From a21cb64a945692eddca7c573d50bea653ad27357 Mon Sep 17 00:00:00 2001
From: Alan Buscaglia <gentlemanprogramming@gmail.com>
Date: Wed, 10 Jun 2026 10:34:50 +0200
Subject: [PATCH 001/126] fix(ui): extend integration poll timeouts to 60s
 (#11519)

---
 ui/CHANGELOG.md                          | 1 +
 ui/actions/integrations/integrations.ts  | 2 +-
 ui/actions/integrations/jira-dispatch.ts | 2 +-
 3 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 49e6ddf9f0..a3d12493d6 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -54,6 +54,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 - Compliance page now loads the most recent scan when opened from the sidebar instead of showing the "no compliance data available" alert [(#11374)](https://github.com/prowler-cloud/prowler/pull/11374)
 - Invitation links now show specific expired, no-longer-valid, and invalid-token messages based on API error responses [(#11376)](https://github.com/prowler-cloud/prowler/pull/11376)
+- Jira dispatch and provider connection-test polling no longer show a false timeout for longer-running tasks; both poll windows now extend to 60 seconds [(#11519)](https://github.com/prowler-cloud/prowler/pull/11519)
 
 ### 🔐 Security
 
diff --git a/ui/actions/integrations/integrations.ts b/ui/actions/integrations/integrations.ts
index 40084a0da1..8945842fe4 100644
--- a/ui/actions/integrations/integrations.ts
+++ b/ui/actions/integrations/integrations.ts
@@ -286,7 +286,7 @@ const pollTaskUntilComplete = async (
   taskId: string,
 ): Promise<PollConnectionResult> => {
   const settled = await pollTaskUntilSettled<ConnectionTaskResult>(taskId, {
-    maxAttempts: 10,
+    maxAttempts: 20,
     delayMs: 3000,
   });
 
diff --git a/ui/actions/integrations/jira-dispatch.ts b/ui/actions/integrations/jira-dispatch.ts
index 72bfc1176d..9e3b25679f 100644
--- a/ui/actions/integrations/jira-dispatch.ts
+++ b/ui/actions/integrations/jira-dispatch.ts
@@ -148,7 +148,7 @@ export const pollJiraDispatchTask = async (
   { success: true; message: string } | { success: false; error: string }
 > => {
   const res = await pollTaskUntilSettled(taskId, {
-    maxAttempts: 10,
+    maxAttempts: 30,
     delayMs: 2000,
   });
   if (!res.ok) {

From 4a5a49b5bb0c57af8bf6ceec9bdf40fa56d7ee59 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Wed, 10 Jun 2026 10:55:31 +0200
Subject: [PATCH 002/126] fix(api): store and refresh Resource.name on every
 scan (#11476)

Co-authored-by: Josema Camacho <josema@prowler.com>
---
 api/CHANGELOG.md                         |  1 +
 api/src/backend/tasks/jobs/scan.py       |  9 +++
 api/src/backend/tasks/tests/test_scan.py | 73 ++++++++++++++++++++++++
 3 files changed, 83 insertions(+)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index dc404079ec..ab40743b36 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -17,6 +17,7 @@ All notable changes to the **Prowler API** are documented in this file.
 ### 🐞 Fixed
 
 - Workers now shut down gracefully on deploy or restart, finishing or re-queueing in-flight tasks instead of being force-killed and leaving them stuck [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
+- Resource `name` is now stored and refreshed on every scan, so resources no longer keep an empty name [(#11476)](https://github.com/prowler-cloud/prowler/pull/11476)
 
 ### 🔐 Security
 
diff --git a/api/src/backend/tasks/jobs/scan.py b/api/src/backend/tasks/jobs/scan.py
index db5018db90..ded3ee57dc 100644
--- a/api/src/backend/tasks/jobs/scan.py
+++ b/api/src/backend/tasks/jobs/scan.py
@@ -269,6 +269,7 @@ def _store_resources(
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
+                "name": finding.resource_name,
                 "region": finding.region,
                 "service": finding.service_name,
                 "type": finding.resource_type,
@@ -276,6 +277,7 @@ def _store_resources(
         )
 
         if not created:
+            resource_instance.name = finding.resource_name
             resource_instance.region = finding.region
             resource_instance.service = finding.service_name
             resource_instance.type = finding.resource_type
@@ -704,6 +706,12 @@ def _process_finding_micro_batch(
                     if finding.region and resource_instance.region != finding.region:
                         resource_instance.region = finding.region
                         updated = True
+                    if (
+                        finding.resource_name
+                        and resource_instance.name != finding.resource_name
+                    ):
+                        resource_instance.name = finding.resource_name
+                        updated = True
                     if resource_instance.service != finding.service_name:
                         resource_instance.service = finding.service_name
                         updated = True
@@ -945,6 +953,7 @@ def _process_finding_micro_batch(
                         Resource.objects.bulk_update(
                             resources_to_bulk_update,
                             [
+                                "name",
                                 "metadata",
                                 "details",
                                 "partition",
diff --git a/api/src/backend/tasks/tests/test_scan.py b/api/src/backend/tasks/tests/test_scan.py
index 8d3d0be93a..6961659acf 100644
--- a/api/src/backend/tasks/tests/test_scan.py
+++ b/api/src/backend/tasks/tests/test_scan.py
@@ -315,6 +315,7 @@ class TestPerformScan:
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
+                "name": finding.resource_name,
                 "region": finding.region,
                 "service": finding.service_name,
                 "type": finding.resource_type,
@@ -348,6 +349,7 @@ class TestPerformScan:
 
         resource_instance = MagicMock()
         resource_instance.uid = finding.resource_uid
+        resource_instance.name = "old_name"
         resource_instance.region = "us-west-1"
         resource_instance.service = "old_service"
         resource_instance.type = "old_type"
@@ -366,6 +368,7 @@ class TestPerformScan:
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
+                "name": finding.resource_name,
                 "region": finding.region,
                 "service": finding.service_name,
                 "type": finding.resource_type,
@@ -373,6 +376,7 @@ class TestPerformScan:
         )
 
         # Check that resource fields were updated
+        assert resource_instance.name == finding.resource_name
         assert resource_instance.region == finding.region
         assert resource_instance.service == finding.service_name
         assert resource_instance.type == finding.resource_type
@@ -1565,6 +1569,75 @@ class TestProcessFindingMicroBatch:
         assert resource_cache[finding.resource_uid].service == finding.service_name
         assert tag_cache.keys() == {("team", "devsec")}
 
+    def test_process_finding_micro_batch_refreshes_empty_resource_name(
+        self, tenants_fixture, scans_fixture
+    ):
+        tenant = tenants_fixture[0]
+        scan = scans_fixture[0]
+        provider = scan.provider
+
+        # Old resource stored before names were persisted: empty name.
+        existing_resource = Resource.objects.create(
+            tenant_id=tenant.id,
+            provider=provider,
+            uid="arn:aws:s3:::my-bucket",
+            name="",
+            region="us-east-1",
+            service="s3",
+            type="bucket",
+        )
+
+        finding = FakeFinding(
+            uid="finding-empty-name",
+            status=StatusChoices.PASS,
+            status_extended="passing",
+            severity=Severity.low,
+            check_id="s3_bucket_public_access",
+            resource_uid=existing_resource.uid,
+            resource_name="my-bucket",
+            region="us-east-1",
+            service_name="s3",
+            resource_type="bucket",
+            partition="aws",
+            raw={"status": "PASS"},
+            metadata={"source": "prowler"},
+        )
+
+        resource_cache = {existing_resource.uid: existing_resource}
+        tag_cache = {}
+        last_status_cache = {}
+        resource_failed_findings_cache = {existing_resource.uid: 0}
+        unique_resources: set[tuple[str, str]] = set()
+        scan_resource_cache: set[tuple[str, str, str, str]] = set()
+        mute_rules_cache = {}
+        scan_categories_cache: dict[tuple[str, str], dict[str, int]] = {}
+        scan_resource_groups_cache: dict[tuple[str, str], dict[str, int]] = {}
+        group_resources_cache: dict[str, set] = {}
+
+        with (
+            patch("tasks.jobs.scan.rls_transaction", new=noop_rls_transaction),
+            patch("api.db_utils.rls_transaction", new=noop_rls_transaction),
+        ):
+            _process_finding_micro_batch(
+                str(tenant.id),
+                [finding],
+                scan,
+                provider,
+                resource_cache,
+                tag_cache,
+                last_status_cache,
+                resource_failed_findings_cache,
+                unique_resources,
+                scan_resource_cache,
+                mute_rules_cache,
+                scan_categories_cache,
+                scan_resource_groups_cache,
+                group_resources_cache,
+            )
+
+        existing_resource.refresh_from_db()
+        assert existing_resource.name == finding.resource_name
+
     def test_process_finding_micro_batch_skips_long_uid(
         self, tenants_fixture, scans_fixture
     ):

From 01b49f07430c2a1e4b9b82dca2e52d2e173428eb Mon Sep 17 00:00:00 2001
From: StylusFrost <43682773+StylusFrost@users.noreply.github.com>
Date: Wed, 10 Jun 2026 11:16:39 +0200
Subject: [PATCH 003/126] feat(dashboard): render dynamic-provider compliance
 frameworks (#11503)

Co-authored-by: pedrooot <pedromarting3@gmail.com>
---
 dashboard/common_methods.py                   | 180 ++++++++++++++++
 dashboard/compliance/generic.py               |  44 ++++
 dashboard/lib/layouts.py                      |   2 +-
 dashboard/pages/compliance.py                 |  88 +++++---
 dashboard/pages/overview.py                   |   2 +-
 tests/dashboard/__init__.py                   |   0
 tests/dashboard/common_methods_test.py        |  81 +++++++
 tests/dashboard/compliance/__init__.py        |   0
 tests/dashboard/compliance/generic_test.py    | 204 ++++++++++++++++++
 tests/dashboard/pages/__init__.py             |   0
 .../pages/compliance_dispatch_test.py         | 179 +++++++++++++++
 tests/dashboard/pages/conftest.py             |   7 +
 tests/dashboard/pages/scope_columns_test.py   |  60 ++++++
 13 files changed, 814 insertions(+), 33 deletions(-)
 create mode 100644 dashboard/compliance/generic.py
 create mode 100644 tests/dashboard/__init__.py
 create mode 100644 tests/dashboard/common_methods_test.py
 create mode 100644 tests/dashboard/compliance/__init__.py
 create mode 100644 tests/dashboard/compliance/generic_test.py
 create mode 100644 tests/dashboard/pages/__init__.py
 create mode 100644 tests/dashboard/pages/compliance_dispatch_test.py
 create mode 100644 tests/dashboard/pages/conftest.py
 create mode 100644 tests/dashboard/pages/scope_columns_test.py

diff --git a/dashboard/common_methods.py b/dashboard/common_methods.py
index a2f9ffe89b..b9f59513a5 100644
--- a/dashboard/common_methods.py
+++ b/dashboard/common_methods.py
@@ -1538,6 +1538,186 @@ def get_section_container_iso(data, section_1, section_2):
     return html.Div(section_containers, className="compliance-data-layout")
 
 
+def _status_bar(success, failed, classname):
+    """Build the stacked PASS/FAIL bar shown next to an accordion title."""
+    fig = go.Figure(
+        data=[
+            go.Bar(
+                name="Failed",
+                x=[failed],
+                y=[""],
+                orientation="h",
+                marker=dict(color="#e77676"),
+                width=[0.8],
+            ),
+            go.Bar(
+                name="Success",
+                x=[success],
+                y=[""],
+                orientation="h",
+                marker=dict(color="#45cc6e"),
+                width=[0.8],
+            ),
+        ]
+    )
+    fig.update_layout(
+        barmode="stack",
+        margin=dict(l=10, r=10, t=10, b=10),
+        paper_bgcolor="rgba(0,0,0,0)",
+        plot_bgcolor="rgba(0,0,0,0)",
+        showlegend=False,
+        width=350,
+        height=30,
+        xaxis=dict(showticklabels=False, showgrid=False, zeroline=False),
+        yaxis=dict(showticklabels=False, showgrid=False, zeroline=False),
+        annotations=[
+            dict(
+                x=success + failed,
+                y=0,
+                xref="x",
+                yref="y",
+                text=str(success),
+                showarrow=False,
+                font=dict(color="#45cc6e", size=14),
+                xanchor="left",
+                yanchor="middle",
+            ),
+            dict(
+                x=0,
+                y=0,
+                xref="x",
+                yref="y",
+                text=str(failed),
+                showarrow=False,
+                font=dict(color="#e77676", size=14),
+                xanchor="right",
+                yanchor="middle",
+            ),
+        ],
+    )
+    fig.add_annotation(
+        x=failed,
+        y=0.3,
+        text="|",
+        showarrow=False,
+        xanchor="center",
+        yanchor="middle",
+        font=dict(size=20),
+    )
+    return dcc.Graph(figure=fig, config={"staticPlot": True}, className=classname)
+
+
+def get_section_containers_generic(data, section_col, id_col):
+    """Two-level view: section -> requirement id (+ description) -> checks.
+
+    Sorts lexicographically so arbitrary requirement IDs never crash the
+    version-aware sort used by the CIS renderer.
+    """
+    data["STATUS"] = data["STATUS"].apply(map_status_to_icon)
+    data[section_col] = data[section_col].astype(str)
+    data[id_col] = data[id_col].astype(str)
+    data.sort_values(by=[section_col, id_col], inplace=True)
+
+    counts_section = data.groupby([section_col, "STATUS"]).size().unstack(fill_value=0)
+    counts_id = (
+        data.groupby([section_col, id_col, "STATUS"]).size().unstack(fill_value=0)
+    )
+
+    def count(counts, key, emoji):
+        return counts.loc[key, emoji] if emoji in counts.columns else 0
+
+    has_description = "REQUIREMENTS_DESCRIPTION" in data.columns
+    table_cols = ["CHECKID", "STATUS", "REGION", "ACCOUNTID", "RESOURCEID"]
+
+    section_containers = []
+    for section in data[section_col].unique():
+        graph_div = html.Div(
+            _status_bar(
+                count(counts_section, section, pass_emoji),
+                count(counts_section, section, fail_emoji),
+                "info-bar",
+            ),
+            className="graph-section",
+        )
+
+        internal_items = []
+        for req_id in data[data[section_col] == section][id_col].unique():
+            specific_data = data[
+                (data[section_col] == section) & (data[id_col] == req_id)
+            ]
+            data_table = dash_table.DataTable(
+                data=specific_data.to_dict("records"),
+                columns=[
+                    {"name": i, "id": i}
+                    for i in table_cols
+                    if i in specific_data.columns
+                ],
+                style_table={"overflowX": "auto"},
+                style_as_list_view=True,
+                style_cell={"textAlign": "left", "padding": "5px"},
+            )
+            graph_div_req = html.Div(
+                _status_bar(
+                    count(counts_id, (section, req_id), pass_emoji),
+                    count(counts_id, (section, req_id), fail_emoji),
+                    "info-bar-child",
+                ),
+                className="graph-section-req",
+            )
+
+            title = req_id
+            if has_description:
+                title = (
+                    f"{req_id} - {specific_data['REQUIREMENTS_DESCRIPTION'].iloc[0]}"
+                )
+            if len(title) > 130:
+                title = title[:130] + " ..."
+
+            internal_items.append(
+                html.Div(
+                    [
+                        graph_div_req,
+                        dbc.Accordion(
+                            [
+                                dbc.AccordionItem(
+                                    title=title,
+                                    children=[
+                                        html.Div(
+                                            [data_table],
+                                            className="inner-accordion-content",
+                                        )
+                                    ],
+                                )
+                            ],
+                            start_collapsed=True,
+                            flush=True,
+                        ),
+                    ],
+                    className="accordion-inner--child",
+                )
+            )
+
+        section_containers.append(
+            html.Div(
+                [
+                    graph_div,
+                    dbc.Accordion(
+                        [
+                            dbc.AccordionItem(
+                                title=f"{section}", children=internal_items
+                            )
+                        ],
+                        start_collapsed=True,
+                        flush=True,
+                    ),
+                ],
+                className="accordion-inner",
+            )
+        )
+
+    return html.Div(section_containers, className="compliance-data-layout")
+
+
 def get_section_containers_format4(data, section_1):
 
     data["STATUS"] = data["STATUS"].apply(map_status_to_icon)
diff --git a/dashboard/compliance/generic.py b/dashboard/compliance/generic.py
new file mode 100644
index 0000000000..f7d68bb52a
--- /dev/null
+++ b/dashboard/compliance/generic.py
@@ -0,0 +1,44 @@
+import warnings
+
+from dashboard.common_methods import (
+    get_section_containers_format4,
+    get_section_containers_generic,
+)
+
+warnings.filterwarnings("ignore")
+
+
+def get_table(data):
+    # Discover REQUIREMENTS_ATTRIBUTES_* columns at runtime.
+    attr_cols = [c for c in data.columns if c.startswith("REQUIREMENTS_ATTRIBUTES_")]
+
+    # Section column (in priority order):
+    #   1. REQUIREMENTS_ATTRIBUTES_SECTION — most common convention
+    #   2. First discovered attribute column — covers novel schemas
+    #   3. None — no section, group flat by requirement id
+    if "REQUIREMENTS_ATTRIBUTES_SECTION" in attr_cols:
+        section_col = "REQUIREMENTS_ATTRIBUTES_SECTION"
+    elif attr_cols:
+        section_col = attr_cols[0]
+    else:
+        section_col = None
+
+    base_cols = [
+        "REQUIREMENTS_ID",
+        "REQUIREMENTS_DESCRIPTION",
+        "STATUS",
+        "CHECKID",
+        "REGION",
+        "ACCOUNTID",
+        "RESOURCEID",
+    ]
+
+    # Two levels (section -> requirement id) when a section distinct from the
+    # id exists; otherwise group flat by requirement id.
+    if section_col and section_col != "REQUIREMENTS_ID":
+        needed = [section_col] + base_cols
+        aux = data[[c for c in needed if c in data.columns]].copy()
+        return get_section_containers_generic(aux, section_col, "REQUIREMENTS_ID")
+
+    aux = data[[c for c in base_cols if c in data.columns]].copy()
+    return get_section_containers_format4(aux, "REQUIREMENTS_ID")
diff --git a/dashboard/lib/layouts.py b/dashboard/lib/layouts.py
index 930432b6c4..3fb230f314 100644
--- a/dashboard/lib/layouts.py
+++ b/dashboard/lib/layouts.py
@@ -156,7 +156,7 @@ def create_layout_compliance(
                             html.Img(src="assets/favicon.ico", className="w-5 mr-3"),
                             html.Span("Subscribe to Prowler Cloud"),
                         ],
-                        href="https://prowler.pro/",
+                        href="https://cloud.prowler.com/",
                         target="_blank",
                         className="text-prowler-stone-900 inline-flex px-4 py-2 text-xs font-bold uppercase transition-all rounded-lg text-gray-900 hover:bg-prowler-stone-900/10 border-solid border-1 hover:border-prowler-stone-900/10 hover:border-solid hover:border-1 border-prowler-stone-900/10",
                     ),
diff --git a/dashboard/pages/compliance.py b/dashboard/pages/compliance.py
index c1da9f611e..773dd095da 100644
--- a/dashboard/pages/compliance.py
+++ b/dashboard/pages/compliance.py
@@ -215,6 +215,58 @@ else:
     )
 
 
+def _ensure_scope_columns(data):
+    """Guarantee ACCOUNTID and REGION exist.
+
+    Scope columns always sit between DESCRIPTION and ASSESSMENTDATE, so derive
+    them positionally for any provider (e.g. Okta's ORGANIZATIONDOMAIN) and
+    fall back to "-" to avoid a KeyError.
+    """
+    cols = list(data.columns)
+    scope = []
+    if "DESCRIPTION" in cols and "ASSESSMENTDATE" in cols:
+        start, end = cols.index("DESCRIPTION") + 1, cols.index("ASSESSMENTDATE")
+        scope = [c for c in cols[start:end] if c not in ("ACCOUNTID", "REGION")]
+
+    if "ACCOUNTID" not in data.columns:
+        if scope:
+            data.rename(columns={scope.pop(0): "ACCOUNTID"}, inplace=True)
+        else:
+            data["ACCOUNTID"] = "-"
+    if "REGION" not in data.columns:
+        if scope:
+            data.rename(columns={scope.pop(0): "REGION"}, inplace=True)
+        else:
+            data["REGION"] = "-"
+    return data
+
+
+def _dispatch_compliance_renderer(data, analytics_input):
+    """Resolve the compliance renderer module and return (table, deduped_data).
+
+    Tries to import the framework-specific builtin module.  On
+    ModuleNotFoundError (dynamic/external provider with no dedicated module),
+    falls back to the generic renderer.  Any other ImportError is re-raised.
+    get_table() is called OUTSIDE the try block so errors inside the renderer
+    surface as real exceptions rather than being swallowed.
+    """
+    current = analytics_input.replace(".", "_")
+    target = f"dashboard.compliance.{current}"
+    try:
+        module = importlib.import_module(target)
+    except ModuleNotFoundError as exc:
+        if exc.name != target:
+            raise
+        from dashboard.compliance import generic as module
+    dedup_columns = ["CHECKID", "STATUS", "RESOURCEID", "STATUSEXTENDED"]
+    if "MUTED" in data.columns:
+        dedup_columns.insert(2, "MUTED")
+    data = data.drop_duplicates(subset=dedup_columns)
+    if "threatscore" in analytics_input:
+        data = get_threatscore_mean_by_pillar(data)
+    return module.get_table(data), data
+
+
 @callback(
     [
         Output("output", "children"),
@@ -292,7 +344,7 @@ def display_data(
         data.rename(columns={"TENANCYID": "ACCOUNTID"}, inplace=True)
 
     # Filter the chosen level of the CIS
-    if is_level_1:
+    if is_level_1 and "REQUIREMENTS_ATTRIBUTES_PROFILE" in data.columns:
         data = data[data["REQUIREMENTS_ATTRIBUTES_PROFILE"].str.contains("Level 1")]
 
     # Rename the column PROJECTID to ACCOUNTID for GCP
@@ -314,6 +366,9 @@ def display_data(
         data.rename(columns={"SUBSCRIPTION": "ACCOUNTID"}, inplace=True)
         data["REGION"] = "-"
 
+    # Normalize scope columns for any remaining (e.g. dynamic) provider.
+    data = _ensure_scope_columns(data)
+
     # Filter ACCOUNT
     if account_filter == ["All"]:
         updated_cloud_account_values = data["ACCOUNTID"].unique()
@@ -409,36 +464,7 @@ def display_data(
         # Check cases where the compliance start with AWS_
         if "aws_" in analytics_input:
             analytics_input = analytics_input + "_aws"
-        try:
-            current = analytics_input.replace(".", "_")
-            compliance_module = importlib.import_module(
-                f"dashboard.compliance.{current}"
-            )
-            # Build subset list based on available columns
-            dedup_columns = ["CHECKID", "STATUS", "RESOURCEID", "STATUSEXTENDED"]
-            if "MUTED" in data.columns:
-                dedup_columns.insert(2, "MUTED")
-            data = data.drop_duplicates(subset=dedup_columns)
-
-            if "threatscore" in analytics_input:
-                data = get_threatscore_mean_by_pillar(data)
-
-            table = compliance_module.get_table(data)
-        except ModuleNotFoundError:
-            table = html.Div(
-                [
-                    html.H5(
-                        "No data found for this compliance",
-                        className="card-title",
-                        style={"text-align": "left", "color": "black"},
-                    )
-                ],
-                style={
-                    "width": "99%",
-                    "margin-right": "0.8%",
-                    "margin-bottom": "10px",
-                },
-            )
+        table, data = _dispatch_compliance_renderer(data, analytics_input)
 
         df = data.copy()
         # Remove Muted rows
diff --git a/dashboard/pages/overview.py b/dashboard/pages/overview.py
index 665aa8e195..e705f15e9f 100644
--- a/dashboard/pages/overview.py
+++ b/dashboard/pages/overview.py
@@ -1538,7 +1538,7 @@ def filter_data(
                     html.Img(src="assets/favicon.ico", className="w-5 mr-3"),
                     html.Span("Subscribe to Prowler Cloud"),
                 ],
-                href="https://prowler.pro/",
+                href="https://cloud.prowler.com/",
                 target="_blank",
                 className="text-prowler-stone-900 inline-flex px-4 py-2 text-xs font-bold uppercase transition-all rounded-lg text-gray-900 hover:bg-prowler-stone-900/10 border-solid border-1 hover:border-prowler-stone-900/10 hover:border-solid hover:border-1 border-prowler-stone-900/10",
             ),
diff --git a/tests/dashboard/__init__.py b/tests/dashboard/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/dashboard/common_methods_test.py b/tests/dashboard/common_methods_test.py
new file mode 100644
index 0000000000..b2137589c5
--- /dev/null
+++ b/tests/dashboard/common_methods_test.py
@@ -0,0 +1,81 @@
+import pandas as pd
+from dash import dash_table
+
+from dashboard.common_methods import get_section_containers_generic
+
+
+def _datatable_column_ids(component):
+    """Collect the column ids of every DataTable in a Dash component tree."""
+    if isinstance(component, dash_table.DataTable):
+        return [[c["id"] for c in component.columns]]
+    children = getattr(component, "children", None)
+    if children is None:
+        return []
+    if not isinstance(children, (list, tuple)):
+        children = [children]
+    return [cols for child in children for cols in _datatable_column_ids(child)]
+
+
+def _df(**extra):
+    data = {
+        "REQUIREMENTS_ID": ["req1"],
+        "STATUS": ["PASS"],
+        "CHECKID": ["check1"],
+        "REGION": ["us-east-1"],
+        "ACCOUNTID": ["123"],
+        "RESOURCEID": ["res1"],
+    }
+    data.update(extra)
+    return pd.DataFrame(data)
+
+
+class TestGetSectionContainersGeneric:
+    def test_one_container_per_section(self):
+        """One outer container per distinct section value."""
+        df = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec A", "Sec B"],
+                "REQUIREMENTS_ID": ["req1", "req2", "req3"],
+                "STATUS": ["PASS", "FAIL", "PASS"],
+                "CHECKID": ["c1", "c2", "c3"],
+                "REGION": ["-"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+                "RESOURCEID": ["r1", "r2", "r3"],
+            }
+        )
+        result = get_section_containers_generic(
+            df, "REQUIREMENTS_ATTRIBUTES_SECTION", "REQUIREMENTS_ID"
+        )
+        assert len(result.children) == 2
+
+    def test_inner_title_includes_id_and_description(self):
+        """Inner accordion title is '<id> - <description>'."""
+        df = _df(
+            REQUIREMENTS_ATTRIBUTES_SECTION=["Sec A"],
+            REQUIREMENTS_DESCRIPTION=["Ensure MFA"],
+        )
+        rendered = str(
+            get_section_containers_generic(
+                df, "REQUIREMENTS_ATTRIBUTES_SECTION", "REQUIREMENTS_ID"
+            )
+        )
+        assert "req1 - Ensure MFA" in rendered
+
+    def test_arbitrary_ids_do_not_crash(self):
+        """Non-numeric ids are sorted lexicographically without raising."""
+        df = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A"] * 3,
+                "REQUIREMENTS_ID": ["AC-2(1)", "foo-bar", "step.1.2"],
+                "STATUS": ["PASS", "FAIL", "PASS"],
+                "CHECKID": ["c1", "c2", "c3"],
+                "REGION": ["-"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+                "RESOURCEID": ["r1", "r2", "r3"],
+            }
+        )
+        result = get_section_containers_generic(
+            df, "REQUIREMENTS_ATTRIBUTES_SECTION", "REQUIREMENTS_ID"
+        )
+        tables = _datatable_column_ids(result)
+        assert tables and all("CHECKID" in cols for cols in tables)
diff --git a/tests/dashboard/compliance/__init__.py b/tests/dashboard/compliance/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/dashboard/compliance/generic_test.py b/tests/dashboard/compliance/generic_test.py
new file mode 100644
index 0000000000..4e36833ada
--- /dev/null
+++ b/tests/dashboard/compliance/generic_test.py
@@ -0,0 +1,204 @@
+import pandas as pd
+from dash import dash_table, html
+
+from dashboard.compliance.generic import get_table
+
+
+def _make_minimal_df(**extra_cols):
+    """Create a minimal valid DataFrame for get_table tests."""
+    data = {
+        "REQUIREMENTS_ID": ["req1"],
+        "STATUS": ["PASS"],
+        "CHECKID": ["check1"],
+        "REGION": ["us-east-1"],
+        "ACCOUNTID": ["123456789"],
+        "RESOURCEID": ["res1"],
+    }
+    data.update(extra_cols)
+    return pd.DataFrame(data)
+
+
+def _datatable_column_ids(component):
+    """Collect the column ids of every DataTable in a Dash component tree."""
+    if isinstance(component, dash_table.DataTable):
+        return [[c["id"] for c in component.columns]]
+    children = getattr(component, "children", None)
+    if children is None:
+        return []
+    if not isinstance(children, (list, tuple)):
+        children = [children]
+    return [cols for child in children for cols in _datatable_column_ids(child)]
+
+
+class TestGetTable:
+    def test_groups_by_section(self):
+        """SC-001a: df with REQUIREMENTS_ATTRIBUTES_SECTION returns Div grouped by section."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": [
+                    "Section A",
+                    "Section A",
+                    "Section A",
+                    "Section B",
+                    "Section B",
+                ],
+                "REQUIREMENTS_ID": [
+                    "ctrl-alpha",
+                    "ctrl-alpha",
+                    "ctrl-alpha",
+                    "ctrl-beta",
+                    "ctrl-beta",
+                ],
+                "STATUS": ["PASS", "FAIL", "PASS", "FAIL", "FAIL"],
+                "CHECKID": ["check1", "check2", "check3", "check4", "check5"],
+                "REGION": ["us-east-1"] * 5,
+                "ACCOUNTID": ["123"] * 5,
+                "RESOURCEID": ["res1", "res2", "res3", "res4", "res5"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert result.className == "compliance-data-layout"
+        assert len(result.children) == 2  # one container per distinct section
+
+    def test_flat_fallback_no_attributes(self):
+        """SC-001b: No REQUIREMENTS_ATTRIBUTES_* cols → grouped by REQUIREMENTS_ID."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ID": ["req1", "req1", "req2"],
+                "STATUS": ["PASS", "FAIL", "FAIL"],
+                "CHECKID": ["check1", "check2", "check3"],
+                "REGION": ["us-east-1"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+                "RESOURCEID": ["res1", "res2", "res3"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert result.className == "compliance-data-layout"
+        # 2 distinct REQUIREMENTS_ID values → 2 group containers
+        assert len(result.children) == 2
+
+    def test_arbitrary_ids_no_crash(self):
+        """ADR-2 / R1 regression guard: non-numeric REQUIREMENTS_IDs must not raise ValueError.
+
+        get_section_containers_cis sorts by version_tuple which calls int() on each
+        dotted/dashed segment and crashes on IDs like 'AC-2(1)'. Selecting format4
+        (no version sort) is the fix. This test is a permanent guard against regression.
+        """
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ID": ["AC-2(1)", "foo-bar", "step.1.2"],
+                "STATUS": ["PASS", "FAIL", "PASS"],
+                "CHECKID": ["check1", "check2", "check3"],
+                "REGION": ["us-east-1"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+                "RESOURCEID": ["res1", "res2", "res3"],
+            }
+        )
+        # Must not raise ValueError
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+
+    def test_discovers_multiple_attribute_columns(self):
+        """SC-005a: Multiple REQUIREMENTS_ATTRIBUTES_* cols present → no AttributeError;
+        component tree is non-empty."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec B"],
+                "REQUIREMENTS_ATTRIBUTES_CATEGORY": ["Cat 1", "Cat 2"],
+                "REQUIREMENTS_ATTRIBUTES_CONTROL_ID": ["C1", "C2"],
+                "REQUIREMENTS_ID": ["req1", "req2"],
+                "STATUS": ["PASS", "FAIL"],
+                "CHECKID": ["check1", "check2"],
+                "REGION": ["us-east-1"] * 2,
+                "ACCOUNTID": ["123"] * 2,
+                "RESOURCEID": ["res1", "res2"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert result.children  # non-empty component tree
+
+    def test_novel_attribute_column_names(self):
+        """SC-005b: Novel attr col names without a SECTION col → first attr col used as
+        grouping; returns a valid html.Div without any code change required."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_DOMAIN": ["Domain A", "Domain B"],
+                "REQUIREMENTS_ATTRIBUTES_SUBDOMAIN": ["Sub 1", "Sub 2"],
+                "REQUIREMENTS_ID": ["req1", "req2"],
+                "STATUS": ["PASS", "FAIL"],
+                "CHECKID": ["check1", "check2"],
+                "REGION": ["us-east-1"] * 2,
+                "ACCOUNTID": ["123"] * 2,
+                "RESOURCEID": ["res1", "res2"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert len(result.children) > 0
+
+    def test_manual_only_requirements(self):
+        """SC-008a: All rows have STATUS='MANUAL' → returns html.Div with non-empty
+        children; result is not the 'No data found' string."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec B"],
+                "REQUIREMENTS_ID": ["req1", "req2"],
+                "STATUS": ["MANUAL", "MANUAL"],
+                "CHECKID": ["check1", "check2"],
+                "REGION": ["us-east-1"] * 2,
+                "ACCOUNTID": ["123"] * 2,
+                "RESOURCEID": ["res1", "res2"],
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+        assert not isinstance(result, str)
+        assert result.children  # non-empty
+
+    def test_empty_dataframe(self):
+        """SC-009a: Zero rows with correct column schema → valid html.Div; no exception."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": pd.Series([], dtype=str),
+                "REQUIREMENTS_ID": pd.Series([], dtype=str),
+                "STATUS": pd.Series([], dtype=str),
+                "CHECKID": pd.Series([], dtype=str),
+                "REGION": pd.Series([], dtype=str),
+                "ACCOUNTID": pd.Series([], dtype=str),
+                "RESOURCEID": pd.Series([], dtype=str),
+            }
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+
+    def test_get_table_returns_html_div(self):
+        """SC-012a: Smoke test — isinstance(get_table(df), html.Div) is True."""
+        data = _make_minimal_df(
+            REQUIREMENTS_ATTRIBUTES_SECTION=["Sec A"],
+        )
+        result = get_table(data)
+        assert isinstance(result, html.Div)
+
+
+class TestNestedRendering:
+    def test_section_and_requirement_id_are_separate_levels(self):
+        """Section is the outer level; requirement id + description the inner."""
+        data = _make_minimal_df(
+            REQUIREMENTS_ATTRIBUTES_SECTION=["3 Compute Services"],
+            REQUIREMENTS_DESCRIPTION=["Ensure only MFA enabled identities"],
+        )
+        rendered = str(get_table(data))
+        assert "3 Compute Services" in rendered
+        assert "req1 - Ensure only MFA enabled identities" in rendered
+
+    def test_checks_table_is_nested_under_requirement(self):
+        """The checks table sits at the innermost level."""
+        data = _make_minimal_df(
+            REQUIREMENTS_ATTRIBUTES_SECTION=["Sec A"],
+            REQUIREMENTS_DESCRIPTION=["Some requirement"],
+        )
+        tables = _datatable_column_ids(get_table(data))
+        assert tables and all("CHECKID" in cols for cols in tables)
diff --git a/tests/dashboard/pages/__init__.py b/tests/dashboard/pages/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/dashboard/pages/compliance_dispatch_test.py b/tests/dashboard/pages/compliance_dispatch_test.py
new file mode 100644
index 0000000000..78bd88ce68
--- /dev/null
+++ b/tests/dashboard/pages/compliance_dispatch_test.py
@@ -0,0 +1,179 @@
+from unittest.mock import MagicMock, patch
+
+import pandas as pd
+import pytest
+from dash import html
+
+from dashboard.pages.compliance import _dispatch_compliance_renderer
+
+
+def _make_dispatch_df(**extra_cols):
+    """Minimal DataFrame with the columns required by the dedup step."""
+    data = {
+        "REQUIREMENTS_ID": ["req1", "req2"],
+        "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec A"],
+        "STATUS": ["PASS", "FAIL"],
+        "CHECKID": ["check1", "check2"],
+        "RESOURCEID": ["res1", "res2"],
+        "STATUSEXTENDED": ["", ""],
+        "REGION": ["us-east-1", "us-east-1"],
+        "ACCOUNTID": ["123456789", "123456789"],
+    }
+    data.update(extra_cols)
+    return pd.DataFrame(data)
+
+
+class TestDispatchComplianceRenderer:
+    def test_builtin_name_uses_builtin_module(self):
+        """SC-002a: analytics_input='cis_4_0_aws' resolves real builtin module;
+        returns (html.Div, DataFrame) 2-tuple."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ID": ["1.1", "1.2"],
+                "REQUIREMENTS_DESCRIPTION": ["Description 1", "Description 2"],
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Section A", "Section A"],
+                "CHECKID": ["check1", "check2"],
+                "STATUS": ["PASS", "FAIL"],
+                "REGION": ["us-east-1", "us-east-1"],
+                "ACCOUNTID": ["123456789", "123456789"],
+                "RESOURCEID": ["res1", "res2"],
+                "STATUSEXTENDED": ["Pass", "Fail"],
+            }
+        )
+        table, result_data = _dispatch_compliance_renderer(data, "cis_4_0_aws")
+        assert isinstance(table, html.Div)
+        assert isinstance(result_data, pd.DataFrame)
+
+    def test_unknown_name_falls_back_to_generic(self):
+        """SC-003a: Unknown analytics_input raises ModuleNotFoundError → generic
+        fallback is called with the deduped dataframe."""
+        data = _make_dispatch_df()
+        sentinel = MagicMock(
+            return_value=html.Div([], className="compliance-data-layout")
+        )
+
+        with patch("dashboard.compliance.generic.get_table", sentinel):
+            table, result_data = _dispatch_compliance_renderer(data, "myfw_dynprovider")
+
+        sentinel.assert_called_once()
+        assert isinstance(table, html.Div)
+        assert isinstance(result_data, pd.DataFrame)
+
+    def test_import_error_is_not_swallowed(self):
+        """SC-003b: ImportError (NOT ModuleNotFoundError) is re-raised; except clause
+        is exact — only ModuleNotFoundError routes to generic."""
+        data = _make_dispatch_df()
+
+        with patch(
+            "dashboard.pages.compliance.importlib.import_module",
+            side_effect=ImportError("custom error"),
+        ):
+            with pytest.raises(ImportError, match="custom error"):
+                _dispatch_compliance_renderer(data, "anything")
+
+    def test_get_table_error_in_generic_surfaces(self):
+        """SC-004a: ValueError from generic.get_table propagates (not swallowed);
+        get_table is called OUTSIDE the try block."""
+        data = _make_dispatch_df()
+
+        with patch(
+            "dashboard.compliance.generic.get_table",
+            side_effect=ValueError("boom"),
+        ):
+            with pytest.raises(ValueError, match="boom"):
+                _dispatch_compliance_renderer(data, "myfw_dynprovider")
+
+    def test_get_table_error_in_builtin_surfaces(self):
+        """REQ-004 / ADR-1: RuntimeError from a builtin get_table propagates;
+        proving get_table is called outside the try block."""
+        data = _make_dispatch_df()
+        mock_module = MagicMock()
+        mock_module.get_table.side_effect = RuntimeError("table error")
+
+        with patch(
+            "dashboard.pages.compliance.importlib.import_module",
+            return_value=mock_module,
+        ):
+            with pytest.raises(RuntimeError, match="table error"):
+                _dispatch_compliance_renderer(data, "some_builtin_fw")
+
+    def test_dedup_applied_before_get_table(self):
+        """ADR-1: Duplicate rows (identical CHECKID/STATUS/RESOURCEID/STATUSEXTENDED)
+        are dropped; returned data has the deduplicated row count."""
+        # Row 0 and row 1 are identical in all dedup-key columns; row 2 is unique.
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec A", "Sec B"],
+                "REQUIREMENTS_ID": ["req1", "req1", "req2"],
+                "STATUS": ["PASS", "PASS", "FAIL"],
+                "CHECKID": ["check1", "check1", "check2"],
+                "RESOURCEID": ["res1", "res1", "res2"],
+                "STATUSEXTENDED": ["", "", ""],
+                "REGION": ["us-east-1"] * 3,
+                "ACCOUNTID": ["123"] * 3,
+            }
+        )
+        mock_module = MagicMock()
+        mock_module.get_table.return_value = html.Div([])
+
+        with patch(
+            "dashboard.pages.compliance.importlib.import_module",
+            return_value=mock_module,
+        ):
+            table, result_data = _dispatch_compliance_renderer(data, "some_fw")
+
+        assert len(result_data) == 2  # one duplicate removed
+
+    def test_muted_column_added_to_dedup_when_present(self):
+        """ADR-1 edge case: When MUTED column is present, it is included in the dedup
+        subset at index 2; rows differing only in MUTED are kept as distinct rows."""
+        # Both rows share CHECKID/STATUS/RESOURCEID/STATUSEXTENDED but differ in MUTED.
+        # With MUTED in dedup_columns, both rows are kept (2 rows after dedup).
+        # Without MUTED in dedup_columns, they would be collapsed to 1 row.
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Sec A", "Sec A"],
+                "REQUIREMENTS_ID": ["req1", "req1"],
+                "STATUS": ["PASS", "PASS"],
+                "CHECKID": ["check1", "check1"],
+                "RESOURCEID": ["res1", "res1"],
+                "STATUSEXTENDED": ["", ""],
+                "MUTED": ["True", "False"],
+                "REGION": ["us-east-1", "us-east-1"],
+                "ACCOUNTID": ["123", "123"],
+            }
+        )
+        mock_module = MagicMock()
+        mock_module.get_table.return_value = html.Div([])
+
+        with patch(
+            "dashboard.pages.compliance.importlib.import_module",
+            return_value=mock_module,
+        ):
+            table, result_data = _dispatch_compliance_renderer(data, "some_fw")
+
+        # MUTED at idx 2 means these two rows have different dedup keys → both kept
+        assert len(result_data) == 2
+
+    def test_returns_table_and_data_tuple(self):
+        """ADR-1 interface contract: _dispatch_compliance_renderer returns a
+        2-tuple (table, deduped_data)."""
+        data = pd.DataFrame(
+            {
+                "REQUIREMENTS_ID": ["1.1", "1.2"],
+                "REQUIREMENTS_DESCRIPTION": ["Desc 1", "Desc 2"],
+                "REQUIREMENTS_ATTRIBUTES_SECTION": ["Section A", "Section A"],
+                "CHECKID": ["check1", "check2"],
+                "STATUS": ["PASS", "FAIL"],
+                "REGION": ["us-east-1", "us-east-1"],
+                "ACCOUNTID": ["123456789", "123456789"],
+                "RESOURCEID": ["res1", "res2"],
+                "STATUSEXTENDED": ["", ""],
+            }
+        )
+        result = _dispatch_compliance_renderer(data, "cis_4_0_aws")
+        assert isinstance(result, tuple)
+        assert len(result) == 2
+        table, deduped_data = result
+        assert isinstance(table, html.Div)
+        assert isinstance(deduped_data, pd.DataFrame)
diff --git a/tests/dashboard/pages/conftest.py b/tests/dashboard/pages/conftest.py
new file mode 100644
index 0000000000..a5c674c7de
--- /dev/null
+++ b/tests/dashboard/pages/conftest.py
@@ -0,0 +1,7 @@
+import dash
+
+# Initialize a minimal Dash app so that dashboard page modules can call
+# dash.register_page() during import without raising PageError.
+# This module-level initialization runs during pytest collection, before
+# any test file in this directory is imported.
+_test_app = dash.Dash("prowler_test_app", use_pages=True, pages_folder="")
diff --git a/tests/dashboard/pages/scope_columns_test.py b/tests/dashboard/pages/scope_columns_test.py
new file mode 100644
index 0000000000..a8aea34221
--- /dev/null
+++ b/tests/dashboard/pages/scope_columns_test.py
@@ -0,0 +1,60 @@
+import pandas as pd
+
+from dashboard.pages.compliance import _ensure_scope_columns
+
+
+def _df(columns):
+    """Build a one-row DataFrame preserving the given column order."""
+    return pd.DataFrame({col: ["x"] for col in columns})
+
+
+class TestEnsureScopeColumns:
+    def test_aws_account_and_region_preserved(self):
+        """A provider that already emits ACCOUNTID and REGION is left untouched."""
+        df = _df(["PROVIDER", "DESCRIPTION", "ACCOUNTID", "REGION", "ASSESSMENTDATE"])
+        result = _ensure_scope_columns(df)
+        assert "ACCOUNTID" in result.columns
+        assert "REGION" in result.columns
+        assert result["ACCOUNTID"].iloc[0] == "x"
+
+    def test_okta_single_scope_column_becomes_accountid(self):
+        """Okta's ORGANIZATIONDOMAIN becomes ACCOUNTID; REGION falls back."""
+        df = _df(["PROVIDER", "DESCRIPTION", "ORGANIZATIONDOMAIN", "ASSESSMENTDATE"])
+        df["ORGANIZATIONDOMAIN"] = ["trial-123.okta.com"]
+        result = _ensure_scope_columns(df)
+        assert "ACCOUNTID" in result.columns
+        assert "ORGANIZATIONDOMAIN" not in result.columns
+        assert result["ACCOUNTID"].iloc[0] == "trial-123.okta.com"
+        assert result["REGION"].iloc[0] == "-"
+
+    def test_two_unknown_scope_columns_map_to_account_and_region(self):
+        """Two scope columns map positionally to ACCOUNTID and REGION."""
+        df = _df(["PROVIDER", "DESCRIPTION", "TENANCYID", "LOCATION", "ASSESSMENTDATE"])
+        df["TENANCYID"] = ["tenant-1"]
+        df["LOCATION"] = ["eu-west-1"]
+        result = _ensure_scope_columns(df)
+        assert result["ACCOUNTID"].iloc[0] == "tenant-1"
+        assert result["REGION"].iloc[0] == "eu-west-1"
+
+    def test_no_scope_columns_fall_back_to_dash(self):
+        """No scope columns → both ACCOUNTID and REGION fall back to '-'."""
+        df = _df(["PROVIDER", "DESCRIPTION", "ASSESSMENTDATE"])
+        result = _ensure_scope_columns(df)
+        assert result["ACCOUNTID"].iloc[0] == "-"
+        assert result["REGION"].iloc[0] == "-"
+
+    def test_missing_anchors_still_fall_back_to_dash(self):
+        """Without DESCRIPTION/ASSESSMENTDATE anchors, both fall back to '-'."""
+        df = _df(["PROVIDER", "FOO", "BAR"])
+        result = _ensure_scope_columns(df)
+        assert result["ACCOUNTID"].iloc[0] == "-"
+        assert result["REGION"].iloc[0] == "-"
+
+    def test_existing_accountid_does_not_consume_region_scope(self):
+        """An existing ACCOUNTID is kept; the leftover scope becomes REGION."""
+        df = _df(["PROVIDER", "DESCRIPTION", "ACCOUNTID", "LOCATION", "ASSESSMENTDATE"])
+        df["ACCOUNTID"] = ["acc-1"]
+        df["LOCATION"] = ["us-east-2"]
+        result = _ensure_scope_columns(df)
+        assert result["ACCOUNTID"].iloc[0] == "acc-1"
+        assert result["REGION"].iloc[0] == "us-east-2"

From 61cd4aea3fb74ad33433987435b19f0fb2ef93cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Wed, 10 Jun 2026 11:22:42 +0200
Subject: [PATCH 004/126] feat(compliance): add Okta IDaaS STIG V1R2 framework
 (#11428)

Co-authored-by: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 api/CHANGELOG.md                              |   1 +
 api/src/backend/tasks/jobs/export.py          |   6 +
 prowler/CHANGELOG.md                          |   1 +
 prowler/__main__.py                           |  30 +
 prowler/compliance/okta/__init__.py           |   0
 .../okta/okta_idaas_stig_v1r2_okta.json       | 638 ++++++++++++++++++
 prowler/lib/check/compliance_models.py        |  21 +
 prowler/lib/outputs/compliance/compliance.py  |  12 +
 .../compliance/okta_idaas_stig/__init__.py    |   0
 .../compliance/okta_idaas_stig/models.py      |  32 +
 .../okta_idaas_stig/okta_idaas_stig.py        |  98 +++
 .../okta_idaas_stig/okta_idaas_stig_okta.py   |  95 +++
 .../display_compliance_table_test.py          |   9 +
 tests/lib/outputs/compliance/fixtures.py      |  45 ++
 .../okta_idaas_stig_okta_test.py              | 139 ++++
 ui/CHANGELOG.md                               |   1 +
 .../asd-essential-eight-details.tsx           |   6 +-
 .../aws-well-architected-details.tsx          |   6 +-
 .../compliance-custom-details/ccc-details.tsx |  14 +-
 .../compliance-custom-details/cis-details.tsx |   4 +-
 .../compliance-custom-details/csa-details.tsx |  20 +-
 .../dora-details.tsx                          |   6 +-
 .../compliance-custom-details/ens-details.tsx |   4 +-
 .../generic-details.tsx                       |   6 +-
 .../mitre-details.tsx                         |   8 +-
 .../okta-idaas-stig-details.tsx               |  65 ++
 .../shared-components.tsx                     |  58 +-
 .../threat-details.tsx                        |  10 +-
 .../icons/compliance/IconCompliance.test.ts   |   6 +
 .../icons/compliance/IconCompliance.tsx       |   2 +
 ui/components/icons/compliance/okta.svg       |   1 +
 ui/components/shadcn/badge/badge.test.tsx     |  30 +
 ui/components/shadcn/badge/badge.tsx          |   1 +
 ui/lib/compliance/ccc.tsx                     |   9 +-
 ui/lib/compliance/compliance-mapper.test.ts   |   6 +
 ui/lib/compliance/compliance-mapper.ts        |  14 +
 ui/lib/compliance/csa.tsx                     |   6 +-
 ui/lib/compliance/okta-idaas-stig.tsx         | 163 +++++
 ui/types/compliance.ts                        |  44 ++
 39 files changed, 1521 insertions(+), 96 deletions(-)
 create mode 100644 prowler/compliance/okta/__init__.py
 create mode 100644 prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json
 create mode 100644 prowler/lib/outputs/compliance/okta_idaas_stig/__init__.py
 create mode 100644 prowler/lib/outputs/compliance/okta_idaas_stig/models.py
 create mode 100644 prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
 create mode 100644 prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py
 create mode 100644 tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py
 create mode 100644 ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx
 create mode 100644 ui/components/icons/compliance/okta.svg
 create mode 100644 ui/components/shadcn/badge/badge.test.tsx
 create mode 100644 ui/lib/compliance/okta-idaas-stig.tsx

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index ab40743b36..2033dcc420 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -9,6 +9,7 @@ All notable changes to the **Prowler API** are documented in this file.
 - Opt-in automatic recovery of allowlisted idempotent background tasks whose worker died during a deploy or crash: when enabled via `DJANGO_TASK_RECOVERY_ENABLED` (off by default), stuck summary and deletion tasks are detected and re-run instead of staying pending forever (scan and Jira tasks are excluded), with a `reconcile_orphan_tasks` management command for on-demand recovery [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
 - DORA compliance framework support [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
 - Label Postgres connections with `application_name="<component>:<alias>"` (component injected per process via `DJANGO_APP_COMPONENT`) so connections are attributable by component in `pg_stat_activity` [(#11494)](https://github.com/prowler-cloud/prowler/pull/11494)
+- DISA Okta IDaaS STIG V1R2 compliance framework export support for the Okta provider [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
 
 ### 🔄 Changed
 
diff --git a/api/src/backend/tasks/jobs/export.py b/api/src/backend/tasks/jobs/export.py
index 185acb7f99..96bd03ee6c 100644
--- a/api/src/backend/tasks/jobs/export.py
+++ b/api/src/backend/tasks/jobs/export.py
@@ -58,6 +58,9 @@ from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_azure import (
     AzureMitreAttack,
 )
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_gcp import GCPMitreAttack
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta import (
+    OktaIDaaSSTIG,
+)
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_alibaba import (
     ProwlerThreatScoreAlibaba,
 )
@@ -152,6 +155,9 @@ COMPLIANCE_CLASS_MAP = {
             ProwlerThreatScoreAlibaba,
         ),
     ],
+    "okta": [
+        (lambda name: name.startswith("okta_idaas_stig"), OktaIDaaSSTIG),
+    ],
 }
 
 
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index dcb250d316..c9542d8345 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ### 🚀 Added
 
+- DISA Okta IDaaS STIG V1R2 compliance framework for the Okta provider, with a dedicated CSV output formatter and terminal summary table [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
 - `sagemaker_models_monitor_enabled` check for AWS provider, verifying that each SageMaker monitoring schedule is in the `Scheduled` state so data and model drift is actively detected [(#11278)](https://github.com/prowler-cloud/prowler/pull/11278)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) universal compliance framework with AWS provider coverage across the five DORA pillars [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
 - Okta authenticator and password policy checks for STIG-aligned hardening requirements [(#11465)](https://github.com/prowler-cloud/prowler/pull/11465)
diff --git a/prowler/__main__.py b/prowler/__main__.py
index 6cbaf575d9..703a9e49a0 100644
--- a/prowler/__main__.py
+++ b/prowler/__main__.py
@@ -102,6 +102,9 @@ from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_azure import (
     AzureMitreAttack,
 )
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_gcp import GCPMitreAttack
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta import (
+    OktaIDaaSSTIG,
+)
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_alibaba import (
     ProwlerThreatScoreAlibaba,
 )
@@ -1314,6 +1317,33 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(generic_compliance)
                 generic_compliance.batch_write_data_to_file()
+    elif provider == "okta":
+        for compliance_name in input_compliance_frameworks:
+            if compliance_name.startswith("okta_idaas_stig"):
+                # Generate Okta IDaaS STIG Finding Object
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                okta_idaas_stig = OktaIDaaSSTIG(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(okta_idaas_stig)
+                okta_idaas_stig.batch_write_data_to_file()
+            else:
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                generic_compliance = GenericCompliance(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(generic_compliance)
+                generic_compliance.batch_write_data_to_file()
     else:
         # Dynamic fallback: any external/custom provider
         try:
diff --git a/prowler/compliance/okta/__init__.py b/prowler/compliance/okta/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json b/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json
new file mode 100644
index 0000000000..bac3d9132e
--- /dev/null
+++ b/prowler/compliance/okta/okta_idaas_stig_v1r2_okta.json
@@ -0,0 +1,638 @@
+{
+  "Framework": "Okta-IDaaS-STIG",
+  "Name": "DISA Okta Identity as a Service (IDaaS) STIG V1R2",
+  "Version": "1R2",
+  "Provider": "Okta",
+  "Description": "Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS), Version 1 Release 2 (Benchmark Date: 05 Jan 2026).",
+  "Requirements": [
+    {
+      "Id": "OKTA-APP-000020",
+      "Name": "Okta must log out a session after a 15-minute period of inactivity.",
+      "Description": "A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications must be able to identify when a user's application session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled. This is typically at the operating system level and results in a system lock. However, it may be at the application level where the application interface window is secured instead. Satisfies: SRG-APP-000003, SRG-APP-000190",
+      "Checks": [
+        "signon_global_session_idle_timeout_15min"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273186r1098825_rule",
+          "StigID": "OKTA-APP-000020",
+          "CCI": [
+            "CCI-000057",
+            "CCI-001133"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Global Session Policy. 2. In the Default Policy, verify a rule is configured at Priority 1 that is not named \"Default Rule\". 3. Click the edit icon next to the Priority 1 rule. 4. Verify the \"Maximum Okta global session idle time\" is set to 15 minutes. If \"Maximum Okta global session idle time\" is not set to 15 minutes, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Global Session Policy. 2. Select the Default Policy. 3. In the Rules table, make these updates: - Click \"Add rule\". - Set \"Maximum Okta global session idle time\" to 15 minutes."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000025",
+      "Name": "The Okta Admin Console must log out a session after a 15-minute period of inactivity.",
+      "Description": "A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their application session prior to vacating the vicinity, applications must be able to identify when a user's application session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled. This is typically at the operating system level and results in a system lock. However, it may be at the application level where the application interface window is secured instead.",
+      "Checks": [
+        "application_admin_console_session_idle_timeout_15min"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273187r1098828_rule",
+          "StigID": "OKTA-APP-000025",
+          "CCI": [
+            "CCI-000057"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Applications >> Applications >> Okta Admin Console. 2. In the Sign On tab, under \"Okta Admin Console session\", verify the \"Maximum app session idle time\" is set to 15 minutes. If the \"Maximum app session idle time\" is not set to 15 minutes, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Applications >> Applications >> Okta Admin Console. 2. In the Sign On tab, under \"Okta Admin Console session\", set the \"Maximum app session idle time\" to 15 minutes."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000090",
+      "Name": "Okta must automatically disable accounts after a 35-day period of account inactivity.",
+      "Description": "Attackers that are able to exploit an inactive account can potentially obtain and maintain undetected access to an application. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. Applications must track periods of user inactivity and disable accounts after 35 days of inactivity. Such a process greatly reduces the risk that accounts will be hijacked, leading to a data compromise. To address access requirements, many application developers choose to integrate their applications with enterprise-level authentication/access mechanisms that meet or exceed access control policy requirements. Such integration allows the application developer to off-load those access control functions and focus on core application features and functionality. This policy does not apply to emergency accounts or infrequently used accounts. Infrequently used accounts are local login administrator accounts used by system administrators when network or normal login/access is not available. Emergency accounts are administrator accounts created in response to crisis situations. Satisfies: SRG-APP-000025, SRG-APP-000163, SRG-APP-000700",
+      "Checks": [
+        "user_inactivity_automation_35d_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273188r1098831_rule",
+          "StigID": "OKTA-APP-000090",
+          "CCI": [
+            "CCI-000017",
+            "CCI-000795",
+            "CCI-003627"
+          ],
+          "CheckText": "If Okta Services rely on external directory services for user sourcing, this is not applicable, and the connected directory services must perform this function. Go to Workflows >> Automations and verify that an Automation has been created to disable accounts after 35 days of inactivity. If the Okta configuration does not automatically disable accounts after a 35-day period of account inactivity, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Workflow >> Automations and select \"Add Automation\". 2. Create a name for the Automation (e.g., \"User Inactivity\"). 3. Click \"Add Condition\" and select \"User Inactivity in Okta\". 4. In the duration field, enter 35 days and click \"Save\". 5 Click the edit button next to \"Select Schedule\". 6. Configure the \"Schedule\" field for \"Run Daily\" and set the \"Time\" field to an organizationally defined time to run this automation. Click \"Save\". 7. Click the edit button next to \"Select group membership\". 8. In the \"Applies to\" field, select the group \"Everyone\" by typing it into the field. Click \"Save\". 9. Click \"Add Action\" and select \"Change User lifecycle state in Okta\". 10. In the \"Change user state to\" field, select \"Suspended\" and click \"Save\". 11. Click the \"Inactive\" button near the top of the section screen and select \"Activate\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000170",
+      "Name": "Okta must enforce the limit of three consecutive invalid login attempts by a user during a 15-minute time period.",
+      "Description": "By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account. Satisfies: SRG-APP-000065, SRG-APP-000345",
+      "Checks": [
+        "authenticator_password_lockout_threshold_3"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273189r1098834_rule",
+          "StigID": "OKTA-APP-000170",
+          "CCI": [
+            "CCI-000044",
+            "CCI-002238"
+          ],
+          "CheckText": "If Okta Services rely on external directory services for user sourcing, this check is not applicable, and the connected directory services must perform this function. From the Admin Console: 1. Go to Security >> Authenticators. 2. Click the \"Actions\" button next to \"Password\" and select \"Edit\". 3. For each Password Policy, verify the \"Lock Out\" section has the following values: - \"Lock out after 3 unsuccessful attempts\" is checked. - The value is set to \"3\". If Okta Services are not configured to automatically lock user accounts after three consecutive invalid login attempts, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. Click the \"Actions\" button next to \"Password\" and select \"Edit\". 3. For each Password Policy, ensure the \"Lock Out\" section has the following values: - \"Lock out after 3 unsuccessful attempts\" is checked. - The value is set to \"3\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000180",
+      "Name": "The Okta Dashboard application must be configured to allow authentication only via non-phishable authenticators.",
+      "Description": "Requiring the use of non-phishable authenticators protects against brute force/password dictionary attacks. This provides a better level of security while removing the need to lock out accounts after three attempts in 15 minutes.",
+      "Checks": [
+        "application_dashboard_phishing_resistant_authentication"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273190r1099763_rule",
+          "StigID": "OKTA-APP-000180",
+          "CCI": [
+            "CCI-000044"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Dashboard\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"Possession factor constraints are\" section, verify the \"Phishing resistant\" box is checked. This will ensure that only phishing-resistant factors are used to access the Okta Dashboard. If in the \"Possession factor constraints are\" section the \"Phishing resistant\" box is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Dashboard\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"Possession factor constraints are\" section, ensure the \"Phishing resistant\" box is checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000190",
+      "Name": "The Okta Admin Console application must be configured to allow authentication only via non-phishable authenticators.",
+      "Description": "Requiring the use of non-phishable authenticators protects against brute force/password dictionary attacks. This provides a better level of security while removing the need to lock out accounts after three attempts in 15 minutes.",
+      "Checks": [
+        "application_admin_console_phishing_resistant_authentication"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273191r1099764_rule",
+          "StigID": "OKTA-APP-000190",
+          "CCI": [
+            "CCI-000044"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Admin Console\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"Possession factor constraints are\" section, verify the \"Phishing resistant\" box is checked. This will ensure that only phishing-resistant factors are used to access the Okta Dashboard. If in the \"Possession factor constraints are\" section the \"Phishing resistant\" box is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Admin Console\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"Possession factor constraints are\" section, ensure the \"Phishing resistant\" box is checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000200",
+      "Name": "Okta must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the application.",
+      "Description": "Display of the DOD-approved use notification before granting access to the application ensures that privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance. System use notifications are required only for access via login interfaces with human users and are not required when such human interfaces do not exist. The banner must be formatted in accordance with DTM-08-060. Use the following verbiage for applications that can accommodate banners of 1300 characters: \"You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details.\" Use the following verbiage for operating systems that have severe limitations on the number of characters that can be displayed in the banner: \"I've read & consent to terms in IS user agreem't.\" Satisfies: SRG-APP-000068, SRG-APP-000069, SRG-APP-000070",
+      "Checks": [
+        "signon_dod_warning_banner_configured"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273192r1098843_rule",
+          "StigID": "OKTA-APP-000200",
+          "CCI": [
+            "CCI-000048",
+            "CCI-000050",
+            "CCI-001384",
+            "CCI-001385",
+            "CCI-001386",
+            "CCI-001387",
+            "CCI-001388"
+          ],
+          "CheckText": "Attempt to log in to the Okta tenant and verify the DOD-approved warning banner is in place. If the required warning banner is not present and complete, this is a finding.",
+          "FixText": "Follow the supplemental instructions in the \"Okta DOD Warning Banner Configuration Guide\" provided with this STIG package."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000560",
+      "Name": "The Okta Admin Console application must be configured to use multifactor authentication.",
+      "Description": "Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). A privileged account is defined as an information system account with authorizations of a privileged user. Network access is defined as access to an information system by a user (or a process acting on behalf of a user) communicating through a network (e.g., local area network, wide area network, or the internet). Satisfies: SRG-APP-000149, SRG-APP-000154",
+      "Checks": [
+        "application_admin_console_mfa_required"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT I (High)",
+          "Severity": "high",
+          "RuleID": "SV-273193r1098846_rule",
+          "StigID": "OKTA-APP-000560",
+          "CCI": [
+            "CCI-000765",
+            "CCI-004046"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Admin Console\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"User must authenticate with\" field, verify that either \"Password/IdP + Another factor\" or \"Any 2 factor types\" is selected. If either of these settings is incorrect, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Admin Console\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"User must authenticate with\" field, select either \"Password/IdP + Another factor\" or \"Any 2 factor types\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000570",
+      "Name": "The Okta Dashboard application must be configured to use multifactor authentication.",
+      "Description": "To ensure accountability and prevent unauthenticated access, nonprivileged users must use multifactor authentication to prevent potential misuse and compromise of the system. Multifactor authentication uses two or more factors to achieve authentication. Factors include: (i) Something you know (e.g., password/PIN); (ii) Something you have (e.g., cryptographic identification device, token); or (iii) Something you are (e.g., biometric). A nonprivileged account is any information system account with authorizations of a nonprivileged user. Network access is any access to an application by a user (or process acting on behalf of a user) where the access is obtained through a network connection. Applications integrating with the DOD Active Directory and using the DOD CAC are examples of compliant multifactor authentication solutions. Satisfies: SRG-APP-000150, SRG-APP-000155",
+      "Checks": [
+        "application_dashboard_mfa_required"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT I (High)",
+          "Severity": "high",
+          "RuleID": "SV-273194r1098849_rule",
+          "StigID": "OKTA-APP-000570",
+          "CCI": [
+            "CCI-000766",
+            "CCI-004046"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Dashboard\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"User must authenticate with\" field, verify that either \"Password/IdP + Another factor\" or \"Any 2 factor types\" is selected. If either of these settings is incorrect, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authentication Policies. 2. Click the \"Okta Dashboard\" policy. 3. Click the \"Actions\" button next to the top rule and select \"Edit\". 4. In the \"User must authenticate with\" field, select either \"Password/IdP + Another factor\" or \"Any 2 factor types\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000650",
+      "Name": "Okta must enforce a minimum 15-character password length.",
+      "Description": "Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.",
+      "Checks": [
+        "authenticator_password_minimum_length_15"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273195r1098852_rule",
+          "StigID": "OKTA-APP-000650",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify the \"Minimum Length\" field is set to at least \"15\" characters. If any policy is not set to at least \"15\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set the \"Minimum Length\" field to at least \"15\" characters."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000670",
+      "Name": "Okta must enforce password complexity by requiring that at least one uppercase character be used.",
+      "Description": "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.",
+      "Checks": [
+        "authenticator_password_complexity_uppercase"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273196r1098855_rule",
+          "StigID": "OKTA-APP-000670",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Upper case letter\" is checked. For each policy, if \"Upper case letter\" is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Upper case letter\" to checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000680",
+      "Name": "Okta must enforce password complexity by requiring that at least one lowercase character be used.",
+      "Description": "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.",
+      "Checks": [
+        "authenticator_password_complexity_lowercase"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273197r1098858_rule",
+          "StigID": "OKTA-APP-000680",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Lower case letter\" is checked. For each policy, if \"Lower case letter\" is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Lower case letter\" to checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000690",
+      "Name": "Okta must enforce password complexity by requiring that at least one numeric character be used.",
+      "Description": "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised.",
+      "Checks": [
+        "authenticator_password_complexity_number"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273198r1098861_rule",
+          "StigID": "OKTA-APP-000690",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Number (0-9)\" is checked. For each policy, if \"Number (0-9)\" is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Number (0-9)\" to checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000700",
+      "Name": "Okta must enforce password complexity by requiring that at least one special character be used.",
+      "Description": "Use of a complex password helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password complexity is one factor in determining how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Special characters are not alphanumeric. Examples include: ~ ! @ # $ % ^ *.",
+      "Checks": [
+        "authenticator_password_complexity_symbol"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273199r1098864_rule",
+          "StigID": "OKTA-APP-000700",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Symbol (e.g., !@#$%^&*)\" is checked. For each policy, if \"Symbol (e.g., !@#$%^&*)\" is not checked, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Symbol (e.g., !@#$%^&*)\" to checked."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000740",
+      "Name": "Okta must enforce 24 hours/one day as the minimum password lifetime.",
+      "Description": "Enforcing a minimum password lifetime helps prevent repeated password changes to defeat the password reuse or history enforcement requirement. Restricting this setting limits the user's ability to change their password. Passwords must be changed at specific policy-based intervals; however, if the application allows the user to immediately and continually change their password, it could be changed repeatedly in a short period of time to defeat the organization's policy regarding password reuse. Satisfies: SRG-APP-000173, SRG-APP-000870",
+      "Checks": [
+        "authenticator_password_minimum_age_24h"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273200r1098867_rule",
+          "StigID": "OKTA-APP-000740",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Minimum password age is XX hours\" is set to at least \"24\". For each policy, if \"Minimum password age is XX hours\" is not set to at least \"24\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Minimum password age is XX hours\" to at least \"24\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-000745",
+      "Name": "Okta must enforce a 60-day maximum password lifetime restriction.",
+      "Description": "Any password, no matter how complex, can eventually be cracked. Therefore, passwords must be changed at specific intervals. One method of minimizing this risk is to use complex passwords and periodically change them. If the application does not limit the lifetime of passwords and force users to change their passwords, there is the risk that the system and/or application passwords could be compromised. This requirement does not include emergency administration accounts, which are meant for access to the application in case of failure. These accounts are not required to have maximum password lifetime restrictions.",
+      "Checks": [
+        "authenticator_password_maximum_age_60d"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273201r1098870_rule",
+          "StigID": "OKTA-APP-000745",
+          "CCI": [
+            "CCI-004066"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy, verify \"Password expires after XX days\" is set to \"60\". For each policy, if \"Password expires after XX days\" is not set to \"60\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Password expires after XX days\" to \"60\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001430",
+      "Name": "Okta must off-load audit records onto a central log server.",
+      "Description": "Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. Satisfies: SRG-APP-000358, SRG-APP-000080, SRG-APP-000125",
+      "Checks": [
+        "systemlog_streaming_enabled"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT I (High)",
+          "Severity": "high",
+          "RuleID": "SV-273202r1099766_rule",
+          "StigID": "OKTA-APP-001430",
+          "CCI": [
+            "CCI-001851",
+            "CCI-000166",
+            "CCI-001348"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Reports >> Log Streaming. 2. Verify that a Log Stream connection is configured and active. Alternately, interview the information system security manager (ISSM) and verify that an external Security Information and Event Management (SIEM) system is pulling Okta logs via an Application Programming Interface (API). If either of these is not configured, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Reports >> Log Streaming. 2. Select either \"AWS EventBridge\" or \"Splunk Cloud\" and click \"Next\". 3. Complete the necessary fields and click \"Save\". If Log Streaming is not an option because the SIEM required is not an option, customers can use the Okta Log API to export system logs in real time."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001665",
+      "Name": "Okta must be configured to limit the global session lifetime to 18 hours.",
+      "Description": "Without reauthentication, users may access resources or perform tasks for which they do not have authorization. When applications provide the capability to change security roles or escalate the functional capability of the application, it is critical the user reauthenticate. In addition to the reauthentication requirements associated with session locks, organizations may require reauthentication of individuals and/or devices in other situations, including (but not limited to) the following circumstances. (i) When authenticators change; (ii) When roles change; (iii) When security categories of information systems change; (iv) When the execution of privileged functions occurs; (v) After a fixed period of time; or (vi) Periodically. Within the DOD, the minimum circumstances requiring reauthentication are privilege escalation and role changes.",
+      "Checks": [
+        "signon_global_session_lifetime_18h"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273203r1099958_rule",
+          "StigID": "OKTA-APP-001665",
+          "CCI": [
+            "CCI-002038"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Global Session Policy. 2. In the Default Policy, verify a rule is configured at Priority 1 that is not named \"Default Rule\". 3. Click the \"Edit\" icon next to the Priority 1 rule. 4. Verify \"Maximum Okta global session lifetime\" is set to 18 hours. If the above is not set, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Global Session Policy. 2. Select the Default Policy. 3. In the Rules table, make these updates: - Click \"Add rule\". - Set \"Maximum Okta global session lifetime\" to 18 hours."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001670",
+      "Name": "Okta must be configured to accept Personal Identity Verification (PIV) credentials.",
+      "Description": "The use of PIV credentials facilitates standardization and reduces the risk of unauthorized access. DOD has mandated the use of the common access card (CAC) to support identity management and personal authentication for systems covered under HSPD 12, as well as a primary component of layered protection for national security systems. Satisfies: SRG-APP-000391, SRG-APP-000402, SRG-APP-000403",
+      "Checks": [
+        "authenticator_smart_card_active"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273204r1098879_rule",
+          "StigID": "OKTA-APP-001670",
+          "CCI": [
+            "CCI-001953",
+            "CCI-002009",
+            "CCI-002010"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. Verify that \"Smart Card Authenticator\" is listed and has \"Status\" listed as \"Active\". If \"Smart Card Authenticator\" is not listed or is not listed as \"Active\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. In the \"Setup\" tab, click \"Add authenticator\". 3. Select the configured Smart Card Identity Provider and finish configuration."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001700",
+      "Name": "The Okta Verify application must be configured to connect only to FIPS-compliant devices.",
+      "Description": "Without device-to-device authentication, communications with malicious devices may be established. Bidirectional authentication provides stronger safeguards to validate the identity of other devices for connections that are of greater risk. Currently, DOD requires the use of AES for bidirectional authentication because it is the only FIPS-validated AES cipher block algorithm. For distributed architectures (e.g., service-oriented architectures), the decisions regarding the validation of authentication claims may be made by services separate from the services acting on those decisions. In such situations, it is necessary to provide authentication decisions (as opposed to the actual authenticators) to the services that need to act on those decisions. A local connection is any connection with a device communicating without the use of a network. A network connection is any connection with a device that communicates through a network (e.g., local area or wide area network; the internet). A remote connection is any connection with a device communicating through an external network (e.g., the internet). Because of the challenges of applying this requirement on a large scale, organizations are encouraged to apply the requirement only to those limited number (and type) of devices that truly need to support this capability.",
+      "Checks": [
+        "authenticator_okta_verify_fips_compliant"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273205r1098882_rule",
+          "StigID": "OKTA-APP-001700",
+          "CCI": [
+            "CCI-001967"
+          ],
+          "CheckText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. From the \"Setup\" tab, select \"Edit Okta Verify\". 3. Review the \"FIPS Compliance\" field. If FIPS-compliant authentication is not enabled, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Authenticators. 2. From the \"Setup\" tab, select \"Edit Okta Verify\". 3. In the \"FIPS Compliance\" field, choose whether users enrolling in Okta Verify can use FIPS-compliant devices only or any device. 4. Click \"Save\" after making any changes."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001710",
+      "Name": "Okta must be configured to disable persistent global session cookies.",
+      "Description": "If cached authentication information is out of date, the validity of the authentication information may be questionable. Satisfies: SRG-APP-000400, SRG-APP-000157",
+      "Checks": [
+        "signon_global_session_cookies_not_persistent"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273206r1098885_rule",
+          "StigID": "OKTA-APP-001710",
+          "CCI": [
+            "CCI-002007",
+            "CCI-001942"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Global Session Policy. 2. In the Default Policy, verify a rule is configured at Priority 1 that is not named \"Default Rule\". 3. Click the \"Edit\" icon next to the Priority 1 rule. 4. Verify \"Okta global session cookies persist across browser sessions\" is set to \"Disabled\". If the above it not set, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Global Session Policy. 2. Select the Default Policy. 3. In the \"Rules\" table, make these updates: - Click \"Add rule\". - Set \"Okta global session cookies persist across browser sessions\" to Disable."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-001920",
+      "Name": "Okta must be configured to use only DOD-approved certificate authorities.",
+      "Description": "Untrusted Certificate Authorities (CA) can issue certificates, but they may be issued by organizations or individuals that seek to compromise DOD systems or by organizations with insufficient security controls. If the CA used for verifying the certificate is not DOD approved, trust of this CA has not been established. The DOD will accept only PKI certificates obtained from a DOD-approved internal or external CA. Reliance on CAs for the establishment of secure sessions includes, for example, the use of Transport Layer Security (TLS) certificates. This requirement focuses on communications protection for the application session rather than for the network packet. This requirement applies to applications that use communications sessions. This includes, but is not limited to, web-based applications and Service-Oriented Architectures (SOA). Satisfies: SRG-APP-000427, SRG-APP-000910",
+      "Checks": [
+        "idp_smart_card_dod_approved_ca"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273207r1098888_rule",
+          "StigID": "OKTA-APP-001920",
+          "CCI": [
+            "CCI-002470",
+            "CCI-004909"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Identity Providers (IdPs). 2. Review the list of IdPs with \"Type\" as \"Smart Card\". If the IdP is not listed as \"Active\", this is a finding. 3. Select Actions >> Configure. 4. Under \"Certificate chain\", verify the certificate is from a DOD-approved CA. If the certificate is not from a DOD-approved CA, this is a finding.",
+          "FixText": "From the Admin Console: 1. Go to Security >> Identity Providers. 2. Click \"Add identity provider.\" 3. Click \"Smart Card IdP\". Click \"Next\". 4. Enter the name of the identity provider. 5. Build a certificate chain: - Click \"Browse\" to open a file explorer. Select the certificate file to add and click \"Open\". - To add another certificate, click \"Add Another\" and repeat step 1. - Click \"Build certificate chain\". On success, the chain and its certificates are shown. If the build failed, correct any issues and try again. - Click \"Reset certificate chain\" if replacing the current chain with a new one. 6. In \"IdP username\", select the \"idpuser.subjectAltNameUpn\" attribute. This is the attribute that stores the Electronic Data Interchange Personnel Identifier (EDIPI) on the CAC. 7. In the \"Match Against\" field, select the Okta Profile Attribute in which the EDIPI is to be stored."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-002980",
+      "Name": "Okta must validate passwords against a list of commonly used, expected, or compromised passwords.",
+      "Description": "Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.",
+      "Checks": [
+        "authenticator_password_common_password_check"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273208r1099769_rule",
+          "StigID": "OKTA-APP-002980",
+          "CCI": [
+            "CCI-004058"
+          ],
+          "CheckText": "From the Admin Console: 1. Navigate to Security >> Authenticators. 2. Click the \"Actions\" button next to the Password authenticator and select \"Edit\". 3. Under the \"Password Settings\" section, verify the \"Common Password Check\" box is checked. If \"Common Password Check\" is not selected, this is a finding.",
+          "FixText": "From the Admin Console: 1. Navigate to Security >> Authenticators. 2. Click the \"Actions\" button next to the Password authenticator and select \"Edit\". 3. Under the \"Password Settings\" section, check the \"Common Password Check\" box."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003010",
+      "Name": "Okta must prohibit password reuse for a minimum of five generations.",
+      "Description": "Password-based authentication applies to passwords regardless of whether they are used in single-factor or multifactor authentication. Long passwords or passphrases are preferable over shorter passwords. Enforced composition rules provide marginal security benefits while decreasing usability. However, organizations may choose to establish certain rules for password generation (e.g., minimum character length for long passwords) under certain circumstances and can enforce this requirement in IA-5(1)(h). Account recovery can occur, for example, in situations when a password is forgotten. Cryptographically protected passwords include salted one-way cryptographic hashes of passwords. The list of commonly used, compromised, or expected passwords includes passwords obtained from previous breach corpuses, dictionary words, and repetitive or sequential characters. The list includes context-specific words, such as the name of the service, username, and derivatives thereof.",
+      "Checks": [
+        "authenticator_password_history_5"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-273209r1098894_rule",
+          "StigID": "OKTA-APP-003010",
+          "CCI": [
+            "CCI-004061"
+          ],
+          "CheckText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password row\" and select \"Edit\". 3. For each listed policy, verify \"Enforce password history for last XX passwords\" is set to \"5\". If any policy is not set to at least \"5\", this is a finding.",
+          "FixText": "From the Admin Console: 1. Select Security >> Authenticators. 2. Click the \"Actions\" button next to the \"Password\" row and select \"Edit\". 3. For each listed policy: - Click \"Edit\". - Set \"Enforce password history for last XX passwords\" to \"5\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003240",
+      "Name": "Okta API tokens must be configured with Network Zones to restrict authorization from known networks.",
+      "Description": "An access token is a piece of data that represents the authorization granted to a user or NPE to access specific systems or information resources. Access tokens enable controlled access to services and resources. Properly managing the lifecycle of access tokens, including their issuance, validation, and revocation, is crucial to maintaining confidentiality of data and systems. Restricting token validity to a specific audience, e.g., an application or security domain, and restricting token validity lifetimes are important practices. Access tokens are revoked or invalidated if they are compromised, lost, or are no longer needed to mitigate the risks associated with stolen or misused tokens. API tokens have the potential to be replicated or stolen (just like a password). Because of this, it is important to only allow API tokens to authenticate from known IP ranges as this limits an adversary's ability to use a token to gain access.",
+      "Checks": [
+        "apitoken_restricted_to_network_zone"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279689r1155066_rule",
+          "StigID": "OKTA-APP-003240",
+          "CCI": [
+            "CCI-005165",
+            "CCI-000366"
+          ],
+          "CheckText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"API\" item. 2. Click the \"Tokens\" tab. 3. For each token listed, click the token name link. 4. In the \"Security\" section, verify the \"Token can be used from\" setting is mapped to a known network zone for the application calling the API. If a network zone for each API access token is not defined, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"API\" item. 2. Click the \"Tokens\" tab. 3. For each token listed, click the token name link. 4. In the \"Security\" section, click \"Edit\". 5. Set the \"Token can be used from\" setting to the known network zone for the application calling the API. 6. Click \"Save\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003241",
+      "Name": "Okta API tokens must be created under new dedicated user accounts.",
+      "Description": "An access token is a piece of data that represents the authorization granted to a user or NPE to access specific systems or information resources. Access tokens enable controlled access to services and resources. Properly managing the lifecycle of access tokens, including their issuance, validation, and revocation, is crucial to maintaining confidentiality of data and systems. Restricting token validity to a specific audience, e.g., an application or security domain, and restricting token validity lifetimes are important practices. Access tokens are revoked or invalidated if they are compromised, lost, or are no longer needed to mitigate the risks associated with stolen or misused tokens. When API tokens are created, they inherit the permissions of the user that created them. Therefore, API tokens should only be created from dedicated accounts and permissions must be constrained to least privilege for that dedicated user account and token. No API tokens should be created using a Super Admin account.",
+      "Checks": [
+        "apitoken_not_super_admin"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279690r1155069_rule",
+          "StigID": "OKTA-APP-003241",
+          "CCI": [
+            "CCI-005165",
+            "CCI-000366"
+          ],
+          "CheckText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"API\" item. 2. Click the \"Tokens\" tab. 3. For each token listed, verify that the Role listed is not \"Super Admin\", and that the account has been specifically created for that token. 4. Click the account name to be token to the user profile for that user. 5. Verify the user only has an administrator role (standard or customer) applied that is correctly scoped as required and documented in the Okta Access Control policy. If the token is using a Super Administrator account, or one that is not properly scoped per the Access Control policy, this is a finding. Note: If a Super Admin token is required for system operation, then this permanent finding.",
+          "FixText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"API\" item. 2. Click the \"Tokens\" tab. 3. For each token listed that has \"Super Admin\" or an improperly scoped Admin account, delete the token and create a new one with the appropriately scoped permissions. 4. Verify the application performing the API calls with the new token has been updated."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003242",
+      "Name": "The Okta Global Session policy must be configured to allow or deny IP based access in accordance with the Access Control policy for Okta.",
+      "Description": "To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., networks, web servers, and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement. Access Control policies include identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include access control lists, access control matrices, and cryptography. These policies and mechanisms must be employed by the application to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, and domains) in the information system. The Okta Global Session Policy is applied at the organization level and before any application-specific authentication policies are processed. The Okta authorization package should contain an access control policy that defines IP ranges from which to either allow or deny access. This list (either as an explicit allow or explicit deny) can be implemented in the Global Session Policy.",
+      "Checks": [
+        "signon_global_session_policy_network_zone_enforced"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279691r1155072_rule",
+          "StigID": "OKTA-APP-003242",
+          "CCI": [
+            "CCI-000213"
+          ],
+          "CheckText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"Global Session Policy\" item. 2. In the \"Policy Settings\" section, verify the \"IF User's IP is\" setting is correctly set to either allow or deny based on the organization defined policy. If the Okta Global Session Policy is not configured to restrict access to specific IP ranges, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"Global Session Policy\" item. 2. In the Policy Settings section, configure the \"IF User's IP is\" setting to correctly set the appropriate network to either allow or deny based on the Access Control Policy."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003243",
+      "Name": "Okta must be configured with Network Zones defined to block anonymized proxies according to organizationally defined policy.",
+      "Description": "A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If information flow is not enforced based on approved authorizations, the system may become compromised. Information flow control regulates where information is allowed to travel within a system and between interconnected systems. The flow of all application information must be monitored and controlled so it does not introduce any unacceptable risk to the systems or data. Application-specific examples of enforcement occurs in systems that employ rule sets or establish configuration settings that restrict information system services, or provide a message filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Applications providing information flow control must be able to enforce approved authorizations for controlling the flow of information between interconnected systems in accordance with applicable policy. Working with the organizational CSSP, the ISSM should obtain a list of known anonymizer proxies that exist on the commercial internet. If this is not available from the CSSP, then the Okta-provided \"Enhanced dynamic zone blocklist\" should be activated.",
+      "Checks": [
+        "network_zone_block_anonymized_proxies"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279692r1155075_rule",
+          "StigID": "OKTA-APP-003243",
+          "CCI": [
+            "CCI-001414"
+          ],
+          "CheckText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"Networks' item. 2. If the CSSP has provided a list of anonymizers to block, verify the \"IP Block list\" is configured with them. a. Click the pencil icon next to IP Block list. b. Verify the \"Gateway IPs\" section contains all of the IP ranges in the provided list. 3. If the CSSP is not able to provide a list, then implement the Okta managed list. a. Verify the \"Enhanced dynamic zone blocklist\" is set to \"Active\". If Network Zones are not configured to block anonymous proxies, this is a finding.",
+          "FixText": "From the Admin Console: 1. Select the \"Security\" menu, and then click the \"Networks\" item. 2. If the CSSP has provided a list of anonymizers to block, add the IP ranges to the \"IP Block list\". a. Click the pencil icon next to IP Block list. b. Add the IP ranges to the \"Gateway IPs\" section and click \"Save\". 3. If the CSSP is not able to provide a list, then implement the Okta managed list. a. Set the \"Enhanced dynamic zone blocklist\" to \"Active\"."
+        }
+      ]
+    },
+    {
+      "Id": "OKTA-APP-003244",
+      "Name": "For each application integrated with Okta, network zones must be defined in its authentication policy.",
+      "Description": "A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If information flow is not enforced based on approved authorizations, the system may become compromised. Information flow control regulates where information is allowed to travel within a system and between interconnected systems. The flow of all application information must be monitored and controlled so it does not introduce any unacceptable risk to the systems or data. Application-specific examples of enforcement occurs in systems that employ rule sets or establish configuration settings that restrict information system services, or provide a message filtering capability based on message content (e.g., implementing key word searches or using document characteristics). Applications providing information flow control must be able to enforce approved authorizations for controlling the flow of information between interconnected systems in accordance with applicable policy. Each application in Okta should have a well defined access control policy that takes into account the end user network. This should be documented in the Access Control policy for each application. As an example, access to an application may be restricted to a specific location by policy. In this case, a network defining that specific location should be created.",
+      "Checks": [
+        "application_authentication_policy_network_zone_enforced"
+      ],
+      "Attributes": [
+        {
+          "Section": "CAT II (Medium)",
+          "Severity": "medium",
+          "RuleID": "SV-279693r1155078_rule",
+          "StigID": "OKTA-APP-003244",
+          "CCI": [
+            "CCI-001414"
+          ],
+          "CheckText": "For each application integrated into Okta: 1. From the Admin console, open the \"Security\" menu, and then select \"Networks\". 2. Verify the list of networks includes all necessary allow or block lists. If any application is not configured with network zones, this is a finding.",
+          "FixText": "For each application, starting at the admin console: 1. Open the \"Applications\" group from the Menu, and then click the \"Applications\" menu item. 2. Click the application name. 3. Click the \"Sign On\" tab. 4. Scroll to the \"User Authentication\" section, and then click \"Edit\". 5. Select the appropriate Authentication policy from the pull down, and then click \"Save\". 6. Click \"View Policy Details\". 7. For each nondefault rule: a. Select \"Edit\" from the Actions menu. b. In the \"IF\" section, verify the \"User is\" setting has the appropriate allow or deny range has been selected based on the Access Control policy for the application. c. Scroll down to the bottom and click \"Save\". 8. For the Catch-All rule: a. Select \"Edit\" from the Actions menu. b. Scroll down to the \"Then\" section. c. For the \"Access is\" setting, select \"Denied\", and then click \"Save\"."
+        }
+      ]
+    }
+  ]
+}
diff --git a/prowler/lib/check/compliance_models.py b/prowler/lib/check/compliance_models.py
index 3610893008..f883bf60b1 100644
--- a/prowler/lib/check/compliance_models.py
+++ b/prowler/lib/check/compliance_models.py
@@ -283,6 +283,26 @@ class CSA_CCM_Requirement_Attribute(BaseModel):
     ScopeApplicability: list[dict]
 
 
+class STIG_Requirement_Attribute_Severity(str, Enum):
+    """DISA STIG Requirement Attribute Severity (maps to CAT I/II/III)"""
+
+    high = "high"
+    medium = "medium"
+    low = "low"
+
+
+class STIG_Requirement_Attribute(BaseModel):
+    """DISA STIG Requirement Attribute"""
+
+    Section: str
+    Severity: STIG_Requirement_Attribute_Severity
+    RuleID: str
+    StigID: str
+    CCI: Optional[list[str]] = None
+    CheckText: Optional[str] = None
+    FixText: Optional[str] = None
+
+
 # Base Compliance Model
 # TODO: move this to compliance folder
 class Compliance_Requirement(BaseModel):
@@ -303,6 +323,7 @@ class Compliance_Requirement(BaseModel):
             CCC_Requirement_Attribute,
             C5Germany_Requirement_Attribute,
             CSA_CCM_Requirement_Attribute,
+            STIG_Requirement_Attribute,
             # Generic_Compliance_Requirement_Attribute must be the last one since it is the fallback for generic compliance framework
             Generic_Compliance_Requirement_Attribute,
         ]
diff --git a/prowler/lib/outputs/compliance/compliance.py b/prowler/lib/outputs/compliance/compliance.py
index 65ad8af0b3..4e4bd78232 100644
--- a/prowler/lib/outputs/compliance/compliance.py
+++ b/prowler/lib/outputs/compliance/compliance.py
@@ -18,6 +18,9 @@ from prowler.lib.outputs.compliance.kisa_ismsp.kisa_ismsp import get_kisa_ismsp_
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack import (
     get_mitre_attack_table,
 )
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig import (
+    get_okta_idaas_stig_table,
+)
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore import (
     get_prowler_threatscore_table,
 )
@@ -252,6 +255,15 @@ def display_compliance_table(
                 output_directory,
                 compliance_overview,
             )
+        elif compliance_framework.startswith("okta_idaas_stig"):
+            get_okta_idaas_stig_table(
+                findings,
+                bulk_checks_metadata,
+                compliance_framework,
+                output_filename,
+                output_directory,
+                compliance_overview,
+            )
         else:
             # Try provider-specific table first, fall back to generic
             from prowler.providers.common.provider import Provider
diff --git a/prowler/lib/outputs/compliance/okta_idaas_stig/__init__.py b/prowler/lib/outputs/compliance/okta_idaas_stig/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/lib/outputs/compliance/okta_idaas_stig/models.py b/prowler/lib/outputs/compliance/okta_idaas_stig/models.py
new file mode 100644
index 0000000000..674d9656b7
--- /dev/null
+++ b/prowler/lib/outputs/compliance/okta_idaas_stig/models.py
@@ -0,0 +1,32 @@
+from typing import Optional
+
+from pydantic.v1 import BaseModel
+
+
+class OktaIDaaSSTIGModel(BaseModel):
+    """
+    OktaIDaaSSTIGModel generates a finding's output in DISA Okta IDaaS STIG Compliance format.
+    """
+
+    Provider: str
+    Description: str
+    OrganizationDomain: str
+    AssessmentDate: str
+    Requirements_Id: str
+    Requirements_Name: str
+    Requirements_Description: str
+    Requirements_Attributes_Section: str
+    Requirements_Attributes_Severity: str
+    Requirements_Attributes_RuleID: str
+    Requirements_Attributes_StigID: str
+    Requirements_Attributes_CCI: Optional[list[str]] = None
+    Requirements_Attributes_CheckText: Optional[str] = None
+    Requirements_Attributes_FixText: Optional[str] = None
+    Status: str
+    StatusExtended: str
+    ResourceId: str
+    ResourceName: str
+    CheckId: str
+    Muted: bool
+    Framework: str
+    Name: str
diff --git a/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
new file mode 100644
index 0000000000..5c76055a06
--- /dev/null
+++ b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
@@ -0,0 +1,98 @@
+from colorama import Fore, Style
+from tabulate import tabulate
+
+from prowler.config.config import orange_color
+
+
+def get_okta_idaas_stig_table(
+    findings: list,
+    bulk_checks_metadata: dict,
+    compliance_framework: str,
+    output_filename: str,
+    output_directory: str,
+    compliance_overview: bool,
+):
+    section_table = {
+        "Provider": [],
+        "Section": [],
+        "Status": [],
+        "Muted": [],
+    }
+    pass_count = []
+    fail_count = []
+    muted_count = []
+    sections = {}
+    for index, finding in enumerate(findings):
+        check = bulk_checks_metadata[finding.check_metadata.CheckID]
+        check_compliances = check.Compliance
+        for compliance in check_compliances:
+            if compliance.Framework == "Okta-IDaaS-STIG":
+                for requirement in compliance.Requirements:
+                    for attribute in requirement.Attributes:
+                        section = attribute.Section
+
+                        if section not in sections:
+                            sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+
+                        if finding.muted:
+                            if index not in muted_count:
+                                muted_count.append(index)
+                                sections[section]["Muted"] += 1
+                        else:
+                            if finding.status == "FAIL" and index not in fail_count:
+                                fail_count.append(index)
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS" and index not in pass_count:
+                                pass_count.append(index)
+                                sections[section]["PASS"] += 1
+
+    sections = dict(sorted(sections.items()))
+    for section in sections:
+        section_table["Provider"].append(compliance.Provider)
+        section_table["Section"].append(section)
+        if sections[section]["FAIL"] > 0:
+            section_table["Status"].append(
+                f"{Fore.RED}FAIL({sections[section]['FAIL']}){Style.RESET_ALL}"
+            )
+        else:
+            if sections[section]["PASS"] > 0:
+                section_table["Status"].append(
+                    f"{Fore.GREEN}PASS({sections[section]['PASS']}){Style.RESET_ALL}"
+                )
+            else:
+                section_table["Status"].append(f"{Fore.GREEN}PASS{Style.RESET_ALL}")
+        section_table["Muted"].append(
+            f"{orange_color}{sections[section]['Muted']}{Style.RESET_ALL}"
+        )
+
+    if (
+        len(fail_count) + len(pass_count) + len(muted_count) > 1
+    ):  # If there are no resources, don't print the compliance table
+        print(
+            f"\nCompliance Status of {Fore.YELLOW}{compliance_framework.upper()}{Style.RESET_ALL} Framework:"
+        )
+        total_findings_count = len(fail_count) + len(pass_count) + len(muted_count)
+        overview_table = [
+            [
+                f"{Fore.RED}{round(len(fail_count) / total_findings_count * 100, 2)}% ({len(fail_count)}) FAIL{Style.RESET_ALL}",
+                f"{Fore.GREEN}{round(len(pass_count) / total_findings_count * 100, 2)}% ({len(pass_count)}) PASS{Style.RESET_ALL}",
+                f"{orange_color}{round(len(muted_count) / total_findings_count * 100, 2)}% ({len(muted_count)}) MUTED{Style.RESET_ALL}",
+            ]
+        ]
+        print(tabulate(overview_table, tablefmt="rounded_grid"))
+        if not compliance_overview:
+            if len(fail_count) > 0 and len(section_table["Section"]) > 0:
+                print(
+                    f"\nFramework {Fore.YELLOW}{compliance_framework.upper()}{Style.RESET_ALL} Results:"
+                )
+                print(
+                    tabulate(
+                        section_table,
+                        tablefmt="rounded_grid",
+                        headers="keys",
+                    )
+                )
+                print(f"\nDetailed results of {compliance_framework.upper()} are in:")
+                print(
+                    f" - CSV: {output_directory}/compliance/{output_filename}_{compliance_framework}.csv\n"
+                )
diff --git a/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py
new file mode 100644
index 0000000000..25f71b4def
--- /dev/null
+++ b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta.py
@@ -0,0 +1,95 @@
+from prowler.config.config import timestamp
+from prowler.lib.check.compliance_models import Compliance
+from prowler.lib.outputs.compliance.compliance_output import ComplianceOutput
+from prowler.lib.outputs.compliance.okta_idaas_stig.models import OktaIDaaSSTIGModel
+from prowler.lib.outputs.finding import Finding
+
+
+class OktaIDaaSSTIG(ComplianceOutput):
+    """
+    This class represents the Okta IDaaS STIG compliance output.
+
+    Attributes:
+        - _data (list): A list to store transformed data from findings.
+        - _file_descriptor (TextIOWrapper): A file descriptor to write data to a file.
+
+    Methods:
+        - transform: Transforms findings into Okta IDaaS STIG compliance format.
+    """
+
+    def transform(
+        self,
+        findings: list[Finding],
+        compliance: Compliance,
+        _compliance_name: str,
+    ) -> None:
+        """
+        Transforms a list of findings into Okta IDaaS STIG compliance format.
+
+        Parameters:
+            - findings (list): A list of findings.
+            - compliance (Compliance): A compliance model.
+            - _compliance_name (str): The name of the compliance model (unused).
+
+        Returns:
+            - None
+        """
+        for finding in findings:
+            for requirement in compliance.Requirements:
+                # Source of truth: framework JSON, not finding.compliance snapshot (avoids CSV/UI count drift).
+                if finding.check_id in requirement.Checks:
+                    for attribute in requirement.Attributes:
+                        compliance_row = OktaIDaaSSTIGModel(
+                            Provider=finding.provider,
+                            Description=compliance.Description,
+                            OrganizationDomain=finding.account_name,
+                            AssessmentDate=str(timestamp),
+                            Requirements_Id=requirement.Id,
+                            Requirements_Name=requirement.Name,
+                            Requirements_Description=requirement.Description,
+                            Requirements_Attributes_Section=attribute.Section,
+                            Requirements_Attributes_Severity=attribute.Severity.value,
+                            Requirements_Attributes_RuleID=attribute.RuleID,
+                            Requirements_Attributes_StigID=attribute.StigID,
+                            Requirements_Attributes_CCI=attribute.CCI,
+                            Requirements_Attributes_CheckText=attribute.CheckText,
+                            Requirements_Attributes_FixText=attribute.FixText,
+                            Status=finding.status,
+                            StatusExtended=finding.status_extended,
+                            ResourceId=finding.resource_uid,
+                            ResourceName=finding.resource_name,
+                            CheckId=finding.check_id,
+                            Muted=finding.muted,
+                            Framework=compliance.Framework,
+                            Name=compliance.Name,
+                        )
+                        self._data.append(compliance_row)
+        # Add manual requirements to the compliance output
+        for requirement in compliance.Requirements:
+            if not requirement.Checks:
+                for attribute in requirement.Attributes:
+                    compliance_row = OktaIDaaSSTIGModel(
+                        Provider=compliance.Provider.lower(),
+                        Description=compliance.Description,
+                        OrganizationDomain="",
+                        AssessmentDate=str(timestamp),
+                        Requirements_Id=requirement.Id,
+                        Requirements_Name=requirement.Name,
+                        Requirements_Description=requirement.Description,
+                        Requirements_Attributes_Section=attribute.Section,
+                        Requirements_Attributes_Severity=attribute.Severity.value,
+                        Requirements_Attributes_RuleID=attribute.RuleID,
+                        Requirements_Attributes_StigID=attribute.StigID,
+                        Requirements_Attributes_CCI=attribute.CCI,
+                        Requirements_Attributes_CheckText=attribute.CheckText,
+                        Requirements_Attributes_FixText=attribute.FixText,
+                        Status="MANUAL",
+                        StatusExtended="Manual check",
+                        ResourceId="manual_check",
+                        ResourceName="Manual check",
+                        CheckId="manual",
+                        Muted=False,
+                        Framework=compliance.Framework,
+                        Name=compliance.Name,
+                    )
+                    self._data.append(compliance_row)
diff --git a/tests/lib/outputs/compliance/display_compliance_table_test.py b/tests/lib/outputs/compliance/display_compliance_table_test.py
index a55789a7fd..bd854d6d7d 100644
--- a/tests/lib/outputs/compliance/display_compliance_table_test.py
+++ b/tests/lib/outputs/compliance/display_compliance_table_test.py
@@ -103,6 +103,15 @@ class TestDispatchStartswith:
         display_compliance_table(compliance_framework=framework_name, **_COMMON)
         mock_fn.assert_called_once()
 
+    @pytest.mark.parametrize(
+        "framework_name",
+        ["okta_idaas_stig_v1r2_okta"],
+    )
+    @patch(f"{MODULE}.get_okta_idaas_stig_table")
+    def test_okta_idaas_stig_dispatch(self, mock_fn, framework_name):
+        display_compliance_table(compliance_framework=framework_name, **_COMMON)
+        mock_fn.assert_called_once()
+
     @pytest.mark.parametrize(
         "framework_name",
         [
diff --git a/tests/lib/outputs/compliance/fixtures.py b/tests/lib/outputs/compliance/fixtures.py
index f085460abd..a8fc7aa7e5 100644
--- a/tests/lib/outputs/compliance/fixtures.py
+++ b/tests/lib/outputs/compliance/fixtures.py
@@ -16,6 +16,7 @@ from prowler.lib.check.compliance_models import (
     Mitre_Requirement_Attribute_Azure,
     Mitre_Requirement_Attribute_GCP,
     Prowler_ThreatScore_Requirement_Attribute,
+    STIG_Requirement_Attribute,
 )
 
 CIS_1_4_AWS = Compliance(
@@ -1258,3 +1259,47 @@ ASD_ESSENTIAL_EIGHT_AWS = Compliance(
         ),
     ],
 )
+
+OKTA_IDAAS_STIG_OKTA = Compliance(
+    Framework="Okta-IDaaS-STIG",
+    Name="DISA Okta Identity as a Service (IDaaS) STIG V1R2",
+    Version="1R2",
+    Provider="Okta",
+    Description="Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS).",
+    Requirements=[
+        Compliance_Requirement(
+            Id="OKTA-APP-000020",
+            Name="Okta must log out a session after a 15-minute period of inactivity.",
+            Description="A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate vicinity of the information system.",
+            Attributes=[
+                STIG_Requirement_Attribute(
+                    Section="CAT II (Medium)",
+                    Severity="medium",
+                    RuleID="SV-273186r1098825_rule",
+                    StigID="OKTA-APP-000020",
+                    CCI=["CCI-000057", "CCI-001133"],
+                    CheckText="Verify the Global Session Policy logs out a session after 15 minutes of inactivity.",
+                    FixText="From the Admin Console configure the Global Session Policy idle timeout to 15 minutes.",
+                )
+            ],
+            Checks=["signon_global_session_idle_timeout_15min"],
+        ),
+        Compliance_Requirement(
+            Id="OKTA-APP-000650",
+            Name="Okta must enforce a minimum 15-character password length.",
+            Description="The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.",
+            Attributes=[
+                STIG_Requirement_Attribute(
+                    Section="CAT II (Medium)",
+                    Severity="medium",
+                    RuleID="SV-273209r1098894_rule",
+                    StigID="OKTA-APP-000650",
+                    CCI=["CCI-000205"],
+                    CheckText="Verify the password policy enforces a minimum length of 15 characters.",
+                    FixText="From the Admin Console set the minimum password length to 15 characters.",
+                )
+            ],
+            Checks=[],
+        ),
+    ],
+)
diff --git a/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py
new file mode 100644
index 0000000000..fa616c906e
--- /dev/null
+++ b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_okta_test.py
@@ -0,0 +1,139 @@
+from datetime import datetime
+from io import StringIO
+from unittest import mock
+
+from freezegun import freeze_time
+from mock import patch
+
+from prowler.lib.outputs.compliance.okta_idaas_stig.models import OktaIDaaSSTIGModel
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta import (
+    OktaIDaaSSTIG,
+)
+from tests.lib.outputs.compliance.fixtures import OKTA_IDAAS_STIG_OKTA
+from tests.lib.outputs.fixtures.fixtures import generate_finding_output
+
+OKTA_ORG_DOMAIN = "dev-12345.okta.com"
+
+
+class TestOktaIDaaSSTIG:
+    def test_output_transform(self):
+        findings = [
+            generate_finding_output(
+                provider="okta",
+                account_uid=OKTA_ORG_DOMAIN,
+                account_name=OKTA_ORG_DOMAIN,
+                region="global",
+                service_name="signon",
+                check_id="signon_global_session_idle_timeout_15min",
+                resource_uid="okta-global-session-policy",
+                resource_name="Default Policy",
+                compliance={"Okta-IDaaS-STIG-1R2": ["OKTA-APP-000020"]},
+            )
+        ]
+
+        output = OktaIDaaSSTIG(findings, OKTA_IDAAS_STIG_OKTA)
+        output_data = output.data[0]
+        assert isinstance(output_data, OktaIDaaSSTIGModel)
+        assert output_data.Provider == "okta"
+        assert output_data.Framework == OKTA_IDAAS_STIG_OKTA.Framework
+        assert output_data.Name == OKTA_IDAAS_STIG_OKTA.Name
+        assert output_data.OrganizationDomain == OKTA_ORG_DOMAIN
+        assert output_data.Description == OKTA_IDAAS_STIG_OKTA.Description
+        assert output_data.Requirements_Id == OKTA_IDAAS_STIG_OKTA.Requirements[0].Id
+        assert (
+            output_data.Requirements_Name == OKTA_IDAAS_STIG_OKTA.Requirements[0].Name
+        )
+        assert (
+            output_data.Requirements_Description
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Description
+        )
+        assert (
+            output_data.Requirements_Attributes_Section
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].Section
+        )
+        assert (
+            output_data.Requirements_Attributes_Severity
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].Severity.value
+        )
+        assert (
+            output_data.Requirements_Attributes_RuleID
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].RuleID
+        )
+        assert (
+            output_data.Requirements_Attributes_StigID
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].StigID
+        )
+        assert (
+            output_data.Requirements_Attributes_CCI
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].CCI
+        )
+        assert (
+            output_data.Requirements_Attributes_CheckText
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].CheckText
+        )
+        assert (
+            output_data.Requirements_Attributes_FixText
+            == OKTA_IDAAS_STIG_OKTA.Requirements[0].Attributes[0].FixText
+        )
+        assert output_data.Status == "PASS"
+        assert output_data.StatusExtended == ""
+        assert output_data.ResourceId == "okta-global-session-policy"
+        assert output_data.ResourceName == "Default Policy"
+        assert output_data.CheckId == "signon_global_session_idle_timeout_15min"
+        assert output_data.Muted is False
+        # Test manual check
+        output_data_manual = output.data[1]
+        assert output_data_manual.Provider == "okta"
+        assert output_data_manual.Framework == OKTA_IDAAS_STIG_OKTA.Framework
+        assert output_data_manual.Name == OKTA_IDAAS_STIG_OKTA.Name
+        assert output_data_manual.OrganizationDomain == ""
+        assert (
+            output_data_manual.Requirements_Id
+            == OKTA_IDAAS_STIG_OKTA.Requirements[1].Id
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_Severity
+            == OKTA_IDAAS_STIG_OKTA.Requirements[1].Attributes[0].Severity.value
+        )
+        assert (
+            output_data_manual.Requirements_Attributes_StigID
+            == OKTA_IDAAS_STIG_OKTA.Requirements[1].Attributes[0].StigID
+        )
+        assert output_data_manual.Status == "MANUAL"
+        assert output_data_manual.StatusExtended == "Manual check"
+        assert output_data_manual.ResourceId == "manual_check"
+        assert output_data_manual.ResourceName == "Manual check"
+        assert output_data_manual.CheckId == "manual"
+        assert output_data_manual.Muted is False
+
+    @freeze_time("2025-01-01 00:00:00")
+    @mock.patch(
+        "prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta.timestamp",
+        "2025-01-01 00:00:00",
+    )
+    def test_batch_write_data_to_file(self):
+        mock_file = StringIO()
+        findings = [
+            generate_finding_output(
+                provider="okta",
+                account_uid=OKTA_ORG_DOMAIN,
+                account_name=OKTA_ORG_DOMAIN,
+                region="global",
+                service_name="signon",
+                check_id="signon_global_session_idle_timeout_15min",
+                resource_uid="okta-global-session-policy",
+                resource_name="Default Policy",
+                compliance={"Okta-IDaaS-STIG-1R2": ["OKTA-APP-000020"]},
+            )
+        ]
+        output = OktaIDaaSSTIG(findings, OKTA_IDAAS_STIG_OKTA)
+        output._file_descriptor = mock_file
+
+        with patch.object(mock_file, "close", return_value=None):
+            output.batch_write_data_to_file()
+
+        mock_file.seek(0)
+        content = mock_file.read()
+        expected_csv = f"PROVIDER;DESCRIPTION;ORGANIZATIONDOMAIN;ASSESSMENTDATE;REQUIREMENTS_ID;REQUIREMENTS_NAME;REQUIREMENTS_DESCRIPTION;REQUIREMENTS_ATTRIBUTES_SECTION;REQUIREMENTS_ATTRIBUTES_SEVERITY;REQUIREMENTS_ATTRIBUTES_RULEID;REQUIREMENTS_ATTRIBUTES_STIGID;REQUIREMENTS_ATTRIBUTES_CCI;REQUIREMENTS_ATTRIBUTES_CHECKTEXT;REQUIREMENTS_ATTRIBUTES_FIXTEXT;STATUS;STATUSEXTENDED;RESOURCEID;RESOURCENAME;CHECKID;MUTED;FRAMEWORK;NAME\r\nokta;Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS).;{OKTA_ORG_DOMAIN};{datetime.now()};OKTA-APP-000020;Okta must log out a session after a 15-minute period of inactivity.;A session timeout lock is a temporary action taken when a user stops work and moves away from the immediate vicinity of the information system.;CAT II (Medium);medium;SV-273186r1098825_rule;OKTA-APP-000020;['CCI-000057', 'CCI-001133'];Verify the Global Session Policy logs out a session after 15 minutes of inactivity.;From the Admin Console configure the Global Session Policy idle timeout to 15 minutes.;PASS;;okta-global-session-policy;Default Policy;signon_global_session_idle_timeout_15min;False;Okta-IDaaS-STIG;DISA Okta Identity as a Service (IDaaS) STIG V1R2\r\nokta;Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) for Okta Identity as a Service (IDaaS).;;{datetime.now()};OKTA-APP-000650;Okta must enforce a minimum 15-character password length.;The shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised.;CAT II (Medium);medium;SV-273209r1098894_rule;OKTA-APP-000650;['CCI-000205'];Verify the password policy enforces a minimum length of 15 characters.;From the Admin Console set the minimum password length to 15 characters.;MANUAL;Manual check;manual_check;Manual check;manual;False;Okta-IDaaS-STIG;DISA Okta Identity as a Service (IDaaS) STIG V1R2\r\n"
+
+        assert content == expected_csv
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index a3d12493d6..dc8c0fa708 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 ### 🚀 Added
 
+- DISA Okta IDaaS STIG V1R2 compliance framework support with its dedicated mapper, details panel, and icon [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
 - DORA compliance framework support [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
 
 ### 🔄 Changed
diff --git a/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx b/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx
index 363eba2b10..2cb022a174 100644
--- a/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/asd-essential-eight-details.tsx
@@ -85,7 +85,7 @@ export const ASDEssentialEightCustomDetails = ({
           <ComplianceBadge
             label="Maturity Level"
             value={maturityLevel}
-            color="purple"
+            variant="secondary"
           />
         )}
 
@@ -93,7 +93,7 @@ export const ASDEssentialEightCustomDetails = ({
           <ComplianceBadge
             label="Assessment"
             value={assessmentStatus}
-            color="blue"
+            variant="info"
           />
         )}
 
@@ -101,7 +101,7 @@ export const ASDEssentialEightCustomDetails = ({
           <ComplianceBadge
             label="Cloud Applicability"
             value={cloudApplicability}
-            color="orange"
+            variant="secondary"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx b/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx
index 96ed16a8f1..00aa51e4c5 100644
--- a/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/aws-well-architected-details.tsx
@@ -52,7 +52,7 @@ export const AWSWellArchitectedCustomDetails = ({
           <ComplianceBadge
             label="Question ID"
             value={requirement.well_architected_question_id as string}
-            color="indigo"
+            variant="tag"
           />
         )}
 
@@ -60,7 +60,7 @@ export const AWSWellArchitectedCustomDetails = ({
           <ComplianceBadge
             label="Practice ID"
             value={requirement.well_architected_practice_id as string}
-            color="indigo"
+            variant="tag"
           />
         )}
 
@@ -68,7 +68,7 @@ export const AWSWellArchitectedCustomDetails = ({
           <ComplianceBadge
             label="Assessment"
             value={requirement.assessment_method as string}
-            color="blue"
+            variant="info"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/ccc-details.tsx b/ui/components/compliance/compliance-custom-details/ccc-details.tsx
index 309358264d..e3db174280 100644
--- a/ui/components/compliance/compliance-custom-details/ccc-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/ccc-details.tsx
@@ -1,4 +1,4 @@
-import { cn } from "@/lib";
+import { Badge } from "@/components/shadcn/badge/badge";
 import { CCC_MAPPING_SECTIONS, CCC_TEXT_SECTIONS } from "@/lib/compliance/ccc";
 import { Requirement } from "@/types/compliance";
 
@@ -46,7 +46,7 @@ export const CCCCustomDetails = ({ requirement }: CCCDetailsProps) => {
           <ComplianceBadge
             label="Family"
             value={requirement.family_name as string}
-            color="purple"
+            variant="secondary"
           />
         </ComplianceBadgeContainer>
       )}
@@ -68,15 +68,9 @@ export const CCCCustomDetails = ({ requirement }: CCCDetailsProps) => {
                 </span>
                 <div className="flex flex-wrap gap-2">
                   {mapping.Identifiers.map((identifier, idx) => (
-                    <span
-                      key={idx}
-                      className={cn(
-                        "inline-flex items-center rounded-md px-2 py-1 text-xs font-medium ring-1 ring-inset",
-                        section.colorClasses,
-                      )}
-                    >
+                    <Badge key={idx} variant={section.variant}>
                       {identifier}
-                    </span>
+                    </Badge>
                   ))}
                 </div>
               </div>
diff --git a/ui/components/compliance/compliance-custom-details/cis-details.tsx b/ui/components/compliance/compliance-custom-details/cis-details.tsx
index c46f061188..25823038d5 100644
--- a/ui/components/compliance/compliance-custom-details/cis-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/cis-details.tsx
@@ -41,7 +41,7 @@ export const CISCustomDetails = ({ requirement }: CISDetailsProps) => {
           <ComplianceBadge
             label="Profile"
             value={requirement.profile as string}
-            color="purple"
+            variant="secondary"
           />
         )}
 
@@ -49,7 +49,7 @@ export const CISCustomDetails = ({ requirement }: CISDetailsProps) => {
           <ComplianceBadge
             label="Assessment"
             value={requirement.assessment_status as string}
-            color="blue"
+            variant="info"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/csa-details.tsx b/ui/components/compliance/compliance-custom-details/csa-details.tsx
index 738e4a8aab..81dbcc158a 100644
--- a/ui/components/compliance/compliance-custom-details/csa-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/csa-details.tsx
@@ -1,4 +1,4 @@
-import { cn } from "@/lib";
+import { Badge } from "@/components/shadcn/badge/badge";
 import { CSA_MAPPING_SECTIONS } from "@/lib/compliance/csa";
 import { Requirement } from "@/types/compliance";
 
@@ -36,28 +36,28 @@ export const CSACustomDetails = ({ requirement }: CSADetailsProps) => {
           <ComplianceBadge
             label="CCM Lite"
             value={requirement.ccm_lite as string}
-            color={requirement.ccm_lite === "Yes" ? "green" : "gray"}
+            variant={requirement.ccm_lite === "Yes" ? "success" : "secondary"}
           />
         )}
         {requirement.iaas && (
           <ComplianceBadge
             label="IaaS"
             value={requirement.iaas as string}
-            color="blue"
+            variant="info"
           />
         )}
         {requirement.paas && (
           <ComplianceBadge
             label="PaaS"
             value={requirement.paas as string}
-            color="blue"
+            variant="info"
           />
         )}
         {requirement.saas && (
           <ComplianceBadge
             label="SaaS"
             value={requirement.saas as string}
-            color="blue"
+            variant="info"
           />
         )}
       </ComplianceBadgeContainer>
@@ -72,15 +72,9 @@ export const CSACustomDetails = ({ requirement }: CSADetailsProps) => {
                 </span>
                 <div className="flex flex-wrap gap-2">
                   {mapping.Identifiers.map((identifier, idx) => (
-                    <span
-                      key={idx}
-                      className={cn(
-                        "inline-flex items-center rounded-md px-2 py-1 text-xs font-medium ring-1 ring-inset",
-                        section.colorClasses,
-                      )}
-                    >
+                    <Badge key={idx} variant={section.variant}>
                       {identifier}
-                    </span>
+                    </Badge>
                   ))}
                 </div>
               </div>
diff --git a/ui/components/compliance/compliance-custom-details/dora-details.tsx b/ui/components/compliance/compliance-custom-details/dora-details.tsx
index 3d84e891ba..f27412be5b 100644
--- a/ui/components/compliance/compliance-custom-details/dora-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/dora-details.tsx
@@ -26,21 +26,21 @@ export const DORACustomDetails = ({ requirement }: DORADetailsProps) => {
           <ComplianceBadge
             label="Pillar"
             value={requirement.pillar as string}
-            color="blue"
+            variant="tag"
           />
         )}
         {requirement.article && (
           <ComplianceBadge
             label="Article"
             value={requirement.article as string}
-            color="indigo"
+            variant="tag"
           />
         )}
         {requirement.article_title && (
           <ComplianceBadge
             label="Article Title"
             value={requirement.article_title as string}
-            color="gray"
+            variant="tag"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/ens-details.tsx b/ui/components/compliance/compliance-custom-details/ens-details.tsx
index 9e947cea14..2950c495cd 100644
--- a/ui/components/compliance/compliance-custom-details/ens-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/ens-details.tsx
@@ -28,7 +28,7 @@ export const ENSCustomDetails = ({
           <ComplianceBadge
             label="Type"
             value={translateType(requirement.type as string)}
-            color="orange"
+            variant="secondary"
           />
         )}
 
@@ -36,7 +36,7 @@ export const ENSCustomDetails = ({
           <ComplianceBadge
             label="Level"
             value={requirement.nivel as string}
-            color="red"
+            variant="error"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/generic-details.tsx b/ui/components/compliance/compliance-custom-details/generic-details.tsx
index caa3fec05d..323e3d9a99 100644
--- a/ui/components/compliance/compliance-custom-details/generic-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/generic-details.tsx
@@ -26,7 +26,7 @@ export const GenericCustomDetails = ({
           <ComplianceBadge
             label="Item ID"
             value={requirement.item_id as string}
-            color="indigo"
+            variant="tag"
           />
         )}
 
@@ -34,7 +34,7 @@ export const GenericCustomDetails = ({
           <ComplianceBadge
             label="Service"
             value={requirement.service as string}
-            color="blue"
+            variant="info"
           />
         )}
 
@@ -42,7 +42,7 @@ export const GenericCustomDetails = ({
           <ComplianceBadge
             label="Type"
             value={requirement.type as string}
-            color="orange"
+            variant="secondary"
           />
         )}
       </ComplianceBadgeContainer>
diff --git a/ui/components/compliance/compliance-custom-details/mitre-details.tsx b/ui/components/compliance/compliance-custom-details/mitre-details.tsx
index 8fa7fa276d..53fc583f2c 100644
--- a/ui/components/compliance/compliance-custom-details/mitre-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/mitre-details.tsx
@@ -37,7 +37,7 @@ export const MITRECustomDetails = ({
           <ComplianceBadge
             label="Technique ID"
             value={requirement.technique_id as string}
-            color="indigo"
+            variant="tag"
           />
         )}
       </ComplianceBadgeContainer>
@@ -81,17 +81,17 @@ export const MITRECustomDetails = ({
                   <ComplianceBadge
                     label="Service"
                     value={service.service}
-                    color="blue"
+                    variant="info"
                   />
                   <ComplianceBadge
                     label="Category"
                     value={service.category}
-                    color="indigo"
+                    variant="tag"
                   />
                   <ComplianceBadge
                     label="Coverage"
                     value={service.value}
-                    color="orange"
+                    variant="secondary"
                   />
                 </div>
                 {service.comment && (
diff --git a/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx b/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx
new file mode 100644
index 0000000000..0869b7f390
--- /dev/null
+++ b/ui/components/compliance/compliance-custom-details/okta-idaas-stig-details.tsx
@@ -0,0 +1,65 @@
+import { Severity, SeverityBadge } from "@/components/ui/table";
+import { Requirement } from "@/types/compliance";
+
+import {
+  ComplianceBadge,
+  ComplianceBadgeContainer,
+  ComplianceChipContainer,
+  ComplianceDetailContainer,
+  ComplianceDetailSection,
+  ComplianceDetailText,
+} from "./shared-components";
+
+export const OktaIDaaSStigCustomDetails = ({
+  requirement,
+}: {
+  requirement: Requirement;
+}) => {
+  const severity = requirement.severity as string | undefined;
+  const stigId = requirement.stig_id as string | undefined;
+  const ruleId = requirement.rule_id as string | undefined;
+  const cci = requirement.cci as string[] | undefined;
+  const checkText = requirement.check_text as string | undefined;
+  const fixText = requirement.fix_text as string | undefined;
+
+  return (
+    <ComplianceDetailContainer>
+      <ComplianceBadgeContainer>
+        {severity && (
+          <div className="flex items-center gap-2">
+            <span className="text-muted-foreground text-sm font-medium">
+              Severity:
+            </span>
+            <SeverityBadge severity={severity.toLowerCase() as Severity} />
+          </div>
+        )}
+        {stigId && (
+          <ComplianceBadge label="STIG ID" value={stigId} variant="tag" />
+        )}
+        {ruleId && (
+          <ComplianceBadge label="Rule ID" value={ruleId} variant="tag" />
+        )}
+      </ComplianceBadgeContainer>
+
+      {requirement.description && (
+        <ComplianceDetailSection title="Description">
+          <ComplianceDetailText>{requirement.description}</ComplianceDetailText>
+        </ComplianceDetailSection>
+      )}
+
+      <ComplianceChipContainer title="CCI" items={cci || []} />
+
+      {checkText && (
+        <ComplianceDetailSection title="Check">
+          <ComplianceDetailText>{checkText}</ComplianceDetailText>
+        </ComplianceDetailSection>
+      )}
+
+      {fixText && (
+        <ComplianceDetailSection title="Fix">
+          <ComplianceDetailText>{fixText}</ComplianceDetailText>
+        </ComplianceDetailSection>
+      )}
+    </ComplianceDetailContainer>
+  );
+};
diff --git a/ui/components/compliance/compliance-custom-details/shared-components.tsx b/ui/components/compliance/compliance-custom-details/shared-components.tsx
index d5c69499af..22ba330d57 100644
--- a/ui/components/compliance/compliance-custom-details/shared-components.tsx
+++ b/ui/components/compliance/compliance-custom-details/shared-components.tsx
@@ -1,4 +1,12 @@
-import { cn } from "@/lib/utils";
+import { VariantProps } from "class-variance-authority";
+
+import { Badge, badgeVariants } from "@/components/shadcn/badge/badge";
+
+// Variants come straight from the canonical shadcn Badge so compliance panels
+// share the same badge vocabulary (and tokens) as the rest of the app.
+export type ComplianceBadgeVariant = NonNullable<
+  VariantProps<typeof badgeVariants>["variant"]
+>;
 
 export const ComplianceDetailContainer = ({
   children,
@@ -43,55 +51,28 @@ export const ComplianceBadgeContainer = ({
   return <div className="flex flex-wrap items-center gap-3">{children}</div>;
 };
 
-type BadgeColor =
-  | "red" // Risk/Level/Severity
-  | "blue" // Assessment/Method
-  | "orange" // Type/Category
-  | "green" // Weight/Score (positive)
-  | "purple" // Profile
-  | "indigo" // IDs/References
-  | "gray"; // Additional Info/Neutral
-
 export const ComplianceBadge = ({
   label,
   value,
-  color,
+  variant,
   conditional = false,
 }: {
   label: string;
   value: string | number;
-  color: BadgeColor;
+  variant: ComplianceBadgeVariant;
   conditional?: boolean;
 }) => {
-  const actualColor = conditional && Number(value) === 0 ? "gray" : color;
-
-  const colorClasses = {
-    red: "bg-red-50 text-red-700 ring-red-600/10 dark:bg-red-400/10 dark:text-red-400 dark:ring-red-400/20",
-    blue: "bg-blue-50 text-blue-700 ring-blue-600/10 dark:bg-blue-400/10 dark:text-blue-400 dark:ring-blue-400/20",
-    orange:
-      "bg-orange-50 text-orange-700 ring-orange-600/10 dark:bg-orange-400/10 dark:text-orange-400 dark:ring-orange-400/20",
-    green:
-      "bg-green-50 text-green-700 ring-green-600/10 dark:bg-green-400/10 dark:text-green-400 dark:ring-green-400/20",
-    purple:
-      "bg-purple-50 text-purple-700 ring-purple-600/10 dark:bg-purple-400/10 dark:text-purple-400 dark:ring-purple-400/20",
-    indigo:
-      "bg-indigo-50 text-indigo-700 ring-indigo-600/10 dark:bg-indigo-400/10 dark:text-indigo-400 dark:ring-indigo-400/20",
-    gray: "bg-gray-50 text-gray-600 ring-gray-500/10 dark:bg-gray-400/10 dark:text-gray-400 dark:ring-gray-400/20",
-  };
+  // A "conditional" metric badge with a zero value drops to a neutral variant
+  // so empty scores don't read as a meaningful (e.g. positive) result.
+  const actualVariant: ComplianceBadgeVariant =
+    conditional && Number(value) === 0 ? "secondary" : variant;
 
   return (
     <div className="flex items-center gap-2">
       <span className="text-muted-foreground text-sm font-medium">
         {label}:
       </span>
-      <span
-        className={cn(
-          "inline-flex items-center rounded-md px-2 py-1 text-xs font-medium ring-1 ring-inset",
-          colorClasses[actualColor],
-        )}
-      >
-        {value}
-      </span>
+      <Badge variant={actualVariant}>{value}</Badge>
     </div>
   );
 };
@@ -132,12 +113,9 @@ export const ComplianceChipContainer = ({
     <ComplianceDetailSection title={title}>
       <div className="flex flex-wrap gap-2">
         {items.map((item: string, index: number) => (
-          <span
-            key={index}
-            className="inline-flex items-center rounded-md bg-gray-50 px-2 py-1 text-xs font-medium text-gray-600 ring-1 ring-gray-500/10 ring-inset dark:bg-gray-400/10 dark:text-gray-400 dark:ring-gray-400/20"
-          >
+          <Badge key={index} variant="tag">
             {item}
-          </span>
+          </Badge>
         ))}
       </div>
     </ComplianceDetailSection>
diff --git a/ui/components/compliance/compliance-custom-details/threat-details.tsx b/ui/components/compliance/compliance-custom-details/threat-details.tsx
index 822612234d..542583ff0e 100644
--- a/ui/components/compliance/compliance-custom-details/threat-details.tsx
+++ b/ui/components/compliance/compliance-custom-details/threat-details.tsx
@@ -34,7 +34,7 @@ export const ThreatCustomDetails = ({
           <ComplianceBadge
             label="Risk Level"
             value={requirement.levelOfRisk}
-            color="red"
+            variant="error"
           />
         )}
 
@@ -42,7 +42,7 @@ export const ThreatCustomDetails = ({
           <ComplianceBadge
             label="Weight"
             value={requirement.weight}
-            color="green"
+            variant="success"
           />
         )}
 
@@ -50,7 +50,7 @@ export const ThreatCustomDetails = ({
           <ComplianceBadge
             label="Score"
             value={requirement.score}
-            color="green"
+            variant="success"
             conditional={true}
           />
         )}
@@ -61,13 +61,13 @@ export const ThreatCustomDetails = ({
               <ComplianceBadge
                 label="Findings"
                 value={`${requirement.passedFindings}/${requirement.totalFindings}`}
-                color="blue"
+                variant="info"
               />
               {requirement.totalFindings > 0 && (
                 <ComplianceBadge
                   label="Pass Rate"
                   value={`${Math.round((requirement.passedFindings / requirement.totalFindings) * 100)}%`}
-                  color="green"
+                  variant="success"
                   conditional={true}
                 />
               )}
diff --git a/ui/components/icons/compliance/IconCompliance.test.ts b/ui/components/icons/compliance/IconCompliance.test.ts
index ca5f5a363e..b956b80548 100644
--- a/ui/components/icons/compliance/IconCompliance.test.ts
+++ b/ui/components/icons/compliance/IconCompliance.test.ts
@@ -58,6 +58,12 @@ describe("getComplianceIcon", () => {
       expect(getComplianceIcon("prowler_threatscore_aws")).toBe(threatLogo);
     });
 
+    it("resolves the Okta IDaaS STIG via the `okta` keyword", () => {
+      const oktaLogo = getComplianceIcon("Okta-IDaaS-STIG");
+      expect(oktaLogo).toBeDefined();
+      expect(getComplianceIcon("okta_idaas_stig_v1r2_okta")).toBe(oktaLogo);
+    });
+
     it("resolves ASD Essential Eight by the framework keyword, not by `aws`", () => {
       const essentialLogo = getComplianceIcon("ASD-Essential-Eight");
       expect(essentialLogo).toBeDefined();
diff --git a/ui/components/icons/compliance/IconCompliance.tsx b/ui/components/icons/compliance/IconCompliance.tsx
index fe493e2096..ab0fb9a36a 100644
--- a/ui/components/icons/compliance/IconCompliance.tsx
+++ b/ui/components/icons/compliance/IconCompliance.tsx
@@ -18,6 +18,7 @@ import KISALogo from "./kisa.svg";
 import MITRELogo from "./mitre-attack.svg";
 import NIS2Logo from "./nis2.svg";
 import NISTLogo from "./nist.svg";
+import OktaLogo from "./okta.svg";
 import PCILogo from "./pci-dss.svg";
 import PROWLERTHREATLogo from "./prowlerThreat.svg";
 import RBILogo from "./rbi.svg";
@@ -72,6 +73,7 @@ const COMPLIANCE_LOGOS = [
   // compliance_id is just `dora`, no provider suffix.
   ["dora", DORALogo],
   ["secnumcloud", ANSSILogo],
+  ["okta", OktaLogo],
   ["aws", AWSLogo],
 ] as const;
 
diff --git a/ui/components/icons/compliance/okta.svg b/ui/components/icons/compliance/okta.svg
new file mode 100644
index 0000000000..91b8acbb20
--- /dev/null
+++ b/ui/components/icons/compliance/okta.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 63 63" width="40" height="40"><path fill="#00297A" d="M34.6,0.4l-1.3,16c-0.6-0.1-1.2-0.1-1.9-0.1c-0.8,0-1.6,0.1-2.3,0.2l-0.7-7.7c0-0.2,0.2-0.5,0.4-0.5h1.3l-0.6-7.8c0-0.2,0.2-0.5,0.4-0.5h4.3C34.5,0,34.7,0.2,34.6,0.4L34.6,0.4L34.6,0.4z M23.8,1.2c-0.1-0.2-0.3-0.4-0.5-0.3l-4,1.5C19,2.5,18.9,2.8,19,3l3.3,7.1l-1.2,0.5c-0.2,0.1-0.3,0.3-0.2,0.6l3.3,7c1.2-0.7,2.5-1.2,3.9-1.5L23.8,1.2L23.8,1.2z M14,5.7l9.3,13.1c-1.2,0.8-2.2,1.7-3.1,2.7L14.5,16c-0.2-0.2-0.2-0.5,0-0.6l1-0.8L10,9c-0.2-0.2-0.2-0.5,0-0.6l3.3-2.7C13.5,5.4,13.8,5.5,14,5.7L14,5.7z M6.2,13.2c-0.2-0.1-0.5-0.1-0.6,0.1l-2.1,3.7c-0.1,0.2,0,0.5,0.2,0.6l7.1,3.4l-0.7,1.1c-0.1,0.2,0,0.5,0.2,0.6l7.1,3.2c0.5-1.3,1.2-2.5,2-3.6L6.2,13.2z M0.9,23.3c0-0.2,0.3-0.4,0.5-0.3l15.5,4c-0.4,1.3-0.6,2.7-0.7,4.1l-7.8-0.6c-0.2,0-0.4-0.2-0.4-0.5l0.2-1.3L0.6,28c-0.2,0-0.4-0.2-0.4-0.5L0.9,23.3L0.9,23.3L0.9,23.3z M0.4,33.8C0.1,33.8,0,34,0,34.3l0.8,4.2c0,0.2,0.3,0.4,0.5,0.3l7.6-2l0.2,1.3c0,0.2,0.3,0.4,0.5,0.3l7.5-2.1c-0.4-1.3-0.7-2.7-0.8-4.1L0.4,33.8L0.4,33.8z M2.9,44.9c-0.1-0.2,0-0.5,0.2-0.6l14.5-6.9c0.5,1.3,1.3,2.5,2.2,3.6l-6.3,4.5c-0.2,0.1-0.5,0.1-0.6-0.1L12,44.3l-6.5,4.5c-0.2,0.1-0.5,0.1-0.6-0.1L2.9,44.9L2.9,44.9z M20.4,41.9L9.1,53.3c-0.2,0.2-0.2,0.5,0,0.6l3.3,2.7c0.2,0.2,0.5,0.1,0.6-0.1l4.6-6.4l1,0.9c0.2,0.2,0.5,0.1,0.6-0.1l4.4-6.4C22.4,43.8,21.3,42.9,20.4,41.9L20.4,41.9z M18.2,60.1c-0.2-0.1-0.3-0.3-0.2-0.6L24.6,45c1.2,0.6,2.6,1.1,3.9,1.4l-2,7.5c-0.1,0.2-0.3,0.4-0.5,0.3l-1.2-0.5l-2.1,7.6c-0.1,0.2-0.3,0.4-0.5,0.3L18.2,60.1L18.2,60.1L18.2,60.1z M29.6,46.6l-1.3,16c0,0.2,0.2,0.5,0.4,0.5H33c0.2,0,0.4-0.2,0.4-0.5l-0.6-7.8h1.3c0.2,0,0.4-0.2,0.4-0.5l-0.7-7.7c-0.8,0.1-1.5,0.2-2.3,0.2C30.9,46.7,30.2,46.7,29.6,46.6L29.6,46.6z M45.1,3.4c0.1-0.2,0-0.5-0.2-0.6l-4-1.5c-0.2-0.1-0.5,0.1-0.5,0.3l-2.1,7.6l-1.2-0.5c-0.2-0.1-0.5,0.1-0.5,0.3l-2,7.5c1.4,0.3,2.7,0.8,3.9,1.4L45.1,3.4L45.1,3.4z M53.9,9.7L42.6,21.1c-0.9-1-2-1.9-3.2-2.6l4.4-6.4c0.1-0.2,0.4-0.2,0.6-0.1l1,0.9l4.6-6.4c0.1-0.2,0.4-0.2,0.6-0.1l3.3,2.7C54,9.3,54,9.6,53.9,9.7L53.9,9.7z M59.9,18.7c0.2-0.1,0.3-0.4,0.2-0.6L58,14.4c-0.1-0.2-0.4-0.3-0.6-0.1l-6.5,4.5l-0.7-1.1c-0.1-0.2-0.4-0.3-0.6-0.1L43.3,22c0.9,1.1,1.6,2.3,2.2,3.6L59.9,18.7L59.9,18.7z M62.2,24.5l0.7,4.2c0,0.2-0.1,0.5-0.4,0.5l-15.9,1.5c-0.1-1.4-0.4-2.8-0.8-4.1l7.5-2.1c0.2-0.1,0.5,0.1,0.5,0.3l0.2,1.3l7.6-2C61.9,24.1,62.1,24.3,62.2,24.5L62.2,24.5L62.2,24.5z M61.5,40c0.2,0.1,0.5-0.1,0.5-0.3l0.7-4.2c0-0.2-0.1-0.5-0.4-0.5l-7.8-0.7l0.2-1.3c0-0.2-0.1-0.5-0.4-0.5l-7.8-0.6c0,1.4-0.3,2.8-0.7,4.1L61.5,40L61.5,40L61.5,40z M57.4,49.6c-0.1,0.2-0.4,0.3-0.6,0.1l-13.2-9.1c0.8-1.1,1.5-2.3,2-3.6l7.1,3.2c0.2,0.1,0.3,0.4,0.2,0.6L52.2,42l7.1,3.4c0.2,0.1,0.3,0.4,0.2,0.6L57.4,49.6C57.4,49.6,57.4,49.6,57.4,49.6z M39.7,44.2L49,57.3c0.1,0.2,0.4,0.2,0.6,0.1l3.3-2.7c0.2-0.2,0.2-0.4,0-0.6l-5.5-5.6l1-0.8c0.2-0.2,0.2-0.4,0-0.6l-5.5-5.5C42,42.6,40.9,43.5,39.7,44.2L39.7,44.2L39.7,44.2z M39.7,62c-0.2,0.1-0.5-0.1-0.5-0.3l-4.2-15.4c1.4-0.3,2.7-0.8,3.9-1.5l3.3,7c0.1,0.2,0,0.5-0.2,0.6l-1.2,0.5l3.3,7.1c0.1,0.2,0,0.5-0.2,0.6L39.7,62L39.7,62L39.7,62z"/></svg>
diff --git a/ui/components/shadcn/badge/badge.test.tsx b/ui/components/shadcn/badge/badge.test.tsx
new file mode 100644
index 0000000000..adae2f54b8
--- /dev/null
+++ b/ui/components/shadcn/badge/badge.test.tsx
@@ -0,0 +1,30 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { Badge } from "./badge";
+
+describe("Badge", () => {
+  it("renders its children", () => {
+    render(<Badge variant="info">Assessment</Badge>);
+    expect(screen.getByText("Assessment")).toBeInTheDocument();
+  });
+
+  it("applies the info variant token classes", () => {
+    const { container } = render(<Badge variant="info">Info</Badge>);
+    const badge = container.querySelector("[data-slot='badge']");
+    // The info variant is built from the existing design-system blue token
+    // (bg-data-info) rather than a bespoke palette.
+    expect(badge?.className).toContain("bg-bg-data-info/15");
+    expect(badge?.className).toContain("text-bg-data-info");
+  });
+
+  it("merges a custom className", () => {
+    const { container } = render(
+      <Badge variant="tag" className="extra-class">
+        Tag
+      </Badge>,
+    );
+    const badge = container.querySelector("[data-slot='badge']");
+    expect(badge?.className).toContain("extra-class");
+  });
+});
diff --git a/ui/components/shadcn/badge/badge.tsx b/ui/components/shadcn/badge/badge.tsx
index f200fda7e2..fd1a6efd11 100644
--- a/ui/components/shadcn/badge/badge.tsx
+++ b/ui/components/shadcn/badge/badge.tsx
@@ -24,6 +24,7 @@ const badgeVariants = cva(
           "border-bg-warning/30 bg-bg-warning-secondary/20 text-text-warning-primary",
         error:
           "border-transparent bg-bg-fail-secondary text-text-error-primary",
+        info: "border-transparent bg-bg-data-info/15 text-bg-data-info",
       },
     },
     defaultVariants: {
diff --git a/ui/lib/compliance/ccc.tsx b/ui/lib/compliance/ccc.tsx
index fc6f7e898a..59df6a7c09 100644
--- a/ui/lib/compliance/ccc.tsx
+++ b/ui/lib/compliance/ccc.tsx
@@ -1,6 +1,7 @@
 import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
 import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
 import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import { ComplianceBadgeVariant } from "@/components/compliance/compliance-custom-details/shared-components";
 import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
 import { FindingStatus } from "@/components/ui/table/status-finding-badge";
 import {
@@ -39,7 +40,7 @@ export interface CCCTextSection {
 export interface CCCMappingSection {
   title: string;
   key: keyof Requirement;
-  colorClasses: string;
+  variant: ComplianceBadgeVariant;
 }
 
 export const CCC_TEXT_SECTIONS: CCCTextSection[] = [
@@ -71,14 +72,12 @@ export const CCC_MAPPING_SECTIONS: CCCMappingSection[] = [
   {
     title: "Threat Mappings",
     key: "section_threat_mappings",
-    colorClasses:
-      "bg-red-50 text-red-700 ring-red-600/10 dark:bg-red-400/10 dark:text-red-400 dark:ring-red-400/20",
+    variant: "error",
   },
   {
     title: "Guideline Mappings",
     key: "section_guideline_mappings",
-    colorClasses:
-      "bg-blue-50 text-blue-700 ring-blue-600/10 dark:bg-blue-400/10 dark:text-blue-400 dark:ring-blue-400/20",
+    variant: "info",
   },
 ];
 
diff --git a/ui/lib/compliance/compliance-mapper.test.ts b/ui/lib/compliance/compliance-mapper.test.ts
index 9526b50b07..25933b8dff 100644
--- a/ui/lib/compliance/compliance-mapper.test.ts
+++ b/ui/lib/compliance/compliance-mapper.test.ts
@@ -62,6 +62,10 @@ vi.mock(
   "@/components/compliance/compliance-custom-details/mitre-details",
   () => ({ MITRECustomDetails: stubFactory("MITREStub") }),
 );
+vi.mock(
+  "@/components/compliance/compliance-custom-details/okta-idaas-stig-details",
+  () => ({ OktaIDaaSStigCustomDetails: stubFactory("OktaIDaaSStigStub") }),
+);
 vi.mock(
   "@/components/compliance/compliance-custom-details/threat-details",
   () => ({ ThreatCustomDetails: stubFactory("ThreatStub") }),
@@ -144,6 +148,7 @@ describe("getComplianceMapper", () => {
       { framework: "ProwlerThreatScore", expected: "ThreatStub" },
       { framework: "CCC", expected: "CCCStub" },
       { framework: "CSA-CCM", expected: "CSAStub" },
+      { framework: "Okta-IDaaS-STIG", expected: "OktaIDaaSStigStub" },
     ];
 
     for (const { framework, expected } of wiring) {
@@ -188,6 +193,7 @@ describe("getComplianceMapper", () => {
       "ProwlerThreatScore",
       "CCC",
       "CSA-CCM",
+      "Okta-IDaaS-STIG",
     ]) {
       const mapper = getComplianceMapper(framework);
       expect(Object.keys(mapper).sort(), framework).toEqual(expectedKeys);
diff --git a/ui/lib/compliance/compliance-mapper.ts b/ui/lib/compliance/compliance-mapper.ts
index ba8c97ecfc..2e44958c73 100644
--- a/ui/lib/compliance/compliance-mapper.ts
+++ b/ui/lib/compliance/compliance-mapper.ts
@@ -12,6 +12,7 @@ import { GenericCustomDetails } from "@/components/compliance/compliance-custom-
 import { ISOCustomDetails } from "@/components/compliance/compliance-custom-details/iso-details";
 import { KISACustomDetails } from "@/components/compliance/compliance-custom-details/kisa-details";
 import { MITRECustomDetails } from "@/components/compliance/compliance-custom-details/mitre-details";
+import { OktaIDaaSStigCustomDetails } from "@/components/compliance/compliance-custom-details/okta-idaas-stig-details";
 import { ThreatCustomDetails } from "@/components/compliance/compliance-custom-details/threat-details";
 import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
 import {
@@ -74,6 +75,10 @@ import {
   mapComplianceData as mapMITREComplianceData,
   toAccordionItems as toMITREAccordionItems,
 } from "./mitre";
+import {
+  mapComplianceData as mapOktaIDaaSStigComplianceData,
+  toAccordionItems as toOktaIDaaSStigAccordionItems,
+} from "./okta-idaas-stig";
 import {
   getTopFailedSections as getThreatScoreTopFailedSections,
   mapComplianceData as mapThetaComplianceData,
@@ -213,6 +218,15 @@ const getComplianceMappers = (): Record<string, ComplianceMapper> => ({
     getDetailsComponent: (requirement: Requirement) =>
       createElement(CSACustomDetails, { requirement }),
   },
+  "Okta-IDaaS-STIG": {
+    mapComplianceData: mapOktaIDaaSStigComplianceData,
+    toAccordionItems: toOktaIDaaSStigAccordionItems,
+    getTopFailedSections,
+    calculateCategoryHeatmapData: (data: Framework[]) =>
+      calculateCategoryHeatmapData(data),
+    getDetailsComponent: (requirement: Requirement) =>
+      createElement(OktaIDaaSStigCustomDetails, { requirement }),
+  },
   // DORA (Regulation (EU) 2022/2554) — universal framework keyed by the
   // `framework` field of `prowler/compliance/dora.json` ("DORA"). Groups by
   // Pillar (5 enum values) and surfaces Pillar / Article / ArticleTitle in
diff --git a/ui/lib/compliance/csa.tsx b/ui/lib/compliance/csa.tsx
index 93974d6b47..c4624baa43 100644
--- a/ui/lib/compliance/csa.tsx
+++ b/ui/lib/compliance/csa.tsx
@@ -1,6 +1,7 @@
 import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
 import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
 import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import { ComplianceBadgeVariant } from "@/components/compliance/compliance-custom-details/shared-components";
 import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
 import { FindingStatus } from "@/components/ui/table/status-finding-badge";
 import {
@@ -24,15 +25,14 @@ import {
 export interface CSAMappingSection {
   title: string;
   key: keyof Requirement;
-  colorClasses: string;
+  variant: ComplianceBadgeVariant;
 }
 
 export const CSA_MAPPING_SECTIONS: CSAMappingSection[] = [
   {
     title: "Scope Applicability",
     key: "scope_applicability",
-    colorClasses:
-      "bg-blue-50 text-blue-700 ring-blue-600/10 dark:bg-blue-400/10 dark:text-blue-400 dark:ring-blue-400/20",
+    variant: "info",
   },
 ];
 
diff --git a/ui/lib/compliance/okta-idaas-stig.tsx b/ui/lib/compliance/okta-idaas-stig.tsx
new file mode 100644
index 0000000000..5a00886406
--- /dev/null
+++ b/ui/lib/compliance/okta-idaas-stig.tsx
@@ -0,0 +1,163 @@
+import { ClientAccordionContent } from "@/components/compliance/compliance-accordion/client-accordion-content";
+import { ComplianceAccordionRequirementTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-requeriment-title";
+import { ComplianceAccordionTitle } from "@/components/compliance/compliance-accordion/compliance-accordion-title";
+import { AccordionItemProps } from "@/components/ui/accordion/Accordion";
+import { FindingStatus } from "@/components/ui/table/status-finding-badge";
+import {
+  AttributesData,
+  Control,
+  Framework,
+  isOktaIDaaSStigAttributesMetadata,
+  OktaIDaaSStigRequirement,
+  Requirement,
+  REQUIREMENT_STATUS,
+  RequirementsData,
+  RequirementStatus,
+} from "@/types/compliance";
+
+import {
+  calculateFrameworkCounters,
+  createRequirementsMap,
+  findOrCreateCategory,
+  findOrCreateControl,
+  findOrCreateFramework,
+} from "./commons";
+
+const getStatusCounters = (status: RequirementStatus) => ({
+  pass: status === REQUIREMENT_STATUS.PASS ? 1 : 0,
+  fail: status === REQUIREMENT_STATUS.FAIL ? 1 : 0,
+  manual: status === REQUIREMENT_STATUS.MANUAL ? 1 : 0,
+});
+
+export const mapComplianceData = (
+  attributesData: AttributesData,
+  requirementsData: RequirementsData,
+): Framework[] => {
+  const attributes = attributesData?.data || [];
+  const requirementsMap = createRequirementsMap(requirementsData);
+  const frameworks: Framework[] = [];
+
+  for (const attributeItem of attributes) {
+    const id = attributeItem.id;
+    const metadataArray = attributeItem.attributes?.attributes?.metadata;
+    const attrs = metadataArray?.[0];
+    if (!isOktaIDaaSStigAttributesMetadata(attrs)) continue;
+
+    const requirementData = requirementsMap.get(id);
+    if (!requirementData) continue;
+
+    const frameworkName = attributeItem.attributes.framework;
+    // Level 1: Section maps to the STIG severity category (e.g. "CAT II (Medium)")
+    const categoryName = attrs.Section;
+    // Level 2: each requirement is its own control, labelled by its STIG ID
+    const controlLabel = id;
+    const description = attributeItem.attributes.description;
+    // Human-readable STIG title (e.g. "Okta must log out a session after a
+    // 15-minute period of inactivity."). Surface it next to the STIG ID and
+    // fall back to the bare ID when missing, mirroring DORA/CSA.
+    const requirementName = attributeItem.attributes.name || "";
+    const status = requirementData.attributes.status || "";
+    const checks = attributeItem.attributes.attributes.check_ids || [];
+
+    const framework = findOrCreateFramework(frameworks, frameworkName);
+    const category = findOrCreateCategory(framework.categories, categoryName);
+    const control = findOrCreateControl(category.controls, controlLabel);
+
+    const finalStatus: RequirementStatus = status as RequirementStatus;
+    const requirement = {
+      name: requirementName ? `${id} - ${requirementName}` : id,
+      description,
+      status: finalStatus,
+      check_ids: checks,
+      ...getStatusCounters(finalStatus),
+      severity: attrs.Severity,
+      rule_id: attrs.RuleID,
+      stig_id: attrs.StigID,
+      cci: attrs.CCI,
+      check_text: attrs.CheckText,
+      fix_text: attrs.FixText,
+    } satisfies OktaIDaaSStigRequirement;
+
+    control.requirements.push(requirement);
+  }
+
+  calculateFrameworkCounters(frameworks);
+
+  return frameworks;
+};
+
+const createRequirementItem = (
+  requirement: Requirement,
+  frameworkName: string,
+  categoryName: string,
+  controlIndex: number,
+  scanId: string,
+): AccordionItemProps => ({
+  key: `${frameworkName}-${categoryName}-control-${controlIndex}`,
+  title: (
+    <ComplianceAccordionRequirementTitle
+      type=""
+      name={requirement.name}
+      status={requirement.status as FindingStatus}
+    />
+  ),
+  content: (
+    <ClientAccordionContent
+      key={`content-${frameworkName}-${categoryName}-control-${controlIndex}`}
+      requirement={requirement}
+      scanId={scanId}
+      framework={frameworkName}
+      disableFindings={
+        requirement.check_ids.length === 0 && requirement.manual === 0
+      }
+    />
+  ),
+  items: [],
+});
+
+const createControlItem = (
+  control: Control,
+  frameworkName: string,
+  categoryName: string,
+  controlIndex: number,
+  scanId: string,
+): AccordionItemProps =>
+  createRequirementItem(
+    control.requirements[0],
+    frameworkName,
+    categoryName,
+    controlIndex,
+    scanId,
+  );
+
+export const toAccordionItems = (
+  data: Framework[],
+  scanId: string | undefined,
+): AccordionItemProps[] => {
+  const safeId = scanId || "";
+
+  return data.flatMap((framework) =>
+    framework.categories.map((category) => ({
+      key: `${framework.name}-${category.name}`,
+      title: (
+        <ComplianceAccordionTitle
+          label={category.name}
+          pass={category.pass}
+          fail={category.fail}
+          manual={category.manual}
+          isParentLevel={true}
+        />
+      ),
+      content: "",
+      items: category.controls.map((control, controlIndex) =>
+        createControlItem(
+          control,
+          framework.name,
+          category.name,
+          controlIndex,
+          safeId,
+        ),
+      ),
+    })),
+  );
+};
diff --git a/ui/types/compliance.ts b/ui/types/compliance.ts
index e926efe356..fde9d260e9 100644
--- a/ui/types/compliance.ts
+++ b/ui/types/compliance.ts
@@ -279,6 +279,12 @@ const isOneOf = <T extends string>(
 const isStringArray = (value: unknown): value is string[] =>
   Array.isArray(value) && value.every((item) => typeof item === "string");
 
+const isOptionalString = (value: unknown): value is string | undefined =>
+  value === undefined || typeof value === "string";
+
+const isOptionalStringArray = (value: unknown): value is string[] | undefined =>
+  value === undefined || isStringArray(value);
+
 const ASD_METADATA_STRING_FIELDS = [
   "Section",
   "Description",
@@ -327,6 +333,43 @@ export interface ASDEssentialEightRequirement extends Requirement {
   references: ASDEssentialEightAttributesMetadata["References"];
 }
 
+export interface OktaIDaaSStigAttributesMetadata {
+  Section: string;
+  Severity: string;
+  RuleID: string;
+  StigID: string;
+  CCI?: string[];
+  CheckText?: string;
+  FixText?: string;
+}
+
+const OKTA_IDAAS_STIG_REQUIRED_STRING_FIELDS = [
+  "Section",
+  "Severity",
+  "RuleID",
+  "StigID",
+] as const satisfies readonly (keyof OktaIDaaSStigAttributesMetadata)[];
+
+export const isOktaIDaaSStigAttributesMetadata = (
+  value: unknown,
+): value is OktaIDaaSStigAttributesMetadata =>
+  isRecord(value) &&
+  OKTA_IDAAS_STIG_REQUIRED_STRING_FIELDS.every(
+    (field) => typeof value[field] === "string",
+  ) &&
+  isOptionalStringArray(value.CCI) &&
+  isOptionalString(value.CheckText) &&
+  isOptionalString(value.FixText);
+
+export interface OktaIDaaSStigRequirement extends Requirement {
+  severity: OktaIDaaSStigAttributesMetadata["Severity"];
+  rule_id: OktaIDaaSStigAttributesMetadata["RuleID"];
+  stig_id: OktaIDaaSStigAttributesMetadata["StigID"];
+  cci: OktaIDaaSStigAttributesMetadata["CCI"];
+  check_text: OktaIDaaSStigAttributesMetadata["CheckText"];
+  fix_text: OktaIDaaSStigAttributesMetadata["FixText"];
+}
+
 // DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554).
 // Universal framework — flat attributes dict with Pillar/Article/ArticleTitle.
 // `Pillar` is the canonical grouping key for tables and PDF; the enum mirrors
@@ -374,6 +417,7 @@ export interface AttributesItemData {
         | CCCAttributesMetadata[]
         | CSAAttributesMetadata[]
         | ASDEssentialEightAttributesMetadata[]
+        | OktaIDaaSStigAttributesMetadata[]
         | DORAAttributesMetadata[]
         | GenericAttributesMetadata[];
       check_ids: string[];

From bfb3fcea4c02e9cb8fd488bb5a8089b49d9617f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Wed, 10 Jun 2026 11:34:35 +0200
Subject: [PATCH 005/126] fix(e2e): use branch SDK changes to create the
 container (#11522)

---
 .github/workflows/ui-e2e-tests-v2.yml | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml
index 5e50adb19c..1a3653f8c9 100644
--- a/.github/workflows/ui-e2e-tests-v2.yml
+++ b/.github/workflows/ui-e2e-tests-v2.yml
@@ -134,7 +134,17 @@ jobs:
         # docker-compose.yml references prowlercloud/prowler-api:latest from the registry,
         # which lags behind PR changes; build locally so E2E exercises the API image
         # produced by this PR.
-        run: docker build -t prowlercloud/prowler-api:latest ./api
+        #
+        # The image installs the SDK from git@master (api/uv.lock), so a PR changing BOTH the SDK
+        # and the API would run against the OLD SDK and crash on startup. Overlay the checkout's
+        # SDK source so both run together. New SDK dependencies still need an api/uv.lock bump.
+        run: |
+          docker build -t prowlercloud/prowler-api:pr-base ./api
+          docker build -t prowlercloud/prowler-api:latest -f - prowler <<'DOCKERFILE'
+          FROM prowlercloud/prowler-api:pr-base
+          RUN rm -rf /home/prowler/.venv/lib/python3.12/site-packages/prowler
+          COPY --chown=prowler:prowler . /home/prowler/.venv/lib/python3.12/site-packages/prowler
+          DOCKERFILE
 
       - name: Start API services
         run: |

From ec0bb5383975c6fc5d4c9bdf26231d0d00f8deca Mon Sep 17 00:00:00 2001
From: Aryan Bhaskar <115079796+ARYAN03B@users.noreply.github.com>
Date: Wed, 10 Jun 2026 16:10:54 +0530
Subject: [PATCH 006/126] feat(bedrock): add bedrock_agent_role_least_privilege
 check (#11335)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../__init__.py                               |   0
 ...k_agent_role_least_privilege.metadata.json |  41 +++
 .../bedrock_agent_role_least_privilege.py     | 101 +++++++
 .../aws/services/bedrock/bedrock_service.py   |  18 ++
 .../providers/aws/services/iam/iam_service.py |  33 +++
 ...bedrock_agent_role_least_privilege_test.py | 275 ++++++++++++++++++
 7 files changed, 469 insertions(+)
 create mode 100644 prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/__init__.py
 create mode 100644 prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.metadata.json
 create mode 100644 prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.py
 create mode 100644 tests/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index c9542d8345..056ae34f89 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -20,6 +20,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `entra_service_principal_privileged_role_no_owners` check for M365 provider, failing when a service principal with a permanent Tier 0 directory role has owners on the service principal or its parent app registration [(#11070)](https://github.com/prowler-cloud/prowler/issues/11070)
 - `kms_key_rotation_max_90_days` check for GCP provider, verifying KMS customer-managed keys are rotated every 90 days or less in line with the CIS Benchmark [(#11516)](https://github.com/prowler-cloud/prowler/pull/11516)
 - `exchange_mailbox_primary_smtp_uses_custom_domain` check for M365 provider [(#11215)](https://github.com/prowler-cloud/prowler/pull/11215)
+- `bedrock_agent_role_least_privilege` check for AWS provider, flagging Bedrock Agent execution roles with full-access managed policies, broad `Resource:*` inline statements, or missing permissions boundaries [(#11335)](https://github.com/prowler-cloud/prowler/pull/11335)
 
 ### 🐞 Fixed
 
diff --git a/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/__init__.py b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.metadata.json
new file mode 100644
index 0000000000..7625b6a626
--- /dev/null
+++ b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.metadata.json
@@ -0,0 +1,41 @@
+{
+  "Provider": "aws",
+  "CheckID": "bedrock_agent_role_least_privilege",
+  "CheckTitle": "Amazon Bedrock agent execution role follows least privilege",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices/Runtime Behavior Analysis",
+    "TTPs/Privilege Escalation"
+  ],
+  "ServiceName": "bedrock",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "Other",
+  "ResourceGroup": "ai_ml",
+  "Description": "**Bedrock Agent** execution roles (`agentResourceRoleArn`) should grant only the minimum permissions the agent needs. The evaluation FAILs when the role has an AWS-managed `*FullAccess` policy attached, has an inline statement allowing broad actions on `Resource: \"*\"`, or has no permissions boundary configured.",
+  "Risk": "An overly permissive **Bedrock Agent** execution role turns a successful **prompt injection** into AWS privilege escalation. A model coerced into calling tools can invoke any API the role allows — reading secrets, modifying IAM, exfiltrating data from S3, or pivoting laterally. **Least privilege** plus a **permissions boundary** keeps the blast radius bounded even when guardrails fail.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#grant-least-privilege"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws iam put-role-permissions-boundary --role-name <execution_role_name> --permissions-boundary <boundary_policy_arn>",
+      "NativeIaC": "",
+      "Other": "1. Identify the Bedrock Agent's execution role (agentResourceRoleArn) in the IAM console\n2. Detach any AWS-managed *FullAccess policies (e.g. AmazonBedrockFullAccess, AdministratorAccess)\n3. Replace inline policies that use Resource: \"*\" with statements scoped to specific resource ARNs and minimal action sets\n4. Attach a permissions boundary that caps what the role can ever do, even if a future policy is added\n5. Re-run Prowler to confirm the check passes",
+      "Terraform": "```hcl\nresource \"aws_iam_role\" \"bedrock_agent\" {\n  name                 = \"<execution_role_name>\"\n  assume_role_policy   = data.aws_iam_policy_document.trust.json\n  permissions_boundary = aws_iam_policy.bedrock_agent_boundary.arn  # CRITICAL: caps maximum privileges\n}\n\nresource \"aws_iam_role_policy\" \"bedrock_agent_inline\" {\n  role   = aws_iam_role.bedrock_agent.name\n  policy = jsonencode({\n    Version = \"2012-10-17\",\n    Statement = [{\n      Effect   = \"Allow\",\n      Action   = [\"s3:GetObject\"],            # CRITICAL: narrow action\n      Resource = [\"arn:aws:s3:::my-rag-bucket/*\"]  # CRITICAL: narrow resource\n    }]\n  })\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Apply **least privilege** to every Bedrock Agent execution role: scope `Action` and `Resource` to exactly what the agent needs, avoid AWS-managed `*FullAccess` policies, and always attach a **permissions boundary** so that future policy edits cannot exceed an approved ceiling. Treat agent roles as high-risk because prompt injection can weaponize any granted permission.",
+      "Url": "https://hub.prowler.com/check/bedrock_agent_role_least_privilege"
+    }
+  },
+  "Categories": [
+    "gen-ai"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.py b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.py
new file mode 100644
index 0000000000..e53183d90f
--- /dev/null
+++ b/prowler/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege.py
@@ -0,0 +1,101 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.bedrock.bedrock_agent_client import (
+    bedrock_agent_client,
+)
+from prowler.providers.aws.services.iam.iam_client import iam_client
+from prowler.providers.aws.services.iam.lib.policy import check_admin_access
+from prowler.providers.aws.services.iam.lib.privilege_escalation import (
+    check_privilege_escalation,
+)
+
+
+class bedrock_agent_role_least_privilege(Check):
+    """Ensure Bedrock Agent execution roles follow least privilege.
+
+    A Bedrock Agent's execution role is evaluated against three criteria:
+    - No AWS-managed ``*FullAccess`` policy attached.
+    - No attached or inline policy granting administrative access or known
+      privilege escalation combinations.
+    - A permissions boundary is configured on the role.
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Run the least-privilege evaluation across all Bedrock Agents.
+
+        Returns:
+            A list of ``Check_Report_AWS`` with one entry per agent. The
+            status is ``FAIL`` when any of the criteria above is violated,
+            or when the execution role cannot be resolved in IAM.
+        """
+        findings = []
+        roles_by_arn = {role.arn: role for role in (iam_client.roles or [])}
+
+        for agent in bedrock_agent_client.agents.values():
+            report = Check_Report_AWS(metadata=self.metadata(), resource=agent)
+            report.status = "PASS"
+            report.status_extended = (
+                f"Bedrock Agent {agent.name} execution role follows least privilege."
+            )
+
+            role = roles_by_arn.get(agent.role_arn) if agent.role_arn else None
+            if role is None:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Bedrock Agent {agent.name} execution role could not be "
+                    f"resolved in IAM and cannot be evaluated for least privilege."
+                )
+                findings.append(report)
+                continue
+
+            violations = []
+
+            for policy in role.attached_policies:
+                policy_arn = policy.get("PolicyArn", "")
+                policy_name = policy.get("PolicyName") or policy_arn
+                if policy_arn.startswith(
+                    "arn:aws:iam::aws:policy/"
+                ) and policy_arn.endswith("FullAccess"):
+                    violations.append(
+                        f"managed policy {policy_name} grants full access"
+                    )
+                    continue
+                policy_obj = iam_client.policies.get(policy_arn)
+                if policy_obj is None or not policy_obj.document:
+                    continue
+                document = policy_obj.document
+                if check_admin_access(document):
+                    violations.append(
+                        f"managed policy {policy_name} grants administrative access"
+                    )
+                elif check_privilege_escalation(document):
+                    violations.append(
+                        f"managed policy {policy_name} allows privilege escalation"
+                    )
+
+            for inline_name in role.inline_policies:
+                policy_obj = iam_client.policies.get(f"{role.arn}:policy/{inline_name}")
+                if policy_obj is None or not policy_obj.document:
+                    continue
+                document = policy_obj.document
+                if check_admin_access(document):
+                    violations.append(
+                        f"inline policy {inline_name} grants administrative access"
+                    )
+                elif check_privilege_escalation(document):
+                    violations.append(
+                        f"inline policy {inline_name} allows privilege escalation"
+                    )
+
+            if not role.permissions_boundary:
+                violations.append("no permissions boundary configured")
+
+            if violations:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Bedrock Agent {agent.name} execution role violates least "
+                    f"privilege: {'; '.join(violations)}."
+                )
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/bedrock/bedrock_service.py b/prowler/providers/aws/services/bedrock/bedrock_service.py
index 7222456341..aead63a67f 100644
--- a/prowler/providers/aws/services/bedrock/bedrock_service.py
+++ b/prowler/providers/aws/services/bedrock/bedrock_service.py
@@ -146,6 +146,7 @@ class BedrockAgent(AWSService):
         self.prompts = {}
         self.prompt_scanned_regions: set = set()
         self.__threading_call__(self._list_agents)
+        self.__threading_call__(self._get_agent, self.agents.values())
         self.__threading_call__(self._list_prompts)
         self.__threading_call__(self._get_prompt, self.prompts.values())
         self.__threading_call__(self._list_tags_for_resource, self.agents.values())
@@ -174,6 +175,22 @@ class BedrockAgent(AWSService):
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _get_agent(self, agent):
+        """Fetch full agent details to capture the execution role ARN.
+
+        list_agents only returns summaries (no agentResourceRoleArn), so we
+        need a per-agent GetAgent call. Stored on the Agent model for use by
+        checks like bedrock_agent_role_least_privilege.
+        """
+        logger.info("Bedrock Agent - Getting Agent...")
+        try:
+            agent_info = self.regional_clients[agent.region].get_agent(agentId=agent.id)
+            agent.role_arn = agent_info.get("agent", {}).get("agentResourceRoleArn")
+        except Exception as error:
+            logger.error(
+                f"{agent.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
     def _list_prompts(self, regional_client):
         """List all prompts in a region."""
         logger.info("Bedrock Agent - Listing Prompts...")
@@ -236,6 +253,7 @@ class Agent(BaseModel):
     name: str
     arn: str
     guardrail_id: Optional[str] = None
+    role_arn: Optional[str] = None
     region: str
     tags: Optional[list] = []
 
diff --git a/prowler/providers/aws/services/iam/iam_service.py b/prowler/providers/aws/services/iam/iam_service.py
index d6cb150178..fa01550b11 100644
--- a/prowler/providers/aws/services/iam/iam_service.py
+++ b/prowler/providers/aws/services/iam/iam_service.py
@@ -103,6 +103,9 @@ class IAM(AWSService):
         self._get_user_temporary_credentials_usage()
         self.organization_features = []
         self._list_organizations_features()
+        # ListRoles does not echo PermissionsBoundary; backfill via GetRole.
+        if self.roles:
+            self.__threading_call__(self._get_role_permissions_boundary, self.roles)
         # List missing tags
         self.__threading_call__(self._list_tags, self.users)
         self.__threading_call__(self._list_tags, self.roles)
@@ -133,6 +136,7 @@ class IAM(AWSService):
                                 arn=role["Arn"],
                                 assume_role_policy=role["AssumeRolePolicyDocument"],
                                 is_service_role=is_service_role(role),
+                                permissions_boundary=role.get("PermissionsBoundary"),
                             )
                         )
         except ClientError as error:
@@ -460,6 +464,34 @@ class IAM(AWSService):
                 f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _get_role_permissions_boundary(self, role):
+        """Backfill ``role.permissions_boundary`` via ``GetRole``.
+
+        ``ListRoles`` does not return ``PermissionsBoundary`` in practice, so
+        the value is fetched per role and stored on the ``Role`` model.
+
+        Args:
+            role: The ``Role`` instance to enrich.
+        """
+        try:
+            response = self.client.get_role(RoleName=role.name)
+            role.permissions_boundary = response.get("Role", {}).get(
+                "PermissionsBoundary"
+            )
+        except ClientError as error:
+            if error.response["Error"]["Code"] == "NoSuchEntity":
+                logger.warning(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            logger.error(
+                f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
     def _list_attached_role_policies(self):
         logger.info("IAM - List Attached Role Policies...")
         try:
@@ -1139,6 +1171,7 @@ class Role(BaseModel):
     is_service_role: bool
     attached_policies: list[dict] = []
     inline_policies: list[str] = []
+    permissions_boundary: Optional[dict] = None
     tags: Optional[list]
 
 
diff --git a/tests/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege_test.py b/tests/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege_test.py
new file mode 100644
index 0000000000..c6e5d7f756
--- /dev/null
+++ b/tests/providers/aws/services/bedrock/bedrock_agent_role_least_privilege/bedrock_agent_role_least_privilege_test.py
@@ -0,0 +1,275 @@
+from json import dumps
+from unittest import mock
+
+import botocore
+from boto3 import client
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+AGENT_ID = "test-agent-id"
+AGENT_NAME = "test-agent-name"
+AGENT_ARN = (
+    f"arn:aws:bedrock:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:agent/{AGENT_ID}"
+)
+ROLE_NAME = "AmazonBedrockExecutionRoleForAgents_test"
+ROLE_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/{ROLE_NAME}"
+BOUNDARY_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:policy/AgentBoundary"
+
+ASSUME_ROLE_POLICY_DOCUMENT = {
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Principal": {"Service": "bedrock.amazonaws.com"},
+            "Action": "sts:AssumeRole",
+        }
+    ],
+}
+
+BOUNDARY_POLICY_DOCUMENT = {
+    "Version": "2012-10-17",
+    "Statement": [{"Effect": "Allow", "Action": "bedrock:*", "Resource": "*"}],
+}
+
+NARROW_INLINE_POLICY = {
+    "Version": "2012-10-17",
+    "Statement": [
+        {
+            "Effect": "Allow",
+            "Action": ["s3:GetObject"],
+            "Resource": ["arn:aws:s3:::my-rag-bucket/*"],
+        }
+    ],
+}
+
+BROAD_INLINE_POLICY = {
+    "Version": "2012-10-17",
+    "Statement": [{"Effect": "Allow", "Action": "*", "Resource": "*"}],
+}
+
+
+# Mock both ListAgents and GetAgent at the botocore level. moto's bedrock-agent
+# support is incomplete for our needs (GetAgent often doesn't echo back the
+# role ARN we set), so we control the responses directly. We also need to keep
+# IAM calls going to moto.
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def _mock_bedrock_agent_factory(role_arn):
+    """Return a mock_make_api_call function that returns role_arn from GetAgent.
+
+    Pass role_arn=None to simulate an agent whose role can't be resolved.
+    """
+
+    def _mock_make_api_call(self, operation_name, kwarg):
+        if operation_name == "ListAgents":
+            return {
+                "agentSummaries": [
+                    {"agentId": AGENT_ID, "agentName": AGENT_NAME},
+                ]
+            }
+        if operation_name == "GetAgent":
+            return {
+                "agent": {
+                    "agentId": AGENT_ID,
+                    "agentName": AGENT_NAME,
+                    "agentResourceRoleArn": role_arn,
+                }
+            }
+        if operation_name == "ListTagsForResource":
+            return {"tags": {}}
+        if operation_name == "ListPrompts":
+            return {"promptSummaries": []}
+        return make_api_call(self, operation_name, kwarg)
+
+    return _mock_make_api_call
+
+
+def _setup_role(
+    *,
+    attached_policy_arns=(),
+    inline_policies=None,
+    permissions_boundary=None,
+):
+    """Create an IAM role in moto with the given configuration. Returns the role ARN."""
+    iam = client("iam", region_name=AWS_REGION_US_EAST_1)
+
+    if permissions_boundary:
+        iam.create_policy(
+            PolicyName="AgentBoundary",
+            PolicyDocument=dumps(BOUNDARY_POLICY_DOCUMENT),
+        )
+
+    create_kwargs = {
+        "RoleName": ROLE_NAME,
+        "AssumeRolePolicyDocument": dumps(ASSUME_ROLE_POLICY_DOCUMENT),
+    }
+    if permissions_boundary:
+        create_kwargs["PermissionsBoundary"] = permissions_boundary
+    iam.create_role(**create_kwargs)
+
+    for policy_arn in attached_policy_arns:
+        iam.attach_role_policy(RoleName=ROLE_NAME, PolicyArn=policy_arn)
+
+    for policy_name, policy_document in (inline_policies or {}).items():
+        iam.put_role_policy(
+            RoleName=ROLE_NAME,
+            PolicyName=policy_name,
+            PolicyDocument=dumps(policy_document),
+        )
+
+    return ROLE_ARN
+
+
+def _run_check(role_arn_for_get_agent):
+    """Build the IAM + BedrockAgent services, patch them in, run the check."""
+    from prowler.providers.aws.services.bedrock.bedrock_service import BedrockAgent
+    from prowler.providers.aws.services.iam.iam_service import IAM
+
+    aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+    with mock.patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=_mock_bedrock_agent_factory(role_arn_for_get_agent),
+    ):
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege.bedrock_agent_client",
+                new=BedrockAgent(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege.iam_client",
+                new=IAM(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege import (
+                bedrock_agent_role_least_privilege,
+            )
+
+            return bedrock_agent_role_least_privilege().execute()
+
+
+class Test_bedrock_agent_role_least_privilege:
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_no_agents(self):
+        """No agents in the account -> zero findings."""
+        from prowler.providers.aws.services.bedrock.bedrock_service import BedrockAgent
+        from prowler.providers.aws.services.iam.iam_service import IAM
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege.bedrock_agent_client",
+                new=BedrockAgent(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege.iam_client",
+                new=IAM(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.bedrock.bedrock_agent_role_least_privilege.bedrock_agent_role_least_privilege import (
+                bedrock_agent_role_least_privilege,
+            )
+
+            assert bedrock_agent_role_least_privilege().execute() == []
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_compliant(self):
+        """Narrow inline policy + boundary + no *FullAccess attached -> PASS."""
+        role_arn = _setup_role(
+            inline_policies={"NarrowAccess": NARROW_INLINE_POLICY},
+            permissions_boundary=BOUNDARY_ARN,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert "follows least privilege" in result[0].status_extended
+        assert result[0].resource_id == AGENT_ID
+        assert result[0].resource_arn == AGENT_ARN
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_full_access_attached(self):
+        """AmazonBedrockFullAccess attached -> FAIL."""
+        role_arn = _setup_role(
+            attached_policy_arns=("arn:aws:iam::aws:policy/AmazonBedrockFullAccess",),
+            inline_policies={"NarrowAccess": NARROW_INLINE_POLICY},
+            permissions_boundary=BOUNDARY_ARN,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "grants full access" in result[0].status_extended
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_administrator_access_attached(self):
+        """AdministratorAccess attached (no FullAccess suffix) -> FAIL via doc-based admin check."""
+        role_arn = _setup_role(
+            attached_policy_arns=("arn:aws:iam::aws:policy/AdministratorAccess",),
+            inline_policies={"NarrowAccess": NARROW_INLINE_POLICY},
+            permissions_boundary=BOUNDARY_ARN,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert (
+            "managed policy AdministratorAccess grants administrative access"
+            in result[0].status_extended
+        )
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_resource_star_broad_action(self):
+        """Inline statement with Action:* on Resource:* -> FAIL."""
+        role_arn = _setup_role(
+            inline_policies={"BroadAccess": BROAD_INLINE_POLICY},
+            permissions_boundary=BOUNDARY_ARN,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "grants administrative access" in result[0].status_extended
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_no_permissions_boundary(self):
+        """Otherwise clean role but missing permissions boundary -> FAIL."""
+        role_arn = _setup_role(
+            inline_policies={"NarrowAccess": NARROW_INLINE_POLICY},
+            permissions_boundary=None,
+        )
+
+        result = _run_check(role_arn_for_get_agent=role_arn)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "no permissions boundary configured" in result[0].status_extended
+
+    @mock_aws(config={"iam": {"load_aws_managed_policies": True}})
+    def test_agent_role_not_resolvable(self):
+        """role_arn returned by GetAgent doesn't match any IAM role -> FAIL."""
+        result = _run_check(
+            role_arn_for_get_agent=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/does-not-exist"
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "could not be resolved" in result[0].status_extended

From 3c8fde25eeb5c2596b1be4f722be7126bfefee50 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Wed, 10 Jun 2026 18:19:50 +0200
Subject: [PATCH 007/126] chore(cli): add banner about Prowler Cloud (#11528)

---
 prowler/__main__.py   |  8 ++++++--
 prowler/lib/banner.py | 42 ++++++++++++++++++++++++++++++++++++++----
 2 files changed, 44 insertions(+), 6 deletions(-)

diff --git a/prowler/__main__.py b/prowler/__main__.py
index 703a9e49a0..533a704359 100644
--- a/prowler/__main__.py
+++ b/prowler/__main__.py
@@ -19,7 +19,7 @@ from prowler.config.config import (
     orange_color,
     sarif_file_suffix,
 )
-from prowler.lib.banner import print_banner
+from prowler.lib.banner import print_banner, print_prowler_cloud_banner
 from prowler.lib.check.check import (
     exclude_checks_to_run,
     exclude_services_to_run,
@@ -202,7 +202,7 @@ def prowler():
 
     if not args.no_banner:
         legend = args.verbose or getattr(args, "fixer", None)
-        print_banner(legend)
+        print_banner(legend, provider)
 
     # We treat the compliance framework as another output format
     if compliance_framework:
@@ -1476,6 +1476,10 @@ def prowler():
                     f"\nDetailed compliance results are in {Fore.YELLOW}{output_options.output_directory}/compliance/{Style.RESET_ALL}\n"
                 )
 
+    # Promote Prowler Cloud as the last thing the user sees after the results
+    if not args.no_banner and not args.only_logs:
+        print_prowler_cloud_banner(provider)
+
     # If custom checks were passed, remove the modules
     if checks_folder:
         remove_custom_checks_module(checks_folder, provider)
diff --git a/prowler/lib/banner.py b/prowler/lib/banner.py
index 72031805e2..bb693fb961 100644
--- a/prowler/lib/banner.py
+++ b/prowler/lib/banner.py
@@ -3,12 +3,13 @@ from colorama import Fore, Style
 from prowler.config.config import banner_color, orange_color, prowler_version, timestamp
 
 
-def print_banner(legend: bool = False):
+def print_banner(legend: bool = False, provider: str = None):
     """
     Prints the banner with optional legend for color codes.
 
     Parameters:
     - legend (bool): Flag to indicate whether to print the color legend or not. Default is False.
+    - provider (str): The provider being scanned, used to tailor the Prowler Cloud banner.
 
     Returns:
     - None
@@ -20,13 +21,12 @@ def print_banner(legend: bool = False):
 | .__/|_|  \___/ \_/\_/ |_|\___|_|v{prowler_version}
 |_|{Fore.BLUE} Get the most at https://cloud.prowler.com {Style.RESET_ALL}
 
-{Fore.GREEN}New! Send findings from Prowler CLI to Prowler Cloud{Style.RESET_ALL}
-{Fore.GREEN}More details here: goto.prowler.com/import-findings{Style.RESET_ALL}
-
 {Fore.YELLOW}Date: {timestamp.strftime("%Y-%m-%d %H:%M:%S")}{Style.RESET_ALL}
 """
     print(banner)
 
+    print_prowler_cloud_banner(provider)
+
     if legend:
         print(
             f"""
@@ -37,3 +37,37 @@ def print_banner(legend: bool = False):
 - {Fore.RED}FAIL (Fix required){Style.RESET_ALL}
             """
         )
+
+
+def print_prowler_cloud_banner(provider: str = None):
+    """
+    Prints a promotional banner highlighting what Prowler Cloud adds on top of
+    the open-source CLI.
+
+    Shown at the start and end of a scan to let users know about the managed
+    platform capabilities they are missing (attack paths, AI, organizations,
+    continuous scanning, integrations and live compliance dashboards).
+
+    Parameters:
+    - provider (str): The provider that was scanned, used to tailor the message.
+
+    Returns:
+    - None
+    """
+    check = f"{Fore.GREEN}✓{Style.RESET_ALL}"
+    bar = f"{banner_color}│{Style.RESET_ALL}"
+    print(
+        f"""
+{bar} {Style.BRIGHT}You're getting a snapshot. Prowler Cloud gives you the full picture.{Style.RESET_ALL}
+{bar}
+{bar} {check} {Style.BRIGHT}Attack Path Visualization{Style.RESET_ALL} - see how attackers chain risks to reach your crown jewels
+{bar} {check} {Style.BRIGHT}Lighthouse AI + MCP{Style.RESET_ALL} - autonomous triage, prioritization and remediation
+{bar} {check} {Style.BRIGHT}Organizations{Style.RESET_ALL} - all your AWS accounts under one organization
+{bar} {check} {Style.BRIGHT}Continuous scanning{Style.RESET_ALL} - scheduled scans with history, trends and alerts
+{bar} {check} {Style.BRIGHT}Integrations{Style.RESET_ALL} - Jira, Slack, AWS Security Hub, Amazon S3, SSO and RBAC
+{bar} {check} {Style.BRIGHT}Reports{Style.RESET_ALL} - download ready-to-share PDF reports
+{bar} {check} {Style.BRIGHT}Live compliance{Style.RESET_ALL} - dashboards for 50+ frameworks, always up to date
+{bar}
+{bar} {Fore.BLUE}Start free at cloud.prowler.com{Style.RESET_ALL}
+"""
+    )

From 368d3a2661cb8b08e081caf3c1d3a0a5253314d9 Mon Sep 17 00:00:00 2001
From: Johannes Engler <johannes.engler@maibornwolff.de>
Date: Wed, 10 Jun 2026 18:43:24 +0200
Subject: [PATCH 008/126] feat(stackit): add objectstorage checks (#11397)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
---
 README.md                                     |   2 +-
 prowler/CHANGELOG.md                          |   1 +
 .../services/objectstorage/__init__.py        |   0
 .../__init__.py                               |   0
 ...torage_access_key_expiration.metadata.json |  37 +
 .../objectstorage_access_key_expiration.py    |  27 +
 .../__init__.py                               |   0
 ...e_bucket_object_lock_enabled.metadata.json |  37 +
 ...bjectstorage_bucket_object_lock_enabled.py |  31 +
 .../__init__.py                               |   0
 ...rage_bucket_retention_policy.metadata.json |  39 ++
 .../objectstorage_bucket_retention_policy.py  |  30 +
 .../objectstorage/objectstorage_client.py     |   6 +
 .../objectstorage/objectstorage_service.py    | 306 +++++++++
 prowler/providers/stackit/stackit_provider.py |   9 +-
 .../stackit/stackit_regions_by_service.json   |   6 +
 pyproject.toml                                |   1 +
 ...bjectstorage_access_key_expiration_test.py | 150 ++++
 ...storage_bucket_object_lock_enabled_test.py | 111 +++
 ...ectstorage_bucket_retention_policy_test.py | 153 +++++
 .../stackit_objectstorage_service_test.py     | 645 ++++++++++++++++++
 .../stackit/stackit_provider_test.py          |  65 ++
 uv.lock                                       |  17 +
 23 files changed, 1671 insertions(+), 2 deletions(-)
 create mode 100644 prowler/providers/stackit/services/objectstorage/__init__.py
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/__init__.py
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.metadata.json
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.py
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/__init__.py
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.metadata.json
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.py
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/__init__.py
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.metadata.json
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.py
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_client.py
 create mode 100644 prowler/providers/stackit/services/objectstorage/objectstorage_service.py
 create mode 100644 tests/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration_test.py
 create mode 100644 tests/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled_test.py
 create mode 100644 tests/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy_test.py
 create mode 100644 tests/providers/stackit/services/objectstorage/stackit_objectstorage_service_test.py

diff --git a/README.md b/README.md
index d2808daf84..74e91021ca 100644
--- a/README.md
+++ b/README.md
@@ -122,7 +122,7 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 | Vercel | 26 | 6 | 0 | 8 | Official | UI, API, CLI |
 | Okta | 1 | 1 | 0 | 1 | Official | CLI |
 | Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 0 | 1 | Unofficial | CLI |
-| StackIT [Contact us](https://prowler.com/contact) | 4 | 1 | 0 | 1 | Unofficial | CLI |
+| StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 0 | 3 | Unofficial | CLI |
 | NHN | 6 | 2 | 1 | 0 | Unofficial | CLI |
 
 > [!Note]
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 056ae34f89..619401bf32 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -21,6 +21,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `kms_key_rotation_max_90_days` check for GCP provider, verifying KMS customer-managed keys are rotated every 90 days or less in line with the CIS Benchmark [(#11516)](https://github.com/prowler-cloud/prowler/pull/11516)
 - `exchange_mailbox_primary_smtp_uses_custom_domain` check for M365 provider [(#11215)](https://github.com/prowler-cloud/prowler/pull/11215)
 - `bedrock_agent_role_least_privilege` check for AWS provider, flagging Bedrock Agent execution roles with full-access managed policies, broad `Resource:*` inline statements, or missing permissions boundaries [(#11335)](https://github.com/prowler-cloud/prowler/pull/11335)
+- STACKIT ObjectStorage service with Object Lock, default retention policy, and access key expiration checks [(#11397)](https://github.com/prowler-cloud/prowler/pull/11397)
 
 ### 🐞 Fixed
 
diff --git a/prowler/providers/stackit/services/objectstorage/__init__.py b/prowler/providers/stackit/services/objectstorage/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/__init__.py b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.metadata.json b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.metadata.json
new file mode 100644
index 0000000000..38da16c5fa
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "stackit",
+  "CheckID": "objectstorage_access_key_expiration",
+  "CheckTitle": "ObjectStorage access keys should have an expiration date",
+  "CheckType": [],
+  "ServiceName": "objectstorage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "**ObjectStorage access keys** should have an explicit expiration date. Long-lived credentials increase the blast radius of a credential compromise because they cannot expire on their own. Setting an expiration date enforces periodic rotation and limits the exposure window if a key is leaked.",
+  "Risk": "If an **ObjectStorage access key** is leaked, stolen, or forgotten without an expiration date, it remains usable indefinitely. An attacker can retain persistent access to object storage resources until the key is manually revoked.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.stackit.cloud/products/storage/object-storage/",
+    "https://docs.stackit.cloud/products/storage/object-storage/how-tos/create-and-delete-object-storage-credentials/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. In the STACKIT Portal navigate to Object Storage > Access Keys. 2. Delete the non-expiring access key. 3. Create a new access key with an expiration date appropriate for your rotation policy (e.g. 90 days). 4. Update all applications and services that use the old key with the new credentials.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Create **ObjectStorage access keys** with an explicit expiration date and establish a rotation process. Delete non-expiring keys and replace them with time-limited credentials. A rotation period of **90 days or less** is recommended.",
+      "Url": "https://hub.prowler.com/check/objectstorage_access_key_expiration"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Access keys are scoped to credentials groups. This check evaluates all access keys across all credentials groups in the project."
+}
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.py b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.py
new file mode 100644
index 0000000000..2fb49ac725
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration.py
@@ -0,0 +1,27 @@
+from prowler.lib.check.models import Check, CheckReportStackIT
+from prowler.providers.stackit.services.objectstorage.objectstorage_client import (
+    objectstorage_client,
+)
+
+
+class objectstorage_access_key_expiration(Check):
+    def execute(self):
+        findings = []
+        for key in objectstorage_client.access_keys:
+            report = CheckReportStackIT(
+                metadata=self.metadata(),
+                resource=key,
+            )
+            report.resource_id = key.key_id
+            report.resource_name = key.display_name
+            report.location = key.region
+
+            if key.has_expiration():
+                report.status = "PASS"
+                report.status_extended = f"Access key {key.display_name} has an expiration date set ({key.expires})."
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Access key {key.display_name} has no expiration date and never rotates."
+
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/__init__.py b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.metadata.json b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.metadata.json
new file mode 100644
index 0000000000..cd587c72da
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "stackit",
+  "CheckID": "objectstorage_bucket_object_lock_enabled",
+  "CheckTitle": "ObjectStorage buckets should have S3 Object Lock enabled",
+  "CheckType": [],
+  "ServiceName": "objectstorage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "storage",
+  "Description": "**S3 Object Lock** prevents objects from being deleted or overwritten for a fixed period or indefinitely. Enabling it protects against accidental deletion and ransomware by enforcing a **write-once-read-many (WORM)** model. Object Lock can only be enabled when the bucket is created.",
+  "Risk": "Without **Object Lock**, objects can be deleted or overwritten at any time, increasing the risk of data loss from accidental deletion, malicious actors, or ransomware. Backups and compliance data are particularly vulnerable.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.stackit.cloud/products/storage/object-storage/",
+    "https://docs.stackit.cloud/products/storage/object-storage/how-tos/object-lock-bucket/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "Object Lock must be enabled at bucket creation time and cannot be enabled on an existing bucket. Create a new bucket with Object Lock enabled and migrate your data to it.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Create **ObjectStorage buckets** with S3 Object Lock enabled for workloads that require data immutability, compliance archiving, or ransomware protection. Object Lock cannot be retroactively enabled on existing buckets.",
+      "Url": "https://hub.prowler.com/check/objectstorage_bucket_object_lock_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Object Lock can only be activated at bucket creation. Buckets without Object Lock are not necessarily misconfigured — evaluate based on the sensitivity and compliance requirements of the stored data."
+}
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.py b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.py
new file mode 100644
index 0000000000..89a3c1d3fb
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled.py
@@ -0,0 +1,31 @@
+from prowler.lib.check.models import Check, CheckReportStackIT
+from prowler.providers.stackit.services.objectstorage.objectstorage_client import (
+    objectstorage_client,
+)
+
+
+class objectstorage_bucket_object_lock_enabled(Check):
+    def execute(self):
+        findings = []
+        for bucket in objectstorage_client.buckets:
+            report = CheckReportStackIT(
+                metadata=self.metadata(),
+                resource=bucket,
+            )
+            report.resource_id = bucket.name
+            report.resource_name = bucket.name
+            report.location = bucket.region
+
+            if bucket.object_lock_enabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Bucket {bucket.name} has S3 Object Lock enabled."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Bucket {bucket.name} does not have S3 Object Lock enabled."
+                )
+
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/__init__.py b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.metadata.json b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.metadata.json
new file mode 100644
index 0000000000..44088e5889
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.metadata.json
@@ -0,0 +1,39 @@
+{
+  "Provider": "stackit",
+  "CheckID": "objectstorage_bucket_retention_policy",
+  "CheckTitle": "ObjectStorage buckets should have a default retention policy configured",
+  "CheckType": [],
+  "ServiceName": "objectstorage",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "storage",
+  "Description": "An **ObjectStorage default retention policy** automatically applies a minimum retention period to every object uploaded to the bucket, preventing deletion or overwriting before the period expires. Without it, objects can be removed immediately after upload, undermining compliance and data durability requirements.",
+  "Risk": "Buckets without a **default retention policy** offer no automatic protection against premature object deletion. Compliance data, audit logs, and backups may be deleted before their required retention period elapses.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.stackit.cloud/products/storage/object-storage/",
+    "https://docs.stackit.cloud/products/storage/object-storage/how-tos/object-lock-default-retention/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "Use the STACKIT Object Storage API or Portal to set a default retention policy on the bucket. Choose COMPLIANCE mode for strict immutability or GOVERNANCE mode to allow privileged users to override the policy.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure a **default retention policy** on every bucket that stores compliance-relevant or sensitive data. Choose `COMPLIANCE` mode for regulatory requirements and `GOVERNANCE` mode when administrative overrides are acceptable.",
+      "Url": "https://hub.prowler.com/check/objectstorage_bucket_retention_policy"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "objectstorage_bucket_object_lock_enabled"
+  ],
+  "Notes": "A default retention policy requires Object Lock to be enabled on the bucket. Buckets without Object Lock cannot have a retention policy."
+}
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.py b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.py
new file mode 100644
index 0000000000..a9dbc7ed2b
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy.py
@@ -0,0 +1,30 @@
+from prowler.lib.check.models import Check, CheckReportStackIT
+from prowler.providers.stackit.services.objectstorage.objectstorage_client import (
+    objectstorage_client,
+)
+
+
+class objectstorage_bucket_retention_policy(Check):
+    def execute(self):
+        findings = []
+        for bucket in objectstorage_client.buckets:
+            report = CheckReportStackIT(
+                metadata=self.metadata(),
+                resource=bucket,
+            )
+            report.resource_id = bucket.name
+            report.resource_name = bucket.name
+            report.location = bucket.region
+
+            if bucket.retention_days and bucket.retention_days > 0:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Bucket {bucket.name} has a default retention policy of "
+                    f"{bucket.retention_days} day(s) in {bucket.retention_mode} mode."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Bucket {bucket.name} does not have a default retention policy configured."
+
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_client.py b/prowler/providers/stackit/services/objectstorage/objectstorage_client.py
new file mode 100644
index 0000000000..56cdbfd0bf
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    ObjectStorageService,
+)
+
+objectstorage_client = ObjectStorageService(Provider.get_global_provider())
diff --git a/prowler/providers/stackit/services/objectstorage/objectstorage_service.py b/prowler/providers/stackit/services/objectstorage/objectstorage_service.py
new file mode 100644
index 0000000000..e37545ec24
--- /dev/null
+++ b/prowler/providers/stackit/services/objectstorage/objectstorage_service.py
@@ -0,0 +1,306 @@
+import json
+from datetime import datetime, timezone
+from typing import Optional
+
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.stackit.stackit_provider import StackitProvider, suppress_stderr
+
+
+class ObjectStorageService:
+    def __init__(self, provider: StackitProvider):
+        self.provider = provider
+        self.project_id = provider.identity.project_id
+        self.regional_clients = provider.generate_regional_clients("objectstorage")
+
+        self.buckets: list[Bucket] = []
+        self.access_keys: list[AccessKey] = []
+
+        self._fetch_all_regions()
+
+    def _fetch_all_regions(self):
+        for region, client in self.regional_clients.items():
+            try:
+                self._list_buckets(client, region)
+                self._list_access_keys(client, region)
+            except Exception as error:
+                if getattr(error, "status", None) == 404:
+                    logger.info(
+                        f"StackIT project {self.project_id} has no ObjectStorage "
+                        f"presence in region {region}; skipping."
+                    )
+                    continue
+                raise
+
+    def _handle_api_call(self, api_function, *args, **kwargs):
+        try:
+            with suppress_stderr():
+                return api_function(*args, **kwargs)
+        except Exception as e:
+            self.provider.handle_api_error(e)
+            raise
+
+    def _list_buckets(self, client, region: str):
+        response = self._handle_api_call(
+            client.list_buckets, project_id=self.project_id, region=region
+        )
+
+        buckets_list = getattr(response, "buckets", None) or []
+        if isinstance(response, dict):
+            buckets_list = response.get("buckets", [])
+
+        for bucket_data in buckets_list:
+            try:
+                if hasattr(bucket_data, "name"):
+                    name = bucket_data.name
+                    object_lock_enabled = getattr(
+                        bucket_data, "object_lock_enabled", False
+                    )
+                elif isinstance(bucket_data, dict):
+                    name = bucket_data.get("name", "")
+                    object_lock_enabled = bucket_data.get("objectLockEnabled", False)
+                else:
+                    continue
+            except Exception as e:
+                logger.error(f"Error processing bucket: {e}")
+                continue
+
+            retention_days, retention_mode = self._get_default_retention(
+                client, region, name
+            )
+
+            self.buckets.append(
+                Bucket(
+                    name=name,
+                    region=region,
+                    project_id=self.project_id,
+                    object_lock_enabled=object_lock_enabled,
+                    retention_days=retention_days,
+                    retention_mode=retention_mode,
+                )
+            )
+
+        logger.info(f"Listed {len(buckets_list)} buckets in {region}")
+
+    def _get_default_retention(
+        self, client, region: str, bucket_name: str
+    ) -> tuple[Optional[int], Optional[str]]:
+        try:
+            response = self._handle_api_call(
+                client.get_default_retention,
+                project_id=self.project_id,
+                region=region,
+                bucket_name=bucket_name,
+            )
+            days = getattr(response, "days", None)
+            mode = getattr(response, "mode", None)
+            if isinstance(response, dict):
+                days = response.get("days")
+                mode = response.get("mode")
+            return days, str(mode) if mode else None
+        except Exception as e:
+            if getattr(e, "status", None) == 404:
+                return None, None
+            raise
+
+    def _list_access_keys(self, client, region: str):
+        credentials_groups_response = self._handle_api_call(
+            client.list_credentials_groups, project_id=self.project_id, region=region
+        )
+
+        credentials_groups = (
+            getattr(credentials_groups_response, "credentials_groups", None) or []
+        )
+        if isinstance(credentials_groups_response, dict):
+            credentials_groups = credentials_groups_response.get(
+                "credentialsGroups",
+                credentials_groups_response.get("credentials_groups", []),
+            )
+
+        total_keys = 0
+
+        for credentials_group_data in credentials_groups:
+            try:
+                if isinstance(credentials_group_data, dict):
+                    credentials_group_id = credentials_group_data.get(
+                        "id",
+                        credentials_group_data.get(
+                            "groupId",
+                            credentials_group_data.get("credentialsGroupId", ""),
+                        ),
+                    )
+                    credentials_group_name = credentials_group_data.get(
+                        "displayName",
+                        credentials_group_data.get("name", credentials_group_id),
+                    )
+                else:
+                    credentials_group_id = (
+                        getattr(credentials_group_data, "id", None)
+                        or getattr(credentials_group_data, "group_id", None)
+                        or getattr(credentials_group_data, "credentials_group_id", "")
+                    )
+                    credentials_group_name = getattr(
+                        credentials_group_data,
+                        "display_name",
+                        getattr(credentials_group_data, "name", credentials_group_id),
+                    )
+            except Exception as e:
+                logger.error(f"Error processing credentials group: {e}")
+                continue
+
+            if not credentials_group_id:
+                continue
+
+            response = self._list_access_keys_response(
+                client, region, credentials_group_id
+            )
+            keys_list = self._extract_access_keys(response)
+
+            for key_data in keys_list:
+                try:
+                    if hasattr(key_data, "key_id"):
+                        key_id = key_data.key_id
+                        display_name = getattr(key_data, "display_name", key_id)
+                        expires = getattr(key_data, "expires", None)
+                    elif isinstance(key_data, dict):
+                        key_id = key_data.get("keyId", key_data.get("key_id", ""))
+                        display_name = key_data.get(
+                            "displayName", key_data.get("display_name", key_id)
+                        )
+                        expires = key_data.get("expires")
+                    else:
+                        continue
+
+                    if not key_id:
+                        continue
+
+                    self.access_keys.append(
+                        AccessKey(
+                            key_id=key_id,
+                            display_name=display_name,
+                            expires=expires,
+                            region=region,
+                            project_id=self.project_id,
+                            credentials_group_id=credentials_group_id,
+                            credentials_group_name=credentials_group_name,
+                        )
+                    )
+                except Exception as e:
+                    logger.error(f"Error processing access key: {e}")
+                    continue
+
+            total_keys += len(keys_list)
+
+        logger.info(f"Listed {total_keys} access keys in {region}")
+
+    def _list_access_keys_response(
+        self, client, region: str, credentials_group_id: str
+    ):
+        raw_method = None
+        if callable(
+            getattr(type(client), "list_access_keys_without_preload_content", None)
+        ):
+            raw_method = client.list_access_keys_without_preload_content
+        elif callable(vars(client).get("list_access_keys_without_preload_content")):
+            raw_method = vars(client)["list_access_keys_without_preload_content"]
+
+        if raw_method:
+            response = self._handle_api_call(
+                raw_method,
+                project_id=self.project_id,
+                region=region,
+                credentials_group=credentials_group_id,
+            )
+            self._raise_for_raw_response_status(response)
+            return response
+
+        return self._handle_api_call(
+            client.list_access_keys,
+            project_id=self.project_id,
+            region=region,
+            credentials_group=credentials_group_id,
+        )
+
+    def _raise_for_raw_response_status(self, response):
+        status = getattr(response, "status", None)
+        if status is None:
+            status = getattr(response, "status_code", None)
+        if isinstance(status, int) and status >= 400:
+            error = Exception(
+                f"StackIT ObjectStorage list_access_keys failed with status {status}"
+            )
+            error.status = status
+            self.provider.handle_api_error(error)
+            raise error
+
+    @staticmethod
+    def _extract_access_keys(response) -> list:
+        payload = response
+        if not isinstance(payload, (dict, list)):
+            json_method = getattr(response, "json", None)
+            if callable(json_method):
+                payload = json_method()
+            elif hasattr(response, "data"):
+                payload = ObjectStorageService._parse_raw_json(response.data)
+            elif hasattr(response, "text"):
+                payload = ObjectStorageService._parse_raw_json(response.text)
+
+        if isinstance(payload, dict):
+            return payload.get("accessKeys", payload.get("access_keys", []))
+        if isinstance(payload, list):
+            return payload
+        return getattr(response, "access_keys", None) or []
+
+    @staticmethod
+    def _parse_raw_json(raw):
+        if raw in (None, b"", ""):
+            return {}
+        if isinstance(raw, (bytes, bytearray)):
+            raw = raw.decode("utf-8")
+        if isinstance(raw, str):
+            return json.loads(raw)
+        return raw
+
+
+class Bucket(BaseModel):
+    name: str
+    region: str
+    project_id: str
+    object_lock_enabled: bool = False
+    retention_days: Optional[int] = None
+    retention_mode: Optional[str] = None
+
+
+class AccessKey(BaseModel):
+    key_id: str
+    display_name: str
+    # None or a sentinel year-0001 date string means the key never expires.
+    expires: Optional[str] = None
+    region: str
+    project_id: str
+    credentials_group_id: Optional[str] = None
+    credentials_group_name: Optional[str] = None
+
+    def has_expiration(self) -> bool:
+        """Return True if the key has a real (non-sentinel) expiration date."""
+        if not self.expires:
+            return False
+        try:
+            expires_str = self.expires.replace("Z", "+00:00")
+            dt = datetime.fromisoformat(expires_str)
+            # Year 0001 (or earlier) is the SDK sentinel for "never expires"
+            return dt.year > 1
+        except (ValueError, AttributeError):
+            return False
+
+    def expires_within_days(self, days: int) -> bool:
+        """Return True if the key expires within the given number of days from now."""
+        if not self.has_expiration():
+            return False
+        expires_str = self.expires.replace("Z", "+00:00")
+        dt = datetime.fromisoformat(expires_str)
+        if dt.tzinfo is None:
+            dt = dt.replace(tzinfo=timezone.utc)
+        delta = dt - datetime.now(tz=timezone.utc)
+        return delta.days <= days
diff --git a/prowler/providers/stackit/stackit_provider.py b/prowler/providers/stackit/stackit_provider.py
index 417555ef1d..4c34afd31b 100644
--- a/prowler/providers/stackit/stackit_provider.py
+++ b/prowler/providers/stackit/stackit_provider.py
@@ -15,6 +15,7 @@ from colorama import Style
 # loader and surfacing as a misleading empty report.
 from stackit.core.configuration import Configuration
 from stackit.iaas import DefaultApi as IaasDefaultApi
+from stackit.objectstorage import DefaultApi as ObjectStorageDefaultApi
 from stackit.resourcemanager import DefaultApi as ResourceManagerDefaultApi
 
 from prowler.config.config import (
@@ -224,11 +225,17 @@ class StackitProvider(Provider):
             return json_regions.intersection(audited_regions)
         return json_regions
 
+    _SERVICE_API_CLASS = {
+        "iaas": IaasDefaultApi,
+        "objectstorage": ObjectStorageDefaultApi,
+    }
+
     def generate_regional_clients(self, service: str = "iaas") -> dict:
         """Generate regional API clients for the given service.
 
         Returns dict: {"eu01": DefaultApi_client, "eu02": DefaultApi_client}
         """
+        api_class = self._SERVICE_API_CLASS.get(service, IaasDefaultApi)
         regional_clients = {}
         service_regions = self.get_available_service_regions(
             service, self._audited_regions
@@ -240,7 +247,7 @@ class StackitProvider(Provider):
                     self._service_account_key_path,
                     self._service_account_key,
                 )
-                client = IaasDefaultApi(config)
+                client = api_class(config)
                 client.region = region  # Attach region attribute
                 regional_clients[region] = client
 
diff --git a/prowler/providers/stackit/stackit_regions_by_service.json b/prowler/providers/stackit/stackit_regions_by_service.json
index d9c8cdb9be..5841d4e32d 100644
--- a/prowler/providers/stackit/stackit_regions_by_service.json
+++ b/prowler/providers/stackit/stackit_regions_by_service.json
@@ -5,6 +5,12 @@
         "eu01",
         "eu02"
       ]
+    },
+    "objectstorage": {
+      "regions": [
+        "eu01",
+        "eu02"
+      ]
     }
   }
 }
diff --git a/pyproject.toml b/pyproject.toml
index f029f3d6f7..28a4b531cc 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -95,6 +95,7 @@ dependencies = [
   "slack-sdk==3.39.0",
   "stackit-core==0.2.0",
   "stackit-iaas==1.4.0",
+  "stackit-objectstorage==1.4.0",
   "stackit-resourcemanager==0.8.0",
   "tabulate==0.9.0",
   "tzlocal==5.3.1",
diff --git a/tests/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration_test.py b/tests/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration_test.py
new file mode 100644
index 0000000000..2d1e6b7875
--- /dev/null
+++ b/tests/providers/stackit/services/objectstorage/objectstorage_access_key_expiration/objectstorage_access_key_expiration_test.py
@@ -0,0 +1,150 @@
+from unittest import mock
+
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    AccessKey,
+)
+from tests.providers.stackit.stackit_fixtures import (
+    STACKIT_PROJECT_ID,
+    set_mocked_stackit_provider,
+)
+
+
+class Test_objectstorage_access_key_expiration:
+    def test_no_access_keys(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.access_keys = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_access_key_expiration.objectstorage_access_key_expiration import (
+                objectstorage_access_key_expiration,
+            )
+
+            check = objectstorage_access_key_expiration()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_access_key_with_expiration(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.access_keys = [
+            AccessKey(
+                key_id="key-123",
+                display_name="my-key",
+                expires="2027-01-01T00:00:00+00:00",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_access_key_expiration.objectstorage_access_key_expiration import (
+                objectstorage_access_key_expiration,
+            )
+
+            check = objectstorage_access_key_expiration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "has an expiration date set" in result[0].status_extended
+            assert result[0].resource_id == "key-123"
+            assert result[0].resource_name == "my-key"
+            assert result[0].location == "eu01"
+
+    def test_access_key_no_expiration_none(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.access_keys = [
+            AccessKey(
+                key_id="key-456",
+                display_name="never-expiring-key",
+                expires=None,
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_access_key_expiration.objectstorage_access_key_expiration import (
+                objectstorage_access_key_expiration,
+            )
+
+            check = objectstorage_access_key_expiration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "no expiration date" in result[0].status_extended
+            assert result[0].resource_id == "key-456"
+
+    def test_access_key_no_expiration_sentinel(self):
+        """Year-0001 date is the SDK sentinel for 'never expires'."""
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.access_keys = [
+            AccessKey(
+                key_id="key-789",
+                display_name="sentinel-key",
+                expires="0001-01-01T00:00:00+00:00",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_access_key_expiration.objectstorage_access_key_expiration import (
+                objectstorage_access_key_expiration,
+            )
+
+            check = objectstorage_access_key_expiration()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "no expiration date" in result[0].status_extended
diff --git a/tests/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled_test.py b/tests/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled_test.py
new file mode 100644
index 0000000000..a802dac78f
--- /dev/null
+++ b/tests/providers/stackit/services/objectstorage/objectstorage_bucket_object_lock_enabled/objectstorage_bucket_object_lock_enabled_test.py
@@ -0,0 +1,111 @@
+from unittest import mock
+
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    Bucket,
+)
+from tests.providers.stackit.stackit_fixtures import (
+    STACKIT_PROJECT_ID,
+    set_mocked_stackit_provider,
+)
+
+
+class Test_objectstorage_bucket_object_lock_enabled:
+    def test_no_buckets(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_object_lock_enabled.objectstorage_bucket_object_lock_enabled import (
+                objectstorage_bucket_object_lock_enabled,
+            )
+
+            check = objectstorage_bucket_object_lock_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_object_lock_enabled(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=True,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_object_lock_enabled.objectstorage_bucket_object_lock_enabled import (
+                objectstorage_bucket_object_lock_enabled,
+            )
+
+            check = objectstorage_bucket_object_lock_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "has S3 Object Lock enabled" in result[0].status_extended
+            assert result[0].resource_id == "my-bucket"
+            assert result[0].resource_name == "my-bucket"
+            assert result[0].location == "eu01"
+
+    def test_bucket_object_lock_disabled(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=False,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_object_lock_enabled.objectstorage_bucket_object_lock_enabled import (
+                objectstorage_bucket_object_lock_enabled,
+            )
+
+            check = objectstorage_bucket_object_lock_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "does not have S3 Object Lock enabled" in result[0].status_extended
+            assert result[0].resource_id == "my-bucket"
diff --git a/tests/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy_test.py b/tests/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy_test.py
new file mode 100644
index 0000000000..59fdf73370
--- /dev/null
+++ b/tests/providers/stackit/services/objectstorage/objectstorage_bucket_retention_policy/objectstorage_bucket_retention_policy_test.py
@@ -0,0 +1,153 @@
+from unittest import mock
+
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    Bucket,
+)
+from tests.providers.stackit.stackit_fixtures import (
+    STACKIT_PROJECT_ID,
+    set_mocked_stackit_provider,
+)
+
+
+class Test_objectstorage_bucket_retention_policy:
+    def test_no_buckets(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_retention_policy.objectstorage_bucket_retention_policy import (
+                objectstorage_bucket_retention_policy,
+            )
+
+            check = objectstorage_bucket_retention_policy()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_bucket_with_retention_policy(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=True,
+                retention_days=30,
+                retention_mode="COMPLIANCE",
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_retention_policy.objectstorage_bucket_retention_policy import (
+                objectstorage_bucket_retention_policy,
+            )
+
+            check = objectstorage_bucket_retention_policy()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "30 day(s)" in result[0].status_extended
+            assert "COMPLIANCE" in result[0].status_extended
+            assert result[0].resource_id == "my-bucket"
+            assert result[0].location == "eu01"
+
+    def test_bucket_without_retention_policy(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=False,
+                retention_days=None,
+                retention_mode=None,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_retention_policy.objectstorage_bucket_retention_policy import (
+                objectstorage_bucket_retention_policy,
+            )
+
+            check = objectstorage_bucket_retention_policy()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                "does not have a default retention policy" in result[0].status_extended
+            )
+            assert result[0].resource_id == "my-bucket"
+
+    def test_bucket_retention_zero_days(self):
+        objectstorage_client = mock.MagicMock
+        objectstorage_client.buckets = [
+            Bucket(
+                name="my-bucket",
+                region="eu01",
+                project_id=STACKIT_PROJECT_ID,
+                object_lock_enabled=True,
+                retention_days=0,
+                retention_mode="GOVERNANCE",
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_stackit_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_service.ObjectStorageService",
+                new=objectstorage_client,
+            ) as service_client,
+            mock.patch(
+                "prowler.providers.stackit.services.objectstorage.objectstorage_client.objectstorage_client",
+                new=service_client,
+            ),
+        ):
+            from prowler.providers.stackit.services.objectstorage.objectstorage_bucket_retention_policy.objectstorage_bucket_retention_policy import (
+                objectstorage_bucket_retention_policy,
+            )
+
+            check = objectstorage_bucket_retention_policy()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
diff --git a/tests/providers/stackit/services/objectstorage/stackit_objectstorage_service_test.py b/tests/providers/stackit/services/objectstorage/stackit_objectstorage_service_test.py
new file mode 100644
index 0000000000..59f6559a54
--- /dev/null
+++ b/tests/providers/stackit/services/objectstorage/stackit_objectstorage_service_test.py
@@ -0,0 +1,645 @@
+from types import SimpleNamespace
+from unittest import mock
+
+import pytest
+
+from prowler.providers.stackit.services.objectstorage.objectstorage_service import (
+    AccessKey,
+    ObjectStorageService,
+)
+from tests.providers.stackit.stackit_fixtures import STACKIT_PROJECT_ID
+
+
+class TestObjectStorageService:
+    def test_list_buckets_keeps_bucket_when_retention_not_configured(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        not_found_error = Exception("not found")
+        not_found_error.status = 404
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(
+            buckets=[
+                SimpleNamespace(
+                    name="my-bucket",
+                    object_lock_enabled=True,
+                )
+            ]
+        )
+        client.get_default_retention.side_effect = not_found_error
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 1
+        assert service.buckets[0].name == "my-bucket"
+        assert service.buckets[0].object_lock_enabled is True
+        assert service.buckets[0].retention_days is None
+        assert service.buckets[0].retention_mode is None
+
+    def test_list_buckets_propagates_unexpected_retention_api_errors(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        api_error = Exception("service unavailable")
+        api_error.status = 503
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(
+            buckets=[
+                SimpleNamespace(
+                    name="my-bucket",
+                    object_lock_enabled=True,
+                )
+            ]
+        )
+        client.get_default_retention.side_effect = api_error
+
+        with pytest.raises(Exception, match="service unavailable"):
+            service._list_buckets(client, "eu01")
+
+        assert service.buckets == []
+        service.provider.handle_api_error.assert_called_once_with(api_error)
+
+    def test_init_creates_service_with_no_regions(self):
+        provider = mock.MagicMock()
+        provider.identity.project_id = STACKIT_PROJECT_ID
+        provider.generate_regional_clients.return_value = {}
+
+        service = ObjectStorageService(provider)
+
+        assert service.project_id == STACKIT_PROJECT_ID
+        assert service.buckets == []
+        assert service.access_keys == []
+        provider.generate_regional_clients.assert_called_once_with("objectstorage")
+
+    def test_fetch_all_regions_skips_404_region(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+        service.access_keys = []
+
+        not_found = Exception("not found")
+        not_found.status = 404
+        service.regional_clients = {"eu01": mock.MagicMock()}
+
+        with mock.patch.object(service, "_list_buckets", side_effect=not_found):
+            service._fetch_all_regions()
+
+        assert service.buckets == []
+
+    def test_fetch_all_regions_reraises_non_404_error(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+        service.access_keys = []
+
+        server_error = Exception("internal server error")
+        server_error.status = 500
+        service.regional_clients = {"eu01": mock.MagicMock()}
+
+        with mock.patch.object(service, "_list_buckets", side_effect=server_error):
+            with pytest.raises(Exception, match="internal server error"):
+                service._fetch_all_regions()
+
+    def test_list_buckets_with_dict_api_response(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        not_found = Exception("not found")
+        not_found.status = 404
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = {
+            "buckets": [
+                SimpleNamespace(name="dict-response-bucket", object_lock_enabled=True)
+            ]
+        }
+        client.get_default_retention.side_effect = not_found
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 1
+        assert service.buckets[0].name == "dict-response-bucket"
+
+    def test_list_buckets_with_dict_bucket_data(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        not_found = Exception("not found")
+        not_found.status = 404
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(
+            buckets=[{"name": "dict-bucket", "objectLockEnabled": True}]
+        )
+        client.get_default_retention.side_effect = not_found
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 1
+        assert service.buckets[0].name == "dict-bucket"
+        assert service.buckets[0].object_lock_enabled is True
+
+    def test_list_buckets_skips_unknown_bucket_type(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(buckets=[42])
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 0
+
+    def test_get_default_retention_with_dict_response(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+
+        client = mock.MagicMock()
+        client.get_default_retention.return_value = {"days": 14, "mode": "GOVERNANCE"}
+
+        days, mode = service._get_default_retention(client, "eu01", "my-bucket")
+
+        assert days == 14
+        assert mode == "GOVERNANCE"
+
+    def test_list_access_keys_with_object_data(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[SimpleNamespace(id="cg-001", display_name="main-group")]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(
+            access_keys=[
+                SimpleNamespace(
+                    key_id="key-001",
+                    display_name="my-key",
+                    expires="2027-01-01T00:00:00+00:00",
+                )
+            ]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        client.list_credentials_groups.assert_called_once_with(
+            project_id=STACKIT_PROJECT_ID, region="eu01"
+        )
+        client.list_access_keys.assert_called_once_with(
+            project_id=STACKIT_PROJECT_ID, region="eu01", credentials_group="cg-001"
+        )
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-001"
+        assert service.access_keys[0].display_name == "my-key"
+        assert service.access_keys[0].region == "eu01"
+        assert service.access_keys[0].expires == "2027-01-01T00:00:00+00:00"
+        assert service.access_keys[0].credentials_group_id == "cg-001"
+        assert service.access_keys[0].credentials_group_name == "main-group"
+
+    def test_list_access_keys_with_credentials_group_id_object_data(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[
+                SimpleNamespace(
+                    credentials_group_id="cg-sdk",
+                    display_name="sdk-group",
+                )
+            ]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(access_keys=[])
+
+        service._list_access_keys(client, "eu01")
+
+        client.list_access_keys.assert_called_once_with(
+            project_id=STACKIT_PROJECT_ID, region="eu01", credentials_group="cg-sdk"
+        )
+
+    def test_list_access_keys_collects_keys_from_multiple_credentials_groups(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[
+                SimpleNamespace(id="cg-001", display_name="group-one"),
+                SimpleNamespace(id="cg-002", display_name="group-two"),
+            ]
+        )
+        client.list_access_keys.side_effect = [
+            SimpleNamespace(
+                access_keys=[
+                    SimpleNamespace(
+                        key_id="key-001",
+                        display_name="key-one",
+                        expires="2027-01-01T00:00:00+00:00",
+                    )
+                ]
+            ),
+            SimpleNamespace(
+                access_keys=[
+                    SimpleNamespace(
+                        key_id="key-002",
+                        display_name="key-two",
+                        expires=None,
+                    )
+                ]
+            ),
+        ]
+
+        service._list_access_keys(client, "eu01")
+
+        assert client.list_access_keys.call_args_list == [
+            mock.call(
+                project_id=STACKIT_PROJECT_ID,
+                region="eu01",
+                credentials_group="cg-001",
+            ),
+            mock.call(
+                project_id=STACKIT_PROJECT_ID,
+                region="eu01",
+                credentials_group="cg-002",
+            ),
+        ]
+        assert [key.key_id for key in service.access_keys] == ["key-001", "key-002"]
+        assert service.access_keys[1].expires is None
+        assert service.access_keys[1].has_expiration() is False
+        assert [key.credentials_group_id for key in service.access_keys] == [
+            "cg-001",
+            "cg-002",
+        ]
+
+    def test_list_access_keys_with_dict_api_response(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = {
+            "credentialsGroups": [{"id": "cg-dict", "displayName": "dict-group"}]
+        }
+        client.list_access_keys.return_value = {
+            "accessKeys": [
+                {"keyId": "key-dict", "displayName": "dict-key", "expires": None}
+            ]
+        }
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-dict"
+        assert service.access_keys[0].display_name == "dict-key"
+        assert service.access_keys[0].expires is None
+        assert service.access_keys[0].has_expiration() is False
+        assert service.access_keys[0].credentials_group_id == "cg-dict"
+        assert service.access_keys[0].credentials_group_name == "dict-group"
+
+    def test_list_access_keys_with_raw_json_response_and_null_expires(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        class RawResponse:
+            status = 200
+
+            def json(self):
+                return {
+                    "accessKeys": [
+                        {
+                            "keyId": "key-raw",
+                            "displayName": "raw-key",
+                            "expires": None,
+                        }
+                    ]
+                }
+
+        class FakeClient:
+            def __init__(self):
+                self.list_credentials_groups = mock.MagicMock(
+                    return_value=SimpleNamespace(
+                        credentials_groups=[SimpleNamespace(id="cg-raw")]
+                    )
+                )
+                self.list_access_keys = mock.MagicMock()
+                self.raw_call = None
+
+            def list_access_keys_without_preload_content(self, **kwargs):
+                self.raw_call = kwargs
+                return RawResponse()
+
+        client = FakeClient()
+
+        service._list_access_keys(client, "eu01")
+
+        assert client.raw_call == {
+            "project_id": STACKIT_PROJECT_ID,
+            "region": "eu01",
+            "credentials_group": "cg-raw",
+        }
+        client.list_access_keys.assert_not_called()
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-raw"
+        assert service.access_keys[0].expires is None
+        assert service.access_keys[0].has_expiration() is False
+
+    def test_list_access_keys_with_raw_data_response(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        class RawResponse:
+            status = 200
+            data = b'{"accessKeys":[{"keyId":"key-data","displayName":"data-key"}]}'
+
+        class FakeClient:
+            def __init__(self):
+                self.list_credentials_groups = mock.MagicMock(
+                    return_value=SimpleNamespace(
+                        credentials_groups=[SimpleNamespace(id="cg-data")]
+                    )
+                )
+
+            def list_access_keys_without_preload_content(self, **kwargs):
+                return RawResponse()
+
+        service._list_access_keys(FakeClient(), "eu01")
+
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-data"
+        assert service.access_keys[0].display_name == "data-key"
+
+    def test_list_access_keys_raw_response_propagates_non_success_status(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        class RawResponse:
+            status = 503
+
+        class FakeClient:
+            def __init__(self):
+                self.list_credentials_groups = mock.MagicMock(
+                    return_value=SimpleNamespace(
+                        credentials_groups=[SimpleNamespace(id="cg-error")]
+                    )
+                )
+
+            def list_access_keys_without_preload_content(self, **kwargs):
+                return RawResponse()
+
+        with pytest.raises(Exception, match="status 503") as error:
+            service._list_access_keys(FakeClient(), "eu01")
+
+        assert error.value.status == 503
+        service.provider.handle_api_error.assert_called_once_with(error.value)
+
+    def test_list_access_keys_with_dict_key_data(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[{"id": "cg-456", "displayName": "group-456"}]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(
+            access_keys=[
+                {
+                    "keyId": "key-456",
+                    "displayName": "my-dict-key",
+                    "expires": "2028-06-01T00:00:00+00:00",
+                }
+            ]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-456"
+        assert service.access_keys[0].display_name == "my-dict-key"
+        assert service.access_keys[0].credentials_group_id == "cg-456"
+
+    def test_list_access_keys_skips_unknown_type(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[SimpleNamespace(id="cg-001")]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(access_keys=[42])
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 0
+
+    def test_list_access_keys_no_keys(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[SimpleNamespace(id="cg-empty")]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(access_keys=[])
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 0
+
+    def test_list_access_keys_no_credentials_groups(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 0
+        client.list_access_keys.assert_not_called()
+
+    def test_list_access_keys_skips_malformed_credentials_groups(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[
+                42,
+                {},
+                SimpleNamespace(id="cg-valid", display_name="valid-group"),
+            ]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(
+            access_keys=[SimpleNamespace(key_id="key-valid")]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        client.list_access_keys.assert_called_once_with(
+            project_id=STACKIT_PROJECT_ID, region="eu01", credentials_group="cg-valid"
+        )
+        assert len(service.access_keys) == 1
+        assert service.access_keys[0].key_id == "key-valid"
+
+    def test_fetch_all_regions_calls_both_list_methods(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+        service.access_keys = []
+
+        service.regional_clients = {"eu01": mock.MagicMock()}
+
+        with (
+            mock.patch.object(service, "_list_buckets") as mock_buckets,
+            mock.patch.object(service, "_list_access_keys") as mock_keys,
+        ):
+            service._fetch_all_regions()
+
+        mock_buckets.assert_called_once()
+        mock_keys.assert_called_once()
+
+    def test_list_buckets_handles_bucket_processing_error(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.buckets = []
+
+        class BrokenBucket:
+            @property
+            def name(self):
+                raise RuntimeError("broken bucket attribute")
+
+        client = mock.MagicMock()
+        client.list_buckets.return_value = SimpleNamespace(buckets=[BrokenBucket()])
+
+        service._list_buckets(client, "eu01")
+
+        assert len(service.buckets) == 0
+
+    def test_list_access_keys_handles_key_processing_error(self):
+        service = ObjectStorageService.__new__(ObjectStorageService)
+        service.provider = mock.MagicMock()
+        service.project_id = STACKIT_PROJECT_ID
+        service.access_keys = []
+
+        class BrokenKey:
+            @property
+            def key_id(self):
+                raise RuntimeError("broken key attribute")
+
+        client = mock.MagicMock()
+        client.list_credentials_groups.return_value = SimpleNamespace(
+            credentials_groups=[SimpleNamespace(id="cg-001")]
+        )
+        client.list_access_keys.return_value = SimpleNamespace(
+            access_keys=[BrokenKey()]
+        )
+
+        service._list_access_keys(client, "eu01")
+
+        assert len(service.access_keys) == 0
+
+
+class TestAccessKeyModel:
+    def test_has_expiration_with_invalid_date_string(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="not-a-valid-date",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.has_expiration() is False
+
+    def test_expires_within_days_when_no_expiration(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires=None,
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires is None
+        assert key.has_expiration() is False
+        assert key.expires_within_days(90) is False
+
+    def test_expires_within_days_when_expiring_soon(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="2026-06-15T00:00:00+00:00",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires_within_days(90) is True
+
+    def test_expires_within_days_when_not_expiring_soon(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="2030-01-01T00:00:00+00:00",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires_within_days(30) is False
+
+    def test_expires_within_days_with_naive_datetime(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="2026-06-10T00:00:00",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires_within_days(90) is True
+
+    def test_expires_within_days_with_sentinel_key(self):
+        key = AccessKey(
+            key_id="k",
+            display_name="k",
+            expires="0001-01-01T00:00:00+00:00",
+            region="eu01",
+            project_id=STACKIT_PROJECT_ID,
+        )
+        assert key.expires_within_days(90) is False
diff --git a/tests/providers/stackit/stackit_provider_test.py b/tests/providers/stackit/stackit_provider_test.py
index 8bcbe17f84..13bc7f4698 100644
--- a/tests/providers/stackit/stackit_provider_test.py
+++ b/tests/providers/stackit/stackit_provider_test.py
@@ -411,3 +411,68 @@ class Test_StackitProvider_Handle_API_Error:
         with pytest.raises(RuntimeError) as excinfo:
             StackitProvider.handle_api_error(original)
         assert excinfo.value is original
+
+
+class TestGenerateRegionalClients:
+    """Tests for StackitProvider.generate_regional_clients."""
+
+    def _make_provider(self):
+        provider = object.__new__(StackitProvider)
+        provider._service_account_key_path = "/tmp/sa-key.json"
+        provider._service_account_key = None
+        provider._audited_regions = None
+        return provider
+
+    def _fake_classes(self):
+        class FakeConfig:
+            pass
+
+        class FakeIaasClient:
+            def __init__(self, config):
+                pass
+
+        class FakeObjStorageClient:
+            def __init__(self, config):
+                pass
+
+        return FakeConfig, FakeIaasClient, FakeObjStorageClient
+
+    def test_objectstorage_service_uses_objectstorage_api_class(self, monkeypatch):
+        FakeConfig, FakeIaasClient, FakeObjStorageClient = self._fake_classes()
+
+        monkeypatch.setattr(
+            StackitProvider,
+            "_SERVICE_API_CLASS",
+            {"iaas": FakeIaasClient, "objectstorage": FakeObjStorageClient},
+        )
+        provider = self._make_provider()
+        monkeypatch.setattr(
+            provider, "get_available_service_regions", lambda _s, _r: ["eu01"]
+        )
+        with patch.object(
+            StackitProvider, "_build_sdk_configuration", return_value=FakeConfig()
+        ):
+            clients = provider.generate_regional_clients("objectstorage")
+
+        assert "eu01" in clients
+        assert isinstance(clients["eu01"], FakeObjStorageClient)
+
+    def test_iaas_service_uses_iaas_api_class(self, monkeypatch):
+        FakeConfig, FakeIaasClient, FakeObjStorageClient = self._fake_classes()
+
+        monkeypatch.setattr(
+            StackitProvider,
+            "_SERVICE_API_CLASS",
+            {"iaas": FakeIaasClient, "objectstorage": FakeObjStorageClient},
+        )
+        provider = self._make_provider()
+        monkeypatch.setattr(
+            provider, "get_available_service_regions", lambda _s, _r: ["eu01"]
+        )
+        with patch.object(
+            StackitProvider, "_build_sdk_configuration", return_value=FakeConfig()
+        ):
+            clients = provider.generate_regional_clients("iaas")
+
+        assert "eu01" in clients
+        assert isinstance(clients["eu01"], FakeIaasClient)
diff --git a/uv.lock b/uv.lock
index e42e3ba8af..3a66d2826b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -3325,6 +3325,7 @@ dependencies = [
     { name = "slack-sdk" },
     { name = "stackit-core" },
     { name = "stackit-iaas" },
+    { name = "stackit-objectstorage" },
     { name = "stackit-resourcemanager" },
     { name = "tabulate" },
     { name = "tzlocal" },
@@ -3433,6 +3434,7 @@ requires-dist = [
     { name = "slack-sdk", specifier = "==3.39.0" },
     { name = "stackit-core", specifier = "==0.2.0" },
     { name = "stackit-iaas", specifier = "==1.4.0" },
+    { name = "stackit-objectstorage", specifier = "==1.4.0" },
     { name = "stackit-resourcemanager", specifier = "==0.8.0" },
     { name = "tabulate", specifier = "==0.9.0" },
     { name = "tzlocal", specifier = "==5.3.1" },
@@ -4298,6 +4300,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/08/51/2201164d7bfacf47539888c735f10f6320c188252384957aa1b23121a210/stackit_iaas-1.4.0-py3-none-any.whl", hash = "sha256:3f4a32321b57ac238f73e5d660c6428186b92cc0425c1f0783ba801e377149d9", size = 316588, upload-time = "2026-05-13T09:43:14.943Z" },
 ]
 
+[[package]]
+name = "stackit-objectstorage"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dateutil" },
+    { name = "requests" },
+    { name = "stackit-core" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/90/80/b790756af40a5c6d979dd688b2557394ac54b594eb4c08edc33157ba890f/stackit_objectstorage-1.4.0.tar.gz", hash = "sha256:4a3812b4de102b199f061706a802909f9e53ae9b0858769d5bd720f814c8bdbe", size = 31814, upload-time = "2026-05-13T09:43:05.027Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/68/f1/ffa8d5e2ec9f818c72a6f045691364eb4e927ee86641993a70882d00205a/stackit_objectstorage-1.4.0-py3-none-any.whl", hash = "sha256:1a3285c6840d95cff591d84fd21803575cb0d010c398e6575ed92987b9c39866", size = 65061, upload-time = "2026-05-13T09:43:04.13Z" },
+]
+
 [[package]]
 name = "stackit-resourcemanager"
 version = "0.8.0"

From e085e14247d66c789dbb1109fe6fc0e753be9aaf Mon Sep 17 00:00:00 2001
From: sahil-sols <168274064+sahil-sols@users.noreply.github.com>
Date: Wed, 10 Jun 2026 22:19:06 +0530
Subject: [PATCH 009/126] fix(aws): order-independent CloudWatch metric filter
 pattern checks (#11345)

Co-authored-by: Sahil Pugalia <sahil-sols@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 ...etwork_acls_alarm_configured.metadata.json |   3 +-
 ...hanges_to_network_acls_alarm_configured.py |  12 +-
 ...es_to_network_gateways_alarm_configured.py |  12 +-
 ...oute_tables_alarm_configured.metadata.json |   2 +-
 ...o_network_route_tables_alarm_configured.py |  14 +-
 ...dwatch_changes_to_vpcs_alarm_configured.py |  17 +-
 ...ws_config_configuration_changes_enabled.py |  11 +-
 ...loudtrail_configuration_changes_enabled.py |  11 +-
 ...g_metric_filter_authentication_failures.py |   6 +-
 ...metric_filter_aws_organizations_changes.py |  28 ++-
 ...isable_or_scheduled_deletion_of_kms_cmk.py |   6 +-
 ...for_s3_bucket_policy_changes.metadata.json |   3 +-
 ...ric_filter_for_s3_bucket_policy_changes.py |  16 +-
 ...metric_filter_policy_changes.metadata.json |   1 -
 ...dwatch_log_metric_filter_policy_changes.py |  22 ++-
 ...og_metric_filter_security_group_changes.py |  12 +-
 ...c_filter_sign_in_without_mfa.metadata.json |   1 -
 ...h_log_metric_filter_sign_in_without_mfa.py |   6 +-
 .../services/cloudwatch/lib/metric_filters.py |  39 ++++
 ...s_to_network_acls_alarm_configured_test.py | 182 ++++++++++++++++++
 ..._network_gateways_alarm_configured_test.py |  92 +++++++++
 ...work_route_tables_alarm_configured_test.py | 182 ++++++++++++++++++
 ...h_changes_to_vpcs_alarm_configured_test.py | 182 ++++++++++++++++++
 ...nfig_configuration_changes_enabled_test.py |  94 +++++++++
 ...rail_configuration_changes_enabled_test.py |  94 +++++++++
 ...ric_filter_authentication_failures_test.py |  92 +++++++++
 ...c_filter_aws_organizations_changes_test.py |  92 +++++++++
 ...e_or_scheduled_deletion_of_kms_cmk_test.py |  94 +++++++++
 ...ilter_for_s3_bucket_policy_changes_test.py |  92 +++++++++
 ...h_log_metric_filter_policy_changes_test.py |  92 +++++++++
 ...tric_filter_security_group_changes_test.py |  92 +++++++++
 ..._metric_filter_sign_in_without_mfa_test.py |  92 +++++++++
 .../cloudwatch/cloudwatch_service_test.py     |  14 ++
 34 files changed, 1689 insertions(+), 20 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 619401bf32..cd6db78f37 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -29,6 +29,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `entra_users_mfa_capable` no longer flags pre-provisioned users with future `employeeHireDate`; future-hire date comparisons now tolerate naive datetimes [(#11511)](https://github.com/prowler-cloud/prowler/pull/11511)
 - M365 Admin Center group enumeration now follows Microsoft Graph pagination so group-scoped checks include groups beyond the first page [(#11510)](https://github.com/prowler-cloud/prowler/pull/11510)
 - GCP `kms_key_rotation_enabled` check now only verifies that automatic key rotation is enabled (any interval) instead of enforcing a 90-day period, resolving the mismatch between the check and its documentation; the CIS, Prowler ThreatScore, and CCC requirements that mandate a 90-day maximum were remapped to the new `kms_key_rotation_max_90_days` check [(#11516)](https://github.com/prowler-cloud/prowler/pull/11516)
+- AWS CloudWatch log metric filter checks now validate `filterPattern` clauses regardless of order [(#11345)](https://github.com/prowler-cloud/prowler/pull/11345)
 
 ---
 
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json
index 20ed5f0adb..9070c7b0c7 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.metadata.json
@@ -17,9 +17,8 @@
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
-    "https://www.clouddefense.ai/compliance-rules/cis-v130/monitoring/cis-v130-4-11",
     "https://support.icompaas.com/support/solutions/articles/62000084031-ensure-a-log-metric-filter-and-alarm-exist-for-changes-to-network-access-control-lists-nacl-",
-    "https://trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudWatchLogs/network-acl-changes-alarm.html",
+    "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudWatchLogs/network-acl-changes-alarm.html",
     "https://support.icompaas.com/support/solutions/articles/62000233134-4-11-ensure-network-access-control-list-nacl-changes-are-monitored-manual-"
   ],
   "Remediation": {
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.py
index 20d68a0121..68f45a8d27 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,16 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_changes_to_network_acls_alarm_configured(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?CreateNetworkAcl.+\$\.eventName\s*=\s*.?CreateNetworkAclEntry.+\$\.eventName\s*=\s*.?DeleteNetworkAcl.+\$\.eventName\s*=\s*.?DeleteNetworkAclEntry.+\$\.eventName\s*=\s*.?ReplaceNetworkAclEntry.+\$\.eventName\s*=\s*.?ReplaceNetworkAclAssociation.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "CreateNetworkAcl",
+                "CreateNetworkAclEntry",
+                "DeleteNetworkAcl",
+                "DeleteNetworkAclEntry",
+                "ReplaceNetworkAclEntry",
+                "ReplaceNetworkAclAssociation",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured.py
index 5f6eda3973..f7bf8e1d22 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,16 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_changes_to_network_gateways_alarm_configured(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?CreateCustomerGateway.+\$\.eventName\s*=\s*.?DeleteCustomerGateway.+\$\.eventName\s*=\s*.?AttachInternetGateway.+\$\.eventName\s*=\s*.?CreateInternetGateway.+\$\.eventName\s*=\s*.?DeleteInternetGateway.+\$\.eventName\s*=\s*.?DetachInternetGateway.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "CreateCustomerGateway",
+                "DeleteCustomerGateway",
+                "AttachInternetGateway",
+                "CreateInternetGateway",
+                "DeleteInternetGateway",
+                "DetachInternetGateway",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.metadata.json
index 82490a63da..89949cfbd6 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.metadata.json
@@ -37,5 +37,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": ""
+  "Notes": "Logging and Monitoring"
 }
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.py
index f8fcc8eacb..460765cb2f 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,18 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_changes_to_network_route_tables_alarm_configured(Check):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?ec2.amazonaws.com.+\$\.eventName\s*=\s*.?CreateRoute.+\$\.eventName\s*=\s*.?CreateRouteTable.+\$\.eventName\s*=\s*.?ReplaceRoute.+\$\.eventName\s*=\s*.?ReplaceRouteTableAssociation.+\$\.eventName\s*=\s*.?DeleteRouteTable.+\$\.eventName\s*=\s*.?DeleteRoute.+\$\.eventName\s*=\s*.?DisassociateRouteTable.?"
+        pattern = build_metric_filter_pattern(
+            event_source="ec2.amazonaws.com",
+            event_names=[
+                "CreateRoute",
+                "CreateRouteTable",
+                "ReplaceRoute",
+                "ReplaceRouteTableAssociation",
+                "DeleteRouteTable",
+                "DeleteRoute",
+                "DisassociateRouteTable",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured.py
index d7606647c4..be4fb0859d 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,21 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_changes_to_vpcs_alarm_configured(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?CreateVpc.+\$\.eventName\s*=\s*.?DeleteVpc.+\$\.eventName\s*=\s*.?ModifyVpcAttribute.+\$\.eventName\s*=\s*.?AcceptVpcPeeringConnection.+\$\.eventName\s*=\s*.?CreateVpcPeeringConnection.+\$\.eventName\s*=\s*.?DeleteVpcPeeringConnection.+\$\.eventName\s*=\s*.?RejectVpcPeeringConnection.+\$\.eventName\s*=\s*.?AttachClassicLinkVpc.+\$\.eventName\s*=\s*.?DetachClassicLinkVpc.+\$\.eventName\s*=\s*.?DisableVpcClassicLink.+\$\.eventName\s*=\s*.?EnableVpcClassicLink.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "CreateVpc",
+                "DeleteVpc",
+                "ModifyVpcAttribute",
+                "AcceptVpcPeeringConnection",
+                "CreateVpcPeeringConnection",
+                "DeleteVpcPeeringConnection",
+                "RejectVpcPeeringConnection",
+                "AttachClassicLinkVpc",
+                "DetachClassicLinkVpc",
+                "DisableVpcClassicLink",
+                "EnableVpcClassicLink",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.py
index 11bf08d99d..49bf9a03a3 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -15,7 +16,15 @@ class cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_change
     Check
 ):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?config.amazonaws.com.+\$\.eventName\s*=\s*.?StopConfigurationRecorder.+\$\.eventName\s*=\s*.?DeleteDeliveryChannel.+\$\.eventName\s*=\s*.?PutDeliveryChannel.+\$\.eventName\s*=\s*.?PutConfigurationRecorder.?"
+        pattern = build_metric_filter_pattern(
+            event_source="config.amazonaws.com",
+            event_names=[
+                "StopConfigurationRecorder",
+                "DeleteDeliveryChannel",
+                "PutDeliveryChannel",
+                "PutConfigurationRecorder",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.py
index eb272ecfb1..e9567315f4 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -15,7 +16,15 @@ class cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_change
     Check
 ):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?CreateTrail.+\$\.eventName\s*=\s*.?UpdateTrail.+\$\.eventName\s*=\s*.?DeleteTrail.+\$\.eventName\s*=\s*.?StartLogging.+\$\.eventName\s*=\s*.?StopLogging.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "CreateTrail",
+                "UpdateTrail",
+                "DeleteTrail",
+                "StartLogging",
+                "StopLogging",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures.py
index c217cbbaf6..1b2e5173bb 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,10 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_authentication_failures(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?ConsoleLogin.+\$\.errorMessage\s*=\s*.?Failed authentication.?"
+        pattern = build_metric_filter_pattern(
+            event_names=["ConsoleLogin"],
+            extra_clauses=[("errorMessage", "=", "Failed authentication")],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes.py
index af7ec82119..9976a885bb 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,32 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_aws_organizations_changes(Check):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?organizations\.amazonaws\.com.+\$\.eventName\s*=\s*.?AcceptHandshake.+\$\.eventName\s*=\s*.?AttachPolicy.+\$\.eventName\s*=\s*.?CancelHandshake.+\$\.eventName\s*=\s*.?CreateAccount.+\$\.eventName\s*=\s*.?CreateOrganization.+\$\.eventName\s*=\s*.?CreateOrganizationalUnit.+\$\.eventName\s*=\s*.?CreatePolicy.+\$\.eventName\s*=\s*.?DeclineHandshake.+\$\.eventName\s*=\s*.?DeleteOrganization.+\$\.eventName\s*=\s*.?DeleteOrganizationalUnit.+\$\.eventName\s*=\s*.?DeletePolicy.+\$\.eventName\s*=\s*.?EnableAllFeatures.+\$\.eventName\s*=\s*.?EnablePolicyType.+\$\.eventName\s*=\s*.?InviteAccountToOrganization.+\$\.eventName\s*=\s*.?LeaveOrganization.+\$\.eventName\s*=\s*.?DetachPolicy.+\$\.eventName\s*=\s*.?DisablePolicyType.+\$\.eventName\s*=\s*.?MoveAccount.+\$\.eventName\s*=\s*.?RemoveAccountFromOrganization.+\$\.eventName\s*=\s*.?UpdateOrganizationalUnit.+\$\.eventName\s*=\s*.?UpdatePolicy.?"
+        pattern = build_metric_filter_pattern(
+            event_source="organizations.amazonaws.com",
+            event_names=[
+                "AcceptHandshake",
+                "AttachPolicy",
+                "CancelHandshake",
+                "CreateAccount",
+                "CreateOrganization",
+                "CreateOrganizationalUnit",
+                "CreatePolicy",
+                "DeclineHandshake",
+                "DeleteOrganization",
+                "DeleteOrganizationalUnit",
+                "DeletePolicy",
+                "EnableAllFeatures",
+                "EnablePolicyType",
+                "InviteAccountToOrganization",
+                "LeaveOrganization",
+                "DetachPolicy",
+                "DisablePolicyType",
+                "MoveAccount",
+                "RemoveAccountFromOrganization",
+                "UpdateOrganizationalUnit",
+                "UpdatePolicy",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.py
index 4cfed985f7..20d1d62a5a 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,10 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk(Check):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?kms.amazonaws.com.+\$\.eventName\s*=\s*.?DisableKey.+\$\.eventName\s*=\s*.?ScheduleKeyDeletion.?"
+        pattern = build_metric_filter_pattern(
+            event_source="kms.amazonaws.com",
+            event_names=["DisableKey", "ScheduleKeyDeletion"],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.metadata.json
index 2d77c42704..6292de6071 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.metadata.json
@@ -17,8 +17,7 @@
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
-    "https://support.icompaas.com/support/solutions/articles/62000086674-ensure-a-log-metric-filter-and-alarm-exist-for-s3-bucket-policy-changes",
-    "https://www.tenable.com/audits/items/CIS_Amazon_Web_Services_Foundations_v5.0.0_L1.audit:8101350d6907e07863ac6748689b3e12"
+    "https://support.icompaas.com/support/solutions/articles/62000086674-ensure-a-log-metric-filter-and-alarm-exist-for-s3-bucket-policy-changes"
   ],
   "Remediation": {
     "Code": {
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.py
index 45d09b3528..d5fe1ef994 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,20 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_for_s3_bucket_policy_changes(Check):
     def execute(self):
-        pattern = r"\$\.eventSource\s*=\s*.?s3.amazonaws.com.+\$\.eventName\s*=\s*.?PutBucketAcl.+\$\.eventName\s*=\s*.?PutBucketPolicy.+\$\.eventName\s*=\s*.?PutBucketCors.+\$\.eventName\s*=\s*.?PutBucketLifecycle.+\$\.eventName\s*=\s*.?PutBucketReplication.+\$\.eventName\s*=\s*.?DeleteBucketPolicy.+\$\.eventName\s*=\s*.?DeleteBucketCors.+\$\.eventName\s*=\s*.?DeleteBucketLifecycle.+\$\.eventName\s*=\s*.?DeleteBucketReplication.?"
+        pattern = build_metric_filter_pattern(
+            event_source="s3.amazonaws.com",
+            event_names=[
+                "PutBucketAcl",
+                "PutBucketPolicy",
+                "PutBucketCors",
+                "PutBucketLifecycle",
+                "PutBucketReplication",
+                "DeleteBucketPolicy",
+                "DeleteBucketCors",
+                "DeleteBucketLifecycle",
+                "DeleteBucketReplication",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.metadata.json
index 75cba1ee62..b1c36be2d8 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.metadata.json
@@ -17,7 +17,6 @@
   "RelatedUrl": "",
   "AdditionalURLs": [
     "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
-    "https://www.clouddefense.ai/compliance-rules/cis-v140/monitoring/cis-v140-4-4",
     "https://www.intelligentdiscovery.io/controls/cloudwatch/cloudwatch-alarm-iam-policy-change"
   ],
   "Remediation": {
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.py
index f5efd04dde..4347a9b3aa 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,26 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_policy_changes(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?DeleteGroupPolicy.+\$\.eventName\s*=\s*.?DeleteRolePolicy.+\$\.eventName\s*=\s*.?DeleteUserPolicy.+\$\.eventName\s*=\s*.?PutGroupPolicy.+\$\.eventName\s*=\s*.?PutRolePolicy.+\$\.eventName\s*=\s*.?PutUserPolicy.+\$\.eventName\s*=\s*.?CreatePolicy.+\$\.eventName\s*=\s*.?DeletePolicy.+\$\.eventName\s*=\s*.?CreatePolicyVersion.+\$\.eventName\s*=\s*.?DeletePolicyVersion.+\$\.eventName\s*=\s*.?AttachRolePolicy.+\$\.eventName\s*=\s*.?DetachRolePolicy.+\$\.eventName\s*=\s*.?AttachUserPolicy.+\$\.eventName\s*=\s*.?DetachUserPolicy.+\$\.eventName\s*=\s*.?AttachGroupPolicy.+\$\.eventName\s*=\s*.?DetachGroupPolicy.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "DeleteGroupPolicy",
+                "DeleteRolePolicy",
+                "DeleteUserPolicy",
+                "PutGroupPolicy",
+                "PutRolePolicy",
+                "PutUserPolicy",
+                "CreatePolicy",
+                "DeletePolicy",
+                "CreatePolicyVersion",
+                "DeletePolicyVersion",
+                "AttachRolePolicy",
+                "DetachRolePolicy",
+                "AttachUserPolicy",
+                "DetachUserPolicy",
+                "AttachGroupPolicy",
+                "DetachGroupPolicy",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes.py
index a7972e420c..3557632904 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,16 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_security_group_changes(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?AuthorizeSecurityGroupIngress.+\$\.eventName\s*=\s*.?AuthorizeSecurityGroupEgress.+\$\.eventName\s*=\s*.?RevokeSecurityGroupIngress.+\$\.eventName\s*=\s*.?RevokeSecurityGroupEgress.+\$\.eventName\s*=\s*.?CreateSecurityGroup.+\$\.eventName\s*=\s*.?DeleteSecurityGroup.?"
+        pattern = build_metric_filter_pattern(
+            event_names=[
+                "AuthorizeSecurityGroupIngress",
+                "AuthorizeSecurityGroupEgress",
+                "RevokeSecurityGroupIngress",
+                "RevokeSecurityGroupEgress",
+                "CreateSecurityGroup",
+                "DeleteSecurityGroup",
+            ],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.metadata.json b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.metadata.json
index 20058c1ed8..76ffd832ff 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.metadata.json
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.metadata.json
@@ -21,7 +21,6 @@
     "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudwatch-alarms-for-cloudtrail.html",
     "https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/aws/CloudWatchLogs/console-sign-in-without-mfa.html",
     "https://www.tenable.com/audits/items/CIS_Amazon_Web_Services_Foundations_v3.0.0_L1.audit:1957056ee174cc38502d5f5f1864333b",
-    "https://www.clouddefense.ai/compliance-rules/gdpr/data-protection/log-metric-filter-console-login-mfa",
     "https://www.intelligentdiscovery.io/controls/cloudwatch/cloudwatch-alarm-no-mfa",
     "https://support.icompaas.com/support/solutions/articles/62000083605-ensure-a-log-metric-filter-and-alarm-exist-for-management-console-sign-in-without-mfa"
   ],
diff --git a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.py b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.py
index 8437600646..07475a6185 100644
--- a/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.py
+++ b/prowler/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa.py
@@ -6,6 +6,7 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_client import (
     cloudwatch_client,
 )
 from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
     check_cloudwatch_log_metric_filter,
 )
 from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
@@ -13,7 +14,10 @@ from prowler.providers.aws.services.cloudwatch.logs_client import logs_client
 
 class cloudwatch_log_metric_filter_sign_in_without_mfa(Check):
     def execute(self):
-        pattern = r"\$\.eventName\s*=\s*.?ConsoleLogin.+\$\.additionalEventData\.MFAUsed\s*!=\s*.?Yes.?"
+        pattern = build_metric_filter_pattern(
+            event_names=["ConsoleLogin"],
+            extra_clauses=[("additionalEventData.MFAUsed", "!=", "Yes")],
+        )
         findings = []
 
         report = check_cloudwatch_log_metric_filter(
diff --git a/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py b/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py
index 84d70b4083..e5d104b840 100644
--- a/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py
+++ b/prowler/providers/aws/services/cloudwatch/lib/metric_filters.py
@@ -3,6 +3,45 @@ import re
 from prowler.lib.check.models import Check_Report_AWS
 
 
+def build_metric_filter_pattern(
+    *,
+    event_names: list[str] | None = None,
+    event_source: str | None = None,
+    extra_clauses: list[tuple[str, str, str]] | None = None,
+) -> str:
+    """Build a regex pattern to match a CloudWatch Logs filterPattern string.
+
+    All clauses must be present for the pattern to match, regardless of the
+    order in which AWS stores them. Event names are matched exactly, so a
+    short name like ``CreateRoute`` will not be satisfied by a longer one
+    like ``CreateRouteTable``.
+
+    Pass the result directly to ``check_cloudwatch_log_metric_filter``.
+
+    Args:
+        event_names: AWS API action names to require (``$.eventName``).
+        event_source: optional service principal to require (``$.eventSource``),
+            e.g. ``"ec2.amazonaws.com"``.
+        extra_clauses: additional conditions as ``(field, operator, value)``
+            tuples, where ``operator`` is ``"="`` or ``"!="``. Example:
+            ``("additionalEventData.MFAUsed", "!=", "Yes")``.
+
+    Returns:
+        A regex string for use with ``re.search(..., flags=re.DOTALL)``.
+    """
+    parts: list[str] = []
+    if event_source is not None:
+        parts.append(rf"(?=.*\$\.eventSource\s*=\s*.?{re.escape(event_source)})")
+    for name in event_names or []:
+        parts.append(rf"(?=.*\$\.eventName\s*=\s*.?{re.escape(name)}\b)")
+    for field, operator, value in extra_clauses or []:
+        if operator not in ("=", "!="):
+            raise ValueError(f"unsupported operator {operator!r}; expected '=' or '!='")
+        op = r"\s*!=\s*" if operator == "!=" else r"\s*=\s*"
+        parts.append(rf"(?=.*\$\.{re.escape(field)}{op}.?{re.escape(value)})")
+    return "".join(parts)
+
+
 def check_cloudwatch_log_metric_filter(
     metric_filter_pattern: str,
     trails: list,
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py
index 66c2099843..928ff2b47c 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_acls_alarm_configured/cloudwatch_changes_to_network_acls_alarm_configured_test.py
@@ -674,3 +674,185 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
             result = check.execute()
 
             assert len(result) == 0
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = ReplaceNetworkAclAssociation) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = DeleteNetworkAcl) || ($.eventName = CreateNetworkAclEntry) || ($.eventName = CreateNetworkAcl) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured import (
+                cloudwatch_changes_to_network_acls_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_acls_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_substring_only_no_match(self):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = CreateNetworkAclEntry) || ($.eventName = DeleteNetworkAclEntry) || ($.eventName = ReplaceNetworkAclEntry) || ($.eventName = ReplaceNetworkAclAssociation) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_acls_alarm_configured.cloudwatch_changes_to_network_acls_alarm_configured import (
+                cloudwatch_changes_to_network_acls_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_acls_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "No CloudWatch log groups found with metric filters or alarms associated."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py
index afe0f7d3ce..50c8663437 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_gateways_alarm_configured/cloudwatch_changes_to_network_gateways_alarm_configured_test.py
@@ -616,3 +616,95 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
             )
             assert result[0].region == AWS_REGION_US_EAST_1
             assert result[0].resource_tags == [{}]
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = DetachInternetGateway) || ($.eventName = DeleteInternetGateway) || ($.eventName = CreateInternetGateway) || ($.eventName = AttachInternetGateway) || ($.eventName = DeleteCustomerGateway) || ($.eventName = CreateCustomerGateway) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_changes_to_network_gateways_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_changes_to_network_gateways_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_gateways_alarm_configured.cloudwatch_changes_to_network_gateways_alarm_configured import (
+                cloudwatch_changes_to_network_gateways_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_gateways_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py
index 7ec6e32c56..929793eb34 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_network_route_tables_alarm_configured/cloudwatch_changes_to_network_route_tables_alarm_configured_test.py
@@ -596,3 +596,185 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = ec2.amazonaws.com) && ($.eventName = DisassociateRouteTable) || ($.eventName = DeleteRoute) || ($.eventName = DeleteRouteTable) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = ReplaceRoute) || ($.eventName = CreateRouteTable) || ($.eventName = CreateRoute) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured import (
+                cloudwatch_changes_to_network_route_tables_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_route_tables_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_substring_only_no_match(self):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = ec2.amazonaws.com) && ($.eventName = CreateRouteTable) || ($.eventName = ReplaceRouteTableAssociation) || ($.eventName = DeleteRouteTable) || ($.eventName = DisassociateRouteTable) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_network_route_tables_alarm_configured.cloudwatch_changes_to_network_route_tables_alarm_configured import (
+                cloudwatch_changes_to_network_route_tables_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_network_route_tables_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "No CloudWatch log groups found with metric filters or alarms associated."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py
index 31f27030ff..57d33cb3fe 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_changes_to_vpcs_alarm_configured/cloudwatch_changes_to_vpcs_alarm_configured_test.py
@@ -596,3 +596,185 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = EnableVpcClassicLink) || ($.eventName = DisableVpcClassicLink) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = ModifyVpcAttribute) || ($.eventName = DeleteVpc) || ($.eventName = CreateVpc) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured import (
+                cloudwatch_changes_to_vpcs_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_vpcs_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_substring_only_no_match(self):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = ModifyVpcAttribute) || ($.eventName = AcceptVpcPeeringConnection) || ($.eventName = CreateVpcPeeringConnection) || ($.eventName = DeleteVpcPeeringConnection) || ($.eventName = RejectVpcPeeringConnection) || ($.eventName = AttachClassicLinkVpc) || ($.eventName = DetachClassicLinkVpc) || ($.eventName = DisableVpcClassicLink) || ($.eventName = EnableVpcClassicLink) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_changes_to_vpcs_alarm_configured.cloudwatch_changes_to_vpcs_alarm_configured import (
+                cloudwatch_changes_to_vpcs_alarm_configured,
+            )
+
+            check = cloudwatch_changes_to_vpcs_alarm_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "No CloudWatch log groups found with metric filters or alarms associated."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled_test.py
index 30982553b2..62ca14d4ba 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled_test.py
@@ -665,3 +665,97 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_c
             result = check.execute()
 
             assert len(result) == 0
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = config.amazonaws.com) && (($.eventName = PutConfigurationRecorder) || ($.eventName = PutDeliveryChannel) || ($.eventName = DeleteDeliveryChannel) || ($.eventName = StopConfigurationRecorder)) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled import (
+                cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled,
+            )
+
+            check = (
+                cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled_test.py
index fcb98fda3e..3b555bf05b 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled/cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled_test.py
@@ -610,3 +610,97 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_c
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = StopLogging) || ($.eventName = StartLogging) || ($.eventName = DeleteTrail) || ($.eventName = UpdateTrail) || ($.eventName = CreateTrail) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled.cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled import (
+                cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled,
+            )
+
+            check = (
+                cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures_test.py
index 66b9d8116b..201be76f6d 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_authentication_failures/cloudwatch_log_metric_filter_authentication_failures_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_authentication_failures:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.errorMessage = Failed authentication) && ($.eventName = ConsoleLogin) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_log_metric_filter_authentication_failures.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_log_metric_filter_authentication_failures.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_authentication_failures.cloudwatch_log_metric_filter_authentication_failures import (
+                cloudwatch_log_metric_filter_authentication_failures,
+            )
+
+            check = cloudwatch_log_metric_filter_authentication_failures()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes_test.py
index 3aaf475cbe..534c50c906 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_aws_organizations_changes/cloudwatch_log_metric_filter_aws_organizations_changes_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_aws_organizations_changes:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = organizations.amazonaws.com) && ($.eventName = UpdatePolicy) || ($.eventName = UpdateOrganizationalUnit) || ($.eventName = RemoveAccountFromOrganization) || ($.eventName = MoveAccount) || ($.eventName = DisablePolicyType) || ($.eventName = DetachPolicy) || ($.eventName = LeaveOrganization) || ($.eventName = InviteAccountToOrganization) || ($.eventName = EnablePolicyType) || ($.eventName = EnableAllFeatures) || ($.eventName = DeletePolicy) || ($.eventName = DeleteOrganizationalUnit) || ($.eventName = DeleteOrganization) || ($.eventName = DeclineHandshake) || ($.eventName = CreatePolicy) || ($.eventName = CreateOrganizationalUnit) || ($.eventName = CreateOrganization) || ($.eventName = CreateAccount) || ($.eventName = CancelHandshake) || ($.eventName = AttachPolicy) || ($.eventName = AcceptHandshake) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_log_metric_filter_aws_organizations_changes.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_log_metric_filter_aws_organizations_changes.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_aws_organizations_changes.cloudwatch_log_metric_filter_aws_organizations_changes import (
+                cloudwatch_log_metric_filter_aws_organizations_changes,
+            )
+
+            check = cloudwatch_log_metric_filter_aws_organizations_changes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk_test.py
index 7eb1cae331..f13263cf9f 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk/cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk_test.py
@@ -610,3 +610,97 @@ class Test_cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = kms.amazonaws.com) && (($.eventName = ScheduleKeyDeletion) || ($.eventName = DisableKey)) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk.cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk import (
+                cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk,
+            )
+
+            check = (
+                cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk()
+            )
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes_test.py
index 7d2d631f11..aa88f5164d 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes/cloudwatch_log_metric_filter_for_s3_bucket_policy_changes_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_for_s3_bucket_policy_changes:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventSource = s3.amazonaws.com) && (($.eventName = DeleteBucketReplication) || ($.eventName = DeleteBucketLifecycle) || ($.eventName = DeleteBucketCors) || ($.eventName = DeleteBucketPolicy) || ($.eventName = PutBucketReplication) || ($.eventName = PutBucketLifecycle) || ($.eventName = PutBucketCors) || ($.eventName = PutBucketPolicy) || ($.eventName = PutBucketAcl)) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes.cloudwatch_log_metric_filter_for_s3_bucket_policy_changes import (
+                cloudwatch_log_metric_filter_for_s3_bucket_policy_changes,
+            )
+
+            check = cloudwatch_log_metric_filter_for_s3_bucket_policy_changes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes_test.py
index 06e36688d6..fd3e86d313 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_policy_changes/cloudwatch_log_metric_filter_policy_changes_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = DetachGroupPolicy) || ($.eventName = AttachGroupPolicy) || ($.eventName = DetachUserPolicy) || ($.eventName = AttachUserPolicy) || ($.eventName = DetachRolePolicy) || ($.eventName = AttachRolePolicy) || ($.eventName = DeletePolicyVersion) || ($.eventName = CreatePolicyVersion) || ($.eventName = DeletePolicy) || ($.eventName = CreatePolicy) || ($.eventName = PutUserPolicy) || ($.eventName = PutRolePolicy) || ($.eventName = PutGroupPolicy) || ($.eventName = DeleteUserPolicy) || ($.eventName = DeleteRolePolicy) || ($.eventName = DeleteGroupPolicy) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_policy_changes.cloudwatch_log_metric_filter_policy_changes.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_policy_changes.cloudwatch_log_metric_filter_policy_changes.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_policy_changes.cloudwatch_log_metric_filter_policy_changes.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_policy_changes.cloudwatch_log_metric_filter_policy_changes import (
+                cloudwatch_log_metric_filter_policy_changes,
+            )
+
+            check = cloudwatch_log_metric_filter_policy_changes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes_test.py
index ede85e8e6e..35dee7b516 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_security_group_changes/cloudwatch_log_metric_filter_security_group_changes_test.py
@@ -599,3 +599,95 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.eventName = DeleteSecurityGroup) || ($.eventName = CreateSecurityGroup) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = AuthorizeSecurityGroupIngress) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_log_metric_filter_security_group_changes.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_log_metric_filter_security_group_changes.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_security_group_changes.cloudwatch_log_metric_filter_security_group_changes import (
+                cloudwatch_log_metric_filter_security_group_changes,
+            )
+
+            check = cloudwatch_log_metric_filter_security_group_changes()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa_test.py
index df67472cdd..6944860d75 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_log_metric_filter_sign_in_without_mfa/cloudwatch_log_metric_filter_sign_in_without_mfa_test.py
@@ -596,3 +596,95 @@ class Test_cloudwatch_log_metric_filter_sign_in_without_mfa:
                 == f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*"
             )
             assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_reversed_clauses(
+        self,
+    ):
+        cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_US_EAST_1)
+        cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_US_EAST_1)
+        logs_client = client("logs", region_name=AWS_REGION_US_EAST_1)
+        s3_client = client("s3", region_name=AWS_REGION_US_EAST_1)
+        s3_client.create_bucket(Bucket="test")
+        logs_client.create_log_group(logGroupName="/log-group/test")
+        cloudtrail_client.create_trail(
+            Name="test_trail",
+            S3BucketName="test",
+            CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test:*",
+        )
+        logs_client.put_metric_filter(
+            logGroupName="/log-group/test",
+            filterName="test-filter",
+            filterPattern="{ ($.additionalEventData.MFAUsed != Yes) && ($.eventName = ConsoleLogin) }",
+            metricTransformations=[
+                {
+                    "metricName": "my-metric",
+                    "metricNamespace": "my-namespace",
+                    "metricValue": "$.value",
+                }
+            ],
+        )
+        cloudwatch_client.put_metric_alarm(
+            AlarmName="test-alarm",
+            MetricName="my-metric",
+            Namespace="my-namespace",
+            Period=10,
+            EvaluationPeriods=5,
+            Statistic="Average",
+            Threshold=2,
+            ComparisonOperator="GreaterThanThreshold",
+            ActionsEnabled=True,
+        )
+
+        from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
+            Cloudtrail,
+        )
+        from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
+            CloudWatch,
+            Logs,
+        )
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        from prowler.providers.common.models import Audit_Metadata
+
+        aws_provider.audit_metadata = Audit_Metadata(
+            services_scanned=0,
+            expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
+            completed_checks=0,
+            audit_progress=0,
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_log_metric_filter_sign_in_without_mfa.logs_client",
+                new=Logs(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_client",
+                new=CloudWatch(aws_provider),
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudtrail_client",
+                new=Cloudtrail(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.cloudwatch.cloudwatch_log_metric_filter_sign_in_without_mfa.cloudwatch_log_metric_filter_sign_in_without_mfa import (
+                cloudwatch_log_metric_filter_sign_in_without_mfa,
+            )
+
+            check = cloudwatch_log_metric_filter_sign_in_without_mfa()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "CloudWatch log group /log-group/test found with metric filter test-filter and alarms set."
+            )
diff --git a/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py b/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py
index 8ae7ed980f..33d4bde7d7 100644
--- a/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py
+++ b/tests/providers/aws/services/cloudwatch/cloudwatch_service_test.py
@@ -1,3 +1,4 @@
+import pytest
 from boto3 import client
 from moto import mock_aws
 
@@ -5,6 +6,9 @@ from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
     CloudWatch,
     Logs,
 )
+from prowler.providers.aws.services.cloudwatch.lib.metric_filters import (
+    build_metric_filter_pattern,
+)
 from tests.providers.aws.utils import (
     AWS_ACCOUNT_NUMBER,
     AWS_REGION_US_EAST_1,
@@ -216,3 +220,13 @@ class Test_CloudWatch_Service:
         assert logs.log_groups[arn].kms_id == "test_kms_id"
         assert logs.log_groups[arn].region == AWS_REGION_US_EAST_1
         assert logs.log_groups[arn].tags == [{}]
+
+
+class Test_build_metric_filter_pattern:
+    @pytest.mark.parametrize("bad_operator", ["==", "~=", "<", "<>", ">=", ""])
+    def test_rejects_unsupported_operator(self, bad_operator):
+        with pytest.raises(ValueError, match="unsupported operator"):
+            build_metric_filter_pattern(
+                event_names=["ConsoleLogin"],
+                extra_clauses=[("errorMessage", bad_operator, "Failed authentication")],
+            )

From 75f95559d629f371b5618c3f4c243d8b54a975a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Wed, 10 Jun 2026 19:04:40 +0200
Subject: [PATCH 010/126] fix(api): warm compliance caches when starting the
 worker (#11530)

---
 api/CHANGELOG.md                              |  1 +
 api/src/backend/api/compliance.py             | 63 +++++++++++++
 api/src/backend/api/exceptions.py             | 26 ++++++
 api/src/backend/api/tests/test_compliance.py  | 93 +++++++++++++++++++
 api/src/backend/api/tests/test_views.py       | 33 +++++++
 api/src/backend/api/v1/views.py               | 10 ++
 api/src/backend/config/guniconf.py            | 25 +++++
 ui/CHANGELOG.md                               |  1 +
 ui/actions/compliances/compliances.ts         |  7 ++
 .../compliance/[compliancetitle]/page.tsx     | 11 +++
 .../compliance/compliance-warming.tsx         | 49 ++++++++++
 ui/components/compliance/index.ts             |  1 +
 12 files changed, 320 insertions(+)
 create mode 100644 ui/components/compliance/compliance-warming.tsx

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 2033dcc420..6759b28741 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -19,6 +19,7 @@ All notable changes to the **Prowler API** are documented in this file.
 
 - Workers now shut down gracefully on deploy or restart, finishing or re-queueing in-flight tasks instead of being force-killed and leaving them stuck [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
 - Resource `name` is now stored and refreshed on every scan, so resources no longer keep an empty name [(#11476)](https://github.com/prowler-cloud/prowler/pull/11476)
+- Compliance catalog now warms in a background thread after each worker forks, and `compliance-overviews/attributes` returns `503` while warming, so the first request after a deploy no longer trips the Gunicorn worker timeout [(#4554)](https://github.com/prowler-cloud/prowler-cloud/pull/4554)
 
 ### 🔐 Security
 
diff --git a/api/src/backend/api/compliance.py b/api/src/backend/api/compliance.py
index 678aff8d57..202825185b 100644
--- a/api/src/backend/api/compliance.py
+++ b/api/src/backend/api/compliance.py
@@ -1,3 +1,5 @@
+import logging
+import threading
 from collections.abc import Iterable, Mapping
 
 from api.models import Provider
@@ -6,8 +8,19 @@ from prowler.lib.check.compliance_models import (
 )
 from prowler.lib.check.models import CheckMetadata
 
+logger = logging.getLogger(__name__)
+
 AVAILABLE_COMPLIANCE_FRAMEWORKS = {}
 
+# Per-process readiness flags for the background compliance warm-up.
+# `STARTED` is set as soon as warming begins (only happens under Gunicorn via
+# the post_fork hook); `WARMED` is set when it finishes. The attributes
+# endpoint checks both: it returns 503 only while warming is in progress.
+# Under `runserver` warming never runs, so `STARTED` stays clear and the
+# endpoint keeps lazy-loading as before.
+COMPLIANCE_WARMING_STARTED = threading.Event()
+COMPLIANCE_WARMED = threading.Event()
+
 
 class LazyComplianceTemplate(Mapping):
     """Lazy-load compliance templates per provider on first access."""
@@ -174,6 +187,56 @@ def _ensure_provider_loaded(provider_type: Provider.ProviderChoices) -> None:
         PROWLER_CHECKS._cache[provider_type] = checks
 
 
+def warm_compliance_caches(
+    provider_types: Iterable[str] | None = None,
+) -> list[str]:
+    """
+    Eagerly populate the per-process compliance caches at server startup.
+
+    Moves the cold-cache catalog load off the request thread so the first
+    request does not trip the Gunicorn worker timeout. Reads only on-disk
+    metadata (no database access). Each provider is warmed in isolation;
+    failures are logged and fall back to lazy loading.
+
+    Args:
+        provider_types (Iterable[str] | None): Subset to warm. Defaults to all.
+
+    Returns:
+        list[str]: Provider types that could not be warmed.
+    """
+    if provider_types is None:
+        provider_types = Provider.ProviderChoices.values
+    provider_types = list(provider_types)
+
+    COMPLIANCE_WARMING_STARTED.set()
+    logger.info("Compliance cache warm-up started for providers: %s", provider_types)
+
+    failed = []
+    for provider_type in provider_types:
+        try:
+            get_compliance_frameworks(provider_type)
+            _ensure_provider_loaded(provider_type)
+        # Prowler check loading may sys.exit (SystemExit, not Exception).
+        except (Exception, SystemExit):
+            logger.warning(
+                "Failed to warm compliance caches for provider '%s'; "
+                "loading lazily on first request",
+                provider_type,
+                exc_info=True,
+            )
+            failed.append(provider_type)
+
+    # Mark as warmed even when some providers failed: a failed provider falls
+    # back to a single-provider lazy load, which stays under the worker timeout.
+    COMPLIANCE_WARMED.set()
+    logger.info(
+        "Compliance cache warm-up finished (providers warmed: %d, failed: %s)",
+        len(provider_types) - len(failed),
+        failed,
+    )
+    return failed
+
+
 def load_prowler_checks(
     prowler_compliance, provider_types: Iterable[str] | None = None
 ):
diff --git a/api/src/backend/api/exceptions.py b/api/src/backend/api/exceptions.py
index 78f8c64c7d..4f6f26c2ea 100644
--- a/api/src/backend/api/exceptions.py
+++ b/api/src/backend/api/exceptions.py
@@ -187,6 +187,32 @@ class UpstreamServiceUnavailableError(APIException):
         )
 
 
+class ComplianceWarmingError(APIException):
+    """Compliance catalog is still warming (503 Service Unavailable).
+
+    Returned by the compliance attributes endpoint while the per-process
+    catalog warm-up is in progress, so the request thread never triggers the
+    slow cold load that would trip the Gunicorn worker timeout.
+    """
+
+    status_code = status.HTTP_503_SERVICE_UNAVAILABLE
+    default_detail = (
+        "Compliance data is still loading. Please try again in a few seconds."
+    )
+    default_code = "compliance_warming"
+
+    def __init__(self, detail=None):
+        super().__init__(
+            detail=[
+                {
+                    "detail": detail or self.default_detail,
+                    "status": str(self.status_code),
+                    "code": self.default_code,
+                }
+            ]
+        )
+
+
 class UpstreamInternalError(APIException):
     """Unexpected error communicating with provider (500 Internal Server Error).
 
diff --git a/api/src/backend/api/tests/test_compliance.py b/api/src/backend/api/tests/test_compliance.py
index 508e5abaca..99a31ea12c 100644
--- a/api/src/backend/api/tests/test_compliance.py
+++ b/api/src/backend/api/tests/test_compliance.py
@@ -10,6 +10,7 @@ from api.compliance import (
     get_prowler_provider_checks,
     get_prowler_provider_compliance,
     load_prowler_checks,
+    warm_compliance_caches,
 )
 from api.models import Provider
 from prowler.lib.check.compliance_models import (
@@ -267,11 +268,17 @@ def reset_compliance_cache():
     """Reset the module-level cache so each test starts cold."""
     previous = dict(compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS)
     compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS.clear()
+    # The warming flags are module-global; clear them so they do not leak
+    # between tests that call warm_compliance_caches.
+    compliance_module.COMPLIANCE_WARMING_STARTED.clear()
+    compliance_module.COMPLIANCE_WARMED.clear()
     try:
         yield
     finally:
         compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS.clear()
         compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS.update(previous)
+        compliance_module.COMPLIANCE_WARMING_STARTED.clear()
+        compliance_module.COMPLIANCE_WARMED.clear()
 
 
 class TestGetComplianceFrameworks:
@@ -321,3 +328,89 @@ class TestGetComplianceFrameworks:
             f"loadable by get_bulk_compliance_frameworks_universal: "
             f"{sorted(missing)}"
         )
+
+
+class TestWarmComplianceCaches:
+    def test_warms_all_provider_types_by_default(self, reset_compliance_cache):
+        provider_types = list(Provider.ProviderChoices.values)
+        with (
+            patch("api.compliance.get_compliance_frameworks") as mock_frameworks,
+            patch("api.compliance._ensure_provider_loaded") as mock_ensure,
+        ):
+            warm_compliance_caches()
+
+        warmed = {call.args[0] for call in mock_frameworks.call_args_list}
+        assert warmed == set(provider_types)
+        assert mock_frameworks.call_count == len(provider_types)
+        assert mock_ensure.call_count == len(provider_types)
+
+    def test_warms_only_requested_provider_types(self, reset_compliance_cache):
+        with (
+            patch("api.compliance.get_compliance_frameworks") as mock_frameworks,
+            patch("api.compliance._ensure_provider_loaded") as mock_ensure,
+        ):
+            warm_compliance_caches([Provider.ProviderChoices.AWS])
+
+        mock_frameworks.assert_called_once_with(Provider.ProviderChoices.AWS)
+        mock_ensure.assert_called_once_with(Provider.ProviderChoices.AWS)
+
+    def test_populates_module_cache(self, reset_compliance_cache):
+        with (
+            patch(
+                "api.compliance.get_bulk_compliance_frameworks_universal"
+            ) as mock_get_bulk,
+            patch("api.compliance._ensure_provider_loaded"),
+        ):
+            mock_get_bulk.return_value = {"cis_1.4_aws": MagicMock()}
+            warm_compliance_caches([Provider.ProviderChoices.AWS])
+
+        assert (
+            Provider.ProviderChoices.AWS
+            in compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS
+        )
+
+    def test_failing_provider_does_not_abort_the_rest(self, reset_compliance_cache):
+        """A failing provider (even on SystemExit) is isolated; others warm."""
+        providers = [Provider.ProviderChoices.AWS, Provider.ProviderChoices.OKTA]
+
+        def fake_frameworks(provider_type):
+            if provider_type == Provider.ProviderChoices.OKTA:
+                raise SystemExit(1)
+            return []
+
+        with (
+            patch(
+                "api.compliance.get_compliance_frameworks", side_effect=fake_frameworks
+            ),
+            patch("api.compliance._ensure_provider_loaded") as mock_ensure,
+        ):
+            failed = warm_compliance_caches(providers)
+
+        assert failed == [Provider.ProviderChoices.OKTA]
+        mock_ensure.assert_called_once_with(Provider.ProviderChoices.AWS)
+
+    def test_sets_readiness_flags(self, reset_compliance_cache):
+        assert not compliance_module.COMPLIANCE_WARMING_STARTED.is_set()
+        assert not compliance_module.COMPLIANCE_WARMED.is_set()
+
+        with (
+            patch("api.compliance.get_compliance_frameworks"),
+            patch("api.compliance._ensure_provider_loaded"),
+        ):
+            warm_compliance_caches([Provider.ProviderChoices.AWS])
+
+        assert compliance_module.COMPLIANCE_WARMING_STARTED.is_set()
+        assert compliance_module.COMPLIANCE_WARMED.is_set()
+
+    def test_marks_warmed_even_when_a_provider_fails(self, reset_compliance_cache):
+        """A failed provider still leaves the caches flagged as warmed."""
+        with (
+            patch(
+                "api.compliance.get_compliance_frameworks",
+                side_effect=SystemExit(1),
+            ),
+            patch("api.compliance._ensure_provider_loaded"),
+        ):
+            warm_compliance_caches([Provider.ProviderChoices.AWS])
+
+        assert compliance_module.COMPLIANCE_WARMED.is_set()
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index d213e8c855..ab90bdbde0 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -9578,6 +9578,39 @@ class TestComplianceOverviewViewSet:
         )
         assert response.status_code == status.HTTP_400_BAD_REQUEST
 
+    def test_compliance_overview_attributes_503_while_warming(
+        self, authenticated_client
+    ):
+        from api.compliance import COMPLIANCE_WARMED, COMPLIANCE_WARMING_STARTED
+
+        COMPLIANCE_WARMING_STARTED.set()
+        COMPLIANCE_WARMED.clear()
+        try:
+            response = authenticated_client.get(
+                reverse("complianceoverview-attributes"),
+                {"filter[compliance_id]": "aws_account_security_onboarding_aws"},
+            )
+        finally:
+            COMPLIANCE_WARMING_STARTED.clear()
+
+        assert response.status_code == status.HTTP_503_SERVICE_UNAVAILABLE
+        assert response.json()["errors"][0]["code"] == "compliance_warming"
+
+    def test_compliance_overview_attributes_serves_when_warming_not_started(
+        self, authenticated_client
+    ):
+        # Dev fallback: under runserver warming never runs, so the guard must
+        # not refuse — the endpoint lazily loads and serves as before.
+        from api.compliance import COMPLIANCE_WARMED, COMPLIANCE_WARMING_STARTED
+
+        COMPLIANCE_WARMING_STARTED.clear()
+        COMPLIANCE_WARMED.clear()
+        response = authenticated_client.get(
+            reverse("complianceoverview-attributes"),
+            {"filter[compliance_id]": "aws_account_security_onboarding_aws"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+
     def test_compliance_overview_task_management_integration(
         self, authenticated_client, compliance_requirements_overviews_fixture
     ):
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 9c91c3201f..45100f1018 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -114,6 +114,8 @@ from api.attack_paths import get_queries_for_provider, get_query_by_id
 from api.attack_paths import views_helpers as attack_paths_views_helpers
 from api.base_views import BaseRLSViewSet, BaseTenantViewset, BaseUserViewset
 from api.compliance import (
+    COMPLIANCE_WARMED,
+    COMPLIANCE_WARMING_STARTED,
     PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE,
     get_compliance_frameworks,
     get_prowler_provider_compliance,
@@ -122,6 +124,7 @@ from api.constants import SEVERITY_ORDER
 from api.db_router import MainRouter
 from api.db_utils import rls_transaction
 from api.exceptions import (
+    ComplianceWarmingError,
     TaskFailedException,
     UpstreamAccessDeniedError,
     UpstreamAuthenticationError,
@@ -5059,6 +5062,13 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
     @action(detail=False, methods=["get"], url_name="attributes")
     def attributes(self, request):
+        # While the background warm-up is in progress, refuse immediately
+        # instead of falling through to the slow cold load on the request
+        # thread (which would trip the Gunicorn worker timeout). `is_set()` is
+        # a non-blocking flag read, so this never touches the loader.
+        if COMPLIANCE_WARMING_STARTED.is_set() and not COMPLIANCE_WARMED.is_set():
+            raise ComplianceWarmingError()
+
         compliance_id = request.query_params.get("filter[compliance_id]")
         if not compliance_id:
             raise ValidationError(
diff --git a/api/src/backend/config/guniconf.py b/api/src/backend/config/guniconf.py
index 536fd97abb..a16c8de9a0 100644
--- a/api/src/backend/config/guniconf.py
+++ b/api/src/backend/config/guniconf.py
@@ -1,6 +1,7 @@
 import logging
 import multiprocessing
 import os
+import threading
 
 from config.env import env
 
@@ -11,6 +12,7 @@ os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.django.production")
 import django  # noqa: E402
 
 django.setup()
+from api.compliance import warm_compliance_caches  # noqa: E402
 from config.django.production import LOGGING as DJANGO_LOGGERS, DEBUG  # noqa: E402
 from config.custom_logging import BackendLogger  # noqa: E402
 
@@ -41,3 +43,26 @@ def on_reload(_):
 
 def when_ready(_):
     gunicorn_logger.info("Gunicorn server is ready")
+
+
+def _warm_compliance_caches_in_background():
+    """Warm compliance caches off the request path and log the outcome."""
+    failed = warm_compliance_caches()
+    if failed:
+        gunicorn_logger.warning("Compliance caches warmed (skipped: %s)", failed)
+    else:
+        gunicorn_logger.info("Compliance caches warmed")
+
+
+def post_fork(_server, worker):
+    """Warm compliance caches after each worker fork.
+
+    Warm compliance caches in a background thread so the worker becomes ready
+    immediately. A request for a not-yet-warmed provider lazily loads just that
+    provider, which stays well under the worker timeout.
+    """
+    threading.Thread(
+        target=_warm_compliance_caches_in_background,
+        name="warm-compliance-caches",
+        daemon=True,
+    ).start()
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index dc8c0fa708..57d0427dc9 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -12,6 +12,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 ### 🔄 Changed
 
 - Renamed "Customer Support" to "Support Desk" in the side menu, showing it only in Prowler Cloud/Enterprise, while "Community Support" now shows only in Prowler OSS [(#11508)](https://github.com/prowler-cloud/prowler/pull/11508)
+- Compliance detail page now shows a "still loading" retry state while the API warms its compliance catalog, instead of rendering an empty page [(#4554)](https://github.com/prowler-cloud/prowler-cloud/pull/4554)
 
 ---
 
diff --git a/ui/actions/compliances/compliances.ts b/ui/actions/compliances/compliances.ts
index d5f4fd4954..58e7c5b5a0 100644
--- a/ui/actions/compliances/compliances.ts
+++ b/ui/actions/compliances/compliances.ts
@@ -84,6 +84,13 @@ export const getComplianceAttributes = async (complianceId: string) => {
       headers,
     });
 
+    // The compliance catalog is still warming after a deploy/restart. Signal
+    // the page to render the "still loading" state instead of letting this
+    // become a thrown 5xx (which would be captured as a server error).
+    if (response.status === 503) {
+      return { warming: true as const, status: 503 };
+    }
+
     return handleApiResponse(response);
   } catch (error) {
     console.error("Error fetching compliance attributes:", error);
diff --git a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
index 71e7870f8d..445710e48f 100644
--- a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
+++ b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
@@ -13,6 +13,7 @@ import {
   ClientAccordionWrapper,
   ComplianceDownloadContainer,
   ComplianceHeader,
+  ComplianceWarming,
   RequirementsStatusCard,
   RequirementsStatusCardSkeleton,
   // SectionsFailureRateCard,
@@ -92,6 +93,16 @@ export default async function ComplianceDetail({
         : Promise.resolve(null),
     ]);
 
+  // The compliance catalog is still warming after a deploy/restart. Show the
+  // "still loading" state with a Try Again instead of rendering an empty page.
+  if (attributesData?.warming) {
+    return (
+      <ContentLayout title={pageTitle}>
+        <ComplianceWarming />
+      </ContentLayout>
+    );
+  }
+
   if (selectedScanResponse?.data) {
     const scan = selectedScanResponse.data;
     const providerId = scan.relationships?.provider?.data?.id;
diff --git a/ui/components/compliance/compliance-warming.tsx b/ui/components/compliance/compliance-warming.tsx
new file mode 100644
index 0000000000..19864ae121
--- /dev/null
+++ b/ui/components/compliance/compliance-warming.tsx
@@ -0,0 +1,49 @@
+"use client";
+
+import { Icon } from "@iconify/react";
+import { useRouter } from "next/navigation";
+
+import { Button } from "@/components/shadcn/button/button";
+import { Card, CardContent } from "@/components/shadcn/card/card";
+
+export const ComplianceWarming = () => {
+  const router = useRouter();
+
+  return (
+    <div className="flex h-full min-h-[calc(100vh-56px)] items-center justify-center">
+      <div className="mx-auto w-full max-w-2xl">
+        <Card variant="base" padding="lg">
+          <CardContent>
+            <div className="flex w-full items-center justify-between gap-6">
+              <div className="flex items-start gap-4">
+                <Icon
+                  icon="tabler:clock"
+                  className="mt-1 h-5 w-5 text-gray-400 dark:text-gray-300"
+                />
+                <div>
+                  <h2 className="mb-1 text-base font-medium text-gray-900 dark:text-white">
+                    Compliance data is still loading
+                  </h2>
+                  <p className="text-sm text-gray-500 dark:text-gray-300">
+                    This can happen for a few seconds right after an update.
+                    Please try again shortly.
+                  </p>
+                </div>
+              </div>
+              <Button
+                variant="secondary"
+                size="sm"
+                className="shrink-0 gap-2"
+                onClick={() => router.refresh()}
+                aria-label="Reload compliance data"
+              >
+                <Icon icon="tabler:refresh" className="h-4 w-4" />
+                Try Again
+              </Button>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    </div>
+  );
+};
diff --git a/ui/components/compliance/index.ts b/ui/components/compliance/index.ts
index e0bd631200..caea32e264 100644
--- a/ui/components/compliance/index.ts
+++ b/ui/components/compliance/index.ts
@@ -19,6 +19,7 @@ export * from "./compliance-header/compliance-scan-info";
 export * from "./compliance-header/data-compliance";
 export * from "./compliance-header/scan-selector";
 export * from "./compliance-overview-grid";
+export * from "./compliance-warming";
 export * from "./no-scans-available";
 export * from "./skeletons/bar-chart-skeleton";
 export * from "./skeletons/compliance-accordion-skeleton";

From 989c3b174e9c58a58e6cdb60a7ac93b87aa4c59c Mon Sep 17 00:00:00 2001
From: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com>
Date: Thu, 11 Jun 2026 08:31:08 +0200
Subject: [PATCH 011/126] fix(bedrock): per-finding severity for long-term API
 key check (#11526)

---
 prowler/CHANGELOG.md                          |   1 +
 ...key_no_long_term_credentials.metadata.json |  19 +-
 ...edrock_api_key_no_long_term_credentials.py |  81 ++-
 ...k_api_key_no_long_term_credentials_test.py | 593 +++++-------------
 4 files changed, 220 insertions(+), 474 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index cd6db78f37..96ccb4bb29 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -30,6 +30,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - M365 Admin Center group enumeration now follows Microsoft Graph pagination so group-scoped checks include groups beyond the first page [(#11510)](https://github.com/prowler-cloud/prowler/pull/11510)
 - GCP `kms_key_rotation_enabled` check now only verifies that automatic key rotation is enabled (any interval) instead of enforcing a 90-day period, resolving the mismatch between the check and its documentation; the CIS, Prowler ThreatScore, and CCC requirements that mandate a 90-day maximum were remapped to the new `kms_key_rotation_max_90_days` check [(#11516)](https://github.com/prowler-cloud/prowler/pull/11516)
 - AWS CloudWatch log metric filter checks now validate `filterPattern` clauses regardless of order [(#11345)](https://github.com/prowler-cloud/prowler/pull/11345)
+- AWS `bedrock_api_key_no_long_term_credentials` now applies severity per finding (never-expires keys correctly flag as critical, no leak across findings) and aligns title and wording with AWS guidance to prefer short-term Bedrock API keys [(#11526)](https://github.com/prowler-cloud/prowler/pull/11526)
 
 ---
 
diff --git a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json
index f9b8ee0df9..c85279e4a4 100644
--- a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json
+++ b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.metadata.json
@@ -1,7 +1,7 @@
 {
   "Provider": "aws",
   "CheckID": "bedrock_api_key_no_long_term_credentials",
-  "CheckTitle": "Amazon Bedrock API key is expired",
+  "CheckTitle": "Amazon Bedrock long-term API key has expired",
   "CheckType": [
     "Software and Configuration Checks/AWS Security Best Practices",
     "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices",
@@ -14,23 +14,24 @@
   "Severity": "high",
   "ResourceType": "AwsIamUser",
   "ResourceGroup": "IAM",
-  "Description": "**Bedrock API keys** are evaluated for **lifetime** and **expiration**.\n\nThe finding identifies keys that are long-lived, set to expire far in the future, or configured to `never expire`, and distinguishes them from keys that have already expired.",
-  "Risk": "Long-lived or non-expiring keys enable persistent access if compromised.\n- Confidentiality: unauthorized inference and exposure of prompts/outputs\n- Availability/Cost: uncontrolled usage and spend spikes\n- Integrity: actions can continue without timely revocation or rotation",
+  "Description": "AWS recommends Amazon Bedrock **long-term API keys** only for **exploration**; production workloads should use **short-term API keys** (session-scoped, valid up to **12 hours**). This check fails for any active long-term Bedrock API key, escalating to `critical` severity when configured to **never expire**. Already-expired keys pass — they can no longer authenticate.",
+  "Risk": "Long-term Bedrock API keys persist beyond a session until their stored expiration, and keys set to **never expire** grant indefinite access until manually revoked, enabling unauthorized inference, uncontrolled usage and spend, and activity that continues past timely revocation.",
   "RelatedUrl": "",
   "AdditionalURLs": [
-    "https://docs.aws.amazon.com/ja_jp/bedrock/latest/userguide/getting-started-api-keys.html",
-    "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials",
-    "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html"
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys.html",
+    "https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-generate.html",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/security-creds-programmatic-access.html#security-creds-alternatives-to-long-term-access-keys",
+    "https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#rotate-credentials"
   ],
   "Remediation": {
     "Code": {
       "CLI": "aws iam delete-service-specific-credential --user-name <username> --service-specific-credential-id <credential-id>",
       "NativeIaC": "",
-      "Other": "1. Sign in to the AWS Management Console and open IAM\n2. Go to Users > select <example_resource_name> > Security credentials\n3. In \"API keys for Amazon Bedrock\", find the non-expired key and click Delete\n4. Confirm deletion to remove the key (removes the long-term credential so the check passes)",
+      "Other": "1. Sign in to the AWS Management Console and open IAM\n2. Go to Users > select the IAM user backing the Bedrock API key > Security credentials\n3. In \"API keys for Amazon Bedrock\", select the active long-term key and click Delete\n4. For workloads that still need Bedrock access, generate a short-term API key from the Bedrock console (Short-term API keys tab), or call the Bedrock API with short-term credentials issued by AWS STS",
       "Terraform": ""
     },
     "Recommendation": {
-      "Text": "Prefer **short-term credentials** and **IAM roles**; avoid `never expire`.\n\nEnforce **least privilege**, strict **rotation**, and automatic **expiration** for any long-term key. Store secrets securely, monitor with audit logs, and revoke unused or stale keys quickly.",
+      "Text": "Use short-term Amazon Bedrock API keys for any non-exploratory workload — they are bound to the IAM principal's session, valid for at most 12 hours, scoped to a single Region, and can be auto-refreshed by the SDK. For existing long-term keys, delete the underlying IAM service-specific credential. If a long-term key must be retained for an exploration scenario, set an explicit short expiration and never select `never expire`.",
       "Url": "https://hub.prowler.com/check/bedrock_api_key_no_long_term_credentials"
     }
   },
@@ -40,5 +41,5 @@
   ],
   "DependsOn": [],
   "RelatedTo": [],
-  "Notes": "This check verifies that Amazon Bedrock API keys have expiration dates set. API keys without expiration dates are considered long-term credentials and pose a security risk. The check follows security best practices for credential management and the principle of least privilege."
+  "Notes": "AWS recommends against using long-term Amazon Bedrock API keys outside of exploration; production workloads should use short-term API keys (session-scoped, valid up to 12 hours). The IAM `ListServiceSpecificCredentials` API only enumerates long-term keys — short-term keys are session-scoped credentials that never appear here. The check therefore passes only when an existing long-term key has already expired and can no longer authenticate; any active long-term key fails, with critical severity when it is configured to never expire."
 }
diff --git a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.py b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.py
index 2edffd7ccb..9697ecbff0 100644
--- a/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.py
+++ b/prowler/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials.py
@@ -1,49 +1,62 @@
 from datetime import datetime, timezone
 
-from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.lib.check.models import Check, Check_Report_AWS, Severity
 from prowler.providers.aws.services.iam.iam_client import iam_client
 
+# Days threshold above which a Bedrock long-term API key is considered effectively non-expiring.
+NEVER_EXPIRES_THRESHOLD_DAYS = 10000
+
 
 class bedrock_api_key_no_long_term_credentials(Check):
-    """
-    Bedrock API keys should be short-lived to reduce the risk of unauthorized access.
-    This check verifies if there are any long-term Bedrock API keys.
-    If there are, it checks if they are expired or will be expired.
-    If they are expired, it will be marked as PASS.
-    If they are not expired, it will be marked as FAIL and the severity will be critical if the key will never expire.
+    """Amazon Bedrock long-term API keys should not be used outside of exploration.
+
+    AWS recommends short-term Bedrock API keys (session-scoped, valid up to 12 hours)
+    for any non-exploratory workload. ``ListServiceSpecificCredentials`` only enumerates
+    long-term keys, so every key inspected here is by definition a long-term credential.
+
+    PASS when the long-term key has already expired (it can no longer authenticate).
+    FAIL (critical) when the key is configured to never expire.
+    FAIL (high) for any other active long-term key.
     """
 
     def execute(self):
-        """
-        Execute the Bedrock API key no long-term credentials check.
-
-        Iterate over all the Bedrock API keys and check if they are expired or will be expired.
-
-        Returns:
-            List[Check_Report_AWS]: A list of report objects with the results of the check.
-        """
-
         findings = []
         for api_key in iam_client.service_specific_credentials:
             if api_key.service_name != "bedrock.amazonaws.com":
                 continue
-            if api_key.expiration_date:
-                report = Check_Report_AWS(metadata=self.metadata(), resource=api_key)
-                # Check if the expiration date is in the future
-                if api_key.expiration_date > datetime.now(timezone.utc):
-                    report.status = "FAIL"
-                    # Get the days until the expiration date
-                    days_until_expiration = (
-                        api_key.expiration_date - datetime.now(timezone.utc)
-                    ).days
-                    if days_until_expiration > 10000:
-                        self.Severity = "critical"
-                        report.status_extended = f"Long-term Bedrock API key {api_key.id} in user {api_key.user.name} exists and never expires."
-                    else:
-                        report.status_extended = f"Long-term Bedrock API key {api_key.id} in user {api_key.user.name} exists and will expire in {days_until_expiration} days."
-                else:
-                    report.status = "PASS"
-                    report.status_extended = f"Long-term Bedrock API key {api_key.id} in user {api_key.user.name} exists but has expired."
-                findings.append(report)
+            if not api_key.expiration_date:
+                continue
+
+            report = Check_Report_AWS(metadata=self.metadata(), resource=api_key)
+            now = datetime.now(timezone.utc)
+
+            if api_key.expiration_date <= now:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Bedrock long-term API key {api_key.id} in user "
+                    f"{api_key.user.name} has already expired and can no longer "
+                    f"authenticate."
+                )
+            elif (api_key.expiration_date - now).days > NEVER_EXPIRES_THRESHOLD_DAYS:
+                report.status = "FAIL"
+                report.check_metadata.Severity = Severity.critical
+                report.status_extended = (
+                    f"Bedrock long-term API key {api_key.id} in user "
+                    f"{api_key.user.name} is configured to never expire. Use "
+                    f"short-term Bedrock API keys (session-scoped, valid up to "
+                    f"12 hours) for non-exploratory workloads instead."
+                )
+            else:
+                days_until_expiration = (api_key.expiration_date - now).days
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Bedrock long-term API key {api_key.id} in user "
+                    f"{api_key.user.name} is active and will expire in "
+                    f"{days_until_expiration} days. Use short-term Bedrock API "
+                    f"keys (session-scoped, valid up to 12 hours) for "
+                    f"non-exploratory workloads instead."
+                )
+
+            findings.append(report)
 
         return findings
diff --git a/tests/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials_test.py b/tests/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials_test.py
index bf4f6381b9..d75d248c7c 100644
--- a/tests/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials_test.py
+++ b/tests/providers/aws/services/bedrock/bedrock_api_key_no_long_term_credentials/bedrock_api_key_no_long_term_credentials_test.py
@@ -3,466 +3,197 @@ from unittest import mock
 
 from moto import mock_aws
 
+from prowler.lib.check.models import Severity
 from tests.providers.aws.utils import AWS_REGION_US_EAST_1, set_mocked_aws_provider
 
+BEDROCK_SERVICE = "bedrock.amazonaws.com"
+
+
+def _make_user(name="test_user"):
+    from prowler.providers.aws.services.iam.iam_service import User
+
+    return User(
+        name=name,
+        arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/{name}",
+        attached_policies=[],
+        inline_policies=[],
+    )
+
+
+def _make_credential(
+    user,
+    credential_id="test-credential-id",
+    expiration_delta_days=None,
+    service_name=BEDROCK_SERVICE,
+):
+    from prowler.providers.aws.services.iam.iam_service import ServiceSpecificCredential
+
+    expiration_date = (
+        datetime.now(timezone.utc) + timedelta(days=expiration_delta_days)
+        if expiration_delta_days is not None
+        else None
+    )
+    return ServiceSpecificCredential(
+        arn=(
+            f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/{user.name}/"
+            f"credential/{credential_id}"
+        ),
+        user=user,
+        status="Active",
+        create_date=datetime.now(timezone.utc),
+        service_user_name=None,
+        service_credential_alias=None,
+        expiration_date=expiration_date,
+        id=credential_id,
+        service_name=service_name,
+        region=AWS_REGION_US_EAST_1,
+    )
+
+
+def _run_check(credentials):
+    from prowler.providers.aws.services.iam.iam_service import IAM
+
+    aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+    iam = IAM(aws_provider)
+    iam.service_specific_credentials = credentials
+
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ),
+        mock.patch(
+            "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
+            new=iam,
+        ),
+    ):
+        from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
+            bedrock_api_key_no_long_term_credentials,
+        )
+
+        check = bedrock_api_key_no_long_term_credentials()
+        return check.execute()
+
 
 class Test_bedrock_api_key_no_long_term_credentials:
     @mock_aws
     def test_no_bedrock_api_keys(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
-
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=IAM(aws_provider),
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 0
+        assert _run_check([]) == []
 
     @mock_aws
-    def test_bedrock_api_key_with_future_expiration_date(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
+    def test_active_short_expiration_key_fails_high(self):
+        # Per AWS guidance, every active long-term key is a finding regardless of
+        # how soon it expires. Short remaining lifetime does not downgrade severity.
+        credential = _make_credential(_make_user(), expiration_delta_days=30)
+        result = _run_check([credential])
 
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential with future expiration date
-        expiration_date = datetime.now(timezone.utc) + timedelta(days=30)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date,
-            id="test-credential-id",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert "will expire in" in result[0].status_extended
-            assert "test-credential-id" in result[0].status_extended
-            assert "test_user" in result[0].status_extended
-            assert result[0].resource_id == "test-credential-id"
-            assert result[0].region == AWS_REGION_US_EAST_1
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert result[0].check_metadata.Severity == Severity.high
+        assert "is active and will expire in" in result[0].status_extended
+        assert "short-term Bedrock API keys" in result[0].status_extended
 
     @mock_aws
-    def test_bedrock_api_key_with_critical_expiration_date(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
+    def test_active_long_expiration_key_fails_high(self):
+        credential = _make_credential(_make_user(), expiration_delta_days=365)
+        result = _run_check([credential])
 
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential with very far future expiration date (>10000 days)
-        expiration_date = datetime.now(timezone.utc) + timedelta(days=15000)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date,
-            id="test-credential-id",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 1
-            assert result[0].status == "FAIL"
-            assert "never expires" in result[0].status_extended
-            assert "test-credential-id" in result[0].status_extended
-            assert "test_user" in result[0].status_extended
-            assert result[0].resource_id == "test-credential-id"
-            assert result[0].region == AWS_REGION_US_EAST_1
-            assert check.Severity == "critical"
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert result[0].check_metadata.Severity == Severity.high
+        assert "is active and will expire in" in result[0].status_extended
 
     @mock_aws
-    def test_bedrock_api_key_with_expired_date(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
+    def test_never_expires_key_fails_critical(self):
+        # >10000 days approximates AWS's "no expiration" sentinel (~100 years).
+        credential = _make_credential(_make_user(), expiration_delta_days=15000)
+        result = _run_check([credential])
 
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential with past expiration date
-        expiration_date = datetime.now(timezone.utc) - timedelta(days=30)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date,
-            id="test-credential-id",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 1
-            assert result[0].status == "PASS"
-            assert "has expired" in result[0].status_extended
-            assert "test-credential-id" in result[0].status_extended
-            assert "test_user" in result[0].status_extended
-            assert result[0].resource_id == "test-credential-id"
-            assert result[0].region == AWS_REGION_US_EAST_1
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert result[0].check_metadata.Severity == Severity.critical
+        assert "configured to never expire" in result[0].status_extended
+        assert "short-term Bedrock API keys" in result[0].status_extended
 
     @mock_aws
-    def test_bedrock_api_key_without_expiration_date_ignored(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
+    def test_already_expired_key_passes(self):
+        credential = _make_credential(_make_user(), expiration_delta_days=-30)
+        result = _run_check([credential])
 
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential without expiration date (should be ignored)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=None,  # No expiration date - should be ignored
-            id="test-credential-id",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 0
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert "has already expired" in result[0].status_extended
 
     @mock_aws
-    def test_non_bedrock_api_key_ignored(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
-
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
-        )
-
-        # Create a mock user
-        mock_user = User(
-            name="test_user",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential for a different service
-        expiration_date = datetime.now(timezone.utc) + timedelta(days=30)
-        mock_credential = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user/credential/test-credential-id",
-            user=mock_user,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date,
-            id="test-credential-id",
-            service_name="codecommit.amazonaws.com",  # Different service
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [mock_credential]
-
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
-            ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
-            ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
-
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
-
-            assert len(result) == 0
+    def test_key_without_expiration_date_ignored(self):
+        credential = _make_credential(_make_user(), expiration_delta_days=None)
+        assert _run_check([credential]) == []
 
     @mock_aws
-    def test_multiple_bedrock_api_keys_mixed_scenarios(self):
-        from prowler.providers.aws.services.iam.iam_service import IAM
-
-        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
-        iam = IAM(aws_provider)
-
-        # Mock service-specific credentials
-        from prowler.providers.aws.services.iam.iam_service import (
-            ServiceSpecificCredential,
-            User,
+    def test_non_bedrock_service_ignored(self):
+        credential = _make_credential(
+            _make_user(),
+            expiration_delta_days=30,
+            service_name="codecommit.amazonaws.com",
         )
+        assert _run_check([credential]) == []
 
-        # Create mock users
-        mock_user1 = User(
-            name="test_user1",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user1",
-            attached_policies=[],
-            inline_policies=[],
+    @mock_aws
+    def test_mixed_scenarios(self):
+        user1, user2, user3 = (
+            _make_user("u1"),
+            _make_user("u2"),
+            _make_user("u3"),
         )
-
-        mock_user2 = User(
-            name="test_user2",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user2",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        mock_user3 = User(
-            name="test_user3",
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user3",
-            attached_policies=[],
-            inline_policies=[],
-        )
-
-        # Create a mock service-specific credential with future expiration date
-        expiration_date1 = datetime.now(timezone.utc) + timedelta(days=30)
-        mock_credential1 = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user1/credential/test-credential-id-1",
-            user=mock_user1,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date1,
-            id="test-credential-id-1",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        # Create a mock service-specific credential with critical expiration date
-        expiration_date2 = datetime.now(timezone.utc) + timedelta(days=15000)
-        mock_credential2 = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user2/credential/test-credential-id-2",
-            user=mock_user2,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date2,
-            id="test-credential-id-2",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        # Create a mock service-specific credential with expired date
-        expiration_date3 = datetime.now(timezone.utc) - timedelta(days=30)
-        mock_credential3 = ServiceSpecificCredential(
-            arn=f"arn:aws:iam:{AWS_REGION_US_EAST_1}:123456789012:user/test_user3/credential/test-credential-id-3",
-            user=mock_user3,
-            status="Active",
-            create_date=datetime.now(timezone.utc),
-            service_user_name=None,
-            service_credential_alias=None,
-            expiration_date=expiration_date3,
-            id="test-credential-id-3",
-            service_name="bedrock.amazonaws.com",
-            region=AWS_REGION_US_EAST_1,
-        )
-
-        iam.service_specific_credentials = [
-            mock_credential1,
-            mock_credential2,
-            mock_credential3,
+        credentials = [
+            _make_credential(user1, "active-key", expiration_delta_days=191),
+            _make_credential(user2, "never-key", expiration_delta_days=15000),
+            _make_credential(user3, "expired-key", expiration_delta_days=-30),
         ]
+        result = _run_check(credentials)
 
-        with (
-            mock.patch(
-                "prowler.providers.common.provider.Provider.get_global_provider",
-                return_value=aws_provider,
+        assert len(result) == 3
+        by_id = {r.resource_id: r for r in result}
+
+        assert by_id["active-key"].status == "FAIL"
+        assert by_id["active-key"].check_metadata.Severity == Severity.high
+
+        assert by_id["never-key"].status == "FAIL"
+        assert by_id["never-key"].check_metadata.Severity == Severity.critical
+
+        assert by_id["expired-key"].status == "PASS"
+
+    @mock_aws
+    def test_severity_does_not_leak_never_then_active(self):
+        """Regression: a never-expires key processed before an active key must
+        not bleed `critical` severity into the active finding."""
+        credentials = [
+            _make_credential(
+                _make_user("u-never"), "never-key", expiration_delta_days=15000
             ),
-            mock.patch(
-                "prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials.iam_client",
-                new=iam,
+            _make_credential(
+                _make_user("u-active"), "active-key", expiration_delta_days=191
             ),
-        ):
-            from prowler.providers.aws.services.bedrock.bedrock_api_key_no_long_term_credentials.bedrock_api_key_no_long_term_credentials import (
-                bedrock_api_key_no_long_term_credentials,
-            )
+        ]
+        result = _run_check(credentials)
 
-            check = bedrock_api_key_no_long_term_credentials()
-            result = check.execute()
+        by_id = {r.resource_id: r for r in result}
+        assert by_id["never-key"].check_metadata.Severity == Severity.critical
+        assert by_id["active-key"].check_metadata.Severity == Severity.high
 
-            assert len(result) == 3
+    @mock_aws
+    def test_severity_does_not_leak_active_then_never(self):
+        """Regression: same as above with the reverse iteration order."""
+        credentials = [
+            _make_credential(
+                _make_user("u-active"), "active-key", expiration_delta_days=191
+            ),
+            _make_credential(
+                _make_user("u-never"), "never-key", expiration_delta_days=15000
+            ),
+        ]
+        result = _run_check(credentials)
 
-            # Check the credential with future expiration date (FAIL)
-            fail_result1 = next(
-                r for r in result if r.resource_id == "test-credential-id-1"
-            )
-            assert fail_result1.status == "FAIL"
-            assert "will expire in" in fail_result1.status_extended
-            assert "test-credential-id-1" in fail_result1.status_extended
-            assert "test_user1" in fail_result1.status_extended
-
-            # Check the credential with critical expiration date (FAIL)
-            fail_result2 = next(
-                r for r in result if r.resource_id == "test-credential-id-2"
-            )
-            assert fail_result2.status == "FAIL"
-            assert "never expires" in fail_result2.status_extended
-            assert "test-credential-id-2" in fail_result2.status_extended
-            assert "test_user2" in fail_result2.status_extended
-
-            # Check the credential with expired date (PASS)
-            pass_result = next(
-                r for r in result if r.resource_id == "test-credential-id-3"
-            )
-            assert pass_result.status == "PASS"
-            assert "has expired" in pass_result.status_extended
-            assert "test-credential-id-3" in pass_result.status_extended
-            assert "test_user3" in pass_result.status_extended
+        by_id = {r.resource_id: r for r in result}
+        assert by_id["active-key"].check_metadata.Severity == Severity.high
+        assert by_id["never-key"].check_metadata.Severity == Severity.critical

From 285974b7d4e6b497f2862bd37d3ac7709d1d515f Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Thu, 11 Jun 2026 09:08:25 +0200
Subject: [PATCH 012/126] chore(changelog): v5.30.0 (#11540)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com>
---
 api/CHANGELOG.md     |  6 +++---
 prowler/CHANGELOG.md | 10 +++++-----
 ui/CHANGELOG.md      |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 6759b28741..8f3585fd20 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
-## [1.31.0] (Prowler UNRELEASED)
+## [1.31.0] (Prowler v5.30.0)
 
 ### 🚀 Added
 
@@ -19,11 +19,11 @@ All notable changes to the **Prowler API** are documented in this file.
 
 - Workers now shut down gracefully on deploy or restart, finishing or re-queueing in-flight tasks instead of being force-killed and leaving them stuck [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
 - Resource `name` is now stored and refreshed on every scan, so resources no longer keep an empty name [(#11476)](https://github.com/prowler-cloud/prowler/pull/11476)
-- Compliance catalog now warms in a background thread after each worker forks, and `compliance-overviews/attributes` returns `503` while warming, so the first request after a deploy no longer trips the Gunicorn worker timeout [(#4554)](https://github.com/prowler-cloud/prowler-cloud/pull/4554)
+- Compliance catalog now warms in background during startup. `compliance-overviews/attributes` returns `503` while warming, so the first request after a deploy no longer trips the API timeout [(#4554)](https://github.com/prowler-cloud/prowler-cloud/pull/4554)
 
 ### 🔐 Security
 
-- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) flagged by osv-scanner in `api/uv.lock` [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
+- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
 
 ---
 
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 96ccb4bb29..bb206f5a96 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
-## [5.30.0] (Prowler UNRELEASED)
+## [5.30.0] (Prowler v5.30.0)
 
 ### 🚀 Added
 
@@ -32,6 +32,10 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - AWS CloudWatch log metric filter checks now validate `filterPattern` clauses regardless of order [(#11345)](https://github.com/prowler-cloud/prowler/pull/11345)
 - AWS `bedrock_api_key_no_long_term_credentials` now applies severity per finding (never-expires keys correctly flag as critical, no leak across findings) and aligns title and wording with AWS guidance to prefer short-term Bedrock API keys [(#11526)](https://github.com/prowler-cloud/prowler/pull/11526)
 
+### 🔐 Security
+
+- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
+
 ---
 
 ## [5.29.3] (Prowler v5.29.3)
@@ -43,10 +47,6 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Jira integration no longer fails with `400 INVALID_INPUT` when a finding has empty fields [(#11474)](https://github.com/prowler-cloud/prowler/pull/11474)
 - GCP `iam_service_account_unused` now passes disabled service accounts instead of failing them, since a disabled account cannot authenticate or be used [(#11467)](https://github.com/prowler-cloud/prowler/pull/11467)
 
-### 🔐 Security
-
-- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) flagged by osv-scanner [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
-
 ---
 
 ## [5.29.1] (Prowler v5.29.1)
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 57d0427dc9..2676778fef 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 All notable changes to the **Prowler UI** are documented in this file.
 
-## [1.30.0] (Prowler UNRELEASED)
+## [1.30.0] (Prowler v5.30.0)
 
 ### 🚀 Added
 

From f1d741214a60df17158c3fdc97804fd1fde64f3a Mon Sep 17 00:00:00 2001
From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
Date: Thu, 11 Jun 2026 09:44:17 +0200
Subject: [PATCH 013/126] fix(ui): adapt risk pipeline sankey layout (#11527)

---
 ui/CHANGELOG.md                               |  4 +
 .../graphs/sankey-chart.layout.test.ts        | 84 ++++++++++++++++
 ui/components/graphs/sankey-chart.layout.ts   | 70 +++++++++++++
 ui/components/graphs/sankey-chart.test.tsx    | 98 +++++++++++++++++++
 ui/components/graphs/sankey-chart.tsx         | 28 ++++--
 5 files changed, 277 insertions(+), 7 deletions(-)
 create mode 100644 ui/components/graphs/sankey-chart.layout.test.ts
 create mode 100644 ui/components/graphs/sankey-chart.layout.ts
 create mode 100644 ui/components/graphs/sankey-chart.test.tsx

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 2676778fef..67a0a59e5d 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -14,6 +14,10 @@ All notable changes to the **Prowler UI** are documented in this file.
 - Renamed "Customer Support" to "Support Desk" in the side menu, showing it only in Prowler Cloud/Enterprise, while "Community Support" now shows only in Prowler OSS [(#11508)](https://github.com/prowler-cloud/prowler/pull/11508)
 - Compliance detail page now shows a "still loading" retry state while the API warms its compliance catalog, instead of rendering an empty page [(#4554)](https://github.com/prowler-cloud/prowler-cloud/pull/4554)
 
+### 🐞 Fixed
+
+- Risk Pipeline Sankey chart now adapts height and node spacing for dense provider datasets, keeping provider and severity labels readable [(#11527)](https://github.com/prowler-cloud/prowler/pull/11527)
+
 ---
 
 ## [1.29.3] (Prowler v5.29.3)
diff --git a/ui/components/graphs/sankey-chart.layout.test.ts b/ui/components/graphs/sankey-chart.layout.test.ts
new file mode 100644
index 0000000000..95fe9b624e
--- /dev/null
+++ b/ui/components/graphs/sankey-chart.layout.test.ts
@@ -0,0 +1,84 @@
+import { describe, expect, it } from "vitest";
+
+import { getSankeyLayoutConfig } from "./sankey-chart.layout";
+
+describe("getSankeyLayoutConfig", () => {
+  it("keeps default size when provider count is at baseline", () => {
+    const config = getSankeyLayoutConfig({
+      baseHeight: 460,
+      nodes: [
+        { name: "AWS" },
+        { name: "High" },
+        { name: "Medium" },
+        { name: "Low" },
+        { name: "Azure" },
+        { name: "Info" },
+        { name: "GCP" },
+      ],
+      links: [{ source: 0 }, { source: 4 }, { source: 6 }],
+    });
+
+    expect(config).toEqual({
+      height: 460,
+      nodePadding: 50,
+    });
+  });
+
+  it("increases height and reduces node padding for denser graphs", () => {
+    const config = getSankeyLayoutConfig({
+      baseHeight: 460,
+      nodes: Array.from({ length: 24 }, (_, index) => ({
+        name: `Provider ${index}`,
+      })),
+      links: [
+        { source: 0 },
+        { source: 1 },
+        { source: 2 },
+        { source: 3 },
+        { source: 4 },
+        { source: 5 },
+        { source: 6 },
+        { source: 7 },
+        { source: 8 },
+        { source: 9 },
+        { source: 10 },
+        { source: 11 },
+      ],
+    });
+
+    expect(config).toEqual({
+      height: 844,
+      nodePadding: 38,
+    });
+  });
+
+  it("clamps padding to minimum when provider count is very large", () => {
+    const config = getSankeyLayoutConfig({
+      baseHeight: 460,
+      nodes: Array.from({ length: 120 }, (_, index) => ({
+        name: `Provider ${index}`,
+      })),
+      links: Array.from({ length: 100 }, (_, index) => ({
+        source: index,
+      })),
+    });
+
+    expect(config.nodePadding).toBe(14);
+    expect(config.height).toBe(1400);
+  });
+
+  it("falls back to node-based provider estimation when no link sources exist", () => {
+    const config = getSankeyLayoutConfig({
+      baseHeight: 460,
+      nodes: Array.from({ length: 8 }, (_, index) => ({
+        name: `Node ${index}`,
+      })),
+      links: [],
+    });
+
+    expect(config).toEqual({
+      height: 460,
+      nodePadding: 50,
+    });
+  });
+});
diff --git a/ui/components/graphs/sankey-chart.layout.ts b/ui/components/graphs/sankey-chart.layout.ts
new file mode 100644
index 0000000000..fd8ba39562
--- /dev/null
+++ b/ui/components/graphs/sankey-chart.layout.ts
@@ -0,0 +1,70 @@
+export interface SankeyNodeLike {
+  name: string;
+}
+
+export interface SankeyLinkLike {
+  source: number;
+}
+
+export interface SankeyLayoutInput {
+  baseHeight: number;
+  nodes: SankeyNodeLike[];
+  links: SankeyLinkLike[];
+}
+
+export interface SankeyLayoutConfig {
+  height: number;
+  nodePadding: number;
+}
+
+const SANKEY_DEFAULT_NODE_PADDING = 50;
+const SANKEY_MIN_NODE_PADDING = 14;
+const SANKEY_HEIGHT_GROWTH_PER_PROVIDER = 64;
+const SANKEY_BASE_PROVIDER_COUNT = 6;
+const SANKEY_MAX_HEIGHT = 1400;
+
+const getProviderNodeCount = ({ nodes, links }: SankeyLayoutInput): number => {
+  const uniqueSourceIndexes = new Set<number>();
+
+  links.forEach((link) => {
+    uniqueSourceIndexes.add(link.source);
+  });
+
+  if (uniqueSourceIndexes.size > 0) {
+    return uniqueSourceIndexes.size;
+  }
+
+  return Math.max(0, nodes.length - 5);
+};
+
+const getNodePaddingForProviderCount = (providerNodeCount: number): number => {
+  const compactedProviders = Math.max(
+    0,
+    providerNodeCount - SANKEY_BASE_PROVIDER_COUNT,
+  );
+  return Math.max(
+    SANKEY_MIN_NODE_PADDING,
+    Math.round(SANKEY_DEFAULT_NODE_PADDING - compactedProviders * 2),
+  );
+};
+
+export const getSankeyLayoutConfig = (
+  params: SankeyLayoutInput,
+): SankeyLayoutConfig => {
+  const providerNodeCount = getProviderNodeCount(params);
+  const extraProviders = Math.max(
+    0,
+    providerNodeCount - SANKEY_BASE_PROVIDER_COUNT,
+  );
+  const dynamicHeight = Math.min(
+    SANKEY_MAX_HEIGHT,
+    Math.round(
+      params.baseHeight + extraProviders * SANKEY_HEIGHT_GROWTH_PER_PROVIDER,
+    ),
+  );
+
+  return {
+    height: dynamicHeight,
+    nodePadding: getNodePaddingForProviderCount(providerNodeCount),
+  };
+};
diff --git a/ui/components/graphs/sankey-chart.test.tsx b/ui/components/graphs/sankey-chart.test.tsx
new file mode 100644
index 0000000000..48c9e01a04
--- /dev/null
+++ b/ui/components/graphs/sankey-chart.test.tsx
@@ -0,0 +1,98 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { CustomNode, SankeyChart } from "./sankey-chart";
+import { getSankeyLayoutConfig } from "./sankey-chart.layout";
+
+const mockPush = vi.fn();
+
+vi.mock("@/lib", () => ({
+  applyFailNonMutedFilters: (filters: unknown) => filters,
+}));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: mockPush }),
+  useSearchParams: () => new URLSearchParams(),
+}));
+
+describe("SankeyChart", () => {
+  it("uses layout-configured height for the empty-state container", () => {
+    const data = {
+      nodes: Array.from({ length: 14 }, (_, index) => ({
+        name: `Node ${index}`,
+      })),
+      links: Array.from({ length: 12 }, (_, index) => ({
+        source: index,
+        target: 13,
+        value: 0,
+      })),
+    };
+
+    const baseHeight = 460;
+    const layoutConfig = getSankeyLayoutConfig({
+      baseHeight,
+      nodes: data.nodes,
+      links: data.links,
+    });
+
+    const { container } = render(
+      <SankeyChart data={data} height={baseHeight} />,
+    );
+
+    expect(
+      screen.getByText("No failed findings to display"),
+    ).toBeInTheDocument();
+    expect(container.firstElementChild).toHaveStyle({
+      height: `${layoutConfig.height}px`,
+    });
+  });
+
+  it("renders risk and severity node labels with middle-aligned text", () => {
+    const x = 10;
+    const y = 20;
+    const width = 70;
+    const height = 80;
+    const nodeCenterY = y + height / 2;
+
+    render(
+      <svg>
+        <CustomNode
+          x={x}
+          y={y}
+          width={width}
+          height={height}
+          payload={{ name: "High", value: 9, newFindings: 3, change: 1 }}
+          containerWidth={200}
+          colors={{ High: "#ff0000" }}
+        />
+      </svg>,
+    );
+
+    const textElements = screen.getAllByText(/High|9/);
+    const nameLabel = textElements.find(
+      (element) => element.textContent === "High",
+    );
+    const valueLabel = textElements.find(
+      (element) => element.textContent === "9",
+    );
+
+    expect(nameLabel).toBeDefined();
+    expect(valueLabel).toBeDefined();
+
+    if (!nameLabel || !valueLabel) {
+      throw new Error(
+        "Expected both node name and value labels to be rendered.",
+      );
+    }
+
+    expect(nameLabel).toHaveAttribute("dominant-baseline", "middle");
+    expect(valueLabel).toHaveAttribute("dominant-baseline", "middle");
+
+    const nameY = Number.parseFloat(nameLabel.getAttribute("y") || "0");
+    const valueY = Number.parseFloat(valueLabel.getAttribute("y") || "0");
+
+    expect(nameY).toBeLessThan(nodeCenterY);
+    expect(valueY).toBeGreaterThan(nodeCenterY);
+    expect((nameY + valueY) / 2).toBeCloseTo(nodeCenterY);
+  });
+});
diff --git a/ui/components/graphs/sankey-chart.tsx b/ui/components/graphs/sankey-chart.tsx
index 0a41d0e4e7..f65647d73e 100644
--- a/ui/components/graphs/sankey-chart.tsx
+++ b/ui/components/graphs/sankey-chart.tsx
@@ -11,6 +11,7 @@ import { initializeChartColors } from "@/lib/charts/colors";
 import { PROVIDER_DISPLAY_NAMES } from "@/types/providers";
 import { SEVERITY_FILTER_MAP } from "@/types/severities";
 
+import { getSankeyLayoutConfig } from "./sankey-chart.layout";
 import { ChartTooltip } from "./shared/chart-tooltip";
 
 // Reverse mapping from display name to provider type for URL filters
@@ -73,6 +74,7 @@ interface NodeTooltipState {
 
 const TOOLTIP_OFFSET_PX = 10;
 const MIN_LINK_WIDTH = 4;
+const NODE_LABEL_LINE_SPACING = 13;
 
 interface TooltipPayload {
   payload: {
@@ -88,7 +90,7 @@ interface TooltipProps {
   payload?: TooltipPayload[];
 }
 
-interface CustomNodeProps {
+export interface CustomNodeProps {
   x: number;
   y: number;
   width: number;
@@ -148,7 +150,7 @@ const CustomTooltip = ({ active, payload }: TooltipProps) => {
   return null;
 };
 
-const CustomNode = ({
+export const CustomNode = ({
   x,
   y,
   width,
@@ -215,6 +217,10 @@ const CustomNode = ({
   const iconSize = 24;
   const iconGap = 8;
 
+  const nodeCenterY = y + height / 2;
+  const nodeNameY = nodeCenterY - NODE_LABEL_LINE_SPACING / 2;
+  const nodeValueY = nodeCenterY + NODE_LABEL_LINE_SPACING / 2;
+
   // Calculate text position accounting for icon
   const textOffsetX = isOut ? x - 6 : x + width + 6;
   const iconOffsetX = isOut
@@ -260,8 +266,9 @@ const CustomNode = ({
                   : textOffsetX + iconSize + iconGap * 2
                 : textOffsetX
             }
-            y={y + height / 2}
+            y={nodeNameY}
             fontSize="14"
+            dominantBaseline="middle"
             fill="var(--color-text-neutral-primary)"
           >
             {nodeName}
@@ -275,8 +282,9 @@ const CustomNode = ({
                   : textOffsetX + iconSize + iconGap * 2
                 : textOffsetX
             }
-            y={y + height / 2 + 13}
+            y={nodeValueY}
             fontSize="12"
+            dominantBaseline="middle"
             fill="var(--color-text-neutral-secondary)"
           >
             {payload.value}
@@ -531,11 +539,17 @@ export function SankeyChart({
   // Check if there's actual data to display (links with values > 0)
   const hasData = data.links.some((link) => link.value > 0);
 
+  const layoutConfig = getSankeyLayoutConfig({
+    baseHeight: height,
+    nodes: data.nodes,
+    links: data.links,
+  });
+
   if (!hasData) {
     return (
       <div
         className="flex items-center justify-center"
-        style={{ height: `${height}px` }}
+        style={{ height: `${layoutConfig.height}px` }}
       >
         <div className="flex flex-col items-center gap-2 text-center">
           <Info size={48} className="text-text-neutral-tertiary" />
@@ -549,12 +563,12 @@ export function SankeyChart({
 
   return (
     <div className="relative">
-      <ResponsiveContainer width="100%" height={height}>
+      <ResponsiveContainer width="100%" height={layoutConfig.height}>
         <Sankey
           data={data}
           node={wrappedCustomNode}
           link={wrappedCustomLink}
-          nodePadding={50}
+          nodePadding={layoutConfig.nodePadding}
           margin={{ top: 20, right: 160, bottom: 20, left: 160 }}
           sort={false}
         >

From c4378d5992137773fe7766fa12c97b82403ed396 Mon Sep 17 00:00:00 2001
From: Prowler Bot <bot@prowler.com>
Date: Thu, 11 Jun 2026 15:28:25 +0200
Subject: [PATCH 014/126] chore(release): Bump versions to v5.31.0 (#11548)

Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
---
 .env                                              | 2 +-
 api/pyproject.toml                                | 2 +-
 api/src/backend/api/specs/v1.yaml                 | 2 +-
 api/uv.lock                                       | 2 +-
 docs/getting-started/installation/prowler-app.mdx | 4 ++--
 prowler/config/config.py                          | 2 +-
 pyproject.toml                                    | 2 +-
 uv.lock                                           | 2 +-
 8 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.env b/.env
index c6085538a0..c0364e29ae 100644
--- a/.env
+++ b/.env
@@ -145,7 +145,7 @@ SENTRY_RELEASE=local
 NEXT_PUBLIC_SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.30.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.31.0
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
diff --git a/api/pyproject.toml b/api/pyproject.toml
index 5e18ffac20..2b34eb6e19 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -68,7 +68,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.31.0"
+version = "1.32.0"
 
 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
diff --git a/api/src/backend/api/specs/v1.yaml b/api/src/backend/api/specs/v1.yaml
index d2a30ca897..18566c5c71 100644
--- a/api/src/backend/api/specs/v1.yaml
+++ b/api/src/backend/api/specs/v1.yaml
@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.31.0
+  version: 1.32.0
   description: |-
     Prowler API specification.
 
diff --git a/api/uv.lock b/api/uv.lock
index 9689a9cd0a..bb42355e20 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -4499,7 +4499,7 @@ dependencies = [
 
 [[package]]
 name = "prowler-api"
-version = "1.31.0"
+version = "1.32.0"
 source = { virtual = "." }
 dependencies = [
     { name = "cartography" },
diff --git a/docs/getting-started/installation/prowler-app.mdx b/docs/getting-started/installation/prowler-app.mdx
index dea9c09446..eea9075cda 100644
--- a/docs/getting-started/installation/prowler-app.mdx
+++ b/docs/getting-started/installation/prowler-app.mdx
@@ -128,8 +128,8 @@ To update the environment file:
 Edit the `.env` file and change version values:
 
 ```env
-PROWLER_UI_VERSION="5.29.0"
-PROWLER_API_VERSION="5.29.0"
+PROWLER_UI_VERSION="5.30.0"
+PROWLER_API_VERSION="5.30.0"
 ```
 
 <Note>
diff --git a/prowler/config/config.py b/prowler/config/config.py
index 71c59d82a3..9e2b079da6 100644
--- a/prowler/config/config.py
+++ b/prowler/config/config.py
@@ -49,7 +49,7 @@ class _MutableTimestamp:
 
 timestamp = _MutableTimestamp(datetime.today())
 timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.30.0"
+prowler_version = "5.31.0"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"
diff --git a/pyproject.toml b/pyproject.toml
index 28a4b531cc..41fec77a42 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -124,7 +124,7 @@ maintainers = [{name = "Prowler Engineering", email = "engineering@prowler.com"}
 name = "prowler"
 readme = "README.md"
 requires-python = ">=3.10,<3.13"
-version = "5.30.0"
+version = "5.31.0"
 
 [project.scripts]
 prowler = "prowler.__main__:prowler"
diff --git a/uv.lock b/uv.lock
index 3a66d2826b..be25aea7da 100644
--- a/uv.lock
+++ b/uv.lock
@@ -3245,7 +3245,7 @@ wheels = [
 
 [[package]]
 name = "prowler"
-version = "5.30.0"
+version = "5.31.0"
 source = { editable = "." }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },

From 610febb5d56ed9e1d008bde9b43ff5f132d276a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Thu, 11 Jun 2026 15:53:44 +0200
Subject: [PATCH 015/126] fix(api): bump prowler SDK lock to v5.30.0 for
 okta_idaas_stig (#11553)

---
 api/uv.lock | 70 +++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 68 insertions(+), 2 deletions(-)

diff --git a/api/uv.lock b/api/uv.lock
index bb42355e20..d36993b516 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -4415,8 +4415,8 @@ wheels = [
 
 [[package]]
 name = "prowler"
-version = "5.27.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#0abbb7fc590eaf7de6ed354dd5a217bca261d2b0" }
+version = "5.30.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#f1d741214a60df17158c3fdc97804fd1fde64f3a" }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },
     { name = "alibabacloud-credentials" },
@@ -4489,9 +4489,14 @@ dependencies = [
     { name = "pygithub" },
     { name = "python-dateutil" },
     { name = "pytz" },
+    { name = "scaleway" },
     { name = "schema" },
     { name = "shodan" },
     { name = "slack-sdk" },
+    { name = "stackit-core" },
+    { name = "stackit-iaas" },
+    { name = "stackit-objectstorage" },
+    { name = "stackit-resourcemanager" },
     { name = "tabulate" },
     { name = "tzlocal" },
     { name = "uuid6" },
@@ -5531,6 +5536,67 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/49/4b/359f28a903c13438ef59ebeee215fb25da53066db67b305c125f1c6d2a25/sqlparse-0.5.5-py3-none-any.whl", hash = "sha256:12a08b3bf3eec877c519589833aed092e2444e68240a3577e8e26148acc7b1ba", size = 46138, upload-time = "2025-12-19T07:17:46.573Z" },
 ]
 
+[[package]]
+name = "stackit-core"
+version = "0.2.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+    { name = "pydantic" },
+    { name = "pyjwt", extra = ["crypto"] },
+    { name = "requests" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/24/90/20f9ec7387eec4067cfd3d29055d0e2b5e1e0322c601a7f48125fd8ea35f/stackit_core-0.2.0.tar.gz", hash = "sha256:b8af91877cdb060d6969a303d8cf20bc0b33b345afd91f679c44a987381e2d47", size = 8987, upload-time = "2025-06-12T08:24:45.251Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ab/b4/7b53187ce68956870d864ccb9ccfb68066c9df9de1c9568fd2feb03c4504/stackit_core-0.2.0-py3-none-any.whl", hash = "sha256:04632fc6742790d08ddfcb7f2313e04d1254827397a80250f838a2f81b92645b", size = 10240, upload-time = "2025-06-12T08:24:44.214Z" },
+]
+
+[[package]]
+name = "stackit-iaas"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dateutil" },
+    { name = "requests" },
+    { name = "stackit-core" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/52/07/24e65278300d5c3cb19cb1660bff924c80812cf8aad3e715f826bae5aa80/stackit_iaas-1.4.0.tar.gz", hash = "sha256:93523b23442350c7ebefd9129485c4c2a539f694a9c36a0f8edfaba9862057ea", size = 116236, upload-time = "2026-05-13T09:43:15.996Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/08/51/2201164d7bfacf47539888c735f10f6320c188252384957aa1b23121a210/stackit_iaas-1.4.0-py3-none-any.whl", hash = "sha256:3f4a32321b57ac238f73e5d660c6428186b92cc0425c1f0783ba801e377149d9", size = 316588, upload-time = "2026-05-13T09:43:14.943Z" },
+]
+
+[[package]]
+name = "stackit-objectstorage"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dateutil" },
+    { name = "requests" },
+    { name = "stackit-core" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/90/80/b790756af40a5c6d979dd688b2557394ac54b594eb4c08edc33157ba890f/stackit_objectstorage-1.4.0.tar.gz", hash = "sha256:4a3812b4de102b199f061706a802909f9e53ae9b0858769d5bd720f814c8bdbe", size = 31814, upload-time = "2026-05-13T09:43:05.027Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/68/f1/ffa8d5e2ec9f818c72a6f045691364eb4e927ee86641993a70882d00205a/stackit_objectstorage-1.4.0-py3-none-any.whl", hash = "sha256:1a3285c6840d95cff591d84fd21803575cb0d010c398e6575ed92987b9c39866", size = 65061, upload-time = "2026-05-13T09:43:04.13Z" },
+]
+
+[[package]]
+name = "stackit-resourcemanager"
+version = "0.8.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+    { name = "python-dateutil" },
+    { name = "requests" },
+    { name = "stackit-core" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/23/2d/f458f18e48ed2b1c83df52cff7dbdfd5dd904fb2980ffd9385876e47bbd9/stackit_resourcemanager-0.8.0.tar.gz", hash = "sha256:f44542beab4130857f5a7f465cf02defeef657bdf63c1beeb3102f0ba3c003fe", size = 33943, upload-time = "2026-05-13T09:43:08.667Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c7/9c/38a74d0f7a89b4320f6d2366fb660638bda8860daa08748b12c713d84381/stackit_resourcemanager-0.8.0-py3-none-any.whl", hash = "sha256:dd04bb8353d041a137c4dcba190beabded7acfaff1bc98b218fce20a99389ebc", size = 81288, upload-time = "2026-05-13T09:43:07.81Z" },
+]
+
 [[package]]
 name = "statsd"
 version = "4.0.1"

From ce27053c2dd2e97b7589402c83bcb78bb08d41e1 Mon Sep 17 00:00:00 2001
From: Zeus Almightee <53497290+ernestprovo23@users.noreply.github.com>
Date: Thu, 11 Jun 2026 10:53:28 -0400
Subject: [PATCH 016/126] feat(aws): add securityhub + config org-wide
 delegated admin checks (#11259)

Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com>
---
 prowler/CHANGELOG.md                          |   9 +
 .../__init__.py                               |   0
 ...d_org_aggregator_all_regions.metadata.json |  44 ++
 ...ed_admin_and_org_aggregator_all_regions.py | 115 ++++
 .../aws/services/config/config_service.py     | 131 +++++
 .../__init__.py                               |   0
 ...ed_admin_enabled_all_regions.metadata.json |  44 ++
 ...hub_delegated_admin_enabled_all_regions.py |  84 +++
 .../securityhub/securityhub_service.py        | 101 +++-
 ...min_and_org_aggregator_all_regions_test.py | 491 +++++++++++++++++
 ...elegated_admin_enabled_all_regions_test.py | 512 ++++++++++++++++++
 11 files changed, 1530 insertions(+), 1 deletion(-)
 create mode 100644 prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/__init__.py
 create mode 100644 prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.metadata.json
 create mode 100644 prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.py
 create mode 100644 prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/__init__.py
 create mode 100644 prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.metadata.json
 create mode 100644 prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.py
 create mode 100644 tests/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions_test.py
 create mode 100644 tests/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index bb206f5a96..62fbb35d30 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -2,6 +2,15 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
+## [5.31.0] (Prowler UNRELEASED)
+
+### 🚀 Added
+
+- `securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
+- `config_delegated_admin_and_org_aggregator_all_regions` check for AWS provider, verifying that AWS Config has a delegated administrator and an organization aggregator covering all AWS regions [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
+
+---
+
 ## [5.30.0] (Prowler v5.30.0)
 
 ### 🚀 Added
diff --git a/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/__init__.py b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.metadata.json b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.metadata.json
new file mode 100644
index 0000000000..cbbd7a66dd
--- /dev/null
+++ b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.metadata.json
@@ -0,0 +1,44 @@
+{
+  "Provider": "aws",
+  "CheckID": "config_delegated_admin_and_org_aggregator_all_regions",
+  "CheckTitle": "AWS Config has a delegated administrator and an organization aggregator covering all AWS regions",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
+  "ServiceName": "config",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "AwsConfigConfigurationAggregator",
+  "ResourceGroup": "governance",
+  "Description": "**AWS Config** has a delegated administrator registered via AWS Organizations and at least one Configuration Aggregator with an OrganizationAggregationSource that covers all AWS regions, ensuring centralized org-wide configuration visibility.",
+  "Risk": "Without an org-wide **AWS Config** aggregator and a delegated administrator, configuration data is fragmented across accounts and regions, **compliance reporting** is incomplete, and **drift detection** is delayed. Adversaries or misconfigurations can persist in unmonitored accounts, eroding **audit readiness** and **regulatory posture**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html",
+    "https://docs.aws.amazon.com/config/latest/developerguide/set-up-aggregator-cli.html",
+    "https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-config.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws organizations register-delegated-administrator --account-id <ADMIN_ACCOUNT_ID> --service-principal config.amazonaws.com && aws configservice put-configuration-aggregator --configuration-aggregator-name org-aggregator --organization-aggregation-source RoleArn=<ROLE_ARN>,AllAwsRegions=true",
+      "NativeIaC": "",
+      "Other": "1. From the AWS Organizations management account, register the delegated administrator for config.amazonaws.com\n2. In the delegated admin account, open AWS Config\n3. Create a Configuration Aggregator and select Add my organization as the source\n4. Enable Include all AWS Regions\n5. Confirm an IAM role with AWSConfigRoleForOrganizations is attached\n6. Verify the aggregator status reaches SUCCEEDED for all member accounts",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Register a **delegated administrator** for AWS Config via AWS Organizations and create at least one **Configuration Aggregator** with an OrganizationAggregationSource that covers **all AWS regions**. This centralizes configuration data across the organization for unified compliance and audit reporting.",
+      "Url": "https://hub.prowler.com/check/config_delegated_admin_and_org_aggregator_all_regions"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "config_recorder_all_regions_enabled",
+    "guardduty_delegated_admin_enabled_all_regions"
+  ],
+  "Notes": "This check requires execution from the organization management account or delegated administrator account to access organization-level APIs."
+}
diff --git a/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.py b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.py
new file mode 100644
index 0000000000..f56ea191f8
--- /dev/null
+++ b/prowler/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions.py
@@ -0,0 +1,115 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.config.config_client import config_client
+from prowler.providers.aws.services.config.config_service import Aggregator
+
+
+class config_delegated_admin_and_org_aggregator_all_regions(Check):
+    """Ensure AWS Config has a delegated admin and an org aggregator covering all regions.
+
+    This check verifies that:
+    1. A delegated administrator is registered for the config.amazonaws.com
+       service principal via AWS Organizations.
+    2. At least one AWS Config Configuration Aggregator exists with an
+       OrganizationAggregationSource that covers all AWS regions
+       (AllAwsRegions=true).
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the check logic.
+
+        Returns:
+            A list of reports containing the result of the check. One finding per
+            aggregator-region, or a single synthetic FAIL when no aggregators
+            exist in any region.
+        """
+        findings = []
+
+        has_delegated_admin = (
+            bool(config_client.delegated_administrators)
+            and not config_client.delegated_administrators_lookup_failed
+        )
+        delegated_admin_unknown = config_client.delegated_administrators_lookup_failed
+
+        # No aggregators in any region: emit one synthetic FAIL anchored to the
+        # audited account in the default region.
+        if not config_client.aggregators:
+            synthetic = Aggregator(
+                name="unknown",
+                arn=config_client.get_unknown_arn(
+                    region=config_client.region,
+                    resource_type="config-aggregator",
+                ),
+                region=config_client.region,
+                all_aws_regions=False,
+                aws_regions=None,
+                organization_aggregation_source_present=False,
+            )
+            report = Check_Report_AWS(metadata=self.metadata(), resource=synthetic)
+            if delegated_admin_unknown:
+                delegated_state = (
+                    "delegated administrator status could not be determined"
+                )
+            elif has_delegated_admin:
+                delegated_state = "delegated administrator configured"
+            else:
+                delegated_state = (
+                    "no delegated administrator registered for config.amazonaws.com"
+                )
+            report.status = "FAIL"
+            report.status_extended = (
+                f"AWS Config has no Organization Aggregator configured in any "
+                f"region ({delegated_state})."
+            )
+            findings.append(report)
+            return findings
+
+        for region, aggregators_in_region in config_client.aggregators.items():
+            for aggregator in aggregators_in_region:
+                report = Check_Report_AWS(metadata=self.metadata(), resource=aggregator)
+
+                org_aware = aggregator.organization_aggregation_source_present
+                covers_all = aggregator.all_aws_regions
+
+                issues = []
+                if delegated_admin_unknown:
+                    issues.append(
+                        "delegated administrator status for config.amazonaws.com "
+                        "could not be determined"
+                    )
+                elif not has_delegated_admin:
+                    issues.append(
+                        "no delegated administrator registered for config.amazonaws.com"
+                    )
+                if not org_aware:
+                    issues.append(
+                        f"aggregator {aggregator.name} is not an organization aggregator"
+                    )
+                elif not covers_all:
+                    issues.append(
+                        f"aggregator {aggregator.name} does not cover all AWS regions"
+                    )
+
+                if issues:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"AWS Config aggregator {aggregator.name} in region "
+                        f"{region} has issues: {', '.join(issues)}."
+                    )
+                else:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"AWS Config aggregator {aggregator.name} in region "
+                        f"{region} is an organization aggregator covering all "
+                        f"AWS regions with delegated admin configured."
+                    )
+
+                # Support muting non-default regions if configured
+                if report.status == "FAIL" and (
+                    config_client.audit_config.get("mute_non_default_regions", False)
+                    and region != config_client.region
+                ):
+                    report.muted = True
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/config/config_service.py b/prowler/providers/aws/services/config/config_service.py
index 443cee2233..85ab22fd8e 100644
--- a/prowler/providers/aws/services/config/config_service.py
+++ b/prowler/providers/aws/services/config/config_service.py
@@ -1,5 +1,6 @@
 from typing import Optional
 
+from botocore.client import ClientError
 from pydantic.v1 import BaseModel
 
 from prowler.lib.logger import logger
@@ -12,10 +13,16 @@ class Config(AWSService):
         # Call AWSService's __init__
         super().__init__(__class__.__name__, provider)
         self.recorders = {}
+        self.aggregators: dict[str, list] = {}
+        self.delegated_administrators: list = []
+        self.delegated_administrators_lookup_failed: bool = False
         self.__threading_call__(self.describe_configuration_recorders)
         self.__threading_call__(
             self._describe_configuration_recorder_status, self.recorders.values()
         )
+        self.__threading_call__(self._describe_configuration_aggregators)
+        # Organizations API is not regional; single call.
+        self._list_config_delegated_administrators()
 
     def _get_recorder_arn_template(self, region):
         return f"arn:{self.audited_partition}:config:{region}:{self.audited_account}:recorder"
@@ -73,6 +80,108 @@ class Config(AWSService):
                 f"{recorder.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _describe_configuration_aggregators(self, regional_client):
+        """Describe AWS Config configuration aggregators per region.
+
+        An aggregator counts as organization-aware when its
+        OrganizationAggregationSource key is present in the response.
+        """
+        logger.info("Config - Describing Configuration Aggregators...")
+        try:
+            paginator = regional_client.get_paginator(
+                "describe_configuration_aggregators"
+            )
+            region_aggregators: list = []
+            for page in paginator.paginate():
+                for aggregator in page.get("ConfigurationAggregators", []):
+                    name = aggregator.get("ConfigurationAggregatorName", "")
+                    arn = aggregator.get("ConfigurationAggregatorArn", "")
+                    org_source = aggregator.get("OrganizationAggregationSource")
+                    org_aware = org_source is not None
+                    all_aws_regions = False
+                    aws_regions: Optional[list] = None
+                    if org_aware:
+                        all_aws_regions = org_source.get("AllAwsRegions", False)
+                        aws_regions = org_source.get("AwsRegions")
+                    if not self.audit_resources or (
+                        is_resource_filtered(arn, self.audit_resources)
+                    ):
+                        region_aggregators.append(
+                            Aggregator(
+                                name=name,
+                                arn=arn,
+                                region=regional_client.region,
+                                all_aws_regions=all_aws_regions,
+                                aws_regions=aws_regions,
+                                organization_aggregation_source_present=org_aware,
+                            )
+                        )
+            if region_aggregators:
+                self.aggregators[regional_client.region] = region_aggregators
+        except ClientError as error:
+            if error.response["Error"]["Code"] in (
+                "AccessDeniedException",
+                "AccessDenied",
+            ):
+                logger.warning(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def _list_config_delegated_administrators(self):
+        """List delegated administrators for the AWS Config service principal.
+
+        Uses the Organizations API directly (not regional). Sets
+        delegated_administrators_lookup_failed to True on AccessDenied so callers
+        can surface the unknown delegated-admin state in findings.
+        """
+        logger.info(
+            "Config - Listing delegated administrators for config.amazonaws.com..."
+        )
+        try:
+            org_client = self.session.client("organizations")
+            paginator = org_client.get_paginator("list_delegated_administrators")
+            for page in paginator.paginate(ServicePrincipal="config.amazonaws.com"):
+                for admin in page.get("DelegatedAdministrators", []):
+                    self.delegated_administrators.append(
+                        ConfigDelegatedAdministrator(
+                            id=admin.get("Id", ""),
+                            arn=admin.get("Arn", ""),
+                            name=admin.get("Name", ""),
+                            email=admin.get("Email", ""),
+                            status=admin.get("Status", ""),
+                            joined_method=admin.get("JoinedMethod", ""),
+                        )
+                    )
+        except ClientError as error:
+            error_code = error.response["Error"]["Code"]
+            if error_code in (
+                "AccessDeniedException",
+                "AccessDenied",
+                "AWSOrganizationsNotInUseException",
+            ):
+                self.delegated_administrators_lookup_failed = True
+                logger.warning(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                self.delegated_administrators_lookup_failed = True
+                logger.error(
+                    f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            self.delegated_administrators_lookup_failed = True
+            logger.error(
+                f"{self.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
 
 class Recorder(BaseModel):
     name: str
@@ -80,3 +189,25 @@ class Recorder(BaseModel):
     recording: Optional[bool]
     last_status: Optional[str]
     region: str
+
+
+class Aggregator(BaseModel):
+    """Represents an AWS Config Configuration Aggregator."""
+
+    name: str
+    arn: str
+    region: str
+    all_aws_regions: bool = False
+    aws_regions: Optional[list] = None
+    organization_aggregation_source_present: bool = False
+
+
+class ConfigDelegatedAdministrator(BaseModel):
+    """Represents a delegated administrator registered for config.amazonaws.com."""
+
+    id: str
+    arn: str
+    name: str
+    email: str
+    status: str
+    joined_method: str
diff --git a/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/__init__.py b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.metadata.json b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.metadata.json
new file mode 100644
index 0000000000..99748671ae
--- /dev/null
+++ b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.metadata.json
@@ -0,0 +1,44 @@
+{
+  "Provider": "aws",
+  "CheckID": "securityhub_delegated_admin_enabled_all_regions",
+  "CheckTitle": "Security Hub has delegated admin configured and is enabled in all regions with organization auto-enable",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices",
+    "Software and Configuration Checks/Industry and Regulatory Standards/AWS Foundational Security Best Practices"
+  ],
+  "ServiceName": "securityhub",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "AwsSecurityHubHub",
+  "ResourceGroup": "security",
+  "Description": "**AWS Security Hub** has a delegated administrator configured at the organization level, hubs are active in all opted-in regions, and organization auto-enable is active so that new member accounts are automatically enrolled.",
+  "Risk": "Without org-wide **AWS Security Hub** configuration, findings can be aggregated inconsistently, delegated admin may be missing in some regions, and new accounts will not be auto-enrolled. This fragments **security posture visibility**, delays **incident response**, and lets misconfigurations and compliance drift go undetected across the organization.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/designate-orgs-admin-account.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/accounts-orgs-auto-enable.html",
+    "https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-regions.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws securityhub enable-organization-admin-account --admin-account-id <ADMIN_ACCOUNT_ID> && aws securityhub update-organization-configuration --auto-enable --auto-enable-standards DEFAULT",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the AWS Organizations management account\n2. Open the AWS Organizations console\n3. Navigate to Services > AWS Security Hub\n4. Click Register delegated administrator and enter the security account ID\n5. Switch to the delegated admin account\n6. In Security Hub console, go to Settings > Accounts\n7. Enable auto-enable for new organization accounts\n8. Repeat hub enablement for all opted-in regions",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure a **delegated administrator** for AWS Security Hub via AWS Organizations. Enable Security Hub in **all opted-in regions** and turn on **auto-enable** so new member accounts are automatically enrolled. This ensures uniform security posture monitoring across the entire organization.",
+      "Url": "https://hub.prowler.com/check/securityhub_delegated_admin_enabled_all_regions"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "securityhub_enabled",
+    "guardduty_delegated_admin_enabled_all_regions"
+  ],
+  "Notes": "This check requires execution from the organization management account or delegated administrator account to access organization-level APIs."
+}
diff --git a/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.py b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.py
new file mode 100644
index 0000000000..4828752183
--- /dev/null
+++ b/prowler/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions.py
@@ -0,0 +1,84 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.securityhub.securityhub_client import (
+    securityhub_client,
+)
+
+
+class securityhub_delegated_admin_enabled_all_regions(Check):
+    """Ensure Security Hub has a delegated admin and is enabled in all regions.
+
+    This check verifies that:
+    1. A delegated administrator account is configured for Security Hub
+    2. Security Hub is active (ACTIVE status) in each region
+    3. Organization auto-enable is configured for new member accounts
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the check logic.
+
+        Returns:
+            A list of reports containing the result of the check for each region.
+        """
+        findings = []
+
+        # Build a set of regions that have an organization admin account configured
+        regions_with_admin = {
+            admin.region
+            for admin in securityhub_client.organization_admin_accounts
+            if admin.admin_status == "ENABLED"
+        }
+        admin_lookup_failed = securityhub_client.organization_admin_lookup_failed
+
+        for securityhub in securityhub_client.securityhubs:
+            report = Check_Report_AWS(metadata=self.metadata(), resource=securityhub)
+
+            # Check if this region has a delegated admin
+            has_delegated_admin = securityhub.region in regions_with_admin
+
+            # Check if hub is active
+            hub_active = securityhub.status == "ACTIVE"
+
+            # Check if auto-enable is configured for organization members
+            auto_enable_on = securityhub.organization_auto_enable
+
+            # Determine overall status
+            issues = []
+            if admin_lookup_failed:
+                issues.append("delegated administrator status could not be determined")
+            elif not has_delegated_admin:
+                issues.append("no delegated administrator configured")
+            if not hub_active:
+                issues.append("Security Hub not enabled")
+            if (
+                hub_active
+                and securityhub.organization_config_available
+                and not auto_enable_on
+            ):
+                # Only report auto-enable issue if hub is active and org config data
+                # is available (i.e., we could actually read AutoEnable from the API).
+                issues.append("organization auto-enable not configured")
+
+            if issues:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Security Hub in region {securityhub.region} has issues: "
+                    f"{', '.join(issues)}."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Security Hub in region {securityhub.region} has delegated "
+                    f"admin configured with hub active and organization auto-enable "
+                    f"enabled."
+                )
+
+            # Support muting non-default regions if configured
+            if report.status == "FAIL" and (
+                securityhub_client.audit_config.get("mute_non_default_regions", False)
+                and securityhub.region != securityhub_client.region
+            ):
+                report.muted = True
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/securityhub/securityhub_service.py b/prowler/providers/aws/services/securityhub/securityhub_service.py
index 0799c6e048..5e2d445742 100644
--- a/prowler/providers/aws/services/securityhub/securityhub_service.py
+++ b/prowler/providers/aws/services/securityhub/securityhub_service.py
@@ -13,8 +13,14 @@ class SecurityHub(AWSService):
         # Call AWSService's __init__
         super().__init__(__class__.__name__, provider)
         self.securityhubs = []
+        self.organization_admin_accounts = []
+        self.organization_admin_lookup_failed: bool = False
         self.__threading_call__(self._describe_hub)
         self.__threading_call__(self._list_tags, self.securityhubs)
+        self.__threading_call__(self._list_organization_admin_accounts)
+        self.__threading_call__(
+            self._describe_organization_configuration, self.securityhubs
+        )
 
     def _describe_hub(self, regional_client):
         logger.info("SecurityHub - Describing Hub...")
@@ -104,6 +110,95 @@ class SecurityHub(AWSService):
                 f"{resource.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _list_organization_admin_accounts(self, regional_client):
+        """List Security Hub delegated administrator accounts for the organization.
+
+        This API is only available to the organization management account or
+        a delegated administrator account.
+        """
+        logger.info("SecurityHub - listing organization admin accounts...")
+        try:
+            paginator = regional_client.get_paginator(
+                "list_organization_admin_accounts"
+            )
+            for page in paginator.paginate():
+                for admin in page.get("AdminAccounts", []):
+                    admin_account = OrganizationAdminAccount(
+                        admin_account_id=admin.get("AdminAccountId"),
+                        admin_status=admin.get("AdminStatus"),
+                        region=regional_client.region,
+                    )
+                    # Avoid duplicates across regions for the same admin account
+                    if not any(
+                        existing.admin_account_id == admin_account.admin_account_id
+                        and existing.region == admin_account.region
+                        for existing in self.organization_admin_accounts
+                    ):
+                        self.organization_admin_accounts.append(admin_account)
+        except ClientError as error:
+            self.organization_admin_lookup_failed = True
+            if error.response["Error"]["Code"] in (
+                "AccessDeniedException",
+                "InvalidAccessException",
+                "BadRequestException",
+            ):
+                logger.warning(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            self.organization_admin_lookup_failed = True
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def _describe_organization_configuration(self, securityhub):
+        """Describe the organization configuration for a Security Hub instance.
+
+        This provides information about auto-enable settings for the organization.
+        Only invoked for hubs in ACTIVE status.
+        """
+        logger.info("SecurityHub - describing organization configuration...")
+        try:
+            if securityhub.status != "ACTIVE":
+                return
+            regional_client = self.regional_clients[securityhub.region]
+            org_config = regional_client.describe_organization_configuration()
+            securityhub.organization_auto_enable = org_config.get("AutoEnable", False)
+            securityhub.auto_enable_standards = org_config.get(
+                "AutoEnableStandards", "NONE"
+            )
+            securityhub.organization_config_available = True
+        except ClientError as error:
+            if error.response["Error"]["Code"] in (
+                "AccessDeniedException",
+                "InvalidAccessException",
+                "BadRequestException",
+            ):
+                # Expected when not running from management or delegated admin account
+                logger.warning(
+                    f"{securityhub.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+            else:
+                logger.error(
+                    f"{securityhub.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        except Exception as error:
+            logger.error(
+                f"{securityhub.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+class OrganizationAdminAccount(BaseModel):
+    """Represents a Security Hub delegated administrator account."""
+
+    admin_account_id: str
+    admin_status: str  # ENABLED or DISABLE_IN_PROGRESS
+    region: str
+
 
 class SecurityHubHub(BaseModel):
     arn: str
@@ -112,4 +207,8 @@ class SecurityHubHub(BaseModel):
     standards: str
     integrations: str
     region: str
-    tags: Optional[list]
+    tags: Optional[list] = []
+    # Organization configuration fields
+    organization_auto_enable: bool = False
+    auto_enable_standards: str = "NONE"
+    organization_config_available: bool = False
diff --git a/tests/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions_test.py b/tests/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions_test.py
new file mode 100644
index 0000000000..f2acf555d1
--- /dev/null
+++ b/tests/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/config_delegated_admin_and_org_aggregator_all_regions_test.py
@@ -0,0 +1,491 @@
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_EU_WEST_1,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+orig = botocore.client.BaseClient._make_api_call
+
+
+AGG_ARN_TEMPLATE = (
+    "arn:aws:config:{region}:" + AWS_ACCOUNT_NUMBER + ":config-aggregator/{name}"
+)
+
+
+def _aggregator_payload(
+    name, region, *, org_aware=True, all_regions=True, aws_regions=None
+):
+    payload = {
+        "ConfigurationAggregatorName": name,
+        "ConfigurationAggregatorArn": AGG_ARN_TEMPLATE.format(region=region, name=name),
+    }
+    if org_aware:
+        org_source = {
+            "RoleArn": f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/AWSConfigRoleForOrganizations",
+            "AllAwsRegions": all_regions,
+        }
+        if not all_regions and aws_regions:
+            org_source["AwsRegions"] = aws_regions
+        payload["OrganizationAggregationSource"] = org_source
+    return payload
+
+
+def make_mock_no_aggregators_no_admin():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {"ConfigurationAggregators": []}
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_aggregator_not_org_aware():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "legacy-agg",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=False,
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_org_aggregator_not_all_regions_with_admin():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "partial-org-agg",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=True,
+                        all_regions=False,
+                        aws_regions=[AWS_REGION_EU_WEST_1],
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            return {
+                "DelegatedAdministrators": [
+                    {
+                        "Id": "123456789012",
+                        "Arn": f"arn:aws:organizations::{AWS_ACCOUNT_NUMBER}:account/o-abc123/123456789012",
+                        "Email": "admin@example.com",
+                        "Name": "Security",
+                        "Status": "ACTIVE",
+                        "JoinedMethod": "CREATED",
+                    }
+                ]
+            }
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_full_pass():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "org-aggregator",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=True,
+                        all_regions=True,
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            return {
+                "DelegatedAdministrators": [
+                    {
+                        "Id": "123456789012",
+                        "Arn": f"arn:aws:organizations::{AWS_ACCOUNT_NUMBER}:account/o-abc123/123456789012",
+                        "Email": "admin@example.com",
+                        "Name": "Security",
+                        "Status": "ACTIVE",
+                        "JoinedMethod": "CREATED",
+                    }
+                ]
+            }
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_access_denied_on_orgs():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "org-aggregator",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=True,
+                        all_regions=True,
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            raise botocore.exceptions.ClientError(
+                {
+                    "Error": {
+                        "Code": "AccessDeniedException",
+                        "Message": "User is not authorized to perform: organizations:ListDelegatedAdministrators",
+                    }
+                },
+                operation_name,
+            )
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_aggregators_access_denied():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            raise botocore.exceptions.ClientError(
+                {
+                    "Error": {
+                        "Code": "AccessDeniedException",
+                        "Message": "denied",
+                    }
+                },
+                operation_name,
+            )
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_aggregators_other_client_error():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            raise botocore.exceptions.ClientError(
+                {
+                    "Error": {
+                        "Code": "InternalServerError",
+                        "Message": "boom",
+                    }
+                },
+                operation_name,
+            )
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_aggregators_unexpected_exception():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            raise RuntimeError("simulated transient error")
+        if operation_name == "ListDelegatedAdministrators":
+            return {"DelegatedAdministrators": []}
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+def make_mock_delegated_admins_unexpected_exception():
+    def _mock(self, operation_name, api_params):
+        if operation_name == "DescribeConfigurationAggregators":
+            return {
+                "ConfigurationAggregators": [
+                    _aggregator_payload(
+                        "org-aggregator",
+                        AWS_REGION_EU_WEST_1,
+                        org_aware=True,
+                        all_regions=True,
+                    )
+                ]
+            }
+        if operation_name == "ListDelegatedAdministrators":
+            raise RuntimeError("simulated transient error")
+        return orig(self, operation_name, api_params)
+
+    return _mock
+
+
+class Test_config_delegated_admin_and_org_aggregator_all_regions:
+    @mock_aws
+    def test_no_aggregators_no_admin(self):
+        """Test when no aggregators exist in any region and no delegated admin is set."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_no_aggregators_no_admin(),
+        ):
+            aws_provider = set_mocked_aws_provider(
+                [AWS_REGION_EU_WEST_1, AWS_REGION_US_EAST_1]
+            )
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert (
+                    "no Organization Aggregator configured in any region"
+                    in result[0].status_extended
+                )
+                assert (
+                    "no delegated administrator registered for config.amazonaws.com"
+                    in result[0].status_extended
+                )
+
+    @mock_aws
+    def test_aggregator_not_org_aware(self):
+        """Test when an aggregator exists but is not an organization aggregator."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_aggregator_not_org_aware(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                eu_west_1_result = None
+                for finding in result:
+                    if finding.region == AWS_REGION_EU_WEST_1:
+                        eu_west_1_result = finding
+                        break
+
+                assert eu_west_1_result is not None
+                assert eu_west_1_result.status == "FAIL"
+                assert (
+                    "is not an organization aggregator"
+                    in eu_west_1_result.status_extended
+                )
+
+    @mock_aws
+    def test_org_aggregator_not_all_regions_with_admin(self):
+        """Test org aggregator that doesn't cover all AWS regions (delegated admin set)."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_org_aggregator_not_all_regions_with_admin(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                eu_west_1_result = None
+                for finding in result:
+                    if finding.region == AWS_REGION_EU_WEST_1:
+                        eu_west_1_result = finding
+                        break
+
+                assert eu_west_1_result is not None
+                assert eu_west_1_result.status == "FAIL"
+                assert (
+                    "does not cover all AWS regions" in eu_west_1_result.status_extended
+                )
+
+    @mock_aws
+    def test_full_pass(self):
+        """Test PASS: delegated admin set and org aggregator covering all AWS regions."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_full_pass(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                eu_west_1_result = None
+                for finding in result:
+                    if finding.region == AWS_REGION_EU_WEST_1:
+                        eu_west_1_result = finding
+                        break
+
+                assert eu_west_1_result is not None
+                assert eu_west_1_result.status == "PASS"
+                assert (
+                    "is an organization aggregator covering all AWS regions"
+                    in eu_west_1_result.status_extended
+                )
+                assert "delegated admin configured" in eu_west_1_result.status_extended
+                assert eu_west_1_result.resource_arn == AGG_ARN_TEMPLATE.format(
+                    region=AWS_REGION_EU_WEST_1, name="org-aggregator"
+                )
+
+    @mock_aws
+    def test_access_denied_on_organizations(self):
+        """Test that AccessDenied on Organizations is reported as unknown admin state."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_access_denied_on_orgs(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            from prowler.providers.aws.services.config.config_service import Config
+
+            with (
+                patch(
+                    "prowler.providers.common.provider.Provider.get_global_provider",
+                    return_value=aws_provider,
+                ),
+                patch(
+                    "prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions.config_client",
+                    new=Config(aws_provider),
+                ),
+            ):
+                from prowler.providers.aws.services.config.config_delegated_admin_and_org_aggregator_all_regions.config_delegated_admin_and_org_aggregator_all_regions import (
+                    config_delegated_admin_and_org_aggregator_all_regions,
+                )
+
+                check = config_delegated_admin_and_org_aggregator_all_regions()
+                result = check.execute()
+
+                eu_west_1_result = None
+                for finding in result:
+                    if finding.region == AWS_REGION_EU_WEST_1:
+                        eu_west_1_result = finding
+                        break
+
+                assert eu_west_1_result is not None
+                # The check still runs; aggregator coverage is satisfied but the
+                # delegated-admin status is unknown, so it must FAIL.
+                assert eu_west_1_result.status == "FAIL"
+                assert (
+                    "delegated administrator status for config.amazonaws.com could not be determined"
+                    in eu_west_1_result.status_extended
+                )
+
+    @mock_aws
+    def test_aggregators_access_denied(self):
+        """AccessDenied on DescribeConfigurationAggregators is swallowed: no aggregators recorded for that region."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_aggregators_access_denied(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+            from prowler.providers.aws.services.config.config_service import Config
+
+            service = Config(aws_provider)
+            assert service.aggregators == {}
+
+    @mock_aws
+    def test_aggregators_other_client_error(self):
+        """Non-access ClientError on DescribeConfigurationAggregators is logged at error level."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_aggregators_other_client_error(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+            from prowler.providers.aws.services.config.config_service import Config
+
+            service = Config(aws_provider)
+            assert service.aggregators == {}
+
+    @mock_aws
+    def test_aggregators_unexpected_exception(self):
+        """Non-ClientError on DescribeConfigurationAggregators is caught by bare except."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_aggregators_unexpected_exception(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+            from prowler.providers.aws.services.config.config_service import Config
+
+            service = Config(aws_provider)
+            assert service.aggregators == {}
+
+    @mock_aws
+    def test_delegated_admins_unexpected_exception(self):
+        """Non-ClientError on ListDelegatedAdministrators must still set lookup_failed."""
+        with patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=make_mock_delegated_admins_unexpected_exception(),
+        ):
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+            from prowler.providers.aws.services.config.config_service import Config
+
+            service = Config(aws_provider)
+            assert service.delegated_administrators_lookup_failed is True
+            assert service.delegated_administrators == []
diff --git a/tests/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions_test.py b/tests/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions_test.py
new file mode 100644
index 0000000000..01af147e9a
--- /dev/null
+++ b/tests/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/securityhub_delegated_admin_enabled_all_regions_test.py
@@ -0,0 +1,512 @@
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_EU_WEST_1,
+    set_mocked_aws_provider,
+)
+
+orig = botocore.client.BaseClient._make_api_call
+
+HUB_ARN = f"arn:aws:securityhub:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:hub/default"
+
+
+def _active_hub_responses(operation_name):
+    """Return a moto-friendly response for hub-describing API calls.
+
+    Returns None if the operation is not one of the hub APIs (so the caller
+    can fall back to the default behavior).
+    """
+    if operation_name == "DescribeHub":
+        return {
+            "HubArn": HUB_ARN,
+            "SubscribedAt": "2024-01-01T00:00:00.000Z",
+            "AutoEnableControls": True,
+        }
+    if operation_name == "GetEnabledStandards":
+        return {"StandardsSubscriptions": []}
+    if operation_name == "ListEnabledProductsForImport":
+        return {"ProductSubscriptions": []}
+    if operation_name == "ListTagsForResource":
+        return {"Tags": {}}
+    return None
+
+
+def mock_make_api_call_org_admin_and_config(self, operation_name, api_params):
+    """Mock organization admin accounts and configuration APIs - PASS scenario."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {
+            "AdminAccounts": [
+                {
+                    "AdminAccountId": "123456789012",
+                    "AdminStatus": "ENABLED",
+                }
+            ]
+        }
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {
+            "AutoEnable": True,
+            "AutoEnableStandards": "DEFAULT",
+        }
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_org_admin_no_auto_enable(self, operation_name, api_params):
+    """Mock organization admin configured but auto-enable disabled."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {
+            "AdminAccounts": [
+                {
+                    "AdminAccountId": "123456789012",
+                    "AdminStatus": "ENABLED",
+                }
+            ]
+        }
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {
+            "AutoEnable": False,
+            "AutoEnableStandards": "NONE",
+        }
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_no_org_admin(self, operation_name, api_params):
+    """Mock no organization admin configured."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {"AdminAccounts": []}
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {
+            "AutoEnable": False,
+            "AutoEnableStandards": "NONE",
+        }
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_securityhub_not_subscribed(self, operation_name, api_params):
+    """Simulate Security Hub not subscribed in the account (InvalidAccessException)."""
+    if operation_name == "DescribeHub":
+        raise botocore.exceptions.ClientError(
+            {
+                "Error": {
+                    "Code": "InvalidAccessException",
+                    "Message": "Account is not subscribed to AWS Security Hub",
+                }
+            },
+            operation_name,
+        )
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {"AdminAccounts": []}
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_admin_lookup_access_denied(self, operation_name, api_params):
+    """Hub is ACTIVE but ListOrganizationAdminAccounts is denied — lookup-failed path."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        raise botocore.exceptions.ClientError(
+            {
+                "Error": {
+                    "Code": "AccessDeniedException",
+                    "Message": "User is not authorized to perform: securityhub:ListOrganizationAdminAccounts",
+                }
+            },
+            operation_name,
+        )
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {"AutoEnable": True, "AutoEnableStandards": "DEFAULT"}
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_admin_lookup_unexpected(self, operation_name, api_params):
+    """ListOrganizationAdminAccounts raises a non-ClientError — bare Exception branch."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        raise RuntimeError("simulated transient error")
+    if operation_name == "DescribeOrganizationConfiguration":
+        return {"AutoEnable": True, "AutoEnableStandards": "DEFAULT"}
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_describe_org_config_other_client_error(
+    self, operation_name, api_params
+):
+    """DescribeOrganizationConfiguration raises a non-access ClientError — else branch."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {
+            "AdminAccounts": [
+                {"AdminAccountId": "123456789012", "AdminStatus": "ENABLED"}
+            ]
+        }
+    if operation_name == "DescribeOrganizationConfiguration":
+        raise botocore.exceptions.ClientError(
+            {"Error": {"Code": "InternalServerError", "Message": "boom"}},
+            operation_name,
+        )
+    return orig(self, operation_name, api_params)
+
+
+def mock_make_api_call_describe_org_config_unexpected(self, operation_name, api_params):
+    """DescribeOrganizationConfiguration raises a non-ClientError — bare Exception branch."""
+    hub_resp = _active_hub_responses(operation_name)
+    if hub_resp is not None:
+        return hub_resp
+    if operation_name == "ListOrganizationAdminAccounts":
+        return {
+            "AdminAccounts": [
+                {"AdminAccountId": "123456789012", "AdminStatus": "ENABLED"}
+            ]
+        }
+    if operation_name == "DescribeOrganizationConfiguration":
+        raise RuntimeError("simulated transient error")
+    return orig(self, operation_name, api_params)
+
+
+class Test_securityhub_delegated_admin_enabled_all_regions:
+    def teardown_method(self):
+        """Evict cached securityhub modules so legacy mock.patch-based tests
+        in the same session see a fresh import path."""
+        import sys
+
+        for mod in (
+            "prowler.providers.aws.services.securityhub.securityhub_client",
+            "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions",
+        ):
+            sys.modules.pop(mod, None)
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_securityhub_not_subscribed,
+    )
+    @mock_aws
+    def test_no_securityhub(self):
+        """Test when Security Hub is not subscribed in any region."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            # Should have findings for each region (with NOT_AVAILABLE hubs)
+            assert len(result) > 0
+            # All should fail since hub is not enabled
+            for finding in result:
+                assert finding.status == "FAIL"
+                assert "Security Hub not enabled" in finding.status_extended
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_no_org_admin,
+    )
+    @mock_aws
+    def test_securityhub_enabled_no_delegated_admin(self):
+        """Test when Security Hub is enabled but no delegated admin is configured."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            eu_west_1_result = None
+            for finding in result:
+                if finding.region == AWS_REGION_EU_WEST_1:
+                    eu_west_1_result = finding
+                    break
+
+            assert eu_west_1_result is not None
+            assert eu_west_1_result.status == "FAIL"
+            assert (
+                "no delegated administrator configured"
+                in eu_west_1_result.status_extended
+            )
+            assert eu_west_1_result.resource_arn == HUB_ARN
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_org_admin_no_auto_enable,
+    )
+    @mock_aws
+    def test_securityhub_enabled_with_admin_no_auto_enable(self):
+        """Test when Security Hub is enabled with delegated admin but auto-enable is off."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            eu_west_1_result = None
+            for finding in result:
+                if finding.region == AWS_REGION_EU_WEST_1:
+                    eu_west_1_result = finding
+                    break
+
+            assert eu_west_1_result is not None
+            assert eu_west_1_result.status == "FAIL"
+            assert (
+                "organization auto-enable not configured"
+                in eu_west_1_result.status_extended
+            )
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_org_admin_and_config,
+    )
+    @mock_aws
+    def test_securityhub_enabled_with_admin_and_auto_enable(self):
+        """Test when Security Hub is enabled with delegated admin and auto-enable on (PASS)."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            eu_west_1_result = None
+            for finding in result:
+                if finding.region == AWS_REGION_EU_WEST_1:
+                    eu_west_1_result = finding
+                    break
+
+            assert eu_west_1_result is not None
+            assert eu_west_1_result.status == "PASS"
+            assert "delegated admin configured" in eu_west_1_result.status_extended
+            assert "auto-enable" in eu_west_1_result.status_extended
+            assert eu_west_1_result.resource_arn == HUB_ARN
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_admin_lookup_access_denied,
+    )
+    @mock_aws
+    def test_admin_lookup_access_denied(self):
+        """AccessDenied on ListOrganizationAdminAccounts must FAIL with unknown-admin message."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=SecurityHub(aws_provider),
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            check = securityhub_delegated_admin_enabled_all_regions()
+            result = check.execute()
+
+            eu_west_1_result = None
+            for finding in result:
+                if finding.region == AWS_REGION_EU_WEST_1:
+                    eu_west_1_result = finding
+                    break
+
+            assert eu_west_1_result is not None
+            assert eu_west_1_result.status == "FAIL"
+            assert (
+                "delegated administrator status could not be determined"
+                in eu_west_1_result.status_extended
+            )
+            assert (
+                "no delegated administrator configured"
+                not in eu_west_1_result.status_extended
+            )
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_admin_lookup_unexpected,
+    )
+    @mock_aws
+    def test_admin_lookup_unexpected_exception(self):
+        """Non-ClientError raised from ListOrganizationAdminAccounts still sets lookup_failed."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        service = SecurityHub(aws_provider)
+        assert service.organization_admin_lookup_failed is True
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=service,
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            result = securityhub_delegated_admin_enabled_all_regions().execute()
+            assert result and result[0].status == "FAIL"
+            assert (
+                "delegated administrator status could not be determined"
+                in result[0].status_extended
+            )
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_describe_org_config_other_client_error,
+    )
+    @mock_aws
+    def test_describe_org_config_other_client_error(self):
+        """Non-access ClientError on DescribeOrganizationConfiguration is logged at error level."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        service = SecurityHub(aws_provider)
+        # organization_config_available stays False, so the auto-enable issue is suppressed
+        assert service.securityhubs[0].organization_config_available is False
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=service,
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            result = securityhub_delegated_admin_enabled_all_regions().execute()
+            # Admin is configured and hub is active; with org config unavailable the
+            # check should PASS because there are no other detectable issues.
+            assert result and result[0].status == "PASS"
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call",
+        new=mock_make_api_call_describe_org_config_unexpected,
+    )
+    @mock_aws
+    def test_describe_org_config_unexpected_exception(self):
+        """Non-ClientError on DescribeOrganizationConfiguration is caught by bare except."""
+        aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+        from prowler.providers.aws.services.securityhub.securityhub_service import (
+            SecurityHub,
+        )
+
+        service = SecurityHub(aws_provider)
+        assert service.securityhubs[0].organization_config_available is False
+
+        with (
+            patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            patch(
+                "prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions.securityhub_client",
+                new=service,
+            ),
+        ):
+            from prowler.providers.aws.services.securityhub.securityhub_delegated_admin_enabled_all_regions.securityhub_delegated_admin_enabled_all_regions import (
+                securityhub_delegated_admin_enabled_all_regions,
+            )
+
+            result = securityhub_delegated_admin_enabled_all_regions().execute()
+            assert result and result[0].status == "PASS"

From 65f00a197bbbe203f068d854d24935f2265deb3d Mon Sep 17 00:00:00 2001
From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
Date: Thu, 11 Jun 2026 17:32:28 +0200
Subject: [PATCH 017/126] fix(api): normalize OCI scan region credentials
 (#11558)

---
 api/CHANGELOG.md                        |  8 ++++++++
 api/src/backend/api/tests/test_utils.py | 24 ++++++++++++++++++++++++
 api/src/backend/api/utils.py            |  6 ++++++
 3 files changed, 38 insertions(+)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 8f3585fd20..1756fe83a4 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
+## [1.31.1] (Prowler UNRELEASED)
+
+### 🐞 Fixed
+
+- OCI scans now use API key credentials with the configured region instead of falling back to `/home/prowler/.oci/config` [(#11558)](https://github.com/prowler-cloud/prowler/pull/11558)
+
+---
+
 ## [1.31.0] (Prowler v5.30.0)
 
 ### 🚀 Added
diff --git a/api/src/backend/api/tests/test_utils.py b/api/src/backend/api/tests/test_utils.py
index 3a7f030a9c..3fd9235dac 100644
--- a/api/src/backend/api/tests/test_utils.py
+++ b/api/src/backend/api/tests/test_utils.py
@@ -357,6 +357,30 @@ class TestGetProwlerProviderKwargs:
         expected_result = {**secret_dict, **expected_extra_kwargs}
         assert result == expected_result
 
+    def test_get_prowler_provider_kwargs_oraclecloud_converts_region_string_to_set(
+        self,
+    ):
+        secret_dict = {
+            "user": "ocid1.user.oc1..fake",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----",
+            "tenancy": "ocid1.tenancy.oc1..fake",
+            "region": "us-ashburn-1",
+            "pass_phrase": "fake-passphrase",
+        }
+        secret_mock = MagicMock()
+        secret_mock.secret = secret_dict
+
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret = secret_mock
+        provider.uid = "ocid1.tenancy.oc1..fake"
+
+        result = get_prowler_provider_kwargs(provider)
+
+        expected_result = {**secret_dict, "region": {"us-ashburn-1"}}
+        assert result == expected_result
+
     def test_get_prowler_provider_kwargs_with_mutelist(self):
         provider_uid = "provider_uid"
         secret_dict = {"key": "value"}
diff --git a/api/src/backend/api/utils.py b/api/src/backend/api/utils.py
index 8da8d91226..678ed24772 100644
--- a/api/src/backend/api/utils.py
+++ b/api/src/backend/api/utils.py
@@ -243,6 +243,12 @@ def get_prowler_provider_kwargs(
             **prowler_provider_kwargs,
             "filter_accounts": [provider.uid],
         }
+    elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+        if isinstance(prowler_provider_kwargs.get("region"), str):
+            prowler_provider_kwargs = {
+                **prowler_provider_kwargs,
+                "region": {prowler_provider_kwargs["region"]},
+            }
     elif provider.provider == Provider.ProviderChoices.OPENSTACK.value:
         # clouds_yaml_content, clouds_yaml_cloud and provider_id are validated
         # in the provider itself, so it's not needed here.

From bba594a1db82d0cd13610b815e8be0c4739d4776 Mon Sep 17 00:00:00 2001
From: Oleksandr_Sanin <alexaaander.sanin@gmail.com>
Date: Thu, 11 Jun 2026 17:40:41 +0200
Subject: [PATCH 018/126] feat(aws/sagemaker): add sagemaker_clarify_exists
 check (#11211)

Signed-off-by: Oleksandr Sanin <alexaaander.sanin@gmail.com>
Signed-off-by: Oleksandr Yizchak Sanin <alexaaander.sanin@gmail.com>
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../sagemaker_clarify_exists/__init__.py      |   0
 .../sagemaker_clarify_exists.metadata.json    |  39 +++
 .../sagemaker_clarify_exists.py               |  54 ++++
 .../services/sagemaker/sagemaker_service.py   |  88 +++++++
 .../sagemaker_clarify_exists_test.py          | 247 ++++++++++++++++++
 .../sagemaker/sagemaker_service_test.py       |   4 +-
 7 files changed, 431 insertions(+), 2 deletions(-)
 create mode 100644 prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/__init__.py
 create mode 100644 prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.metadata.json
 create mode 100644 prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.py
 create mode 100644 tests/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 62fbb35d30..eb81a58378 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -8,6 +8,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 - `securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
 - `config_delegated_admin_and_org_aggregator_all_regions` check for AWS provider, verifying that AWS Config has a delegated administrator and an organization aggregator covering all AWS regions [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
+- `sagemaker_clarify_exists` check for AWS provider [(#11211)](https://github.com/prowler-cloud/prowler/pull/11211)
 
 ---
 
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/__init__.py b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.metadata.json b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.metadata.json
new file mode 100644
index 0000000000..0e127a7759
--- /dev/null
+++ b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.metadata.json
@@ -0,0 +1,39 @@
+{
+  "Provider": "aws",
+  "CheckID": "sagemaker_clarify_exists",
+  "CheckTitle": "Amazon SageMaker Clarify processing jobs exist in the region",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "sagemaker",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "Other",
+  "ResourceGroup": "ai_ml",
+  "Description": "**SageMaker Clarify** provides bias detection and model explainability for ML workloads.\n\nThis check verifies that at least one SageMaker processing job using the AWS-managed Clarify container image exists in each successfully scanned region. The absence of Clarify jobs indicates that responsible-AI controls such as bias detection and explainability are not in place.",
+  "Risk": "Without **SageMaker Clarify** processing jobs, ML models may be deployed without bias analysis or explainability reports. This can lead to:\n- **Regulatory non-compliance** with AI governance frameworks\n- **Undetected bias** in model predictions affecting protected groups\n- **Lack of accountability** for ML model decisions in production",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/sagemaker/latest/dg/clarify-configure-processing-jobs.html",
+    "https://docs.aws.amazon.com/sagemaker/latest/dg-ecr-paths/sagemaker-algo-docker-registry-paths.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws sagemaker create-processing-job --processing-job-name clarify-bias-check --app-specification ImageUri=<clarify-image-uri> --role-arn <role-arn> --processing-resources 'ClusterConfig={InstanceCount=1,InstanceType=ml.m5.xlarge,VolumeSizeInGB=20}'",
+      "NativeIaC": "",
+      "Other": "1. Open the AWS Console and go to Amazon SageMaker\n2. Navigate to Processing > Processing jobs\n3. Click Create processing job\n4. Select the SageMaker Clarify container image for your region\n5. Configure input/output paths and the analysis configuration\n6. Click Create processing job",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Create SageMaker Clarify processing jobs to evaluate models for bias and explainability before deployment. Integrate Clarify into your ML pipeline to ensure responsible AI practices.",
+      "Url": "https://hub.prowler.com/check/sagemaker_clarify_exists"
+    }
+  },
+  "Categories": [
+    "gen-ai"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Results are generated per scanned region. Regions where `ListProcessingJobs` cannot be queried are omitted from the findings."
+}
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.py b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.py
new file mode 100644
index 0000000000..9c559613d3
--- /dev/null
+++ b/prowler/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists.py
@@ -0,0 +1,54 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.sagemaker.sagemaker_client import sagemaker_client
+
+
+class sagemaker_clarify_exists(Check):
+    """Check whether at least one SageMaker Clarify processing job exists per region.
+
+    A region is reported only when ListProcessingJobs succeeded for it; regions
+    where the API call failed (e.g. AccessDenied, unsupported region) are
+    skipped at the service layer and produce no finding.
+
+    - PASS: At least one processing job uses the AWS-managed Clarify container
+      image in the region (one finding per job).
+    - FAIL: No processing job uses the Clarify container image in the region
+      (one finding per region).
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the SageMaker Clarify exists check.
+
+        Returns:
+            A list of reports containing the result of the check.
+        """
+        findings = []
+        for region in sorted(sagemaker_client.processing_jobs_scanned_regions):
+            clarify_jobs = sorted(
+                (
+                    job
+                    for job in sagemaker_client.sagemaker_processing_jobs
+                    if job.region == region
+                    and job.image_uri
+                    and "sagemaker-clarify-processing" in job.image_uri
+                ),
+                key=lambda job: job.name,
+            )
+
+            if clarify_jobs:
+                for job in clarify_jobs:
+                    report = Check_Report_AWS(metadata=self.metadata(), resource=job)
+                    report.status = "PASS"
+                    report.status_extended = f"SageMaker Clarify processing job {job.name} exists in region {region}."
+                    findings.append(report)
+            else:
+                report = Check_Report_AWS(metadata=self.metadata(), resource={})
+                report.region = region
+                report.resource_id = "sagemaker-clarify"
+                report.resource_arn = f"arn:{sagemaker_client.audited_partition}:sagemaker:{region}:{sagemaker_client.audited_account}:processing-job"
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"No SageMaker Clarify processing jobs found in region {region}."
+                )
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/sagemaker/sagemaker_service.py b/prowler/providers/aws/services/sagemaker/sagemaker_service.py
index 5093a4ac02..20ea4c0280 100644
--- a/prowler/providers/aws/services/sagemaker/sagemaker_service.py
+++ b/prowler/providers/aws/services/sagemaker/sagemaker_service.py
@@ -15,6 +15,8 @@ class SageMaker(AWSService):
         self.sagemaker_notebook_instances = []
         self.sagemaker_models = []
         self.sagemaker_training_jobs = []
+        self.sagemaker_processing_jobs = []
+        self.processing_jobs_scanned_regions = set()
         self.sagemaker_domains = []
         self.endpoint_configs = {}
         self.sagemaker_model_registries = []
@@ -24,6 +26,7 @@ class SageMaker(AWSService):
         self.__threading_call__(self._list_notebook_instances)
         self.__threading_call__(self._list_models)
         self.__threading_call__(self._list_training_jobs)
+        self.__threading_call__(self._list_processing_jobs)
         self.__threading_call__(self._list_endpoint_configs)
         self.__threading_call__(self._list_domains)
         self.__threading_call__(self._list_model_package_groups)
@@ -37,6 +40,9 @@ class SageMaker(AWSService):
         self.__threading_call__(
             self._describe_training_job, self.sagemaker_training_jobs
         )
+        self.__threading_call__(
+            self._describe_processing_job, self.sagemaker_processing_jobs
+        )
         self.__threading_call__(
             self._describe_endpoint_config, list(self.endpoint_configs.values())
         )
@@ -51,6 +57,9 @@ class SageMaker(AWSService):
         self.__threading_call__(
             self._list_tags_for_resource, self.sagemaker_training_jobs
         )
+        self.__threading_call__(
+            self._list_tags_for_resource, self.sagemaker_processing_jobs
+        )
         self.__threading_call__(
             self._list_tags_for_resource, list(self.endpoint_configs.values())
         )
@@ -128,6 +137,66 @@ class SageMaker(AWSService):
                 f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    def _list_processing_jobs(self, regional_client):
+        """List SageMaker processing jobs in a region.
+
+        Populates ``self.sagemaker_processing_jobs`` with `ProcessingJob`
+        entries and adds ``regional_client.region`` to
+        ``self.processing_jobs_scanned_regions`` once pagination succeeds, so
+        regions where ``ListProcessingJobs`` fails are skipped by checks that
+        consume that set.
+
+        Args:
+            regional_client: Regional SageMaker boto3 client.
+        """
+        logger.info("SageMaker - listing processing jobs...")
+        try:
+            list_processing_jobs_paginator = regional_client.get_paginator(
+                "list_processing_jobs"
+            )
+            for page in list_processing_jobs_paginator.paginate():
+                for processing_job in page["ProcessingJobSummaries"]:
+                    if not self.audit_resources or (
+                        is_resource_filtered(
+                            processing_job["ProcessingJobArn"], self.audit_resources
+                        )
+                    ):
+                        self.sagemaker_processing_jobs.append(
+                            ProcessingJob(
+                                name=processing_job["ProcessingJobName"],
+                                region=regional_client.region,
+                                arn=processing_job["ProcessingJobArn"],
+                            )
+                        )
+            self.processing_jobs_scanned_regions.add(regional_client.region)
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def _describe_processing_job(self, processing_job):
+        """Describe a SageMaker processing job and enrich its image metadata.
+
+        Reads ``AppSpecification.ImageUri`` from ``DescribeProcessingJob`` and
+        stores it on ``processing_job.image_uri``. Errors are logged and
+        swallowed so a failure in one job does not abort the scan.
+
+        Args:
+            processing_job: ProcessingJob model to enrich in-place.
+        """
+        logger.info("SageMaker - describing processing job...")
+        try:
+            regional_client = self.regional_clients[processing_job.region]
+            describe_processing_job = regional_client.describe_processing_job(
+                ProcessingJobName=processing_job.name
+            )
+            app_spec = describe_processing_job.get("AppSpecification", {})
+            processing_job.image_uri = app_spec.get("ImageUri")
+        except Exception as error:
+            logger.error(
+                f"{processing_job.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
     def _describe_notebook_instance(self, notebook_instance):
         logger.info("SageMaker - describing notebook instances...")
         try:
@@ -451,6 +520,25 @@ class TrainingJob(BaseModel):
     tags: Optional[list] = []
 
 
+class ProcessingJob(BaseModel):
+    """Represents a SageMaker processing job.
+
+    Attributes:
+        name: Processing job name.
+        region: AWS region where the job lives.
+        arn: Processing job ARN.
+        image_uri: Container image URI from `AppSpecification.ImageUri`,
+            populated by `_describe_processing_job`.
+        tags: Resource tags, populated by `_list_tags_for_resource`.
+    """
+
+    name: str
+    region: str
+    arn: str
+    image_uri: Optional[str] = None
+    tags: Optional[list] = []
+
+
 class ProductionVariant(BaseModel):
     name: str
     initial_instance_count: int
diff --git a/tests/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists_test.py b/tests/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists_test.py
new file mode 100644
index 0000000000..32f5487100
--- /dev/null
+++ b/tests/providers/aws/services/sagemaker/sagemaker_clarify_exists/sagemaker_clarify_exists_test.py
@@ -0,0 +1,247 @@
+from unittest import mock
+
+from prowler.providers.aws.services.sagemaker.sagemaker_service import ProcessingJob
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_EU_WEST_1,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+CLARIFY_IMAGE_URI = f"{AWS_ACCOUNT_NUMBER}.dkr.ecr.{AWS_REGION_US_EAST_1}.amazonaws.com/sagemaker-clarify-processing:1.0"
+NON_CLARIFY_IMAGE_URI = f"{AWS_ACCOUNT_NUMBER}.dkr.ecr.{AWS_REGION_US_EAST_1}.amazonaws.com/sagemaker-xgboost:1.0"
+CUSTOM_CLARIFY_IMAGE_URI = f"{AWS_ACCOUNT_NUMBER}.dkr.ecr.{AWS_REGION_US_EAST_1}.amazonaws.com/my-clarify-thing:1.0"
+PROCESSING_JOB_ARN = f"arn:aws:sagemaker:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:processing-job/clarify-job"
+
+
+class Test_sagemaker_clarify_exists:
+    def test_no_processing_jobs_no_scanned_regions(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = []
+        sagemaker_client.processing_jobs_scanned_regions = set()
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_no_processing_jobs_region_scanned(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = []
+        sagemaker_client.processing_jobs_scanned_regions = {AWS_REGION_US_EAST_1}
+        sagemaker_client.audited_partition = "aws"
+        sagemaker_client.audited_account = AWS_ACCOUNT_NUMBER
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"No SageMaker Clarify processing jobs found in region {AWS_REGION_US_EAST_1}."
+            )
+            assert result[0].resource_id == "sagemaker-clarify"
+
+    def test_non_clarify_processing_job(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = [
+            ProcessingJob(
+                name="xgboost-job",
+                arn=f"arn:aws:sagemaker:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:processing-job/xgboost-job",
+                region=AWS_REGION_US_EAST_1,
+                image_uri=NON_CLARIFY_IMAGE_URI,
+            )
+        ]
+        sagemaker_client.processing_jobs_scanned_regions = {AWS_REGION_US_EAST_1}
+        sagemaker_client.audited_partition = "aws"
+        sagemaker_client.audited_account = AWS_ACCOUNT_NUMBER
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"No SageMaker Clarify processing jobs found in region {AWS_REGION_US_EAST_1}."
+            )
+
+    def test_custom_image_with_clarify_in_name_does_not_match(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = [
+            ProcessingJob(
+                name="my-clarify-thing-job",
+                arn=f"arn:aws:sagemaker:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:processing-job/my-clarify-thing-job",
+                region=AWS_REGION_US_EAST_1,
+                image_uri=CUSTOM_CLARIFY_IMAGE_URI,
+            )
+        ]
+        sagemaker_client.processing_jobs_scanned_regions = {AWS_REGION_US_EAST_1}
+        sagemaker_client.audited_partition = "aws"
+        sagemaker_client.audited_account = AWS_ACCOUNT_NUMBER
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"No SageMaker Clarify processing jobs found in region {AWS_REGION_US_EAST_1}."
+            )
+
+    def test_clarify_processing_job_exists(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = [
+            ProcessingJob(
+                name="clarify-job",
+                arn=PROCESSING_JOB_ARN,
+                region=AWS_REGION_US_EAST_1,
+                image_uri=CLARIFY_IMAGE_URI,
+            )
+        ]
+        sagemaker_client.processing_jobs_scanned_regions = {AWS_REGION_US_EAST_1}
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"SageMaker Clarify processing job clarify-job exists in region {AWS_REGION_US_EAST_1}."
+            )
+            assert result[0].resource_id == "clarify-job"
+            assert result[0].resource_arn == PROCESSING_JOB_ARN
+
+    def test_mixed_regions(self):
+        sagemaker_client = mock.MagicMock
+        sagemaker_client.sagemaker_processing_jobs = [
+            ProcessingJob(
+                name="clarify-job",
+                arn=PROCESSING_JOB_ARN,
+                region=AWS_REGION_US_EAST_1,
+                image_uri=CLARIFY_IMAGE_URI,
+            )
+        ]
+        sagemaker_client.processing_jobs_scanned_regions = {
+            AWS_REGION_US_EAST_1,
+            AWS_REGION_EU_WEST_1,
+        }
+        sagemaker_client.audited_partition = "aws"
+        sagemaker_client.audited_account = AWS_ACCOUNT_NUMBER
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1]
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists.sagemaker_client",
+                sagemaker_client,
+            ),
+        ):
+            from prowler.providers.aws.services.sagemaker.sagemaker_clarify_exists.sagemaker_clarify_exists import (
+                sagemaker_clarify_exists,
+            )
+
+            check = sagemaker_clarify_exists()
+            result = check.execute()
+
+            assert len(result) == 2
+
+            results_by_region = {r.region: r for r in result}
+
+            us_result = results_by_region[AWS_REGION_US_EAST_1]
+            assert us_result.status == "PASS"
+            assert (
+                us_result.status_extended
+                == f"SageMaker Clarify processing job clarify-job exists in region {AWS_REGION_US_EAST_1}."
+            )
+
+            eu_result = results_by_region[AWS_REGION_EU_WEST_1]
+            assert eu_result.status == "FAIL"
+            assert (
+                eu_result.status_extended
+                == f"No SageMaker Clarify processing jobs found in region {AWS_REGION_EU_WEST_1}."
+            )
diff --git a/tests/providers/aws/services/sagemaker/sagemaker_service_test.py b/tests/providers/aws/services/sagemaker/sagemaker_service_test.py
index d49a506fd9..50431c2e13 100644
--- a/tests/providers/aws/services/sagemaker/sagemaker_service_test.py
+++ b/tests/providers/aws/services/sagemaker/sagemaker_service_test.py
@@ -396,13 +396,13 @@ class Test_SageMaker_Service:
                 sagemaker_service = SageMaker(audit_info)
 
                 # Check that __threading_call__ was called for _list_tags_for_resource
-                # (one for each resource type: models, notebooks, training jobs, endpoint configs, domains)
+                # (one for each resource type: models, notebooks, training jobs, processing jobs, endpoint configs, domains)
                 tag_calls = [
                     c
                     for c in mock_threading_call.call_args_list
                     if c[0][0] == sagemaker_service._list_tags_for_resource
                 ]
-                assert len(tag_calls) == 5
+                assert len(tag_calls) == 6
 
     # Test SageMaker list model package groups
     def test_list_model_package_groups(self):

From 20eca787676c44f383799d1700864c7d5f1a2115 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Thu, 11 Jun 2026 18:00:36 +0200
Subject: [PATCH 019/126] fix(compliance): resolve provider from scan in
 attributes endp (#11546)

---
 api/CHANGELOG.md                              |   1 +
 api/src/backend/api/tests/test_views.py       | 182 ++++++++++++++++++
 api/src/backend/api/v1/views.py               |  57 +++++-
 ui/CHANGELOG.md                               |   8 +
 ui/actions/compliances/compliances.ts         |  11 +-
 .../compliance/[compliancetitle]/page.tsx     |   2 +-
 6 files changed, 258 insertions(+), 3 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 1756fe83a4..fc367813f7 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ### 🐞 Fixed
 
+- `compliance-overviews/attributes` now resolves the provider from the scan, so multi-provider universal frameworks (e.g. CSA CCM) return the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
 - OCI scans now use API key credentials with the configured region instead of falling back to `/home/prowler/.oci/config` [(#11558)](https://github.com/prowler-cloud/prowler/pull/11558)
 
 ---
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index ab90bdbde0..410bd23e19 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -9570,6 +9570,188 @@ class TestComplianceOverviewViewSet:
             assert "Category" in first_attr
             assert "AWSService" in first_attr
 
+    def test_compliance_overview_attributes_resolves_provider_from_scan(
+        self, authenticated_client, tenants_fixture, providers_fixture
+    ):
+        # csa_ccm_4.0 is a multi-provider universal framework: a single
+        # compliance_id whose requirements expose different checks per provider.
+        # Passing a scan must return the check IDs for that scan's provider,
+        # otherwise the endpoint defaults to the first provider that declares the
+        # framework and azure/gcp requirements end up with check IDs that match
+        # no findings.
+        tenant = tenants_fixture[0]
+        gcp_provider = providers_fixture[2]
+        azure_provider = providers_fixture[4]
+        assert gcp_provider.provider == Provider.ProviderChoices.GCP.value
+        assert azure_provider.provider == Provider.ProviderChoices.AZURE.value
+
+        now = datetime.now(timezone.utc)
+        gcp_scan = Scan.objects.create(
+            name="gcp scan",
+            provider=gcp_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+        azure_scan = Scan.objects.create(
+            name="azure scan",
+            provider=azure_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+
+        def request_attributes(scan_id=None):
+            params = {"filter[compliance_id]": "csa_ccm_4.0"}
+            if scan_id is not None:
+                params["filter[scan_id]"] = str(scan_id)
+            return authenticated_client.get(
+                reverse("complianceoverview-attributes"), params
+            )
+
+        def collect_check_ids(scan_id=None):
+            response = request_attributes(scan_id)
+            assert response.status_code == status.HTTP_200_OK
+            check_ids = set()
+            for item in response.json()["data"]:
+                check_ids.update(item["attributes"]["attributes"]["check_ids"])
+            return check_ids
+
+        gcp_check_ids = collect_check_ids(gcp_scan.id)
+        azure_check_ids = collect_check_ids(azure_scan.id)
+
+        # Each scan resolves to its own provider's checks, and they differ.
+        assert gcp_check_ids
+        assert azure_check_ids
+        assert gcp_check_ids != azure_check_ids
+
+        # The returned check IDs belong to the SDK's per-provider definition.
+        from api.compliance import get_prowler_provider_compliance
+
+        def expected_check_ids(provider_type):
+            framework = get_prowler_provider_compliance(provider_type)["csa_ccm_4.0"]
+            expected = set()
+            for requirement in framework.requirements:
+                expected.update(requirement.checks.get(provider_type, []))
+            return expected
+
+        assert gcp_check_ids <= expected_check_ids(Provider.ProviderChoices.GCP.value)
+        assert azure_check_ids <= expected_check_ids(
+            Provider.ProviderChoices.AZURE.value
+        )
+
+        # An explicit scan_id is authoritative: a non-existent scan must fail
+        # closed with 404 instead of silently falling back to another provider.
+        missing_response = request_attributes("00000000-0000-0000-0000-000000000000")
+        assert missing_response.status_code == status.HTTP_404_NOT_FOUND
+
+        # A malformed scan_id is rejected with 404 as well.
+        malformed_response = request_attributes("not-a-uuid")
+        assert malformed_response.status_code == status.HTTP_404_NOT_FOUND
+
+        # An empty value (filter[scan_id]=) must not fall back to the legacy
+        # provider picker: the explicit (if blank) selector fails closed.
+        empty_response = request_attributes("")
+        assert empty_response.status_code == status.HTTP_404_NOT_FOUND
+
+        # A scan belonging to another tenant is not visible (RLS), so it must
+        # return 404 rather than leaking the fallback provider's check IDs.
+        other_tenant = Tenant.objects.create(name="Other Compliance Tenant")
+        foreign_provider = Provider.objects.create(
+            provider="gcp",
+            uid="foreign-gcp-test",
+            alias="foreign_gcp",
+            tenant_id=other_tenant.id,
+        )
+        foreign_scan = Scan.objects.create(
+            name="foreign scan",
+            provider=foreign_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=other_tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+        foreign_response = request_attributes(foreign_scan.id)
+        assert foreign_response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_compliance_overview_attributes_scan_scoped_by_provider_group(
+        self,
+        authenticated_client_no_permissions_rbac,
+        providers_fixture,
+    ):
+        # A user with limited visibility (no UNLIMITED_VISIBILITY) must only be
+        # able to resolve scans for providers in its provider groups. Tenant RLS
+        # alone is not enough here: both scans belong to the same tenant, so the
+        # endpoint has to scope the scan lookup by provider group, otherwise a
+        # restricted user could read another provider's compliance metadata.
+        client = authenticated_client_no_permissions_rbac
+        limited_user = client.user
+        membership = Membership.objects.filter(user=limited_user).first()
+        tenant = membership.tenant
+
+        allowed_provider = providers_fixture[2]
+        denied_provider = providers_fixture[4]
+        assert allowed_provider.provider == Provider.ProviderChoices.GCP.value
+        assert denied_provider.provider == Provider.ProviderChoices.AZURE.value
+
+        provider_group = ProviderGroup.objects.create(
+            name="limited-compliance-group",
+            tenant_id=tenant.id,
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id,
+            provider_group=provider_group,
+            provider=allowed_provider,
+        )
+        RoleProviderGroupRelationship.objects.create(
+            tenant_id=tenant.id,
+            role=limited_user.roles.first(),
+            provider_group=provider_group,
+        )
+
+        now = datetime.now(timezone.utc)
+        allowed_scan = Scan.objects.create(
+            name="allowed scan",
+            provider=allowed_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+        denied_scan = Scan.objects.create(
+            name="denied scan",
+            provider=denied_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=tenant.id,
+            started_at=now,
+            completed_at=now,
+        )
+
+        def request_attributes(scan_id):
+            return client.get(
+                reverse("complianceoverview-attributes"),
+                {
+                    "filter[compliance_id]": "csa_ccm_4.0",
+                    "filter[scan_id]": str(scan_id),
+                },
+            )
+
+        # The scan in the user's provider group resolves normally.
+        assert request_attributes(allowed_scan.id).status_code == status.HTTP_200_OK
+
+        # The scan outside the user's provider group is invisible, so it fails
+        # closed with 404 instead of leaking the other provider's check IDs.
+        assert (
+            request_attributes(denied_scan.id).status_code == status.HTTP_404_NOT_FOUND
+        )
+
     def test_compliance_overview_attributes_missing_compliance_id(
         self, authenticated_client
     ):
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 45100f1018..0942adc8e1 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -30,6 +30,7 @@ from dj_rest_auth.registration.views import SocialLoginView
 from django.conf import settings as django_settings
 from django.contrib.postgres.aggregates import ArrayAgg, BoolAnd, StringAgg
 from django.contrib.postgres.search import SearchQuery
+from django.core.exceptions import ValidationError as DjangoValidationError
 from django.db import transaction
 from django.db.models import (
     BooleanField,
@@ -4644,6 +4645,16 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
                 location=OpenApiParameter.QUERY,
                 description="Compliance framework ID to get attributes for.",
             ),
+            OpenApiParameter(
+                name="filter[scan_id]",
+                required=False,
+                type=OpenApiTypes.UUID,
+                location=OpenApiParameter.QUERY,
+                description="Scan ID used to resolve the provider for "
+                "multi-provider universal frameworks (e.g. CSA CCM), so "
+                "the returned check IDs match the scan's provider. When omitted, "
+                "the first provider that declares the framework is used.",
+            ),
         ],
         responses={
             200: OpenApiResponse(
@@ -5084,7 +5095,51 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
         provider_type = None
 
-        # If we couldn't determine from database, try each provider type
+        # When a scan is provided, resolve the provider from it. Multi-provider
+        # universal frameworks (e.g. CSA CCM) share a single compliance_id
+        # across providers but expose different checks per provider, so the
+        # metadata (and therefore the check IDs the UI uses to fetch findings)
+        # must be returned for the scan's provider. Without this, the endpoint
+        # falls back to the first provider that declares the framework and
+        # returns its check IDs, leaving azure/gcp/... requirements with no
+        # matching findings.
+        scan_id = request.query_params.get("filter[scan_id]")
+        if "filter[scan_id]" in request.query_params:
+            # An explicit scan_id is authoritative: fail closed instead of
+            # falling back to another provider. Otherwise an invalid, empty
+            # (filter[scan_id]=) or inaccessible scan would silently return the
+            # first provider's check IDs, recreating the multi-provider mismatch
+            # this endpoint fixes.
+            if not scan_id:
+                raise NotFound(detail=f"Scan '{scan_id}' not found.")
+
+            # Tenant isolation is already enforced by Postgres RLS on the
+            # connection (see BaseRLSViewSet). Scope the lookup by provider
+            # group as well so a user with limited visibility can't resolve
+            # another provider's scan and read its compliance metadata, mirroring
+            # the RBAC scoping get_queryset() applies to the rest of the ViewSet.
+            role = get_role(request.user, request.tenant_id)
+            if getattr(role, Permissions.UNLIMITED_VISIBILITY.value, False):
+                scan_queryset = Scan.objects.filter(tenant_id=request.tenant_id)
+            else:
+                scan_queryset = Scan.objects.filter(provider__in=get_providers(role))
+
+            try:
+                scan = scan_queryset.select_related("provider").get(id=scan_id)
+            except (Scan.DoesNotExist, DjangoValidationError, ValueError):
+                raise NotFound(detail=f"Scan '{scan_id}' not found.")
+
+            provider_type = scan.provider.provider
+            if compliance_id not in get_compliance_frameworks(provider_type):
+                raise NotFound(
+                    detail=(
+                        f"Compliance framework '{compliance_id}' is not "
+                        f"available for scan '{scan_id}'."
+                    )
+                )
+
+        # Fall back to the first provider that declares the framework. Keeps the
+        # endpoint working for provider-agnostic callers that omit the scan.
         if not provider_type:
             for pt in Provider.ProviderChoices.values:
                 if compliance_id in get_compliance_frameworks(pt):
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 67a0a59e5d..277fabb5b0 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to the **Prowler UI** are documented in this file.
 
+## [1.30.1] (Prowler UNRELEASED)
+
+### 🐞 Fixed
+
+- Compliance attributes requests now pass the selected scan, so multi-provider universal frameworks (e.g. CSA CCM) load the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
+
+---
+
 ## [1.30.0] (Prowler v5.30.0)
 
 ### 🚀 Added
diff --git a/ui/actions/compliances/compliances.ts b/ui/actions/compliances/compliances.ts
index 58e7c5b5a0..e06b06d29d 100644
--- a/ui/actions/compliances/compliances.ts
+++ b/ui/actions/compliances/compliances.ts
@@ -73,12 +73,21 @@ export const getComplianceOverviewMetadataInfo = async ({
   }
 };
 
-export const getComplianceAttributes = async (complianceId: string) => {
+export const getComplianceAttributes = async (
+  complianceId: string,
+  scanId?: string,
+) => {
   const headers = await getAuthHeaders({ contentType: false });
 
   try {
     const url = new URL(`${apiBaseUrl}/compliance-overviews/attributes`);
     url.searchParams.append("filter[compliance_id]", complianceId);
+    // Pass the scan so multi-provider universal frameworks (e.g. CSA CCM)
+    // resolve the check IDs for the scan's provider instead of defaulting to
+    // the first provider that declares the framework.
+    if (scanId) {
+      url.searchParams.append("filter[scan_id]", scanId);
+    }
 
     const response = await fetch(url.toString(), {
       headers,
diff --git a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
index 445710e48f..f5d42f8bc8 100644
--- a/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
+++ b/ui/app/(prowler)/compliance/[compliancetitle]/page.tsx
@@ -87,7 +87,7 @@ export default async function ComplianceDetail({
           "filter[scan_id]": selectedScanId ?? undefined,
         },
       }),
-      getComplianceAttributes(complianceId),
+      getComplianceAttributes(complianceId, selectedScanId ?? undefined),
       selectedScanId
         ? getScan(selectedScanId, { include: "provider" })
         : Promise.resolve(null),

From a394c0fdf68e176d2cd3c3121551df3040983454 Mon Sep 17 00:00:00 2001
From: Josema Camacho <josema@prowler.com>
Date: Thu, 11 Jun 2026 18:32:35 +0200
Subject: [PATCH 020/126] fix(api): drop_subgraph deletes relationships then
 nodes to cut Neo4j memory (#11557)

---
 api/CHANGELOG.md                              |  2 +
 api/src/backend/api/attack_paths/database.py  | 20 ++++-
 .../api/tests/test_attack_paths_database.py   | 81 +++++++++++++++++++
 3 files changed, 101 insertions(+), 2 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index fc367813f7..5b5ea6b97e 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -4,9 +4,11 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ## [1.31.1] (Prowler UNRELEASED)
 
+
 ### 🐞 Fixed
 
 - `compliance-overviews/attributes` now resolves the provider from the scan, so multi-provider universal frameworks (e.g. CSA CCM) return the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
+- Attack Paths: `drop_subgraph` now deletes relationships first and then nodes in batches, using less memory on Neo4j when clearing a dense provider graph [(#11557)](https://github.com/prowler-cloud/prowler/pull/11557)
 - OCI scans now use API key credentials with the configured region instead of falling back to `/home/prowler/.oci/config` [(#11558)](https://github.com/prowler-cloud/prowler/pull/11558)
 
 ---
diff --git a/api/src/backend/api/attack_paths/database.py b/api/src/backend/api/attack_paths/database.py
index d5cc1698a7..0e6cc083dc 100644
--- a/api/src/backend/api/attack_paths/database.py
+++ b/api/src/backend/api/attack_paths/database.py
@@ -175,7 +175,8 @@ def drop_subgraph(database: str, provider_id: str) -> int:
     """
     Delete all nodes for a provider from the tenant database.
 
-    Uses batched deletion to avoid memory issues with large graphs.
+    Deletes relationships then nodes in batches (not `DETACH DELETE`) so a dense
+    provider's graph cannot exceed Neo4j's transaction memory limit.
     Silently returns 0 if the database doesn't exist.
     """
     provider_label = get_provider_label(provider_id)
@@ -183,13 +184,28 @@ def drop_subgraph(database: str, provider_id: str) -> int:
 
     try:
         with get_session(database) as session:
+            # Phase 1: delete relationships incident to provider nodes in batches.
+            deleted_count = 1
+            while deleted_count > 0:
+                result = session.run(
+                    f"""
+                    MATCH (:`{provider_label}`)-[r]-()
+                    WITH DISTINCT r LIMIT $batch_size
+                    DELETE r
+                    RETURN COUNT(r) AS deleted_rels_count
+                    """,
+                    {"batch_size": BATCH_SIZE},
+                )
+                deleted_count = result.single().get("deleted_rels_count", 0)
+
+            # Phase 2: delete the now relationship-free nodes in batches.
             deleted_count = 1
             while deleted_count > 0:
                 result = session.run(
                     f"""
                     MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`)
                     WITH n LIMIT $batch_size
-                    DETACH DELETE n
+                    DELETE n
                     RETURN COUNT(n) AS deleted_nodes_count
                     """,
                     {"batch_size": BATCH_SIZE},
diff --git a/api/src/backend/api/tests/test_attack_paths_database.py b/api/src/backend/api/tests/test_attack_paths_database.py
index 3a29a1007d..7ca8a4accb 100644
--- a/api/src/backend/api/tests/test_attack_paths_database.py
+++ b/api/src/backend/api/tests/test_attack_paths_database.py
@@ -542,3 +542,84 @@ class TestHasProviderData:
         ):
             with pytest.raises(db_module.GraphDatabaseQueryException):
                 db_module.has_provider_data("db-tenant-abc", "provider-123")
+
+
+class TestDropSubgraph:
+    """Test drop_subgraph two-phase batched deletion of a provider's graph."""
+
+    @staticmethod
+    def _result(count):
+        result = MagicMock()
+        result.single.return_value.get.return_value = count
+        return result
+
+    @staticmethod
+    def _session_ctx(session):
+        ctx = MagicMock()
+        ctx.__enter__.return_value = session
+        ctx.__exit__.return_value = False
+        return ctx
+
+    def test_deletes_relationships_then_nodes_in_batches(self):
+        session = MagicMock()
+        # Phase 1 (relationships): one full batch then empty.
+        # Phase 2 (nodes): one full batch then empty.
+        session.run.side_effect = [
+            self._result(1000),
+            self._result(0),
+            self._result(1000),
+            self._result(0),
+        ]
+
+        with patch(
+            "api.attack_paths.database.get_session",
+            return_value=self._session_ctx(session),
+        ):
+            deleted = db_module.drop_subgraph("db-tenant-abc", "provider-123")
+
+        # Only phase-2 node counts contribute to the return value.
+        assert deleted == 1000
+        assert session.run.call_count == 4
+
+        queries = [call.args[0] for call in session.run.call_args_list]
+
+        # Regression guard: the memory blow-up was caused by DETACH DELETE.
+        assert all("DETACH DELETE" not in query for query in queries)
+
+        rel_queries = [query for query in queries if "DELETE r" in query]
+        node_queries = [query for query in queries if "DELETE n" in query]
+        assert rel_queries and node_queries
+        # DISTINCT avoids double-counting relationships matched from both ends.
+        assert all("DISTINCT r" in query for query in rel_queries)
+
+        # Relationships must be fully drained before nodes are deleted.
+        first_node = next(i for i, q in enumerate(queries) if "DELETE n" in q)
+        last_rel = max(i for i, q in enumerate(queries) if "DELETE r" in q)
+        assert last_rel < first_node
+
+    def test_returns_zero_when_database_not_found(self):
+        session_ctx = MagicMock()
+        session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
+            message="Database does not exist",
+            code="Neo.ClientError.Database.DatabaseNotFound",
+        )
+
+        with patch(
+            "api.attack_paths.database.get_session",
+            return_value=session_ctx,
+        ):
+            assert db_module.drop_subgraph("db-tenant-gone", "provider-123") == 0
+
+    def test_raises_on_other_errors(self):
+        session_ctx = MagicMock()
+        session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
+            message="Connection refused",
+            code="Neo.TransientError.General.UnknownError",
+        )
+
+        with patch(
+            "api.attack_paths.database.get_session",
+            return_value=session_ctx,
+        ):
+            with pytest.raises(db_module.GraphDatabaseQueryException):
+                db_module.drop_subgraph("db-tenant-abc", "provider-123")

From 2e82f1564f6b5535baa0692776726c60fc469577 Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Fri, 12 Jun 2026 10:07:56 +0200
Subject: [PATCH 021/126] fix(ui): show threat map data for okta and google
 workspace accounts (#11542)

---
 ui/CHANGELOG.md                               |  1 +
 .../regions/threat-map.adapter.test.ts        | 62 +++++++++++++
 .../overview/regions/threat-map.adapter.ts    | 15 +++
 ui/components/graphs/threat-map.test.tsx      | 93 +++++++++++++++++++
 ui/components/graphs/threat-map.tsx           | 14 ++-
 5 files changed, 181 insertions(+), 4 deletions(-)
 create mode 100644 ui/actions/overview/regions/threat-map.adapter.test.ts
 create mode 100644 ui/components/graphs/threat-map.test.tsx

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 277fabb5b0..4e5aa06e45 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 ### 🐞 Fixed
 
+- Threat Map no longer shows an empty map for accounts that only have Okta or Google Workspace scans [(#11542)](https://github.com/prowler-cloud/prowler/pull/11542)
 - Compliance attributes requests now pass the selected scan, so multi-provider universal frameworks (e.g. CSA CCM) load the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
 
 ---
diff --git a/ui/actions/overview/regions/threat-map.adapter.test.ts b/ui/actions/overview/regions/threat-map.adapter.test.ts
new file mode 100644
index 0000000000..515825bb0a
--- /dev/null
+++ b/ui/actions/overview/regions/threat-map.adapter.test.ts
@@ -0,0 +1,62 @@
+import { describe, expect, it } from "vitest";
+
+import { adaptRegionsOverviewToThreatMap } from "./threat-map.adapter";
+import type { RegionsOverviewResponse } from "./types";
+
+function buildRegionsResponse(
+  rows: Array<{ providerType: string; region: string }>,
+): RegionsOverviewResponse {
+  return {
+    data: rows.map(({ providerType, region }, index) => ({
+      type: "regions-overview",
+      id: `region-${index}`,
+      attributes: {
+        provider_type: providerType,
+        region,
+        total: 10,
+        fail: 4,
+        muted: 0,
+        pass: 6,
+      },
+    })),
+    meta: { version: "v1" },
+  };
+}
+
+describe("adaptRegionsOverviewToThreatMap", () => {
+  it("maps okta regions to a global location", () => {
+    const response = buildRegionsResponse([
+      { providerType: "okta", region: "global" },
+    ]);
+
+    const result = adaptRegionsOverviewToThreatMap(response);
+
+    expect(result.locations).toHaveLength(1);
+    expect(result.locations[0]).toMatchObject({
+      providerType: "okta",
+      region: "global",
+      name: "Okta - Global",
+      totalFindings: 10,
+      failFindings: 4,
+    });
+    expect(result.regions).toEqual(["global"]);
+  });
+
+  it("maps googleworkspace regions to a global location", () => {
+    const response = buildRegionsResponse([
+      { providerType: "googleworkspace", region: "global" },
+    ]);
+
+    const result = adaptRegionsOverviewToThreatMap(response);
+
+    expect(result.locations).toHaveLength(1);
+    expect(result.locations[0]).toMatchObject({
+      providerType: "googleworkspace",
+      region: "global",
+      name: "Google Workspace - Global",
+      totalFindings: 10,
+      failFindings: 4,
+    });
+    expect(result.regions).toEqual(["global"]);
+  });
+});
diff --git a/ui/actions/overview/regions/threat-map.adapter.ts b/ui/actions/overview/regions/threat-map.adapter.ts
index 0b7852b56a..6ee0958aad 100644
--- a/ui/actions/overview/regions/threat-map.adapter.ts
+++ b/ui/actions/overview/regions/threat-map.adapter.ts
@@ -261,6 +261,19 @@ const ALIBABACLOUD_COORDINATES: Record<string, { lat: number; lng: number }> = {
   global: { lat: 30.3, lng: 120.2 }, // Global fallback (Hangzhou HQ)
 };
 
+// Okta is a SaaS identity platform without user-facing regions
+const OKTA_COORDINATES: Record<string, { lat: number; lng: number }> = {
+  global: { lat: 37.8, lng: -122.4 }, // Global fallback (San Francisco HQ)
+};
+
+// Google Workspace is a SaaS suite without user-facing regions
+const GOOGLEWORKSPACE_COORDINATES: Record<
+  string,
+  { lat: number; lng: number }
+> = {
+  global: { lat: 37.4, lng: -122.1 }, // Global fallback (Mountain View HQ)
+};
+
 const PROVIDER_COORDINATES: Record<
   string,
   Record<string, { lat: number; lng: number }>
@@ -277,6 +290,8 @@ const PROVIDER_COORDINATES: Record<
   oraclecloud: ORACLECLOUD_COORDINATES,
   mongodbatlas: MONGODBATLAS_COORDINATES,
   alibabacloud: ALIBABACLOUD_COORDINATES,
+  okta: OKTA_COORDINATES,
+  googleworkspace: GOOGLEWORKSPACE_COORDINATES,
 };
 
 // Returns [lng, lat] format for D3/GeoJSON compatibility
diff --git a/ui/components/graphs/threat-map.test.tsx b/ui/components/graphs/threat-map.test.tsx
new file mode 100644
index 0000000000..47d447bddc
--- /dev/null
+++ b/ui/components/graphs/threat-map.test.tsx
@@ -0,0 +1,93 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { ThreatMap } from "./threat-map";
+import type { ThreatMapData } from "./threat-map.types";
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: vi.fn() }),
+  useSearchParams: () => new URLSearchParams(),
+}));
+
+vi.mock("./horizontal-bar-chart", () => ({
+  HorizontalBarChart: () => <div data-testid="bar-chart" />,
+}));
+
+function buildLocation(providerType: string, region: string) {
+  return {
+    id: `${providerType}-${region}`,
+    name: `${providerType} - ${region}`,
+    region,
+    regionCode: region,
+    providerType,
+    coordinates: [-122.4, 37.8] as [number, number],
+    totalFindings: 10,
+    failFindings: 4,
+    riskLevel: "high" as const,
+    severityData: [
+      { name: "Fail", value: 4, percentage: 40 },
+      { name: "Pass", value: 6, percentage: 60 },
+    ],
+  };
+}
+
+describe("ThreatMap region selector", () => {
+  it("auto-selects the region when it is the only one available", () => {
+    const data: ThreatMapData = {
+      locations: [
+        buildLocation("okta", "global"),
+        buildLocation("googleworkspace", "global"),
+      ],
+      regions: ["global"],
+    };
+
+    render(<ThreatMap data={data} />);
+
+    const select = screen.getByRole("combobox", {
+      name: "Filter threat map by region",
+    });
+    expect(select).toHaveValue("global");
+    expect(screen.getByText("Global Regions")).toBeInTheDocument();
+    expect(
+      screen.queryByText("Select a location on the map to view details"),
+    ).not.toBeInTheDocument();
+  });
+
+  it("keeps All Regions as default when there are multiple regions", () => {
+    const data: ThreatMapData = {
+      locations: [
+        buildLocation("aws", "us-east-1"),
+        buildLocation("okta", "global"),
+      ],
+      regions: ["global", "us-east-1"],
+    };
+
+    render(<ThreatMap data={data} />);
+
+    const select = screen.getByRole("combobox", {
+      name: "Filter threat map by region",
+    });
+    expect(select).toHaveValue("All Regions");
+    expect(
+      screen.getByRole("option", { name: "All Regions" }),
+    ).toBeInTheDocument();
+  });
+
+  it("shows the global option capitalized while keeping its filter value", () => {
+    const data: ThreatMapData = {
+      locations: [
+        buildLocation("aws", "us-east-1"),
+        buildLocation("okta", "global"),
+      ],
+      regions: ["global", "us-east-1"],
+    };
+
+    render(<ThreatMap data={data} />);
+
+    const globalOption = screen.getByRole("option", { name: "Global" });
+    expect(globalOption).toHaveValue("global");
+    expect(
+      screen.getByRole("option", { name: "us-east-1" }),
+    ).toBeInTheDocument();
+  });
+});
diff --git a/ui/components/graphs/threat-map.tsx b/ui/components/graphs/threat-map.tsx
index 42b44aa8d1..b73f81336c 100644
--- a/ui/components/graphs/threat-map.tsx
+++ b/ui/components/graphs/threat-map.tsx
@@ -124,7 +124,11 @@ export function ThreatMap({
     x: number;
     y: number;
   } | null>(null);
-  const [selectedRegion, setSelectedRegion] = useState("All Regions");
+  // With a single region "All Regions" adds nothing, so it starts selected
+  const hasSingleRegion = data.regions.length === 1;
+  const [selectedRegion, setSelectedRegion] = useState(
+    hasSingleRegion ? data.regions[0] : "All Regions",
+  );
   const [worldData, setWorldData] = useState<FeatureCollection | null>(null);
   const [isLoadingMap, setIsLoadingMap] = useState(true);
   const [dimensions, setDimensions] = useState<{
@@ -424,10 +428,12 @@ export function ThreatMap({
                   onChange={(e) => setSelectedRegion(e.target.value)}
                   className="border-border-neutral-primary bg-bg-neutral-secondary text-text-neutral-primary appearance-none rounded-lg border px-4 py-2 pr-10 text-sm focus:outline-none focus-visible:ring-2 focus-visible:ring-offset-2"
                 >
-                  <option value="All Regions">All Regions</option>
+                  {!hasSingleRegion && (
+                    <option value="All Regions">All Regions</option>
+                  )}
                   {sortedRegions.map((region) => (
                     <option key={region} value={region}>
-                      {region}
+                      {region.toLowerCase() === "global" ? "Global" : region}
                     </option>
                   ))}
                 </select>
@@ -467,7 +473,7 @@ export function ThreatMap({
                   <div className="border-border-neutral-primary bg-bg-neutral-secondary absolute bottom-4 left-4 flex items-center gap-2 rounded-full border px-3 py-1.5">
                     <div
                       aria-hidden="true"
-                      className="bg-data-critical h-3 w-3 rounded"
+                      className="bg-bg-data-critical h-3 w-3 rounded"
                     />
                     <span className="text-text-neutral-primary text-sm font-medium">
                       {locationCount} Locations

From 56831a73927546fc008614ba574e91cef820d0de Mon Sep 17 00:00:00 2001
From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
Date: Fri, 12 Jun 2026 11:10:46 +0200
Subject: [PATCH 022/126] feat(oci): add storage admin delete exclusion check
 (#11523)

---
 prowler/CHANGELOG.md                          |   1 +
 .../oraclecloud/cis_3.1_oraclecloud.json      |   4 +-
 .../__init__.py                               |   0
 ..._service_level_admins_scoped.metadata.json |  39 +++
 ...ity_storage_service_level_admins_scoped.py | 176 ++++++++++
 ...torage_service_level_admins_scoped_test.py | 326 ++++++++++++++++++
 6 files changed, 545 insertions(+), 1 deletion(-)
 create mode 100644 prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/__init__.py
 create mode 100644 prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.metadata.json
 create mode 100644 prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.py
 create mode 100644 tests/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index eb81a58378..bb4053e3b8 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -9,6 +9,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
 - `config_delegated_admin_and_org_aggregator_all_regions` check for AWS provider, verifying that AWS Config has a delegated administrator and an organization aggregator covering all AWS regions [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
 - `sagemaker_clarify_exists` check for AWS provider [(#11211)](https://github.com/prowler-cloud/prowler/pull/11211)
+- `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 
 ---
 
diff --git a/prowler/compliance/oraclecloud/cis_3.1_oraclecloud.json b/prowler/compliance/oraclecloud/cis_3.1_oraclecloud.json
index ceca68d124..8140dca6cc 100644
--- a/prowler/compliance/oraclecloud/cis_3.1_oraclecloud.json
+++ b/prowler/compliance/oraclecloud/cis_3.1_oraclecloud.json
@@ -302,7 +302,9 @@
     {
       "Id": "1.15",
       "Description": "Ensure storage service-level admins cannot delete resources they manage",
-      "Checks": [],
+      "Checks": [
+        "identity_storage_service_level_admins_scoped"
+      ],
       "Attributes": [
         {
           "Section": "1. Identity and Access Management",
diff --git a/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/__init__.py b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.metadata.json b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.metadata.json
new file mode 100644
index 0000000000..4e8f905658
--- /dev/null
+++ b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.metadata.json
@@ -0,0 +1,39 @@
+{
+  "Provider": "oraclecloud",
+  "CheckID": "identity_storage_service_level_admins_scoped",
+  "CheckTitle": "OCI IAM storage service-level admin policies exclude delete permissions",
+  "CheckType": [],
+  "ServiceName": "identity",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Policy",
+  "ResourceGroup": "IAM",
+  "Description": "**OCI IAM policies** are reviewed to ensure storage service-level administrator statements that grant `manage` permissions exclude the relevant storage delete permissions with `request.permission`. This supports CIS OCI 3.1 control 1.15 separation of duties for Block Volume, File Storage, and Object Storage administrators.",
+  "Risk": "Storage service-level administrators with unrestricted `manage` permissions can delete the resources they administer, including volumes, backups, file systems, mount targets, export sets, objects, or buckets. This weakens separation of duties and can lead to data loss, service disruption, or destructive insider activity.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.oracle.com/en-us/iaas/Content/Identity/policyreference/policyreference.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Block/home.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/File/home.htm",
+    "https://docs.oracle.com/en-us/iaas/Content/Object/home.htm"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "oci iam policy update --policy-id <policy-ocid> --statements \"[\\\"Allow group VolumeUsers to manage volumes in tenancy where request.permission!='VOLUME_DELETE'\\\"]\"",
+      "NativeIaC": "",
+      "Other": "1. In OCI Console, go to Identity & Security > Policies\n2. Open each active policy that grants storage service-level administrators `manage` permissions\n3. Edit storage manage statements to exclude the relevant delete permission with `request.permission`\n4. Example: Allow group BucketUsers to manage buckets in tenancy where request.permission!='BUCKET_DELETE'\n5. Save changes",
+      "Terraform": "```hcl\nresource \"oci_identity_policy\" \"storage_admins\" {\n  compartment_id = var.compartment_id\n  name           = \"storage-admins\"\n  description    = \"Storage administrators without delete permissions\"\n\n  statements = [\n    \"Allow group VolumeUsers to manage volumes in tenancy where request.permission!='VOLUME_DELETE'\",\n    \"Allow group VolumeUsers to manage volume-backups in tenancy where request.permission!='VOLUME_BACKUP_DELETE'\",\n    \"Allow group FileUsers to manage file-systems in tenancy where request.permission!='FILE_SYSTEM_DELETE'\",\n    \"Allow group FileUsers to manage mount-targets in tenancy where request.permission!='MOUNT_TARGET_DELETE'\",\n    \"Allow group FileUsers to manage export-sets in tenancy where request.permission!='EXPORT_SET_DELETE'\",\n    \"Allow group BucketUsers to manage objects in tenancy where request.permission!='OBJECT_DELETE'\",\n    \"Allow group BucketUsers to manage buckets in tenancy where request.permission!='BUCKET_DELETE'\"\n  ]\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Exclude delete permissions from storage service-level administrator policies. Use `request.permission!='VOLUME_DELETE'`, `request.permission!='VOLUME_BACKUP_DELETE'`, `request.permission!='FILE_SYSTEM_DELETE'`, `request.permission!='MOUNT_TARGET_DELETE'`, `request.permission!='EXPORT_SET_DELETE'`, `request.permission!='OBJECT_DELETE'`, and `request.permission!='BUCKET_DELETE'` as appropriate for each storage manage statement.",
+      "Url": "https://hub.prowler.com/check/identity_storage_service_level_admins_scoped"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.py b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.py
new file mode 100644
index 0000000000..49ef16748a
--- /dev/null
+++ b/prowler/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped.py
@@ -0,0 +1,176 @@
+"""Check storage service-level administrators cannot delete managed resources."""
+
+import re
+
+from prowler.lib.check.models import Check, Check_Report_OCI
+from prowler.providers.oraclecloud.services.identity.identity_client import (
+    identity_client,
+)
+
+STORAGE_DELETE_PERMISSIONS_BY_RESOURCE = {
+    "volumes": {"VOLUME_DELETE"},
+    "volume-backups": {"VOLUME_BACKUP_DELETE"},
+    "file-systems": {"FILE_SYSTEM_DELETE"},
+    "mount-targets": {"MOUNT_TARGET_DELETE"},
+    "export-sets": {"EXPORT_SET_DELETE"},
+    "objects": {"OBJECT_DELETE"},
+    "buckets": {"BUCKET_DELETE"},
+    "volume-family": {"VOLUME_DELETE", "VOLUME_BACKUP_DELETE"},
+    "file-family": {"FILE_SYSTEM_DELETE", "MOUNT_TARGET_DELETE", "EXPORT_SET_DELETE"},
+    "object-family": {"OBJECT_DELETE", "BUCKET_DELETE"},
+}
+ALL_STORAGE_DELETE_PERMISSIONS = set().union(
+    *STORAGE_DELETE_PERMISSIONS_BY_RESOURCE.values()
+)
+STORAGE_DELETE_PERMISSIONS_BY_RESOURCE["all-resources"] = ALL_STORAGE_DELETE_PERMISSIONS
+
+MANAGE_STATEMENT_PATTERN = re.compile(
+    r"\ballow\s+group\b.+?\bto\s+manage\s+(?P<resource>[a-z-]+)\b",
+    re.IGNORECASE,
+)
+QUOTED_LITERAL_PATTERN = re.compile(r"'(?:\\.|[^'\\])*'|\"(?:\\.|[^\"\\])*\"")
+
+
+def _normalize_statement(statement: str) -> str:
+    """Collapse whitespace in an OCI policy statement."""
+    return " ".join(statement.strip().split())
+
+
+def _has_disjunctive_condition(statement: str) -> bool:
+    """Return True when the WHERE condition can allow alternate branches."""
+    condition = re.split(r"\bwhere\b", statement, flags=re.IGNORECASE, maxsplit=1)
+    if len(condition) != 2:
+        return False
+
+    condition_without_literals = QUOTED_LITERAL_PATTERN.sub("", condition[1])
+    return bool(
+        re.search(r"\b(any|or)\b|\|\|", condition_without_literals, re.IGNORECASE)
+    )
+
+
+def _storage_manage_resource(statement: str) -> str | None:
+    """Return the managed storage resource in a policy statement, if any."""
+    normalized_statement = _normalize_statement(statement)
+    match = MANAGE_STATEMENT_PATTERN.search(normalized_statement)
+    if not match:
+        return None
+
+    resource = match.group("resource").lower()
+    if resource not in STORAGE_DELETE_PERMISSIONS_BY_RESOURCE:
+        return None
+
+    return resource
+
+
+def _excluded_permissions(statement: str) -> set[str]:
+    """Return delete permissions explicitly excluded with request.permission != value."""
+    if _has_disjunctive_condition(statement):
+        return set()
+
+    exclusions = set()
+    for permission in ALL_STORAGE_DELETE_PERMISSIONS:
+        pattern = re.compile(
+            rf"\brequest\.permission\s*!=\s*['\"]?{re.escape(permission)}['\"]?\b",
+            re.IGNORECASE,
+        )
+        if pattern.search(statement):
+            exclusions.add(permission)
+    return exclusions
+
+
+def _missing_delete_exclusions(statement: str) -> tuple[str, set[str]] | None:
+    """Return the storage resource and missing delete exclusions for a statement."""
+    normalized_statement = _normalize_statement(statement)
+    resource = _storage_manage_resource(normalized_statement)
+    if not resource:
+        return None
+
+    required_permissions = STORAGE_DELETE_PERMISSIONS_BY_RESOURCE[resource]
+
+    excluded_permissions = _excluded_permissions(normalized_statement)
+    missing_permissions = required_permissions - excluded_permissions
+    if not missing_permissions:
+        return None
+
+    return resource, missing_permissions
+
+
+class identity_storage_service_level_admins_scoped(Check):
+    """Ensure storage service-level admins cannot delete resources they manage."""
+
+    def execute(self) -> list[Check_Report_OCI]:
+        """Execute the storage service-level administrators scoped check.
+
+        Returns:
+            A list of OCI check reports for active non-tenant-admin policies.
+        """
+        findings = []
+
+        for policy in identity_client.policies:
+            if policy.lifecycle_state != "ACTIVE":
+                continue
+
+            if policy.name.upper() == "TENANT ADMIN POLICY":
+                continue
+
+            region = policy.region if hasattr(policy, "region") else "global"
+            violations = []
+            has_storage_manage_statement = False
+
+            for statement in policy.statements:
+                if _storage_manage_resource(statement):
+                    has_storage_manage_statement = True
+
+                missing_result = _missing_delete_exclusions(statement)
+                if not missing_result:
+                    continue
+
+                resource, missing_permissions = missing_result
+                violations.append(
+                    f"statement `{_normalize_statement(statement)}` manages {resource} without excluding: {', '.join(sorted(missing_permissions))}"
+                )
+
+            if not has_storage_manage_statement:
+                continue
+
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource=policy,
+                region=region,
+                resource_id=policy.id,
+                resource_name=policy.name,
+                compartment_id=policy.compartment_id,
+            )
+
+            if violations:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Policy '{policy.name}' allows storage service-level administrators to manage storage resources without explicitly excluding required delete permissions: "
+                    + "; ".join(violations)
+                    + "."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Policy '{policy.name}' excludes required storage delete permissions from storage manage statements."
+
+            findings.append(report)
+
+        if not findings:
+            region = (
+                identity_client.audited_regions[0].key
+                if identity_client.audited_regions
+                else "global"
+            )
+            report = Check_Report_OCI(
+                metadata=self.metadata(),
+                resource={},
+                region=region,
+                resource_id=identity_client.audited_tenancy,
+                resource_name="Tenancy",
+                compartment_id=identity_client.audited_tenancy,
+            )
+            report.status = "PASS"
+            report.status_extended = "No active storage service-level administrator policies grant manage permissions without excluding delete permissions."
+            findings.append(report)
+
+        return findings
diff --git a/tests/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped_test.py b/tests/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped_test.py
new file mode 100644
index 0000000000..5b974c893c
--- /dev/null
+++ b/tests/providers/oraclecloud/services/identity/identity_storage_service_level_admins_scoped/identity_storage_service_level_admins_scoped_test.py
@@ -0,0 +1,326 @@
+from datetime import datetime
+from unittest import mock
+
+import pytest
+
+from prowler.lib.check.models import Check_Report_OCI
+from prowler.providers.oraclecloud.services.identity.identity_service import Policy
+from tests.providers.oraclecloud.oci_fixtures import (
+    OCI_COMPARTMENT_ID,
+    OCI_REGION,
+    OCI_TENANCY_ID,
+    set_mocked_oraclecloud_provider,
+)
+
+CHECK_PATH = "prowler.providers.oraclecloud.services.identity.identity_storage_service_level_admins_scoped.identity_storage_service_level_admins_scoped"
+
+
+def _policy(
+    name: str, statements: list[str], lifecycle_state: str = "ACTIVE"
+) -> Policy:
+    return Policy(
+        id=f"ocid1.policy.oc1..{name.lower().replace(' ', '-')}",
+        name=name,
+        description="Test policy",
+        compartment_id=OCI_COMPARTMENT_ID,
+        statements=statements,
+        time_created=datetime.now(),
+        lifecycle_state=lifecycle_state,
+        region=OCI_REGION,
+    )
+
+
+def _identity_client(policies: list[Policy]) -> mock.MagicMock:
+    identity_client = mock.MagicMock()
+    identity_client.policies = policies
+    identity_client.audited_tenancy = OCI_TENANCY_ID
+    identity_client.audited_regions = [mock.MagicMock(key=OCI_REGION)]
+    return identity_client
+
+
+def _run_check(policies: list[Policy]) -> list[Check_Report_OCI]:
+    identity_client = _identity_client(policies)
+
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_oraclecloud_provider(),
+        ),
+        mock.patch(f"{CHECK_PATH}.identity_client", new=identity_client),
+    ):
+        from prowler.providers.oraclecloud.services.identity.identity_storage_service_level_admins_scoped.identity_storage_service_level_admins_scoped import (
+            identity_storage_service_level_admins_scoped,
+        )
+
+        return identity_storage_service_level_admins_scoped().execute()
+
+
+class Test_identity_storage_service_level_admins_scoped:
+    def test_no_policies_passes_with_tenancy_finding(self):
+        result = _run_check([])
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert result[0].resource_id == OCI_TENANCY_ID
+        assert result[0].resource_name == "Tenancy"
+        assert (
+            result[0].status_extended
+            == "No active storage service-level administrator policies grant manage permissions without excluding delete permissions."
+        )
+
+    def test_manage_volumes_without_delete_exclusion_fails(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Volume Admins",
+                    ["Allow group VolumeUsers to manage volumes in tenancy"],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert result[0].resource_name == "Volume Admins"
+        assert "VOLUME_DELETE" in result[0].status_extended
+        assert (
+            "Allow group VolumeUsers to manage volumes in tenancy"
+            in result[0].status_extended
+        )
+
+    def test_manage_volumes_with_delete_exclusion_passes(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Volume Admins",
+                    [
+                        "Allow group VolumeUsers to manage volumes in tenancy where request.permission!='VOLUME_DELETE'"
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert (
+            result[0].status_extended
+            == "Policy 'Volume Admins' excludes required storage delete permissions from storage manage statements."
+        )
+
+    def test_delete_exclusion_parser_is_case_and_whitespace_insensitive(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Volume Admins",
+                    [
+                        "  allow   group VolumeUsers TO   manage   volumes in tenancy WHERE request.permission   !=   'volume_delete'  "
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+
+    def test_generic_where_clause_does_not_pass(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Bucket Admins",
+                    [
+                        "Allow group BucketUsers to manage buckets in tenancy where request.region='iad'"
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "BUCKET_DELETE" in result[0].status_extended
+        assert "request.region='iad'" in result[0].status_extended
+
+    @pytest.mark.parametrize(
+        "statement",
+        [
+            "Allow group BucketUsers to manage buckets in tenancy where ANY {request.permission!='BUCKET_DELETE', request.region='iad'}",
+            "Allow group BucketUsers to manage buckets in tenancy where request.permission!='BUCKET_DELETE' OR request.region='iad'",
+        ],
+    )
+    def test_disjunctive_delete_exclusion_does_not_pass(self, statement):
+        result = _run_check([_policy("Bucket Admins", [statement])])
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "BUCKET_DELETE" in result[0].status_extended
+
+    def test_quoted_literals_do_not_make_delete_exclusion_disjunctive(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Bucket Admins",
+                    [
+                        "Allow group BucketUsers to manage buckets in tenancy where request.permission!='BUCKET_DELETE' and target.tag.namespace='any-tag'"
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+
+    @pytest.mark.parametrize(
+        "resource,permission",
+        [
+            ("file-systems", "FILE_SYSTEM_DELETE"),
+            ("mount-targets", "MOUNT_TARGET_DELETE"),
+            ("export-sets", "EXPORT_SET_DELETE"),
+            ("volumes", "VOLUME_DELETE"),
+            ("volume-backups", "VOLUME_BACKUP_DELETE"),
+            ("objects", "OBJECT_DELETE"),
+            ("buckets", "BUCKET_DELETE"),
+        ],
+    )
+    def test_storage_resources_require_matching_delete_exclusion(
+        self, resource, permission
+    ):
+        fail_result = _run_check(
+            [
+                _policy(
+                    "Storage Admins",
+                    [f"Allow group StorageUsers to manage {resource} in tenancy"],
+                )
+            ]
+        )
+        pass_result = _run_check(
+            [
+                _policy(
+                    "Storage Admins",
+                    [
+                        f"Allow group StorageUsers to manage {resource} in tenancy where request.permission != '{permission}'"
+                    ],
+                )
+            ]
+        )
+
+        assert len(fail_result) == 1
+        assert fail_result[0].status == "FAIL"
+        assert permission in fail_result[0].status_extended
+        assert len(pass_result) == 1
+        assert pass_result[0].status == "PASS"
+
+    def test_file_family_fails_until_all_delete_permissions_are_excluded(self):
+        partial_result = _run_check(
+            [
+                _policy(
+                    "File Admins",
+                    [
+                        "Allow group FileUsers to manage file-family in tenancy where ALL {request.permission!='FILE_SYSTEM_DELETE', request.permission!='MOUNT_TARGET_DELETE'}"
+                    ],
+                )
+            ]
+        )
+        complete_result = _run_check(
+            [
+                _policy(
+                    "File Admins",
+                    [
+                        "Allow group FileUsers to manage file-family in tenancy where ALL {request.permission!='FILE_SYSTEM_DELETE', request.permission!='MOUNT_TARGET_DELETE', request.permission!='EXPORT_SET_DELETE'}"
+                    ],
+                )
+            ]
+        )
+
+        assert len(partial_result) == 1
+        assert partial_result[0].status == "FAIL"
+        assert "EXPORT_SET_DELETE" in partial_result[0].status_extended
+        assert len(complete_result) == 1
+        assert complete_result[0].status == "PASS"
+
+    @pytest.mark.parametrize(
+        "family,missing_permission,statement",
+        [
+            (
+                "volume-family",
+                "VOLUME_BACKUP_DELETE",
+                "Allow group VolumeUsers to manage volume-family in tenancy where request.permission!='VOLUME_DELETE'",
+            ),
+            (
+                "object-family",
+                "BUCKET_DELETE",
+                "Allow group BucketUsers to manage object-family in tenancy where request.permission!='OBJECT_DELETE'",
+            ),
+            (
+                "all-resources",
+                "BUCKET_DELETE",
+                "Allow group StorageUsers to manage all-resources in tenancy where ALL {request.permission!='VOLUME_DELETE', request.permission!='VOLUME_BACKUP_DELETE', request.permission!='FILE_SYSTEM_DELETE', request.permission!='MOUNT_TARGET_DELETE', request.permission!='EXPORT_SET_DELETE', request.permission!='OBJECT_DELETE'}",
+            ),
+        ],
+    )
+    def test_families_and_all_resources_fail_unless_all_delete_permissions_are_excluded(
+        self, family, missing_permission, statement
+    ):
+        result = _run_check([_policy("Storage Admins", [statement])])
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert family in result[0].status_extended
+        assert missing_permission in result[0].status_extended
+
+    def test_all_resources_passes_when_all_storage_delete_permissions_are_excluded(
+        self,
+    ):
+        result = _run_check(
+            [
+                _policy(
+                    "Storage Admins",
+                    [
+                        "Allow group StorageUsers to manage all-resources in tenancy where ALL {request.permission!='VOLUME_DELETE', request.permission!='VOLUME_BACKUP_DELETE', request.permission!='FILE_SYSTEM_DELETE', request.permission!='MOUNT_TARGET_DELETE', request.permission!='EXPORT_SET_DELETE', request.permission!='OBJECT_DELETE', request.permission!='BUCKET_DELETE'}"
+                    ],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+
+    def test_inactive_policies_are_ignored(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Inactive Volume Admins",
+                    ["Allow group VolumeUsers to manage volumes in tenancy"],
+                    lifecycle_state="INACTIVE",
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert result[0].resource_name == "Tenancy"
+
+    def test_tenant_admin_policy_is_ignored(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Tenant Admin Policy",
+                    ["Allow group Administrators to manage all-resources in tenancy"],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert result[0].resource_name == "Tenancy"
+
+    def test_policies_without_storage_manage_statements_are_ignored(self):
+        result = _run_check(
+            [
+                _policy(
+                    "Network Admins",
+                    ["Allow group NetworkUsers to manage vcns in tenancy"],
+                )
+            ]
+        )
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert result[0].resource_name == "Tenancy"

From 79e066d3f5a7da950a3c98e15cafd837f6204193 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Fri, 12 Jun 2026 18:51:13 +0900
Subject: [PATCH 023/126] feat(gcp): add
 cloudsql_instance_high_availability_enabled check (#11024)

Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com>
Co-authored-by: lydiavilchez <114735608+lydiavilchez@users.noreply.github.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../__init__.py                               |   0
 ...ce_high_availability_enabled.metadata.json |  38 ++++
 ...dsql_instance_high_availability_enabled.py |  41 ++++
 .../gcp/services/cloudsql/cloudsql_service.py |   4 +
 tests/providers/gcp/gcp_fixtures.py           |   2 +
 .../__init__.py                               |   0
 .../__init__.py                               |   0
 ...instance_high_availability_enabled_test.py | 205 ++++++++++++++++++
 9 files changed, 291 insertions(+)
 create mode 100644 prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py
 create mode 100644 prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.metadata.json
 create mode 100644 prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.py
 create mode 100644 tests/providers/gcp/services/cloudsql/cloudsql_instance_cmek_encryption_enabled/__init__.py
 create mode 100644 tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py
 create mode 100644 tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index bb4053e3b8..b14ef2de8f 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -9,6 +9,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
 - `config_delegated_admin_and_org_aggregator_all_regions` check for AWS provider, verifying that AWS Config has a delegated administrator and an organization aggregator covering all AWS regions [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
 - `sagemaker_clarify_exists` check for AWS provider [(#11211)](https://github.com/prowler-cloud/prowler/pull/11211)
+- `cloudsql_instance_high_availability_enabled` check for GCP provider, verifying Cloud SQL primary instances use `REGIONAL` availability for automatic zone failover [(#11024)](https://github.com/prowler-cloud/prowler/pull/11024)
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 
 ---
diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.metadata.json b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.metadata.json
new file mode 100644
index 0000000000..3e66f9cdd3
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "gcp",
+  "CheckID": "cloudsql_instance_high_availability_enabled",
+  "CheckTitle": "Cloud SQL instance has high availability (REGIONAL) configured",
+  "CheckType": [],
+  "ServiceName": "cloudsql",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "sqladmin.googleapis.com/Instance",
+  "Description": "Ensures that Cloud SQL instances have high availability configured by setting availabilityType to REGIONAL. A REGIONAL instance maintains a standby replica in a different zone within the same region and automatically fails over on zone-level outages.",
+  "Risk": "Instances with ZONAL availability have no standby replica. A zone-level outage will cause database downtime until manual recovery, violating availability requirements and potentially breaching SLAs and ISMS-P 2.12.1 disaster preparedness controls.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://cloud.google.com/sql/docs/postgres/high-availability",
+    "https://cloud.google.com/sql/docs/sqlserver/high-availability"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "gcloud sql instances patch <INSTANCE_NAME> --availability-type=REGIONAL",
+      "NativeIaC": "",
+      "Other": "1. Go to Google Cloud Console > SQL > Instances.\n2. Click the instance name, then Edit.\n3. Under Availability, select Multiple zones (Highly available).\n4. Click Save.",
+      "Terraform": "```hcl\nresource \"google_sql_database_instance\" \"example\" {\n  name             = \"<instance_name>\"\n  database_version = \"POSTGRES_15\"\n  region           = \"<region>\"\n\n  settings {\n    tier = \"db-custom-2-7680\"\n\n    availability_type = \"REGIONAL\"  # Critical: enables HA standby replica\n\n    backup_configuration {\n      enabled    = true\n      start_time = \"02:00\"\n    }\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Set availabilityType to REGIONAL for all production Cloud SQL instances. This creates a standby replica in a different zone and enables automatic failover, reducing RTO in the event of a zone outage.",
+      "Url": "https://hub.prowler.com/check/cloudsql_instance_high_availability_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "cloudsql_instance_automated_backups"
+  ],
+  "Notes": "Enabling HA increases instance cost approximately 2x due to the standby replica. ZONAL instances are acceptable for non-production workloads where downtime is tolerable."
+}
diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.py b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.py
new file mode 100644
index 0000000000..37bf576345
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled.py
@@ -0,0 +1,41 @@
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.cloudsql.cloudsql_client import cloudsql_client
+
+
+class cloudsql_instance_high_availability_enabled(Check):
+    """Check that Cloud SQL primary instances are configured for high availability.
+
+    Verifies that each Cloud SQL primary instance has `availabilityType` set to
+    `REGIONAL`, which provisions a standby replica in a different zone within
+    the same region and enables automatic failover on zone-level outages. Read
+    replicas are skipped because they inherit availability from their primary.
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        """Execute the high availability check across all Cloud SQL instances.
+
+        Returns:
+            A list of `Check_Report_GCP` findings, one per Cloud SQL primary
+            instance. Status is `PASS` when `availability_type == "REGIONAL"`
+            and `FAIL` otherwise.
+        """
+        findings = []
+        for instance in cloudsql_client.instances:
+            if instance.instance_type != "CLOUD_SQL_INSTANCE":
+                continue
+            report = Check_Report_GCP(metadata=self.metadata(), resource=instance)
+            if instance.availability_type == "REGIONAL":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Database instance {instance.name} has high availability "
+                    f"(REGIONAL) configured."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Database instance {instance.name} does not have high "
+                    f"availability configured (current: "
+                    f"{instance.availability_type})."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/gcp/services/cloudsql/cloudsql_service.py b/prowler/providers/gcp/services/cloudsql/cloudsql_service.py
index 137169999a..1fe706bb02 100644
--- a/prowler/providers/gcp/services/cloudsql/cloudsql_service.py
+++ b/prowler/providers/gcp/services/cloudsql/cloudsql_service.py
@@ -46,6 +46,9 @@ class CloudSQL(GCPService):
                                     "authorizedNetworks", []
                                 ),
                                 flags=settings.get("databaseFlags", []),
+                                availability_type=settings.get(
+                                    "availabilityType", "ZONAL"
+                                ),
                                 instance_type=instance.get(
                                     "instanceType", "CLOUD_SQL_INSTANCE"
                                 ),
@@ -76,6 +79,7 @@ class Instance(BaseModel):
     ssl_mode: str
     automated_backups: bool
     flags: list
+    availability_type: str = "ZONAL"
     instance_type: str = "CLOUD_SQL_INSTANCE"
     cmek_key_name: Optional[str] = None
     project_id: str
diff --git a/tests/providers/gcp/gcp_fixtures.py b/tests/providers/gcp/gcp_fixtures.py
index ba6480ee22..1abcaf5bf0 100644
--- a/tests/providers/gcp/gcp_fixtures.py
+++ b/tests/providers/gcp/gcp_fixtures.py
@@ -722,6 +722,7 @@ def mock_api_instances_calls(client: MagicMock, service: str):
                         },
                         "backupConfiguration": {"enabled": True},
                         "databaseFlags": [],
+                        "availabilityType": "REGIONAL",
                     },
                 },
                 {
@@ -737,6 +738,7 @@ def mock_api_instances_calls(client: MagicMock, service: str):
                         },
                         "backupConfiguration": {"enabled": False},
                         "databaseFlags": [],
+                        "availabilityType": "ZONAL",
                     },
                 },
             ]
diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_cmek_encryption_enabled/__init__.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_cmek_encryption_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled_test.py b/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled_test.py
new file mode 100644
index 0000000000..82c49fb89e
--- /dev/null
+++ b/tests/providers/gcp/services/cloudsql/cloudsql_instance_high_availability_enabled/cloudsql_instance_high_availability_enabled_test.py
@@ -0,0 +1,205 @@
+from unittest import mock
+
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_EU1_LOCATION,
+    GCP_PROJECT_ID,
+    set_mocked_gcp_provider,
+)
+
+
+class Test_cloudsql_instance_high_availability_enabled:
+    """Tests for the cloudsql_instance_high_availability_enabled check."""
+
+    def test_no_instances(self):
+        """No Cloud SQL instances → no findings."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+
+            cloudsql_client.instances = []
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_instance_ha_enabled(self):
+        """A REGIONAL primary instance → PASS."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+            from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
+                Instance,
+            )
+
+            cloudsql_client.instances = [
+                Instance(
+                    name="db-ha",
+                    version="POSTGRES_15",
+                    ip_addresses=[],
+                    region=GCP_EU1_LOCATION,
+                    public_ip=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
+                    automated_backups=True,
+                    authorized_networks=[],
+                    flags=[],
+                    project_id=GCP_PROJECT_ID,
+                    availability_type="REGIONAL",
+                )
+            ]
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "db-ha"
+            assert result[0].location == GCP_EU1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_instance_ha_disabled(self):
+        """A ZONAL primary instance → FAIL with current availability in status_extended."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+            from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
+                Instance,
+            )
+
+            cloudsql_client.instances = [
+                Instance(
+                    name="db-zonal",
+                    version="POSTGRES_15",
+                    ip_addresses=[],
+                    region=GCP_EU1_LOCATION,
+                    public_ip=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
+                    automated_backups=True,
+                    authorized_networks=[],
+                    flags=[],
+                    project_id=GCP_PROJECT_ID,
+                    availability_type="ZONAL",
+                )
+            ]
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "ZONAL" in result[0].status_extended
+            assert result[0].resource_id == "db-zonal"
+            assert result[0].location == GCP_EU1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_read_replica_skipped(self):
+        """Read replicas (instance_type != CLOUD_SQL_INSTANCE) are skipped."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+            from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
+                Instance,
+            )
+
+            cloudsql_client.instances = [
+                Instance(
+                    name="db-replica",
+                    version="POSTGRES_15",
+                    ip_addresses=[],
+                    region=GCP_EU1_LOCATION,
+                    public_ip=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
+                    automated_backups=True,
+                    authorized_networks=[],
+                    flags=[],
+                    project_id=GCP_PROJECT_ID,
+                    availability_type="ZONAL",
+                    instance_type="READ_REPLICA_INSTANCE",
+                )
+            ]
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_instance_default_availability_type_fails(self):
+        """An instance missing availabilityType defaults to ZONAL (service layer) and must FAIL."""
+        cloudsql_client = mock.MagicMock()
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled.cloudsql_client",
+                new=cloudsql_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudsql.cloudsql_instance_high_availability_enabled.cloudsql_instance_high_availability_enabled import (
+                cloudsql_instance_high_availability_enabled,
+            )
+            from prowler.providers.gcp.services.cloudsql.cloudsql_service import (
+                Instance,
+            )
+
+            cloudsql_client.instances = [
+                Instance(
+                    name="db-default",
+                    version="POSTGRES_15",
+                    ip_addresses=[],
+                    region=GCP_EU1_LOCATION,
+                    public_ip=False,
+                    require_ssl=False,
+                    ssl_mode="ENCRYPTED_ONLY",
+                    automated_backups=True,
+                    authorized_networks=[],
+                    flags=[],
+                    project_id=GCP_PROJECT_ID,
+                    # availability_type omitted → model default "ZONAL"
+                )
+            ]
+            check = cloudsql_instance_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "ZONAL" in result[0].status_extended

From ca443b8ff1ca38c8d46ef453f7b22123cb7ebee0 Mon Sep 17 00:00:00 2001
From: Josema Camacho <josema@prowler.com>
Date: Fri, 12 Jun 2026 12:07:31 +0200
Subject: [PATCH 024/126] chore: prepare API and UI changelogs for 5.30.1
 release (#11562)

---
 api/CHANGELOG.md | 5 ++---
 ui/CHANGELOG.md  | 4 ++--
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 5b5ea6b97e..cc86538823 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -2,8 +2,7 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
-## [1.31.1] (Prowler UNRELEASED)
-
+## [1.31.1] (Prowler v5.30.1)
 
 ### 🐞 Fixed
 
@@ -30,7 +29,7 @@ All notable changes to the **Prowler API** are documented in this file.
 
 - Workers now shut down gracefully on deploy or restart, finishing or re-queueing in-flight tasks instead of being force-killed and leaving them stuck [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
 - Resource `name` is now stored and refreshed on every scan, so resources no longer keep an empty name [(#11476)](https://github.com/prowler-cloud/prowler/pull/11476)
-- Compliance catalog now warms in background during startup. `compliance-overviews/attributes` returns `503` while warming, so the first request after a deploy no longer trips the API timeout [(#4554)](https://github.com/prowler-cloud/prowler-cloud/pull/4554)
+- Compliance catalog now warms in background during startup. `compliance-overviews/attributes` returns `503` while warming, so the first request after a deploy no longer trips the API timeout [(#11530)](https://github.com/prowler-cloud/prowler/pull/11530)
 
 ### 🔐 Security
 
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 4e5aa06e45..a7a7f75774 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 All notable changes to the **Prowler UI** are documented in this file.
 
-## [1.30.1] (Prowler UNRELEASED)
+## [1.30.1] (Prowler v5.30.1)
 
 ### 🐞 Fixed
 
@@ -21,7 +21,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 ### 🔄 Changed
 
 - Renamed "Customer Support" to "Support Desk" in the side menu, showing it only in Prowler Cloud/Enterprise, while "Community Support" now shows only in Prowler OSS [(#11508)](https://github.com/prowler-cloud/prowler/pull/11508)
-- Compliance detail page now shows a "still loading" retry state while the API warms its compliance catalog, instead of rendering an empty page [(#4554)](https://github.com/prowler-cloud/prowler-cloud/pull/4554)
+- Compliance detail page now shows a "still loading" retry state while the API warms its compliance catalog, instead of rendering an empty page [(#11530)](https://github.com/prowler-cloud/prowler/pull/11530)
 
 ### 🐞 Fixed
 

From 9022a3a1385ed48f078213dc81363702068455b6 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Fri, 12 Jun 2026 20:18:08 +0900
Subject: [PATCH 025/126] feat(azure): add
 cosmosdb_account_automatic_failover_enabled check (#11031)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   3 +-
 prowler/compliance/csa_ccm_4.0.json           |   3 +-
 .../__init__.py                               |   0
 ...t_automatic_failover_enabled.metadata.json |  38 ++++++
 ...osdb_account_automatic_failover_enabled.py |  29 +++++
 .../services/cosmosdb/cosmosdb_service.py     |  25 +++-
 ...account_automatic_failover_enabled_test.py | 115 ++++++++++++++++++
 8 files changed, 209 insertions(+), 5 deletions(-)
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.py
 create mode 100644 tests/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index b14ef2de8f..904bfb829c 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -11,6 +11,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `sagemaker_clarify_exists` check for AWS provider [(#11211)](https://github.com/prowler-cloud/prowler/pull/11211)
 - `cloudsql_instance_high_availability_enabled` check for GCP provider, verifying Cloud SQL primary instances use `REGIONAL` availability for automatic zone failover [(#11024)](https://github.com/prowler-cloud/prowler/pull/11024)
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
+- `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 
 ---
 
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 0051795890..8e5458f526 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1293,7 +1293,8 @@
         "storage_ensure_private_endpoints_in_storage_accounts",
         "storage_secure_transfer_required_is_enabled",
         "vm_ensure_using_managed_disks",
-        "vm_trusted_launch_enabled"
+        "vm_trusted_launch_enabled",
+        "cosmosdb_account_automatic_failover_enabled"
       ]
     },
     {
diff --git a/prowler/compliance/csa_ccm_4.0.json b/prowler/compliance/csa_ccm_4.0.json
index e014c5f408..e25ba23c6f 100644
--- a/prowler/compliance/csa_ccm_4.0.json
+++ b/prowler/compliance/csa_ccm_4.0.json
@@ -1087,7 +1087,8 @@
           "storage_blob_versioning_is_enabled",
           "storage_geo_redundant_enabled",
           "vm_scaleset_associated_with_load_balancer",
-          "vm_scaleset_not_empty"
+          "vm_scaleset_not_empty",
+          "cosmosdb_account_automatic_failover_enabled"
         ],
         "gcp": [
           "compute_instance_automatic_restart_enabled",
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/__init__.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.metadata.json b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.metadata.json
new file mode 100644
index 0000000000..41246ff7a6
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "cosmosdb_account_automatic_failover_enabled",
+  "CheckTitle": "Cosmos DB account has automatic failover enabled",
+  "CheckType": [],
+  "ServiceName": "cosmosdb",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.documentdb/databaseaccounts",
+  "ResourceGroup": "database",
+  "Description": "**Azure Cosmos DB accounts** are evaluated for **automatic failover** configuration. When enabled, Cosmos DB automatically promotes a secondary region to primary during a regional outage, ensuring continuous availability without manual intervention.",
+  "Risk": "Without **automatic failover**, a regional outage requires **manual failover** which delays recovery and risks data unavailability. Applications dependent on the primary region experience downtime until an operator intervenes.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-manage-database-account#automatic-failover",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/high-availability",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/distribute-data-globally"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --enable-automatic-failover true",
+      "NativeIaC": "```bicep\n// Bicep: Enable automatic failover on a Cosmos DB account\nresource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  kind: 'GlobalDocumentDB'\n  properties: {\n    databaseAccountOfferType: 'Standard'\n    locations: [\n      { locationName: '<primary_region>', failoverPriority: 0 }\n      { locationName: '<secondary_region>', failoverPriority: 1 }\n    ]\n    enableAutomaticFailover: true // Critical: Promotes a secondary region during a primary region outage\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Cosmos DB account\n2. In the left menu, select Replicate data globally\n3. Click Automatic Failover\n4. Toggle Enable Automatic Failover to On\n5. Set failover priorities for each region\n6. Click Save",
+      "Terraform": "```hcl\n# Terraform: Enable automatic failover on a Cosmos DB account\nresource \"azurerm_cosmosdb_account\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<primary_region>\"\n  offer_type          = \"Standard\"\n  kind                = \"GlobalDocumentDB\"\n\n  geo_location {\n    location          = \"<primary_region>\"\n    failover_priority = 0\n  }\n\n  geo_location {\n    location          = \"<secondary_region>\"\n    failover_priority = 1\n  }\n\n  enable_automatic_failover = true # Critical: Promotes a secondary region during a primary region outage\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **automatic failover** on Cosmos DB accounts with **multi-region** deployments so a secondary region is promoted automatically when the primary region becomes unavailable. Configure **failover priorities** to reflect your recovery strategy, validate **RTO/RPO** expectations with periodic failover drills, and combine with **multi-region writes** where active-active is required.",
+      "Url": "https://hub.prowler.com/check/cosmosdb_account_automatic_failover_enabled"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.py
new file mode 100644
index 0000000000..7d7d2e5023
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled.py
@@ -0,0 +1,29 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client
+
+
+class cosmosdb_account_automatic_failover_enabled(Check):
+    """Ensure that Cosmos DB accounts have automatic failover enabled."""
+
+    def execute(self) -> Check_Report_Azure:
+        """Execute the Cosmos DB automatic failover check.
+
+        Iterates over every Cosmos DB account fetched by the service and reports
+        PASS when `enableAutomaticFailover` is True, FAIL otherwise.
+
+        Returns:
+            A list of Check_Report_Azure with one report per Cosmos DB account.
+        """
+        findings = []
+        for subscription, accounts in cosmosdb_client.accounts.items():
+            for account in accounts:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
+                report.subscription = subscription
+                report.status = "FAIL"
+                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not have automatic failover enabled."
+                if account.enable_automatic_failover:
+                    report.status = "PASS"
+                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} has automatic failover enabled."
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py
index c36af1d2e9..e7c53799a7 100644
--- a/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_service.py
@@ -1,5 +1,5 @@
 from dataclasses import dataclass
-from typing import List
+from typing import List, Optional
 
 from azure.mgmt.cosmosdb import CosmosDBManagementClient
 
@@ -36,14 +36,29 @@ class CosmosDB(AzureService):
                                     name=private_endpoint_connection.name,
                                     type=private_endpoint_connection.type,
                                 )
-                                for private_endpoint_connection in getattr(
-                                    account, "private_endpoint_connections", []
+                                for private_endpoint_connection in (
+                                    getattr(account, "private_endpoint_connections", [])
+                                    or []
                                 )
                                 if private_endpoint_connection
                             ],
                             disable_local_auth=getattr(
                                 account, "disable_local_auth", False
                             ),
+                            enable_automatic_failover=getattr(
+                                account, "enable_automatic_failover", False
+                            ),
+                            backup_policy_type=getattr(
+                                getattr(account, "backup_policy", None),
+                                "type",
+                                None,
+                            ),
+                            public_network_access=getattr(
+                                account, "public_network_access", None
+                            ),
+                            minimal_tls_version=getattr(
+                                account, "minimal_tls_version", None
+                            ),
                         )
                     )
             except Exception as error:
@@ -71,3 +86,7 @@ class Account:
     location: str
     private_endpoint_connections: List[PrivateEndpointConnection]
     disable_local_auth: bool = False
+    enable_automatic_failover: bool = False
+    backup_policy_type: Optional[str] = None
+    public_network_access: Optional[str] = None
+    minimal_tls_version: Optional[str] = None
diff --git a/tests/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled_test.py b/tests/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled_test.py
new file mode 100644
index 0000000000..8b4330d64c
--- /dev/null
+++ b/tests/providers/azure/services/cosmosdb/cosmosdb_account_automatic_failover_enabled/cosmosdb_account_automatic_failover_enabled_test.py
@@ -0,0 +1,115 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+class Test_cosmosdb_account_automatic_failover_enabled:
+    def test_no_subscriptions(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled import (
+                cosmosdb_account_automatic_failover_enabled,
+            )
+
+            cosmosdb_client.accounts = {}
+
+            check = cosmosdb_account_automatic_failover_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled import (
+                cosmosdb_account_automatic_failover_enabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        enable_automatic_failover=True,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_automatic_failover_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_fail(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_automatic_failover_enabled.cosmosdb_account_automatic_failover_enabled import (
+                cosmosdb_account_automatic_failover_enabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        enable_automatic_failover=False,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_automatic_failover_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"

From 25fc2859666a4b0e9c60f89148e746f5668322d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Fri, 12 Jun 2026 13:45:34 +0200
Subject: [PATCH 026/126] chore(banner): update info (#11568)

---
 prowler/lib/banner.py | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/prowler/lib/banner.py b/prowler/lib/banner.py
index bb693fb961..bccebaaab8 100644
--- a/prowler/lib/banner.py
+++ b/prowler/lib/banner.py
@@ -58,16 +58,17 @@ def print_prowler_cloud_banner(provider: str = None):
     bar = f"{banner_color}│{Style.RESET_ALL}"
     print(
         f"""
-{bar} {Style.BRIGHT}You're getting a snapshot. Prowler Cloud gives you the full picture.{Style.RESET_ALL}
+{bar} {Style.BRIGHT}You're getting a snapshot 📸. Prowler Cloud gives you the full picture:{Style.RESET_ALL}
 {bar}
-{bar} {check} {Style.BRIGHT}Attack Path Visualization{Style.RESET_ALL} - see how attackers chain risks to reach your crown jewels
-{bar} {check} {Style.BRIGHT}Lighthouse AI + MCP{Style.RESET_ALL} - autonomous triage, prioritization and remediation
-{bar} {check} {Style.BRIGHT}Organizations{Style.RESET_ALL} - all your AWS accounts under one organization
-{bar} {check} {Style.BRIGHT}Continuous scanning{Style.RESET_ALL} - scheduled scans with history, trends and alerts
-{bar} {check} {Style.BRIGHT}Integrations{Style.RESET_ALL} - Jira, Slack, AWS Security Hub, Amazon S3, SSO and RBAC
-{bar} {check} {Style.BRIGHT}Reports{Style.RESET_ALL} - download ready-to-share PDF reports
-{bar} {check} {Style.BRIGHT}Live compliance{Style.RESET_ALL} - dashboards for 50+ frameworks, always up to date
+{bar} {check} {Style.BRIGHT}Continuous Security Monitoring{Style.RESET_ALL} - scheduled scans with history, trends and alerts.
+{bar} {check} {Style.BRIGHT}Lighthouse AI + MCP{Style.RESET_ALL} - autonomous triage, custom dashboards, prioritization with prevention and remediation.
+{bar} {check} {Style.BRIGHT}Alerts{Style.RESET_ALL} - get notified when anything you want is happening.
+{bar} {check} {Style.BRIGHT}Live Compliance{Style.RESET_ALL} - dashboards for 50+ frameworks, always up to date.
+{bar} {check} {Style.BRIGHT}Remediation{Style.RESET_ALL} - complete guided remediation including Autonomous remediation with Lighthouse AI.
+{bar} {check} {Style.BRIGHT}Attack Path Visualization{Style.RESET_ALL} - see how attackers chain risks to reach your crown jewels.
+{bar} {check} {Style.BRIGHT}Bulk Provisioning{Style.RESET_ALL} - add your entire AWS Organization in seconds.
+{bar} {check} {Style.BRIGHT}Integrations{Style.RESET_ALL} - Anything with our MCP + Jira, Slack, AWS Security Hub, Amazon S3, SSO and RBAC.
 {bar}
-{bar} {Fore.BLUE}Start free at cloud.prowler.com{Style.RESET_ALL}
+{bar} {Fore.BLUE}Start free at 👉 cloud.prowler.com{Style.RESET_ALL}
 """
     )

From dc3433aaf0d18c2d548579a80902f8ee2f185ad8 Mon Sep 17 00:00:00 2001
From: Prowler Bot <bot@prowler.com>
Date: Fri, 12 Jun 2026 14:15:02 +0200
Subject: [PATCH 027/126] feat(aws): Update regions for AWS services (#11570)

Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
---
 prowler/providers/aws/aws_regions_by_service.json | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/prowler/providers/aws/aws_regions_by_service.json b/prowler/providers/aws/aws_regions_by_service.json
index 2e451910fb..0874d14a07 100644
--- a/prowler/providers/aws/aws_regions_by_service.json
+++ b/prowler/providers/aws/aws_regions_by_service.json
@@ -2582,6 +2582,7 @@
         "aws": [
           "af-south-1",
           "ap-east-1",
+          "ap-east-2",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-northeast-3",
@@ -2591,6 +2592,9 @@
           "ap-southeast-2",
           "ap-southeast-3",
           "ap-southeast-4",
+          "ap-southeast-5",
+          "ap-southeast-6",
+          "ap-southeast-7",
           "ca-central-1",
           "ca-west-1",
           "eu-central-1",
@@ -2604,6 +2608,7 @@
           "il-central-1",
           "me-central-1",
           "me-south-1",
+          "mx-central-1",
           "sa-east-1",
           "us-east-1",
           "us-east-2",
@@ -7344,6 +7349,7 @@
     "lightsail": {
       "regions": {
         "aws": [
+          "ap-east-1",
           "ap-northeast-1",
           "ap-northeast-2",
           "ap-south-1",
@@ -7354,9 +7360,11 @@
           "ca-central-1",
           "eu-central-1",
           "eu-north-1",
+          "eu-south-2",
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
+          "sa-east-1",
           "us-east-1",
           "us-east-2",
           "us-west-2"
@@ -8269,7 +8277,9 @@
           "cn-north-1",
           "cn-northwest-1"
         ],
-        "aws-eusc": [],
+        "aws-eusc": [
+          "eusc-de-east-1"
+        ],
         "aws-us-gov": [
           "us-gov-east-1",
           "us-gov-west-1"
@@ -9220,6 +9230,7 @@
           "eu-west-1",
           "eu-west-2",
           "eu-west-3",
+          "sa-east-1",
           "us-east-1",
           "us-east-2",
           "us-west-2"
@@ -9986,6 +9997,8 @@
           "ap-south-1",
           "ap-southeast-1",
           "ap-southeast-2",
+          "ap-southeast-5",
+          "ap-southeast-7",
           "ca-central-1",
           "eu-central-1",
           "eu-south-2",

From 15bfa39b23cab7e18706884da3f79b739a200155 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Mon, 15 Jun 2026 09:57:23 +0200
Subject: [PATCH 028/126] ci: fail PR checks on critical container image and
 dependency vulnerabilities (#11580)

---
 .github/actions/osv-scanner/action.yml     | 6 +++---
 .github/scripts/osv-scan.sh                | 5 ++---
 .github/workflows/api-container-checks.yml | 2 +-
 .github/workflows/mcp-container-checks.yml | 2 +-
 .github/workflows/sdk-container-checks.yml | 2 +-
 .github/workflows/ui-container-checks.yml  | 2 +-
 6 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/.github/actions/osv-scanner/action.yml b/.github/actions/osv-scanner/action.yml
index 4bfb5993cb..de5116fdcf 100644
--- a/.github/actions/osv-scanner/action.yml
+++ b/.github/actions/osv-scanner/action.yml
@@ -1,5 +1,5 @@
 name: 'OSV-Scanner'
-description: 'Install osv-scanner and scan a lockfile, failing on HIGH/CRITICAL/UNKNOWN severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
+description: 'Install osv-scanner and scan a lockfile, failing on CRITICAL severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
 author: 'Prowler'
 
 inputs:
@@ -7,9 +7,9 @@ inputs:
     description: 'Path to the lockfile to scan, relative to the repository root (e.g. uv.lock, api/uv.lock, ui/pnpm-lock.yaml).'
     required: true
   severity-levels:
-    description: 'Comma-separated severity levels that fail the scan. Default: HIGH,CRITICAL,UNKNOWN.'
+    description: 'Comma-separated severity levels that fail the scan. Default: CRITICAL.'
     required: false
-    default: 'HIGH,CRITICAL,UNKNOWN'
+    default: 'CRITICAL'
   version:
     description: 'osv-scanner release tag to install. When overriding, you MUST also override binary-sha256.'
     required: false
diff --git a/.github/scripts/osv-scan.sh b/.github/scripts/osv-scan.sh
index d9c2e1a901..16afc6668c 100755
--- a/.github/scripts/osv-scan.sh
+++ b/.github/scripts/osv-scan.sh
@@ -6,8 +6,7 @@
 #   - .github/workflows/api-security.yml, sdk-security.yml, ui-security.yml
 #
 # Severity levels (comma-separated) are read from OSV_SEVERITY_LEVELS.
-# Default: HIGH,CRITICAL,UNKNOWN — preserves prior .safety-policy.yml policy
-#   (ignore-cvss-severity-below: 7 + ignore-cvss-unknown-severity: False).
+# Default: CRITICAL — only CVSS >= 9.0 findings fail the scan.
 # osv-scanner has no native CVSS threshold (google/osv-scanner#1400, closed
 # not-planned). Severity is derived from $group.max_severity (numeric CVSS
 # score string) which osv-scanner emits per group.
@@ -33,7 +32,7 @@ set -euo pipefail
 
 ROOT="$(git rev-parse --show-toplevel)"
 CONFIG="${ROOT}/osv-scanner.toml"
-SEVERITY_LEVELS="${OSV_SEVERITY_LEVELS:-HIGH,CRITICAL,UNKNOWN}"
+SEVERITY_LEVELS="${OSV_SEVERITY_LEVELS:-CRITICAL}"
 
 for bin in osv-scanner jq; do
   if ! command -v "${bin}" >/dev/null 2>&1; then
diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml
index 44482e2428..e1bd756d86 100644
--- a/.github/workflows/api-container-checks.yml
+++ b/.github/workflows/api-container-checks.yml
@@ -134,5 +134,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'false'
+          fail-on-critical: 'true'
           severity: 'CRITICAL'
diff --git a/.github/workflows/mcp-container-checks.yml b/.github/workflows/mcp-container-checks.yml
index 7493e1b763..5f7a9f1447 100644
--- a/.github/workflows/mcp-container-checks.yml
+++ b/.github/workflows/mcp-container-checks.yml
@@ -127,5 +127,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'false'
+          fail-on-critical: 'true'
           severity: 'CRITICAL'
diff --git a/.github/workflows/sdk-container-checks.yml b/.github/workflows/sdk-container-checks.yml
index 42709ac6f7..fcb30578d8 100644
--- a/.github/workflows/sdk-container-checks.yml
+++ b/.github/workflows/sdk-container-checks.yml
@@ -153,5 +153,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'false'
+          fail-on-critical: 'true'
           severity: 'CRITICAL'
diff --git a/.github/workflows/ui-container-checks.yml b/.github/workflows/ui-container-checks.yml
index 0eae703fce..10415f4d48 100644
--- a/.github/workflows/ui-container-checks.yml
+++ b/.github/workflows/ui-container-checks.yml
@@ -132,5 +132,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'false'
+          fail-on-critical: 'true'
           severity: 'CRITICAL'

From a679865cce358f536c8bf4dffc7cad208676856f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Mon, 15 Jun 2026 10:38:28 +0200
Subject: [PATCH 029/126] ci: always run container and dependency vulnerability
 scans on PRs (#11582)

---
 .github/workflows/api-container-checks.yml |  3 --
 .github/workflows/api-security.yml         |  7 ----
 .github/workflows/mcp-container-checks.yml |  3 --
 .github/workflows/mcp-security.yml         |  6 ----
 .github/workflows/sdk-container-checks.yml | 29 ++++-------------
 .github/workflows/sdk-security.yml         | 37 ++++++----------------
 .github/workflows/ui-container-checks.yml  |  3 --
 .github/workflows/ui-security.yml          |  6 ----
 8 files changed, 15 insertions(+), 79 deletions(-)

diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml
index e1bd756d86..d12bf5d2d4 100644
--- a/.github/workflows/api-container-checks.yml
+++ b/.github/workflows/api-container-checks.yml
@@ -12,9 +12,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'api/**'
-      - '.github/workflows/api-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/api-security.yml b/.github/workflows/api-security.yml
index ba7f5fe58a..ed4e5476d2 100644
--- a/.github/workflows/api-security.yml
+++ b/.github/workflows/api-security.yml
@@ -16,13 +16,6 @@ on:
     branches:
       - "master"
       - "v5.*"
-    paths:
-      - 'api/**'
-      - '.github/workflows/api-tests.yml'
-      - '.github/workflows/api-security.yml'
-      - '.github/actions/setup-python-uv/**'
-      - '.github/actions/osv-scanner/**'
-      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/mcp-container-checks.yml b/.github/workflows/mcp-container-checks.yml
index 5f7a9f1447..23e6ba2984 100644
--- a/.github/workflows/mcp-container-checks.yml
+++ b/.github/workflows/mcp-container-checks.yml
@@ -12,9 +12,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'mcp_server/**'
-      - '.github/workflows/mcp-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/mcp-security.yml b/.github/workflows/mcp-security.yml
index 66a5cd8c0d..fc76756e40 100644
--- a/.github/workflows/mcp-security.yml
+++ b/.github/workflows/mcp-security.yml
@@ -15,12 +15,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'mcp_server/pyproject.toml'
-      - 'mcp_server/uv.lock'
-      - '.github/workflows/mcp-security.yml'
-      - '.github/actions/osv-scanner/**'
-      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/sdk-container-checks.yml b/.github/workflows/sdk-container-checks.yml
index fcb30578d8..2b436db468 100644
--- a/.github/workflows/sdk-container-checks.yml
+++ b/.github/workflows/sdk-container-checks.yml
@@ -15,12 +15,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'prowler/**'
-      - 'Dockerfile*'
-      - 'pyproject.toml'
-      - 'uv.lock'
-      - '.github/workflows/sdk-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -111,25 +105,14 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: ./**
+          files: |
+            prowler/**
+            Dockerfile*
+            pyproject.toml
+            uv.lock
+            .github/workflows/sdk-container-checks.yml
           files_ignore: |
-            .github/**
             prowler/CHANGELOG.md
-            docs/**
-            permissions/**
-            api/**
-            ui/**
-            dashboard/**
-            mcp_server/**
-            skills/**
-            README.md
-            mkdocs.yml
-            .backportrc.json
-            .env
-            docker-compose*
-            examples/**
-            .gitignore
-            contrib/**
             **/AGENTS.md
 
       - name: Set up Docker Buildx
diff --git a/.github/workflows/sdk-security.yml b/.github/workflows/sdk-security.yml
index c18f56ea8f..11a7894ce8 100644
--- a/.github/workflows/sdk-security.yml
+++ b/.github/workflows/sdk-security.yml
@@ -19,16 +19,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'prowler/**'
-      - 'tests/**'
-      - 'pyproject.toml'
-      - 'uv.lock'
-      - '.github/workflows/sdk-tests.yml'
-      - '.github/workflows/sdk-security.yml'
-      - '.github/actions/setup-python-uv/**'
-      - '.github/actions/osv-scanner/**'
-      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -71,27 +61,18 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files:
-            ./**
+          files: |
+            prowler/**
+            tests/**
+            pyproject.toml
+            uv.lock
+            .github/workflows/sdk-tests.yml
             .github/workflows/sdk-security.yml
+            .github/actions/setup-python-uv/**
+            .github/actions/osv-scanner/**
+            .github/scripts/osv-scan.sh
           files_ignore: |
-            .github/**
             prowler/CHANGELOG.md
-            docs/**
-            permissions/**
-            api/**
-            ui/**
-            dashboard/**
-            mcp_server/**
-            skills/**
-            README.md
-            mkdocs.yml
-            .backportrc.json
-            .env
-            docker-compose*
-            examples/**
-            .gitignore
-            contrib/**
             **/AGENTS.md
 
       - name: Setup Python with uv
diff --git a/.github/workflows/ui-container-checks.yml b/.github/workflows/ui-container-checks.yml
index 10415f4d48..a931e50f22 100644
--- a/.github/workflows/ui-container-checks.yml
+++ b/.github/workflows/ui-container-checks.yml
@@ -12,9 +12,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'ui/**'
-      - '.github/workflows/ui-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/ui-security.yml b/.github/workflows/ui-security.yml
index 470fae1f9c..e178e9b3b0 100644
--- a/.github/workflows/ui-security.yml
+++ b/.github/workflows/ui-security.yml
@@ -15,12 +15,6 @@ on:
     branches:
       - 'master'
       - 'v5.*'
-    paths:
-      - 'ui/package.json'
-      - 'ui/pnpm-lock.yaml'
-      - '.github/workflows/ui-security.yml'
-      - '.github/actions/osv-scanner/**'
-      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}

From dccd674cf934abc1abb44b54f53a0c9839e92f6b Mon Sep 17 00:00:00 2001
From: Branch Vincent <branchevincent@gmail.com>
Date: Mon, 15 Jun 2026 01:59:51 -0700
Subject: [PATCH 030/126] chore(sdk): support Python 3.13 (#9293)

Co-authored-by: Pepe Fagoaga <pepe@prowler.com>
---
 .github/workflows/sdk-code-quality.yml        |   1 +
 .github/workflows/sdk-tests.yml               |   9 +-
 prowler/CHANGELOG.md                          |   5 +
 .../providers/aws/lib/ip_ranges/__init__.py   |   0
 .../providers/aws/lib/ip_ranges/ip_ranges.py  |  51 ++
 .../route53_dangling_ip_subdomain_takeover.py |  18 +-
 pyproject.toml                                |  10 +-
 .../aws/lib/ip_ranges/ip_ranges_test.py       | 112 ++++
 uv.lock                                       | 548 ++++++++++++++++--
 9 files changed, 683 insertions(+), 71 deletions(-)
 create mode 100644 prowler/providers/aws/lib/ip_ranges/__init__.py
 create mode 100644 prowler/providers/aws/lib/ip_ranges/ip_ranges.py
 create mode 100644 tests/providers/aws/lib/ip_ranges/ip_ranges_test.py

diff --git a/.github/workflows/sdk-code-quality.yml b/.github/workflows/sdk-code-quality.yml
index 5c76547989..2b1efc69a9 100644
--- a/.github/workflows/sdk-code-quality.yml
+++ b/.github/workflows/sdk-code-quality.yml
@@ -29,6 +29,7 @@ jobs:
           - '3.10'
           - '3.11'
           - '3.12'
+          - '3.13'
 
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml
index 59316c0d95..2952ebc2d5 100644
--- a/.github/workflows/sdk-tests.yml
+++ b/.github/workflows/sdk-tests.yml
@@ -29,6 +29,7 @@ jobs:
           - '3.10'
           - '3.11'
           - '3.12'
+          - '3.13'
 
     steps:
       - name: Harden Runner
@@ -540,7 +541,7 @@ jobs:
         with:
           flags: prowler-py${{ matrix.python-version }}-vercel
           files: ./vercel_coverage.xml
-      
+
       # Scaleway Provider
       - name: Check if Scaleway files changed
         if: steps.check-changes.outputs.any_changed == 'true'
@@ -588,7 +589,7 @@ jobs:
         with:
           flags: prowler-py${{ matrix.python-version }}-stackit
           files: ./stackit_coverage.xml
- 
+
       # External Provider (dynamic loading)
       - name: Check if External Provider files changed
         if: steps.check-changes.outputs.any_changed == 'true'
@@ -608,14 +609,14 @@ jobs:
 
       - name: Upload External Provider coverage to Codecov
         if: steps.changed-external.outputs.any_changed == 'true'
-     
+
         uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
           flags: prowler-py${{ matrix.python-version }}-external
           files: ./external_coverage.xml
-          
+
       # Lib
       - name: Check if Lib files changed
         if: steps.check-changes.outputs.any_changed == 'true'
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 904bfb829c..7d058a6be0 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -6,6 +6,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ### 🚀 Added
 
+- Support for Python 3.13 [(#9293)](https://github.com/prowler-cloud/prowler/pull/9293)
 - `securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
 - `config_delegated_admin_and_org_aggregator_all_regions` check for AWS provider, verifying that AWS Config has a delegated administrator and an organization aggregator covering all AWS regions [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
 - `sagemaker_clarify_exists` check for AWS provider [(#11211)](https://github.com/prowler-cloud/prowler/pull/11211)
@@ -13,6 +14,10 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 
+### 🔄 Changed
+
+- Replaced the unmaintained `awsipranges` dependency with a small standard-library helper for the `route53_dangling_ip_subdomain_takeover` check [(#9293)](https://github.com/prowler-cloud/prowler/pull/9293)
+
 ---
 
 ## [5.30.0] (Prowler v5.30.0)
diff --git a/prowler/providers/aws/lib/ip_ranges/__init__.py b/prowler/providers/aws/lib/ip_ranges/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/lib/ip_ranges/ip_ranges.py b/prowler/providers/aws/lib/ip_ranges/ip_ranges.py
new file mode 100644
index 0000000000..3dbb9d1b17
--- /dev/null
+++ b/prowler/providers/aws/lib/ip_ranges/ip_ranges.py
@@ -0,0 +1,51 @@
+import json
+import urllib.error
+import urllib.request
+from ipaddress import ip_network
+
+from prowler.lib.logger import logger
+
+AWS_IP_RANGES_URL = "https://ip-ranges.amazonaws.com/ip-ranges.json"
+AWS_IP_RANGES_TIMEOUT = 10
+
+
+def get_public_ip_networks() -> list:
+    """Fetch the AWS public IP prefixes as a list of ip_network objects.
+
+    The request verifies the server certificate against the system trust store,
+    matching urllib's default behaviour. This replaces the unmaintained
+    awsipranges package, whose latest release (0.3.3) calls
+    urllib.request.urlopen() with the cafile/capath arguments that Python 3.13
+    removed.
+
+    Returns an empty list when the feed cannot be fetched or parsed, and skips
+    individual malformed prefixes, so a transient or corrupt feed never aborts
+    the calling check.
+    """
+    try:
+        with urllib.request.urlopen(
+            AWS_IP_RANGES_URL, timeout=AWS_IP_RANGES_TIMEOUT
+        ) as response:
+            ranges = json.loads(response.read())
+    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as error:
+        logger.error(
+            f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+        )
+        return []
+
+    networks = []
+    for key, prefixes in (
+        ("ip_prefix", ranges.get("prefixes", [])),
+        ("ipv6_prefix", ranges.get("ipv6_prefixes", [])),
+    ):
+        for prefix in prefixes:
+            cidr = prefix.get(key)
+            if not cidr:
+                continue
+            try:
+                networks.append(ip_network(cidr))
+            except ValueError as error:
+                logger.warning(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+    return networks
diff --git a/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py b/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py
index caf3629816..25703b979f 100644
--- a/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py
+++ b/prowler/providers/aws/services/route53/route53_dangling_ip_subdomain_takeover/route53_dangling_ip_subdomain_takeover.py
@@ -1,10 +1,9 @@
 import re
 from ipaddress import ip_address
 
-import awsipranges
-
 from prowler.lib.check.models import Check, Check_Report_AWS
 from prowler.lib.utils.utils import validate_ip_address
+from prowler.providers.aws.lib.ip_ranges.ip_ranges import get_public_ip_networks
 from prowler.providers.aws.services.ec2.ec2_client import ec2_client
 from prowler.providers.aws.services.route53.route53_client import route53_client
 from prowler.providers.aws.services.s3.s3_client import s3_client
@@ -21,6 +20,10 @@ class route53_dangling_ip_subdomain_takeover(Check):
     def execute(self) -> Check_Report_AWS:
         findings = []
 
+        # AWS public IP prefixes are fetched lazily, at most once per run, only
+        # when a dangling-candidate public IP is found.
+        aws_ip_networks = None
+
         # When --region is used, Route53 service gathers EIPs from all regions
         # to avoid false positives. Otherwise, use ec2_client data directly.
         if route53_client.all_account_elastic_ips:
@@ -42,6 +45,7 @@ class route53_dangling_ip_subdomain_takeover(Check):
             if record_set.type == "A" and not record_set.is_alias:
                 for record in record_set.records:
                     if validate_ip_address(record):
+                        record_ip = ip_address(record)
                         report = Check_Report_AWS(
                             metadata=self.metadata(), resource=record_set
                         )
@@ -53,14 +57,12 @@ class route53_dangling_ip_subdomain_takeover(Check):
                         report.status = "PASS"
                         report.status_extended = f"Route53 record {record} (name: {record_set.name}) in Hosted Zone {hosted_zone.name} is not a dangling IP."
                         # If Public IP check if it is in the AWS Account
-                        if (
-                            not ip_address(record).is_private
-                            and record not in public_ips
-                        ):
+                        if not record_ip.is_private and record not in public_ips:
                             report.status_extended = f"Route53 record {record} (name: {record_set.name}) in Hosted Zone {hosted_zone.name} does not belong to AWS and it is not a dangling IP."
                             # Check if potential dangling IP is within AWS Ranges
-                            aws_ip_ranges = awsipranges.get_ranges()
-                            if aws_ip_ranges.get(record):
+                            if aws_ip_networks is None:
+                                aws_ip_networks = get_public_ip_networks()
+                            if any(record_ip in network for network in aws_ip_networks):
                                 report.status = "FAIL"
                                 report.status_extended = f"Route53 record {record} (name: {record_set.name}) in Hosted Zone {hosted_zone.name} is a dangling IP which can lead to a subdomain takeover attack."
                         findings.append(report)
diff --git a/pyproject.toml b/pyproject.toml
index 41fec77a42..26c8237b95 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -32,10 +32,10 @@ classifiers = [
   "Programming Language :: Python :: 3",
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
-  "Programming Language :: Python :: 3.12"
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13"
 ]
 dependencies = [
-  "awsipranges==0.3.3",
   "alive-progress==3.3.0",
   "azure-identity==1.21.0",
   "azure-keyvault-keys==4.10.0",
@@ -80,8 +80,8 @@ dependencies = [
   "kubernetes==32.0.1",
   "markdown==3.10.2",
   "microsoft-kiota-abstractions==1.9.2",
+  "numpy==2.2.6",
   "msgraph-sdk==1.55.0",
-  "numpy==2.0.2",
   "okta==3.4.2",
   "openstacksdk==4.2.0",
   "pandas==2.2.3",
@@ -100,7 +100,7 @@ dependencies = [
   "tabulate==0.9.0",
   "tzlocal==5.3.1",
   "uuid6==2024.7.10",
-  "py-iam-expand==0.1.0",
+  "py-iam-expand==0.3.0",
   "h2==4.3.0",
   "oci==2.169.0",
   "alibabacloud_credentials==1.0.3",
@@ -123,7 +123,7 @@ license = "Apache-2.0"
 maintainers = [{name = "Prowler Engineering", email = "engineering@prowler.com"}]
 name = "prowler"
 readme = "README.md"
-requires-python = ">=3.10,<3.13"
+requires-python = ">=3.10,<3.14"
 version = "5.31.0"
 
 [project.scripts]
diff --git a/tests/providers/aws/lib/ip_ranges/ip_ranges_test.py b/tests/providers/aws/lib/ip_ranges/ip_ranges_test.py
new file mode 100644
index 0000000000..bce53165d6
--- /dev/null
+++ b/tests/providers/aws/lib/ip_ranges/ip_ranges_test.py
@@ -0,0 +1,112 @@
+import json
+import urllib.error
+from ipaddress import IPv4Network, IPv6Network, ip_address
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.aws.lib.ip_ranges.ip_ranges import get_public_ip_networks
+
+URLOPEN_TARGET = "prowler.providers.aws.lib.ip_ranges.ip_ranges.urllib.request.urlopen"
+
+SAMPLE_RANGES = {
+    "prefixes": [
+        {"ip_prefix": "54.152.0.0/16", "service": "AMAZON"},
+        {"ip_prefix": "3.5.140.0/22", "service": "S3"},
+    ],
+    "ipv6_prefixes": [
+        {"ipv6_prefix": "2600:1f00::/24", "service": "AMAZON"},
+    ],
+}
+
+
+def mock_urlopen(payload):
+    response = MagicMock()
+    response.read.return_value = json.dumps(payload).encode()
+    context_manager = MagicMock()
+    context_manager.__enter__.return_value = response
+    context_manager.__exit__.return_value = False
+    return context_manager
+
+
+class TestGetPublicIPNetworks:
+    def test_parses_ipv4_and_ipv6_prefixes(self):
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(SAMPLE_RANGES)):
+            networks = get_public_ip_networks()
+
+        assert networks == [
+            IPv4Network("54.152.0.0/16"),
+            IPv4Network("3.5.140.0/22"),
+            IPv6Network("2600:1f00::/24"),
+        ]
+
+    def test_known_aws_ip_is_contained(self):
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(SAMPLE_RANGES)):
+            networks = get_public_ip_networks()
+
+        assert any(ip_address("54.152.12.70") in network for network in networks)
+
+    def test_external_ip_is_not_contained(self):
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(SAMPLE_RANGES)):
+            networks = get_public_ip_networks()
+
+        assert not any(ip_address("17.5.7.3") in network for network in networks)
+
+    def test_empty_payload_returns_empty_list(self):
+        with patch(
+            "prowler.providers.aws.lib.ip_ranges.ip_ranges.urllib.request.urlopen",
+            return_value=mock_urlopen({}),
+        ):
+            networks = get_public_ip_networks()
+
+        assert networks == []
+
+    def test_prefixes_missing_cidr_are_skipped(self):
+        payload = {
+            "prefixes": [{"ip_prefix": "10.0.0.0/8"}, {"service": "EC2"}],
+            "ipv6_prefixes": [{"service": "AMAZON"}],
+        }
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(payload)):
+            networks = get_public_ip_networks()
+
+        assert networks == [IPv4Network("10.0.0.0/8")]
+
+    def test_urlopen_failure_returns_empty_list(self):
+        with patch(URLOPEN_TARGET, side_effect=urllib.error.URLError("boom")):
+            networks = get_public_ip_networks()
+
+        assert networks == []
+
+    def test_timeout_returns_empty_list(self):
+        with patch(URLOPEN_TARGET, side_effect=TimeoutError("timed out")):
+            networks = get_public_ip_networks()
+
+        assert networks == []
+
+    def test_invalid_json_returns_empty_list(self):
+        response = MagicMock()
+        response.read.return_value = b"not json"
+        context_manager = MagicMock()
+        context_manager.__enter__.return_value = response
+        context_manager.__exit__.return_value = False
+        with patch(URLOPEN_TARGET, return_value=context_manager):
+            networks = get_public_ip_networks()
+
+        assert networks == []
+
+    def test_malformed_cidr_is_skipped(self):
+        payload = {
+            "prefixes": [
+                {"ip_prefix": "300.0.0.0/8"},
+                {"ip_prefix": "10.0.0.0/8"},
+            ],
+            "ipv6_prefixes": [
+                {"ipv6_prefix": "2600::/129"},
+                {"ipv6_prefix": "2600:1f00::/24"},
+            ],
+        }
+        with patch(URLOPEN_TARGET, return_value=mock_urlopen(payload)):
+            networks = get_public_ip_networks()
+
+        assert networks == [
+            IPv4Network("10.0.0.0/8"),
+            IPv6Network("2600:1f00::/24"),
+        ]
diff --git a/uv.lock b/uv.lock
index be25aea7da..42fef8fe94 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,8 +1,9 @@
 version = 1
 revision = 3
-requires-python = ">=3.10, <3.13"
+requires-python = ">=3.10, <3.14"
 resolution-markers = [
-    "python_full_version >= '3.12'",
+    "python_full_version >= '3.13'",
+    "python_full_version == '3.12.*'",
     "python_full_version == '3.11.*'",
     "python_full_version < '3.11'",
 ]
@@ -319,6 +320,23 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/84/63/7749337c90f92bc2cb18f9560d67aa6258c7060d1397d21529b8004fcf6f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:888e78eb5ca55a615d285c3c09a7a91b42e9dd6fc699b166ebd5dee87c9ccf14", size = 1732427, upload-time = "2026-03-31T21:58:06.337Z" },
     { url = "https://files.pythonhosted.org/packages/98/de/cf2f44ff98d307e72fb97d5f5bbae3bfcb442f0ea9790c0bf5c5c2331404/aiohttp-3.13.5-cp312-cp312-win32.whl", hash = "sha256:8bd3ec6376e68a41f9f95f5ed170e2fcf22d4eb27a1f8cb361d0508f6e0557f3", size = 433534, upload-time = "2026-03-31T21:58:08.712Z" },
     { url = "https://files.pythonhosted.org/packages/aa/ca/eadf6f9c8fa5e31d40993e3db153fb5ed0b11008ad5d9de98a95045bed84/aiohttp-3.13.5-cp312-cp312-win_amd64.whl", hash = "sha256:110e448e02c729bcebb18c60b9214a87ba33bac4a9fa5e9a5f139938b56c6cb1", size = 460446, upload-time = "2026-03-31T21:58:10.945Z" },
+    { url = "https://files.pythonhosted.org/packages/78/e9/d76bf503005709e390122d34e15256b88f7008e246c4bdbe915cd4f1adce/aiohttp-3.13.5-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:a5029cc80718bbd545123cd8fe5d15025eccaaaace5d0eeec6bd556ad6163d61", size = 742930, upload-time = "2026-03-31T21:58:13.155Z" },
+    { url = "https://files.pythonhosted.org/packages/57/00/4b7b70223deaebd9bb85984d01a764b0d7bd6526fcdc73cca83bcbe7243e/aiohttp-3.13.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4bb6bf5811620003614076bdc807ef3b5e38244f9d25ca5fe888eaccea2a9832", size = 496927, upload-time = "2026-03-31T21:58:15.073Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/f5/0fb20fb49f8efdcdce6cd8127604ad2c503e754a8f139f5e02b01626523f/aiohttp-3.13.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a84792f8631bf5a94e52d9cc881c0b824ab42717165a5579c760b830d9392ac9", size = 497141, upload-time = "2026-03-31T21:58:17.009Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/86/b7c870053e36a94e8951b803cb5b909bfbc9b90ca941527f5fcafbf6b0fa/aiohttp-3.13.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:57653eac22c6a4c13eb22ecf4d673d64a12f266e72785ab1c8b8e5940d0e8090", size = 1732476, upload-time = "2026-03-31T21:58:18.925Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/e5/4e161f84f98d80c03a238671b4136e6530453d65262867d989bbe78244d0/aiohttp-3.13.5-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e5e5f7debc7a57af53fdf5c5009f9391d9f4c12867049d509bf7bb164a6e295b", size = 1706507, upload-time = "2026-03-31T21:58:21.094Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/56/ea11a9f01518bd5a2a2fcee869d248c4b8a0cfa0bb13401574fa31adf4d4/aiohttp-3.13.5-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c719f65bebcdf6716f10e9eff80d27567f7892d8988c06de12bbbd39307c6e3a", size = 1773465, upload-time = "2026-03-31T21:58:23.159Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/40/333ca27fb74b0383f17c90570c748f7582501507307350a79d9f9f3c6eb1/aiohttp-3.13.5-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d97f93fdae594d886c5a866636397e2bcab146fd7a132fd6bb9ce182224452f8", size = 1873523, upload-time = "2026-03-31T21:58:25.59Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/d2/e2f77eef1acb7111405433c707dc735e63f67a56e176e72e9e7a2cd3f493/aiohttp-3.13.5-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3df334e39d4c2f899a914f1dba283c1aadc311790733f705182998c6f7cae665", size = 1754113, upload-time = "2026-03-31T21:58:27.624Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/56/3f653d7f53c89669301ec9e42c95233e2a0c0a6dd051269e6e678db4fdb0/aiohttp-3.13.5-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fe6970addfea9e5e081401bcbadf865d2b6da045472f58af08427e108d618540", size = 1562351, upload-time = "2026-03-31T21:58:29.918Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/a6/9b3e91eb8ae791cce4ee736da02211c85c6f835f1bdfac0594a8a3b7018c/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7becdf835feff2f4f335d7477f121af787e3504b48b449ff737afb35869ba7bb", size = 1693205, upload-time = "2026-03-31T21:58:32.214Z" },
+    { url = "https://files.pythonhosted.org/packages/98/fc/bfb437a99a2fcebd6b6eaec609571954de2ed424f01c352f4b5504371dd3/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:676e5651705ad5d8a70aeb8eb6936c436d8ebbd56e63436cb7dd9bb36d2a9a46", size = 1730618, upload-time = "2026-03-31T21:58:34.728Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/b6/c8534862126191a034f68153194c389addc285a0f1347d85096d349bbc15/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:9b16c653d38eb1a611cc898c41e76859ca27f119d25b53c12875fd0474ae31a8", size = 1745185, upload-time = "2026-03-31T21:58:36.909Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/93/4ca8ee2ef5236e2707e0fd5fecb10ce214aee1ff4ab307af9c558bda3b37/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:999802d5fa0389f58decd24b537c54aa63c01c3219ce17d1214cbda3c2b22d2d", size = 1557311, upload-time = "2026-03-31T21:58:39.38Z" },
+    { url = "https://files.pythonhosted.org/packages/57/ae/76177b15f18c5f5d094f19901d284025db28eccc5ae374d1d254181d33f4/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:ec707059ee75732b1ba130ed5f9580fe10ff75180c812bc267ded039db5128c6", size = 1773147, upload-time = "2026-03-31T21:58:41.476Z" },
+    { url = "https://files.pythonhosted.org/packages/01/a4/62f05a0a98d88af59d93b7fcac564e5f18f513cb7471696ac286db970d6a/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2d6d44a5b48132053c2f6cd5c8cb14bc67e99a63594e336b0f2af81e94d5530c", size = 1730356, upload-time = "2026-03-31T21:58:44.049Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/85/fc8601f59dfa8c9523808281f2da571f8b4699685f9809a228adcc90838d/aiohttp-3.13.5-cp313-cp313-win32.whl", hash = "sha256:329f292ed14d38a6c4c435e465f48bebb47479fd676a0411936cc371643225cc", size = 432637, upload-time = "2026-03-31T21:58:46.167Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/1b/ac685a8882896acf0f6b31d689e3792199cfe7aba37969fa91da63a7fa27/aiohttp-3.13.5-cp313-cp313-win_amd64.whl", hash = "sha256:69f571de7500e0557801c0b51f4780482c0ec5fe2ac851af5a92cfce1af1cb83", size = 458896, upload-time = "2026-03-31T21:58:48.119Z" },
 ]
 
 [[package]]
@@ -327,7 +345,7 @@ version = "1.4.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "frozenlist" },
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/61/62/06741b579156360248d1ec624842ad0edf697050bbaf7c3e46394e106ad1/aiosignal-1.4.0.tar.gz", hash = "sha256:f47eecd9468083c2029cc99945502cb7708b082c232f9aca65da147157b251c7", size = 25007, upload-time = "2025-07-03T22:54:43.528Z" }
 wheels = [
@@ -752,7 +770,7 @@ source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "exceptiongroup", marker = "python_full_version < '3.11'" },
     { name = "idna" },
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/19/14/2c5dd9f512b66549ae92767a9c7b330ae88e1932ca57876909410251fe13/anyio-4.13.0.tar.gz", hash = "sha256:334b70e641fd2221c1505b3890c69882fe4a2df910cba14d97019b90b24439dc", size = 231622, upload-time = "2026-03-24T12:59:09.671Z" }
 wheels = [
@@ -829,15 +847,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ef/c3/f30a7a63e664acc7c2545ca0491b6ce8264536e0e5cad3965f1d1b91e960/aws_xray_sdk-2.15.0-py2.py3-none-any.whl", hash = "sha256:422d62ad7d52e373eebb90b642eb1bb24657afe03b22a8df4a8b2e5108e278a3", size = 103228, upload-time = "2025-10-29T21:00:24.12Z" },
 ]
 
-[[package]]
-name = "awsipranges"
-version = "0.3.3"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/19/2e/6efa95f995369da828715f41705686cd214b9259ed758266942553d40441/awsipranges-0.3.3.tar.gz", hash = "sha256:4f0b3f22a9dc1163c85b513bed812b6c92bdacd674e6a7b68252a3c25b99e2c0", size = 16739, upload-time = "2022-02-10T21:08:32.825Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/83/ce/5c9a8bf91bdc9592a409c99e58fd99f2727ab8d634719c0ad796021b76d7/awsipranges-0.3.3-py3-none-any.whl", hash = "sha256:f3d7a54aeaf7fe310beb5d377a4034a63a51b72677ae6af3e0967bc4de7eedaf", size = 18106, upload-time = "2022-02-10T21:08:31.497Z" },
-]
-
 [[package]]
 name = "azure-common"
 version = "1.1.28"
@@ -1310,6 +1319,10 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/13/f3/89aac8a83d73937ccd39bbe8fc6ac8860c11cfa0af5b1c96d081facac844/black-25.1.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1e2978f6df243b155ef5fa7e558a43037c3079093ed5d10fd84c43900f2d8ecc", size = 1453985, upload-time = "2025-01-29T05:37:18.273Z" },
     { url = "https://files.pythonhosted.org/packages/6f/22/b99efca33f1f3a1d2552c714b1e1b5ae92efac6c43e790ad539a163d1754/black-25.1.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3b48735872ec535027d979e8dcb20bf4f70b5ac75a8ea99f127c106a7d7aba9f", size = 1783816, upload-time = "2025-01-29T04:18:33.823Z" },
     { url = "https://files.pythonhosted.org/packages/18/7e/a27c3ad3822b6f2e0e00d63d58ff6299a99a5b3aee69fa77cd4b0076b261/black-25.1.0-cp312-cp312-win_amd64.whl", hash = "sha256:ea0213189960bda9cf99be5b8c8ce66bb054af5e9e861249cd23471bd7b0b3ba", size = 1440860, upload-time = "2025-01-29T04:19:12.944Z" },
+    { url = "https://files.pythonhosted.org/packages/98/87/0edf98916640efa5d0696e1abb0a8357b52e69e82322628f25bf14d263d1/black-25.1.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8f0b18a02996a836cc9c9c78e5babec10930862827b1b724ddfe98ccf2f2fe4f", size = 1650673, upload-time = "2025-01-29T05:37:20.574Z" },
+    { url = "https://files.pythonhosted.org/packages/52/e5/f7bf17207cf87fa6e9b676576749c6b6ed0d70f179a3d812c997870291c3/black-25.1.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:afebb7098bfbc70037a053b91ae8437c3857482d3a690fefc03e9ff7aa9a5fd3", size = 1453190, upload-time = "2025-01-29T05:37:22.106Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/ee/adda3d46d4a9120772fae6de454c8495603c37c4c3b9c60f25b1ab6401fe/black-25.1.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:030b9759066a4ee5e5aca28c3c77f9c64789cdd4de8ac1df642c40b708be6171", size = 1782926, upload-time = "2025-01-29T04:18:58.564Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/64/94eb5f45dcb997d2082f097a3944cfc7fe87e071907f677e80788a2d7b7a/black-25.1.0-cp313-cp313-win_amd64.whl", hash = "sha256:a22f402b410566e2d1c950708c77ebf5ebd5d0d88a6a2e87c86d9fb48afa0d18", size = 1442613, upload-time = "2025-01-29T04:19:27.63Z" },
     { url = "https://files.pythonhosted.org/packages/09/71/54e999902aed72baf26bca0d50781b01838251a462612966e9fc4891eadd/black-25.1.0-py3-none-any.whl", hash = "sha256:95e8176dae143ba9097f351d174fdaf0ccd29efb414b362ae3fd72bf0f710717", size = 207646, upload-time = "2025-01-29T04:15:38.082Z" },
 ]
 
@@ -1405,6 +1418,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/7b/2b/2b6435f76bfeb6bbf055596976da087377ede68df465419d192acf00c437/cffi-2.0.0-cp312-cp312-win32.whl", hash = "sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18", size = 172932, upload-time = "2025-09-08T23:22:57.188Z" },
     { url = "https://files.pythonhosted.org/packages/f8/ed/13bd4418627013bec4ed6e54283b1959cf6db888048c7cf4b4c3b5b36002/cffi-2.0.0-cp312-cp312-win_amd64.whl", hash = "sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5", size = 183557, upload-time = "2025-09-08T23:22:58.351Z" },
     { url = "https://files.pythonhosted.org/packages/95/31/9f7f93ad2f8eff1dbc1c3656d7ca5bfd8fb52c9d786b4dcf19b2d02217fa/cffi-2.0.0-cp312-cp312-win_arm64.whl", hash = "sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6", size = 177762, upload-time = "2025-09-08T23:22:59.668Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/8d/a0a47a0c9e413a658623d014e91e74a50cdd2c423f7ccfd44086ef767f90/cffi-2.0.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb", size = 185230, upload-time = "2025-09-08T23:23:00.879Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/d2/a6c0296814556c68ee32009d9c2ad4f85f2707cdecfd7727951ec228005d/cffi-2.0.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca", size = 181043, upload-time = "2025-09-08T23:23:02.231Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/1e/d22cc63332bd59b06481ceaac49d6c507598642e2230f201649058a7e704/cffi-2.0.0-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b", size = 212446, upload-time = "2025-09-08T23:23:03.472Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/f5/a2c23eb03b61a0b8747f211eb716446c826ad66818ddc7810cc2cc19b3f2/cffi-2.0.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b", size = 220101, upload-time = "2025-09-08T23:23:04.792Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/7f/e6647792fc5850d634695bc0e6ab4111ae88e89981d35ac269956605feba/cffi-2.0.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2", size = 207948, upload-time = "2025-09-08T23:23:06.127Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/1e/a5a1bd6f1fb30f22573f76533de12a00bf274abcdc55c8edab639078abb6/cffi-2.0.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3", size = 206422, upload-time = "2025-09-08T23:23:07.753Z" },
+    { url = "https://files.pythonhosted.org/packages/98/df/0a1755e750013a2081e863e7cd37e0cdd02664372c754e5560099eb7aa44/cffi-2.0.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26", size = 219499, upload-time = "2025-09-08T23:23:09.648Z" },
+    { url = "https://files.pythonhosted.org/packages/50/e1/a969e687fcf9ea58e6e2a928ad5e2dd88cc12f6f0ab477e9971f2309b57c/cffi-2.0.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c", size = 222928, upload-time = "2025-09-08T23:23:10.928Z" },
+    { url = "https://files.pythonhosted.org/packages/36/54/0362578dd2c9e557a28ac77698ed67323ed5b9775ca9d3fe73fe191bb5d8/cffi-2.0.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b", size = 221302, upload-time = "2025-09-08T23:23:12.42Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/6d/bf9bda840d5f1dfdbf0feca87fbdb64a918a69bca42cfa0ba7b137c48cb8/cffi-2.0.0-cp313-cp313-win32.whl", hash = "sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27", size = 172909, upload-time = "2025-09-08T23:23:14.32Z" },
+    { url = "https://files.pythonhosted.org/packages/37/18/6519e1ee6f5a1e579e04b9ddb6f1676c17368a7aba48299c3759bbc3c8b3/cffi-2.0.0-cp313-cp313-win_amd64.whl", hash = "sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75", size = 183402, upload-time = "2025-09-08T23:23:15.535Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/0e/02ceeec9a7d6ee63bb596121c2c8e9b3a9e150936f4fbef6ca1943e6137c/cffi-2.0.0-cp313-cp313-win_arm64.whl", hash = "sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91", size = 177780, upload-time = "2025-09-08T23:23:16.761Z" },
 ]
 
 [[package]]
@@ -1479,6 +1504,22 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/86/eb/890922a8b03a568ca2f336c36585a4713c55d4d67bf0f0c78924be6315ca/charset_normalizer-3.4.7-cp312-cp312-win32.whl", hash = "sha256:2257141f39fe65a3fdf38aeccae4b953e5f3b3324f4ff0daf9f15b8518666a2c", size = 148460, upload-time = "2026-04-02T09:26:41.416Z" },
     { url = "https://files.pythonhosted.org/packages/35/d9/0e7dffa06c5ab081f75b1b786f0aefc88365825dfcd0ac544bdb7b2b6853/charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl", hash = "sha256:5ed6ab538499c8644b8a3e18debabcd7ce684f3fa91cf867521a7a0279cab2d6", size = 159330, upload-time = "2026-04-02T09:26:42.554Z" },
     { url = "https://files.pythonhosted.org/packages/9e/5d/481bcc2a7c88ea6b0878c299547843b2521ccbc40980cb406267088bc701/charset_normalizer-3.4.7-cp312-cp312-win_arm64.whl", hash = "sha256:56be790f86bfb2c98fb742ce566dfb4816e5a83384616ab59c49e0604d49c51d", size = 147828, upload-time = "2026-04-02T09:26:44.075Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/3b/66777e39d3ae1ddc77ee606be4ec6d8cbd4c801f65e5a1b6f2b11b8346dd/charset_normalizer-3.4.7-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:f496c9c3cc02230093d8330875c4c3cdfc3b73612a5fd921c65d39cbcef08063", size = 309627, upload-time = "2026-04-02T09:26:45.198Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/4e/b7f84e617b4854ade48a1b7915c8ccfadeba444d2a18c291f696e37f0d3b/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0ea948db76d31190bf08bd371623927ee1339d5f2a0b4b1b4a4439a65298703c", size = 207008, upload-time = "2026-04-02T09:26:46.824Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/bb/ec73c0257c9e11b268f018f068f5d00aa0ef8c8b09f7753ebd5f2880e248/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a277ab8928b9f299723bc1a2dabb1265911b1a76341f90a510368ca44ad9ab66", size = 228303, upload-time = "2026-04-02T09:26:48.397Z" },
+    { url = "https://files.pythonhosted.org/packages/85/fb/32d1f5033484494619f701e719429c69b766bfc4dbc61aa9e9c8c166528b/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3bec022aec2c514d9cf199522a802bd007cd588ab17ab2525f20f9c34d067c18", size = 224282, upload-time = "2026-04-02T09:26:49.684Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/07/330e3a0dda4c404d6da83b327270906e9654a24f6c546dc886a0eb0ffb23/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e044c39e41b92c845bc815e5ae4230804e8e7bc29e399b0437d64222d92809dd", size = 215595, upload-time = "2026-04-02T09:26:50.915Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/7c/fc890655786e423f02556e0216d4b8c6bcb6bdfa890160dc66bf52dee468/charset_normalizer-3.4.7-cp313-cp313-manylinux_2_31_armv7l.whl", hash = "sha256:f495a1652cf3fbab2eb0639776dad966c2fb874d79d87ca07f9d5f059b8bd215", size = 201986, upload-time = "2026-04-02T09:26:52.197Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/97/bfb18b3db2aed3b90cf54dc292ad79fdd5ad65c4eae454099475cbeadd0d/charset_normalizer-3.4.7-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e712b419df8ba5e42b226c510472b37bd57b38e897d3eca5e8cfd410a29fa859", size = 211711, upload-time = "2026-04-02T09:26:53.49Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/a5/a581c13798546a7fd557c82614a5c65a13df2157e9ad6373166d2a3e645d/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7804338df6fcc08105c7745f1502ba68d900f45fd770d5bdd5288ddccb8a42d8", size = 210036, upload-time = "2026-04-02T09:26:54.975Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/bf/b3ab5bcb478e4193d517644b0fb2bf5497fbceeaa7a1bc0f4d5b50953861/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:481551899c856c704d58119b5025793fa6730adda3571971af568f66d2424bb5", size = 202998, upload-time = "2026-04-02T09:26:56.303Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/4e/23efd79b65d314fa320ec6017b4b5834d5c12a58ba4610aa353af2e2f577/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:f59099f9b66f0d7145115e6f80dd8b1d847176df89b234a5a6b3f00437aa0832", size = 230056, upload-time = "2026-04-02T09:26:57.554Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/9f/1e1941bc3f0e01df116e68dc37a55c4d249df5e6fa77f008841aef68264f/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:f59ad4c0e8f6bba240a9bb85504faa1ab438237199d4cce5f622761507b8f6a6", size = 211537, upload-time = "2026-04-02T09:26:58.843Z" },
+    { url = "https://files.pythonhosted.org/packages/80/0f/088cbb3020d44428964a6c97fe1edfb1b9550396bf6d278330281e8b709c/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:3dedcc22d73ec993f42055eff4fcfed9318d1eeb9a6606c55892a26964964e48", size = 226176, upload-time = "2026-04-02T09:27:00.437Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/9f/130394f9bbe06f4f63e22641d32fc9b202b7e251c9aef4db044324dac493/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:64f02c6841d7d83f832cd97ccf8eb8a906d06eb95d5276069175c696b024b60a", size = 217723, upload-time = "2026-04-02T09:27:02.021Z" },
+    { url = "https://files.pythonhosted.org/packages/73/55/c469897448a06e49f8fa03f6caae97074fde823f432a98f979cc42b90e69/charset_normalizer-3.4.7-cp313-cp313-win32.whl", hash = "sha256:4042d5c8f957e15221d423ba781e85d553722fc4113f523f2feb7b188cc34c5e", size = 148085, upload-time = "2026-04-02T09:27:03.192Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/78/1b74c5bbb3f99b77a1715c91b3e0b5bdb6fe302d95ace4f5b1bec37b0167/charset_normalizer-3.4.7-cp313-cp313-win_amd64.whl", hash = "sha256:3946fa46a0cf3e4c8cb1cc52f56bb536310d34f25f01ca9b6c16afa767dab110", size = 158819, upload-time = "2026-04-02T09:27:04.454Z" },
+    { url = "https://files.pythonhosted.org/packages/68/86/46bd42279d323deb8687c4a5a811fd548cb7d1de10cf6535d099877a9a9f/charset_normalizer-3.4.7-cp313-cp313-win_arm64.whl", hash = "sha256:80d04837f55fc81da168b98de4f4b797ef007fc8a79ab71c6ec9bc4dd662b15b", size = 147915, upload-time = "2026-04-02T09:27:05.971Z" },
     { url = "https://files.pythonhosted.org/packages/db/8f/61959034484a4a7c527811f4721e75d02d653a35afb0b6054474d8185d4c/charset_normalizer-3.4.7-py3-none-any.whl", hash = "sha256:3dce51d0f5e7951f8bb4900c257dad282f49190fdbebecd4ba99bcc41fef404d", size = 61958, upload-time = "2026-04-02T09:28:37.794Z" },
 ]
 
@@ -1586,6 +1627,26 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/1c/8e/5bb04f0318805e190984c6ce106b4c3968a9562a400180e549855d8211bd/coverage-7.6.12-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:b076e625396e787448d27a411aefff867db2bffac8ed04e8f7056b07024eed5a", size = 241329, upload-time = "2025-02-11T14:45:53.19Z" },
     { url = "https://files.pythonhosted.org/packages/9e/9d/fa04d9e6c3f6459f4e0b231925277cfc33d72dfab7fa19c312c03e59da99/coverage-7.6.12-cp312-cp312-win32.whl", hash = "sha256:00b2086892cf06c7c2d74983c9595dc511acca00665480b3ddff749ec4fb2a95", size = 211289, upload-time = "2025-02-11T14:45:54.74Z" },
     { url = "https://files.pythonhosted.org/packages/53/40/53c7ffe3c0c3fff4d708bc99e65f3d78c129110d6629736faf2dbd60ad57/coverage-7.6.12-cp312-cp312-win_amd64.whl", hash = "sha256:7ae6eabf519bc7871ce117fb18bf14e0e343eeb96c377667e3e5dd12095e0288", size = 212079, upload-time = "2025-02-11T14:45:57.22Z" },
+    { url = "https://files.pythonhosted.org/packages/76/89/1adf3e634753c0de3dad2f02aac1e73dba58bc5a3a914ac94a25b2ef418f/coverage-7.6.12-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:488c27b3db0ebee97a830e6b5a3ea930c4a6e2c07f27a5e67e1b3532e76b9ef1", size = 208673, upload-time = "2025-02-11T14:45:59.618Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/64/92a4e239d64d798535c5b45baac6b891c205a8a2e7c9cc8590ad386693dc/coverage-7.6.12-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5d1095bbee1851269f79fd8e0c9b5544e4c00c0c24965e66d8cba2eb5bb535fd", size = 208945, upload-time = "2025-02-11T14:46:01.869Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/d0/4596a3ef3bca20a94539c9b1e10fd250225d1dec57ea78b0867a1cf9742e/coverage-7.6.12-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0533adc29adf6a69c1baa88c3d7dbcaadcffa21afbed3ca7a225a440e4744bf9", size = 242484, upload-time = "2025-02-11T14:46:03.527Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/ef/6fd0d344695af6718a38d0861408af48a709327335486a7ad7e85936dc6e/coverage-7.6.12-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:53c56358d470fa507a2b6e67a68fd002364d23c83741dbc4c2e0680d80ca227e", size = 239525, upload-time = "2025-02-11T14:46:05.973Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/4b/373be2be7dd42f2bcd6964059fd8fa307d265a29d2b9bcf1d044bcc156ed/coverage-7.6.12-cp313-cp313-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:64cbb1a3027c79ca6310bf101014614f6e6e18c226474606cf725238cf5bc2d4", size = 241545, upload-time = "2025-02-11T14:46:07.79Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/7d/0e83cc2673a7790650851ee92f72a343827ecaaea07960587c8f442b5cd3/coverage-7.6.12-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:79cac3390bfa9836bb795be377395f28410811c9066bc4eefd8015258a7578c6", size = 241179, upload-time = "2025-02-11T14:46:11.853Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/8c/566ea92ce2bb7627b0900124e24a99f9244b6c8c92d09ff9f7633eb7c3c8/coverage-7.6.12-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:9b148068e881faa26d878ff63e79650e208e95cf1c22bd3f77c3ca7b1d9821a3", size = 239288, upload-time = "2025-02-11T14:46:13.411Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/e4/869a138e50b622f796782d642c15fb5f25a5870c6d0059a663667a201638/coverage-7.6.12-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8bec2ac5da793c2685ce5319ca9bcf4eee683b8a1679051f8e6ec04c4f2fd7dc", size = 241032, upload-time = "2025-02-11T14:46:15.005Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/28/a52ff5d62a9f9e9fe9c4f17759b98632edd3a3489fce70154c7d66054dd3/coverage-7.6.12-cp313-cp313-win32.whl", hash = "sha256:200e10beb6ddd7c3ded322a4186313d5ca9e63e33d8fab4faa67ef46d3460af3", size = 211315, upload-time = "2025-02-11T14:46:16.638Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/17/ab849b7429a639f9722fa5628364c28d675c7ff37ebc3268fe9840dda13c/coverage-7.6.12-cp313-cp313-win_amd64.whl", hash = "sha256:2b996819ced9f7dbb812c701485d58f261bef08f9b85304d41219b1496b591ef", size = 212099, upload-time = "2025-02-11T14:46:18.268Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/1c/b9965bf23e171d98505eb5eb4fb4d05c44efd256f2e0f19ad1ba8c3f54b0/coverage-7.6.12-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:299cf973a7abff87a30609879c10df0b3bfc33d021e1adabc29138a48888841e", size = 209511, upload-time = "2025-02-11T14:46:20.768Z" },
+    { url = "https://files.pythonhosted.org/packages/57/b3/119c201d3b692d5e17784fee876a9a78e1b3051327de2709392962877ca8/coverage-7.6.12-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4b467a8c56974bf06e543e69ad803c6865249d7a5ccf6980457ed2bc50312703", size = 209729, upload-time = "2025-02-11T14:46:22.258Z" },
+    { url = "https://files.pythonhosted.org/packages/52/4e/a7feb5a56b266304bc59f872ea07b728e14d5a64f1ad3a2cc01a3259c965/coverage-7.6.12-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2458f275944db8129f95d91aee32c828a408481ecde3b30af31d552c2ce284a0", size = 253988, upload-time = "2025-02-11T14:46:23.999Z" },
+    { url = "https://files.pythonhosted.org/packages/65/19/069fec4d6908d0dae98126aa7ad08ce5130a6decc8509da7740d36e8e8d2/coverage-7.6.12-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0a9d8be07fb0832636a0f72b80d2a652fe665e80e720301fb22b191c3434d924", size = 249697, upload-time = "2025-02-11T14:46:25.617Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/da/5b19f09ba39df7c55f77820736bf17bbe2416bbf5216a3100ac019e15839/coverage-7.6.12-cp313-cp313t-manylinux_2_5_x86_64.manylinux1_x86_64.manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:14d47376a4f445e9743f6c83291e60adb1b127607a3618e3185bbc8091f0467b", size = 252033, upload-time = "2025-02-11T14:46:28.069Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/89/4c2750df7f80a7872267f7c5fe497c69d45f688f7b3afe1297e52e33f791/coverage-7.6.12-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:b95574d06aa9d2bd6e5cc35a5bbe35696342c96760b69dc4287dbd5abd4ad51d", size = 251535, upload-time = "2025-02-11T14:46:29.818Z" },
+    { url = "https://files.pythonhosted.org/packages/78/3b/6d3ae3c1cc05f1b0460c51e6f6dcf567598cbd7c6121e5ad06643974703c/coverage-7.6.12-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:ecea0c38c9079570163d663c0433a9af4094a60aafdca491c6a3d248c7432827", size = 249192, upload-time = "2025-02-11T14:46:31.563Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/8e/c14a79f535ce41af7d436bbad0d3d90c43d9e38ec409b4770c894031422e/coverage-7.6.12-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:2251fabcfee0a55a8578a9d29cecfee5f2de02f11530e7d5c5a05859aa85aee9", size = 250627, upload-time = "2025-02-11T14:46:33.145Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/79/b7cee656cfb17a7f2c1b9c3cee03dd5d8000ca299ad4038ba64b61a9b044/coverage-7.6.12-cp313-cp313t-win32.whl", hash = "sha256:eb5507795caabd9b2ae3f1adc95f67b1104971c22c624bb354232d65c4fc90b3", size = 212033, upload-time = "2025-02-11T14:46:35.79Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/c3/f7aaa3813f1fa9a4228175a7bd368199659d392897e184435a3b66408dd3/coverage-7.6.12-cp313-cp313t-win_amd64.whl", hash = "sha256:f60a297c3987c6c02ffb29effc70eadcbb412fe76947d394a1091a3615948e2f", size = 213240, upload-time = "2025-02-11T14:46:38.119Z" },
     { url = "https://files.pythonhosted.org/packages/7a/7f/05818c62c7afe75df11e0233bd670948d68b36cdbf2a339a095bc02624a8/coverage-7.6.12-pp39.pp310-none-any.whl", hash = "sha256:7e39e845c4d764208e7b8f6a21c541ade741e2c41afabdfa1caa28687a3c98cf", size = 200558, upload-time = "2025-02-11T14:47:00.292Z" },
     { url = "https://files.pythonhosted.org/packages/fb/b2/f655700e1024dec98b10ebaafd0cedbc25e40e4abe62a3c8e2ceef4f8f0a/coverage-7.6.12-py3-none-any.whl", hash = "sha256:eb8668cfbc279a536c633137deeb9435d2962caec279c3f8cf8b91fff6ff8953", size = 200552, upload-time = "2025-02-11T14:47:01.999Z" },
 ]
@@ -1800,6 +1861,14 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/14/a7/9790e60d19870f6554f7583722bb324c1355784316f20aeda1c0b5b1491a/dulwich-1.2.5-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:d8f7ea8f47e38e5b0de3fab97e07e9c9161ffddc90b3964512cab2b7749df4e6", size = 1441354, upload-time = "2026-05-28T22:27:14.683Z" },
     { url = "https://files.pythonhosted.org/packages/91/44/0ea8a69c24aa1254ff5996d682eae2eab287d471b937dcdb26d9ea9720b4/dulwich-1.2.5-cp312-cp312-win32.whl", hash = "sha256:8929134acf4ff967203df7600b38535f9b5b590462067a7e30dbce01acb97af9", size = 1017058, upload-time = "2026-05-28T22:27:16.121Z" },
     { url = "https://files.pythonhosted.org/packages/bd/9c/2fcddda7faec3bae52db7c64bfcb5dc756f597f33fae90e8d4e4b4d3b39b/dulwich-1.2.5-cp312-cp312-win_amd64.whl", hash = "sha256:9693d2c9e226b2ea855c1dc3a87e2f4d972f7523fc0f7924e5997e9f4c23d97f", size = 1031731, upload-time = "2026-05-28T22:27:17.633Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/33/8bd311edfb312e907b4ec7ad4680922e3f5baeccd18d987aeb57141a685d/dulwich-1.2.5-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:2f10dafa1ef5660b1331364bc8d68446448608a8d8f493ed0e260eaf5133e71c", size = 1530974, upload-time = "2026-05-28T22:27:19.301Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/0d/e4704188a78efbe785d6dc921b70a4f896dbbd4e37caed3a4122be31e871/dulwich-1.2.5-cp313-cp313-android_21_x86_64.whl", hash = "sha256:9b6d234f1f91335e9f01d9daac42ddc2d2e5c2fdbe285d8eeef50353b283648a", size = 1524254, upload-time = "2026-05-28T22:27:20.993Z" },
+    { url = "https://files.pythonhosted.org/packages/62/95/feb632693a629314593972f9393bb0a614aee5301ebd0848cb1c7fbfa56c/dulwich-1.2.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:c65230abaa52c72093b70d3b499d5689d1d8f9627e88ad3c3b4f8154e86ac0c8", size = 1394846, upload-time = "2026-05-28T22:27:22.475Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/4c/f0b4ae4cd2a34bf21ac37944d75c68d2297ebc0128928f988767d1542ef0/dulwich-1.2.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e128cddeccae4146b556684a0d5426454fff5bfe7306862e5a8ce6b471568af4", size = 1333523, upload-time = "2026-05-28T22:27:23.966Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/bf/b834306cd6a5959b1521d7f4d3e7473d39cdaea43063d97fa1eed6f1ba28/dulwich-1.2.5-cp313-cp313-manylinux_2_28_aarch64.whl", hash = "sha256:07cb75b58216440e2c170fff4f3d55a5f387358d9489863af8cb11f24ee37121", size = 1415849, upload-time = "2026-05-28T22:27:25.329Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/e5/8a6110eb9314fea1bf79c13ab1a5ab699167f1401284cee4bebbf3db2e90/dulwich-1.2.5-cp313-cp313-manylinux_2_28_x86_64.whl", hash = "sha256:df4ac3746099562c8160d78d55bb2fa10c9ada7ef970af3e2536bd133cb7830e", size = 1441075, upload-time = "2026-05-28T22:27:26.723Z" },
+    { url = "https://files.pythonhosted.org/packages/00/75/e993287749f7fa9ff871a0a4fbbede81727f982b1658ba50e7273a100fd3/dulwich-1.2.5-cp313-cp313-win32.whl", hash = "sha256:9fc113c1348c7eb22c4e8790f68b562bb4f42a721fafb813e89a57e9cd632040", size = 1016835, upload-time = "2026-05-28T22:27:28.544Z" },
+    { url = "https://files.pythonhosted.org/packages/50/bc/17cc36a67696e06e040e8035fcfdc2583e3834f736b7fe808d3ce01531d0/dulwich-1.2.5-cp313-cp313-win_amd64.whl", hash = "sha256:1ba83ec3cfb4c506c277400357a51523c8258fa07b841ee06e8e1071da4cfed1", size = 1031444, upload-time = "2026-05-28T22:27:30.204Z" },
     { url = "https://files.pythonhosted.org/packages/07/4b/4a18a59ad230581cd0ef460e96001f90762e566dc2dfdba22aa358eb5a0e/dulwich-1.2.5-py3-none-any.whl", hash = "sha256:1679b376433a0fc7f36586afda1d4ed7427afa7a79d4bf17e5014474eea69fa4", size = 686745, upload-time = "2026-05-28T22:27:53.695Z" },
 ]
 
@@ -1952,6 +2021,38 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/66/bb/852b9d6db2fa40be96f29c0d1205c306288f0684df8fd26ca1951d461a56/frozenlist-1.8.0-cp312-cp312-win32.whl", hash = "sha256:433403ae80709741ce34038da08511d4a77062aa924baf411ef73d1146e74faf", size = 39985, upload-time = "2025-10-06T05:36:23.661Z" },
     { url = "https://files.pythonhosted.org/packages/b8/af/38e51a553dd66eb064cdf193841f16f077585d4d28394c2fa6235cb41765/frozenlist-1.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:34187385b08f866104f0c0617404c8eb08165ab1272e884abc89c112e9c00746", size = 44591, upload-time = "2025-10-06T05:36:24.958Z" },
     { url = "https://files.pythonhosted.org/packages/a7/06/1dc65480ab147339fecc70797e9c2f69d9cea9cf38934ce08df070fdb9cb/frozenlist-1.8.0-cp312-cp312-win_arm64.whl", hash = "sha256:fe3c58d2f5db5fbd18c2987cba06d51b0529f52bc3a6cdc33d3f4eab725104bd", size = 40102, upload-time = "2025-10-06T05:36:26.333Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/40/0832c31a37d60f60ed79e9dfb5a92e1e2af4f40a16a29abcc7992af9edff/frozenlist-1.8.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:8d92f1a84bb12d9e56f818b3a746f3efba93c1b63c8387a73dde655e1e42282a", size = 85717, upload-time = "2025-10-06T05:36:27.341Z" },
+    { url = "https://files.pythonhosted.org/packages/30/ba/b0b3de23f40bc55a7057bd38434e25c34fa48e17f20ee273bbde5e0650f3/frozenlist-1.8.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:96153e77a591c8adc2ee805756c61f59fef4cf4073a9275ee86fe8cba41241f7", size = 49651, upload-time = "2025-10-06T05:36:28.855Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/ab/6e5080ee374f875296c4243c381bbdef97a9ac39c6e3ce1d5f7d42cb78d6/frozenlist-1.8.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f21f00a91358803399890ab167098c131ec2ddd5f8f5fd5fe9c9f2c6fcd91e40", size = 49417, upload-time = "2025-10-06T05:36:29.877Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/4e/e4691508f9477ce67da2015d8c00acd751e6287739123113a9fca6f1604e/frozenlist-1.8.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:fb30f9626572a76dfe4293c7194a09fb1fe93ba94c7d4f720dfae3b646b45027", size = 234391, upload-time = "2025-10-06T05:36:31.301Z" },
+    { url = "https://files.pythonhosted.org/packages/40/76/c202df58e3acdf12969a7895fd6f3bc016c642e6726aa63bd3025e0fc71c/frozenlist-1.8.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eaa352d7047a31d87dafcacbabe89df0aa506abb5b1b85a2fb91bc3faa02d822", size = 233048, upload-time = "2025-10-06T05:36:32.531Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/c0/8746afb90f17b73ca5979c7a3958116e105ff796e718575175319b5bb4ce/frozenlist-1.8.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:03ae967b4e297f58f8c774c7eabcce57fe3c2434817d4385c50661845a058121", size = 226549, upload-time = "2025-10-06T05:36:33.706Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/eb/4c7eefc718ff72f9b6c4893291abaae5fbc0c82226a32dcd8ef4f7a5dbef/frozenlist-1.8.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f6292f1de555ffcc675941d65fffffb0a5bcd992905015f85d0592201793e0e5", size = 239833, upload-time = "2025-10-06T05:36:34.947Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/4e/e5c02187cf704224f8b21bee886f3d713ca379535f16893233b9d672ea71/frozenlist-1.8.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:29548f9b5b5e3460ce7378144c3010363d8035cea44bc0bf02d57f5a685e084e", size = 245363, upload-time = "2025-10-06T05:36:36.534Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/96/cb85ec608464472e82ad37a17f844889c36100eed57bea094518bf270692/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ec3cc8c5d4084591b4237c0a272cc4f50a5b03396a47d9caaf76f5d7b38a4f11", size = 229314, upload-time = "2025-10-06T05:36:38.582Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/6f/4ae69c550e4cee66b57887daeebe006fe985917c01d0fff9caab9883f6d0/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:517279f58009d0b1f2e7c1b130b377a349405da3f7621ed6bfae50b10adf20c1", size = 243365, upload-time = "2025-10-06T05:36:40.152Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/58/afd56de246cf11780a40a2c28dc7cbabbf06337cc8ddb1c780a2d97e88d8/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:db1e72ede2d0d7ccb213f218df6a078a9c09a7de257c2fe8fcef16d5925230b1", size = 237763, upload-time = "2025-10-06T05:36:41.355Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/36/cdfaf6ed42e2644740d4a10452d8e97fa1c062e2a8006e4b09f1b5fd7d63/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:b4dec9482a65c54a5044486847b8a66bf10c9cb4926d42927ec4e8fd5db7fed8", size = 240110, upload-time = "2025-10-06T05:36:42.716Z" },
+    { url = "https://files.pythonhosted.org/packages/03/a8/9ea226fbefad669f11b52e864c55f0bd57d3c8d7eb07e9f2e9a0b39502e1/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:21900c48ae04d13d416f0e1e0c4d81f7931f73a9dfa0b7a8746fb2fe7dd970ed", size = 233717, upload-time = "2025-10-06T05:36:44.251Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/0b/1b5531611e83ba7d13ccc9988967ea1b51186af64c42b7a7af465dcc9568/frozenlist-1.8.0-cp313-cp313-win32.whl", hash = "sha256:8b7b94a067d1c504ee0b16def57ad5738701e4ba10cec90529f13fa03c833496", size = 39628, upload-time = "2025-10-06T05:36:45.423Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/cf/174c91dbc9cc49bc7b7aab74d8b734e974d1faa8f191c74af9b7e80848e6/frozenlist-1.8.0-cp313-cp313-win_amd64.whl", hash = "sha256:878be833caa6a3821caf85eb39c5ba92d28e85df26d57afb06b35b2efd937231", size = 43882, upload-time = "2025-10-06T05:36:46.796Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/17/502cd212cbfa96eb1388614fe39a3fc9ab87dbbe042b66f97acb57474834/frozenlist-1.8.0-cp313-cp313-win_arm64.whl", hash = "sha256:44389d135b3ff43ba8cc89ff7f51f5a0bb6b63d829c8300f79a2fe4fe61bcc62", size = 39676, upload-time = "2025-10-06T05:36:47.8Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/5c/3bbfaa920dfab09e76946a5d2833a7cbdf7b9b4a91c714666ac4855b88b4/frozenlist-1.8.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:e25ac20a2ef37e91c1b39938b591457666a0fa835c7783c3a8f33ea42870db94", size = 89235, upload-time = "2025-10-06T05:36:48.78Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/d6/f03961ef72166cec1687e84e8925838442b615bd0b8854b54923ce5b7b8a/frozenlist-1.8.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:07cdca25a91a4386d2e76ad992916a85038a9b97561bf7a3fd12d5d9ce31870c", size = 50742, upload-time = "2025-10-06T05:36:49.837Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/bb/a6d12b7ba4c3337667d0e421f7181c82dda448ce4e7ad7ecd249a16fa806/frozenlist-1.8.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4e0c11f2cc6717e0a741f84a527c52616140741cd812a50422f83dc31749fb52", size = 51725, upload-time = "2025-10-06T05:36:50.851Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/71/d1fed0ffe2c2ccd70b43714c6cab0f4188f09f8a67a7914a6b46ee30f274/frozenlist-1.8.0-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:b3210649ee28062ea6099cfda39e147fa1bc039583c8ee4481cb7811e2448c51", size = 284533, upload-time = "2025-10-06T05:36:51.898Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/1f/fb1685a7b009d89f9bf78a42d94461bc06581f6e718c39344754a5d9bada/frozenlist-1.8.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:581ef5194c48035a7de2aefc72ac6539823bb71508189e5de01d60c9dcd5fa65", size = 292506, upload-time = "2025-10-06T05:36:53.101Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/3b/b991fe1612703f7e0d05c0cf734c1b77aaf7c7d321df4572e8d36e7048c8/frozenlist-1.8.0-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3ef2d026f16a2b1866e1d86fc4e1291e1ed8a387b2c333809419a2f8b3a77b82", size = 274161, upload-time = "2025-10-06T05:36:54.309Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/ec/c5c618767bcdf66e88945ec0157d7f6c4a1322f1473392319b7a2501ded7/frozenlist-1.8.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5500ef82073f599ac84d888e3a8c1f77ac831183244bfd7f11eaa0289fb30714", size = 294676, upload-time = "2025-10-06T05:36:55.566Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/ce/3934758637d8f8a88d11f0585d6495ef54b2044ed6ec84492a91fa3b27aa/frozenlist-1.8.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:50066c3997d0091c411a66e710f4e11752251e6d2d73d70d8d5d4c76442a199d", size = 300638, upload-time = "2025-10-06T05:36:56.758Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/4f/a7e4d0d467298f42de4b41cbc7ddaf19d3cfeabaf9ff97c20c6c7ee409f9/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:5c1c8e78426e59b3f8005e9b19f6ff46e5845895adbde20ece9218319eca6506", size = 283067, upload-time = "2025-10-06T05:36:57.965Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/48/c7b163063d55a83772b268e6d1affb960771b0e203b632cfe09522d67ea5/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:eefdba20de0d938cec6a89bd4d70f346a03108a19b9df4248d3cf0d88f1b0f51", size = 292101, upload-time = "2025-10-06T05:36:59.237Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/d0/2366d3c4ecdc2fd391e0afa6e11500bfba0ea772764d631bbf82f0136c9d/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:cf253e0e1c3ceb4aaff6df637ce033ff6535fb8c70a764a8f46aafd3d6ab798e", size = 289901, upload-time = "2025-10-06T05:37:00.811Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/94/daff920e82c1b70e3618a2ac39fbc01ae3e2ff6124e80739ce5d71c9b920/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:032efa2674356903cd0261c4317a561a6850f3ac864a63fc1583147fb05a79b0", size = 289395, upload-time = "2025-10-06T05:37:02.115Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/20/bba307ab4235a09fdcd3cc5508dbabd17c4634a1af4b96e0f69bfe551ebd/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:6da155091429aeba16851ecb10a9104a108bcd32f6c1642867eadaee401c1c41", size = 283659, upload-time = "2025-10-06T05:37:03.711Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/00/04ca1c3a7a124b6de4f8a9a17cc2fcad138b4608e7a3fc5877804b8715d7/frozenlist-1.8.0-cp313-cp313t-win32.whl", hash = "sha256:0f96534f8bfebc1a394209427d0f8a63d343c9779cda6fc25e8e121b5fd8555b", size = 43492, upload-time = "2025-10-06T05:37:04.915Z" },
+    { url = "https://files.pythonhosted.org/packages/59/5e/c69f733a86a94ab10f68e496dc6b7e8bc078ebb415281d5698313e3af3a1/frozenlist-1.8.0-cp313-cp313t-win_amd64.whl", hash = "sha256:5d63a068f978fc69421fb0e6eb91a9603187527c86b7cd3f534a5b77a592b888", size = 48034, upload-time = "2025-10-06T05:37:06.343Z" },
+    { url = "https://files.pythonhosted.org/packages/16/6c/be9d79775d8abe79b05fa6d23da99ad6e7763a1d080fbae7290b286093fd/frozenlist-1.8.0-cp313-cp313t-win_arm64.whl", hash = "sha256:bf0a7e10b077bf5fb9380ad3ae8ce20ef919a6ad93b4552896419ac7e1d8e042", size = 41749, upload-time = "2025-10-06T05:37:07.431Z" },
     { url = "https://files.pythonhosted.org/packages/9a/9a/e35b4a917281c0b8419d4207f4334c8e8c5dbf4f3f5f9ada73958d937dcc/frozenlist-1.8.0-py3-none-any.whl", hash = "sha256:0c18a16eab41e82c295618a77502e17b195883241c563b00f0aa5106fc4eaa0d", size = 13409, upload-time = "2025-10-06T05:38:16.721Z" },
 ]
 
@@ -2384,6 +2485,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/2b/24/e581ffed864cd33c1b445b5763d617448ebb880f48675fc9de0471a95cbc/lazy_object_proxy-1.12.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c4fcbe74fb85df8ba7825fa05eddca764138da752904b378f0ae5ab33a36c308", size = 69329, upload-time = "2025-08-22T13:42:41.311Z" },
     { url = "https://files.pythonhosted.org/packages/78/be/15f8f5a0b0b2e668e756a152257d26370132c97f2f1943329b08f057eff0/lazy_object_proxy-1.12.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:563d2ec8e4d4b68ee7848c5ab4d6057a6d703cb7963b342968bb8758dda33a23", size = 70690, upload-time = "2025-08-22T13:42:42.51Z" },
     { url = "https://files.pythonhosted.org/packages/5d/aa/f02be9bbfb270e13ee608c2b28b8771f20a5f64356c6d9317b20043c6129/lazy_object_proxy-1.12.0-cp312-cp312-win_amd64.whl", hash = "sha256:53c7fd99eb156bbb82cbc5d5188891d8fdd805ba6c1e3b92b90092da2a837073", size = 26563, upload-time = "2025-08-22T13:42:43.685Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/26/b74c791008841f8ad896c7f293415136c66cc27e7c7577de4ee68040c110/lazy_object_proxy-1.12.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:86fd61cb2ba249b9f436d789d1356deae69ad3231dc3c0f17293ac535162672e", size = 26745, upload-time = "2025-08-22T13:42:44.982Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/52/641870d309e5d1fb1ea7d462a818ca727e43bfa431d8c34b173eb090348c/lazy_object_proxy-1.12.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:81d1852fb30fab81696f93db1b1e55a5d1ff7940838191062f5f56987d5fcc3e", size = 71537, upload-time = "2025-08-22T13:42:46.141Z" },
+    { url = "https://files.pythonhosted.org/packages/47/b6/919118e99d51c5e76e8bf5a27df406884921c0acf2c7b8a3b38d847ab3e9/lazy_object_proxy-1.12.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:be9045646d83f6c2664c1330904b245ae2371b5c57a3195e4028aedc9f999655", size = 71141, upload-time = "2025-08-22T13:42:47.375Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/47/1d20e626567b41de085cf4d4fb3661a56c159feaa73c825917b3b4d4f806/lazy_object_proxy-1.12.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:67f07ab742f1adfb3966c40f630baaa7902be4222a17941f3d85fd1dae5565ff", size = 69449, upload-time = "2025-08-22T13:42:48.49Z" },
+    { url = "https://files.pythonhosted.org/packages/58/8d/25c20ff1a1a8426d9af2d0b6f29f6388005fc8cd10d6ee71f48bff86fdd0/lazy_object_proxy-1.12.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:75ba769017b944fcacbf6a80c18b2761a1795b03f8899acdad1f1c39db4409be", size = 70744, upload-time = "2025-08-22T13:42:49.608Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/67/8ec9abe15c4f8a4bcc6e65160a2c667240d025cbb6591b879bea55625263/lazy_object_proxy-1.12.0-cp313-cp313-win_amd64.whl", hash = "sha256:7b22c2bbfb155706b928ac4d74c1a63ac8552a55ba7fff4445155523ea4067e1", size = 26568, upload-time = "2025-08-22T13:42:57.719Z" },
+    { url = "https://files.pythonhosted.org/packages/23/12/cd2235463f3469fd6c62d41d92b7f120e8134f76e52421413a0ad16d493e/lazy_object_proxy-1.12.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4a79b909aa16bde8ae606f06e6bbc9d3219d2e57fb3e0076e17879072b742c65", size = 27391, upload-time = "2025-08-22T13:42:50.62Z" },
+    { url = "https://files.pythonhosted.org/packages/60/9e/f1c53e39bbebad2e8609c67d0830cc275f694d0ea23d78e8f6db526c12d3/lazy_object_proxy-1.12.0-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:338ab2f132276203e404951205fe80c3fd59429b3a724e7b662b2eb539bb1be9", size = 80552, upload-time = "2025-08-22T13:42:51.731Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/b6/6c513693448dcb317d9d8c91d91f47addc09553613379e504435b4cc8b3e/lazy_object_proxy-1.12.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8c40b3c9faee2e32bfce0df4ae63f4e73529766893258eca78548bac801c8f66", size = 82857, upload-time = "2025-08-22T13:42:53.225Z" },
+    { url = "https://files.pythonhosted.org/packages/12/1c/d9c4aaa4c75da11eb7c22c43d7c90a53b4fca0e27784a5ab207768debea7/lazy_object_proxy-1.12.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:717484c309df78cedf48396e420fa57fc8a2b1f06ea889df7248fdd156e58847", size = 80833, upload-time = "2025-08-22T13:42:54.391Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/ae/29117275aac7d7d78ae4f5a4787f36ff33262499d486ac0bf3e0b97889f6/lazy_object_proxy-1.12.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:a6b7ea5ea1ffe15059eb44bcbcb258f97bcb40e139b88152c40d07b1a1dfc9ac", size = 79516, upload-time = "2025-08-22T13:42:55.812Z" },
+    { url = "https://files.pythonhosted.org/packages/19/40/b4e48b2c38c69392ae702ae7afa7b6551e0ca5d38263198b7c79de8b3bdf/lazy_object_proxy-1.12.0-cp313-cp313t-win_amd64.whl", hash = "sha256:08c465fb5cd23527512f9bd7b4c7ba6cec33e28aad36fbbe46bf7b858f9f3f7f", size = 27656, upload-time = "2025-08-22T13:42:56.793Z" },
     { url = "https://files.pythonhosted.org/packages/41/a0/b91504515c1f9a299fc157967ffbd2f0321bce0516a3d5b89f6f4cad0355/lazy_object_proxy-1.12.0-pp39.pp310.pp311.graalpy311-none-any.whl", hash = "sha256:c3b2e0af1f7f77c4263759c4824316ce458fabe0fceadcd24ef8ca08b2d1e402", size = 15072, upload-time = "2025-08-22T13:50:05.498Z" },
 ]
 
@@ -2417,6 +2530,22 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/b2/e7/d667d337367686311c38b580d1ca3d5a23a6617e129f26becd4f5dc458df/lz4-4.4.5-cp312-cp312-win32.whl", hash = "sha256:214e37cfe270948ea7eb777229e211c601a3e0875541c1035ab408fbceaddf50", size = 88189, upload-time = "2025-11-03T13:01:52.605Z" },
     { url = "https://files.pythonhosted.org/packages/a5/0b/a54cd7406995ab097fceb907c7eb13a6ddd49e0b231e448f1a81a50af65c/lz4-4.4.5-cp312-cp312-win_amd64.whl", hash = "sha256:713a777de88a73425cf08eb11f742cd2c98628e79a8673d6a52e3c5f0c116f33", size = 99497, upload-time = "2025-11-03T13:01:53.477Z" },
     { url = "https://files.pythonhosted.org/packages/6a/7e/dc28a952e4bfa32ca16fa2eb026e7a6ce5d1411fcd5986cd08c74ec187b9/lz4-4.4.5-cp312-cp312-win_arm64.whl", hash = "sha256:a88cbb729cc333334ccfb52f070463c21560fca63afcf636a9f160a55fac3301", size = 91279, upload-time = "2025-11-03T13:01:54.419Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/46/08fd8ef19b782f301d56a9ccfd7dafec5fd4fc1a9f017cf22a1accb585d7/lz4-4.4.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:6bb05416444fafea170b07181bc70640975ecc2a8c92b3b658c554119519716c", size = 207171, upload-time = "2025-11-03T13:01:56.595Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/3f/ea3334e59de30871d773963997ecdba96c4584c5f8007fd83cfc8f1ee935/lz4-4.4.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:b424df1076e40d4e884cfcc4c77d815368b7fb9ebcd7e634f937725cd9a8a72a", size = 207163, upload-time = "2025-11-03T13:01:57.721Z" },
+    { url = "https://files.pythonhosted.org/packages/41/7b/7b3a2a0feb998969f4793c650bb16eff5b06e80d1f7bff867feb332f2af2/lz4-4.4.5-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:216ca0c6c90719731c64f41cfbd6f27a736d7e50a10b70fad2a9c9b262ec923d", size = 1292136, upload-time = "2025-11-03T13:02:00.375Z" },
+    { url = "https://files.pythonhosted.org/packages/89/d1/f1d259352227bb1c185288dd694121ea303e43404aa77560b879c90e7073/lz4-4.4.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:533298d208b58b651662dd972f52d807d48915176e5b032fb4f8c3b6f5fe535c", size = 1279639, upload-time = "2025-11-03T13:02:01.649Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/fb/ba9256c48266a09012ed1d9b0253b9aa4fe9cdff094f8febf5b26a4aa2a2/lz4-4.4.5-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:451039b609b9a88a934800b5fc6ee401c89ad9c175abf2f4d9f8b2e4ef1afc64", size = 1368257, upload-time = "2025-11-03T13:02:03.35Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/6d/dee32a9430c8b0e01bbb4537573cabd00555827f1a0a42d4e24ca803935c/lz4-4.4.5-cp313-cp313-win32.whl", hash = "sha256:a5f197ffa6fc0e93207b0af71b302e0a2f6f29982e5de0fbda61606dd3a55832", size = 88191, upload-time = "2025-11-03T13:02:04.406Z" },
+    { url = "https://files.pythonhosted.org/packages/18/e0/f06028aea741bbecb2a7e9648f4643235279a770c7ffaf70bd4860c73661/lz4-4.4.5-cp313-cp313-win_amd64.whl", hash = "sha256:da68497f78953017deb20edff0dba95641cc86e7423dfadf7c0264e1ac60dc22", size = 99502, upload-time = "2025-11-03T13:02:05.886Z" },
+    { url = "https://files.pythonhosted.org/packages/61/72/5bef44afb303e56078676b9f2486f13173a3c1e7f17eaac1793538174817/lz4-4.4.5-cp313-cp313-win_arm64.whl", hash = "sha256:c1cfa663468a189dab510ab231aad030970593f997746d7a324d40104db0d0a9", size = 91285, upload-time = "2025-11-03T13:02:06.77Z" },
+    { url = "https://files.pythonhosted.org/packages/49/55/6a5c2952971af73f15ed4ebfdd69774b454bd0dc905b289082ca8664fba1/lz4-4.4.5-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:67531da3b62f49c939e09d56492baf397175ff39926d0bd5bd2d191ac2bff95f", size = 207348, upload-time = "2025-11-03T13:02:08.117Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/d7/fd62cbdbdccc35341e83aabdb3f6d5c19be2687d0a4eaf6457ddf53bba64/lz4-4.4.5-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:a1acbbba9edbcbb982bc2cac5e7108f0f553aebac1040fbec67a011a45afa1ba", size = 207340, upload-time = "2025-11-03T13:02:09.152Z" },
+    { url = "https://files.pythonhosted.org/packages/77/69/225ffadaacb4b0e0eb5fd263541edd938f16cd21fe1eae3cd6d5b6a259dc/lz4-4.4.5-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:a482eecc0b7829c89b498fda883dbd50e98153a116de612ee7c111c8bcf82d1d", size = 1293398, upload-time = "2025-11-03T13:02:10.272Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/9e/2ce59ba4a21ea5dc43460cba6f34584e187328019abc0e66698f2b66c881/lz4-4.4.5-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e099ddfaa88f59dd8d36c8a3c66bd982b4984edf127eb18e30bb49bdba68ce67", size = 1281209, upload-time = "2025-11-03T13:02:12.091Z" },
+    { url = "https://files.pythonhosted.org/packages/80/4f/4d946bd1624ec229b386a3bc8e7a85fa9a963d67d0a62043f0af0978d3da/lz4-4.4.5-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a2af2897333b421360fdcce895c6f6281dc3fab018d19d341cf64d043fc8d90d", size = 1369406, upload-time = "2025-11-03T13:02:13.683Z" },
+    { url = "https://files.pythonhosted.org/packages/02/a2/d429ba4720a9064722698b4b754fb93e42e625f1318b8fe834086c7c783b/lz4-4.4.5-cp313-cp313t-win32.whl", hash = "sha256:66c5de72bf4988e1b284ebdd6524c4bead2c507a2d7f172201572bac6f593901", size = 88325, upload-time = "2025-11-03T13:02:14.743Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/85/7ba10c9b97c06af6c8f7032ec942ff127558863df52d866019ce9d2425cf/lz4-4.4.5-cp313-cp313t-win_amd64.whl", hash = "sha256:cdd4bdcbaf35056086d910d219106f6a04e1ab0daa40ec0eeef1626c27d0fddb", size = 99643, upload-time = "2025-11-03T13:02:15.978Z" },
+    { url = "https://files.pythonhosted.org/packages/77/4d/a175459fb29f909e13e57c8f475181ad8085d8d7869bd8ad99033e3ee5fa/lz4-4.4.5-cp313-cp313t-win_arm64.whl", hash = "sha256:28ccaeb7c5222454cd5f60fcd152564205bcb801bd80e125949d2dfbadc76bbd", size = 91504, upload-time = "2025-11-03T13:02:17.313Z" },
 ]
 
 [[package]]
@@ -2479,6 +2608,28 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/2f/e1/78ee7a023dac597a5825441ebd17170785a9dab23de95d2c7508ade94e0e/markupsafe-3.0.3-cp312-cp312-win32.whl", hash = "sha256:d88b440e37a16e651bda4c7c2b930eb586fd15ca7406cb39e211fcff3bf3017d", size = 14540, upload-time = "2025-09-27T18:36:38.761Z" },
     { url = "https://files.pythonhosted.org/packages/aa/5b/bec5aa9bbbb2c946ca2733ef9c4ca91c91b6a24580193e891b5f7dbe8e1e/markupsafe-3.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:26a5784ded40c9e318cfc2bdb30fe164bdb8665ded9cd64d500a34fb42067b1c", size = 15105, upload-time = "2025-09-27T18:36:39.701Z" },
     { url = "https://files.pythonhosted.org/packages/e5/f1/216fc1bbfd74011693a4fd837e7026152e89c4bcf3e77b6692fba9923123/markupsafe-3.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:35add3b638a5d900e807944a078b51922212fb3dedb01633a8defc4b01a3c85f", size = 13906, upload-time = "2025-09-27T18:36:40.689Z" },
+    { url = "https://files.pythonhosted.org/packages/38/2f/907b9c7bbba283e68f20259574b13d005c121a0fa4c175f9bed27c4597ff/markupsafe-3.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795", size = 11622, upload-time = "2025-09-27T18:36:41.777Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/d9/5f7756922cdd676869eca1c4e3c0cd0df60ed30199ffd775e319089cb3ed/markupsafe-3.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219", size = 12029, upload-time = "2025-09-27T18:36:43.257Z" },
+    { url = "https://files.pythonhosted.org/packages/00/07/575a68c754943058c78f30db02ee03a64b3c638586fba6a6dd56830b30a3/markupsafe-3.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6", size = 24374, upload-time = "2025-09-27T18:36:44.508Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/21/9b05698b46f218fc0e118e1f8168395c65c8a2c750ae2bab54fc4bd4e0e8/markupsafe-3.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676", size = 22980, upload-time = "2025-09-27T18:36:45.385Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/71/544260864f893f18b6827315b988c146b559391e6e7e8f7252839b1b846a/markupsafe-3.0.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9", size = 21990, upload-time = "2025-09-27T18:36:46.916Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/28/b50fc2f74d1ad761af2f5dcce7492648b983d00a65b8c0e0cb457c82ebbe/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1", size = 23784, upload-time = "2025-09-27T18:36:47.884Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/76/104b2aa106a208da8b17a2fb72e033a5a9d7073c68f7e508b94916ed47a9/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc", size = 21588, upload-time = "2025-09-27T18:36:48.82Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/99/16a5eb2d140087ebd97180d95249b00a03aa87e29cc224056274f2e45fd6/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12", size = 23041, upload-time = "2025-09-27T18:36:49.797Z" },
+    { url = "https://files.pythonhosted.org/packages/19/bc/e7140ed90c5d61d77cea142eed9f9c303f4c4806f60a1044c13e3f1471d0/markupsafe-3.0.3-cp313-cp313-win32.whl", hash = "sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed", size = 14543, upload-time = "2025-09-27T18:36:51.584Z" },
+    { url = "https://files.pythonhosted.org/packages/05/73/c4abe620b841b6b791f2edc248f556900667a5a1cf023a6646967ae98335/markupsafe-3.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5", size = 15113, upload-time = "2025-09-27T18:36:52.537Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/3a/fa34a0f7cfef23cf9500d68cb7c32dd64ffd58a12b09225fb03dd37d5b80/markupsafe-3.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485", size = 13911, upload-time = "2025-09-27T18:36:53.513Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/d7/e05cd7efe43a88a17a37b3ae96e79a19e846f3f456fe79c57ca61356ef01/markupsafe-3.0.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73", size = 11658, upload-time = "2025-09-27T18:36:54.819Z" },
+    { url = "https://files.pythonhosted.org/packages/99/9e/e412117548182ce2148bdeacdda3bb494260c0b0184360fe0d56389b523b/markupsafe-3.0.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37", size = 12066, upload-time = "2025-09-27T18:36:55.714Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/e6/fa0ffcda717ef64a5108eaa7b4f5ed28d56122c9a6d70ab8b72f9f715c80/markupsafe-3.0.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19", size = 25639, upload-time = "2025-09-27T18:36:56.908Z" },
+    { url = "https://files.pythonhosted.org/packages/96/ec/2102e881fe9d25fc16cb4b25d5f5cde50970967ffa5dddafdb771237062d/markupsafe-3.0.3-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025", size = 23569, upload-time = "2025-09-27T18:36:57.913Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/30/6f2fce1f1f205fc9323255b216ca8a235b15860c34b6798f810f05828e32/markupsafe-3.0.3-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6", size = 23284, upload-time = "2025-09-27T18:36:58.833Z" },
+    { url = "https://files.pythonhosted.org/packages/58/47/4a0ccea4ab9f5dcb6f79c0236d954acb382202721e704223a8aafa38b5c8/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f", size = 24801, upload-time = "2025-09-27T18:36:59.739Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/70/3780e9b72180b6fecb83a4814d84c3bf4b4ae4bf0b19c27196104149734c/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb", size = 22769, upload-time = "2025-09-27T18:37:00.719Z" },
+    { url = "https://files.pythonhosted.org/packages/98/c5/c03c7f4125180fc215220c035beac6b9cb684bc7a067c84fc69414d315f5/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009", size = 23642, upload-time = "2025-09-27T18:37:01.673Z" },
+    { url = "https://files.pythonhosted.org/packages/80/d6/2d1b89f6ca4bff1036499b1e29a1d02d282259f3681540e16563f27ebc23/markupsafe-3.0.3-cp313-cp313t-win32.whl", hash = "sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354", size = 14612, upload-time = "2025-09-27T18:37:02.639Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/98/e48a4bfba0a0ffcf9925fe2d69240bfaa19c6f7507b8cd09c70684a53c1e/markupsafe-3.0.3-cp313-cp313t-win_amd64.whl", hash = "sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218", size = 15200, upload-time = "2025-09-27T18:37:03.582Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/72/e3cc540f351f316e9ed0f092757459afbc595824ca724cbc5a5d4263713f/markupsafe-3.0.3-cp313-cp313t-win_arm64.whl", hash = "sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287", size = 13973, upload-time = "2025-09-27T18:37:04.929Z" },
 ]
 
 [[package]]
@@ -2785,6 +2936,42 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ca/a4/840f5b97339e27846c46307f2530a2805d9d537d8b8bd416af031cad7fa0/multidict-6.7.1-cp312-cp312-win32.whl", hash = "sha256:28ca5ce2fd9716631133d0e9a9b9a745ad7f60bac2bccafb56aa380fc0b6c511", size = 41887, upload-time = "2026-01-26T02:44:14.245Z" },
     { url = "https://files.pythonhosted.org/packages/80/31/0b2517913687895f5904325c2069d6a3b78f66cc641a86a2baf75a05dcbb/multidict-6.7.1-cp312-cp312-win_amd64.whl", hash = "sha256:fcee94dfbd638784645b066074b338bc9cc155d4b4bffa4adce1615c5a426c19", size = 46053, upload-time = "2026-01-26T02:44:15.371Z" },
     { url = "https://files.pythonhosted.org/packages/0c/5b/aba28e4ee4006ae4c7df8d327d31025d760ffa992ea23812a601d226e682/multidict-6.7.1-cp312-cp312-win_arm64.whl", hash = "sha256:ba0a9fb644d0c1a2194cf7ffb043bd852cea63a57f66fbd33959f7dae18517bf", size = 43307, upload-time = "2026-01-26T02:44:16.852Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/22/929c141d6c0dba87d3e1d38fbdf1ba8baba86b7776469f2bc2d3227a1e67/multidict-6.7.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:2b41f5fed0ed563624f1c17630cb9941cf2309d4df00e494b551b5f3e3d67a23", size = 76174, upload-time = "2026-01-26T02:44:18.509Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/75/bc704ae15fee974f8fccd871305e254754167dce5f9e42d88a2def741a1d/multidict-6.7.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:84e61e3af5463c19b67ced91f6c634effb89ef8bfc5ca0267f954451ed4bb6a2", size = 45116, upload-time = "2026-01-26T02:44:19.745Z" },
+    { url = "https://files.pythonhosted.org/packages/79/76/55cd7186f498ed080a18440c9013011eb548f77ae1b297206d030eb1180a/multidict-6.7.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:935434b9853c7c112eee7ac891bc4cb86455aa631269ae35442cb316790c1445", size = 43524, upload-time = "2026-01-26T02:44:21.571Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/3c/414842ef8d5a1628d68edee29ba0e5bcf235dbfb3ccd3ea303a7fe8c72ff/multidict-6.7.1-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:432feb25a1cb67fe82a9680b4d65fb542e4635cb3166cd9c01560651ad60f177", size = 249368, upload-time = "2026-01-26T02:44:22.803Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/32/befed7f74c458b4a525e60519fe8d87eef72bb1e99924fa2b0f9d97a221e/multidict-6.7.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e82d14e3c948952a1a85503817e038cba5905a3352de76b9a465075d072fba23", size = 256952, upload-time = "2026-01-26T02:44:24.306Z" },
+    { url = "https://files.pythonhosted.org/packages/03/d6/c878a44ba877f366630c860fdf74bfb203c33778f12b6ac274936853c451/multidict-6.7.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:4cfb48c6ea66c83bcaaf7e4dfa7ec1b6bbcf751b7db85a328902796dfde4c060", size = 240317, upload-time = "2026-01-26T02:44:25.772Z" },
+    { url = "https://files.pythonhosted.org/packages/68/49/57421b4d7ad2e9e60e25922b08ceb37e077b90444bde6ead629095327a6f/multidict-6.7.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:1d540e51b7e8e170174555edecddbd5538105443754539193e3e1061864d444d", size = 267132, upload-time = "2026-01-26T02:44:27.648Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/fe/ec0edd52ddbcea2a2e89e174f0206444a61440b40f39704e64dc807a70bd/multidict-6.7.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:273d23f4b40f3dce4d6c8a821c741a86dec62cded82e1175ba3d99be128147ed", size = 268140, upload-time = "2026-01-26T02:44:29.588Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/73/6e1b01cbeb458807aa0831742232dbdd1fa92bfa33f52a3f176b4ff3dc11/multidict-6.7.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d624335fd4fa1c08a53f8b4be7676ebde19cd092b3895c421045ca87895b429", size = 254277, upload-time = "2026-01-26T02:44:30.902Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/b2/5fb8c124d7561a4974c342bc8c778b471ebbeb3cc17df696f034a7e9afe7/multidict-6.7.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:12fad252f8b267cc75b66e8fc51b3079604e8d43a75428ffe193cd9e2195dfd6", size = 252291, upload-time = "2026-01-26T02:44:32.31Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/96/51d4e4e06bcce92577fcd488e22600bd38e4fd59c20cb49434d054903bd2/multidict-6.7.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:03ede2a6ffbe8ef936b92cb4529f27f42be7f56afcdab5ab739cd5f27fb1cbf9", size = 250156, upload-time = "2026-01-26T02:44:33.734Z" },
+    { url = "https://files.pythonhosted.org/packages/db/6b/420e173eec5fba721a50e2a9f89eda89d9c98fded1124f8d5c675f7a0c0f/multidict-6.7.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:90efbcf47dbe33dcf643a1e400d67d59abeac5db07dc3f27d6bdeae497a2198c", size = 249742, upload-time = "2026-01-26T02:44:35.222Z" },
+    { url = "https://files.pythonhosted.org/packages/44/a3/ec5b5bd98f306bc2aa297b8c6f11a46714a56b1e6ef5ebda50a4f5d7c5fb/multidict-6.7.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:5c4b9bfc148f5a91be9244d6264c53035c8a0dcd2f51f1c3c6e30e30ebaa1c84", size = 262221, upload-time = "2026-01-26T02:44:36.604Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/f7/e8c0d0da0cd1e28d10e624604e1a36bcc3353aaebdfdc3a43c72bc683a12/multidict-6.7.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:401c5a650f3add2472d1d288c26deebc540f99e2fb83e9525007a74cd2116f1d", size = 258664, upload-time = "2026-01-26T02:44:38.008Z" },
+    { url = "https://files.pythonhosted.org/packages/52/da/151a44e8016dd33feed44f730bd856a66257c1ee7aed4f44b649fb7edeb3/multidict-6.7.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:97891f3b1b3ffbded884e2916cacf3c6fc87b66bb0dde46f7357404750559f33", size = 249490, upload-time = "2026-01-26T02:44:39.386Z" },
+    { url = "https://files.pythonhosted.org/packages/87/af/a3b86bf9630b732897f6fc3f4c4714b90aa4361983ccbdcd6c0339b21b0c/multidict-6.7.1-cp313-cp313-win32.whl", hash = "sha256:e1c5988359516095535c4301af38d8a8838534158f649c05dd1050222321bcb3", size = 41695, upload-time = "2026-01-26T02:44:41.318Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/35/e994121b0e90e46134673422dd564623f93304614f5d11886b1b3e06f503/multidict-6.7.1-cp313-cp313-win_amd64.whl", hash = "sha256:960c83bf01a95b12b08fd54324a4eb1d5b52c88932b5cba5d6e712bb3ed12eb5", size = 45884, upload-time = "2026-01-26T02:44:42.488Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/61/42d3e5dbf661242a69c97ea363f2d7b46c567da8eadef8890022be6e2ab0/multidict-6.7.1-cp313-cp313-win_arm64.whl", hash = "sha256:563fe25c678aaba333d5399408f5ec3c383ca5b663e7f774dd179a520b8144df", size = 43122, upload-time = "2026-01-26T02:44:43.664Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/b3/e6b21c6c4f314bb956016b0b3ef2162590a529b84cb831c257519e7fde44/multidict-6.7.1-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:c76c4bec1538375dad9d452d246ca5368ad6e1c9039dadcf007ae59c70619ea1", size = 83175, upload-time = "2026-01-26T02:44:44.894Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/76/23ecd2abfe0957b234f6c960f4ade497f55f2c16aeb684d4ecdbf1c95791/multidict-6.7.1-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:57b46b24b5d5ebcc978da4ec23a819a9402b4228b8a90d9c656422b4bdd8a963", size = 48460, upload-time = "2026-01-26T02:44:46.106Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/57/a0ed92b23f3a042c36bc4227b72b97eca803f5f1801c1ab77c8a212d455e/multidict-6.7.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:e954b24433c768ce78ab7929e84ccf3422e46deb45a4dc9f93438f8217fa2d34", size = 46930, upload-time = "2026-01-26T02:44:47.278Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/66/02ec7ace29162e447f6382c495dc95826bf931d3818799bbef11e8f7df1a/multidict-6.7.1-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:3bd231490fa7217cc832528e1cd8752a96f0125ddd2b5749390f7c3ec8721b65", size = 242582, upload-time = "2026-01-26T02:44:48.604Z" },
+    { url = "https://files.pythonhosted.org/packages/58/18/64f5a795e7677670e872673aca234162514696274597b3708b2c0d276cce/multidict-6.7.1-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:253282d70d67885a15c8a7716f3a73edf2d635793ceda8173b9ecc21f2fb8292", size = 250031, upload-time = "2026-01-26T02:44:50.544Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/ed/e192291dbbe51a8290c5686f482084d31bcd9d09af24f63358c3d42fd284/multidict-6.7.1-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:0b4c48648d7649c9335cf1927a8b87fa692de3dcb15faa676c6a6f1f1aabda43", size = 228596, upload-time = "2026-01-26T02:44:51.951Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/7e/3562a15a60cf747397e7f2180b0a11dc0c38d9175a650e75fa1b4d325e15/multidict-6.7.1-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:98bc624954ec4d2c7cb074b8eefc2b5d0ce7d482e410df446414355d158fe4ca", size = 257492, upload-time = "2026-01-26T02:44:53.902Z" },
+    { url = "https://files.pythonhosted.org/packages/24/02/7d0f9eae92b5249bb50ac1595b295f10e263dd0078ebb55115c31e0eaccd/multidict-6.7.1-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1b99af4d9eec0b49927b4402bcbb58dea89d3e0db8806a4086117019939ad3dd", size = 255899, upload-time = "2026-01-26T02:44:55.316Z" },
+    { url = "https://files.pythonhosted.org/packages/00/e3/9b60ed9e23e64c73a5cde95269ef1330678e9c6e34dd4eb6b431b85b5a10/multidict-6.7.1-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6aac4f16b472d5b7dc6f66a0d49dd57b0e0902090be16594dc9ebfd3d17c47e7", size = 247970, upload-time = "2026-01-26T02:44:56.783Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/06/538e58a63ed5cfb0bd4517e346b91da32fde409d839720f664e9a4ae4f9d/multidict-6.7.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:21f830fe223215dffd51f538e78c172ed7c7f60c9b96a2bf05c4848ad49921c3", size = 245060, upload-time = "2026-01-26T02:44:58.195Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/2f/d743a3045a97c895d401e9bd29aaa09b94f5cbdf1bd561609e5a6c431c70/multidict-6.7.1-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:f5dd81c45b05518b9aa4da4aa74e1c93d715efa234fd3e8a179df611cc85e5f4", size = 235888, upload-time = "2026-01-26T02:44:59.57Z" },
+    { url = "https://files.pythonhosted.org/packages/38/83/5a325cac191ab28b63c52f14f1131f3b0a55ba3b9aa65a6d0bf2a9b921a0/multidict-6.7.1-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:eb304767bca2bb92fb9c5bd33cedc95baee5bb5f6c88e63706533a1c06ad08c8", size = 243554, upload-time = "2026-01-26T02:45:01.054Z" },
+    { url = "https://files.pythonhosted.org/packages/20/1f/9d2327086bd15da2725ef6aae624208e2ef828ed99892b17f60c344e57ed/multidict-6.7.1-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:c9035dde0f916702850ef66460bc4239d89d08df4d02023a5926e7446724212c", size = 252341, upload-time = "2026-01-26T02:45:02.484Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/2c/2a1aa0280cf579d0f6eed8ee5211c4f1730bd7e06c636ba2ee6aafda302e/multidict-6.7.1-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:af959b9beeb66c822380f222f0e0a1889331597e81f1ded7f374f3ecb0fd6c52", size = 246391, upload-time = "2026-01-26T02:45:03.862Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/03/7ca022ffc36c5a3f6e03b179a5ceb829be9da5783e6fe395f347c0794680/multidict-6.7.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:41f2952231456154ee479651491e94118229844dd7226541788be783be2b5108", size = 243422, upload-time = "2026-01-26T02:45:05.296Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/1d/b31650eab6c5778aceed46ba735bd97f7c7d2f54b319fa916c0f96e7805b/multidict-6.7.1-cp313-cp313t-win32.whl", hash = "sha256:df9f19c28adcb40b6aae30bbaa1478c389efd50c28d541d76760199fc1037c32", size = 47770, upload-time = "2026-01-26T02:45:06.754Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/5b/2d2d1d522e51285bd61b1e20df8f47ae1a9d80839db0b24ea783b3832832/multidict-6.7.1-cp313-cp313t-win_amd64.whl", hash = "sha256:d54ecf9f301853f2c5e802da559604b3e95bb7a3b01a9c295c6ee591b9882de8", size = 53109, upload-time = "2026-01-26T02:45:08.044Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/a3/cc409ba012c83ca024a308516703cf339bdc4b696195644a7215a5164a24/multidict-6.7.1-cp313-cp313t-win_arm64.whl", hash = "sha256:5a37ca18e360377cfda1d62f5f382ff41f2b8c4ccb329ed974cc2e1643440118", size = 45573, upload-time = "2026-01-26T02:45:09.349Z" },
     { url = "https://files.pythonhosted.org/packages/81/08/7036c080d7117f28a4af526d794aab6a84463126db031b007717c1a6676e/multidict-6.7.1-py3-none-any.whl", hash = "sha256:55d97cc6dae627efa6a6e548885712d4864b81110ac76fa4e534c03819fa4a56", size = 12319, upload-time = "2026-01-26T02:46:44.004Z" },
 ]
 
@@ -2835,40 +3022,64 @@ wheels = [
 
 [[package]]
 name = "numpy"
-version = "2.0.2"
+version = "2.2.6"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a9/75/10dd1f8116a8b796cb2c737b674e02d02e80454bda953fa7e65d8c12b016/numpy-2.0.2.tar.gz", hash = "sha256:883c987dee1880e2a864ab0dc9892292582510604156762362d9326444636e78", size = 18902015, upload-time = "2024-08-26T20:19:40.945Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/76/21/7d2a95e4bba9dc13d043ee156a356c0a8f0c6309dff6b21b4d71a073b8a8/numpy-2.2.6.tar.gz", hash = "sha256:e29554e2bef54a90aa5cc07da6ce955accb83f21ab5de01a62c8478897b264fd", size = 20276440, upload-time = "2025-05-17T22:38:04.611Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/21/91/3495b3237510f79f5d81f2508f9f13fea78ebfdf07538fc7444badda173d/numpy-2.0.2-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:51129a29dbe56f9ca83438b706e2e69a39892b5eda6cedcb6b0c9fdc9b0d3ece", size = 21165245, upload-time = "2024-08-26T20:04:14.625Z" },
-    { url = "https://files.pythonhosted.org/packages/05/33/26178c7d437a87082d11019292dce6d3fe6f0e9026b7b2309cbf3e489b1d/numpy-2.0.2-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:f15975dfec0cf2239224d80e32c3170b1d168335eaedee69da84fbe9f1f9cd04", size = 13738540, upload-time = "2024-08-26T20:04:36.784Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/31/cc46e13bf07644efc7a4bf68df2df5fb2a1a88d0cd0da9ddc84dc0033e51/numpy-2.0.2-cp310-cp310-macosx_14_0_arm64.whl", hash = "sha256:8c5713284ce4e282544c68d1c3b2c7161d38c256d2eefc93c1d683cf47683e66", size = 5300623, upload-time = "2024-08-26T20:04:46.491Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/16/7bfcebf27bb4f9d7ec67332ffebee4d1bf085c84246552d52dbb548600e7/numpy-2.0.2-cp310-cp310-macosx_14_0_x86_64.whl", hash = "sha256:becfae3ddd30736fe1889a37f1f580e245ba79a5855bff5f2a29cb3ccc22dd7b", size = 6901774, upload-time = "2024-08-26T20:04:58.173Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/a3/561c531c0e8bf082c5bef509d00d56f82e0ea7e1e3e3a7fc8fa78742a6e5/numpy-2.0.2-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2da5960c3cf0df7eafefd806d4e612c5e19358de82cb3c343631188991566ccd", size = 13907081, upload-time = "2024-08-26T20:05:19.098Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/66/f7177ab331876200ac7563a580140643d1179c8b4b6a6b0fc9838de2a9b8/numpy-2.0.2-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:496f71341824ed9f3d2fd36cf3ac57ae2e0165c143b55c3a035ee219413f3318", size = 19523451, upload-time = "2024-08-26T20:05:47.479Z" },
-    { url = "https://files.pythonhosted.org/packages/25/7f/0b209498009ad6453e4efc2c65bcdf0ae08a182b2b7877d7ab38a92dc542/numpy-2.0.2-cp310-cp310-musllinux_1_1_x86_64.whl", hash = "sha256:a61ec659f68ae254e4d237816e33171497e978140353c0c2038d46e63282d0c8", size = 19927572, upload-time = "2024-08-26T20:06:17.137Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/df/2619393b1e1b565cd2d4c4403bdd979621e2c4dea1f8532754b2598ed63b/numpy-2.0.2-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:d731a1c6116ba289c1e9ee714b08a8ff882944d4ad631fd411106a30f083c326", size = 14400722, upload-time = "2024-08-26T20:06:39.16Z" },
-    { url = "https://files.pythonhosted.org/packages/22/ad/77e921b9f256d5da36424ffb711ae79ca3f451ff8489eeca544d0701d74a/numpy-2.0.2-cp310-cp310-win32.whl", hash = "sha256:984d96121c9f9616cd33fbd0618b7f08e0cfc9600a7ee1d6fd9b239186d19d97", size = 6472170, upload-time = "2024-08-26T20:06:50.361Z" },
-    { url = "https://files.pythonhosted.org/packages/10/05/3442317535028bc29cf0c0dd4c191a4481e8376e9f0db6bcf29703cadae6/numpy-2.0.2-cp310-cp310-win_amd64.whl", hash = "sha256:c7b0be4ef08607dd04da4092faee0b86607f111d5ae68036f16cc787e250a131", size = 15905558, upload-time = "2024-08-26T20:07:13.881Z" },
-    { url = "https://files.pythonhosted.org/packages/8b/cf/034500fb83041aa0286e0fb16e7c76e5c8b67c0711bb6e9e9737a717d5fe/numpy-2.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:49ca4decb342d66018b01932139c0961a8f9ddc7589611158cb3c27cbcf76448", size = 21169137, upload-time = "2024-08-26T20:07:45.345Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/d9/32de45561811a4b87fbdee23b5797394e3d1504b4a7cf40c10199848893e/numpy-2.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:11a76c372d1d37437857280aa142086476136a8c0f373b2e648ab2c8f18fb195", size = 13703552, upload-time = "2024-08-26T20:08:06.666Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/ca/2f384720020c7b244d22508cb7ab23d95f179fcfff33c31a6eeba8d6c512/numpy-2.0.2-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:807ec44583fd708a21d4a11d94aedf2f4f3c3719035c76a2bbe1fe8e217bdc57", size = 5298957, upload-time = "2024-08-26T20:08:15.83Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/78/a3e4f9fb6aa4e6fdca0c5428e8ba039408514388cf62d89651aade838269/numpy-2.0.2-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:8cafab480740e22f8d833acefed5cc87ce276f4ece12fdaa2e8903db2f82897a", size = 6905573, upload-time = "2024-08-26T20:08:27.185Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/72/cfc3a1beb2caf4efc9d0b38a15fe34025230da27e1c08cc2eb9bfb1c7231/numpy-2.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a15f476a45e6e5a3a79d8a14e62161d27ad897381fecfa4a09ed5322f2085669", size = 13914330, upload-time = "2024-08-26T20:08:48.058Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/a8/c17acf65a931ce551fee11b72e8de63bf7e8a6f0e21add4c937c83563538/numpy-2.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:13e689d772146140a252c3a28501da66dfecd77490b498b168b501835041f951", size = 19534895, upload-time = "2024-08-26T20:09:16.536Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/86/8767f3d54f6ae0165749f84648da9dcc8cd78ab65d415494962c86fac80f/numpy-2.0.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:9ea91dfb7c3d1c56a0e55657c0afb38cf1eeae4544c208dc465c3c9f3a7c09f9", size = 19937253, upload-time = "2024-08-26T20:09:46.263Z" },
-    { url = "https://files.pythonhosted.org/packages/df/87/f76450e6e1c14e5bb1eae6836478b1028e096fd02e85c1c37674606ab752/numpy-2.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c1c9307701fec8f3f7a1e6711f9089c06e6284b3afbbcd259f7791282d660a15", size = 14414074, upload-time = "2024-08-26T20:10:08.483Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/ca/0f0f328e1e59f73754f06e1adfb909de43726d4f24c6a3f8805f34f2b0fa/numpy-2.0.2-cp311-cp311-win32.whl", hash = "sha256:a392a68bd329eafac5817e5aefeb39038c48b671afd242710b451e76090e81f4", size = 6470640, upload-time = "2024-08-26T20:10:19.732Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/57/3a3f14d3a759dcf9bf6e9eda905794726b758819df4663f217d658a58695/numpy-2.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:286cd40ce2b7d652a6f22efdfc6d1edf879440e53e76a75955bc0c826c7e64dc", size = 15910230, upload-time = "2024-08-26T20:10:43.413Z" },
-    { url = "https://files.pythonhosted.org/packages/45/40/2e117be60ec50d98fa08c2f8c48e09b3edea93cfcabd5a9ff6925d54b1c2/numpy-2.0.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:df55d490dea7934f330006d0f81e8551ba6010a5bf035a249ef61a94f21c500b", size = 20895803, upload-time = "2024-08-26T20:11:13.916Z" },
-    { url = "https://files.pythonhosted.org/packages/46/92/1b8b8dee833f53cef3e0a3f69b2374467789e0bb7399689582314df02651/numpy-2.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8df823f570d9adf0978347d1f926b2a867d5608f434a7cff7f7908c6570dcf5e", size = 13471835, upload-time = "2024-08-26T20:11:34.779Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/19/e2793bde475f1edaea6945be141aef6c8b4c669b90c90a300a8954d08f0a/numpy-2.0.2-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:9a92ae5c14811e390f3767053ff54eaee3bf84576d99a2456391401323f4ec2c", size = 5038499, upload-time = "2024-08-26T20:11:43.902Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/ff/ddf6dac2ff0dd50a7327bcdba45cb0264d0e96bb44d33324853f781a8f3c/numpy-2.0.2-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:a842d573724391493a97a62ebbb8e731f8a5dcc5d285dfc99141ca15a3302d0c", size = 6633497, upload-time = "2024-08-26T20:11:55.09Z" },
-    { url = "https://files.pythonhosted.org/packages/72/21/67f36eac8e2d2cd652a2e69595a54128297cdcb1ff3931cfc87838874bd4/numpy-2.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c05e238064fc0610c840d1cf6a13bf63d7e391717d247f1bf0318172e759e692", size = 13621158, upload-time = "2024-08-26T20:12:14.95Z" },
-    { url = "https://files.pythonhosted.org/packages/39/68/e9f1126d757653496dbc096cb429014347a36b228f5a991dae2c6b6cfd40/numpy-2.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0123ffdaa88fa4ab64835dcbde75dcdf89c453c922f18dced6e27c90d1d0ec5a", size = 19236173, upload-time = "2024-08-26T20:12:44.049Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/e9/1f5333281e4ebf483ba1c888b1d61ba7e78d7e910fdd8e6499667041cc35/numpy-2.0.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:96a55f64139912d61de9137f11bf39a55ec8faec288c75a54f93dfd39f7eb40c", size = 19634174, upload-time = "2024-08-26T20:13:13.634Z" },
-    { url = "https://files.pythonhosted.org/packages/71/af/a469674070c8d8408384e3012e064299f7a2de540738a8e414dcfd639996/numpy-2.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:ec9852fb39354b5a45a80bdab5ac02dd02b15f44b3804e9f00c556bf24b4bded", size = 14099701, upload-time = "2024-08-26T20:13:34.851Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/3d/08ea9f239d0e0e939b6ca52ad403c84a2bce1bde301a8eb4888c1c1543f1/numpy-2.0.2-cp312-cp312-win32.whl", hash = "sha256:671bec6496f83202ed2d3c8fdc486a8fc86942f2e69ff0e986140339a63bcbe5", size = 6174313, upload-time = "2024-08-26T20:13:45.653Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/b5/4ac39baebf1fdb2e72585c8352c56d063b6126be9fc95bd2bb5ef5770c20/numpy-2.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:cfd41e13fdc257aa5778496b8caa5e856dc4896d4ccf01841daee1d96465467a", size = 15606179, upload-time = "2024-08-26T20:14:08.786Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/3e/ed6db5be21ce87955c0cbd3009f2803f59fa08df21b5df06862e2d8e2bdd/numpy-2.2.6-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:b412caa66f72040e6d268491a59f2c43bf03eb6c96dd8f0307829feb7fa2b6fb", size = 21165245, upload-time = "2025-05-17T21:27:58.555Z" },
+    { url = "https://files.pythonhosted.org/packages/22/c2/4b9221495b2a132cc9d2eb862e21d42a009f5a60e45fc44b00118c174bff/numpy-2.2.6-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8e41fd67c52b86603a91c1a505ebaef50b3314de0213461c7a6e99c9a3beff90", size = 14360048, upload-time = "2025-05-17T21:28:21.406Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/77/dc2fcfc66943c6410e2bf598062f5959372735ffda175b39906d54f02349/numpy-2.2.6-cp310-cp310-macosx_14_0_arm64.whl", hash = "sha256:37e990a01ae6ec7fe7fa1c26c55ecb672dd98b19c3d0e1d1f326fa13cb38d163", size = 5340542, upload-time = "2025-05-17T21:28:30.931Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/4f/1cb5fdc353a5f5cc7feb692db9b8ec2c3d6405453f982435efc52561df58/numpy-2.2.6-cp310-cp310-macosx_14_0_x86_64.whl", hash = "sha256:5a6429d4be8ca66d889b7cf70f536a397dc45ba6faeb5f8c5427935d9592e9cf", size = 6878301, upload-time = "2025-05-17T21:28:41.613Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/17/96a3acd228cec142fcb8723bd3cc39c2a474f7dcf0a5d16731980bcafa95/numpy-2.2.6-cp310-cp310-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:efd28d4e9cd7d7a8d39074a4d44c63eda73401580c5c76acda2ce969e0a38e83", size = 14297320, upload-time = "2025-05-17T21:29:02.78Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/63/3de6a34ad7ad6646ac7d2f55ebc6ad439dbbf9c4370017c50cf403fb19b5/numpy-2.2.6-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fc7b73d02efb0e18c000e9ad8b83480dfcd5dfd11065997ed4c6747470ae8915", size = 16801050, upload-time = "2025-05-17T21:29:27.675Z" },
+    { url = "https://files.pythonhosted.org/packages/07/b6/89d837eddef52b3d0cec5c6ba0456c1bf1b9ef6a6672fc2b7873c3ec4e2e/numpy-2.2.6-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:74d4531beb257d2c3f4b261bfb0fc09e0f9ebb8842d82a7b4209415896adc680", size = 15807034, upload-time = "2025-05-17T21:29:51.102Z" },
+    { url = "https://files.pythonhosted.org/packages/01/c8/dc6ae86e3c61cfec1f178e5c9f7858584049b6093f843bca541f94120920/numpy-2.2.6-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:8fc377d995680230e83241d8a96def29f204b5782f371c532579b4f20607a289", size = 18614185, upload-time = "2025-05-17T21:30:18.703Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/c5/0064b1b7e7c89137b471ccec1fd2282fceaae0ab3a9550f2568782d80357/numpy-2.2.6-cp310-cp310-win32.whl", hash = "sha256:b093dd74e50a8cba3e873868d9e93a85b78e0daf2e98c6797566ad8044e8363d", size = 6527149, upload-time = "2025-05-17T21:30:29.788Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/dd/4b822569d6b96c39d1215dbae0582fd99954dcbcf0c1a13c61783feaca3f/numpy-2.2.6-cp310-cp310-win_amd64.whl", hash = "sha256:f0fd6321b839904e15c46e0d257fdd101dd7f530fe03fd6359c1ea63738703f3", size = 12904620, upload-time = "2025-05-17T21:30:48.994Z" },
+    { url = "https://files.pythonhosted.org/packages/da/a8/4f83e2aa666a9fbf56d6118faaaf5f1974d456b1823fda0a176eff722839/numpy-2.2.6-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f9f1adb22318e121c5c69a09142811a201ef17ab257a1e66ca3025065b7f53ae", size = 21176963, upload-time = "2025-05-17T21:31:19.36Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/2b/64e1affc7972decb74c9e29e5649fac940514910960ba25cd9af4488b66c/numpy-2.2.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:c820a93b0255bc360f53eca31a0e676fd1101f673dda8da93454a12e23fc5f7a", size = 14406743, upload-time = "2025-05-17T21:31:41.087Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/9f/0121e375000b5e50ffdd8b25bf78d8e1a5aa4cca3f185d41265198c7b834/numpy-2.2.6-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:3d70692235e759f260c3d837193090014aebdf026dfd167834bcba43e30c2a42", size = 5352616, upload-time = "2025-05-17T21:31:50.072Z" },
+    { url = "https://files.pythonhosted.org/packages/31/0d/b48c405c91693635fbe2dcd7bc84a33a602add5f63286e024d3b6741411c/numpy-2.2.6-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:481b49095335f8eed42e39e8041327c05b0f6f4780488f61286ed3c01368d491", size = 6889579, upload-time = "2025-05-17T21:32:01.712Z" },
+    { url = "https://files.pythonhosted.org/packages/52/b8/7f0554d49b565d0171eab6e99001846882000883998e7b7d9f0d98b1f934/numpy-2.2.6-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b64d8d4d17135e00c8e346e0a738deb17e754230d7e0810ac5012750bbd85a5a", size = 14312005, upload-time = "2025-05-17T21:32:23.332Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/dd/2238b898e51bd6d389b7389ffb20d7f4c10066d80351187ec8e303a5a475/numpy-2.2.6-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ba10f8411898fc418a521833e014a77d3ca01c15b0c6cdcce6a0d2897e6dbbdf", size = 16821570, upload-time = "2025-05-17T21:32:47.991Z" },
+    { url = "https://files.pythonhosted.org/packages/83/6c/44d0325722cf644f191042bf47eedad61c1e6df2432ed65cbe28509d404e/numpy-2.2.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bd48227a919f1bafbdda0583705e547892342c26fb127219d60a5c36882609d1", size = 15818548, upload-time = "2025-05-17T21:33:11.728Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/9d/81e8216030ce66be25279098789b665d49ff19eef08bfa8cb96d4957f422/numpy-2.2.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9551a499bf125c1d4f9e250377c1ee2eddd02e01eac6644c080162c0c51778ab", size = 18620521, upload-time = "2025-05-17T21:33:39.139Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/fd/e19617b9530b031db51b0926eed5345ce8ddc669bb3bc0044b23e275ebe8/numpy-2.2.6-cp311-cp311-win32.whl", hash = "sha256:0678000bb9ac1475cd454c6b8c799206af8107e310843532b04d49649c717a47", size = 6525866, upload-time = "2025-05-17T21:33:50.273Z" },
+    { url = "https://files.pythonhosted.org/packages/31/0a/f354fb7176b81747d870f7991dc763e157a934c717b67b58456bc63da3df/numpy-2.2.6-cp311-cp311-win_amd64.whl", hash = "sha256:e8213002e427c69c45a52bbd94163084025f533a55a59d6f9c5b820774ef3303", size = 12907455, upload-time = "2025-05-17T21:34:09.135Z" },
+    { url = "https://files.pythonhosted.org/packages/82/5d/c00588b6cf18e1da539b45d3598d3557084990dcc4331960c15ee776ee41/numpy-2.2.6-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:41c5a21f4a04fa86436124d388f6ed60a9343a6f767fced1a8a71c3fbca038ff", size = 20875348, upload-time = "2025-05-17T21:34:39.648Z" },
+    { url = "https://files.pythonhosted.org/packages/66/ee/560deadcdde6c2f90200450d5938f63a34b37e27ebff162810f716f6a230/numpy-2.2.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:de749064336d37e340f640b05f24e9e3dd678c57318c7289d222a8a2f543e90c", size = 14119362, upload-time = "2025-05-17T21:35:01.241Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/65/4baa99f1c53b30adf0acd9a5519078871ddde8d2339dc5a7fde80d9d87da/numpy-2.2.6-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:894b3a42502226a1cac872f840030665f33326fc3dac8e57c607905773cdcde3", size = 5084103, upload-time = "2025-05-17T21:35:10.622Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/89/e5a34c071a0570cc40c9a54eb472d113eea6d002e9ae12bb3a8407fb912e/numpy-2.2.6-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:71594f7c51a18e728451bb50cc60a3ce4e6538822731b2933209a1f3614e9282", size = 6625382, upload-time = "2025-05-17T21:35:21.414Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/35/8c80729f1ff76b3921d5c9487c7ac3de9b2a103b1cd05e905b3090513510/numpy-2.2.6-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f2618db89be1b4e05f7a1a847a9c1c0abd63e63a1607d892dd54668dd92faf87", size = 14018462, upload-time = "2025-05-17T21:35:42.174Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/3d/1e1db36cfd41f895d266b103df00ca5b3cbe965184df824dec5c08c6b803/numpy-2.2.6-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fd83c01228a688733f1ded5201c678f0c53ecc1006ffbc404db9f7a899ac6249", size = 16527618, upload-time = "2025-05-17T21:36:06.711Z" },
+    { url = "https://files.pythonhosted.org/packages/61/c6/03ed30992602c85aa3cd95b9070a514f8b3c33e31124694438d88809ae36/numpy-2.2.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:37c0ca431f82cd5fa716eca9506aefcabc247fb27ba69c5062a6d3ade8cf8f49", size = 15505511, upload-time = "2025-05-17T21:36:29.965Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/25/5761d832a81df431e260719ec45de696414266613c9ee268394dd5ad8236/numpy-2.2.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fe27749d33bb772c80dcd84ae7e8df2adc920ae8297400dabec45f0dedb3f6de", size = 18313783, upload-time = "2025-05-17T21:36:56.883Z" },
+    { url = "https://files.pythonhosted.org/packages/57/0a/72d5a3527c5ebffcd47bde9162c39fae1f90138c961e5296491ce778e682/numpy-2.2.6-cp312-cp312-win32.whl", hash = "sha256:4eeaae00d789f66c7a25ac5f34b71a7035bb474e679f410e5e1a94deb24cf2d4", size = 6246506, upload-time = "2025-05-17T21:37:07.368Z" },
+    { url = "https://files.pythonhosted.org/packages/36/fa/8c9210162ca1b88529ab76b41ba02d433fd54fecaf6feb70ef9f124683f1/numpy-2.2.6-cp312-cp312-win_amd64.whl", hash = "sha256:c1f9540be57940698ed329904db803cf7a402f3fc200bfe599334c9bd84a40b2", size = 12614190, upload-time = "2025-05-17T21:37:26.213Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/5c/6657823f4f594f72b5471f1db1ab12e26e890bb2e41897522d134d2a3e81/numpy-2.2.6-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:0811bb762109d9708cca4d0b13c4f67146e3c3b7cf8d34018c722adb2d957c84", size = 20867828, upload-time = "2025-05-17T21:37:56.699Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/9e/14520dc3dadf3c803473bd07e9b2bd1b69bc583cb2497b47000fed2fa92f/numpy-2.2.6-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:287cc3162b6f01463ccd86be154f284d0893d2b3ed7292439ea97eafa8170e0b", size = 14143006, upload-time = "2025-05-17T21:38:18.291Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/06/7e96c57d90bebdce9918412087fc22ca9851cceaf5567a45c1f404480e9e/numpy-2.2.6-cp313-cp313-macosx_14_0_arm64.whl", hash = "sha256:f1372f041402e37e5e633e586f62aa53de2eac8d98cbfb822806ce4bbefcb74d", size = 5076765, upload-time = "2025-05-17T21:38:27.319Z" },
+    { url = "https://files.pythonhosted.org/packages/73/ed/63d920c23b4289fdac96ddbdd6132e9427790977d5457cd132f18e76eae0/numpy-2.2.6-cp313-cp313-macosx_14_0_x86_64.whl", hash = "sha256:55a4d33fa519660d69614a9fad433be87e5252f4b03850642f88993f7b2ca566", size = 6617736, upload-time = "2025-05-17T21:38:38.141Z" },
+    { url = "https://files.pythonhosted.org/packages/85/c5/e19c8f99d83fd377ec8c7e0cf627a8049746da54afc24ef0a0cb73d5dfb5/numpy-2.2.6-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f92729c95468a2f4f15e9bb94c432a9229d0d50de67304399627a943201baa2f", size = 14010719, upload-time = "2025-05-17T21:38:58.433Z" },
+    { url = "https://files.pythonhosted.org/packages/19/49/4df9123aafa7b539317bf6d342cb6d227e49f7a35b99c287a6109b13dd93/numpy-2.2.6-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1bc23a79bfabc5d056d106f9befb8d50c31ced2fbc70eedb8155aec74a45798f", size = 16526072, upload-time = "2025-05-17T21:39:22.638Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/6c/04b5f47f4f32f7c2b0e7260442a8cbcf8168b0e1a41ff1495da42f42a14f/numpy-2.2.6-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:e3143e4451880bed956e706a3220b4e5cf6172ef05fcc397f6f36a550b1dd868", size = 15503213, upload-time = "2025-05-17T21:39:45.865Z" },
+    { url = "https://files.pythonhosted.org/packages/17/0a/5cd92e352c1307640d5b6fec1b2ffb06cd0dabe7d7b8227f97933d378422/numpy-2.2.6-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:b4f13750ce79751586ae2eb824ba7e1e8dba64784086c98cdbbcc6a42112ce0d", size = 18316632, upload-time = "2025-05-17T21:40:13.331Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/3b/5cba2b1d88760ef86596ad0f3d484b1cbff7c115ae2429678465057c5155/numpy-2.2.6-cp313-cp313-win32.whl", hash = "sha256:5beb72339d9d4fa36522fc63802f469b13cdbe4fdab4a288f0c441b74272ebfd", size = 6244532, upload-time = "2025-05-17T21:43:46.099Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/3b/d58c12eafcb298d4e6d0d40216866ab15f59e55d148a5658bb3132311fcf/numpy-2.2.6-cp313-cp313-win_amd64.whl", hash = "sha256:b0544343a702fa80c95ad5d3d608ea3599dd54d4632df855e4c8d24eb6ecfa1c", size = 12610885, upload-time = "2025-05-17T21:44:05.145Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/9e/4bf918b818e516322db999ac25d00c75788ddfd2d2ade4fa66f1f38097e1/numpy-2.2.6-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:0bca768cd85ae743b2affdc762d617eddf3bcf8724435498a1e80132d04879e6", size = 20963467, upload-time = "2025-05-17T21:40:44Z" },
+    { url = "https://files.pythonhosted.org/packages/61/66/d2de6b291507517ff2e438e13ff7b1e2cdbdb7cb40b3ed475377aece69f9/numpy-2.2.6-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:fc0c5673685c508a142ca65209b4e79ed6740a4ed6b2267dbba90f34b0b3cfda", size = 14225144, upload-time = "2025-05-17T21:41:05.695Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/25/480387655407ead912e28ba3a820bc69af9adf13bcbe40b299d454ec011f/numpy-2.2.6-cp313-cp313t-macosx_14_0_arm64.whl", hash = "sha256:5bd4fc3ac8926b3819797a7c0e2631eb889b4118a9898c84f585a54d475b7e40", size = 5200217, upload-time = "2025-05-17T21:41:15.903Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/4a/6e313b5108f53dcbf3aca0c0f3e9c92f4c10ce57a0a721851f9785872895/numpy-2.2.6-cp313-cp313t-macosx_14_0_x86_64.whl", hash = "sha256:fee4236c876c4e8369388054d02d0e9bb84821feb1a64dd59e137e6511a551f8", size = 6712014, upload-time = "2025-05-17T21:41:27.321Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/30/172c2d5c4be71fdf476e9de553443cf8e25feddbe185e0bd88b096915bcc/numpy-2.2.6-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:e1dda9c7e08dc141e0247a5b8f49cf05984955246a327d4c48bda16821947b2f", size = 14077935, upload-time = "2025-05-17T21:41:49.738Z" },
+    { url = "https://files.pythonhosted.org/packages/12/fb/9e743f8d4e4d3c710902cf87af3512082ae3d43b945d5d16563f26ec251d/numpy-2.2.6-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f447e6acb680fd307f40d3da4852208af94afdfab89cf850986c3ca00562f4fa", size = 16600122, upload-time = "2025-05-17T21:42:14.046Z" },
+    { url = "https://files.pythonhosted.org/packages/12/75/ee20da0e58d3a66f204f38916757e01e33a9737d0b22373b3eb5a27358f9/numpy-2.2.6-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:389d771b1623ec92636b0786bc4ae56abafad4a4c513d36a55dce14bd9ce8571", size = 15586143, upload-time = "2025-05-17T21:42:37.464Z" },
+    { url = "https://files.pythonhosted.org/packages/76/95/bef5b37f29fc5e739947e9ce5179ad402875633308504a52d188302319c8/numpy-2.2.6-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8e9ace4a37db23421249ed236fdcdd457d671e25146786dfc96835cd951aa7c1", size = 18385260, upload-time = "2025-05-17T21:43:05.189Z" },
+    { url = "https://files.pythonhosted.org/packages/09/04/f2f83279d287407cf36a7a8053a5abe7be3622a4363337338f2585e4afda/numpy-2.2.6-cp313-cp313t-win32.whl", hash = "sha256:038613e9fb8c72b0a41f025a7e4c3f0b7a1b5d768ece4796b674c8f3fe13efff", size = 6377225, upload-time = "2025-05-17T21:43:16.254Z" },
+    { url = "https://files.pythonhosted.org/packages/67/0e/35082d13c09c02c011cf21570543d202ad929d961c02a147493cb0c2bdf5/numpy-2.2.6-cp313-cp313t-win_amd64.whl", hash = "sha256:6031dd6dfecc0cf9f668681a37648373bddd6421fff6c66ec1624eed0180ee06", size = 12771374, upload-time = "2025-05-17T21:43:35.479Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/3b/d94a75f4dbf1ef5d321523ecac21ef23a3cd2ac8b78ae2aac40873590229/numpy-2.2.6-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:0b605b275d7bd0c640cad4e5d30fa701a8d59302e127e5f79138ad62762c3e3d", size = 21040391, upload-time = "2025-05-17T21:44:35.948Z" },
+    { url = "https://files.pythonhosted.org/packages/17/f4/09b2fa1b58f0fb4f7c7963a1649c64c4d315752240377ed74d9cd878f7b5/numpy-2.2.6-pp310-pypy310_pp73-macosx_14_0_x86_64.whl", hash = "sha256:7befc596a7dc9da8a337f79802ee8adb30a552a94f792b9c9d18c840055907db", size = 6786754, upload-time = "2025-05-17T21:44:47.446Z" },
+    { url = "https://files.pythonhosted.org/packages/af/30/feba75f143bdc868a1cc3f44ccfa6c4b9ec522b36458e738cd00f67b573f/numpy-2.2.6-pp310-pypy310_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ce47521a4754c8f4593837384bd3424880629f718d87c5d44f8ed763edd63543", size = 16643476, upload-time = "2025-05-17T21:45:11.871Z" },
+    { url = "https://files.pythonhosted.org/packages/37/48/ac2a9584402fb6c0cd5b5d1a91dcf176b15760130dd386bbafdbfe3640bf/numpy-2.2.6-pp310-pypy310_pp73-win_amd64.whl", hash = "sha256:d042d24c90c41b54fd506da306759e06e568864df8ec17ccc17e9e884634fd00", size = 12812666, upload-time = "2025-05-17T21:45:31.426Z" },
 ]
 
 [[package]]
@@ -3069,6 +3280,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/20/e8/45a05d9c39d2cea61ab175dbe6a2de1d05b679e8de2011da4ee190d7e748/pandas-2.2.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:6dfcb5ee8d4d50c06a51c2fffa6cff6272098ad6540aed1a76d15fb9318194d8", size = 16359235, upload-time = "2024-09-20T19:02:07.094Z" },
     { url = "https://files.pythonhosted.org/packages/1d/99/617d07a6a5e429ff90c90da64d428516605a1ec7d7bea494235e1c3882de/pandas-2.2.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:062309c1b9ea12a50e8ce661145c6aab431b1e99530d3cd60640e255778bd43a", size = 14056756, upload-time = "2024-09-20T13:09:20.474Z" },
     { url = "https://files.pythonhosted.org/packages/29/d4/1244ab8edf173a10fd601f7e13b9566c1b525c4f365d6bee918e68381889/pandas-2.2.3-cp312-cp312-win_amd64.whl", hash = "sha256:59ef3764d0fe818125a5097d2ae867ca3fa64df032331b7e0917cf5d7bf66b13", size = 11504248, upload-time = "2024-09-20T13:09:23.137Z" },
+    { url = "https://files.pythonhosted.org/packages/64/22/3b8f4e0ed70644e85cfdcd57454686b9057c6c38d2f74fe4b8bc2527214a/pandas-2.2.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:f00d1345d84d8c86a63e476bb4955e46458b304b9575dcf71102b5c705320015", size = 12477643, upload-time = "2024-09-20T13:09:25.522Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/93/b3f5d1838500e22c8d793625da672f3eec046b1a99257666c94446969282/pandas-2.2.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3508d914817e153ad359d7e069d752cdd736a247c322d932eb89e6bc84217f28", size = 11281573, upload-time = "2024-09-20T13:09:28.012Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/94/6c79b07f0e5aab1dcfa35a75f4817f5c4f677931d4234afcd75f0e6a66ca/pandas-2.2.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:22a9d949bfc9a502d320aa04e5d02feab689d61da4e7764b62c30b991c42c5f0", size = 15196085, upload-time = "2024-09-20T19:02:10.451Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/31/aa8da88ca0eadbabd0a639788a6da13bb2ff6edbbb9f29aa786450a30a91/pandas-2.2.3-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f3a255b2c19987fbbe62a9dfd6cff7ff2aa9ccab3fc75218fd4b7530f01efa24", size = 12711809, upload-time = "2024-09-20T13:09:30.814Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/7c/c6dbdb0cb2a4344cacfb8de1c5808ca885b2e4dcfde8008266608f9372af/pandas-2.2.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:800250ecdadb6d9c78eae4990da62743b857b470883fa27f652db8bdde7f6659", size = 16356316, upload-time = "2024-09-20T19:02:13.825Z" },
+    { url = "https://files.pythonhosted.org/packages/57/b7/8b757e7d92023b832869fa8881a992696a0bfe2e26f72c9ae9f255988d42/pandas-2.2.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6374c452ff3ec675a8f46fd9ab25c4ad0ba590b71cf0656f8b6daa5202bca3fb", size = 14022055, upload-time = "2024-09-20T13:09:33.462Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/bc/4b18e2b8c002572c5a441a64826252ce5da2aa738855747247a971988043/pandas-2.2.3-cp313-cp313-win_amd64.whl", hash = "sha256:61c5ad4043f791b61dd4752191d9f07f0ae412515d59ba8f005832a532f8736d", size = 11481175, upload-time = "2024-09-20T13:09:35.871Z" },
+    { url = "https://files.pythonhosted.org/packages/76/a3/a5d88146815e972d40d19247b2c162e88213ef51c7c25993942c39dbf41d/pandas-2.2.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:3b71f27954685ee685317063bf13c7709a7ba74fc996b84fc6821c59b0f06468", size = 12615650, upload-time = "2024-09-20T13:09:38.685Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/8c/f0fd18f6140ddafc0c24122c8a964e48294acc579d47def376fef12bcb4a/pandas-2.2.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:38cf8125c40dae9d5acc10fa66af8ea6fdf760b2714ee482ca691fc66e6fcb18", size = 11290177, upload-time = "2024-09-20T13:09:41.141Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/f9/e995754eab9c0f14c6777401f7eece0943840b7a9fc932221c19d1abee9f/pandas-2.2.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:ba96630bc17c875161df3818780af30e43be9b166ce51c9a18c1feae342906c2", size = 14651526, upload-time = "2024-09-20T19:02:16.905Z" },
+    { url = "https://files.pythonhosted.org/packages/25/b0/98d6ae2e1abac4f35230aa756005e8654649d305df9a28b16b9ae4353bff/pandas-2.2.3-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:1db71525a1538b30142094edb9adc10be3f3e176748cd7acc2240c2f2e5aa3a4", size = 11871013, upload-time = "2024-09-20T13:09:44.39Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/57/0f72a10f9db6a4628744c8e8f0df4e6e21de01212c7c981d31e50ffc8328/pandas-2.2.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:15c0e1e02e93116177d29ff83e8b1619c93ddc9c49083f237d4312337a61165d", size = 15711620, upload-time = "2024-09-20T19:02:20.639Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/5f/b38085618b950b79d2d9164a711c52b10aefc0ae6833b96f626b7021b2ed/pandas-2.2.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:ad5b65698ab28ed8d7f18790a0dc58005c7629f227be9ecc1072aa74c0c1d43a", size = 13098436, upload-time = "2024-09-20T13:09:48.112Z" },
 ]
 
 [[package]]
@@ -3213,6 +3437,40 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/cf/74/66bd798b5b3be70aa1b391f5cc9d6a0a5532d7fd3b19ec0b213e72e6ad9d/propcache-0.5.2-cp312-cp312-win32.whl", hash = "sha256:8c7972d8f193740d9175f0998ab38717e6cd322d5935c5b0fef8c0d323fd9031", size = 39018, upload-time = "2026-05-08T21:00:31.622Z" },
     { url = "https://files.pythonhosted.org/packages/61/7c/5c0d34aa3024694d6dcb9271cdbdd08c4e47c1c0ad95ec7e7bc74cdea145/propcache-0.5.2-cp312-cp312-win_amd64.whl", hash = "sha256:d9ee8826a7d47863a08ac44e1a5f611a462eefc3a194b492da242128bec75b42", size = 42322, upload-time = "2026-05-08T21:00:32.918Z" },
     { url = "https://files.pythonhosted.org/packages/4d/91/875812f1a3feb20ceba818ef39fbe4d92f1081e04ac815c822496d0d038b/propcache-0.5.2-cp312-cp312-win_arm64.whl", hash = "sha256:2800a4a8ead6b28cccd1ec54b59346f0def7922ee1c7598e8499c733cfbb7c84", size = 38172, upload-time = "2026-05-08T21:00:35.124Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/09/f049e45385503fe67db75a6b6186a7b9f0c3930366dc960522c312a825b1/propcache-0.5.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:099aaf4b4d1a02265b92a977edf00b5c4f63b3b17ac6de39b0d637c9cac0188a", size = 94457, upload-time = "2026-05-08T21:00:36.355Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/65/83d1d05655baf63113731bd5a1008435e14f8d1e5a06cbe4ec5b23ad7a31/propcache-0.5.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:68ce1c44c7a813a7f71ea04315a8c7b330b63db99d059a797a4651bb6f69f117", size = 53835, upload-time = "2026-05-08T21:00:38.072Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/12/a6ba6482bb5ea3260c000c9b20881c95fa11c6b30173715668259f844ed7/propcache-0.5.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:fc299c129490f55f254cd90be0deca4764e36e9a7c08b4aa588479a3bbed3098", size = 54545, upload-time = "2026-05-08T21:00:39.319Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/19/7fa086f5764c59ec8a8e157cd93aa8497acc00aba9dcdec56bfffb32602d/propcache-0.5.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a6ae2198be502c10f09b2516e7b5d019816924bc3183a43ce792a7bd6625e6f4", size = 59886, upload-time = "2026-05-08T21:00:40.621Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/e4/5d7663dc8235956c8f5281698a3af1d351d8820341ddd890f59d9a9127f2/propcache-0.5.2-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6041d31504dc1779d700e1edcfb08eea334b357620b06681a4eabb57a74e574e", size = 63261, upload-time = "2026-05-08T21:00:41.775Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/4a/15a03adee24d6350da4292caeac44c34c033d2afe5e87eb370f38854560f/propcache-0.5.2-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f7eabc04151c78a9f4d5bbb5f1faf571e4defeb4b585e0fe95b60ff2dbe4d3d7", size = 64184, upload-time = "2026-05-08T21:00:43.018Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/c6/979176efdaa3d239e36d503d5af63a0a773b36662ed8f52e5b6a6d9fd40e/propcache-0.5.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4db0ba63d693afd40d249bd93f842b5f144f8fcbb83de05660373bcf30517b1d", size = 61534, upload-time = "2026-05-08T21:00:44.507Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/22/63e8cd1bae4c2d2be6493b6b7d10566ddafad88137cfbc99964a1119853c/propcache-0.5.2-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1dbcf7675229b35d31abb6547d8ebc8c27a830ac3f9a794edff6254873ec7c0a", size = 61500, upload-time = "2026-05-08T21:00:45.796Z" },
+    { url = "https://files.pythonhosted.org/packages/60/5a/28e5d9acbac1cc9ccb67045e8c1b943aa8d79fdf39c93bd73cacd68008ea/propcache-0.5.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d310c013aad2c72f1c3f2f8dd3279d460a858c551f97aeb8c63e4693cca7b4d2", size = 59994, upload-time = "2026-05-08T21:00:47.093Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/40/db650677f554a95b9c01a7c9d93d629e93a15562f5deb4573c9ee136fed2/propcache-0.5.2-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:06187263ddad280d05b4d8a8b3bb7d164cbebd469236544a42e6d9b28ac6a4fa", size = 56884, upload-time = "2026-05-08T21:00:48.376Z" },
+    { url = "https://files.pythonhosted.org/packages/80/45/70b39b89516ff8b96bf732fa6fded8cef20f293cb1508690101c3c07ec51/propcache-0.5.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:3115559b8effafd63b142ea5ed53d63a16ea6469cbc63dce4ee194b42db5d853", size = 63464, upload-time = "2026-05-08T21:00:49.954Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/e2/fa59d3a89eac5534293124af4f1d0d0ada091ce4a0ab4610ce03fd2bdd8d/propcache-0.5.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:c60462af8e6dc30c35407c7237ea908d777b22862bbee27bc4699c0d8bcdc45a", size = 61588, upload-time = "2026-05-08T21:00:51.281Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/97/efb547a55c4bc7381cfb202d6a2239ac621045277bc1ea5dfd3a7f0516c0/propcache-0.5.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:40314bca9ac559716fe374094fc81c11dcc34b64fd6c585360f5775690505704", size = 64667, upload-time = "2026-05-08T21:00:52.602Z" },
+    { url = "https://files.pythonhosted.org/packages/92/56/f5c7d9b4b7595d5127da38974d791b2153f3d1eae6c674af3583ace92ad3/propcache-0.5.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:cfa21e036ce1e1db2be04ba3b85d2df1bb1702fa01932d984c5464c665228ff4", size = 62463, upload-time = "2026-05-08T21:00:54.303Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/3b/484a3a65fc9f9f60c41dcd17b428bace5389544e2c680994534a20755066/propcache-0.5.2-cp313-cp313-win32.whl", hash = "sha256:f156a3529f38063b6dbaf356e15602a7f95f8055b1295a438433a6386f10463d", size = 38621, upload-time = "2026-05-08T21:00:55.808Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/fd/3f0f10dba4dabad3bf53102be007abf55481067952bde0fdddff439e7c61/propcache-0.5.2-cp313-cp313-win_amd64.whl", hash = "sha256:dfed59d0a5aeb01e242e66ff0300bc4a265a7c05f612d30016f0b60b1017d757", size = 41649, upload-time = "2026-05-08T21:00:57.061Z" },
+    { url = "https://files.pythonhosted.org/packages/90/ec/6ce619cc32bb500a482f811f9cd509368b4e58e638d13f2c68f370d6b475/propcache-0.5.2-cp313-cp313-win_arm64.whl", hash = "sha256:ba338430e87ceb9c8f0cf754de38a9860560261e56c00376debd628698a7364f", size = 37636, upload-time = "2026-05-08T21:00:58.646Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/82/c1d268bbbf2ef981c5bf0fbbe746db617c66e3bcefe431a1aa8943fbe23a/propcache-0.5.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:a592f5f3da71c8691c788c13cb6734b6d17663d2e1cb8caddf0673d01ef8847d", size = 98872, upload-time = "2026-05-08T21:00:59.889Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/d4/52c871e73e864e6b34c0e2d58ac1ec5ccd149497ddc7ad2137ae98323a35/propcache-0.5.2-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:6a997d0489e9668a384fcfd5061b857aa5361de73191cac204d04b889cfbbafa", size = 56257, upload-time = "2026-05-08T21:01:01.195Z" },
+    { url = "https://files.pythonhosted.org/packages/67/f0/9b90ca2a210b3d09bcfcd96ecd0f55545c091535abce2a45de2775cfd357/propcache-0.5.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:10734b5484ea113152ee25a91dccedf81631791805d2c9ccb054958e51842c94", size = 56696, upload-time = "2026-05-08T21:01:02.941Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/0e/6e9d4ba07c8e56e21ddec1e75f12148142b21ca83a51871babce095334f4/propcache-0.5.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cafca7e56c12bb02ae16d283742bef25a61122e9dab2b5b3f2ccbe589ce32164", size = 62378, upload-time = "2026-05-08T21:01:04.475Z" },
+    { url = "https://files.pythonhosted.org/packages/65/19/c10badaa463dde8a27ce884f8ee2ec37e6035b7c9f5ff0c8f74f06f08dac/propcache-0.5.2-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f064f8d2b59177878b7615df1735cd8fe3462ed6be8c7b217d17a276489c2b7f", size = 65283, upload-time = "2026-05-08T21:01:05.959Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/b6/93bea99ca80e19cef6512a8580e5b7857bbe09422d9daa7fd4ef5723306c/propcache-0.5.2-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f78abfa8dfc32376fd1aacf597b2f2fbbe0ea751419aee718af5d4f82537ef8c", size = 66616, upload-time = "2026-05-08T21:01:07.228Z" },
+    { url = "https://files.pythonhosted.org/packages/83/e4/5c7462e50625f051f37fb38b8224f7639f667184bbd34424ec83819bb1b7/propcache-0.5.2-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f7467da8a9822bf1a55336f877340c5bcbd3c482afc43a99771169f74a26dedc", size = 63773, upload-time = "2026-05-08T21:01:08.514Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/b6/99238894047b13c823be25027e736626cd414a52a5e30d2c3347c2733529/propcache-0.5.2-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a6ddc6ac9e25de626c1f129c1b467d7ecd33ce2237d3fd0c4e429feef0a7ee1f", size = 63664, upload-time = "2026-05-08T21:01:09.874Z" },
+    { url = "https://files.pythonhosted.org/packages/85/1e/a3a1a63116a2b8edb415a8bb9a6f0c34bd03830b1e18e8ce2904e1dc1cf4/propcache-0.5.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:2f22cbbac9e26a8e864c0985ff1268d5d939d53d9d9411a9824279097e03a2cb", size = 62643, upload-time = "2026-05-08T21:01:11.132Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/03/893cf147de2fc6543c5eaa07ad833170e7e2a2385725bbebe8c0503723bb/propcache-0.5.2-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:fc76378c62a0f04d0cd82fbb1a2cd2d7e28fcb40d5873f28a6c44e388aaa2751", size = 59595, upload-time = "2026-05-08T21:01:12.387Z" },
+    { url = "https://files.pythonhosted.org/packages/86/3b/04c1a2e12c57766568ba75ba72b3bf2042818d4c1425fab6fc07155c7cff/propcache-0.5.2-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:acd2c8edba48e31e58a363b8cf4e5c7db3b04b3f9e371f601df30d9b0d244836", size = 65711, upload-time = "2026-05-08T21:01:13.676Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/34/80f8d0099f8d6bacc4de1624c85672681c8cd1149ca2da0e38fd120b817f/propcache-0.5.2-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:452b5065457eb9991ec5eb38ff41d6cd4c991c9ac7c531c4d5849ae473a9a13f", size = 64247, upload-time = "2026-05-08T21:01:14.936Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/1a/8b08f3a5f1037e9e370c55883ceeeee0f6dd0416fb2d2d67b8bfc91f2a79/propcache-0.5.2-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:3430bb2bfe1331885c427745a751e774ee679fd4344f80b97bf879815fe8fa55", size = 67102, upload-time = "2026-05-08T21:01:16.281Z" },
+    { url = "https://files.pythonhosted.org/packages/34/68/8bdb7bb7756d76e005490649d10e4a8369e610c74d619f71e1aedf889e9c/propcache-0.5.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:cef6cea3922890dd6c9654971001fa797b526c16ab5e1e46c05fd6f877be7568", size = 64964, upload-time = "2026-05-08T21:01:17.57Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/aa/50fb0b5d3968b61a510926ff8b8465f1d6e976b3ab74496d7a4b9fc42515/propcache-0.5.2-cp313-cp313t-win32.whl", hash = "sha256:72d61e16dd78228b58c5d47be830ff3da7e5f139abdf0aef9d86cde1c5cf2191", size = 42546, upload-time = "2026-05-08T21:01:18.946Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/4c/0ddbae64321bd4a95bcbfc19307238016b5b1fee645c84626c8d539e5b74/propcache-0.5.2-cp313-cp313t-win_amd64.whl", hash = "sha256:0958834041a0166d343b8d2cedcd8bcbaeb4fdbe0cf08320c5379f143c3be6e7", size = 46330, upload-time = "2026-05-08T21:01:20.162Z" },
+    { url = "https://files.pythonhosted.org/packages/00/d9/9cddc8efb78d8af264c5ec9f6d10b62f57c515feda8d321595f56010fb23/propcache-0.5.2-cp313-cp313t-win_arm64.whl", hash = "sha256:6de8bd93ddde9b992cf2b2e0d796d501a19026b5b9fd87356d7d0779531a8d96", size = 40521, upload-time = "2026-05-08T21:01:21.399Z" },
     { url = "https://files.pythonhosted.org/packages/3a/ed/1cdcab6ba3d6ab7feca11fc14f0eeea80755bb53ef4e892079f31b10a25f/propcache-0.5.2-py3-none-any.whl", hash = "sha256:be1ddfcbb376e3de5d2e2db1d58d6d67463e6b4f9f040c000de8e300295465fe", size = 14036, upload-time = "2026-05-08T21:02:10.673Z" },
 ]
 
@@ -3262,7 +3520,6 @@ dependencies = [
     { name = "alibabacloud-tea-openapi" },
     { name = "alibabacloud-vpc20160428" },
     { name = "alive-progress" },
-    { name = "awsipranges" },
     { name = "azure-identity" },
     { name = "azure-keyvault-keys" },
     { name = "azure-mgmt-apimanagement" },
@@ -3371,7 +3628,6 @@ requires-dist = [
     { name = "alibabacloud-tea-openapi", specifier = "==0.4.4" },
     { name = "alibabacloud-vpc20160428", specifier = "==6.13.0" },
     { name = "alive-progress", specifier = "==3.3.0" },
-    { name = "awsipranges", specifier = "==0.3.3" },
     { name = "azure-identity", specifier = "==1.21.0" },
     { name = "azure-keyvault-keys", specifier = "==4.10.0" },
     { name = "azure-mgmt-apimanagement", specifier = "==5.0.0" },
@@ -3417,12 +3673,12 @@ requires-dist = [
     { name = "markdown", specifier = "==3.10.2" },
     { name = "microsoft-kiota-abstractions", specifier = "==1.9.2" },
     { name = "msgraph-sdk", specifier = "==1.55.0" },
-    { name = "numpy", specifier = "==2.0.2" },
+    { name = "numpy", specifier = "==2.2.6" },
     { name = "oci", specifier = "==2.169.0" },
     { name = "okta", specifier = "==3.4.2" },
     { name = "openstacksdk", specifier = "==4.2.0" },
     { name = "pandas", specifier = "==2.2.3" },
-    { name = "py-iam-expand", specifier = "==0.1.0" },
+    { name = "py-iam-expand", specifier = "==0.3.0" },
     { name = "py-ocsf-models", specifier = "==0.8.1" },
     { name = "pydantic", specifier = "==2.12.5" },
     { name = "pygithub", specifier = "==2.8.0" },
@@ -3470,6 +3726,12 @@ version = "7.2.2"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/aa/c6/d1ddf4abb55e93cebc4f2ed8b5d6dbad109ecb8d63748dd2b20ab5e57ebe/psutil-7.2.2.tar.gz", hash = "sha256:0746f5f8d406af344fd547f1c8daa5f5c33dbc293bb8d6a16d80b4bb88f59372", size = 493740, upload-time = "2026-01-28T18:14:54.428Z" }
 wheels = [
+    { url = "https://files.pythonhosted.org/packages/51/08/510cbdb69c25a96f4ae523f733cdc963ae654904e8db864c07585ef99875/psutil-7.2.2-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:2edccc433cbfa046b980b0df0171cd25bcaeb3a68fe9022db0979e7aa74a826b", size = 130595, upload-time = "2026-01-28T18:14:57.293Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/f5/97baea3fe7a5a9af7436301f85490905379b1c6f2dd51fe3ecf24b4c5fbf/psutil-7.2.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:e78c8603dcd9a04c7364f1a3e670cea95d51ee865e4efb3556a3a63adef958ea", size = 131082, upload-time = "2026-01-28T18:14:59.732Z" },
+    { url = "https://files.pythonhosted.org/packages/37/d6/246513fbf9fa174af531f28412297dd05241d97a75911ac8febefa1a53c6/psutil-7.2.2-cp313-cp313t-manylinux2010_x86_64.manylinux_2_12_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1a571f2330c966c62aeda00dd24620425d4b0cc86881c89861fbc04549e5dc63", size = 181476, upload-time = "2026-01-28T18:15:01.884Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/b5/9182c9af3836cca61696dabe4fd1304e17bc56cb62f17439e1154f225dd3/psutil-7.2.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:917e891983ca3c1887b4ef36447b1e0873e70c933afc831c6b6da078ba474312", size = 184062, upload-time = "2026-01-28T18:15:04.436Z" },
+    { url = "https://files.pythonhosted.org/packages/16/ba/0756dca669f5a9300d0cbcbfae9a4c30e446dfc7440ffe43ded5724bfd93/psutil-7.2.2-cp313-cp313t-win_amd64.whl", hash = "sha256:ab486563df44c17f5173621c7b198955bd6b613fb87c71c161f827d3fb149a9b", size = 139893, upload-time = "2026-01-28T18:15:06.378Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/61/8fa0e26f33623b49949346de05ec1ddaad02ed8ba64af45f40a147dbfa97/psutil-7.2.2-cp313-cp313t-win_arm64.whl", hash = "sha256:ae0aefdd8796a7737eccea863f80f81e468a1e4cf14d926bd9b6f5f2d5f90ca9", size = 135589, upload-time = "2026-01-28T18:15:08.03Z" },
     { url = "https://files.pythonhosted.org/packages/e7/36/5ee6e05c9bd427237b11b3937ad82bb8ad2752d72c6969314590dd0c2f6e/psutil-7.2.2-cp36-abi3-macosx_10_9_x86_64.whl", hash = "sha256:ed0cace939114f62738d808fdcecd4c869222507e266e574799e9c0faa17d486", size = 129090, upload-time = "2026-01-28T18:15:22.168Z" },
     { url = "https://files.pythonhosted.org/packages/80/c4/f5af4c1ca8c1eeb2e92ccca14ce8effdeec651d5ab6053c589b074eda6e1/psutil-7.2.2-cp36-abi3-macosx_11_0_arm64.whl", hash = "sha256:1a7b04c10f32cc88ab39cbf606e117fd74721c831c98a27dc04578deb0c16979", size = 129859, upload-time = "2026-01-28T18:15:23.795Z" },
     { url = "https://files.pythonhosted.org/packages/b5/70/5d8df3b09e25bce090399cf48e452d25c935ab72dad19406c77f4e828045/psutil-7.2.2-cp36-abi3-manylinux2010_x86_64.manylinux_2_12_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:076a2d2f923fd4821644f5ba89f059523da90dc9014e85f8e45a5774ca5bc6f9", size = 155560, upload-time = "2026-01-28T18:15:25.976Z" },
@@ -3482,14 +3744,14 @@ wheels = [
 
 [[package]]
 name = "py-iam-expand"
-version = "0.1.0"
+version = "0.3.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "iamdata" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/22/99/8d31a30b37825577275bb3663885b55075fba80257fcd6813b85d3aaffa8/py_iam_expand-0.1.0.tar.gz", hash = "sha256:5a2884dc267ac59a02c3a80fefc0b34c309dac681baa0f87c436067c6cf53a96", size = 10228, upload-time = "2025-04-30T07:15:35.304Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a3/08/f6e11a029b81f0bec4b7b1f18704aadf509a882cc386c90ef1ac043c18cc/py_iam_expand-0.3.0.tar.gz", hash = "sha256:4ccfe25f40ba0633a152c4f86b49cde8972ee3d4b6009b017a4310cc4b9e64c7", size = 10234, upload-time = "2026-02-24T09:47:47.772Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/79/19/482c2e0768cda7afaed07918e4fbd951e2418255fb5d1d9b35b284871716/py_iam_expand-0.1.0-py3-none-any.whl", hash = "sha256:b845ce7b50ac895b02b4f338e09c62a68ea51849794f76e189b02009bd388510", size = 12522, upload-time = "2025-04-30T07:15:33.799Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/dd/4056d0bc3d6317039d2dd2ee7cd6a5389575603e270399a8f9f20e11e721/py_iam_expand-0.3.0-py3-none-any.whl", hash = "sha256:94c0a1e9dd60316ce60ddc0cdc9a046119bde335b5bb9593ee29224857860d5a", size = 12527, upload-time = "2026-02-24T09:47:45.602Z" },
 ]
 
 [[package]]
@@ -3560,6 +3822,17 @@ version = "3.23.0"
 source = { registry = "https://pypi.org/simple" }
 sdist = { url = "https://files.pythonhosted.org/packages/c9/85/e24bf90972a30b0fcd16c73009add1d7d7cd9140c2498a68252028899e41/pycryptodomex-3.23.0.tar.gz", hash = "sha256:71909758f010c82bc99b0abf4ea12012c98962fbf0583c2164f8b84533c2e4da", size = 4922157, upload-time = "2025-05-17T17:23:41.434Z" }
 wheels = [
+    { url = "https://files.pythonhosted.org/packages/2e/00/10edb04777069a42490a38c137099d4b17ba6e36a4e6e28bdc7470e9e853/pycryptodomex-3.23.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:7b37e08e3871efe2187bc1fd9320cc81d87caf19816c648f24443483005ff886", size = 2498764, upload-time = "2025-05-17T17:22:21.453Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/3f/2872a9c2d3a27eac094f9ceaa5a8a483b774ae69018040ea3240d5b11154/pycryptodomex-3.23.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:91979028227543010d7b2ba2471cf1d1e398b3f183cb105ac584df0c36dac28d", size = 1643012, upload-time = "2025-05-17T17:22:23.702Z" },
+    { url = "https://files.pythonhosted.org/packages/70/af/774c2e2b4f6570fbf6a4972161adbb183aeeaa1863bde31e8706f123bf92/pycryptodomex-3.23.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6b8962204c47464d5c1c4038abeadd4514a133b28748bcd9fa5b6d62e3cec6fa", size = 2187643, upload-time = "2025-05-17T17:22:26.37Z" },
+    { url = "https://files.pythonhosted.org/packages/de/a3/71065b24cb889d537954cedc3ae5466af00a2cabcff8e29b73be047e9a19/pycryptodomex-3.23.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a33986a0066860f7fcf7c7bd2bc804fa90e434183645595ae7b33d01f3c91ed8", size = 2273762, upload-time = "2025-05-17T17:22:28.313Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/0b/ff6f43b7fbef4d302c8b981fe58467b8871902cdc3eb28896b52421422cc/pycryptodomex-3.23.0-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7947ab8d589e3178da3d7cdeabe14f841b391e17046954f2fbcd941705762b5", size = 2313012, upload-time = "2025-05-17T17:22:30.57Z" },
+    { url = "https://files.pythonhosted.org/packages/02/de/9d4772c0506ab6da10b41159493657105d3f8bb5c53615d19452afc6b315/pycryptodomex-3.23.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:c25e30a20e1b426e1f0fa00131c516f16e474204eee1139d1603e132acffc314", size = 2186856, upload-time = "2025-05-17T17:22:32.819Z" },
+    { url = "https://files.pythonhosted.org/packages/28/ad/8b30efcd6341707a234e5eba5493700a17852ca1ac7a75daa7945fcf6427/pycryptodomex-3.23.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:da4fa650cef02db88c2b98acc5434461e027dce0ae8c22dd5a69013eaf510006", size = 2347523, upload-time = "2025-05-17T17:22:35.386Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/02/16868e9f655b7670dbb0ac4f2844145cbc42251f916fc35c414ad2359849/pycryptodomex-3.23.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:58b851b9effd0d072d4ca2e4542bf2a4abcf13c82a29fd2c93ce27ee2a2e9462", size = 2272825, upload-time = "2025-05-17T17:22:37.632Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/18/4ca89ac737230b52ac8ffaca42f9c6f1fd07c81a6cd821e91af79db60632/pycryptodomex-3.23.0-cp313-cp313t-win32.whl", hash = "sha256:a9d446e844f08299236780f2efa9898c818fe7e02f17263866b8550c7d5fb328", size = 1772078, upload-time = "2025-05-17T17:22:40Z" },
+    { url = "https://files.pythonhosted.org/packages/73/34/13e01c322db027682e00986873eca803f11c56ade9ba5bbf3225841ea2d4/pycryptodomex-3.23.0-cp313-cp313t-win_amd64.whl", hash = "sha256:bc65bdd9fc8de7a35a74cab1c898cab391a4add33a8fe740bda00f5976ca4708", size = 1803656, upload-time = "2025-05-17T17:22:42.139Z" },
+    { url = "https://files.pythonhosted.org/packages/54/68/9504c8796b1805d58f4425002bcca20f12880e6fa4dc2fc9a668705c7a08/pycryptodomex-3.23.0-cp313-cp313t-win_arm64.whl", hash = "sha256:c885da45e70139464f082018ac527fdaad26f1657a99ee13eecdce0f0ca24ab4", size = 1707172, upload-time = "2025-05-17T17:22:44.704Z" },
     { url = "https://files.pythonhosted.org/packages/dd/9c/1a8f35daa39784ed8adf93a694e7e5dc15c23c741bbda06e1d45f8979e9e/pycryptodomex-3.23.0-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:06698f957fe1ab229a99ba2defeeae1c09af185baa909a31a5d1f9d42b1aaed6", size = 2499240, upload-time = "2025-05-17T17:22:46.953Z" },
     { url = "https://files.pythonhosted.org/packages/7a/62/f5221a191a97157d240cf6643747558759126c76ee92f29a3f4aee3197a5/pycryptodomex-3.23.0-cp37-abi3-macosx_10_9_x86_64.whl", hash = "sha256:b2c2537863eccef2d41061e82a881dcabb04944c5c06c5aa7110b577cc487545", size = 1644042, upload-time = "2025-05-17T17:22:49.098Z" },
     { url = "https://files.pythonhosted.org/packages/8c/fd/5a054543c8988d4ed7b612721d7e78a4b9bf36bc3c5ad45ef45c22d0060e/pycryptodomex-3.23.0-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:43c446e2ba8df8889e0e16f02211c25b4934898384c1ec1ec04d7889c0333587", size = 2186227, upload-time = "2025-05-17T17:22:51.139Z" },
@@ -3643,6 +3916,20 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/49/3b/774f2b5cd4192d5ab75870ce4381fd89cf218af999515baf07e7206753f0/pydantic_core-2.41.5-cp312-cp312-win32.whl", hash = "sha256:b74557b16e390ec12dca509bce9264c3bbd128f8a2c376eaa68003d7f327276d", size = 1985908, upload-time = "2025-11-04T13:40:19.309Z" },
     { url = "https://files.pythonhosted.org/packages/86/45/00173a033c801cacf67c190fef088789394feaf88a98a7035b0e40d53dc9/pydantic_core-2.41.5-cp312-cp312-win_amd64.whl", hash = "sha256:1962293292865bca8e54702b08a4f26da73adc83dd1fcf26fbc875b35d81c815", size = 2020145, upload-time = "2025-11-04T13:40:21.548Z" },
     { url = "https://files.pythonhosted.org/packages/f9/22/91fbc821fa6d261b376a3f73809f907cec5ca6025642c463d3488aad22fb/pydantic_core-2.41.5-cp312-cp312-win_arm64.whl", hash = "sha256:1746d4a3d9a794cacae06a5eaaccb4b8643a131d45fbc9af23e353dc0a5ba5c3", size = 1976179, upload-time = "2025-11-04T13:40:23.393Z" },
+    { url = "https://files.pythonhosted.org/packages/87/06/8806241ff1f70d9939f9af039c6c35f2360cf16e93c2ca76f184e76b1564/pydantic_core-2.41.5-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:941103c9be18ac8daf7b7adca8228f8ed6bb7a1849020f643b3a14d15b1924d9", size = 2120403, upload-time = "2025-11-04T13:40:25.248Z" },
+    { url = "https://files.pythonhosted.org/packages/94/02/abfa0e0bda67faa65fef1c84971c7e45928e108fe24333c81f3bfe35d5f5/pydantic_core-2.41.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:112e305c3314f40c93998e567879e887a3160bb8689ef3d2c04b6cc62c33ac34", size = 1896206, upload-time = "2025-11-04T13:40:27.099Z" },
+    { url = "https://files.pythonhosted.org/packages/15/df/a4c740c0943e93e6500f9eb23f4ca7ec9bf71b19e608ae5b579678c8d02f/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0cbaad15cb0c90aa221d43c00e77bb33c93e8d36e0bf74760cd00e732d10a6a0", size = 1919307, upload-time = "2025-11-04T13:40:29.806Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/e3/6324802931ae1d123528988e0e86587c2072ac2e5394b4bc2bc34b61ff6e/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:03ca43e12fab6023fc79d28ca6b39b05f794ad08ec2feccc59a339b02f2b3d33", size = 2063258, upload-time = "2025-11-04T13:40:33.544Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/d4/2230d7151d4957dd79c3044ea26346c148c98fbf0ee6ebd41056f2d62ab5/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:dc799088c08fa04e43144b164feb0c13f9a0bc40503f8df3e9fde58a3c0c101e", size = 2214917, upload-time = "2025-11-04T13:40:35.479Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/9f/eaac5df17a3672fef0081b6c1bb0b82b33ee89aa5cec0d7b05f52fd4a1fa/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:97aeba56665b4c3235a0e52b2c2f5ae9cd071b8a8310ad27bddb3f7fb30e9aa2", size = 2332186, upload-time = "2025-11-04T13:40:37.436Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/4e/35a80cae583a37cf15604b44240e45c05e04e86f9cfd766623149297e971/pydantic_core-2.41.5-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:406bf18d345822d6c21366031003612b9c77b3e29ffdb0f612367352aab7d586", size = 2073164, upload-time = "2025-11-04T13:40:40.289Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/e3/f6e262673c6140dd3305d144d032f7bd5f7497d3871c1428521f19f9efa2/pydantic_core-2.41.5-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:b93590ae81f7010dbe380cdeab6f515902ebcbefe0b9327cc4804d74e93ae69d", size = 2179146, upload-time = "2025-11-04T13:40:42.809Z" },
+    { url = "https://files.pythonhosted.org/packages/75/c7/20bd7fc05f0c6ea2056a4565c6f36f8968c0924f19b7d97bbfea55780e73/pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:01a3d0ab748ee531f4ea6c3e48ad9dac84ddba4b0d82291f87248f2f9de8d740", size = 2137788, upload-time = "2025-11-04T13:40:44.752Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/8d/34318ef985c45196e004bc46c6eab2eda437e744c124ef0dbe1ff2c9d06b/pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_armv7l.whl", hash = "sha256:6561e94ba9dacc9c61bce40e2d6bdc3bfaa0259d3ff36ace3b1e6901936d2e3e", size = 2340133, upload-time = "2025-11-04T13:40:46.66Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/59/013626bf8c78a5a5d9350d12e7697d3d4de951a75565496abd40ccd46bee/pydantic_core-2.41.5-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:915c3d10f81bec3a74fbd4faebe8391013ba61e5a1a8d48c4455b923bdda7858", size = 2324852, upload-time = "2025-11-04T13:40:48.575Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/d9/c248c103856f807ef70c18a4f986693a46a8ffe1602e5d361485da502d20/pydantic_core-2.41.5-cp313-cp313-win32.whl", hash = "sha256:650ae77860b45cfa6e2cdafc42618ceafab3a2d9a3811fcfbd3bbf8ac3c40d36", size = 1994679, upload-time = "2025-11-04T13:40:50.619Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/8b/341991b158ddab181cff136acd2552c9f35bd30380422a639c0671e99a91/pydantic_core-2.41.5-cp313-cp313-win_amd64.whl", hash = "sha256:79ec52ec461e99e13791ec6508c722742ad745571f234ea6255bed38c6480f11", size = 2019766, upload-time = "2025-11-04T13:40:52.631Z" },
+    { url = "https://files.pythonhosted.org/packages/73/7d/f2f9db34af103bea3e09735bb40b021788a5e834c81eedb541991badf8f5/pydantic_core-2.41.5-cp313-cp313-win_arm64.whl", hash = "sha256:3f84d5c1b4ab906093bdc1ff10484838aca54ef08de4afa9de0f5f14d69639cd", size = 1981005, upload-time = "2025-11-04T13:40:54.734Z" },
     { url = "https://files.pythonhosted.org/packages/11/72/90fda5ee3b97e51c494938a4a44c3a35a9c96c19bba12372fb9c634d6f57/pydantic_core-2.41.5-graalpy311-graalpy242_311_native-macosx_10_12_x86_64.whl", hash = "sha256:b96d5f26b05d03cc60f11a7761a5ded1741da411e7fe0909e27a5e6a0cb7b034", size = 2115441, upload-time = "2025-11-04T13:42:39.557Z" },
     { url = "https://files.pythonhosted.org/packages/1f/53/8942f884fa33f50794f119012dc6a1a02ac43a56407adaac20463df8e98f/pydantic_core-2.41.5-graalpy311-graalpy242_311_native-macosx_11_0_arm64.whl", hash = "sha256:634e8609e89ceecea15e2d61bc9ac3718caaaa71963717bf3c8f38bfde64242c", size = 1930291, upload-time = "2025-11-04T13:42:42.169Z" },
     { url = "https://files.pythonhosted.org/packages/79/c8/ecb9ed9cd942bce09fc888ee960b52654fbdbede4ba6c2d6e0d3b1d8b49c/pydantic_core-2.41.5-graalpy311-graalpy242_311_native-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:93e8740d7503eb008aa2df04d3b9735f845d43ae845e6dcd2be0b55a2da43cd2", size = 1948632, upload-time = "2025-11-04T13:42:44.564Z" },
@@ -3780,7 +4067,7 @@ version = "26.2.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/1a/51/27a5ad5f939d08f690a326ef9582cda7140555180db71695f6fb747d6a36/pyopenssl-26.2.0.tar.gz", hash = "sha256:8c6fcecd1183a7fc897548dfe388b0cdb7f37e018200d8409cf33959dbe35387", size = 182195, upload-time = "2026-05-04T23:06:09.72Z" }
 wheels = [
@@ -3899,6 +4186,9 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/e7/ab/01ea1943d4eba0f850c3c61e78e8dd59757ff815ff3ccd0a84de5f541f42/pywin32-311-cp312-cp312-win32.whl", hash = "sha256:750ec6e621af2b948540032557b10a2d43b0cee2ae9758c54154d711cc852d31", size = 8706543, upload-time = "2025-07-14T20:13:20.765Z" },
     { url = "https://files.pythonhosted.org/packages/d1/a8/a0e8d07d4d051ec7502cd58b291ec98dcc0c3fff027caad0470b72cfcc2f/pywin32-311-cp312-cp312-win_amd64.whl", hash = "sha256:b8c095edad5c211ff31c05223658e71bf7116daa0ecf3ad85f3201ea3190d067", size = 9495040, upload-time = "2025-07-14T20:13:22.543Z" },
     { url = "https://files.pythonhosted.org/packages/ba/3a/2ae996277b4b50f17d61f0603efd8253cb2d79cc7ae159468007b586396d/pywin32-311-cp312-cp312-win_arm64.whl", hash = "sha256:e286f46a9a39c4a18b319c28f59b61de793654af2f395c102b4f819e584b5852", size = 8710102, upload-time = "2025-07-14T20:13:24.682Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/be/3fd5de0979fcb3994bfee0d65ed8ca9506a8a1260651b86174f6a86f52b3/pywin32-311-cp313-cp313-win32.whl", hash = "sha256:f95ba5a847cba10dd8c4d8fefa9f2a6cf283b8b88ed6178fa8a6c1ab16054d0d", size = 8705700, upload-time = "2025-07-14T20:13:26.471Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/28/e0a1909523c6890208295a29e05c2adb2126364e289826c0a8bc7297bd5c/pywin32-311-cp313-cp313-win_amd64.whl", hash = "sha256:718a38f7e5b058e76aee1c56ddd06908116d35147e133427e59a3983f703a20d", size = 9494700, upload-time = "2025-07-14T20:13:28.243Z" },
+    { url = "https://files.pythonhosted.org/packages/04/bf/90339ac0f55726dce7d794e6d79a18a91265bdf3aa70b6b9ca52f35e022a/pywin32-311-cp313-cp313-win_arm64.whl", hash = "sha256:7b4075d959648406202d92a2310cb990fea19b535c7f4a78d3f5e10b926eeb8a", size = 8709318, upload-time = "2025-07-14T20:13:30.348Z" },
 ]
 
 [[package]]
@@ -3935,6 +4225,16 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/74/93/7baea19427dcfbe1e5a372d81473250b379f04b1bd3c4c5ff825e2327202/pyyaml-6.0.3-cp312-cp312-win32.whl", hash = "sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5", size = 137658, upload-time = "2025-09-25T21:32:20.209Z" },
     { url = "https://files.pythonhosted.org/packages/86/bf/899e81e4cce32febab4fb42bb97dcdf66bc135272882d1987881a4b519e9/pyyaml-6.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b", size = 154003, upload-time = "2025-09-25T21:32:21.167Z" },
     { url = "https://files.pythonhosted.org/packages/1a/08/67bd04656199bbb51dbed1439b7f27601dfb576fb864099c7ef0c3e55531/pyyaml-6.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd", size = 140344, upload-time = "2025-09-25T21:32:22.617Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/11/0fd08f8192109f7169db964b5707a2f1e8b745d4e239b784a5a1dd80d1db/pyyaml-6.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8", size = 181669, upload-time = "2025-09-25T21:32:23.673Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/16/95309993f1d3748cd644e02e38b75d50cbc0d9561d21f390a76242ce073f/pyyaml-6.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1", size = 173252, upload-time = "2025-09-25T21:32:25.149Z" },
+    { url = "https://files.pythonhosted.org/packages/50/31/b20f376d3f810b9b2371e72ef5adb33879b25edb7a6d072cb7ca0c486398/pyyaml-6.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c", size = 767081, upload-time = "2025-09-25T21:32:26.575Z" },
+    { url = "https://files.pythonhosted.org/packages/49/1e/a55ca81e949270d5d4432fbbd19dfea5321eda7c41a849d443dc92fd1ff7/pyyaml-6.0.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5", size = 841159, upload-time = "2025-09-25T21:32:27.727Z" },
+    { url = "https://files.pythonhosted.org/packages/74/27/e5b8f34d02d9995b80abcef563ea1f8b56d20134d8f4e5e81733b1feceb2/pyyaml-6.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6", size = 801626, upload-time = "2025-09-25T21:32:28.878Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/11/ba845c23988798f40e52ba45f34849aa8a1f2d4af4b798588010792ebad6/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6", size = 753613, upload-time = "2025-09-25T21:32:30.178Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/e0/7966e1a7bfc0a45bf0a7fb6b98ea03fc9b8d84fa7f2229e9659680b69ee3/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be", size = 794115, upload-time = "2025-09-25T21:32:31.353Z" },
+    { url = "https://files.pythonhosted.org/packages/de/94/980b50a6531b3019e45ddeada0626d45fa85cbe22300844a7983285bed3b/pyyaml-6.0.3-cp313-cp313-win32.whl", hash = "sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26", size = 137427, upload-time = "2025-09-25T21:32:32.58Z" },
+    { url = "https://files.pythonhosted.org/packages/97/c9/39d5b874e8b28845e4ec2202b5da735d0199dbe5b8fb85f91398814a9a46/pyyaml-6.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c", size = 154090, upload-time = "2025-09-25T21:32:33.659Z" },
+    { url = "https://files.pythonhosted.org/packages/73/e8/2bdf3ca2090f68bb3d75b44da7bbc71843b19c9f2b9cb9b0f4ab7a5a4329/pyyaml-6.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb", size = 140246, upload-time = "2025-09-25T21:32:34.663Z" },
 ]
 
 [[package]]
@@ -3944,7 +4244,7 @@ source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "attrs" },
     { name = "rpds-py" },
-    { name = "typing-extensions" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/2f/db/98b5c277be99dd18bfd91dd04e1b759cad18d1a338188c936e92f921c7e2/referencing-0.36.2.tar.gz", hash = "sha256:df2e89862cd09deabbdba16944cc3f10feb6b3e6f18e902f7cc25609a34775aa", size = 74744, upload-time = "2025-01-25T08:48:16.138Z" }
 wheels = [
@@ -4006,6 +4306,38 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c3/1c/bdcc98f9a4af4fdd166c74941174619ccff4726d3ce32faa8e9a2ecd38dd/regex-2026.5.9-cp312-cp312-win32.whl", hash = "sha256:164eba9b755ea6f244b0d881196fbc1fac09714e9782c9e2732b813142033c8e", size = 266699, upload-time = "2026-05-09T23:12:59.14Z" },
     { url = "https://files.pythonhosted.org/packages/78/87/240d36864f9e48ace85f72e79ced97ceb7f27ce87739a947dcb834b4e6bc/regex-2026.5.9-cp312-cp312-win_amd64.whl", hash = "sha256:86f40a5d6444db30a125c9c9177e6b25dad981cbc37451fd838f145e6edac92e", size = 277783, upload-time = "2026-05-09T23:13:00.789Z" },
     { url = "https://files.pythonhosted.org/packages/4f/b5/7b30f312b0669dff5beebe5b0989dc2d1a312b1a44fab852199c387a5b96/regex-2026.5.9-cp312-cp312-win_arm64.whl", hash = "sha256:96f5f58b54a063d7ea9dca08e1cf57bfe10499c4d579ee672da284f57f5f0070", size = 270513, upload-time = "2026-05-09T23:13:02.426Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/da/797e91ecec6f84135da778ddce78c20e0af5d2a15c26f87a81bc3eadb6db/regex-2026.5.9-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:d626b84406444b165fc0ba981604edea39f0588ff1f92baa23fe50799ea9afdb", size = 490303, upload-time = "2026-05-09T23:13:04.382Z" },
+    { url = "https://files.pythonhosted.org/packages/44/da/bf30abaaa737b58f4a4b8c4a03659e02fd92092c822e0197ed9e0daab917/regex-2026.5.9-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:d7bdc0ab8f3dd7e1b4f9ab88634e13374669db86bb3c72e8292f07ae313f539f", size = 292019, upload-time = "2026-05-09T23:13:06.022Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/e7/d0eaf5713828417b9e5648cf81fa9bacd4961f6ab98c380c2034f8716e35/regex-2026.5.9-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a8820737949116ffff55fe18f9fc644530063ba6ebfcb8314239416e78f1347c", size = 289468, upload-time = "2026-05-09T23:13:08.214Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/9b/b3fdd62b003baa1a9b593cd8c8699c9651c2e80cc21a5c715707983c42d7/regex-2026.5.9-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:aa0fbdbac82cb3e4450d0ccde7d7a35607f4cb2dd9fba4b8b69bfaf8c9fa6aed", size = 796749, upload-time = "2026-05-09T23:13:10.573Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/30/66ab84588765f5b4b271a9ca09ef7ce2b87caa95176ec3d2ad65d7bc4902/regex-2026.5.9-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:57e8915c7986aa33d25e4d3629cef711cd2863f2961b10409f0c04cb8b7d9020", size = 865445, upload-time = "2026-05-09T23:13:12.523Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/89/f05169e8588aac365f35ffc7f3bc3184f095ef4cfded7cfaa3c7fd5dbd89/regex-2026.5.9-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:508f56a89ba9cb26e4168cbc37dbd60a28d82430a9e18ad1d25fe0883c314ca2", size = 912322, upload-time = "2026-05-09T23:13:14.281Z" },
+    { url = "https://files.pythonhosted.org/packages/30/e1/c93444052cf41581f3c884ab3fb5823daf0992f11cd4388d4275ca610558/regex-2026.5.9-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b6d189041f15691cfa2b6c4290448ec221244d225b3f5fe9e7771b34ffcdf6e2", size = 801269, upload-time = "2026-05-09T23:13:16.569Z" },
+    { url = "https://files.pythonhosted.org/packages/50/fe/0cf96b882f540e62e8b9956599798203d599c44cf4c77917ca27400ff69b/regex-2026.5.9-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e82db382b44d0111b22601c509c89f64434816c9e0eef9d1989cda8cc6ff1c04", size = 777085, upload-time = "2026-05-09T23:13:18.675Z" },
+    { url = "https://files.pythonhosted.org/packages/23/5c/d78d4924e7fc875557b9e9b768423925fdfaac5549d06da7810019a9bd26/regex-2026.5.9-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:2acfb48634f64996b57f90f39afa692ff362162722581921fe92239a59960f3c", size = 785153, upload-time = "2026-05-09T23:13:20.525Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/e0/5214774090e7b4524dcea3e3c4aa74141d43043f8beb49c1599db1c8b53a/regex-2026.5.9-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:d29eebfc9525db68cad3c97eedd7f754fa265aa5cd0cf4f863b2421e1b48fc9f", size = 860164, upload-time = "2026-05-09T23:13:22.263Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/e1/4a57a83350319b1271f0d7a249b8672513ed928b237a741631270de6caea/regex-2026.5.9-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:debb893095e944091c16e641a6e33c1b0f4cb61ab945ec5afbf53ce7068834d8", size = 765731, upload-time = "2026-05-09T23:13:24.277Z" },
+    { url = "https://files.pythonhosted.org/packages/12/f4/499e74a20c156fc75836ee04a72a38d1a063978f600937f9760467beb1b0/regex-2026.5.9-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:d659eee77986549c9ea45b861c7567e44d6287c3dc9a4565478853f7b9fe2ff6", size = 852062, upload-time = "2026-05-09T23:13:26.125Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/92/7eebc0d0a01e78629695f342ba17e0deaff8fb45e79cc0d7b98287da6e3e/regex-2026.5.9-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2efa205e6d98b24d1f3ab395c11aa15cdf10935bca283d0285e0499c284fba21", size = 789577, upload-time = "2026-05-09T23:13:27.814Z" },
+    { url = "https://files.pythonhosted.org/packages/05/a4/018e71f7d2ad48c1ebe6d3ae0026f9b7cb4802fd15c7cc02fdf724355102/regex-2026.5.9-cp313-cp313-win32.whl", hash = "sha256:f3844f134e834076677dd369976e9f5068679fcb8e50102fdf6b7ac96a3ec127", size = 266691, upload-time = "2026-05-09T23:13:29.549Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/1d/861a93719fb9ee7dbfc3761b3797b7a3e112a5d42c6129459d2d741be9b5/regex-2026.5.9-cp313-cp313-win_amd64.whl", hash = "sha256:3527bb4942d2c14552155406cdedd906567456821848aed1cb4933a391bf5eca", size = 277747, upload-time = "2026-05-09T23:13:31.859Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/c6/0a2436ae4da1ba76e51cb98943c6838a9a721faa40ebe2dce07694ae34e3/regex-2026.5.9-cp313-cp313-win_arm64.whl", hash = "sha256:56a33f191f17d8c417f99945ebdc1e691d3af9605d86ec68c7e54a57e3e17af6", size = 270500, upload-time = "2026-05-09T23:13:33.525Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/e9/d21346f7b60ed58789371358ed66b09d00f832e1bd7c06e55d9da5679882/regex-2026.5.9-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:01f28d868834624c934b8d2e0aa1c8341337e37831f4a012f18a5afcba4cbaf3", size = 494172, upload-time = "2026-05-09T23:13:35.935Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/43/fd1177a2032037c681baecdb3422ee4e1424aec4e4f470ef47793d325274/regex-2026.5.9-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:48036f6374aaa79eb3b754ec29c61d1c6b1606749d705a13f8854fa2539671f6", size = 293952, upload-time = "2026-05-09T23:13:38.307Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/7d/9fbf919768368d3f8a4f6c692cf2aa61e482b2b81ec6a298ace4cbf02480/regex-2026.5.9-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:b96350aa424e79d4fd6b567b344dcbe2b2d6bfc48dfe7717587e1fa6d43da6ff", size = 292314, upload-time = "2026-05-09T23:13:40.353Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/6c/e41bfeecb589716843e7c4df09ba46ff2a42961457afece19059d85caeef/regex-2026.5.9-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8f3af7a4903c5c04a11a196a5aa75cdd7dd3f8508132f9fb3259d9f5908e3b88", size = 811681, upload-time = "2026-05-09T23:13:42.543Z" },
+    { url = "https://files.pythonhosted.org/packages/87/83/a5c1c525fba0aa656e88ad0face0b1829788ef4c2fb6b26df58aa1151b84/regex-2026.5.9-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7e87577720152d2caae19fe2baaf1f8d5ca12091e9e229f03915c37d1e4b9178", size = 871135, upload-time = "2026-05-09T23:13:44.326Z" },
+    { url = "https://files.pythonhosted.org/packages/18/d4/80882e799e440dd878b0979cbebf8fa4d54624a332c83037c7a701649e3f/regex-2026.5.9-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c8b9b9d294cfea3cd19c718ade7cc93492b2c4991abd9a68d0b3477ae6d8e100", size = 917265, upload-time = "2026-05-09T23:13:47.295Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/ff/8db60211e2286e396aad7dc7725356c502bff0901ea05bd6cdc2e1a042b9/regex-2026.5.9-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:728d8bfd28a8845c8b6bc5dc7ce010453d206396786c0765c2740cb65f37791e", size = 816311, upload-time = "2026-05-09T23:13:49.885Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/47/742ef579c61730f8d268e5cf1f9ce0e37e2ea041ad0f5644724f2378e463/regex-2026.5.9-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7e30b874d341fac767d7df5a0870540541c2c054b80cfaac116e8d367a8a7ff2", size = 785498, upload-time = "2026-05-09T23:13:52.25Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/ab/cb0999802dcb0fb95b1ab005e8d4163d8afdd67efc2cb6b6630ac13f8cb1/regex-2026.5.9-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:fd190e88a895a8901325fad284a3f74ea52b1da8525b76cc811fa9b1edf0ce2b", size = 801348, upload-time = "2026-05-09T23:13:54.127Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/62/8ca59a24c55bc34d166eefaf3717bd77772f329fdbf984d86581e0a3571c/regex-2026.5.9-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:8e76e8161ad00694cfce6767d5dea860c6391ac5b83e5c3a39661e696f11fc7e", size = 866493, upload-time = "2026-05-09T23:13:56.067Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/3d/30f2ae62cef3278bb5bb821f467277a55fb73f01032cf85997e15e8289a8/regex-2026.5.9-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:ddda5340e6c01a293027dd46232fa79eaff1b48058ce7a98f572b6445b088041", size = 772811, upload-time = "2026-05-09T23:13:57.867Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/ae/7d2089bcd78ad0c0161bc684339df50032acb438a7bd3305e7ddb1193cec/regex-2026.5.9-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:205109e96b3cf5adf8f4cd62bedde9487feb282b9497a3535451e5a24cd706a0", size = 856584, upload-time = "2026-05-09T23:13:59.679Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/29/92ff47f75990131ea4f24ba17819e5a9d141e10819807e09addd73409af6/regex-2026.5.9-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:dfbe4579b9f08036aa7d101d1835437a20783574ac66327e6b29b4018a138081", size = 803453, upload-time = "2026-05-09T23:14:01.978Z" },
+    { url = "https://files.pythonhosted.org/packages/04/99/eff29f1037dcab36702c9ee5d6858cf1ce2336ea8ea2987f64245b99ea5e/regex-2026.5.9-cp313-cp313t-win32.whl", hash = "sha256:ed2c9e8068b614c574d8d30e543d617cf5379b0535d46f97ef00e904745a08b5", size = 269951, upload-time = "2026-05-09T23:14:03.661Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/9d/8870b8981d27b22cda77bb26a5ac7ebfa9c7d9e0dea195a834a82380e748/regex-2026.5.9-cp313-cp313t-win_amd64.whl", hash = "sha256:b46b0f094dc1d3b90356c85a0bd2c9bafc4a6a190b9d6f8ddd5a033b6e088ed4", size = 281240, upload-time = "2026-05-09T23:14:05.56Z" },
+    { url = "https://files.pythonhosted.org/packages/72/b1/3379415e8f135c13ac551353397cc4fe97b4978f3cac73c5fcbcded548b8/regex-2026.5.9-cp313-cp313t-win_arm64.whl", hash = "sha256:872acc074bd29ffc9913ecdfedf6ea77502312ca44a4aa0d3779089c6069d8de", size = 272383, upload-time = "2026-05-09T23:14:07.843Z" },
 ]
 
 [[package]]
@@ -4155,6 +4487,35 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/6f/ab/d5d5e3bcedb0a77f4f613706b750e50a5a3ba1c15ccd3665ecc636c968fd/rpds_py-0.30.0-cp312-cp312-win32.whl", hash = "sha256:1ab5b83dbcf55acc8b08fc62b796ef672c457b17dbd7820a11d6c52c06839bdf", size = 223782, upload-time = "2025-11-30T20:22:37.271Z" },
     { url = "https://files.pythonhosted.org/packages/39/3b/f786af9957306fdc38a74cef405b7b93180f481fb48453a114bb6465744a/rpds_py-0.30.0-cp312-cp312-win_amd64.whl", hash = "sha256:a090322ca841abd453d43456ac34db46e8b05fd9b3b4ac0c78bcde8b089f959b", size = 240463, upload-time = "2025-11-30T20:22:39.021Z" },
     { url = "https://files.pythonhosted.org/packages/f3/d2/b91dc748126c1559042cfe41990deb92c4ee3e2b415f6b5234969ffaf0cc/rpds_py-0.30.0-cp312-cp312-win_arm64.whl", hash = "sha256:669b1805bd639dd2989b281be2cfd951c6121b65e729d9b843e9639ef1fd555e", size = 230868, upload-time = "2025-11-30T20:22:40.493Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/dc/d61221eb88ff410de3c49143407f6f3147acf2538c86f2ab7ce65ae7d5f9/rpds_py-0.30.0-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:f83424d738204d9770830d35290ff3273fbb02b41f919870479fab14b9d303b2", size = 374887, upload-time = "2025-11-30T20:22:41.812Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/32/55fb50ae104061dbc564ef15cc43c013dc4a9f4527a1f4d99baddf56fe5f/rpds_py-0.30.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e7536cd91353c5273434b4e003cbda89034d67e7710eab8761fd918ec6c69cf8", size = 358904, upload-time = "2025-11-30T20:22:43.479Z" },
+    { url = "https://files.pythonhosted.org/packages/58/70/faed8186300e3b9bdd138d0273109784eea2396c68458ed580f885dfe7ad/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:2771c6c15973347f50fece41fc447c054b7ac2ae0502388ce3b6738cd366e3d4", size = 389945, upload-time = "2025-11-30T20:22:44.819Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/a8/073cac3ed2c6387df38f71296d002ab43496a96b92c823e76f46b8af0543/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:0a59119fc6e3f460315fe9d08149f8102aa322299deaa5cab5b40092345c2136", size = 407783, upload-time = "2025-11-30T20:22:46.103Z" },
+    { url = "https://files.pythonhosted.org/packages/77/57/5999eb8c58671f1c11eba084115e77a8899d6e694d2a18f69f0ba471ec8b/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:76fec018282b4ead0364022e3c54b60bf368b9d926877957a8624b58419169b7", size = 515021, upload-time = "2025-11-30T20:22:47.458Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/af/5ab4833eadc36c0a8ed2bc5c0de0493c04f6c06de223170bd0798ff98ced/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:692bef75a5525db97318e8cd061542b5a79812d711ea03dbc1f6f8dbb0c5f0d2", size = 414589, upload-time = "2025-11-30T20:22:48.872Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/de/f7192e12b21b9e9a68a6d0f249b4af3fdcdff8418be0767a627564afa1f1/rpds_py-0.30.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9027da1ce107104c50c81383cae773ef5c24d296dd11c99e2629dbd7967a20c6", size = 394025, upload-time = "2025-11-30T20:22:50.196Z" },
+    { url = "https://files.pythonhosted.org/packages/91/c4/fc70cd0249496493500e7cc2de87504f5aa6509de1e88623431fec76d4b6/rpds_py-0.30.0-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:9cf69cdda1f5968a30a359aba2f7f9aa648a9ce4b580d6826437f2b291cfc86e", size = 408895, upload-time = "2025-11-30T20:22:51.87Z" },
+    { url = "https://files.pythonhosted.org/packages/58/95/d9275b05ab96556fefff73a385813eb66032e4c99f411d0795372d9abcea/rpds_py-0.30.0-cp313-cp313-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:a4796a717bf12b9da9d3ad002519a86063dcac8988b030e405704ef7d74d2d9d", size = 422799, upload-time = "2025-11-30T20:22:53.341Z" },
+    { url = "https://files.pythonhosted.org/packages/06/c1/3088fc04b6624eb12a57eb814f0d4997a44b0d208d6cace713033ff1a6ba/rpds_py-0.30.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:5d4c2aa7c50ad4728a094ebd5eb46c452e9cb7edbfdb18f9e1221f597a73e1e7", size = 572731, upload-time = "2025-11-30T20:22:54.778Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/42/c612a833183b39774e8ac8fecae81263a68b9583ee343db33ab571a7ce55/rpds_py-0.30.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:ba81a9203d07805435eb06f536d95a266c21e5b2dfbf6517748ca40c98d19e31", size = 599027, upload-time = "2025-11-30T20:22:56.212Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/60/525a50f45b01d70005403ae0e25f43c0384369ad24ffe46e8d9068b50086/rpds_py-0.30.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:945dccface01af02675628334f7cf49c2af4c1c904748efc5cf7bbdf0b579f95", size = 563020, upload-time = "2025-11-30T20:22:58.2Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/5d/47c4655e9bcd5ca907148535c10e7d489044243cc9941c16ed7cd53be91d/rpds_py-0.30.0-cp313-cp313-win32.whl", hash = "sha256:b40fb160a2db369a194cb27943582b38f79fc4887291417685f3ad693c5a1d5d", size = 223139, upload-time = "2025-11-30T20:23:00.209Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/e1/485132437d20aa4d3e1d8b3fb5a5e65aa8139f1e097080c2a8443201742c/rpds_py-0.30.0-cp313-cp313-win_amd64.whl", hash = "sha256:806f36b1b605e2d6a72716f321f20036b9489d29c51c91f4dd29a3e3afb73b15", size = 240224, upload-time = "2025-11-30T20:23:02.008Z" },
+    { url = "https://files.pythonhosted.org/packages/24/95/ffd128ed1146a153d928617b0ef673960130be0009c77d8fbf0abe306713/rpds_py-0.30.0-cp313-cp313-win_arm64.whl", hash = "sha256:d96c2086587c7c30d44f31f42eae4eac89b60dabbac18c7669be3700f13c3ce1", size = 230645, upload-time = "2025-11-30T20:23:03.43Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/1b/b10de890a0def2a319a2626334a7f0ae388215eb60914dbac8a3bae54435/rpds_py-0.30.0-cp313-cp313t-macosx_10_12_x86_64.whl", hash = "sha256:eb0b93f2e5c2189ee831ee43f156ed34e2a89a78a66b98cadad955972548be5a", size = 364443, upload-time = "2025-11-30T20:23:04.878Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/bf/27e39f5971dc4f305a4fb9c672ca06f290f7c4e261c568f3dea16a410d47/rpds_py-0.30.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:922e10f31f303c7c920da8981051ff6d8c1a56207dbdf330d9047f6d30b70e5e", size = 353375, upload-time = "2025-11-30T20:23:06.342Z" },
+    { url = "https://files.pythonhosted.org/packages/40/58/442ada3bba6e8e6615fc00483135c14a7538d2ffac30e2d933ccf6852232/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cdc62c8286ba9bf7f47befdcea13ea0e26bf294bda99758fd90535cbaf408000", size = 383850, upload-time = "2025-11-30T20:23:07.825Z" },
+    { url = "https://files.pythonhosted.org/packages/14/14/f59b0127409a33c6ef6f5c1ebd5ad8e32d7861c9c7adfa9a624fc3889f6c/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:47f9a91efc418b54fb8190a6b4aa7813a23fb79c51f4bb84e418f5476c38b8db", size = 392812, upload-time = "2025-11-30T20:23:09.228Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/66/e0be3e162ac299b3a22527e8913767d869e6cc75c46bd844aa43fb81ab62/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1f3587eb9b17f3789ad50824084fa6f81921bbf9a795826570bda82cb3ed91f2", size = 517841, upload-time = "2025-11-30T20:23:11.186Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/55/fa3b9cf31d0c963ecf1ba777f7cf4b2a2c976795ac430d24a1f43d25a6ba/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:39c02563fc592411c2c61d26b6c5fe1e51eaa44a75aa2c8735ca88b0d9599daa", size = 408149, upload-time = "2025-11-30T20:23:12.864Z" },
+    { url = "https://files.pythonhosted.org/packages/60/ca/780cf3b1a32b18c0f05c441958d3758f02544f1d613abf9488cd78876378/rpds_py-0.30.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:51a1234d8febafdfd33a42d97da7a43f5dcb120c1060e352a3fbc0c6d36e2083", size = 383843, upload-time = "2025-11-30T20:23:14.638Z" },
+    { url = "https://files.pythonhosted.org/packages/82/86/d5f2e04f2aa6247c613da0c1dd87fcd08fa17107e858193566048a1e2f0a/rpds_py-0.30.0-cp313-cp313t-manylinux_2_31_riscv64.whl", hash = "sha256:eb2c4071ab598733724c08221091e8d80e89064cd472819285a9ab0f24bcedb9", size = 396507, upload-time = "2025-11-30T20:23:16.105Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/9a/453255d2f769fe44e07ea9785c8347edaf867f7026872e76c1ad9f7bed92/rpds_py-0.30.0-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:6bdfdb946967d816e6adf9a3d8201bfad269c67efe6cefd7093ef959683c8de0", size = 414949, upload-time = "2025-11-30T20:23:17.539Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/31/622a86cdc0c45d6df0e9ccb6becdba5074735e7033c20e401a6d9d0e2ca0/rpds_py-0.30.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:c77afbd5f5250bf27bf516c7c4a016813eb2d3e116139aed0096940c5982da94", size = 565790, upload-time = "2025-11-30T20:23:19.029Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/5d/15bbf0fb4a3f58a3b1c67855ec1efcc4ceaef4e86644665fff03e1b66d8d/rpds_py-0.30.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:61046904275472a76c8c90c9ccee9013d70a6d0f73eecefd38c1ae7c39045a08", size = 590217, upload-time = "2025-11-30T20:23:20.885Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/61/21b8c41f68e60c8cc3b2e25644f0e3681926020f11d06ab0b78e3c6bbff1/rpds_py-0.30.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:4c5f36a861bc4b7da6516dbdf302c55313afa09b81931e8280361a4f6c9a2d27", size = 555806, upload-time = "2025-11-30T20:23:22.488Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/39/7e067bb06c31de48de3eb200f9fc7c58982a4d3db44b07e73963e10d3be9/rpds_py-0.30.0-cp313-cp313t-win32.whl", hash = "sha256:3d4a69de7a3e50ffc214ae16d79d8fbb0922972da0356dcf4d0fdca2878559c6", size = 211341, upload-time = "2025-11-30T20:23:24.449Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/4d/222ef0b46443cf4cf46764d9c630f3fe4abaa7245be9417e56e9f52b8f65/rpds_py-0.30.0-cp313-cp313t-win_amd64.whl", hash = "sha256:f14fc5df50a716f7ece6a80b6c78bb35ea2ca47c499e422aa4463455dd96d56d", size = 225768, upload-time = "2025-11-30T20:23:25.908Z" },
     { url = "https://files.pythonhosted.org/packages/69/71/3f34339ee70521864411f8b6992e7ab13ac30d8e4e3309e07c7361767d91/rpds_py-0.30.0-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:c2262bdba0ad4fc6fb5545660673925c2d2a5d9e2e0fb603aad545427be0fc58", size = 372292, upload-time = "2025-11-30T20:24:16.537Z" },
     { url = "https://files.pythonhosted.org/packages/57/09/f183df9b8f2d66720d2ef71075c59f7e1b336bec7ee4c48f0a2b06857653/rpds_py-0.30.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:ee6af14263f25eedc3bb918a3c04245106a42dfd4f5c2285ea6f997b1fc3f89a", size = 362128, upload-time = "2025-11-30T20:24:18.086Z" },
     { url = "https://files.pythonhosted.org/packages/7a/68/5c2594e937253457342e078f0cc1ded3dd7b2ad59afdbf2d354869110a02/rpds_py-0.30.0-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3adbb8179ce342d235c31ab8ec511e66c73faa27a47e076ccc92421add53e2bb", size = 391542, upload-time = "2025-11-30T20:24:20.092Z" },
@@ -4408,6 +4769,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d6/2f/4a3c322f22c5c66c4b836ec58211641a4067364f5dcdd7b974b4c5da300c/tomli-2.4.1-cp312-cp312-win32.whl", hash = "sha256:da25dc3563bff5965356133435b757a795a17b17d01dbc0f42fb32447ddfd917", size = 98141, upload-time = "2026-03-25T20:21:28.492Z" },
     { url = "https://files.pythonhosted.org/packages/24/22/4daacd05391b92c55759d55eaee21e1dfaea86ce5c571f10083360adf534/tomli-2.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:52c8ef851d9a240f11a88c003eacb03c31fc1c9c4ec64a99a0f922b93874fda9", size = 108847, upload-time = "2026-03-25T20:21:29.386Z" },
     { url = "https://files.pythonhosted.org/packages/68/fd/70e768887666ddd9e9f5d85129e84910f2db2796f9096aa02b721a53098d/tomli-2.4.1-cp312-cp312-win_arm64.whl", hash = "sha256:f758f1b9299d059cc3f6546ae2af89670cb1c4d48ea29c3cacc4fe7de3058257", size = 95088, upload-time = "2026-03-25T20:21:30.677Z" },
+    { url = "https://files.pythonhosted.org/packages/07/06/b823a7e818c756d9a7123ba2cda7d07bc2dd32835648d1a7b7b7a05d848d/tomli-2.4.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:36d2bd2ad5fb9eaddba5226aa02c8ec3fa4f192631e347b3ed28186d43be6b54", size = 155866, upload-time = "2026-03-25T20:21:31.65Z" },
+    { url = "https://files.pythonhosted.org/packages/14/6f/12645cf7f08e1a20c7eb8c297c6f11d31c1b50f316a7e7e1e1de6e2e7b7e/tomli-2.4.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:eb0dc4e38e6a1fd579e5d50369aa2e10acfc9cace504579b2faabb478e76941a", size = 149887, upload-time = "2026-03-25T20:21:33.028Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/e0/90637574e5e7212c09099c67ad349b04ec4d6020324539297b634a0192b0/tomli-2.4.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c7f2c7f2b9ca6bdeef8f0fa897f8e05085923eb091721675170254cbc5b02897", size = 243704, upload-time = "2026-03-25T20:21:34.51Z" },
+    { url = "https://files.pythonhosted.org/packages/10/8f/d3ddb16c5a4befdf31a23307f72828686ab2096f068eaf56631e136c1fdd/tomli-2.4.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f3c6818a1a86dd6dca7ddcaaf76947d5ba31aecc28cb1b67009a5877c9a64f3f", size = 251628, upload-time = "2026-03-25T20:21:36.012Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/f1/dbeeb9116715abee2485bf0a12d07a8f31af94d71608c171c45f64c0469d/tomli-2.4.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d312ef37c91508b0ab2cee7da26ec0b3ed2f03ce12bd87a588d771ae15dcf82d", size = 247180, upload-time = "2026-03-25T20:21:37.136Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/74/16336ffd19ed4da28a70959f92f506233bd7cfc2332b20bdb01591e8b1d1/tomli-2.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:51529d40e3ca50046d7606fa99ce3956a617f9b36380da3b7f0dd3dd28e68cb5", size = 251674, upload-time = "2026-03-25T20:21:38.298Z" },
+    { url = "https://files.pythonhosted.org/packages/16/f9/229fa3434c590ddf6c0aa9af64d3af4b752540686cace29e6281e3458469/tomli-2.4.1-cp313-cp313-win32.whl", hash = "sha256:2190f2e9dd7508d2a90ded5ed369255980a1bcdd58e52f7fe24b8162bf9fedbd", size = 97976, upload-time = "2026-03-25T20:21:39.316Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/1e/71dfd96bcc1c775420cb8befe7a9d35f2e5b1309798f009dca17b7708c1e/tomli-2.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:8d65a2fbf9d2f8352685bc1364177ee3923d6baf5e7f43ea4959d7d8bc326a36", size = 108755, upload-time = "2026-03-25T20:21:40.248Z" },
+    { url = "https://files.pythonhosted.org/packages/83/7a/d34f422a021d62420b78f5c538e5b102f62bea616d1d75a13f0a88acb04a/tomli-2.4.1-cp313-cp313-win_arm64.whl", hash = "sha256:4b605484e43cdc43f0954ddae319fb75f04cc10dd80d830540060ee7cd0243cd", size = 95265, upload-time = "2026-03-25T20:21:41.219Z" },
     { url = "https://files.pythonhosted.org/packages/7b/61/cceae43728b7de99d9b847560c262873a1f6c98202171fd5ed62640b494b/tomli-2.4.1-py3-none-any.whl", hash = "sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe", size = 14583, upload-time = "2026-03-25T20:22:03.012Z" },
 ]
 
@@ -4561,6 +4931,28 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ec/9f/b750b3692ed2ef4705cb305bd68858e73010492b80e43d2a4faa5573cbe7/wrapt-2.1.2-cp312-cp312-win32.whl", hash = "sha256:eba8155747eb2cae4a0b913d9ebd12a1db4d860fc4c829d7578c7b989bd3f2f0", size = 58198, upload-time = "2026-03-06T02:53:37.732Z" },
     { url = "https://files.pythonhosted.org/packages/8e/b2/feecfe29f28483d888d76a48f03c4c4d8afea944dbee2b0cd3380f9df032/wrapt-2.1.2-cp312-cp312-win_amd64.whl", hash = "sha256:1c51c738d7d9faa0b3601708e7e2eda9bf779e1b601dce6c77411f2a1b324a63", size = 60441, upload-time = "2026-03-06T02:52:47.138Z" },
     { url = "https://files.pythonhosted.org/packages/44/e1/e328f605d6e208547ea9fd120804fcdec68536ac748987a68c47c606eea8/wrapt-2.1.2-cp312-cp312-win_arm64.whl", hash = "sha256:c8e46ae8e4032792eb2f677dbd0d557170a8e5524d22acc55199f43efedd39bf", size = 58836, upload-time = "2026-03-06T02:53:22.053Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/7a/d936840735c828b38d26a854e85d5338894cda544cb7a85a9d5b8b9c4df7/wrapt-2.1.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:787fd6f4d67befa6fe2abdffcbd3de2d82dfc6fb8a6d850407c53332709d030b", size = 61259, upload-time = "2026-03-06T02:53:41.922Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/88/9a9b9a90ac8ca11c2fdb6a286cb3a1fc7dd774c00ed70929a6434f6bc634/wrapt-2.1.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:4bdf26e03e6d0da3f0e9422fd36bcebf7bc0eeb55fdf9c727a09abc6b9fe472e", size = 61851, upload-time = "2026-03-06T02:52:48.672Z" },
+    { url = "https://files.pythonhosted.org/packages/03/a9/5b7d6a16fd6533fed2756900fc8fc923f678179aea62ada6d65c92718c00/wrapt-2.1.2-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:bbac24d879aa22998e87f6b3f481a5216311e7d53c7db87f189a7a0266dafffb", size = 121446, upload-time = "2026-03-06T02:54:14.013Z" },
+    { url = "https://files.pythonhosted.org/packages/45/bb/34c443690c847835cfe9f892be78c533d4f32366ad2888972c094a897e39/wrapt-2.1.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:16997dfb9d67addc2e3f41b62a104341e80cac52f91110dece393923c0ebd5ca", size = 123056, upload-time = "2026-03-06T02:54:10.829Z" },
+    { url = "https://files.pythonhosted.org/packages/93/b9/ff205f391cb708f67f41ea148545f2b53ff543a7ac293b30d178af4d2271/wrapt-2.1.2-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:162e4e2ba7542da9027821cb6e7c5e068d64f9a10b5f15512ea28e954893a267", size = 117359, upload-time = "2026-03-06T02:53:03.623Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/3d/1ea04d7747825119c3c9a5e0874a40b33594ada92e5649347c457d982805/wrapt-2.1.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f29c827a8d9936ac320746747a016c4bc66ef639f5cd0d32df24f5eacbf9c69f", size = 121479, upload-time = "2026-03-06T02:53:45.844Z" },
+    { url = "https://files.pythonhosted.org/packages/78/cc/ee3a011920c7a023b25e8df26f306b2484a531ab84ca5c96260a73de76c0/wrapt-2.1.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:a9dd9813825f7ecb018c17fd147a01845eb330254dff86d3b5816f20f4d6aaf8", size = 116271, upload-time = "2026-03-06T02:54:46.356Z" },
+    { url = "https://files.pythonhosted.org/packages/98/fd/e5ff7ded41b76d802cf1191288473e850d24ba2e39a6ec540f21ae3b57cb/wrapt-2.1.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:6f8dbdd3719e534860d6a78526aafc220e0241f981367018c2875178cf83a413", size = 120573, upload-time = "2026-03-06T02:52:50.163Z" },
+    { url = "https://files.pythonhosted.org/packages/47/c5/242cae3b5b080cd09bacef0591691ba1879739050cc7c801ff35c8886b66/wrapt-2.1.2-cp313-cp313-win32.whl", hash = "sha256:5c35b5d82b16a3bc6e0a04349b606a0582bc29f573786aebe98e0c159bc48db6", size = 58205, upload-time = "2026-03-06T02:53:47.494Z" },
+    { url = "https://files.pythonhosted.org/packages/12/69/c358c61e7a50f290958809b3c61ebe8b3838ea3e070d7aac9814f95a0528/wrapt-2.1.2-cp313-cp313-win_amd64.whl", hash = "sha256:f8bc1c264d8d1cf5b3560a87bbdd31131573eb25f9f9447bb6252b8d4c44a3a1", size = 60452, upload-time = "2026-03-06T02:53:30.038Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/66/c8a6fcfe321295fd8c0ab1bd685b5a01462a9b3aa2f597254462fc2bc975/wrapt-2.1.2-cp313-cp313-win_arm64.whl", hash = "sha256:3beb22f674550d5634642c645aba4c72a2c66fb185ae1aebe1e955fae5a13baf", size = 58842, upload-time = "2026-03-06T02:52:52.114Z" },
+    { url = "https://files.pythonhosted.org/packages/da/55/9c7052c349106e0b3f17ae8db4b23a691a963c334de7f9dbd60f8f74a831/wrapt-2.1.2-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:0fc04bc8664a8bc4c8e00b37b5355cffca2535209fba1abb09ae2b7c76ddf82b", size = 63075, upload-time = "2026-03-06T02:53:19.108Z" },
+    { url = "https://files.pythonhosted.org/packages/09/a8/ce7b4006f7218248dd71b7b2b732d0710845a0e49213b18faef64811ffef/wrapt-2.1.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:a9b9d50c9af998875a1482a038eb05755dfd6fe303a313f6a940bb53a83c3f18", size = 63719, upload-time = "2026-03-06T02:54:33.452Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/e5/2ca472e80b9e2b7a17f106bb8f9df1db11e62101652ce210f66935c6af67/wrapt-2.1.2-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:2d3ff4f0024dd224290c0eabf0240f1bfc1f26363431505fb1b0283d3b08f11d", size = 152643, upload-time = "2026-03-06T02:52:42.721Z" },
+    { url = "https://files.pythonhosted.org/packages/36/42/30f0f2cefca9d9cbf6835f544d825064570203c3e70aa873d8ae12e23791/wrapt-2.1.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3278c471f4468ad544a691b31bb856374fbdefb7fee1a152153e64019379f015", size = 158805, upload-time = "2026-03-06T02:54:25.441Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/67/d08672f801f604889dcf58f1a0b424fe3808860ede9e03affc1876b295af/wrapt-2.1.2-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a8914c754d3134a3032601c6984db1c576e6abaf3fc68094bb8ab1379d75ff92", size = 145990, upload-time = "2026-03-06T02:53:57.456Z" },
+    { url = "https://files.pythonhosted.org/packages/68/a7/fd371b02e73babec1de6ade596e8cd9691051058cfdadbfd62a5898f3295/wrapt-2.1.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:ff95d4264e55839be37bafe1536db2ab2de19da6b65f9244f01f332b5286cfbf", size = 155670, upload-time = "2026-03-06T02:54:55.309Z" },
+    { url = "https://files.pythonhosted.org/packages/86/2d/9fe0095dfdb621009f40117dcebf41d7396c2c22dca6eac779f4c007b86c/wrapt-2.1.2-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:76405518ca4e1b76fbb1b9f686cff93aebae03920cc55ceeec48ff9f719c5f67", size = 144357, upload-time = "2026-03-06T02:54:24.092Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/b6/ec7b4a254abbe4cde9fa15c5d2cca4518f6b07d0f1b77d4ee9655e30280e/wrapt-2.1.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:c0be8b5a74c5824e9359b53e7e58bef71a729bacc82e16587db1c4ebc91f7c5a", size = 150269, upload-time = "2026-03-06T02:53:31.268Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/6b/2fabe8ebf148f4ee3c782aae86a795cc68ffe7d432ef550f234025ce0cfa/wrapt-2.1.2-cp313-cp313t-win32.whl", hash = "sha256:f01277d9a5fc1862f26f7626da9cf443bebc0abd2f303f41c5e995b15887dabd", size = 59894, upload-time = "2026-03-06T02:54:15.391Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/fb/9ba66fc2dedc936de5f8073c0217b5d4484e966d87723415cc8262c5d9c2/wrapt-2.1.2-cp313-cp313t-win_amd64.whl", hash = "sha256:84ce8f1c2104d2f6daa912b1b5b039f331febfeee74f8042ad4e04992bd95c8f", size = 63197, upload-time = "2026-03-06T02:54:41.943Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/1c/012d7423c95d0e337117723eb8ecf73c622ce15a97847e84cf3f8f26cd7e/wrapt-2.1.2-cp313-cp313t-win_arm64.whl", hash = "sha256:a93cd767e37faeddbe07d8fc4212d5cba660af59bdb0f6372c93faaa13e6e679", size = 60363, upload-time = "2026-03-06T02:54:48.093Z" },
     { url = "https://files.pythonhosted.org/packages/1a/c7/8528ac2dfa2c1e6708f647df7ae144ead13f0a31146f43c7264b4942bf12/wrapt-2.1.2-py3-none-any.whl", hash = "sha256:b8fd6fa2b2c4e7621808f8c62e8317f4aae56e59721ad933bac5239d913cf0e8", size = 43993, upload-time = "2026-03-06T02:53:12.905Z" },
 ]
 
@@ -4647,6 +5039,42 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/69/7f/cd5ef733f2550de6241bd8bd8c3febc78158b9d75f197d9c7baa113436af/yarl-1.23.0-cp312-cp312-win32.whl", hash = "sha256:fffc45637bcd6538de8b85f51e3df3223e4ad89bccbfca0481c08c7fc8b7ed7d", size = 82359, upload-time = "2026-03-01T22:05:36.811Z" },
     { url = "https://files.pythonhosted.org/packages/f5/be/25216a49daeeb7af2bec0db22d5e7df08ed1d7c9f65d78b14f3b74fd72fc/yarl-1.23.0-cp312-cp312-win_amd64.whl", hash = "sha256:f69f57305656a4852f2a7203efc661d8c042e6cc67f7acd97d8667fb448a426e", size = 87674, upload-time = "2026-03-01T22:05:38.171Z" },
     { url = "https://files.pythonhosted.org/packages/d2/35/aeab955d6c425b227d5b7247eafb24f2653fedc32f95373a001af5dfeb9e/yarl-1.23.0-cp312-cp312-win_arm64.whl", hash = "sha256:6e87a6e8735b44816e7db0b2fbc9686932df473c826b0d9743148432e10bb9b9", size = 81879, upload-time = "2026-03-01T22:05:40.006Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/4b/a0a6e5d0ee8a2f3a373ddef8a4097d74ac901ac363eea1440464ccbe0898/yarl-1.23.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:16c6994ac35c3e74fb0ae93323bf8b9c2a9088d55946109489667c510a7d010e", size = 123796, upload-time = "2026-03-01T22:05:41.412Z" },
+    { url = "https://files.pythonhosted.org/packages/67/b6/8925d68af039b835ae876db5838e82e76ec87b9782ecc97e192b809c4831/yarl-1.23.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4a42e651629dafb64fd5b0286a3580613702b5809ad3f24934ea87595804f2c5", size = 86547, upload-time = "2026-03-01T22:05:42.841Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/50/06d511cc4b8e0360d3c94af051a768e84b755c5eb031b12adaaab6dec6e5/yarl-1.23.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:7c6b9461a2a8b47c65eef63bb1c76a4f1c119618ffa99ea79bc5bb1e46c5821b", size = 85854, upload-time = "2026-03-01T22:05:44.85Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/f4/4e30b250927ffdab4db70da08b9b8d2194d7c7b400167b8fbeca1e4701ca/yarl-1.23.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2569b67d616eab450d262ca7cb9f9e19d2f718c70a8b88712859359d0ab17035", size = 98351, upload-time = "2026-03-01T22:05:46.836Z" },
+    { url = "https://files.pythonhosted.org/packages/86/fc/4118c5671ea948208bdb1492d8b76bdf1453d3e73df051f939f563e7dcc5/yarl-1.23.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e9d9a4d06d3481eab79803beb4d9bd6f6a8e781ec078ac70d7ef2dcc29d1bea5", size = 92711, upload-time = "2026-03-01T22:05:48.316Z" },
+    { url = "https://files.pythonhosted.org/packages/56/11/1ed91d42bd9e73c13dc9e7eb0dd92298d75e7ac4dd7f046ad0c472e231cd/yarl-1.23.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f514f6474e04179d3d33175ed3f3e31434d3130d42ec153540d5b157deefd735", size = 106014, upload-time = "2026-03-01T22:05:50.028Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/c9/74e44e056a23fbc33aca71779ef450ca648a5bc472bdad7a82339918f818/yarl-1.23.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:fda207c815b253e34f7e1909840fd14299567b1c0eb4908f8c2ce01a41265401", size = 105557, upload-time = "2026-03-01T22:05:51.416Z" },
+    { url = "https://files.pythonhosted.org/packages/66/fe/b1e10b08d287f518994f1e2ff9b6d26f0adeecd8dd7d533b01bab29a3eda/yarl-1.23.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:34b6cf500e61c90f305094911f9acc9c86da1a05a7a3f5be9f68817043f486e4", size = 101559, upload-time = "2026-03-01T22:05:52.872Z" },
+    { url = "https://files.pythonhosted.org/packages/72/59/c5b8d94b14e3d3c2a9c20cb100119fd534ab5a14b93673ab4cc4a4141ea5/yarl-1.23.0-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:d7504f2b476d21653e4d143f44a175f7f751cd41233525312696c76aa3dbb23f", size = 100502, upload-time = "2026-03-01T22:05:54.954Z" },
+    { url = "https://files.pythonhosted.org/packages/77/4f/96976cb54cbfc5c9fd73ed4c51804f92f209481d1fb190981c0f8a07a1d7/yarl-1.23.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:578110dd426f0d209d1509244e6d4a3f1a3e9077655d98c5f22583d63252a08a", size = 98027, upload-time = "2026-03-01T22:05:56.409Z" },
+    { url = "https://files.pythonhosted.org/packages/63/6e/904c4f476471afdbad6b7e5b70362fb5810e35cd7466529a97322b6f5556/yarl-1.23.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:609d3614d78d74ebe35f54953c5bbd2ac647a7ddb9c30a5d877580f5e86b22f2", size = 95369, upload-time = "2026-03-01T22:05:58.141Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/40/acfcdb3b5f9d68ef499e39e04d25e141fe90661f9d54114556cf83be8353/yarl-1.23.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:4966242ec68afc74c122f8459abd597afd7d8a60dc93d695c1334c5fd25f762f", size = 105565, upload-time = "2026-03-01T22:06:00.286Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/c6/31e28f3a6ba2869c43d124f37ea5260cac9c9281df803c354b31f4dd1f3c/yarl-1.23.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:e0fd068364a6759bc794459f0a735ab151d11304346332489c7972bacbe9e72b", size = 99813, upload-time = "2026-03-01T22:06:01.712Z" },
+    { url = "https://files.pythonhosted.org/packages/08/1f/6f65f59e72d54aa467119b63fc0b0b1762eff0232db1f4720cd89e2f4a17/yarl-1.23.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:39004f0ad156da43e86aa71f44e033de68a44e5a31fc53507b36dd253970054a", size = 105632, upload-time = "2026-03-01T22:06:03.188Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/c4/18b178a69935f9e7a338127d5b77d868fdc0f0e49becd286d51b3a18c61d/yarl-1.23.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:e5723c01a56c5028c807c701aa66722916d2747ad737a046853f6c46f4875543", size = 101895, upload-time = "2026-03-01T22:06:04.651Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/54/f5b870b5505663911dba950a8e4776a0dbd51c9c54c0ae88e823e4b874a0/yarl-1.23.0-cp313-cp313-win32.whl", hash = "sha256:1b6b572edd95b4fa8df75de10b04bc81acc87c1c7d16bcdd2035b09d30acc957", size = 82356, upload-time = "2026-03-01T22:06:06.04Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/84/266e8da36879c6edcd37b02b547e2d9ecdfea776be49598e75696e3316e1/yarl-1.23.0-cp313-cp313-win_amd64.whl", hash = "sha256:baaf55442359053c7d62f6f8413a62adba3205119bcb6f49594894d8be47e5e3", size = 87515, upload-time = "2026-03-01T22:06:08.107Z" },
+    { url = "https://files.pythonhosted.org/packages/00/fd/7e1c66efad35e1649114fa13f17485f62881ad58edeeb7f49f8c5e748bf9/yarl-1.23.0-cp313-cp313-win_arm64.whl", hash = "sha256:fb4948814a2a98e3912505f09c9e7493b1506226afb1f881825368d6fb776ee3", size = 81785, upload-time = "2026-03-01T22:06:10.181Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/fc/119dd07004f17ea43bb91e3ece6587759edd7519d6b086d16bfbd3319982/yarl-1.23.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:aecfed0b41aa72b7881712c65cf764e39ce2ec352324f5e0837c7048d9e6daaa", size = 130719, upload-time = "2026-03-01T22:06:11.708Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/0d/9f2348502fbb3af409e8f47730282cd6bc80dec6630c1e06374d882d6eb2/yarl-1.23.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:a41bcf68efd19073376eb8cf948b8d9be0af26256403e512bb18f3966f1f9120", size = 89690, upload-time = "2026-03-01T22:06:13.429Z" },
+    { url = "https://files.pythonhosted.org/packages/50/93/e88f3c80971b42cfc83f50a51b9d165a1dbf154b97005f2994a79f212a07/yarl-1.23.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:cde9a2ecd91668bcb7f077c4966d8ceddb60af01b52e6e3e2680e4cf00ad1a59", size = 89851, upload-time = "2026-03-01T22:06:15.53Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/07/61c9dd8ba8f86473263b4036f70fb594c09e99c0d9737a799dfd8bc85651/yarl-1.23.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5023346c4ee7992febc0068e7593de5fa2bf611848c08404b35ebbb76b1b0512", size = 95874, upload-time = "2026-03-01T22:06:17.553Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/e9/f9ff8ceefba599eac6abddcfb0b3bee9b9e636e96dbf54342a8577252379/yarl-1.23.0-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:d1009abedb49ae95b136a8904a3f71b342f849ffeced2d3747bf29caeda218c4", size = 88710, upload-time = "2026-03-01T22:06:19.004Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/78/0231bfcc5d4c8eec220bc2f9ef82cb4566192ea867a7c5b4148f44f6cbcd/yarl-1.23.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a8d00f29b42f534cc8aa3931cfe773b13b23e561e10d2b26f27a8d309b0e82a1", size = 101033, upload-time = "2026-03-01T22:06:21.203Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/9b/30ea5239a61786f18fd25797151a17fbb3be176977187a48d541b5447dd4/yarl-1.23.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:95451e6ce06c3e104556d73b559f5da6c34a069b6b62946d3ad66afcd51642ea", size = 100817, upload-time = "2026-03-01T22:06:22.738Z" },
+    { url = "https://files.pythonhosted.org/packages/62/e2/a4980481071791bc83bce2b7a1a1f7adcabfa366007518b4b845e92eeee3/yarl-1.23.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:531ef597132086b6cf96faa7c6c1dcd0361dd5f1694e5cc30375907b9b7d3ea9", size = 97482, upload-time = "2026-03-01T22:06:24.21Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/1e/304a00cf5f6100414c4b5a01fc7ff9ee724b62158a08df2f8170dfc72a2d/yarl-1.23.0-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:88f9fb0116fbfcefcab70f85cf4b74a2b6ce5d199c41345296f49d974ddb4123", size = 95949, upload-time = "2026-03-01T22:06:25.697Z" },
+    { url = "https://files.pythonhosted.org/packages/68/03/093f4055ed4cae649ac53bca3d180bd37102e9e11d048588e9ab0c0108d0/yarl-1.23.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:e7b0460976dc75cb87ad9cc1f9899a4b97751e7d4e77ab840fc9b6d377b8fd24", size = 95839, upload-time = "2026-03-01T22:06:27.309Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/28/4c75ebb108f322aa8f917ae10a8ffa4f07cae10a8a627b64e578617df6a0/yarl-1.23.0-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:115136c4a426f9da976187d238e84139ff6b51a20839aa6e3720cd1026d768de", size = 90696, upload-time = "2026-03-01T22:06:29.048Z" },
+    { url = "https://files.pythonhosted.org/packages/23/9c/42c2e2dd91c1a570402f51bdf066bfdb1241c2240ba001967bad778e77b7/yarl-1.23.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:ead11956716a940c1abc816b7df3fa2b84d06eaed8832ca32f5c5e058c65506b", size = 100865, upload-time = "2026-03-01T22:06:30.525Z" },
+    { url = "https://files.pythonhosted.org/packages/74/05/1bcd60a8a0a914d462c305137246b6f9d167628d73568505fce3f1cb2e65/yarl-1.23.0-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:fe8f8f5e70e6dbdfca9882cd9deaac058729bcf323cf7a58660901e55c9c94f6", size = 96234, upload-time = "2026-03-01T22:06:32.692Z" },
+    { url = "https://files.pythonhosted.org/packages/90/b2/f52381aac396d6778ce516b7bc149c79e65bfc068b5de2857ab69eeea3b7/yarl-1.23.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:a0e317df055958a0c1e79e5d2aa5a5eaa4a6d05a20d4b0c9c3f48918139c9fc6", size = 100295, upload-time = "2026-03-01T22:06:34.268Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/e8/638bae5bbf1113a659b2435d8895474598afe38b4a837103764f603aba56/yarl-1.23.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:6f0fd84de0c957b2d280143522c4f91a73aada1923caee763e24a2b3fda9f8a5", size = 97784, upload-time = "2026-03-01T22:06:35.864Z" },
+    { url = "https://files.pythonhosted.org/packages/80/25/a3892b46182c586c202629fc2159aa13975d3741d52ebd7347fd501d48d5/yarl-1.23.0-cp313-cp313t-win32.whl", hash = "sha256:93a784271881035ab4406a172edb0faecb6e7d00f4b53dc2f55919d6c9688595", size = 88313, upload-time = "2026-03-01T22:06:37.39Z" },
+    { url = "https://files.pythonhosted.org/packages/43/68/8c5b36aa5178900b37387937bc2c2fe0e9505537f713495472dcf6f6fccc/yarl-1.23.0-cp313-cp313t-win_amd64.whl", hash = "sha256:dd00607bffbf30250fe108065f07453ec124dbf223420f57f5e749b04295e090", size = 94932, upload-time = "2026-03-01T22:06:39.579Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/cc/d79ba8292f51f81f4dc533a8ccfb9fc6992cabf0998ed3245de7589dc07c/yarl-1.23.0-cp313-cp313t-win_arm64.whl", hash = "sha256:ac09d42f48f80c9ee1635b2fcaa819496a44502737660d3c0f2ade7526d29144", size = 84786, upload-time = "2026-03-01T22:06:41.988Z" },
     { url = "https://files.pythonhosted.org/packages/69/68/c8739671f5699c7dc470580a4f821ef37c32c4cb0b047ce223a7f115757f/yarl-1.23.0-py3-none-any.whl", hash = "sha256:a2df6afe50dea8ae15fa34c9f824a3ee958d785fd5d089063d960bae1daa0a3f", size = 48288, upload-time = "2026-03-01T22:07:51.388Z" },
 ]
 
@@ -4702,6 +5130,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/bb/43/3a16ff0a8c913bb9825379db1bd533c75c57c2d2f31dd9111aa9b53711f4/zstd-1.5.7.3-cp312-cp312-win32.whl", hash = "sha256:cbf48c53461e224ffc2490cfe5120a1ff40d14c84d2b512c6d6d99fc91685cf3", size = 150367, upload-time = "2026-01-08T17:03:40.178Z" },
     { url = "https://files.pythonhosted.org/packages/46/83/b85875d7428e63dfa9247e41d17fac611443c774f7892f8643bd4164a6b2/zstd-1.5.7.3-cp312-cp312-win_amd64.whl", hash = "sha256:943a189910f2fea997462e3e4d7fbf727a06d231ef801ebee557b1c87568981c", size = 167604, upload-time = "2026-01-08T17:03:41.355Z" },
     { url = "https://files.pythonhosted.org/packages/37/42/cf291e26804de2f55500cdac93f5e9fa6267cf315def8aa402529bae3a87/zstd-1.5.7.3-cp312-cp312-win_arm64.whl", hash = "sha256:85c4d508f8109afa7c51c4960626c3325af2cf1e442c6c36ebfea15d04757e3f", size = 157241, upload-time = "2026-01-08T16:47:34.615Z" },
+    { url = "https://files.pythonhosted.org/packages/21/7c/f2fe6e09b9d064873ebd384f2692b9fcad3d8e9412298dfb09a935aec77d/zstd-1.5.7.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:b2455e56f1d265dacbd450510b8c2f632a5d8d92c23282e7723fb04af37001a2", size = 268133, upload-time = "2026-01-08T17:31:54.616Z" },
+    { url = "https://files.pythonhosted.org/packages/14/8d/0a1e49844ed82c7ab0f66dce5e0dd822742fc7e9d04f147032db33740840/zstd-1.5.7.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3486dc4f1b4e52bb059f8eec1f31daa3e540062c0f522f221782cf132a8bc9a8", size = 231005, upload-time = "2026-01-08T17:31:55.885Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/24/0ab682096da2411f83236a10c89423f26859a65431660e460e2d637b5628/zstd-1.5.7.3-cp313-cp313-manylinux_2_14_i686.whl", hash = "sha256:1cb47bf10ffcb6a782edacfe758da2c94879f7e89c6628feb3f1254daf8cc596", size = 300230, upload-time = "2026-01-08T16:30:52.654Z" },
+    { url = "https://files.pythonhosted.org/packages/36/2e/3ff0d28ea8d6b9bd931af7477fad082b99633cb7901cdd657dcb7ecfee11/zstd-1.5.7.3-cp313-cp313-manylinux_2_14_x86_64.whl", hash = "sha256:07b1378d1230ddeea8773f99d7518a3060e6468c76edd502057cb795fe278d7e", size = 297097, upload-time = "2026-01-08T16:49:41.211Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/ef/25c15570fb6b06a4a03bd054afa2d084df687ac10e336b703139acc77182/zstd-1.5.7.3-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1ee34317f013e3405108f5baea53502159809cfc4510598d614257525500c70d", size = 2162274, upload-time = "2026-01-08T17:35:24.464Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/24/fd16ba9e9be877a2194f05462ae77dcb62c8f90c4ecc186d9ee71e9bdc9f/zstd-1.5.7.3-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c19127ca2c79855376a34a2d7a6969408094b25c1f44485b0373eba4be851b98", size = 2201877, upload-time = "2026-01-08T17:35:28.596Z" },
+    { url = "https://files.pythonhosted.org/packages/85/ef/73c37a81ac36429bb1bbb69c8ac43f3a154cfab739dce6424d28f95301c3/zstd-1.5.7.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:2e79cae70dd08cb247391312463085c624c0302e8c860d13f87f4c76502d8202", size = 2096535, upload-time = "2026-01-08T17:35:30.001Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/1f/859a8049634e444feb6855347d5e558c1280d87b0bc6385f13cd3d95dbe6/zstd-1.5.7.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:0e83e91e5daf89037c737f5529da0f80da80a78a6ad0b1d70a09860eb267dea4", size = 2125473, upload-time = "2026-01-08T17:35:26.596Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/5c/e7b8aa8eea46f032891ecef187f1d469e20f9ddf0d10607e9523b3d306a1/zstd-1.5.7.3-cp313-cp313-win32.whl", hash = "sha256:2283f3bb910c028e1b9fe76b834016012ab021025a0ea197e27a1333f85e3031", size = 150370, upload-time = "2026-01-08T17:18:12.899Z" },
+    { url = "https://files.pythonhosted.org/packages/50/2b/ba558ff87ba7f6c29e3a9b1c3b3e95338146aee7250b10807229d412a9c4/zstd-1.5.7.3-cp313-cp313-win_amd64.whl", hash = "sha256:3ad5fe4c36bab5dfa5a4b8d050bd07c50c1e69f94d381bc65337ab14cd69e5b1", size = 167602, upload-time = "2026-01-08T17:18:13.858Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/7d/4a5c9813fafad2949d42deee3857d7ecc8caf369bbf82a88b60519200083/zstd-1.5.7.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e878172b0eb69ac2edc6576eb862e00747c7c25e638fb354630a1ea7cfddf49", size = 157239, upload-time = "2026-01-08T16:42:28.885Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/67/5fcec6bbf8aab4aeb26e3cbe8cc9fa2f323dd143d066e313b134b8c28dc8/zstd-1.5.7.3-cp313-cp313t-manylinux_2_14_x86_64.whl", hash = "sha256:7e0a7e94d5b63b4cacf2396079ca9584d11f49f87cb4e5aa21f126a8f6b83446", size = 297302, upload-time = "2026-01-08T16:36:49.027Z" },
     { url = "https://files.pythonhosted.org/packages/64/ad/f6588943c9fde34a28f1b0448a8ac824b2ebe341f7af56ff035d0489338d/zstd-1.5.7.3-pp310-pypy310_pp73-macosx_10_15_x86_64.whl", hash = "sha256:2b9ec4d5ba8c170d3fdf21ae5da3c15eaea2beef9c419a5f3274a6f9e03c412a", size = 260091, upload-time = "2026-01-08T17:14:18.143Z" },
     { url = "https://files.pythonhosted.org/packages/7a/6a/6d2d3b9b7bad0124c684b7b77621ee6bdc3fc220a580f002014cf0a8f558/zstd-1.5.7.3-pp310-pypy310_pp73-macosx_11_0_arm64.whl", hash = "sha256:a7ab69fc4d90eeb64b98a567751f8e48373f4bcf301597fca344b8e8342e1d5e", size = 221149, upload-time = "2026-01-08T17:14:17.168Z" },
     { url = "https://files.pythonhosted.org/packages/90/8d/ad4d3c24293c70d8ae9c80e06b2da2922048933f9a00f35d18df5166346a/zstd-1.5.7.3-pp310-pypy310_pp73-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:da70f0918bf739bc75d7770410c9b94ea0dcb6f02d7ef70598b464bd5fcb193a", size = 326792, upload-time = "2026-01-08T17:12:35.38Z" },

From 383d2b218fa14f4d6ca7b5a02d8baf62bb24e706 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Mon, 15 Jun 2026 11:15:22 +0200
Subject: [PATCH 031/126] chore: configure vulture to ignore known false
 positives (#11583)

---
 pyproject.toml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pyproject.toml b/pyproject.toml
index 26c8237b95..ed4c9f31fb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -364,3 +364,13 @@ constraint-dependencies = [
   "zstd==1.5.7.3"
 ]
 override-dependencies = ["okta==3.4.2"]
+
+[tool.vulture]
+# Suppress known false positives. The CI command only passes --exclude and
+# --min-confidence on the CLI, so ignore_names from here still applies (vulture
+# only overrides the keys set on the CLI).
+# - mock_* : pytest fixtures injected as test params but unused in the body
+# (e.g. mock_sensitive_args in tests/lib/cli/redact_test.py)
+# - view   : DRF BasePermission.has_object_permission(self, request, view, obj)
+# framework-required signature param in skills/django-drf template assets
+ignore_names = ["mock_*", "view"]

From 9465b827479568354468c9fc623d5e00e0d5f535 Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Mon, 15 Jun 2026 11:27:09 +0200
Subject: [PATCH 032/126] docs(sdk): reflect Python 3.13 support (#11585)

---
 docs/getting-started/installation/prowler-cli.mdx | 12 ++++++------
 docs/user-guide/cookbooks/cicd-pipeline.mdx       |  4 ++--
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/docs/getting-started/installation/prowler-cli.mdx b/docs/getting-started/installation/prowler-cli.mdx
index f87653dcfe..eae3d54ab1 100644
--- a/docs/getting-started/installation/prowler-cli.mdx
+++ b/docs/getting-started/installation/prowler-cli.mdx
@@ -4,7 +4,7 @@ title: 'Installation'
 
 ## Installation
 
-To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler is available as a project in [PyPI](https://pypi.org/project/prowler/):
+To install Prowler as a Python package, use `Python >= 3.10, <= 3.13`. Prowler is available as a project in [PyPI](https://pypi.org/project/prowler/):
 
 <Tabs>
   <Tab title="pipx">
@@ -12,7 +12,7 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
 
     _Requirements_:
 
-    * `Python >= 3.10, <= 3.12`
+    * `Python >= 3.10, <= 3.13`
     * `pipx` installed: [pipx installation](https://pipx.pypa.io/stable/installation/).
     * AWS, GCP, Azure and/or Kubernetes credentials
 
@@ -30,7 +30,7 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
 
     _Requirements_:
 
-    * `Python >= 3.10, <= 3.12`
+    * `Python >= 3.10, <= 3.13`
     * `Python pip >= 21.0.0`
     * AWS, GCP, Azure, M365 and/or Kubernetes credentials
 
@@ -81,7 +81,7 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
   <Tab title="Amazon Linux 2">
     _Requirements_:
 
-    * `Python >= 3.10, <= 3.12`
+    * `Python >= 3.10, <= 3.13`
     * AWS, GCP, Azure and/or Kubernetes credentials
 
     _Commands_:
@@ -96,8 +96,8 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
   <Tab title="Ubuntu">
     _Requirements_:
 
-    * `Ubuntu 23.04` or above. For older Ubuntu versions, check [pipx installation](https://docs.prowler.com/projects/prowler-open-source/en/latest/#__tabbed_1_1) and ensure `Python >= 3.10, <= 3.12` is installed.
-    * `Python >= 3.10, <= 3.12`
+    * `Ubuntu 23.04` or above. For older Ubuntu versions, check [pipx installation](https://docs.prowler.com/projects/prowler-open-source/en/latest/#__tabbed_1_1) and ensure `Python >= 3.10, <= 3.13` is installed.
+    * `Python >= 3.10, <= 3.13`
     * AWS, GCP, Azure and/or Kubernetes credentials
 
     _Commands_:
diff --git a/docs/user-guide/cookbooks/cicd-pipeline.mdx b/docs/user-guide/cookbooks/cicd-pipeline.mdx
index a88513d901..11295b1f29 100644
--- a/docs/user-guide/cookbooks/cicd-pipeline.mdx
+++ b/docs/user-guide/cookbooks/cicd-pipeline.mdx
@@ -127,7 +127,7 @@ Add the following to `.gitlab-ci.yml`:
 
 ```yaml
 prowler-scan:
-  image: python:3.12-slim
+  image: python:3.13-slim
   stage: test
   script:
     - pip install prowler
@@ -154,7 +154,7 @@ stages:
   - security
 
 .prowler-base:
-  image: python:3.12-slim
+  image: python:3.13-slim
   stage: security
   before_script:
     - pip install prowler

From 6db8ce672c17fc241f020eb7194a7dbdf4929879 Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Mon, 15 Jun 2026 11:50:08 +0200
Subject: [PATCH 033/126] fix(ui): patch vulnerable dependencies (#11581)

Co-authored-by: Pepe Fagoaga <pepe@prowler.com>
---
 ui/CHANGELOG.md        |    8 +
 ui/Dockerfile          |    4 +-
 ui/dependency-log.json |   48 +-
 ui/package.json        |   16 +-
 ui/pnpm-lock.yaml      | 4584 ++++++++++++++++++++--------------------
 ui/pnpm-workspace.yaml |   14 +-
 6 files changed, 2339 insertions(+), 2335 deletions(-)

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index a7a7f75774..ede3aedff4 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to the **Prowler UI** are documented in this file.
 
+## [1.31.0] (Prowler UNRELEASED)
+
+### 🔐 Security
+
+- Bump vulnerable `Next.js`, React, AI SDK, `postcss`, `hono`, `qs`, `esbuild`, and Alpine OpenSSL packages (`libcrypto3` and `libssl3`) [(#11581)](https://github.com/prowler-cloud/prowler/pull/11581)
+
+---
+
 ## [1.30.1] (Prowler v5.30.1)
 
 ### 🐞 Fixed
diff --git a/ui/Dockerfile b/ui/Dockerfile
index 047df1171b..f7ec32c55e 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -3,8 +3,8 @@ FROM node:24.13.0-alpine@sha256:cd6fb7efa6490f039f3471a189214d5f548c11df1ff9e5b1
 
 LABEL maintainer="https://github.com/prowler-cloud"
 
-# Enable corepack for pnpm
-RUN corepack enable
+# Patch Alpine OpenSSL runtime packages before all stages inherit the base image.
+RUN apk upgrade --no-cache libcrypto3 libssl3 && corepack enable
 
 # Install dependencies only when needed
 FROM base AS deps
diff --git a/ui/dependency-log.json b/ui/dependency-log.json
index 76af7f296a..fd6317898e 100644
--- a/ui/dependency-log.json
+++ b/ui/dependency-log.json
@@ -2,10 +2,10 @@
   {
     "section": "dependencies",
     "name": "@ai-sdk/react",
-    "from": "2.0.106",
-    "to": "2.0.111",
+    "from": "2.0.111",
+    "to": "3.0.207",
     "strategy": "installed",
-    "generatedAt": "2025-12-15T08:24:46.195Z"
+    "generatedAt": "2026-06-15T07:44:51.977Z"
   },
   {
     "section": "dependencies",
@@ -114,10 +114,10 @@
   {
     "section": "dependencies",
     "name": "@next/third-parties",
-    "from": "16.2.3",
-    "to": "16.2.6",
+    "from": "16.2.6",
+    "to": "16.2.9",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:09:04.901Z"
+    "generatedAt": "2026-06-15T07:49:41.143Z"
   },
   {
     "section": "dependencies",
@@ -362,10 +362,10 @@
   {
     "section": "dependencies",
     "name": "ai",
-    "from": "5.0.59",
-    "to": "5.0.109",
+    "from": "5.0.109",
+    "to": "6.0.205",
     "strategy": "installed",
-    "generatedAt": "2025-12-15T08:24:46.195Z"
+    "generatedAt": "2026-06-15T07:44:51.977Z"
   },
   {
     "section": "dependencies",
@@ -482,10 +482,10 @@
   {
     "section": "dependencies",
     "name": "next",
-    "from": "16.2.3",
-    "to": "16.2.6",
+    "from": "16.2.6",
+    "to": "16.2.9",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:09:04.901Z"
+    "generatedAt": "2026-06-15T07:49:41.143Z"
   },
   {
     "section": "dependencies",
@@ -506,10 +506,10 @@
   {
     "section": "dependencies",
     "name": "react",
-    "from": "19.2.5",
-    "to": "19.2.6",
+    "from": "19.2.6",
+    "to": "19.2.7",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:34:34.526Z"
+    "generatedAt": "2026-06-15T07:53:01.462Z"
   },
   {
     "section": "dependencies",
@@ -522,10 +522,10 @@
   {
     "section": "dependencies",
     "name": "react-dom",
-    "from": "19.2.5",
-    "to": "19.2.6",
+    "from": "19.2.6",
+    "to": "19.2.7",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:34:34.526Z"
+    "generatedAt": "2026-06-15T07:53:01.462Z"
   },
   {
     "section": "dependencies",
@@ -658,10 +658,10 @@
   {
     "section": "devDependencies",
     "name": "@next/eslint-plugin-next",
-    "from": "16.2.3",
-    "to": "16.2.6",
+    "from": "16.2.6",
+    "to": "16.2.9",
     "strategy": "installed",
-    "generatedAt": "2026-05-14T10:09:04.901Z"
+    "generatedAt": "2026-06-15T07:49:41.143Z"
   },
   {
     "section": "devDependencies",
@@ -722,10 +722,10 @@
   {
     "section": "devDependencies",
     "name": "@types/react",
-    "from": "19.1.13",
-    "to": "19.2.8",
+    "from": "19.2.8",
+    "to": "19.2.17",
     "strategy": "installed",
-    "generatedAt": "2026-01-19T13:54:24.770Z"
+    "generatedAt": "2026-06-15T07:53:01.462Z"
   },
   {
     "section": "devDependencies",
diff --git a/ui/package.json b/ui/package.json
index a5c34094b0..1c3709e9b4 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -34,7 +34,7 @@
     "typecheck": "tsc"
   },
   "dependencies": {
-    "@ai-sdk/react": "2.0.111",
+    "@ai-sdk/react": "3.0.205",
     "@aws-sdk/client-bedrock-runtime": "3.1045.0",
     "@codemirror/language": "6.12.2",
     "@codemirror/state": "6.6.0",
@@ -48,7 +48,7 @@
     "@langchain/mcp-adapters": "1.1.3",
     "@langchain/openai": "1.4.5",
     "@lezer/highlight": "1.2.3",
-    "@next/third-parties": "16.2.6",
+    "@next/third-parties": "16.2.9",
     "@radix-ui/react-alert-dialog": "1.1.14",
     "@radix-ui/react-avatar": "1.1.11",
     "@radix-ui/react-checkbox": "1.3.3",
@@ -79,7 +79,7 @@
     "@types/js-yaml": "4.0.9",
     "@uiw/react-codemirror": "4.25.8",
     "@xyflow/react": "12.10.2",
-    "ai": "5.0.109",
+    "ai": "6.0.203",
     "class-variance-authority": "0.7.1",
     "clsx": "2.1.1",
     "cmdk": "1.1.1",
@@ -94,12 +94,12 @@
     "marked": "15.0.12",
     "modern-screenshot": "4.7.0",
     "nanoid": "5.1.6",
-    "next": "16.2.6",
+    "next": "16.2.9",
     "next-auth": "5.0.0-beta.30",
     "next-themes": "0.2.1",
-    "react": "19.2.6",
+    "react": "19.2.7",
     "react-day-picker": "9.13.0",
-    "react-dom": "19.2.6",
+    "react-dom": "19.2.7",
     "react-hook-form": "7.62.0",
     "react-markdown": "10.1.0",
     "recharts": "2.15.4",
@@ -118,7 +118,7 @@
   },
   "devDependencies": {
     "@iconify/react": "5.2.1",
-    "@next/eslint-plugin-next": "16.2.6",
+    "@next/eslint-plugin-next": "16.2.9",
     "@playwright/test": "1.56.1",
     "@testing-library/jest-dom": "6.9.1",
     "@testing-library/react": "16.3.2",
@@ -126,7 +126,7 @@
     "@types/d3": "7.4.3",
     "@types/geojson": "7946.0.16",
     "@types/node": "24.10.8",
-    "@types/react": "19.2.8",
+    "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
     "@types/topojson-client": "3.1.5",
     "@types/topojson-specification": "1.0.5",
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 6d44c180a1..4767064b4f 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -7,24 +7,26 @@ settings:
 overrides:
   '@react-types/shared': 3.26.0
   '@internationalized/date': 3.10.0
-  '@react-aria/ssr>react': 19.2.6
-  '@react-aria/ssr>react-dom': 19.2.6
-  '@react-aria/visually-hidden>react': 19.2.6
-  '@react-aria/interactions>react': 19.2.6
+  '@react-aria/ssr>react': 19.2.7
+  '@react-aria/ssr>react-dom': 19.2.7
+  '@react-aria/visually-hidden>react': 19.2.7
+  '@react-aria/interactions>react': 19.2.7
   lodash: 4.18.1
   lodash-es: 4.18.1
-  hono: 4.12.18
+  hono: 4.12.21
   '@hono/node-server': 1.19.14
   '@isaacs/brace-expansion': 5.0.1
   fast-xml-parser: 5.8.0
   serialize-javascript: 7.0.5
+  postcss: 8.5.14
+  esbuild: 0.28.1
   rollup@>=4: 4.59.0
   minimatch@<4: 3.1.4
   minimatch@>=9 <10: 9.0.7
   minimatch@>=10: 10.2.3
   ajv@<7: 6.14.0
   ajv@>=8: 8.18.0
-  qs: 6.14.2
+  qs: 6.15.2
   express-rate-limit: 8.5.1
   uuid: 11.1.1
 
@@ -33,8 +35,8 @@ importers:
   .:
     dependencies:
       '@ai-sdk/react':
-        specifier: 2.0.111
-        version: 2.0.111(react@19.2.6)(zod@4.4.3)
+        specifier: 3.0.205
+        version: 3.0.205(react@19.2.7)(zod@4.4.3)
       '@aws-sdk/client-bedrock-runtime':
         specifier: 3.1045.0
         version: 3.1045.0
@@ -55,10 +57,10 @@ importers:
         version: 7.1.7
       '@heroui/react':
         specifier: 2.8.4
-        version: 2.8.4(@types/react@19.2.8)(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(tailwindcss@4.1.18)
+        version: 2.8.4(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tailwindcss@4.1.18)
       '@hookform/resolvers':
         specifier: 5.2.2
-        version: 5.2.2(react-hook-form@7.62.0(react@19.2.6))
+        version: 5.2.2(react-hook-form@7.62.0(react@19.2.7))
       '@langchain/aws':
         specifier: 1.3.7
         version: 1.3.7(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))
@@ -67,7 +69,7 @@ importers:
         version: 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       '@langchain/mcp-adapters':
         specifier: 1.1.3
-        version: 1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))
+        version: 1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))
       '@langchain/openai':
         specifier: 1.4.5
         version: 1.4.5(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(ws@8.20.1)
@@ -75,80 +77,80 @@ importers:
         specifier: 1.2.3
         version: 1.2.3
       '@next/third-parties':
-        specifier: 16.2.6
-        version: 16.2.6(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)
+        specifier: 16.2.9
+        version: 16.2.9(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-alert-dialog':
         specifier: 1.1.14
-        version: 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-avatar':
         specifier: 1.1.11
-        version: 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-checkbox':
         specifier: 1.3.3
-        version: 1.3.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.3.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-collapsible':
         specifier: 1.1.12
-        version: 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-dialog':
         specifier: 1.1.14
-        version: 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-dropdown-menu':
         specifier: 2.1.15
-        version: 2.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 2.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-icons':
         specifier: 1.3.2
-        version: 1.3.2(react@19.2.6)
+        version: 1.3.2(react@19.2.7)
       '@radix-ui/react-label':
         specifier: 2.1.7
-        version: 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-popover':
         specifier: 1.1.15
-        version: 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-progress':
         specifier: 1.1.7
-        version: 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-radio-group':
         specifier: 1.3.8
-        version: 1.3.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.3.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-scroll-area':
         specifier: 1.2.10
-        version: 1.2.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.2.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-select':
         specifier: 2.2.5
-        version: 2.2.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 2.2.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-separator':
         specifier: 1.1.7
-        version: 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-slot':
         specifier: 1.2.3
-        version: 1.2.3(@types/react@19.2.8)(react@19.2.6)
+        version: 1.2.3(@types/react@19.2.17)(react@19.2.7)
       '@radix-ui/react-tabs':
         specifier: 1.1.13
-        version: 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-toast':
         specifier: 1.2.14
-        version: 1.2.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.2.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-tooltip':
         specifier: 1.2.8
-        version: 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@radix-ui/react-use-controllable-state':
         specifier: 1.2.2
-        version: 1.2.2(@types/react@19.2.8)(react@19.2.6)
+        version: 1.2.2(@types/react@19.2.17)(react@19.2.7)
       '@react-aria/ssr':
         specifier: 3.9.4
-        version: 3.9.4(react@19.2.6)
+        version: 3.9.4(react@19.2.7)
       '@react-aria/visually-hidden':
         specifier: 3.8.12
-        version: 3.8.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 3.8.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-stately/utils':
         specifier: 3.10.8
-        version: 3.10.8(react@19.2.6)
+        version: 3.10.8(react@19.2.7)
       '@react-types/shared':
         specifier: 3.26.0
-        version: 3.26.0(react@19.2.6)
+        version: 3.26.0(react@19.2.7)
       '@sentry/nextjs':
         specifier: 10.27.0
-        version: 10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
+        version: 10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
       '@tailwindcss/postcss':
         specifier: 4.1.18
         version: 4.1.18
@@ -157,19 +159,19 @@ importers:
         version: 0.5.16(tailwindcss@4.1.18)
       '@tanstack/react-table':
         specifier: 8.21.3
-        version: 8.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 8.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@types/js-yaml':
         specifier: 4.0.9
         version: 4.0.9
       '@uiw/react-codemirror':
         specifier: 4.25.8
-        version: 4.25.8(@babel/runtime@7.28.6)(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.40.0)(codemirror@6.0.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 4.25.8(@babel/runtime@7.28.6)(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.40.0)(codemirror@6.0.2)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@xyflow/react':
         specifier: 12.10.2
-        version: 12.10.2(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 12.10.2(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       ai:
-        specifier: 5.0.109
-        version: 5.0.109(zod@4.4.3)
+        specifier: 6.0.203
+        version: 6.0.203(zod@4.4.3)
       class-variance-authority:
         specifier: 0.7.1
         version: 0.7.1
@@ -178,7 +180,7 @@ importers:
         version: 2.1.1
       cmdk:
         specifier: 1.1.1
-        version: 1.1.1(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       d3:
         specifier: 7.9.0
         version: 7.9.0
@@ -187,7 +189,7 @@ importers:
         version: 4.1.0
       framer-motion:
         specifier: 11.18.2
-        version: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       import-in-the-middle:
         specifier: 2.0.0
         version: 2.0.0
@@ -199,10 +201,10 @@ importers:
         version: 4.0.0
       langchain:
         specifier: 1.4.0
-        version: 1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))
+        version: 1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))
       lucide-react:
         specifier: 0.543.0
-        version: 0.543.0(react@19.2.6)
+        version: 0.543.0(react@19.2.7)
       marked:
         specifier: 15.0.12
         version: 15.0.12
@@ -213,32 +215,32 @@ importers:
         specifier: 5.1.6
         version: 5.1.6
       next:
-        specifier: 16.2.6
-        version: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        specifier: 16.2.9
+        version: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       next-auth:
         specifier: 5.0.0-beta.30
-        version: 5.0.0-beta.30(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)
+        version: 5.0.0-beta.30(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
       next-themes:
         specifier: 0.2.1
-        version: 0.2.1(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 0.2.1(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react:
-        specifier: 19.2.6
-        version: 19.2.6
+        specifier: 19.2.7
+        version: 19.2.7
       react-day-picker:
         specifier: 9.13.0
-        version: 9.13.0(react@19.2.6)
+        version: 9.13.0(react@19.2.7)
       react-dom:
-        specifier: 19.2.6
-        version: 19.2.6(react@19.2.6)
+        specifier: 19.2.7
+        version: 19.2.7(react@19.2.7)
       react-hook-form:
         specifier: 7.62.0
-        version: 7.62.0(react@19.2.6)
+        version: 7.62.0(react@19.2.7)
       react-markdown:
         specifier: 10.1.0
-        version: 10.1.0(@types/react@19.2.8)(react@19.2.6)
+        version: 10.1.0(@types/react@19.2.17)(react@19.2.7)
       recharts:
         specifier: 2.15.4
-        version: 2.15.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 2.15.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       require-in-the-middle:
         specifier: 8.0.1
         version: 8.0.1
@@ -250,7 +252,7 @@ importers:
         version: 0.33.5
       streamdown:
         specifier: 1.6.10
-        version: 1.6.10(@types/mdast@4.0.4)(micromark-util-types@2.0.2)(micromark@4.0.2)(react@19.2.6)
+        version: 1.6.10(@types/mdast@4.0.4)(micromark-util-types@2.0.2)(micromark@4.0.2)(react@19.2.7)
       tailwind-merge:
         specifier: 3.3.1
         version: 3.3.1
@@ -262,10 +264,10 @@ importers:
         version: 3.1.0
       use-stick-to-bottom:
         specifier: 1.1.1
-        version: 1.1.1(react@19.2.6)
+        version: 1.1.1(react@19.2.7)
       vaul:
         specifier: 1.1.2
-        version: 1.1.2(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 1.1.2(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       world-atlas:
         specifier: 2.0.2
         version: 2.0.2
@@ -274,14 +276,14 @@ importers:
         version: 4.4.3
       zustand:
         specifier: 5.0.8
-        version: 5.0.8(@types/react@19.2.8)(react@19.2.6)(use-sync-external-store@1.6.0(react@19.2.6))
+        version: 5.0.8(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))
     devDependencies:
       '@iconify/react':
         specifier: 5.2.1
-        version: 5.2.1(react@19.2.6)
+        version: 5.2.1(react@19.2.7)
       '@next/eslint-plugin-next':
-        specifier: 16.2.6
-        version: 16.2.6
+        specifier: 16.2.9
+        version: 16.2.9
       '@playwright/test':
         specifier: 1.56.1
         version: 1.56.1
@@ -290,7 +292,7 @@ importers:
         version: 6.9.1
       '@testing-library/react':
         specifier: 16.3.2
-        version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+        version: 16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@testing-library/user-event':
         specifier: 14.6.1
         version: 14.6.1(@testing-library/dom@10.4.1)
@@ -304,11 +306,11 @@ importers:
         specifier: 24.10.8
         version: 24.10.8
       '@types/react':
-        specifier: 19.2.8
-        version: 19.2.8
+        specifier: 19.2.17
+        version: 19.2.17
       '@types/react-dom':
         specifier: 19.2.3
-        version: 19.2.3(@types/react@19.2.8)
+        version: 19.2.3(@types/react@19.2.17)
       '@types/topojson-client':
         specifier: 3.1.5
         version: 3.1.5
@@ -404,7 +406,7 @@ importers:
         version: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
       vitest-browser-react:
         specifier: 2.0.4
-        version: 2.0.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(vitest@4.1.8)
+        version: 2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.8)
 
 packages:
 
@@ -414,31 +416,27 @@ packages:
   '@adobe/css-tools@4.4.4':
     resolution: {integrity: sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg==}
 
-  '@ai-sdk/gateway@2.0.18':
-    resolution: {integrity: sha512-sDQcW+6ck2m0pTIHW6BPHD7S125WD3qNkx/B8sEzJp/hurocmJ5Cni0ybExg6sQMGo+fr/GWOwpHF1cmCdg5rQ==}
+  '@ai-sdk/gateway@3.0.129':
+    resolution: {integrity: sha512-KEQpZGJuCksc4iFxYtVHeHHG7yH0izGFzJLmRZlriI0hFIzJF9bT2AzJoaTHUI6minlxtP0WKYh84dP18o/Cuw==}
     engines: {node: '>=18'}
     peerDependencies:
       zod: ^3.25.76 || ^4.1.8
 
-  '@ai-sdk/provider-utils@3.0.18':
-    resolution: {integrity: sha512-ypv1xXMsgGcNKUP+hglKqtdDuMg68nWHucPPAhIENrbFAI+xCHiqPVN8Zllxyv1TNZwGWUghPxJXU+Mqps0YRQ==}
+  '@ai-sdk/provider-utils@4.0.29':
+    resolution: {integrity: sha512-uhukHaCBvqkwBHkT8C2PrnqKTCoLn3pdHXqtcR9I8ErH+flbzgW4o7VHSNIup9LRu+WBvZIZDQLsx6rwl2tiOA==}
     engines: {node: '>=18'}
     peerDependencies:
       zod: ^3.25.76 || ^4.1.8
 
-  '@ai-sdk/provider@2.0.0':
-    resolution: {integrity: sha512-6o7Y2SeO9vFKB8lArHXehNuusnpddKPk7xqL7T2/b+OvXMRIXUO1rR4wcv1hAFUAT9avGZshty3Wlua/XA7TvA==}
+  '@ai-sdk/provider@3.0.10':
+    resolution: {integrity: sha512-Q3BZ27qfpYqnCYGvE3vt+Qi6LGOF9R5Nmzn+9JoM1lCRsD9mYaIhfJLkSunN48nfGXJ6n+XNV0J/XVpqGQl7Dw==}
     engines: {node: '>=18'}
 
-  '@ai-sdk/react@2.0.111':
-    resolution: {integrity: sha512-CY2HW/bxTwpRMvd1SmnF1Fg/zv+v4wSDz+a6Vg+7AqF5YkFSmxsyYHEjZ8WzoeQDaDZXJbLM2ToajUHAQoZNtQ==}
+  '@ai-sdk/react@3.0.205':
+    resolution: {integrity: sha512-qh4H9dUqTJwdr+arKSIrVBHG4o4sYJdZGFUCJfAf9vMe/5IwDRwhq9z5ztpcUrXD3QACO01nuyfufNc0ZoGReA==}
     engines: {node: '>=18'}
     peerDependencies:
       react: ^18 || ~19.0.1 || ~19.1.2 || ^19.2.1
-      zod: ^3.25.76 || ^4.1.8
-    peerDependenciesMeta:
-      zod:
-        optional: true
 
   '@alloc/quick-lru@5.2.0':
     resolution: {integrity: sha512-UrcABB+4bUrFABwbluTIBErXwvbsU/V7TZWfmbgJfbkwiBuziS9gxdODUyuiecfdGQ85jglMW6juS3+z5TsKLw==}
@@ -825,158 +823,158 @@ packages:
   '@emnapi/wasi-threads@1.1.0':
     resolution: {integrity: sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==}
 
-  '@esbuild/aix-ppc64@0.27.7':
-    resolution: {integrity: sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==}
+  '@esbuild/aix-ppc64@0.28.1':
+    resolution: {integrity: sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [aix]
 
-  '@esbuild/android-arm64@0.27.7':
-    resolution: {integrity: sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==}
+  '@esbuild/android-arm64@0.28.1':
+    resolution: {integrity: sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
 
-  '@esbuild/android-arm@0.27.7':
-    resolution: {integrity: sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==}
+  '@esbuild/android-arm@0.28.1':
+    resolution: {integrity: sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
 
-  '@esbuild/android-x64@0.27.7':
-    resolution: {integrity: sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==}
+  '@esbuild/android-x64@0.28.1':
+    resolution: {integrity: sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
 
-  '@esbuild/darwin-arm64@0.27.7':
-    resolution: {integrity: sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==}
+  '@esbuild/darwin-arm64@0.28.1':
+    resolution: {integrity: sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
 
-  '@esbuild/darwin-x64@0.27.7':
-    resolution: {integrity: sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==}
+  '@esbuild/darwin-x64@0.28.1':
+    resolution: {integrity: sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
 
-  '@esbuild/freebsd-arm64@0.27.7':
-    resolution: {integrity: sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==}
+  '@esbuild/freebsd-arm64@0.28.1':
+    resolution: {integrity: sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
 
-  '@esbuild/freebsd-x64@0.27.7':
-    resolution: {integrity: sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==}
+  '@esbuild/freebsd-x64@0.28.1':
+    resolution: {integrity: sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
 
-  '@esbuild/linux-arm64@0.27.7':
-    resolution: {integrity: sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==}
+  '@esbuild/linux-arm64@0.28.1':
+    resolution: {integrity: sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
 
-  '@esbuild/linux-arm@0.27.7':
-    resolution: {integrity: sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==}
+  '@esbuild/linux-arm@0.28.1':
+    resolution: {integrity: sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
 
-  '@esbuild/linux-ia32@0.27.7':
-    resolution: {integrity: sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==}
+  '@esbuild/linux-ia32@0.28.1':
+    resolution: {integrity: sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
 
-  '@esbuild/linux-loong64@0.27.7':
-    resolution: {integrity: sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==}
+  '@esbuild/linux-loong64@0.28.1':
+    resolution: {integrity: sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
 
-  '@esbuild/linux-mips64el@0.27.7':
-    resolution: {integrity: sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==}
+  '@esbuild/linux-mips64el@0.28.1':
+    resolution: {integrity: sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
 
-  '@esbuild/linux-ppc64@0.27.7':
-    resolution: {integrity: sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==}
+  '@esbuild/linux-ppc64@0.28.1':
+    resolution: {integrity: sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
 
-  '@esbuild/linux-riscv64@0.27.7':
-    resolution: {integrity: sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==}
+  '@esbuild/linux-riscv64@0.28.1':
+    resolution: {integrity: sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
 
-  '@esbuild/linux-s390x@0.27.7':
-    resolution: {integrity: sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==}
+  '@esbuild/linux-s390x@0.28.1':
+    resolution: {integrity: sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
 
-  '@esbuild/linux-x64@0.27.7':
-    resolution: {integrity: sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==}
+  '@esbuild/linux-x64@0.28.1':
+    resolution: {integrity: sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [linux]
 
-  '@esbuild/netbsd-arm64@0.27.7':
-    resolution: {integrity: sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==}
+  '@esbuild/netbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
 
-  '@esbuild/netbsd-x64@0.27.7':
-    resolution: {integrity: sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==}
+  '@esbuild/netbsd-x64@0.28.1':
+    resolution: {integrity: sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [netbsd]
 
-  '@esbuild/openbsd-arm64@0.27.7':
-    resolution: {integrity: sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==}
+  '@esbuild/openbsd-arm64@0.28.1':
+    resolution: {integrity: sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
 
-  '@esbuild/openbsd-x64@0.27.7':
-    resolution: {integrity: sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==}
+  '@esbuild/openbsd-x64@0.28.1':
+    resolution: {integrity: sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [openbsd]
 
-  '@esbuild/openharmony-arm64@0.27.7':
-    resolution: {integrity: sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==}
+  '@esbuild/openharmony-arm64@0.28.1':
+    resolution: {integrity: sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openharmony]
 
-  '@esbuild/sunos-x64@0.27.7':
-    resolution: {integrity: sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==}
+  '@esbuild/sunos-x64@0.28.1':
+    resolution: {integrity: sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
 
-  '@esbuild/win32-arm64@0.27.7':
-    resolution: {integrity: sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==}
+  '@esbuild/win32-arm64@0.28.1':
+    resolution: {integrity: sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
 
-  '@esbuild/win32-ia32@0.27.7':
-    resolution: {integrity: sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==}
+  '@esbuild/win32-ia32@0.28.1':
+    resolution: {integrity: sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
 
-  '@esbuild/win32-x64@0.27.7':
-    resolution: {integrity: sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==}
+  '@esbuild/win32-x64@0.28.1':
+    resolution: {integrity: sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [win32]
@@ -1619,7 +1617,7 @@ packages:
     resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==}
     engines: {node: '>=18.14.1'}
     peerDependencies:
-      hono: 4.12.18
+      hono: 4.12.21
 
   '@hookform/resolvers@5.2.2':
     resolution: {integrity: sha512-A/IxlMLShx3KjV/HeTcTfaMxdwy690+L/ZADoeaTltLx+CVuzkeVIPuybK3jrRfw7YZnmdKsVVHAlEPIAEUNlA==}
@@ -2094,66 +2092,66 @@ packages:
   '@ndaidong/bellajs@12.0.1':
     resolution: {integrity: sha512-1iY42uiHz0cxNMbde7O3zVN+ZX1viOOUOBRt6ht6lkRZbSjwOnFV34Zv4URp3hGzEe6L9Byk7BOq/41H0PzAOQ==}
 
-  '@next/env@16.2.6':
-    resolution: {integrity: sha512-gd8HoHN4ufj73WmR3JmVolrpJR47ILK6LouP5xElPglaVxir6e1a7VzvTvDWkOoPXT9rkkTzyCxBu4yeZfZwcw==}
+  '@next/env@16.2.9':
+    resolution: {integrity: sha512-ki5VxxXfzD/9TDe13wyeTKIjQTAwBVpnr8KhRDUr8ltMUq1/NBpWNT5tiPoxiGl+PHM4X2ahSOiPk6iAimIzPg==}
 
-  '@next/eslint-plugin-next@16.2.6':
-    resolution: {integrity: sha512-Z8l6o4JWKUl755x4R+wogD86KPeU+Ckw4K+SYG4kHeOJtRenDeK+OSbGcqZpDtbwn9DsJVdir2UxmwXuinUbUw==}
+  '@next/eslint-plugin-next@16.2.9':
+    resolution: {integrity: sha512-UZi8+YT/MLgTC9nrrn2Xd4lBYv1B7lVmtWHfPcthAI5Tt/C1LuDe6DfmtCtJ+WQod3ksY4VrKSvk3oMVAnL7qw==}
 
-  '@next/swc-darwin-arm64@16.2.6':
-    resolution: {integrity: sha512-ZJGkkcNfYgrrMkqOdZ7zoLa1TOy0qpcMfk/z4Mh/FKUz40gVO+HNQWqmLxf67Z5WB64DRp0dhEbyHfel+6sJUg==}
+  '@next/swc-darwin-arm64@16.2.9':
+    resolution: {integrity: sha512-HkfxNYUCmcct0Xsqib5KxqMSHV4AHJq857BNRchyBDs4YS19aHzVfn1kDuBYKqLLQBjXgnkIsjV2Kd4d2wzYhw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [darwin]
 
-  '@next/swc-darwin-x64@16.2.6':
-    resolution: {integrity: sha512-v/YLBHIY132Ced3puBJ7YJKw1lqsCrgcNo2aRJlCEyQrrCeRJlvGlnmxhPxNQI3KE3N1DN5r9TPNPvka3nq5RQ==}
+  '@next/swc-darwin-x64@16.2.9':
+    resolution: {integrity: sha512-7IAtK4MeybpqRV9GRABWEhJ62mOS+rzWOzOTFie4cSEtm12xsoOMJRcECoZx3FHPzFAqN/IJtHqWAFOLfl152w==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [darwin]
 
-  '@next/swc-linux-arm64-gnu@16.2.6':
-    resolution: {integrity: sha512-RPOvqlYBbcQjkz9VQQDZ2T2bARIjXZV1KFlt+V2Mr6SW/e4I9fcKsaA0hdyf2FHoTlsV2xnBd5Y912rP/1Ce6w==}
+  '@next/swc-linux-arm64-gnu@16.2.9':
+    resolution: {integrity: sha512-hBD75iWpUtkL9SmQmcRhmLomn9jgkPzCEkbOcLgHymPEKzv+6ONy13RRiIEz/iEObjkS2Jlb5gYS2XGoS3X4rw==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-arm64-musl@16.2.6':
-    resolution: {integrity: sha512-URUTu1+dMkxJsPFgm+OeEvq9wf5sujw0EvgYy80TDGHTSLTnIHeqb0Eu8A3sC95IRgjejQL+kC4mw+4yPxiAXA==}
+  '@next/swc-linux-arm64-musl@16.2.9':
+    resolution: {integrity: sha512-qZTI3pf9SGc/obr8NkQAekBxmp1QK+kVm+VAf3BALLfFAj+1kUhkTxmrWpVos9R/UYIA8AWX2p6cGI5WdwzVUA==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-linux-x64-gnu@16.2.6':
-    resolution: {integrity: sha512-DOj182mPV8G3UkrayLoREM5YEYI+Dk5wv7Ox9xl1fFibAELEsFD0lDPfHIeILlutMMfdyhlzYPELG3peuKaurw==}
+  '@next/swc-linux-x64-gnu@16.2.9':
+    resolution: {integrity: sha512-xm0HfRNX+UkH4R3c18ynswjj5o5uEj/7iI9p9omdtTSIsRCzQqkGMA+10nzJ4EHnYC3as65IMhbbl5fWRUWHYg==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [glibc]
 
-  '@next/swc-linux-x64-musl@16.2.6':
-    resolution: {integrity: sha512-HKQ5SP/V/ub73UvF7n/zeJlxk2kLmtL7Wzrg4WfmkjmNos5onJ2tKu7yZOPdL18A6Svfn3max29ym+ry7NkK4g==}
+  '@next/swc-linux-x64-musl@16.2.9':
+    resolution: {integrity: sha512-QumimHkGEG6vM3PfEDWKyKen03NcqLOkeKB1EfcPe7VxzmEiCa4jNnMyBn/US5zcd/VE1CI+O8Ovb3lfjVHfGw==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
     libc: [musl]
 
-  '@next/swc-win32-arm64-msvc@16.2.6':
-    resolution: {integrity: sha512-LZXpTlPyS5v7HhSmnvsLGP3iIYgYOBnc8r8ArlT55sGHV89bR2HlDdBjWQ+PY6SJMmk8TuVGFuxalnP3k/0Dwg==}
+  '@next/swc-win32-arm64-msvc@16.2.9':
+    resolution: {integrity: sha512-hzQpKZvw8rAwI6A2uQh6SacCSvNAXaIkPNsWwzqqfRiIMiXMfH936skDhz1OO6KpvdKkJrgHHtqQOq5PIXOvdQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [win32]
 
-  '@next/swc-win32-x64-msvc@16.2.6':
-    resolution: {integrity: sha512-F0+4i0h9J6C4eE3EAPWsoCk7UW/dbzOjyzxY0qnDUOYFu6FFmdZ6l97/XdV3/Nz3VYyO7UWjyEJUXkGqcoXfMA==}
+  '@next/swc-win32-x64-msvc@16.2.9':
+    resolution: {integrity: sha512-qr2VL3Ce5QrwgO2yh1ujSBawrimjVKX8FGF/cOynmdYKJY0BdHpGVNIRK1tqONB10Vkm25Ub1BD2bkjWs4+96w==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [win32]
 
-  '@next/third-parties@16.2.6':
-    resolution: {integrity: sha512-PDPIPVj1NX6Taxsl8OJteAUJ7iwR+QrokwWig68eh0cOmuNjC6MBL+ZzBjO8Bv0n/HOSqjGArZpM5KMSUxm+MQ==}
+  '@next/third-parties@16.2.9':
+    resolution: {integrity: sha512-JZPGQRN8eQs2WMfBXOf6Zjrma+JIN0KyA24MvmIa3bUI4BwTaJ1UlxmYVc5ri6l30LQ8fPv6Kmx20447hCltrg==}
     peerDependencies:
       next: ^13.0.0 || ^14.0.0 || ^15.0.0 || ^16.0.0-beta.0
       react: ^18.2.0 || 19.0.0-rc-de68d2f4-20241204 || ^19.0.0
@@ -3325,13 +3323,13 @@ packages:
   '@react-aria/interactions@3.25.5':
     resolution: {integrity: sha512-EweYHOEvMwef/wsiEqV73KurX/OqnmbzKQa2fLxdULbec5+yDj6wVGaRHIzM4NiijIDe+bldEl5DG05CAKOAHA==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
       react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
 
   '@react-aria/interactions@3.26.0':
     resolution: {integrity: sha512-AAEcHiltjfbmP1i9iaVw34Mb7kbkiHpYdqieWufldh4aplWgsF11YQZOfaCJW4QoR2ML4Zzoa9nfFwLXA52R7Q==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
       react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
 
   '@react-aria/label@3.7.21':
@@ -3443,13 +3441,13 @@ packages:
     resolution: {integrity: sha512-hvTm77Pf+pMBhuBm760Li0BVIO38jv1IBws1xFm1NoL26PU+fe+FMW5+VZWyANR6nYL65joaJKZqOdTQMkO9IQ==}
     engines: {node: '>= 12'}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   '@react-aria/ssr@3.9.4':
     resolution: {integrity: sha512-4jmAigVq409qcJvQyuorsmBR4+9r3+JEC60wC+Y0MZV0HCtTmm8D9guYXlJMdx0SSkgj0hHAyFm/HvPNFofCoQ==}
     engines: {node: '>= 12'}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   '@react-aria/switch@3.7.7':
     resolution: {integrity: sha512-auV3g1qh+d/AZk7Idw2BOcYeXfCD9iDaiGmlcLJb9Eaz4nkq8vOkQxIXQFrn9Xhb+PfQzmQYKkt5N6P2ZNsw/g==}
@@ -3520,18 +3518,18 @@ packages:
   '@react-aria/visually-hidden@3.8.12':
     resolution: {integrity: sha512-Bawm+2Cmw3Xrlr7ARzl2RLtKh0lNUdJ0eNqzWcyx4c0VHUAWtThmH5l+HRqFUGzzutFZVo89SAy40BAbd0gjVw==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   '@react-aria/visually-hidden@3.8.27':
     resolution: {integrity: sha512-hD1DbL3WnjPnCdlQjwe19bQVRAGJyN0Aaup+s7NNtvZUn7AjoEH78jo8TE+L8yM7z/OZUQF26laCfYqeIwWn4g==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
       react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
 
   '@react-aria/visually-hidden@3.8.29':
     resolution: {integrity: sha512-1joCP+MHBLd+YA6Gb08nMFfDBhOF0Kh1gR1SA8zoxEB5RMfQEEkufIB8k0GGwvHGSCK3gFyO8UAVsD0+rRYEyg==}
     peerDependencies:
-      react: 19.2.6
+      react: 19.2.7
       react-dom: ^16.8.0 || ^17.0.0-rc.1 || ^18.0.0 || ^19.0.0-rc.1
 
   '@react-stately/calendar@3.8.4':
@@ -4673,8 +4671,8 @@ packages:
     peerDependencies:
       '@types/react': ^19.2.0
 
-  '@types/react@19.2.8':
-    resolution: {integrity: sha512-3MbSL37jEchWZz2p2mjntRZtPt837ij10ApxKfgmXCTuHWagYg7iA5bqPw6C8BMPfwidlvfPI/fxOc42HLhcyg==}
+  '@types/react@19.2.17':
+    resolution: {integrity: sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==}
 
   '@types/set-cookie-parser@2.4.10':
     resolution: {integrity: sha512-GGmQVGpQWUe5qglJozEjZV/5dyxbOOZ0LHe/lqyWssB88Y4svNfst0uqBVscdDeIKl5Jy5+aPSvy7mI9tYRguw==}
@@ -4788,8 +4786,8 @@ packages:
   '@upsetjs/venn.js@2.0.0':
     resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==}
 
-  '@vercel/oidc@3.0.5':
-    resolution: {integrity: sha512-fnYhv671l+eTTp48gB4zEsTW/YtRgRPnkI2nT7x6qw5rkI1Lq2hTmQIpHPgyThI0znLK+vX2n9XxKdXZ7BUbbw==}
+  '@vercel/oidc@3.2.0':
+    resolution: {integrity: sha512-UycprH3T6n3jH0k44NHMa7pnFHGu/N05MjojYr+Mc6I7obkoLIJujSWwin1pCvdy/eOxrI/l3uDLQsmcrOb4ug==}
     engines: {node: '>= 20'}
 
   '@vitejs/plugin-react@5.1.2':
@@ -4945,8 +4943,8 @@ packages:
     resolution: {integrity: sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==}
     engines: {node: '>= 14'}
 
-  ai@5.0.109:
-    resolution: {integrity: sha512-tW8K4Z0bcYH9PzP7gMmPilgBwgpylEL25bRtWruUnrTS45S6ryNJ6YSEh6mZajlIEDS6bcur7srdXVGERxjVXQ==}
+  ai@6.0.203:
+    resolution: {integrity: sha512-2Qi1ZPGF/FnlvnRqntVgRbUYGeA5ZKFYwTtgu8rcUzMmddArM/nLsvCW69Ip99B1cop6XHRHl+GCKk9t9B+GDA==}
     engines: {node: '>=18'}
     peerDependencies:
       zod: ^3.25.76 || ^4.1.8
@@ -5675,8 +5673,8 @@ packages:
   es-toolkit@1.46.1:
     resolution: {integrity: sha512-5eNtXOs3tbfxXOj04tjjseeWkRWaoCjdEI+96DgwzZoe6c9juL49pXlzAFTI72aWC9Y8p7168g6XIKjh7k6pyQ==}
 
-  esbuild@0.27.7:
-    resolution: {integrity: sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==}
+  esbuild@0.28.1:
+    resolution: {integrity: sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -5828,6 +5826,10 @@ packages:
     resolution: {integrity: sha512-Vo1ab+QXPzZ4tCa8SwIHJFaSzy4R6SHf7BY79rFBDf0idraZWAkYrDjDj8uWaSm3S2TK+hJ7/t1CEmZ7jXw+pg==}
     engines: {node: '>=18.0.0'}
 
+  eventsource-parser@3.1.0:
+    resolution: {integrity: sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg==}
+    engines: {node: '>=18.0.0'}
+
   eventsource@3.0.7:
     resolution: {integrity: sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA==}
     engines: {node: '>=18.0.0'}
@@ -6157,8 +6159,8 @@ packages:
   hoist-non-react-statics@3.3.2:
     resolution: {integrity: sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==}
 
-  hono@4.12.18:
-    resolution: {integrity: sha512-RWzP96k/yv0PQfyXnWjs6zot20TqfpfsNXhOnev8d1InAxubW93L11/oNUc3tQqn2G0bSdAOBpX+2uDFHV7kdQ==}
+  hono@4.12.21:
+    resolution: {integrity: sha512-uV63apnb0kyPtAUwoWgaGh9HyIFcv8lgmzPZSiTBQAFOFGIzka5EZ1dZocmGnn0XdX0+XTqJ6Tqv7selMuGLRQ==}
     engines: {node: '>=16.9.0'}
 
   html-encoding-sniffer@6.0.0:
@@ -7021,8 +7023,8 @@ packages:
       react: '*'
       react-dom: '*'
 
-  next@16.2.6:
-    resolution: {integrity: sha512-qOVgKJg1+At15NpeUP+eJgCHvTCgXsogweq87Ri/Ix7PkqQHg4sdaXmSFqKlgaIXE4kW0g25LE68W87UANlHtw==}
+  next@16.2.9:
+    resolution: {integrity: sha512-MEOJiq/UvuezAdqVSceHbqDgZt1kDw2tpGVOlsdIoJsQdbN2JY2hpVG4xnXGkbdJUOEWhnRfiu/O4Hpc9Juwww==}
     engines: {node: '>=20.9.0'}
     hasBin: true
     peerDependencies:
@@ -7281,10 +7283,6 @@ packages:
     resolution: {integrity: sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==}
     engines: {node: '>=4'}
 
-  postcss@8.4.31:
-    resolution: {integrity: sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==}
-    engines: {node: ^10 || ^12 || >=14}
-
   postcss@8.5.14:
     resolution: {integrity: sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==}
     engines: {node: ^10 || ^12 || >=14}
@@ -7420,8 +7418,8 @@ packages:
     resolution: {integrity: sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==}
     engines: {node: '>=6'}
 
-  qs@6.14.2:
-    resolution: {integrity: sha512-V/yCWTTF7VJ9hIh18Ugr2zhJMP01MY7c5kh4J870L7imm6/DIzBsNLTXzMwUA3yZ5b/KBqLx8Kp3uRvd7xSe3Q==}
+  qs@6.15.2:
+    resolution: {integrity: sha512-Rzq0KEyX/w/tEybncDgdkZrJgVUsUMk3xjh3t5bv3S1HTAtg+uOYt72+ZfwiQwKdysThkTBdL/rTi6HDmX9Ddw==}
     engines: {node: '>=0.6'}
 
   queue-microtask@1.2.3:
@@ -7441,10 +7439,10 @@ packages:
     peerDependencies:
       react: '>=16.8.0'
 
-  react-dom@19.2.6:
-    resolution: {integrity: sha512-0prMI+hvBbPjsWnxDLxlCGyM8PN6UuWjEUCYmZhO67xIV9Xasa/r/vDnq+Xyq4Lo27g8QSbO5YzARu0D1Sps3g==}
+  react-dom@19.2.7:
+    resolution: {integrity: sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==}
     peerDependencies:
-      react: ^19.2.6
+      react: ^19.2.7
 
   react-hook-form@7.62.0:
     resolution: {integrity: sha512-7KWFejc98xqG/F4bAxpL41NB3o1nnvQO1RWZT3TqRZYL8RryQETGfEdVnJN2fy1crCiBLLjkRBVK05j24FxJGA==}
@@ -7519,8 +7517,8 @@ packages:
       react: '>=16.6.0'
       react-dom: '>=16.6.0'
 
-  react@19.2.6:
-    resolution: {integrity: sha512-sfWGGfavi0xr8Pg0sVsyHMAOziVYKgPLNrS7ig+ivMNb3wbCBw3KxtflsGBAwD3gYQlE/AEZsTLgToRrSCjb0Q==}
+  react@19.2.7:
+    resolution: {integrity: sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==}
     engines: {node: '>=0.10.0'}
 
   readdirp@3.6.0:
@@ -8609,33 +8607,33 @@ snapshots:
 
   '@adobe/css-tools@4.4.4': {}
 
-  '@ai-sdk/gateway@2.0.18(zod@4.4.3)':
+  '@ai-sdk/gateway@3.0.129(zod@4.4.3)':
     dependencies:
-      '@ai-sdk/provider': 2.0.0
-      '@ai-sdk/provider-utils': 3.0.18(zod@4.4.3)
-      '@vercel/oidc': 3.0.5
+      '@ai-sdk/provider': 3.0.10
+      '@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
+      '@vercel/oidc': 3.2.0
       zod: 4.4.3
 
-  '@ai-sdk/provider-utils@3.0.18(zod@4.4.3)':
+  '@ai-sdk/provider-utils@4.0.29(zod@4.4.3)':
     dependencies:
-      '@ai-sdk/provider': 2.0.0
+      '@ai-sdk/provider': 3.0.10
       '@standard-schema/spec': 1.1.0
-      eventsource-parser: 3.0.6
+      eventsource-parser: 3.1.0
       zod: 4.4.3
 
-  '@ai-sdk/provider@2.0.0':
+  '@ai-sdk/provider@3.0.10':
     dependencies:
       json-schema: 0.4.0
 
-  '@ai-sdk/react@2.0.111(react@19.2.6)(zod@4.4.3)':
+  '@ai-sdk/react@3.0.205(react@19.2.7)(zod@4.4.3)':
     dependencies:
-      '@ai-sdk/provider-utils': 3.0.18(zod@4.4.3)
-      ai: 5.0.109(zod@4.4.3)
-      react: 19.2.6
-      swr: 2.3.8(react@19.2.6)
+      '@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
+      ai: 6.0.203(zod@4.4.3)
+      react: 19.2.7
+      swr: 2.3.8(react@19.2.7)
       throttleit: 2.1.0
-    optionalDependencies:
-      zod: 4.4.3
+    transitivePeerDependencies:
+      - zod
 
   '@alloc/quick-lru@5.2.0': {}
 
@@ -9435,82 +9433,82 @@ snapshots:
       tslib: 2.8.1
     optional: true
 
-  '@esbuild/aix-ppc64@0.27.7':
+  '@esbuild/aix-ppc64@0.28.1':
     optional: true
 
-  '@esbuild/android-arm64@0.27.7':
+  '@esbuild/android-arm64@0.28.1':
     optional: true
 
-  '@esbuild/android-arm@0.27.7':
+  '@esbuild/android-arm@0.28.1':
     optional: true
 
-  '@esbuild/android-x64@0.27.7':
+  '@esbuild/android-x64@0.28.1':
     optional: true
 
-  '@esbuild/darwin-arm64@0.27.7':
+  '@esbuild/darwin-arm64@0.28.1':
     optional: true
 
-  '@esbuild/darwin-x64@0.27.7':
+  '@esbuild/darwin-x64@0.28.1':
     optional: true
 
-  '@esbuild/freebsd-arm64@0.27.7':
+  '@esbuild/freebsd-arm64@0.28.1':
     optional: true
 
-  '@esbuild/freebsd-x64@0.27.7':
+  '@esbuild/freebsd-x64@0.28.1':
     optional: true
 
-  '@esbuild/linux-arm64@0.27.7':
+  '@esbuild/linux-arm64@0.28.1':
     optional: true
 
-  '@esbuild/linux-arm@0.27.7':
+  '@esbuild/linux-arm@0.28.1':
     optional: true
 
-  '@esbuild/linux-ia32@0.27.7':
+  '@esbuild/linux-ia32@0.28.1':
     optional: true
 
-  '@esbuild/linux-loong64@0.27.7':
+  '@esbuild/linux-loong64@0.28.1':
     optional: true
 
-  '@esbuild/linux-mips64el@0.27.7':
+  '@esbuild/linux-mips64el@0.28.1':
     optional: true
 
-  '@esbuild/linux-ppc64@0.27.7':
+  '@esbuild/linux-ppc64@0.28.1':
     optional: true
 
-  '@esbuild/linux-riscv64@0.27.7':
+  '@esbuild/linux-riscv64@0.28.1':
     optional: true
 
-  '@esbuild/linux-s390x@0.27.7':
+  '@esbuild/linux-s390x@0.28.1':
     optional: true
 
-  '@esbuild/linux-x64@0.27.7':
+  '@esbuild/linux-x64@0.28.1':
     optional: true
 
-  '@esbuild/netbsd-arm64@0.27.7':
+  '@esbuild/netbsd-arm64@0.28.1':
     optional: true
 
-  '@esbuild/netbsd-x64@0.27.7':
+  '@esbuild/netbsd-x64@0.28.1':
     optional: true
 
-  '@esbuild/openbsd-arm64@0.27.7':
+  '@esbuild/openbsd-arm64@0.28.1':
     optional: true
 
-  '@esbuild/openbsd-x64@0.27.7':
+  '@esbuild/openbsd-x64@0.28.1':
     optional: true
 
-  '@esbuild/openharmony-arm64@0.27.7':
+  '@esbuild/openharmony-arm64@0.28.1':
     optional: true
 
-  '@esbuild/sunos-x64@0.27.7':
+  '@esbuild/sunos-x64@0.28.1':
     optional: true
 
-  '@esbuild/win32-arm64@0.27.7':
+  '@esbuild/win32-arm64@0.28.1':
     optional: true
 
-  '@esbuild/win32-ia32@0.27.7':
+  '@esbuild/win32-ia32@0.28.1':
     optional: true
 
-  '@esbuild/win32-x64@0.27.7':
+  '@esbuild/win32-x64@0.28.1':
     optional: true
 
   '@eslint-community/eslint-utils@4.9.1(eslint@9.39.2(jiti@2.6.1))':
@@ -9579,11 +9577,11 @@ snapshots:
       '@floating-ui/core': 1.7.3
       '@floating-ui/utils': 0.2.10
 
-  '@floating-ui/react-dom@2.1.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@floating-ui/react-dom@2.1.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@floating-ui/dom': 1.7.4
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   '@floating-ui/utils@0.2.10': {}
 
@@ -9613,814 +9611,814 @@ snapshots:
     dependencies:
       tslib: 2.8.1
 
-  '@heroui/accordion@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/accordion@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-accordion': 2.2.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tree': 3.9.2(react@19.2.6)
-      '@react-types/accordion': 3.0.0-alpha.26(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-accordion': 2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tree': 3.9.2(react@19.2.7)
+      '@react-types/accordion': 3.0.0-alpha.26(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/alert@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/alert@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/aria-utils@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/aria-utils@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.7(react@19.2.6)
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.7(react@19.2.7)
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@heroui/theme'
       - framer-motion
 
-  '@heroui/autocomplete@2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/autocomplete@2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/combobox': 3.13.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/combobox': 3.11.1(react@19.2.6)
-      '@react-types/combobox': 3.13.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/combobox': 3.13.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/combobox': 3.11.1(react@19.2.7)
+      '@react-types/combobox': 3.13.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
 
-  '@heroui/avatar@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/avatar@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-image': 2.1.12(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-image': 2.1.12(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/badge@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/badge@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/breadcrumbs@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/breadcrumbs@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/breadcrumbs': 3.5.28(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/breadcrumbs': 3.7.16(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/breadcrumbs': 3.5.28(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/breadcrumbs': 3.7.16(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/button@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/button@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/calendar@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/calendar@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@internationalized/date': 3.10.0
-      '@react-aria/calendar': 3.9.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/calendar': 3.8.4(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/calendar': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/calendar': 3.9.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/calendar': 3.8.4(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/calendar': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
       scroll-into-view-if-needed: 3.0.10
 
-  '@heroui/card@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/card@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/checkbox@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/checkbox@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-callback-ref': 2.1.8(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/checkbox': 3.16.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/checkbox': 3.7.1(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-types/checkbox': 3.10.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-callback-ref': 2.1.8(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/checkbox': 3.16.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/checkbox': 3.7.1(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-types/checkbox': 3.10.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/chip@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/chip@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/code@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/code@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/date-input@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/date-input@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
       '@internationalized/date': 3.10.0
-      '@react-aria/datepicker': 3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/datepicker': 3.15.1(react@19.2.6)
-      '@react-types/datepicker': 3.13.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/datepicker': 3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/datepicker': 3.15.1(react@19.2.7)
+      '@react-types/datepicker': 3.13.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/date-picker@2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/date-picker@2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
       '@internationalized/date': 3.10.0
-      '@react-aria/datepicker': 3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/datepicker': 3.15.1(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/datepicker': 3.13.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/datepicker': 3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/datepicker': 3.15.1(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/datepicker': 3.13.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/divider@2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/divider@2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-rsc-utils': 2.1.9(react@19.2.6)
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/react-rsc-utils': 2.1.9(react@19.2.7)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/dom-animation@2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))':
+  '@heroui/dom-animation@2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))':
     dependencies:
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
 
-  '@heroui/drawer@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/drawer@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/dropdown@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/dropdown@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/menu': 3.19.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/menu': 3.9.7(react@19.2.6)
-      '@react-types/menu': 3.10.4(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/menu': 3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/menu': 3.9.7(react@19.2.7)
+      '@react-types/menu': 3.10.4(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/form@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/form@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-stately/form': 3.2.1(react@19.2.6)
-      '@react-types/form': 3.7.15(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-stately/form': 3.2.1(react@19.2.7)
+      '@react-types/form': 3.7.15(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/framer-utils@2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/framer-utils@2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-measure': 2.1.8(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-measure': 2.1.8(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@heroui/theme'
 
-  '@heroui/image@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/image@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-image': 2.1.12(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-image': 2.1.12(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/input-otp@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/input-otp@2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-form-reset': 2.0.1(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/form': 3.1.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.1(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/textfield': 3.12.5(react@19.2.6)
-      input-otp: 1.4.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-form-reset': 2.0.1(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/form': 3.1.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.1(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/textfield': 3.12.5(react@19.2.7)
+      input-otp: 1.4.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/input@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/input@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/textfield': 3.18.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/textfield': 3.12.5(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-textarea-autosize: 8.5.9(@types/react@19.2.8)(react@19.2.6)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/textfield': 3.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/textfield': 3.12.5(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-textarea-autosize: 8.5.9(@types/react@19.2.17)(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
 
-  '@heroui/kbd@2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/kbd@2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/link@2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/link@2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-link': 2.2.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/link': 3.6.4(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-link': 2.2.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/link': 3.6.4(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/listbox@2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/listbox@2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mobile': 2.2.12(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/listbox': 3.14.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/list': 3.13.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@tanstack/react-virtual': 3.11.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mobile': 2.2.12(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/listbox': 3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/list': 3.13.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@tanstack/react-virtual': 3.11.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/menu@2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/menu@2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mobile': 2.2.12(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/menu': 3.19.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tree': 3.9.2(react@19.2.6)
-      '@react-types/menu': 3.10.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mobile': 2.2.12(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/menu': 3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tree': 3.9.2(react@19.2.7)
+      '@react-types/menu': 3.10.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/modal@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/modal@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-aria-modal-overlay': 2.2.18(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-disclosure': 2.2.16(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-draggable': 2.1.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-viewport-size': 2.0.1(react@19.2.6)
-      '@react-aria/dialog': 3.5.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.19(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-aria-modal-overlay': 2.2.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-disclosure': 2.2.16(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-draggable': 2.1.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-viewport-size': 2.0.1(react@19.2.7)
+      '@react-aria/dialog': 3.5.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.19(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/navbar@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/navbar@2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-resize': 2.1.8(react@19.2.6)
-      '@heroui/use-scroll-position': 2.1.8(react@19.2.6)
-      '@react-aria/button': 3.14.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-resize': 2.1.8(react@19.2.7)
+      '@heroui/use-scroll-position': 2.1.8(react@19.2.7)
+      '@react-aria/button': 3.14.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/number-input@2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/number-input@2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/numberfield': 3.12.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/numberfield': 3.10.1(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/numberfield': 3.8.14(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/numberfield': 3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/numberfield': 3.10.1(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/numberfield': 3.8.14(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/pagination@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/pagination@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-intersection-observer': 2.2.14(react@19.2.6)
-      '@heroui/use-pagination': 2.2.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-intersection-observer': 2.2.14(react@19.2.7)
+      '@heroui/use-pagination': 2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
       scroll-into-view-if-needed: 3.0.10
 
-  '@heroui/popover@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/popover@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/dialog': 3.5.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.19(react@19.2.6)
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/dialog': 3.5.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.19(react@19.2.7)
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/progress@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/progress@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mounted': 2.1.8(react@19.2.6)
-      '@react-aria/progress': 3.4.26(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/progress': 3.5.15(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mounted': 2.1.8(react@19.2.7)
+      '@react-aria/progress': 3.4.26(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/progress': 3.5.15(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/radio@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/radio@2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/radio': 3.12.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/radio': 3.11.1(react@19.2.6)
-      '@react-types/radio': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/radio': 3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/radio': 3.11.1(react@19.2.7)
+      '@react-types/radio': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/react-rsc-utils@2.1.9(react@19.2.6)':
+  '@heroui/react-rsc-utils@2.1.9(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/react-utils@2.1.13(react@19.2.6)':
+  '@heroui/react-utils@2.1.13(react@19.2.7)':
     dependencies:
-      '@heroui/react-rsc-utils': 2.1.9(react@19.2.6)
+      '@heroui/react-rsc-utils': 2.1.9(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/react@2.8.4(@types/react@19.2.8)(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(tailwindcss@4.1.18)':
+  '@heroui/react@2.8.4(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(tailwindcss@4.1.18)':
     dependencies:
-      '@heroui/accordion': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/alert': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/autocomplete': 2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/badge': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/breadcrumbs': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/card': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/chip': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/code': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/date-picker': 2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/drawer': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dropdown': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/image': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/input-otp': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/kbd': 2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/link': 2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/navbar': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/number-input': 2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/pagination': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/progress': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/radio': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/select': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/skeleton': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/slider': 2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/snippet': 2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/switch': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/table': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/tabs': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/accordion': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/alert': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/autocomplete': 2.3.28(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/badge': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/breadcrumbs': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/calendar': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/card': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/chip': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/code': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/date-input': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/date-picker': 2.3.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/divider': 2.2.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/drawer': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dropdown': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/image': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/input': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/input-otp': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/kbd': 2.2.21(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/link': 2.2.22(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/menu': 2.2.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/modal': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/navbar': 2.2.24(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/number-input': 2.0.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/pagination': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/progress': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/radio': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/ripple': 2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/select': 2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/skeleton': 2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/slider': 2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/snippet': 2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/switch': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/table': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/tabs': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/toast': 2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/user': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/toast': 2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/user': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
       - tailwindcss
 
-  '@heroui/ripple@2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/ripple@2.2.19(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/scroll-shadow@2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/scroll-shadow@2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-data-scroll-overflow': 2.2.12(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-data-scroll-overflow': 2.2.12(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/select@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/select@2.4.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/form': 2.1.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/listbox': 2.3.25(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/popover': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/scroll-shadow': 2.3.17(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-aria-multiselect': 2.4.18(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-form-reset': 2.0.1(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/form': 3.1.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-button': 2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-aria-multiselect': 2.4.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-form-reset': 2.0.1(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/form': 3.1.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/shared-icons@2.1.10(react@19.2.6)':
+  '@heroui/shared-icons@2.1.10(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   '@heroui/shared-utils@2.1.11': {}
 
-  '@heroui/skeleton@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/skeleton@2.2.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/slider@2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/slider@2.4.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/slider': 3.8.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/slider': 3.7.1(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/slider': 3.8.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/slider': 3.7.1(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/snippet@2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/snippet@2.2.27(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/button': 2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-clipboard': 2.1.9(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/tooltip': 2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-clipboard': 2.1.9(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/spacer@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/spacer@2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/spinner@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/spinner@2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - framer-motion
 
-  '@heroui/switch@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/switch@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/switch': 3.7.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/switch': 3.7.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/system-rsc@2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)':
+  '@heroui/system-rsc@2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)':
     dependencies:
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       clsx: 1.2.1
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.6)
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/system-rsc': 2.3.19(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react@19.2.7)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@heroui/theme'
 
-  '@heroui/table@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/table@2.2.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/checkbox': 2.3.26(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/spacer': 2.2.20(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/table': 3.17.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/table': 3.15.0(react@19.2.6)
-      '@react-stately/virtualizer': 4.4.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/grid': 3.3.5(react@19.2.6)
-      '@react-types/table': 3.13.3(react@19.2.6)
-      '@tanstack/react-virtual': 3.11.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/table': 3.17.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/table': 3.15.0(react@19.2.7)
+      '@react-stately/virtualizer': 4.4.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/grid': 3.3.5(react@19.2.7)
+      '@react-types/table': 3.13.3(react@19.2.7)
+      '@tanstack/react-virtual': 3.11.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/tabs@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/tabs@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mounted': 2.1.8(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/tabs': 3.10.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tabs': 3.8.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mounted': 2.1.8(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/tabs': 3.10.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tabs': 3.8.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
       scroll-into-view-if-needed: 3.0.10
 
   '@heroui/theme@2.4.22(tailwindcss@4.1.18)':
@@ -10435,212 +10433,212 @@ snapshots:
       tailwind-variants: 3.1.1(tailwind-merge@3.3.1)(tailwindcss@4.1.18)
       tailwindcss: 4.1.18
 
-  '@heroui/toast@2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/toast@2.0.16(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/shared-icons': 2.1.10(react@19.2.6)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/shared-icons': 2.1.10(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/spinner': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-is-mobile': 2.2.12(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/toast': 3.0.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toast': 3.1.2(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-is-mobile': 2.2.12(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/toast': 3.0.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toast': 3.1.2(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/tooltip@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/tooltip@2.2.23(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))
-      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/aria-utils': 2.2.23(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/dom-animation': 2.1.10(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))
+      '@heroui/framer-utils': 2.1.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/tooltip': 3.8.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tooltip': 3.5.7(react@19.2.6)
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      '@react-types/tooltip': 3.4.20(react@19.2.6)
-      framer-motion: 11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/tooltip': 3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tooltip': 3.5.7(react@19.2.7)
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      '@react-types/tooltip': 3.4.20(react@19.2.7)
+      framer-motion: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/use-aria-accordion@2.2.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-accordion@2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/button': 3.14.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.25.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tree': 3.9.2(react@19.2.6)
-      '@react-types/accordion': 3.0.0-alpha.26(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/button': 3.14.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.25.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tree': 3.9.2(react@19.2.7)
+      '@react-types/accordion': 3.0.0-alpha.26(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-aria-button@2.2.19(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-button@2.2.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-aria-link@2.2.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-link@2.2.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/link': 3.6.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/link': 3.6.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-aria-modal-overlay@2.2.18(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-modal-overlay@2.2.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.19(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@heroui/use-aria-overlay': 2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.19(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/use-aria-multiselect@2.4.18(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-multiselect@2.4.18(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.21(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/listbox': 3.14.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/menu': 3.19.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.25.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.1(react@19.2.6)
-      '@react-stately/list': 3.13.0(react@19.2.6)
-      '@react-stately/menu': 3.9.7(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.21(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/listbox': 3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/menu': 3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.25.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.1(react@19.2.7)
+      '@react-stately/list': 3.13.0(react@19.2.7)
+      '@react-stately/menu': 3.9.7(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/use-aria-overlay@2.0.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-aria-overlay@2.0.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@heroui/use-callback-ref@2.1.8(react@19.2.6)':
+  '@heroui/use-callback-ref@2.1.8(react@19.2.7)':
     dependencies:
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      react: 19.2.6
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      react: 19.2.7
 
-  '@heroui/use-clipboard@2.1.9(react@19.2.6)':
+  '@heroui/use-clipboard@2.1.9(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-data-scroll-overflow@2.2.12(react@19.2.6)':
+  '@heroui/use-data-scroll-overflow@2.2.12(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-disclosure@2.2.16(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-disclosure@2.2.16(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/use-callback-ref': 2.1.8(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      react: 19.2.6
+      '@heroui/use-callback-ref': 2.1.8(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-draggable@2.1.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-draggable@2.1.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-form-reset@2.0.1(react@19.2.6)':
+  '@heroui/use-form-reset@2.0.1(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-image@2.1.12(react@19.2.6)':
+  '@heroui/use-image@2.1.12(react@19.2.7)':
     dependencies:
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
-      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.6)
-      react: 19.2.6
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
+      '@heroui/use-safe-layout-effect': 2.1.8(react@19.2.7)
+      react: 19.2.7
 
-  '@heroui/use-intersection-observer@2.2.14(react@19.2.6)':
+  '@heroui/use-intersection-observer@2.2.14(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-is-mobile@2.2.12(react@19.2.6)':
+  '@heroui/use-is-mobile@2.2.12(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      react: 19.2.7
 
-  '@heroui/use-is-mounted@2.1.8(react@19.2.6)':
+  '@heroui/use-is-mounted@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-measure@2.1.8(react@19.2.6)':
+  '@heroui/use-measure@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-pagination@2.2.17(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/use-pagination@2.2.17(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@heroui/shared-utils': 2.1.11
-      '@react-aria/i18n': 3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
+      '@react-aria/i18n': 3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@heroui/use-resize@2.1.8(react@19.2.6)':
+  '@heroui/use-resize@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-safe-layout-effect@2.1.8(react@19.2.6)':
+  '@heroui/use-safe-layout-effect@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-scroll-position@2.1.8(react@19.2.6)':
+  '@heroui/use-scroll-position@2.1.8(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/use-viewport-size@2.0.1(react@19.2.6)':
+  '@heroui/use-viewport-size@2.0.1(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@heroui/user@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@heroui/user@2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@heroui/react-utils': 2.1.13(react@19.2.6)
+      '@heroui/avatar': 2.2.21(@heroui/system@2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(@heroui/theme@2.4.22(tailwindcss@4.1.18))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@heroui/react-utils': 2.1.13(react@19.2.7)
       '@heroui/shared-utils': 2.1.11
-      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@heroui/system': 2.4.22(@heroui/theme@2.4.22(tailwindcss@4.1.18))(framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@heroui/theme': 2.4.22(tailwindcss@4.1.18)
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@hono/node-server@1.19.14(hono@4.12.18)':
+  '@hono/node-server@1.19.14(hono@4.12.21)':
     dependencies:
-      hono: 4.12.18
+      hono: 4.12.21
 
-  '@hookform/resolvers@5.2.2(react-hook-form@7.62.0(react@19.2.6))':
+  '@hookform/resolvers@5.2.2(react-hook-form@7.62.0(react@19.2.7))':
     dependencies:
       '@standard-schema/utils': 0.3.0
-      react-hook-form: 7.62.0(react@19.2.6)
+      react-hook-form: 7.62.0(react@19.2.7)
 
   '@humanfs/core@0.19.1': {}
 
@@ -10653,10 +10651,10 @@ snapshots:
 
   '@humanwhocodes/retry@0.4.3': {}
 
-  '@iconify/react@5.2.1(react@19.2.6)':
+  '@iconify/react@5.2.1(react@19.2.7)':
     dependencies:
       '@iconify/types': 2.0.0
-      react: 19.2.6
+      react: 19.2.7
 
   '@iconify/types@2.0.0': {}
 
@@ -10949,7 +10947,7 @@ snapshots:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       uuid: 11.1.1
 
-  '@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)':
+  '@langchain/langgraph-sdk@1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)':
     dependencies:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       '@langchain/protocol': 0.0.15
@@ -10958,8 +10956,8 @@ snapshots:
       p-retry: 7.1.1
       uuid: 11.1.1
     optionalDependencies:
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@opentelemetry/api'
       - '@opentelemetry/exporter-trace-otlp-proto'
@@ -10967,11 +10965,11 @@ snapshots:
       - openai
       - ws
 
-  '@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)':
+  '@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)':
     dependencies:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))
-      '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)
+      '@langchain/langgraph-sdk': 1.9.2(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)
       '@langchain/protocol': 0.0.15
       '@standard-schema/spec': 1.1.0
       uuid: 11.1.1
@@ -10989,10 +10987,10 @@ snapshots:
       - vue
       - ws
 
-  '@langchain/mcp-adapters@1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))':
+  '@langchain/mcp-adapters@1.1.3(@cfworker/json-schema@4.1.1)(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@langchain/langgraph@1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3))':
     dependencies:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
-      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
+      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
       '@modelcontextprotocol/sdk': 1.26.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)
       debug: 4.4.3
       zod: 4.4.3
@@ -11033,7 +11031,7 @@ snapshots:
 
   '@modelcontextprotocol/sdk@1.26.0(@cfworker/json-schema@4.1.1)(zod@4.4.3)':
     dependencies:
-      '@hono/node-server': 1.19.14(hono@4.12.18)
+      '@hono/node-server': 1.19.14(hono@4.12.21)
       ajv: 8.18.0
       ajv-formats: 3.0.1(ajv@8.18.0)
       content-type: 1.0.5
@@ -11043,7 +11041,7 @@ snapshots:
       eventsource-parser: 3.0.6
       express: 5.2.1
       express-rate-limit: 8.5.1(express@5.2.1)
-      hono: 4.12.18
+      hono: 4.12.21
       jose: 6.1.3
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
@@ -11073,40 +11071,40 @@ snapshots:
 
   '@ndaidong/bellajs@12.0.1': {}
 
-  '@next/env@16.2.6': {}
+  '@next/env@16.2.9': {}
 
-  '@next/eslint-plugin-next@16.2.6':
+  '@next/eslint-plugin-next@16.2.9':
     dependencies:
       fast-glob: 3.3.1
 
-  '@next/swc-darwin-arm64@16.2.6':
+  '@next/swc-darwin-arm64@16.2.9':
     optional: true
 
-  '@next/swc-darwin-x64@16.2.6':
+  '@next/swc-darwin-x64@16.2.9':
     optional: true
 
-  '@next/swc-linux-arm64-gnu@16.2.6':
+  '@next/swc-linux-arm64-gnu@16.2.9':
     optional: true
 
-  '@next/swc-linux-arm64-musl@16.2.6':
+  '@next/swc-linux-arm64-musl@16.2.9':
     optional: true
 
-  '@next/swc-linux-x64-gnu@16.2.6':
+  '@next/swc-linux-x64-gnu@16.2.9':
     optional: true
 
-  '@next/swc-linux-x64-musl@16.2.6':
+  '@next/swc-linux-x64-musl@16.2.9':
     optional: true
 
-  '@next/swc-win32-arm64-msvc@16.2.6':
+  '@next/swc-win32-arm64-msvc@16.2.9':
     optional: true
 
-  '@next/swc-win32-x64-msvc@16.2.6':
+  '@next/swc-win32-x64-msvc@16.2.9':
     optional: true
 
-  '@next/third-parties@16.2.6(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)':
+  '@next/third-parties@16.2.9(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)':
     dependencies:
-      next: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
+      next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
       third-party-capital: 1.0.20
 
   '@nodable/entities@2.1.0': {}
@@ -11528,1678 +11526,1678 @@ snapshots:
 
   '@radix-ui/primitive@1.1.3': {}
 
-  '@radix-ui/react-alert-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-alert-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-avatar@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-avatar@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-context': 1.1.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-context': 1.1.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-is-hydrated': 0.1.0(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-checkbox@1.3.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-checkbox@1.3.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-collapsible@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-context@1.1.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-context@1.1.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-context@1.1.3(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-context@1.1.3(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dialog@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
       aria-hidden: 1.2.6
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-direction@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-direction@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-dismissable-layer@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dismissable-layer@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-dropdown-menu@2.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-dropdown-menu@2.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-menu': 2.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-menu': 2.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-focus-guards@1.1.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-focus-guards@1.1.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-icons@1.3.2(react@19.2.6)':
+  '@radix-ui/react-icons@1.3.2(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@radix-ui/react-id@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-id@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-label@2.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-label@2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-menu@2.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-menu@2.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-popper': 1.2.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-roving-focus': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-popper': 1.2.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-roving-focus': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
       aria-hidden: 1.2.6
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-popover@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
       aria-hidden: 1.2.6
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-popper@1.2.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-popper@1.2.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.8)(react@19.2.6)
+      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
       '@radix-ui/rect': 1.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.8)(react@19.2.6)
+      '@floating-ui/react-dom': 2.1.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
       '@radix-ui/rect': 1.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-presence@1.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-presence@1.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-primitive@2.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-primitive@2.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.4(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-slot': 1.2.4(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-progress@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-progress@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-radio-group@1.3.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-roving-focus@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-roving-focus@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-roving-focus@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-scroll-area@1.2.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-select@2.2.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-select@2.2.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-popper': 1.2.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-focus-guards': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-popper': 1.2.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       aria-hidden: 1.2.6
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-remove-scroll: 2.7.2(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-slot@1.2.3(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-slot@1.2.3(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-slot@1.2.4(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-slot@1.2.4(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-tabs@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-roving-focus': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-toast@1.2.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-toast@1.2.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.2
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-tooltip@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
-  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-is-hydrated@0.1.0(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      react: 19.2.7
+      use-sync-external-store: 1.6.0(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-previous@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-rect@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
       '@radix-ui/rect': 1.1.1
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.8)(react@19.2.6)':
+  '@radix-ui/react-use-size@1.1.1(@types/react@19.2.17)(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      react: 19.2.6
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
   '@radix-ui/rect@1.1.1': {}
 
-  '@react-aria/breadcrumbs@3.5.28(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/breadcrumbs@3.5.28(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/link': 3.8.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/breadcrumbs': 3.7.16(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/link': 3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/breadcrumbs': 3.7.16(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/button@3.14.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/button@3.14.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/toolbar': 3.0.0-beta.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/toolbar': 3.0.0-beta.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/calendar@3.9.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/calendar@3.9.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/calendar': 3.8.4(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/calendar': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/calendar': 3.8.4(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/calendar': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/checkbox@3.16.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/checkbox@3.16.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/toggle': 3.12.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/checkbox': 3.7.1(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-types/checkbox': 3.10.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/toggle': 3.12.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/checkbox': 3.7.1(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-types/checkbox': 3.10.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/combobox@3.13.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/combobox@3.13.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/listbox': 3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/listbox': 3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/menu': 3.19.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.31.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/textfield': 3.18.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/combobox': 3.11.1(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/combobox': 3.13.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/menu': 3.19.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/textfield': 3.18.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/combobox': 3.11.1(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/combobox': 3.13.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/datepicker@3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/datepicker@3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/number': 3.6.5
       '@internationalized/string': 3.2.7
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/spinbutton': 3.7.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/datepicker': 3.15.1(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/calendar': 3.8.1(react@19.2.6)
-      '@react-types/datepicker': 3.13.2(react@19.2.6)
-      '@react-types/dialog': 3.5.22(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/spinbutton': 3.7.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/datepicker': 3.15.1(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/calendar': 3.8.1(react@19.2.7)
+      '@react-types/datepicker': 3.13.2(react@19.2.7)
+      '@react-types/dialog': 3.5.22(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/dialog@3.5.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/dialog@3.5.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/dialog': 3.5.22(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/dialog': 3.5.22(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/focus@3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/focus@3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
       clsx: 2.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/focus@3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/focus@3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
       clsx: 2.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/form@3.1.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/form@3.1.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/form@3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/form@3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/grid@3.14.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/grid@3.14.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/grid': 3.11.7(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/grid': 3.3.6(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/grid': 3.11.7(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/grid': 3.3.6(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/i18n@3.12.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/i18n@3.12.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/message': 3.1.8
       '@internationalized/number': 3.6.5
       '@internationalized/string': 3.2.7
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/i18n@3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/i18n@3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/message': 3.1.8
       '@internationalized/number': 3.6.5
       '@internationalized/string': 3.2.7
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/i18n@3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/i18n@3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/message': 3.1.8
       '@internationalized/number': 3.6.5
       '@internationalized/string': 3.2.7
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/interactions@3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/interactions@3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/interactions@3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/interactions@3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.18
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/label@3.7.21(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/label@3.7.21(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/label@3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/label@3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/landmark@3.0.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/landmark@3.0.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      use-sync-external-store: 1.6.0(react@19.2.7)
 
-  '@react-aria/link@3.8.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/link@3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/link': 3.6.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/link': 3.6.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/listbox@3.14.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/listbox@3.14.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/list': 3.13.0(react@19.2.6)
-      '@react-types/listbox': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/list': 3.13.0(react@19.2.7)
+      '@react-types/listbox': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/listbox@3.15.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/listbox@3.15.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/list': 3.13.2(react@19.2.6)
-      '@react-types/listbox': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/list': 3.13.2(react@19.2.7)
+      '@react-types/listbox': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   '@react-aria/live-announcer@3.4.4':
     dependencies:
       '@swc/helpers': 0.5.21
 
-  '@react-aria/menu@3.19.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/menu@3.19.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.31.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/menu': 3.9.9(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/tree': 3.9.2(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/menu': 3.10.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/menu': 3.9.9(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/tree': 3.9.2(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/menu': 3.10.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/menu@3.19.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/menu@3.19.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/overlays': 3.31.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/menu': 3.9.9(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/tree': 3.9.4(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/menu': 3.10.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/overlays': 3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/menu': 3.9.9(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/tree': 3.9.4(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/menu': 3.10.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/numberfield@3.12.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/numberfield@3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/spinbutton': 3.7.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/textfield': 3.18.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/numberfield': 3.10.1(react@19.2.6)
-      '@react-types/button': 3.14.0(react@19.2.6)
-      '@react-types/numberfield': 3.8.14(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/spinbutton': 3.7.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/textfield': 3.18.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/numberfield': 3.10.1(react@19.2.7)
+      '@react-types/button': 3.14.0(react@19.2.7)
+      '@react-types/numberfield': 3.8.14(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/overlays@3.29.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/overlays@3.29.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.19(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.19(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/overlays@3.31.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/overlays@3.31.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/progress@3.4.26(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/progress@3.4.26(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/progress': 3.5.15(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/progress': 3.5.15(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/radio@3.12.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/radio@3.12.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/radio': 3.11.1(react@19.2.6)
-      '@react-types/radio': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/radio': 3.11.1(react@19.2.7)
+      '@react-types/radio': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/selection@3.25.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/selection@3.25.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/selection@3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/selection@3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/slider@3.8.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/slider@3.8.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/slider': 3.7.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/slider': 3.8.2(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/slider': 3.7.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/slider': 3.8.2(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/spinbutton@3.7.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/spinbutton@3.7.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.14(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/i18n': 3.12.14(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/ssr@3.9.10(react@19.2.6)':
+  '@react-aria/ssr@3.9.10(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-aria/ssr@3.9.4(react@19.2.6)':
+  '@react-aria/ssr@3.9.4(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-aria/switch@3.7.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/switch@3.7.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/toggle': 3.12.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/switch': 3.5.15(react@19.2.6)
+      '@react-aria/toggle': 3.12.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/switch': 3.5.15(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/table@3.17.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/table@3.17.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/grid': 3.14.6(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/grid': 3.14.6(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       '@react-aria/live-announcer': 3.4.4
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/collections': 3.12.8(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/visually-hidden': 3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-stately/table': 3.15.0(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/grid': 3.3.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/table': 3.13.3(react@19.2.6)
+      '@react-stately/table': 3.15.0(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/grid': 3.3.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/table': 3.13.3(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/tabs@3.10.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/tabs@3.10.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/selection': 3.27.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tabs': 3.8.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/tabs': 3.3.20(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/selection': 3.27.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tabs': 3.8.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/tabs': 3.3.20(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/textfield@3.18.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/textfield@3.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/textfield': 3.12.5(react@19.2.6)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/textfield': 3.12.5(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/textfield@3.18.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/textfield@3.18.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/form': 3.1.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/label': 3.7.23(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/textfield': 3.12.6(react@19.2.6)
+      '@react-aria/form': 3.1.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/label': 3.7.23(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/textfield': 3.12.6(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/toast@3.0.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/toast@3.0.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/interactions': 3.25.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/landmark': 3.0.8(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toast': 3.1.2(react@19.2.6)
-      '@react-types/button': 3.14.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/interactions': 3.25.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/landmark': 3.0.8(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toast': 3.1.2(react@19.2.7)
+      '@react-types/button': 3.14.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/toggle@3.12.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/toggle@3.12.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/toggle': 3.9.3(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/toggle': 3.9.3(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/toolbar@3.0.0-beta.20(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/toolbar@3.0.0-beta.20(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/focus': 3.21.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/i18n': 3.12.13(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/focus': 3.21.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/i18n': 3.12.13(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/tooltip@3.8.7(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/tooltip@3.8.7(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-stately/tooltip': 3.5.7(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/tooltip': 3.4.20(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-stately/tooltip': 3.5.7(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/tooltip': 3.4.20(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/utils@3.30.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/utils@3.30.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
       clsx: 2.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/utils@3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/utils@3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/ssr': 3.9.10(react@19.2.6)
+      '@react-aria/ssr': 3.9.10(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.18
       clsx: 2.1.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/visually-hidden@3.8.12(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/visually-hidden@3.8.12(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
     transitivePeerDependencies:
       - react-dom
 
-  '@react-aria/visually-hidden@3.8.27(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/visually-hidden@3.8.27(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.18
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-aria/visually-hidden@3.8.29(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-aria/visually-hidden@3.8.29(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/interactions': 3.26.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/interactions': 3.26.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-stately/calendar@3.8.4(react@19.2.6)':
+  '@react-stately/calendar@3.8.4(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/calendar': 3.7.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/calendar': 3.7.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/checkbox@3.7.1(react@19.2.6)':
+  '@react-stately/checkbox@3.7.1(react@19.2.7)':
     dependencies:
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/checkbox': 3.10.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/checkbox': 3.10.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/collections@3.12.7(react@19.2.6)':
+  '@react-stately/collections@3.12.7(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/collections@3.12.8(react@19.2.6)':
+  '@react-stately/collections@3.12.8(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/combobox@3.11.1(react@19.2.6)':
+  '@react-stately/combobox@3.11.1(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/list': 3.13.2(react@19.2.6)
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-stately/select': 3.9.0(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/combobox': 3.13.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/list': 3.13.2(react@19.2.7)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-stately/select': 3.9.0(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/combobox': 3.13.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/datepicker@3.15.1(react@19.2.6)':
+  '@react-stately/datepicker@3.15.1(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
       '@internationalized/string': 3.2.7
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/datepicker': 3.13.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/datepicker': 3.13.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
   '@react-stately/flags@3.1.2':
     dependencies:
       '@swc/helpers': 0.5.18
 
-  '@react-stately/form@3.2.1(react@19.2.6)':
+  '@react-stately/form@3.2.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/form@3.2.2(react@19.2.6)':
+  '@react-stately/form@3.2.2(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/grid@3.11.7(react@19.2.6)':
+  '@react-stately/grid@3.11.7(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-types/grid': 3.3.6(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-types/grid': 3.3.6(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/list@3.13.0(react@19.2.6)':
+  '@react-stately/list@3.13.0(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/list@3.13.2(react@19.2.6)':
+  '@react-stately/list@3.13.2(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/menu@3.9.7(react@19.2.6)':
+  '@react-stately/menu@3.9.7(react@19.2.7)':
     dependencies:
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-types/menu': 3.10.4(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-types/menu': 3.10.4(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/menu@3.9.9(react@19.2.6)':
+  '@react-stately/menu@3.9.9(react@19.2.7)':
     dependencies:
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-types/menu': 3.10.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-types/menu': 3.10.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/numberfield@3.10.1(react@19.2.6)':
+  '@react-stately/numberfield@3.10.1(react@19.2.7)':
     dependencies:
       '@internationalized/number': 3.6.5
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/numberfield': 3.8.14(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/numberfield': 3.8.14(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/overlays@3.6.19(react@19.2.6)':
+  '@react-stately/overlays@3.6.19(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/overlays@3.6.21(react@19.2.6)':
+  '@react-stately/overlays@3.6.21(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/radio@3.11.1(react@19.2.6)':
+  '@react-stately/radio@3.11.1(react@19.2.7)':
     dependencies:
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/radio': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/radio': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/select@3.9.0(react@19.2.6)':
+  '@react-stately/select@3.9.0(react@19.2.7)':
     dependencies:
-      '@react-stately/form': 3.2.2(react@19.2.6)
-      '@react-stately/list': 3.13.2(react@19.2.6)
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/select': 3.12.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/form': 3.2.2(react@19.2.7)
+      '@react-stately/list': 3.13.2(react@19.2.7)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/select': 3.12.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/selection@3.20.7(react@19.2.6)':
+  '@react-stately/selection@3.20.7(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/slider@3.7.1(react@19.2.6)':
+  '@react-stately/slider@3.7.1(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/slider': 3.8.2(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/slider': 3.8.2(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/table@3.15.0(react@19.2.6)':
+  '@react-stately/table@3.15.0(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
       '@react-stately/flags': 3.1.2
-      '@react-stately/grid': 3.11.7(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/grid': 3.3.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/table': 3.13.3(react@19.2.6)
+      '@react-stately/grid': 3.11.7(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/grid': 3.3.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/table': 3.13.3(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/tabs@3.8.5(react@19.2.6)':
+  '@react-stately/tabs@3.8.5(react@19.2.7)':
     dependencies:
-      '@react-stately/list': 3.13.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      '@react-types/tabs': 3.3.20(react@19.2.6)
+      '@react-stately/list': 3.13.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      '@react-types/tabs': 3.3.20(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/toast@3.1.2(react@19.2.6)':
+  '@react-stately/toast@3.1.2(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      react: 19.2.7
+      use-sync-external-store: 1.6.0(react@19.2.7)
 
-  '@react-stately/toggle@3.9.1(react@19.2.6)':
+  '@react-stately/toggle@3.9.1(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/toggle@3.9.3(react@19.2.6)':
+  '@react-stately/toggle@3.9.3(react@19.2.7)':
     dependencies:
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/checkbox': 3.10.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/checkbox': 3.10.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/tooltip@3.5.7(react@19.2.6)':
+  '@react-stately/tooltip@3.5.7(react@19.2.7)':
     dependencies:
-      '@react-stately/overlays': 3.6.21(react@19.2.6)
-      '@react-types/tooltip': 3.4.20(react@19.2.6)
+      '@react-stately/overlays': 3.6.21(react@19.2.7)
+      '@react-types/tooltip': 3.4.20(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/tree@3.9.2(react@19.2.6)':
+  '@react-stately/tree@3.9.2(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.10.8(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.10.8(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/tree@3.9.4(react@19.2.6)':
+  '@react-stately/tree@3.9.4(react@19.2.7)':
     dependencies:
-      '@react-stately/collections': 3.12.8(react@19.2.6)
-      '@react-stately/selection': 3.20.7(react@19.2.6)
-      '@react-stately/utils': 3.11.0(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-stately/collections': 3.12.8(react@19.2.7)
+      '@react-stately/selection': 3.20.7(react@19.2.7)
+      '@react-stately/utils': 3.11.0(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/utils@3.10.8(react@19.2.6)':
+  '@react-stately/utils@3.10.8(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/utils@3.11.0(react@19.2.6)':
+  '@react-stately/utils@3.11.0(react@19.2.7)':
     dependencies:
       '@swc/helpers': 0.5.18
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-stately/virtualizer@4.4.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@react-stately/virtualizer@4.4.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
-      '@react-aria/utils': 3.32.0(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
+      '@react-aria/utils': 3.32.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
       '@swc/helpers': 0.5.21
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@react-types/accordion@3.0.0-alpha.26(react@19.2.6)':
+  '@react-types/accordion@3.0.0-alpha.26(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/breadcrumbs@3.7.16(react@19.2.6)':
+  '@react-types/breadcrumbs@3.7.16(react@19.2.7)':
     dependencies:
-      '@react-types/link': 3.6.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/link': 3.6.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/button@3.14.0(react@19.2.6)':
+  '@react-types/button@3.14.0(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/button@3.14.1(react@19.2.6)':
+  '@react-types/button@3.14.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/calendar@3.7.4(react@19.2.6)':
+  '@react-types/calendar@3.7.4(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/calendar@3.8.1(react@19.2.6)':
+  '@react-types/calendar@3.8.1(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/checkbox@3.10.1(react@19.2.6)':
+  '@react-types/checkbox@3.10.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/checkbox@3.10.2(react@19.2.6)':
+  '@react-types/checkbox@3.10.2(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/combobox@3.13.8(react@19.2.6)':
+  '@react-types/combobox@3.13.8(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/datepicker@3.13.1(react@19.2.6)':
+  '@react-types/datepicker@3.13.1(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-types/calendar': 3.8.1(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/calendar': 3.8.1(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/datepicker@3.13.2(react@19.2.6)':
+  '@react-types/datepicker@3.13.2(react@19.2.7)':
     dependencies:
       '@internationalized/date': 3.10.0
-      '@react-types/calendar': 3.8.1(react@19.2.6)
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/calendar': 3.8.1(react@19.2.7)
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/dialog@3.5.22(react@19.2.6)':
+  '@react-types/dialog@3.5.22(react@19.2.7)':
     dependencies:
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/form@3.7.15(react@19.2.6)':
+  '@react-types/form@3.7.15(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/grid@3.3.5(react@19.2.6)':
+  '@react-types/grid@3.3.5(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/grid@3.3.6(react@19.2.6)':
+  '@react-types/grid@3.3.6(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/link@3.6.4(react@19.2.6)':
+  '@react-types/link@3.6.4(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/link@3.6.5(react@19.2.6)':
+  '@react-types/link@3.6.5(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/listbox@3.7.4(react@19.2.6)':
+  '@react-types/listbox@3.7.4(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/menu@3.10.4(react@19.2.6)':
+  '@react-types/menu@3.10.4(react@19.2.7)':
     dependencies:
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/menu@3.10.5(react@19.2.6)':
+  '@react-types/menu@3.10.5(react@19.2.7)':
     dependencies:
-      '@react-types/overlays': 3.9.2(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/overlays': 3.9.2(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/numberfield@3.8.14(react@19.2.6)':
+  '@react-types/numberfield@3.8.14(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/overlays@3.9.1(react@19.2.6)':
+  '@react-types/overlays@3.9.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/overlays@3.9.2(react@19.2.6)':
+  '@react-types/overlays@3.9.2(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/progress@3.5.15(react@19.2.6)':
+  '@react-types/progress@3.5.15(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/radio@3.9.1(react@19.2.6)':
+  '@react-types/radio@3.9.1(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/select@3.12.0(react@19.2.6)':
+  '@react-types/select@3.12.0(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/shared@3.26.0(react@19.2.6)':
+  '@react-types/shared@3.26.0(react@19.2.7)':
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  '@react-types/slider@3.8.2(react@19.2.6)':
+  '@react-types/slider@3.8.2(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/switch@3.5.15(react@19.2.6)':
+  '@react-types/switch@3.5.15(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/table@3.13.3(react@19.2.6)':
+  '@react-types/table@3.13.3(react@19.2.7)':
     dependencies:
-      '@react-types/grid': 3.3.5(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/grid': 3.3.5(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/tabs@3.3.20(react@19.2.6)':
+  '@react-types/tabs@3.3.20(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/textfield@3.12.5(react@19.2.6)':
+  '@react-types/textfield@3.12.5(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/textfield@3.12.6(react@19.2.6)':
+  '@react-types/textfield@3.12.6(react@19.2.7)':
     dependencies:
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
-  '@react-types/tooltip@3.4.20(react@19.2.6)':
+  '@react-types/tooltip@3.4.20(react@19.2.7)':
     dependencies:
-      '@react-types/overlays': 3.9.1(react@19.2.6)
-      '@react-types/shared': 3.26.0(react@19.2.6)
-      react: 19.2.6
+      '@react-types/overlays': 3.9.1(react@19.2.7)
+      '@react-types/shared': 3.26.0(react@19.2.7)
+      react: 19.2.7
 
   '@rolldown/pluginutils@1.0.0-beta.53': {}
 
@@ -13386,7 +13384,7 @@ snapshots:
 
   '@sentry/core@10.27.0': {}
 
-  '@sentry/nextjs@10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))':
+  '@sentry/nextjs@10.27.0(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))':
     dependencies:
       '@opentelemetry/api': 1.9.0
       '@opentelemetry/semantic-conventions': 1.39.0
@@ -13396,10 +13394,10 @@ snapshots:
       '@sentry/core': 10.27.0
       '@sentry/node': 10.27.0
       '@sentry/opentelemetry': 10.27.0(@opentelemetry/api@1.9.0)(@opentelemetry/context-async-hooks@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/core@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(@opentelemetry/semantic-conventions@1.39.0)
-      '@sentry/react': 10.27.0(react@19.2.6)
+      '@sentry/react': 10.27.0(react@19.2.7)
       '@sentry/vercel-edge': 10.27.0
       '@sentry/webpack-plugin': 4.7.0(webpack@5.104.1(lightningcss@1.30.2)(postcss@8.5.14))
-      next: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       resolve: 1.22.8
       rollup: 4.59.0
       stacktrace-parser: 0.1.11
@@ -13477,12 +13475,12 @@ snapshots:
       '@opentelemetry/semantic-conventions': 1.39.0
       '@sentry/core': 10.27.0
 
-  '@sentry/react@10.27.0(react@19.2.6)':
+  '@sentry/react@10.27.0(react@19.2.7)':
     dependencies:
       '@sentry/browser': 10.27.0
       '@sentry/core': 10.27.0
       hoist-non-react-statics: 3.3.2
-      react: 19.2.6
+      react: 19.2.7
 
   '@sentry/vercel-edge@10.27.0':
     dependencies:
@@ -13830,17 +13828,17 @@ snapshots:
       postcss-selector-parser: 6.0.10
       tailwindcss: 4.1.18
 
-  '@tanstack/react-table@8.21.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@tanstack/react-table@8.21.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@tanstack/table-core': 8.21.3
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  '@tanstack/react-virtual@3.11.3(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@tanstack/react-virtual@3.11.3(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@tanstack/virtual-core': 3.11.3
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   '@tanstack/table-core@8.21.3': {}
 
@@ -13866,15 +13864,15 @@ snapshots:
       picocolors: 1.1.1
       redent: 3.0.0
 
-  '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@testing-library/react@16.3.2(@testing-library/dom@10.4.1)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@babel/runtime': 7.28.6
       '@testing-library/dom': 10.4.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
   '@testing-library/user-event@14.6.1(@testing-library/dom@10.4.1)':
     dependencies:
@@ -14094,11 +14092,11 @@ snapshots:
       pg-protocol: 1.11.0
       pg-types: 2.2.0
 
-  '@types/react-dom@19.2.3(@types/react@19.2.8)':
+  '@types/react-dom@19.2.3(@types/react@19.2.17)':
     dependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  '@types/react@19.2.8':
+  '@types/react@19.2.17':
     dependencies:
       csstype: 3.2.3
 
@@ -14229,7 +14227,7 @@ snapshots:
       '@codemirror/state': 6.6.0
       '@codemirror/view': 6.40.0
 
-  '@uiw/react-codemirror@4.25.8(@babel/runtime@7.28.6)(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.40.0)(codemirror@6.0.2)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@uiw/react-codemirror@4.25.8(@babel/runtime@7.28.6)(@codemirror/autocomplete@6.20.1)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/theme-one-dark@6.1.3)(@codemirror/view@6.40.0)(codemirror@6.0.2)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@babel/runtime': 7.28.6
       '@codemirror/commands': 6.10.3
@@ -14238,8 +14236,8 @@ snapshots:
       '@codemirror/view': 6.40.0
       '@uiw/codemirror-extensions-basic-setup': 4.25.8(@codemirror/autocomplete@6.20.1)(@codemirror/commands@6.10.3)(@codemirror/language@6.12.2)(@codemirror/lint@6.9.5)(@codemirror/search@6.6.0)(@codemirror/state@6.6.0)(@codemirror/view@6.40.0)
       codemirror: 6.0.2
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@codemirror/autocomplete'
       - '@codemirror/language'
@@ -14253,7 +14251,7 @@ snapshots:
       d3-selection: 3.0.0
       d3-transition: 3.0.1(d3-selection@3.0.0)
 
-  '@vercel/oidc@3.0.5': {}
+  '@vercel/oidc@3.2.0': {}
 
   '@vitejs/plugin-react@5.1.2(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))':
     dependencies:
@@ -14435,13 +14433,13 @@ snapshots:
 
   '@xtuc/long@4.2.2': {}
 
-  '@xyflow/react@12.10.2(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)':
+  '@xyflow/react@12.10.2(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
     dependencies:
       '@xyflow/system': 0.0.76
       classcat: 5.0.5
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      zustand: 4.5.7(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      zustand: 4.5.7(@types/react@19.2.17)(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
       - immer
@@ -14487,11 +14485,11 @@ snapshots:
 
   agent-base@7.1.4: {}
 
-  ai@5.0.109(zod@4.4.3):
+  ai@6.0.203(zod@4.4.3):
     dependencies:
-      '@ai-sdk/gateway': 2.0.18(zod@4.4.3)
-      '@ai-sdk/provider': 2.0.0
-      '@ai-sdk/provider-utils': 3.0.18(zod@4.4.3)
+      '@ai-sdk/gateway': 3.0.129(zod@4.4.3)
+      '@ai-sdk/provider': 3.0.10
+      '@ai-sdk/provider-utils': 4.0.29(zod@4.4.3)
       '@opentelemetry/api': 1.9.0
       zod: 4.4.3
 
@@ -14656,7 +14654,7 @@ snapshots:
       http-errors: 2.0.1
       iconv-lite: 0.7.2
       on-finished: 2.4.1
-      qs: 6.14.2
+      qs: 6.15.2
       raw-body: 3.0.2
       type-is: 2.0.1
     transitivePeerDependencies:
@@ -14773,14 +14771,14 @@ snapshots:
 
   clsx@2.1.1: {}
 
-  cmdk@1.1.1(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  cmdk@1.1.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.8)(react@19.2.6)
-      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -15306,34 +15304,34 @@ snapshots:
 
   es-toolkit@1.46.1: {}
 
-  esbuild@0.27.7:
+  esbuild@0.28.1:
     optionalDependencies:
-      '@esbuild/aix-ppc64': 0.27.7
-      '@esbuild/android-arm': 0.27.7
-      '@esbuild/android-arm64': 0.27.7
-      '@esbuild/android-x64': 0.27.7
-      '@esbuild/darwin-arm64': 0.27.7
-      '@esbuild/darwin-x64': 0.27.7
-      '@esbuild/freebsd-arm64': 0.27.7
-      '@esbuild/freebsd-x64': 0.27.7
-      '@esbuild/linux-arm': 0.27.7
-      '@esbuild/linux-arm64': 0.27.7
-      '@esbuild/linux-ia32': 0.27.7
-      '@esbuild/linux-loong64': 0.27.7
-      '@esbuild/linux-mips64el': 0.27.7
-      '@esbuild/linux-ppc64': 0.27.7
-      '@esbuild/linux-riscv64': 0.27.7
-      '@esbuild/linux-s390x': 0.27.7
-      '@esbuild/linux-x64': 0.27.7
-      '@esbuild/netbsd-arm64': 0.27.7
-      '@esbuild/netbsd-x64': 0.27.7
-      '@esbuild/openbsd-arm64': 0.27.7
-      '@esbuild/openbsd-x64': 0.27.7
-      '@esbuild/openharmony-arm64': 0.27.7
-      '@esbuild/sunos-x64': 0.27.7
-      '@esbuild/win32-arm64': 0.27.7
-      '@esbuild/win32-ia32': 0.27.7
-      '@esbuild/win32-x64': 0.27.7
+      '@esbuild/aix-ppc64': 0.28.1
+      '@esbuild/android-arm': 0.28.1
+      '@esbuild/android-arm64': 0.28.1
+      '@esbuild/android-x64': 0.28.1
+      '@esbuild/darwin-arm64': 0.28.1
+      '@esbuild/darwin-x64': 0.28.1
+      '@esbuild/freebsd-arm64': 0.28.1
+      '@esbuild/freebsd-x64': 0.28.1
+      '@esbuild/linux-arm': 0.28.1
+      '@esbuild/linux-arm64': 0.28.1
+      '@esbuild/linux-ia32': 0.28.1
+      '@esbuild/linux-loong64': 0.28.1
+      '@esbuild/linux-mips64el': 0.28.1
+      '@esbuild/linux-ppc64': 0.28.1
+      '@esbuild/linux-riscv64': 0.28.1
+      '@esbuild/linux-s390x': 0.28.1
+      '@esbuild/linux-x64': 0.28.1
+      '@esbuild/netbsd-arm64': 0.28.1
+      '@esbuild/netbsd-x64': 0.28.1
+      '@esbuild/openbsd-arm64': 0.28.1
+      '@esbuild/openbsd-x64': 0.28.1
+      '@esbuild/openharmony-arm64': 0.28.1
+      '@esbuild/sunos-x64': 0.28.1
+      '@esbuild/win32-arm64': 0.28.1
+      '@esbuild/win32-ia32': 0.28.1
+      '@esbuild/win32-x64': 0.28.1
 
   escalade@3.2.0: {}
 
@@ -15516,9 +15514,11 @@ snapshots:
 
   eventsource-parser@3.0.6: {}
 
+  eventsource-parser@3.1.0: {}
+
   eventsource@3.0.7:
     dependencies:
-      eventsource-parser: 3.0.6
+      eventsource-parser: 3.1.0
 
   expect-type@1.3.0: {}
 
@@ -15549,7 +15549,7 @@ snapshots:
       once: 1.4.0
       parseurl: 1.3.3
       proxy-addr: 2.0.7
-      qs: 6.14.2
+      qs: 6.15.2
       range-parser: 1.2.1
       router: 2.2.0
       send: 1.2.1
@@ -15678,14 +15678,14 @@ snapshots:
 
   forwarded@0.2.0: {}
 
-  framer-motion@11.18.2(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  framer-motion@11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       motion-dom: 11.18.1
       motion-utils: 11.18.1
       tslib: 2.8.1
     optionalDependencies:
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   fresh@2.0.0: {}
 
@@ -15943,7 +15943,7 @@ snapshots:
     dependencies:
       react-is: 16.13.1
 
-  hono@4.12.18: {}
+  hono@4.12.21: {}
 
   html-encoding-sniffer@6.0.0:
     dependencies:
@@ -16020,10 +16020,10 @@ snapshots:
 
   inline-style-parser@0.2.7: {}
 
-  input-otp@1.4.1(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  input-otp@1.4.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
   internal-slot@1.1.0:
     dependencies:
@@ -16327,10 +16327,10 @@ snapshots:
       - '@emnapi/core'
       - '@emnapi/runtime'
 
-  langchain@1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3)):
+  langchain@1.4.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3)):
     dependencies:
       '@langchain/core': 1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
-      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
+      '@langchain/langgraph': 1.3.0(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(ws@8.20.1)(zod-to-json-schema@3.25.1(zod@4.4.3))(zod@4.4.3)
       '@langchain/langgraph-checkpoint': 1.0.2(@langchain/core@1.1.45(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1))
       langsmith: 0.6.3(@opentelemetry/api@1.9.0)(@opentelemetry/sdk-trace-base@2.4.0(@opentelemetry/api@1.9.0))(openai@6.37.0(ws@8.20.1)(zod@4.4.3))(ws@8.20.1)
       zod: 4.4.3
@@ -16449,13 +16449,13 @@ snapshots:
     dependencies:
       yallist: 3.1.1
 
-  lucide-react@0.542.0(react@19.2.6):
+  lucide-react@0.542.0(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  lucide-react@0.543.0(react@19.2.6):
+  lucide-react@0.543.0(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   lz-string@1.5.0: {}
 
@@ -17008,37 +17008,37 @@ snapshots:
 
   neo-async@2.6.2: {}
 
-  next-auth@5.0.0-beta.30(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react@19.2.6):
+  next-auth@5.0.0-beta.30(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7):
     dependencies:
       '@auth/core': 0.41.0
-      next: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
+      next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
 
-  next-themes@0.2.1(next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6))(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  next-themes@0.2.1(next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      next: 16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      next: 16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  next@16.2.6(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  next@16.2.9(@babel/core@7.28.6)(@opentelemetry/api@1.9.0)(@playwright/test@1.56.1)(babel-plugin-react-compiler@1.0.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      '@next/env': 16.2.6
+      '@next/env': 16.2.9
       '@swc/helpers': 0.5.15
       baseline-browser-mapping: 2.10.29
       caniuse-lite: 1.0.30001792
-      postcss: 8.4.31
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      styled-jsx: 5.1.6(@babel/core@7.28.6)(react@19.2.6)
+      postcss: 8.5.14
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      styled-jsx: 5.1.6(@babel/core@7.28.6)(react@19.2.7)
     optionalDependencies:
-      '@next/swc-darwin-arm64': 16.2.6
-      '@next/swc-darwin-x64': 16.2.6
-      '@next/swc-linux-arm64-gnu': 16.2.6
-      '@next/swc-linux-arm64-musl': 16.2.6
-      '@next/swc-linux-x64-gnu': 16.2.6
-      '@next/swc-linux-x64-musl': 16.2.6
-      '@next/swc-win32-arm64-msvc': 16.2.6
-      '@next/swc-win32-x64-msvc': 16.2.6
+      '@next/swc-darwin-arm64': 16.2.9
+      '@next/swc-darwin-x64': 16.2.9
+      '@next/swc-linux-arm64-gnu': 16.2.9
+      '@next/swc-linux-arm64-musl': 16.2.9
+      '@next/swc-linux-x64-gnu': 16.2.9
+      '@next/swc-linux-x64-musl': 16.2.9
+      '@next/swc-win32-arm64-msvc': 16.2.9
+      '@next/swc-win32-x64-msvc': 16.2.9
       '@opentelemetry/api': 1.9.0
       '@playwright/test': 1.56.1
       babel-plugin-react-compiler: 1.0.0
@@ -17318,12 +17318,6 @@ snapshots:
       cssesc: 3.0.0
       util-deprecate: 1.0.2
 
-  postcss@8.4.31:
-    dependencies:
-      nanoid: 3.3.12
-      picocolors: 1.1.1
-      source-map-js: 1.2.1
-
   postcss@8.5.14:
     dependencies:
       nanoid: 3.3.12
@@ -17389,7 +17383,7 @@ snapshots:
 
   punycode@2.3.1: {}
 
-  qs@6.14.2:
+  qs@6.15.2:
     dependencies:
       side-channel: 1.1.0
 
@@ -17404,21 +17398,21 @@ snapshots:
       iconv-lite: 0.7.2
       unpipe: 1.0.0
 
-  react-day-picker@9.13.0(react@19.2.6):
+  react-day-picker@9.13.0(react@19.2.7):
     dependencies:
       '@date-fns/tz': 1.4.1
       date-fns: 4.1.0
       date-fns-jalali: 4.1.0-0
-      react: 19.2.6
+      react: 19.2.7
 
-  react-dom@19.2.6(react@19.2.6):
+  react-dom@19.2.7(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
       scheduler: 0.27.0
 
-  react-hook-form@7.62.0(react@19.2.6):
+  react-hook-form@7.62.0(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   react-is@16.13.1: {}
 
@@ -17426,16 +17420,16 @@ snapshots:
 
   react-is@18.3.1: {}
 
-  react-markdown@10.1.0(@types/react@19.2.8)(react@19.2.6):
+  react-markdown@10.1.0(@types/react@19.2.17)(react@19.2.7):
     dependencies:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
       devlop: 1.1.0
       hast-util-to-jsx-runtime: 2.3.6
       html-url-attributes: 3.0.1
       mdast-util-to-hast: 13.2.1
-      react: 19.2.6
+      react: 19.2.7
       remark-parse: 11.0.0
       remark-rehype: 11.1.2
       unified: 11.0.5
@@ -17446,60 +17440,60 @@ snapshots:
 
   react-refresh@0.18.0: {}
 
-  react-remove-scroll-bar@2.3.8(@types/react@19.2.8)(react@19.2.6):
+  react-remove-scroll-bar@2.3.8(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
-      react-style-singleton: 2.2.3(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.7)
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  react-remove-scroll@2.7.2(@types/react@19.2.8)(react@19.2.6):
+  react-remove-scroll@2.7.2(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
-      react-remove-scroll-bar: 2.3.8(@types/react@19.2.8)(react@19.2.6)
-      react-style-singleton: 2.2.3(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      react-remove-scroll-bar: 2.3.8(@types/react@19.2.17)(react@19.2.7)
+      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.7)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.2.8)(react@19.2.6)
-      use-sidecar: 1.1.3(@types/react@19.2.8)(react@19.2.6)
+      use-callback-ref: 1.3.3(@types/react@19.2.17)(react@19.2.7)
+      use-sidecar: 1.1.3(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  react-smooth@4.0.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  react-smooth@4.0.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       fast-equals: 5.4.0
       prop-types: 15.8.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
-      react-transition-group: 4.4.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
+      react-transition-group: 4.4.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
 
-  react-style-singleton@2.2.3(@types/react@19.2.8)(react@19.2.6):
+  react-style-singleton@2.2.3(@types/react@19.2.17)(react@19.2.7):
     dependencies:
       get-nonce: 1.0.1
-      react: 19.2.6
+      react: 19.2.7
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  react-textarea-autosize@8.5.9(@types/react@19.2.8)(react@19.2.6):
+  react-textarea-autosize@8.5.9(@types/react@19.2.17)(react@19.2.7):
     dependencies:
       '@babel/runtime': 7.28.6
-      react: 19.2.6
-      use-composed-ref: 1.4.0(@types/react@19.2.8)(react@19.2.6)
-      use-latest: 1.3.0(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      use-composed-ref: 1.4.0(@types/react@19.2.17)(react@19.2.7)
+      use-latest: 1.3.0(@types/react@19.2.17)(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
 
-  react-transition-group@4.4.5(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  react-transition-group@4.4.5(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       '@babel/runtime': 7.28.6
       dom-helpers: 5.2.1
       loose-envify: 1.4.0
       prop-types: 15.8.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
 
-  react@19.2.6: {}
+  react@19.2.7: {}
 
   readdirp@3.6.0:
     dependencies:
@@ -17509,15 +17503,15 @@ snapshots:
     dependencies:
       decimal.js-light: 2.5.1
 
-  recharts@2.15.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  recharts@2.15.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       clsx: 2.1.1
       eventemitter3: 4.0.7
       lodash: 4.18.1
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
       react-is: 18.3.1
-      react-smooth: 4.0.4(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
+      react-smooth: 4.0.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       recharts-scale: 0.4.5
       tiny-invariant: 1.3.3
       victory-vendor: 36.9.2
@@ -17989,17 +17983,17 @@ snapshots:
       es-errors: 1.3.0
       internal-slot: 1.1.0
 
-  streamdown@1.6.10(@types/mdast@4.0.4)(micromark-util-types@2.0.2)(micromark@4.0.2)(react@19.2.6):
+  streamdown@1.6.10(@types/mdast@4.0.4)(micromark-util-types@2.0.2)(micromark@4.0.2)(react@19.2.7):
     dependencies:
       clsx: 2.1.1
       hast: 1.0.0
       hast-util-to-jsx-runtime: 2.3.6
       html-url-attributes: 3.0.1
       katex: 0.16.27
-      lucide-react: 0.542.0(react@19.2.6)
+      lucide-react: 0.542.0(react@19.2.7)
       marked: 16.4.2
       mermaid: 11.15.0
-      react: 19.2.6
+      react: 19.2.7
       rehype-harden: 1.1.7
       rehype-katex: 7.0.1
       rehype-raw: 7.0.0
@@ -18117,10 +18111,10 @@ snapshots:
     dependencies:
       inline-style-parser: 0.2.7
 
-  styled-jsx@5.1.6(@babel/core@7.28.6)(react@19.2.6):
+  styled-jsx@5.1.6(@babel/core@7.28.6)(react@19.2.7):
     dependencies:
       client-only: 0.0.1
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
       '@babel/core': 7.28.6
 
@@ -18136,11 +18130,11 @@ snapshots:
 
   supports-preserve-symlinks-flag@1.0.0: {}
 
-  swr@2.3.8(react@19.2.6):
+  swr@2.3.8(react@19.2.7):
     dependencies:
       dequal: 2.0.3
-      react: 19.2.6
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      react: 19.2.7
+      use-sync-external-store: 1.6.0(react@19.2.7)
 
   symbol-tree@3.2.4: {}
 
@@ -18384,47 +18378,47 @@ snapshots:
     dependencies:
       punycode: 2.3.1
 
-  use-callback-ref@1.3.3(@types/react@19.2.8)(react@19.2.6):
+  use-callback-ref@1.3.3(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-composed-ref@1.4.0(@types/react@19.2.8)(react@19.2.6):
+  use-composed-ref@1.4.0(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-isomorphic-layout-effect@1.2.1(@types/react@19.2.8)(react@19.2.6):
+  use-isomorphic-layout-effect@1.2.1(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-latest@1.3.0(@types/react@19.2.8)(react@19.2.6):
+  use-latest@1.3.0(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      react: 19.2.6
-      use-isomorphic-layout-effect: 1.2.1(@types/react@19.2.8)(react@19.2.6)
+      react: 19.2.7
+      use-isomorphic-layout-effect: 1.2.1(@types/react@19.2.17)(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-sidecar@1.1.3(@types/react@19.2.8)(react@19.2.6):
+  use-sidecar@1.1.3(@types/react@19.2.17)(react@19.2.7):
     dependencies:
       detect-node-es: 1.1.0
-      react: 19.2.6
+      react: 19.2.7
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.8
+      '@types/react': 19.2.17
 
-  use-stick-to-bottom@1.1.1(react@19.2.6):
+  use-stick-to-bottom@1.1.1(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
-  use-sync-external-store@1.6.0(react@19.2.6):
+  use-sync-external-store@1.6.0(react@19.2.7):
     dependencies:
-      react: 19.2.6
+      react: 19.2.7
 
   util-deprecate@1.0.2: {}
 
@@ -18432,11 +18426,11 @@ snapshots:
 
   vary@1.1.2: {}
 
-  vaul@1.1.2(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6):
+  vaul@1.1.2(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
-      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      '@radix-ui/react-dialog': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -18475,7 +18469,7 @@ snapshots:
 
   vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0):
     dependencies:
-      esbuild: 0.27.7
+      esbuild: 0.28.1
       fdir: 6.5.0(picomatch@4.0.4)
       picomatch: 4.0.4
       postcss: 8.5.14
@@ -18489,14 +18483,14 @@ snapshots:
       terser: 5.47.1
       yaml: 2.9.0
 
-  vitest-browser-react@2.0.4(@types/react-dom@19.2.3(@types/react@19.2.8))(@types/react@19.2.8)(react-dom@19.2.6(react@19.2.6))(react@19.2.6)(vitest@4.1.8):
+  vitest-browser-react@2.0.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.8):
     dependencies:
-      react: 19.2.6
-      react-dom: 19.2.6(react@19.2.6)
+      react: 19.2.7
+      react-dom: 19.2.7(react@19.2.7)
       vitest: 4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0))
     optionalDependencies:
-      '@types/react': 19.2.8
-      '@types/react-dom': 19.2.3(@types/react@19.2.8)
+      '@types/react': 19.2.17
+      '@types/react-dom': 19.2.3(@types/react@19.2.17)
 
   vitest@4.1.8(@opentelemetry/api@1.9.0)(@types/node@24.10.8)(@vitest/browser-playwright@4.1.8)(@vitest/coverage-v8@4.1.8)(jsdom@27.4.0)(msw@2.13.4(@types/node@24.10.8)(typescript@5.5.4))(vite@7.3.2(@types/node@24.10.8)(jiti@2.6.1)(lightningcss@1.30.2)(terser@5.47.1)(yaml@2.9.0)):
     dependencies:
@@ -18719,17 +18713,17 @@ snapshots:
 
   zod@4.4.3: {}
 
-  zustand@4.5.7(@types/react@19.2.8)(react@19.2.6):
+  zustand@4.5.7(@types/react@19.2.17)(react@19.2.7):
     dependencies:
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      use-sync-external-store: 1.6.0(react@19.2.7)
     optionalDependencies:
-      '@types/react': 19.2.8
-      react: 19.2.6
+      '@types/react': 19.2.17
+      react: 19.2.7
 
-  zustand@5.0.8(@types/react@19.2.8)(react@19.2.6)(use-sync-external-store@1.6.0(react@19.2.6)):
+  zustand@5.0.8(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7)):
     optionalDependencies:
-      '@types/react': 19.2.8
-      react: 19.2.6
-      use-sync-external-store: 1.6.0(react@19.2.6)
+      '@types/react': 19.2.17
+      react: 19.2.7
+      use-sync-external-store: 1.6.0(react@19.2.7)
 
   zwitch@2.0.4: {}
diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml
index e4ce0ceaf9..f3e525fc03 100644
--- a/ui/pnpm-workspace.yaml
+++ b/ui/pnpm-workspace.yaml
@@ -17,24 +17,26 @@ saveExact: true
 overrides:
   "@react-types/shared": "3.26.0"
   "@internationalized/date": "3.10.0"
-  "@react-aria/ssr>react": "19.2.6"
-  "@react-aria/ssr>react-dom": "19.2.6"
-  "@react-aria/visually-hidden>react": "19.2.6"
-  "@react-aria/interactions>react": "19.2.6"
+  "@react-aria/ssr>react": "19.2.7"
+  "@react-aria/ssr>react-dom": "19.2.7"
+  "@react-aria/visually-hidden>react": "19.2.7"
+  "@react-aria/interactions>react": "19.2.7"
   "lodash": "4.18.1"
   "lodash-es": "4.18.1"
-  "hono": "4.12.18"
+  "hono": "4.12.21"
   "@hono/node-server": "1.19.14"
   "@isaacs/brace-expansion": "5.0.1"
   "fast-xml-parser": "5.8.0"
   "serialize-javascript": "7.0.5"
+  "postcss": "8.5.14"
+  "esbuild": "0.28.1"
   "rollup@>=4": "4.59.0"
   "minimatch@<4": "3.1.4"
   "minimatch@>=9 <10": "9.0.7"
   "minimatch@>=10": "10.2.3"
   "ajv@<7": "6.14.0"
   "ajv@>=8": "8.18.0"
-  "qs": "6.14.2"
+  "qs": "6.15.2"
   # 8.2.2 dropped provenance attestation; 8.3.1+ restored it. Pinned to skip 8.2.2
   # under `trustPolicy: no-downgrade`.
   "express-rate-limit": "8.5.1"

From 49309b43d38d385ecad98b26c09f53f4d79e4213 Mon Sep 17 00:00:00 2001
From: Alan Buscaglia <gentlemanprogramming@gmail.com>
Date: Mon, 15 Jun 2026 13:53:48 +0200
Subject: [PATCH 034/126] feat(ui): UI onboarding system (#11430)

Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>
Co-authored-by: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
---
 .github/workflows/ui-tests.yml                |   4 +
 AGENTS.md                                     |   6 +
 skills/prowler-tour/SKILL.md                  |  99 +++++
 skills/prowler-tour/assets/tour-template.ts   |  51 +++
 .../prowler-tour/references/output-format.md  |  31 ++
 .../references/tours-architecture.md          |  44 ++
 ui/AGENTS.md                                  |  64 +--
 ui/CHANGELOG.md                               |   1 +
 ui/actions/scans/scans.ts                     |   5 +
 .../_components/scan-list-table.test.tsx      |  23 +-
 .../_components/scan-list-table.tsx           |   3 +
 .../(workflow)/query-builder/_hooks/index.ts  |   1 +
 .../_hooks/use-attack-path-scans.ts           |  81 ++++
 .../query-builder/attack-paths-page.test.tsx  |  19 -
 .../query-builder/attack-paths-page.tsx       | 229 ++++++----
 ui/app/(prowler)/attack-paths/layout.tsx      |   6 +-
 ui/app/(prowler)/compliance/page.tsx          |  44 +-
 ui/app/(prowler)/findings/page.tsx            |  19 +-
 ui/app/(prowler)/layout.tsx                   |  54 ++-
 ui/app/(prowler)/providers/page.tsx           |  23 +-
 ui/app/(prowler)/scans/page.test.ts           |  23 +
 ui/app/(prowler)/scans/page.tsx               |  42 +-
 ui/components/compliance/compliance-card.tsx  |  24 +-
 .../compliance/compliance-overview-grid.tsx   |  83 +++-
 ui/components/findings/findings-filters.tsx   |  34 +-
 .../table/findings-group-table.test.tsx       |  96 ++++-
 .../findings/table/findings-group-table.tsx   | 102 +++--
 .../table/inline-resource-container.tsx       |   2 +
 ui/components/icons/Icons.tsx                 |  66 ---
 .../onboarding-checkpoint-dialog.test.tsx     | 109 +++++
 .../onboarding-checkpoint-watcher.test.tsx    | 112 +++++
 .../__tests__/onboarding-gate.test.tsx        | 185 ++++++++
 .../onboarding-sequence-banner.logic.test.ts  |  63 +++
 .../onboarding-sequence-banner.test.tsx       | 193 +++++++++
 .../onboarding-trigger.decision.test.ts       | 164 +++++++
 .../__tests__/onboarding-trigger.test.tsx     | 300 +++++++++++++
 .../onboarding-welcome-modal.test.tsx         |  83 ++++
 .../onboarding/__tests__/page-ready.test.tsx  |  30 ++
 ui/components/onboarding/index.ts             |   5 +
 .../onboarding-checkpoint-dialog.tsx          |  38 ++
 .../onboarding-checkpoint-watcher.tsx         |  58 +++
 ui/components/onboarding/onboarding-gate.tsx  |  74 ++++
 .../onboarding-sequence-banner.logic.ts       |  32 ++
 .../onboarding/onboarding-sequence-banner.tsx | 100 +++++
 .../onboarding/onboarding-trigger.logic.ts    |  48 +++
 .../onboarding/onboarding-trigger.tsx         | 165 +++++++
 .../onboarding/onboarding-welcome-modal.tsx   |  42 ++
 ui/components/onboarding/page-ready.tsx       |  25 ++
 .../providers/add-provider-button.tsx         |   4 +-
 .../providers/no-providers-added.tsx          |   7 +-
 .../providers/providers-accounts-view.tsx     |  48 ++-
 .../use-provider-wizard-controller.test.tsx   |  91 +++-
 .../hooks/use-provider-wizard-controller.ts   |  25 +-
 .../wizard/provider-wizard-modal.tsx          | 355 +++++++++-------
 .../workflow/forms/connect-account-form.tsx   |  18 +-
 ui/components/scans/scans-page-shell.test.tsx |  13 +-
 ui/components/scans/scans-page-shell.tsx      |  41 +-
 .../table/__tests__/scan-jobs-table.test.tsx  |  77 ++++
 ui/components/scans/table/scan-jobs-table.tsx |   9 +
 ui/components/shadcn/button/button.test.tsx   |  25 ++
 ui/components/shadcn/button/button.tsx        |   4 +
 ui/components/shadcn/tabs/tabs.tsx            |  26 +-
 .../breadcrumb-navigation.test.tsx            |  43 ++
 .../ui/breadcrumbs/breadcrumb-navigation.tsx  |   5 +-
 .../ui/content-layout/content-layout.tsx      |  14 +-
 .../ui/nav-bar/navbar-client.test.tsx         | 255 +++++++++++
 ui/components/ui/nav-bar/navbar-client.tsx    | 112 ++++-
 ui/components/ui/nav-bar/navbar.tsx           |  12 +-
 ui/components/ui/sidebar/sidebar-toggle.tsx   |  30 +-
 ui/components/ui/table/data-table.tsx         |   8 +
 ui/dependency-log.json                        |   8 +
 .../compliance/compliance-detail-url.test.ts  |  38 ++
 ui/lib/compliance/compliance-detail-url.ts    |  26 ++
 ui/lib/onboarding/README.md                   |  76 ++++
 .../__tests__/gate-decision.test.ts           |  74 ++++
 ui/lib/onboarding/__tests__/registry.test.ts  | 185 ++++++++
 ui/lib/onboarding/gate-decision.ts            |  17 +
 ui/lib/onboarding/index.ts                    |   6 +
 ui/lib/onboarding/onboarding-types.ts         |  22 +
 ui/lib/onboarding/registry.ts                 |  80 ++++
 ui/lib/shared/env.ts                          |  14 +
 .../tours/__tests__/add-provider.tour.test.ts |  59 +++
 .../tours/__tests__/attack-paths.tour.test.ts | 120 ++++++
 .../__tests__/explore-findings.tour.test.ts   |  89 ++++
 .../use-driver-tour.lifecycle.test.tsx        | 198 +++++++++
 .../tours/__tests__/use-driver-tour.test.tsx  |  96 +++++
 .../__tests__/view-compliance.tour.test.ts    | 105 +++++
 .../__tests__/view-first-scan.tour.test.ts    |  86 ++++
 ui/lib/tours/add-provider.tour.ts             |  67 +++
 ui/lib/tours/attack-paths-empty.tour.ts       |  31 ++
 ui/lib/tours/attack-paths.tour.ts             |  98 +++++
 ui/lib/tours/explore-findings.tour.ts         |  74 ++++
 .../tours/store/local-storage-adapter.test.ts | 103 +++++
 ui/lib/tours/store/local-storage-adapter.ts   |  70 +++
 ui/lib/tours/store/tour-completion-store.ts   |   8 +
 ui/lib/tours/tour-config.test.ts              |  56 +++
 ui/lib/tours/tour-config.ts                   |  50 +++
 ui/lib/tours/tour-popover-render.test.tsx     | 139 ++++++
 ui/lib/tours/tour-popover-render.tsx          | 197 +++++++++
 ui/lib/tours/tour-types.ts                    |  91 ++++
 ui/lib/tours/use-driver-tour.ts               | 401 ++++++++++++++++++
 ui/lib/tours/use-tour-completion.ts           |  36 ++
 ui/lib/tours/view-compliance.tour.ts          |  76 ++++
 ui/lib/tours/view-first-scan.tour.ts          |  98 +++++
 ui/package.json                               |   2 +
 ui/playwright.config.ts                       |   8 +
 ui/pnpm-lock.yaml                             |   8 +
 ui/scripts/check-tour-alignment.mjs           | 178 ++++++++
 .../__tests__/onboarding-checkpoint.test.ts   |  85 ++++
 ui/store/__tests__/onboarding-replay.test.ts  |  62 +++
 .../__tests__/onboarding-sequence.test.ts     | 132 ++++++
 ui/store/__tests__/page-ready.test.ts         |  31 ++
 ui/store/onboarding-checkpoint.ts             |  46 ++
 ui/store/onboarding-replay.ts                 |  34 ++
 ui/store/onboarding-sequence.ts               |  71 ++++
 ui/store/page-ready.ts                        |  24 ++
 ui/styles/globals.css                         |   4 +
 ui/styles/tours.css                           |  78 ++++
 ui/tests/onboarding/onboarding-page.ts        | 259 +++++++++++
 ui/tests/onboarding/onboarding.md             | 334 +++++++++++++++
 ui/tests/onboarding/onboarding.spec.ts        | 245 +++++++++++
 121 files changed, 8233 insertions(+), 589 deletions(-)
 create mode 100644 skills/prowler-tour/SKILL.md
 create mode 100644 skills/prowler-tour/assets/tour-template.ts
 create mode 100644 skills/prowler-tour/references/output-format.md
 create mode 100644 skills/prowler-tour/references/tours-architecture.md
 create mode 100644 ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts
 delete mode 100644 ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.test.tsx
 create mode 100644 ui/app/(prowler)/scans/page.test.ts
 create mode 100644 ui/components/onboarding/__tests__/onboarding-checkpoint-dialog.test.tsx
 create mode 100644 ui/components/onboarding/__tests__/onboarding-checkpoint-watcher.test.tsx
 create mode 100644 ui/components/onboarding/__tests__/onboarding-gate.test.tsx
 create mode 100644 ui/components/onboarding/__tests__/onboarding-sequence-banner.logic.test.ts
 create mode 100644 ui/components/onboarding/__tests__/onboarding-sequence-banner.test.tsx
 create mode 100644 ui/components/onboarding/__tests__/onboarding-trigger.decision.test.ts
 create mode 100644 ui/components/onboarding/__tests__/onboarding-trigger.test.tsx
 create mode 100644 ui/components/onboarding/__tests__/onboarding-welcome-modal.test.tsx
 create mode 100644 ui/components/onboarding/__tests__/page-ready.test.tsx
 create mode 100644 ui/components/onboarding/index.ts
 create mode 100644 ui/components/onboarding/onboarding-checkpoint-dialog.tsx
 create mode 100644 ui/components/onboarding/onboarding-checkpoint-watcher.tsx
 create mode 100644 ui/components/onboarding/onboarding-gate.tsx
 create mode 100644 ui/components/onboarding/onboarding-sequence-banner.logic.ts
 create mode 100644 ui/components/onboarding/onboarding-sequence-banner.tsx
 create mode 100644 ui/components/onboarding/onboarding-trigger.logic.ts
 create mode 100644 ui/components/onboarding/onboarding-trigger.tsx
 create mode 100644 ui/components/onboarding/onboarding-welcome-modal.tsx
 create mode 100644 ui/components/onboarding/page-ready.tsx
 create mode 100644 ui/components/scans/table/__tests__/scan-jobs-table.test.tsx
 create mode 100644 ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx
 create mode 100644 ui/components/ui/nav-bar/navbar-client.test.tsx
 create mode 100644 ui/lib/compliance/compliance-detail-url.test.ts
 create mode 100644 ui/lib/compliance/compliance-detail-url.ts
 create mode 100644 ui/lib/onboarding/README.md
 create mode 100644 ui/lib/onboarding/__tests__/gate-decision.test.ts
 create mode 100644 ui/lib/onboarding/__tests__/registry.test.ts
 create mode 100644 ui/lib/onboarding/gate-decision.ts
 create mode 100644 ui/lib/onboarding/index.ts
 create mode 100644 ui/lib/onboarding/onboarding-types.ts
 create mode 100644 ui/lib/onboarding/registry.ts
 create mode 100644 ui/lib/shared/env.ts
 create mode 100644 ui/lib/tours/__tests__/add-provider.tour.test.ts
 create mode 100644 ui/lib/tours/__tests__/attack-paths.tour.test.ts
 create mode 100644 ui/lib/tours/__tests__/explore-findings.tour.test.ts
 create mode 100644 ui/lib/tours/__tests__/use-driver-tour.lifecycle.test.tsx
 create mode 100644 ui/lib/tours/__tests__/use-driver-tour.test.tsx
 create mode 100644 ui/lib/tours/__tests__/view-compliance.tour.test.ts
 create mode 100644 ui/lib/tours/__tests__/view-first-scan.tour.test.ts
 create mode 100644 ui/lib/tours/add-provider.tour.ts
 create mode 100644 ui/lib/tours/attack-paths-empty.tour.ts
 create mode 100644 ui/lib/tours/attack-paths.tour.ts
 create mode 100644 ui/lib/tours/explore-findings.tour.ts
 create mode 100644 ui/lib/tours/store/local-storage-adapter.test.ts
 create mode 100644 ui/lib/tours/store/local-storage-adapter.ts
 create mode 100644 ui/lib/tours/store/tour-completion-store.ts
 create mode 100644 ui/lib/tours/tour-config.test.ts
 create mode 100644 ui/lib/tours/tour-config.ts
 create mode 100644 ui/lib/tours/tour-popover-render.test.tsx
 create mode 100644 ui/lib/tours/tour-popover-render.tsx
 create mode 100644 ui/lib/tours/tour-types.ts
 create mode 100644 ui/lib/tours/use-driver-tour.ts
 create mode 100644 ui/lib/tours/use-tour-completion.ts
 create mode 100644 ui/lib/tours/view-compliance.tour.ts
 create mode 100644 ui/lib/tours/view-first-scan.tour.ts
 create mode 100644 ui/scripts/check-tour-alignment.mjs
 create mode 100644 ui/store/__tests__/onboarding-checkpoint.test.ts
 create mode 100644 ui/store/__tests__/onboarding-replay.test.ts
 create mode 100644 ui/store/__tests__/onboarding-sequence.test.ts
 create mode 100644 ui/store/__tests__/page-ready.test.ts
 create mode 100644 ui/store/onboarding-checkpoint.ts
 create mode 100644 ui/store/onboarding-replay.ts
 create mode 100644 ui/store/onboarding-sequence.ts
 create mode 100644 ui/store/page-ready.ts
 create mode 100644 ui/styles/tours.css
 create mode 100644 ui/tests/onboarding/onboarding-page.ts
 create mode 100644 ui/tests/onboarding/onboarding.md
 create mode 100644 ui/tests/onboarding/onboarding.spec.ts

diff --git a/.github/workflows/ui-tests.yml b/.github/workflows/ui-tests.yml
index 918755a629..2dc50a26bb 100644
--- a/.github/workflows/ui-tests.yml
+++ b/.github/workflows/ui-tests.yml
@@ -131,6 +131,10 @@ jobs:
         if: steps.check-changes.outputs.any_changed == 'true'
         run: pnpm run healthcheck
 
+      - name: Check product-tour alignment
+        if: steps.check-changes.outputs.any_changed == 'true'
+        run: pnpm run tour:check
+
       - name: Run pnpm audit
         if: steps.check-changes.outputs.any_changed == 'true'
         run: pnpm run audit
diff --git a/AGENTS.md b/AGENTS.md
index 1cf023889c..c9d63a8c27 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -51,6 +51,7 @@ Use these skills for detailed patterns on-demand:
 | `django-migration-psql` | Django migration best practices for PostgreSQL | [SKILL.md](skills/django-migration-psql/SKILL.md) |
 | `postgresql-indexing` | PostgreSQL indexing, EXPLAIN, monitoring, maintenance | [SKILL.md](skills/postgresql-indexing/SKILL.md) |
 | `prowler-attack-paths-query` | Create Attack Paths openCypher queries | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |
+| `prowler-tour` | Keep product-tour definitions aligned with the UI | [SKILL.md](skills/prowler-tour/SKILL.md) |
 | `gh-aw` | GitHub Agentic Workflows (gh-aw) | [SKILL.md](skills/gh-aw/SKILL.md) |
 | `skill-creator` | Create new AI agent skills | [SKILL.md](skills/skill-creator/SKILL.md) |
 
@@ -67,10 +68,12 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Adding new providers | `prowler-provider` |
 | Adding privilege escalation detection queries | `prowler-attack-paths-query` |
 | Adding services to existing providers | `prowler-provider` |
+| Adding, updating, or removing a tour definition (*.tour.ts) | `prowler-tour` |
 | After creating/modifying a skill | `skill-sync` |
 | App Router / Server Actions | `nextjs-16` |
 | Auditing check-to-requirement mappings as a cloud auditor | `prowler-compliance` |
 | Building AI chat features | `ai-sdk-5` |
+| Changing button labels or section headings on a tour-covered page | `prowler-tour` |
 | Committing changes | `prowler-commit` |
 | Configuring MCP servers in agentic workflows | `gh-aw` |
 | Create PR that requires changelog entry | `prowler-changelog` |
@@ -89,6 +92,7 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Creating/updating compliance frameworks | `prowler-compliance` |
 | Debug why a GitHub Actions job is failing | `prowler-ci` |
 | Debugging gh-aw compilation errors | `gh-aw` |
+| Editing a UI file containing data-tour-id attributes | `prowler-tour` |
 | Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist) | `prowler-pr` |
 | Fixing bug | `tdd` |
 | Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs) | `prowler-compliance` |
@@ -105,6 +109,8 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Modifying gh-aw workflow frontmatter or safe-outputs | `gh-aw` |
 | Refactoring code | `tdd` |
 | Regenerate AGENTS.md Auto-invoke tables (sync.sh) | `skill-sync` |
+| Renaming or removing a data-tour-id attribute value | `prowler-tour` |
+| Restructuring routes or layouts covered by a tour | `prowler-tour` |
 | Review PR requirements: template, title conventions, changelog gate | `prowler-pr` |
 | Review changelog format and conventions | `prowler-changelog` |
 | Reviewing JSON:API compliance | `jsonapi` |
diff --git a/skills/prowler-tour/SKILL.md b/skills/prowler-tour/SKILL.md
new file mode 100644
index 0000000000..8511581a47
--- /dev/null
+++ b/skills/prowler-tour/SKILL.md
@@ -0,0 +1,99 @@
+---
+name: prowler-tour
+description: >
+  Keeps product-tour definitions aligned with the UI features they describe.
+  Trigger: When modifying UI components that have associated tours, editing tour
+  definition files, or renaming data-tour-id attributes.
+license: Apache-2.0
+metadata:
+  author: prowler-cloud
+  version: "1.0"
+  scope: [root, ui]
+  auto_invoke:
+    - "Editing a UI file containing data-tour-id attributes"
+    - "Adding, updating, or removing a tour definition (*.tour.ts)"
+    - "Renaming or removing a data-tour-id attribute value"
+    - "Changing button labels or section headings on a tour-covered page"
+    - "Restructuring routes or layouts covered by a tour"
+allowed-tools: Read, Glob, Grep
+---
+
+# prowler-tour
+
+**Report-only.** This skill never edits tour files or UI files; it inspects
+the change, reports drift it finds between tours and the covered UI, and
+recommends actions for the developer to apply.
+
+## Early-exit rule
+
+Run this check first. Most UI edits are not tour-related — exit cheaply.
+
+1. Glob `ui/lib/tours/*.tour.ts`.
+2. For each tour, check whether any `coversFiles` glob pattern matches any
+   file in the current change.
+3. If no tour matches, respond **exactly**:
+
+   > No tour affected — skipping alignment check
+
+   and exit. Do not proceed to the checklist.
+4. If at least one tour matches, continue to "Drift checklist" for that tour.
+
+## Drift checklist
+
+For each affected tour, evaluate every item. Skip items that obviously do
+not apply, but list explicitly which items were checked.
+
+1. **Orphan selectors** — every step's `target` (which composes to
+   `data-tour-id="<tour-id>-<step.target>"`) must resolve to a real element
+   in the codebase. Grep `ui/` for the expected attribute value; report
+   any step whose target is missing.
+2. **Renamed selectors** — a `data-tour-id` attribute was edited in this
+   change. Match it back to any tour step referencing the old value.
+3. **Outdated copy** — a popover `title`/`description` references a button
+   label, heading, or term that no longer exists on the covered page.
+4. **Obsolete steps** — a step describes a section, panel, or workflow
+   that was removed.
+5. **Missing steps** — a new feature was added on the covered surface
+   without a corresponding step (e.g. a new panel, a new primary action,
+   a new wizard stage).
+6. **Reordered flow** — the user's path through the feature changed (e.g.
+   query builder moved before scan selection) and the step order no
+   longer reflects it.
+
+## Version-bump decision tree
+
+Apply per tour after listing drift:
+
+- **NO bump** when the change is cosmetic. Examples: fix a typo, soften
+  copy, rename a `data-tour-id` selector while keeping the same step,
+  swap one screenshot for another, tighten wording.
+- **BUMP `version`** when the user-visible flow changes materially.
+  Examples: a new step was added or removed; the order changed; an
+  anchored target was retargeted to a different panel; the tour now
+  covers a new feature on the surface.
+
+When in doubt, ask: "Would a user who already saw the previous version
+miss something useful by not seeing this one?" If yes, bump.
+
+## Output format
+
+When emitting a report, follow the exact structure in
+`references/output-format.md`. The structure is mandatory because the
+report is consumed downstream and tolerates no field reordering.
+
+## What this skill MUST NOT do
+
+- Do not edit `*.tour.ts` files. This skill is report-only.
+- Do not edit UI files to add or rename `data-tour-id` attributes.
+- Do not invent new tours. Authoring a new tour is a separate, deliberate
+  decision — the developer makes it, not the skill.
+- Do not flag drift in tours whose `coversFiles` do not match any file
+  in the current change. Stick to the early-exit rule.
+
+## See also
+
+- `references/output-format.md` — exact report template (read when
+  emitting a report).
+- `references/tours-architecture.md` — code map for the tour abstraction
+  under `ui/lib/tours/`.
+- `assets/tour-template.ts` — boilerplate for authoring a new `*.tour.ts`.
diff --git a/skills/prowler-tour/assets/tour-template.ts b/skills/prowler-tour/assets/tour-template.ts
new file mode 100644
index 0000000000..cc264a4678
--- /dev/null
+++ b/skills/prowler-tour/assets/tour-template.ts
@@ -0,0 +1,51 @@
+// @ts-nocheck -- template only; resolves once copied into `ui/lib/tours/`
+/**
+ * Tour template — copy this file to `ui/lib/tours/<your-id>.tour.ts` and
+ * fill in the placeholders. See `references/tours-architecture.md` for the
+ * design context.
+ *
+ * Conventions:
+ *   - Declare via `defineTour({...})` (NOT `: TourDefinition`) so TS
+ *     preserves the literal union of `target` values. `useDriverTour` uses
+ *     that union to validate `stepHandlers` keys and `waitForStep` args.
+ *   - `id` is kebab-case and unique across all tours.
+ *   - Anchored steps reference DOM via `data-tour-id="<id>-<step.target>"`;
+ *     the hook composes the CSS selector automatically.
+ *   - `coversFiles` lists the globs that describe the tour's surface; the
+ *     `prowler-tour` skill consumes this to decide whether to evaluate
+ *     drift on a given change.
+ *   - Material flow changes bump `version`; cosmetic edits do not.
+ */
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+} from "@/lib/tours/tour-types";
+
+export const yourTour = defineTour({
+  id: "your-tour-id",
+  version: 1,
+  coversFiles: [
+    // List the UI files this tour describes, using globs under `ui/`.
+    // Example: "ui/app/(prowler)/your-feature/**"
+  ],
+  steps: [
+    {
+      // Modal step — no anchor. Use for intros, outros, and any step
+      // that does not point at a specific DOM element.
+      title: "Welcome",
+      description: "Short, plain-English description.",
+    },
+    {
+      // Anchored step. The hook resolves
+      // `[data-tour-id="your-tour-id-step-name"]` lazily, so the element
+      // can be conditionally rendered as long as it exists when the step
+      // becomes active.
+      target: "step-name",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Where the action is",
+      description: "Tell the user what to look at here and why.",
+    },
+  ],
+});
diff --git a/skills/prowler-tour/references/output-format.md b/skills/prowler-tour/references/output-format.md
new file mode 100644
index 0000000000..ecd82c4d8e
--- /dev/null
+++ b/skills/prowler-tour/references/output-format.md
@@ -0,0 +1,31 @@
+# Tour Alignment Report — output format
+
+The report is consumed downstream. Field names, order, and headings are
+load-bearing — do not rename, reorder, or omit them.
+
+## Template
+
+```text
+## Tour Alignment Report
+**Tour:** `<tour-id>@v<version>`
+**Files touched:** <comma-separated list of files in the change>
+
+### Drift detected
+- <one bullet per drift item; include file:line where available>
+
+### Recommended actions
+1. <numbered, actionable steps the developer should take>
+
+### Version bump verdict
+- <BUMP | NO bump> — <one-line rationale>
+```
+
+## Rules
+
+- One report per affected tour. If multiple tours are affected, separate
+  reports with a `---` line.
+- If no drift is detected for an affected tour, still emit the report:
+  put "No drift detected." under "Drift detected" and "None required."
+  under "Recommended actions". The verdict line is still mandatory.
+- The verdict is exactly one of `BUMP` or `NO bump` — see the
+  version-bump decision tree in `SKILL.md`.
diff --git a/skills/prowler-tour/references/tours-architecture.md b/skills/prowler-tour/references/tours-architecture.md
new file mode 100644
index 0000000000..9a5c8f49e0
--- /dev/null
+++ b/skills/prowler-tour/references/tours-architecture.md
@@ -0,0 +1,44 @@
+# Tours Architecture
+
+The product-tour abstraction lives under [`ui/lib/tours/`](../../../ui/lib/tours/).
+This skill operates on tour definitions that follow this architecture.
+
+## Code map
+
+| File | Purpose |
+|---|---|
+| `ui/lib/tours/tour-types.ts` | Public type surface: `TourDefinition`, `TourStep`, `TourId`, `TourCompletionRecord`, completion-state const map. Also exports `defineTour(...)` — the required authoring helper that preserves literal step `target`s so `useDriverTour` can type-check `stepHandlers` keys and `waitForStep` arguments. |
+| `ui/lib/tours/tour-config.ts` | `baseDriverConfig`, `getDriverConfig(theme, overrides?)`, overlay-color map. |
+| `ui/lib/tours/store/tour-completion-store.ts` | Persistence interface — the swap point for future API adapters. |
+| `ui/lib/tours/store/local-storage-adapter.ts` | The only adapter in the PoC. Key format: `prowler.tour.<id>.v<version>`. |
+| `ui/lib/tours/use-driver-tour.ts` | React hook. Initializes driver.js, derives `overlayColor` from `useTheme()`, persists completion. |
+| `ui/lib/tours/<id>.tour.ts` | One file per tour. Declared via `defineTour({...})` (not `: TourDefinition`) and imported by the page that opts the user in. |
+| `ui/styles/tours.css` | `.driver-popover.prowler-theme` — every color resolved via `var(--...)` from `globals.css`. |
+
+## Selector convention
+
+Tour steps anchor via `data-tour-id="<tour-id>-<step.target>"`. The hook
+composes the CSS selector at runtime; tour authors only provide the step
+name in `step.target`. Class-based, ID-based, structural selectors are
+forbidden — they couple tours to styling decisions that legitimately
+change.
+
+## Identity and versioning
+
+A tour is `{ id, version }`. The localStorage key composes both. A
+**material content change** bumps `version`; cosmetic edits do not. The
+decision tree lives in the parent SKILL.md.
+
+## Persistence scope
+
+Per-user, cross-tenant. A user who completed `attack-paths@v1` in tenant
+A does not see the tour again in tenant B, even if they can access the
+feature there. The future `UserTourState` model (documented in
+`design.md`, not built) is FK to `User`, not `Membership`.
+
+## Drift = #1 risk
+
+Without the maintenance skill + the optional CI gate
+(`ui/scripts/check-tour-alignment.mjs`), tours decay silently as the
+covered UI evolves. The parent SKILL.md enumerates the six drift
+categories the skill checks for.
diff --git a/ui/AGENTS.md b/ui/AGENTS.md
index 38af45860f..7c06cc56b1 100644
--- a/ui/AGENTS.md
+++ b/ui/AGENTS.md
@@ -14,40 +14,46 @@
 > - [`playwright`](../skills/playwright/SKILL.md) - Page Object Model, selectors
 > - [`vitest`](../skills/vitest/SKILL.md) - Unit testing with React Testing Library
 > - [`tdd`](../skills/tdd/SKILL.md) - TDD workflow (MANDATORY for UI tasks)
+> - [`prowler-tour`](../skills/prowler-tour/SKILL.md) - Keep product-tour definitions aligned with the UI
 
 ## Auto-invoke Skills
 
 When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 
-| Action                                                         | Skill               |
-| -------------------------------------------------------------- | ------------------- |
-| Add changelog entry for a PR or feature                        | `prowler-changelog` |
-| App Router / Server Actions                                    | `nextjs-16`         |
-| Building AI chat features                                      | `ai-sdk-5`          |
-| Committing changes                                             | `prowler-commit`    |
-| Create PR that requires changelog entry                        | `prowler-changelog` |
-| Creating Zod schemas                                           | `zod-4`             |
-| Creating a git commit                                          | `prowler-commit`    |
-| Creating/modifying Prowler UI components                       | `prowler-ui`        |
-| Fixing bug                                                     | `tdd`               |
-| Implementing feature                                           | `tdd`               |
-| Modifying component                                            | `tdd`               |
-| Refactoring code                                               | `tdd`               |
-| Review changelog format and conventions                        | `prowler-changelog` |
-| Testing hooks or utilities                                     | `vitest`            |
-| Update CHANGELOG.md in any component                           | `prowler-changelog` |
-| Using Zustand stores                                           | `zustand-5`         |
-| Working on Prowler UI structure (actions/adapters/types/hooks) | `prowler-ui`        |
-| Working on task                                                | `tdd`               |
-| Working with Prowler UI test helpers/pages                     | `prowler-test-ui`   |
-| Working with Tailwind classes                                  | `tailwind-4`        |
-| Writing Playwright E2E tests                                   | `playwright`        |
-| Writing Prowler UI E2E tests                                   | `prowler-test-ui`   |
-| Writing React component tests                                  | `vitest`            |
-| Writing React components                                       | `react-19`          |
-| Writing TypeScript types/interfaces                            | `typescript`        |
-| Writing Vitest tests                                           | `vitest`            |
-| Writing unit tests for UI                                      | `vitest`            |
+| Action                                                            | Skill               |
+| ----------------------------------------------------------------- | ------------------- |
+| Add changelog entry for a PR or feature                           | `prowler-changelog` |
+| Adding, updating, or removing a tour definition (\*.tour.ts)      | `prowler-tour`      |
+| App Router / Server Actions                                       | `nextjs-16`         |
+| Building AI chat features                                         | `ai-sdk-5`          |
+| Changing button labels or section headings on a tour-covered page | `prowler-tour`      |
+| Committing changes                                                | `prowler-commit`    |
+| Create PR that requires changelog entry                           | `prowler-changelog` |
+| Creating Zod schemas                                              | `zod-4`             |
+| Creating a git commit                                             | `prowler-commit`    |
+| Creating/modifying Prowler UI components                          | `prowler-ui`        |
+| Editing a UI file containing data-tour-id attributes              | `prowler-tour`      |
+| Fixing bug                                                        | `tdd`               |
+| Implementing feature                                              | `tdd`               |
+| Modifying component                                               | `tdd`               |
+| Refactoring code                                                  | `tdd`               |
+| Renaming or removing a data-tour-id attribute value               | `prowler-tour`      |
+| Restructuring routes or layouts covered by a tour                 | `prowler-tour`      |
+| Review changelog format and conventions                           | `prowler-changelog` |
+| Testing hooks or utilities                                        | `vitest`            |
+| Update CHANGELOG.md in any component                              | `prowler-changelog` |
+| Using Zustand stores                                              | `zustand-5`         |
+| Working on Prowler UI structure (actions/adapters/types/hooks)    | `prowler-ui`        |
+| Working on task                                                   | `tdd`               |
+| Working with Prowler UI test helpers/pages                        | `prowler-test-ui`   |
+| Working with Tailwind classes                                     | `tailwind-4`        |
+| Writing Playwright E2E tests                                      | `playwright`        |
+| Writing Prowler UI E2E tests                                      | `prowler-test-ui`   |
+| Writing React component tests                                     | `vitest`            |
+| Writing React components                                          | `react-19`          |
+| Writing TypeScript types/interfaces                               | `typescript`        |
+| Writing Vitest tests                                              | `vitest`            |
+| Writing unit tests for UI                                         | `vitest`            |
 
 ---
 
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index ede3aedff4..dbf87d055e 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -25,6 +25,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 - DISA Okta IDaaS STIG V1R2 compliance framework support with its dedicated mapper, details panel, and icon [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
 - DORA compliance framework support [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
+- Guided product onboarding for new users — step-by-step tours covering providers, scans, findings, compliance, and attack paths, replayable anytime from the info icon in the page header [(#11430)](https://github.com/prowler-cloud/prowler/pull/11430)
 
 ### 🔄 Changed
 
diff --git a/ui/actions/scans/scans.ts b/ui/actions/scans/scans.ts
index 318004ea96..fb32a6286e 100644
--- a/ui/actions/scans/scans.ts
+++ b/ui/actions/scans/scans.ts
@@ -15,6 +15,7 @@ import {
 } from "@/lib/provider-filters";
 import { addScanOperation } from "@/lib/sentry-breadcrumbs";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
+import { SCAN_STATES } from "@/types/attack-paths";
 
 const ORGANIZATION_SCAN_CONCURRENCY_LIMIT = 5;
 export const getScans = async ({
@@ -64,6 +65,10 @@ export const getScansByState = async () => {
     "filter[provider_type__in]",
     sanitizeProviderTypesCsv(),
   );
+  // Only need to know whether at least one completed scan exists; filter server-side
+  // and cap to a single row so the answer is correct regardless of total scan count.
+  url.searchParams.append("filter[state]", SCAN_STATES.COMPLETED);
+  url.searchParams.append("page[size]", "1");
 
   try {
     const response = await fetch(url.toString(), {
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx
index 4aec4b97d3..5ec29558ff 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.test.tsx
@@ -58,6 +58,7 @@ vi.mock("@/components/ui/table", () => ({
     data,
     metadata,
     controlledPage,
+    getRowAttributes,
   }: {
     columns: Array<{
       id?: string;
@@ -74,6 +75,10 @@ vi.mock("@/components/ui/table", () => ({
       };
     };
     controlledPage: number;
+    getRowAttributes?: (row: {
+      index: number;
+      original: AttackPathScan;
+    }) => Record<string, string | undefined>;
   }) => (
     <div>
       <span>{metadata.pagination.count} Total Entries</span>
@@ -95,8 +100,8 @@ vi.mock("@/components/ui/table", () => ({
           </tr>
         </thead>
         <tbody>
-          {data.map((row) => (
-            <tr key={row.id}>
+          {data.map((row, index) => (
+            <tr key={row.id} {...getRowAttributes?.({ index, original: row })}>
               {columns.map((column, index) => (
                 <td key={column.id ?? index}>
                   {column.cell
@@ -176,6 +181,20 @@ describe("ScanListTable", () => {
     );
   });
 
+  it("anchors the attack paths scan tour to the first visible scan row", () => {
+    render(
+      <ScanListTable scans={[createScan(1), createScan(2), createScan(3)]} />,
+    );
+
+    const firstRow = screen
+      .getAllByRole("radio", {
+        name: "Select scan",
+      })[0]
+      .closest("tr");
+
+    expect(firstRow).toHaveAttribute("data-tour-id", "attack-paths-scan-list");
+  });
+
   it("enables the radio button for a failed scan when graph data is ready", async () => {
     const user = userEvent.setup();
     const failedScan: AttackPathScan = {
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx
index 00a330810f..dd532f9ed6 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/scan-list-table.tsx
@@ -295,6 +295,9 @@ export const ScanListTable = ({ scans }: ScanListTableProps) => {
             handleSelectScan(row.original.id);
           }
         }}
+        getRowAttributes={(row) =>
+          row.index === 0 ? { "data-tour-id": "attack-paths-scan-list" } : {}
+        }
         enableRowSelection
         rowSelection={getSelectedRowSelection(paginatedScans, selectedScanId)}
       />
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/index.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/index.ts
index eec8e5f81a..c30edb519c 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/index.ts
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/index.ts
@@ -1,3 +1,4 @@
+export { useAttackPathScans } from "./use-attack-path-scans";
 export { useGraphState } from "./use-graph-state";
 export { useQueryBuilder } from "./use-query-builder";
 export { useWizardState } from "./use-wizard-state";
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts
new file mode 100644
index 0000000000..39515698a1
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts
@@ -0,0 +1,81 @@
+"use client";
+
+import { useState } from "react";
+
+import { getAttackPathScans } from "@/actions/attack-paths";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import type { AttackPathScan } from "@/types/attack-paths";
+
+export interface UseAttackPathScansOptions {
+  /**
+   * Invoked once the initial load resolves with no scan whose graph data is
+   * ready (including empty results or a fetch failure). The page passes a
+   * redirect only during onboarding replay; an established user gets `undefined`
+   * and stays on the page.
+   */
+  onNoReadyScan?: () => void;
+}
+
+export interface UseAttackPathScansResult {
+  scans: AttackPathScan[];
+  scansLoading: boolean;
+  refreshScans: () => Promise<void>;
+}
+
+/**
+ * `useData`-style hook owning the Attack Paths scan list. The direct
+ * `useEffect` (via `useMountEffect`) lives here, not in the component: the
+ * project forbids `useEffect` in components, but a reusable data hook is the
+ * sanctioned place for a mount-time fetch when no fetching library is wired up.
+ */
+export function useAttackPathScans(
+  options: UseAttackPathScansOptions = {},
+): UseAttackPathScansResult {
+  const { onNoReadyScan } = options;
+
+  const [scans, setScans] = useState<AttackPathScan[]>([]);
+  const [scansLoading, setScansLoading] = useState(true);
+
+  const refreshScans = async () => {
+    try {
+      const scansData = await getAttackPathScans();
+      if (scansData?.data) {
+        setScans(scansData.data);
+      }
+    } catch (error) {
+      console.error("Failed to refresh scans:", error);
+    }
+  };
+
+  useMountEffect(() => {
+    let active = true;
+
+    const loadScans = async () => {
+      setScansLoading(true);
+      try {
+        const scansData = await getAttackPathScans();
+        const nextScans = scansData?.data ?? [];
+        if (!active) return;
+        setScans(nextScans);
+        if (!nextScans.some((scan) => scan.attributes.graph_data_ready)) {
+          onNoReadyScan?.();
+        }
+      } catch (error) {
+        if (!active) return;
+        console.error("Failed to load scans:", error);
+        setScans([]);
+        onNoReadyScan?.();
+      } finally {
+        if (active) setScansLoading(false);
+      }
+    };
+
+    void loadScans();
+
+    return () => {
+      active = false;
+    };
+  });
+
+  return { scans, scansLoading, refreshScans };
+}
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.test.tsx
deleted file mode 100644
index 8b91c3fb6e..0000000000
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.test.tsx
+++ /dev/null
@@ -1,19 +0,0 @@
-import { readFileSync } from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-import { describe, expect, it } from "vitest";
-
-describe("AttackPathsPage", () => {
-  const currentDir = path.dirname(fileURLToPath(import.meta.url));
-  const filePath = path.join(currentDir, "attack-paths-page.tsx");
-  const source = readFileSync(filePath, "utf8");
-
-  it("keeps the page description without rendering a duplicate Attack Paths heading", () => {
-    // Then
-    expect(source).not.toContain(">\n          Attack Paths\n        </h2>");
-    expect(source).toContain(
-      "Select a scan, build a query, and visualize Attack Paths in your",
-    );
-  });
-});
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
index 992fdee5ef..07f36912e4 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
@@ -2,7 +2,7 @@
 
 import { ArrowLeft, Info, Maximize2 } from "lucide-react";
 import Link from "next/link";
-import { useSearchParams } from "next/navigation";
+import { usePathname, useRouter, useSearchParams } from "next/navigation";
 import { Suspense, useEffect, useRef, useState } from "react";
 import { FormProvider } from "react-hook-form";
 
@@ -10,11 +10,11 @@ import {
   buildAttackPathQueries,
   executeCustomQuery,
   executeQuery,
-  getAttackPathScans,
   getAvailableQueries,
 } from "@/actions/attack-paths";
 import { adaptQueryResultToGraphData } from "@/actions/attack-paths/query-result.adapter";
 import { FindingDetailDrawer } from "@/components/findings/table";
+import { PageReady } from "@/components/onboarding";
 import { useFindingDetails } from "@/components/resources/table/use-finding-details";
 import { AutoRefresh } from "@/components/scans";
 import {
@@ -32,10 +32,19 @@ import {
   DialogTrigger,
 } from "@/components/shadcn/dialog";
 import { useToast } from "@/components/ui";
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { isCloud } from "@/lib/shared/env";
+import {
+  attackPathsTour,
+  type AttackPathsTourTarget,
+  pickDemoQuery,
+  pickDemoScan,
+} from "@/lib/tours/attack-paths.tour";
+import { attackPathsEmptyTour } from "@/lib/tours/attack-paths-empty.tour";
+import { advanceActiveTour, useDriverTour } from "@/lib/tours/use-driver-tour";
 import type {
   AttackPathQuery,
   AttackPathQueryError,
-  AttackPathScan,
   GraphNode,
 } from "@/types/attack-paths";
 import { ATTACK_PATH_QUERY_IDS, SCAN_STATES } from "@/types/attack-paths";
@@ -53,23 +62,30 @@ import {
   ScanListTable,
 } from "./_components";
 import type { GraphHandle } from "./_components/graph/attack-path-graph";
+import { useAttackPathScans } from "./_hooks/use-attack-path-scans";
 import { useGraphState } from "./_hooks/use-graph-state";
 import { useQueryBuilder } from "./_hooks/use-query-builder";
 import { exportGraphAsPNG } from "./_lib";
 
-/**
- * Attack Paths
- * Allows users to select a scan, build a query, and visualize the attack path graph
- */
 export default function AttackPathsPage() {
   const searchParams = useSearchParams();
+  const pathname = usePathname();
+  const router = useRouter();
   const scanId = searchParams.get("scanId");
+  // Onboarding tours are Cloud-only.
+  const onboardingEnabled = isCloud();
+  const isAttackPathsReplay =
+    onboardingEnabled && searchParams.get("onboarding") === "attack-paths";
   const graphState = useGraphState();
   const finding = useFindingDetails();
   const { toast } = useToast();
 
-  const [scansLoading, setScansLoading] = useState(true);
-  const [scans, setScans] = useState<AttackPathScan[]>([]);
+  const { scans, scansLoading, refreshScans } = useAttackPathScans({
+    onNoReadyScan: isAttackPathsReplay
+      ? () => router.push("/scans?onboarding=view-first-scan")
+      : undefined,
+  });
+
   const [queriesLoading, setQueriesLoading] = useState(true);
   const [queriesError, setQueriesError] = useState<string | null>(null);
   const [isFullscreenOpen, setIsFullscreenOpen] = useState(false);
@@ -81,10 +97,62 @@ export default function AttackPathsPage() {
 
   const [queries, setQueries] = useState<AttackPathQuery[]>([]);
 
-  // Use custom hook for query builder form state and validation
   const queryBuilder = useQueryBuilder(queries);
 
-  // Reset graph state when component mounts
+  const hasReadyScan = scans.some((scan) => scan.attributes.graph_data_ready);
+  const hasNoScans = scans.length === 0;
+
+  useDriverTour(attackPathsEmptyTour, {
+    enabled: onboardingEnabled && !scansLoading && hasNoScans,
+  });
+
+  const { start: startAttackPathsTour } = useDriverTour<AttackPathsTourTarget>(
+    attackPathsTour,
+    {
+      enabled: onboardingEnabled && !scansLoading && hasReadyScan,
+      autoOpen: !isAttackPathsReplay,
+      // Page owns tour auto-open; OnboardingSequenceBanner is the sole Continue/Skip control.
+      // pickDemoScan/pickDemoQuery policy lives in attack-paths.tour.ts.
+      stepHandlers: {
+        "scan-list": {
+          onNext: async ({ waitForStep }) => {
+            const selected = pickDemoScan(scans);
+            if (!selected) return;
+            const params = new URLSearchParams(searchParams.toString());
+            params.set("scanId", selected.id);
+            router.push(`${pathname}?${params.toString()}`);
+            await waitForStep("query-selector");
+          },
+        },
+        "query-selector": {
+          onNext: async ({ waitForStep }) => {
+            const selected = pickDemoQuery(queries);
+            if (!selected) return;
+            queryBuilder.handleQueryChange(selected.id);
+            await waitForStep("execute-button");
+          },
+        },
+      },
+    },
+  );
+
+  // Onboarding replay entry: start the tour once and strip the `onboarding`
+  // param. Invoked from <AttackPathsReplayTrigger>, which mounts only when the
+  // replay conditions hold — so `useMountEffect` fires it exactly once and the
+  // old `replayStartedRef` run-once guard is gone.
+  const startAttackPathsReplay = () => {
+    startAttackPathsTour();
+
+    const params = new URLSearchParams(searchParams.toString());
+    params.delete("onboarding");
+    const query = params.toString();
+    window.history.replaceState(
+      null,
+      "",
+      query ? `${pathname}?${query}` : pathname,
+    );
+  };
+
   useEffect(() => {
     if (!hasResetRef.current) {
       hasResetRef.current = true;
@@ -92,60 +160,22 @@ export default function AttackPathsPage() {
     }
   }, [graphState]);
 
-  // Reset graph state when scan changes
   useEffect(() => {
     graphState.resetGraph();
   }, [scanId]); // eslint-disable-line react-hooks/exhaustive-deps -- reset on scanId change only
 
-  // Load available scans on mount
-  useEffect(() => {
-    const loadScans = async () => {
-      setScansLoading(true);
-      try {
-        const scansData = await getAttackPathScans();
-        if (scansData?.data) {
-          setScans(scansData.data);
-        } else {
-          setScans([]);
-        }
-      } catch (error) {
-        console.error("Failed to load scans:", error);
-        setScans([]);
-      } finally {
-        setScansLoading(false);
-      }
-    };
-
-    loadScans();
-  }, []);
-
-  // Check if there's an executing scan for auto-refresh
   const hasExecutingScan = scans.some(
     (scan) =>
       scan.attributes.state === SCAN_STATES.EXECUTING ||
       scan.attributes.state === SCAN_STATES.SCHEDULED,
   );
 
-  // Detect if the selected scan is showing data from a previous cycle
   const selectedScan = scans.find((scan) => scan.id === scanId);
   const isViewingPreviousCycleData =
     selectedScan &&
     selectedScan.attributes.graph_data_ready &&
     selectedScan.attributes.state !== SCAN_STATES.COMPLETED;
 
-  // Callback to refresh scans (used by AutoRefresh component)
-  const refreshScans = async () => {
-    try {
-      const scansData = await getAttackPathScans();
-      if (scansData?.data) {
-        setScans(scansData.data);
-      }
-    } catch (error) {
-      console.error("Failed to refresh scans:", error);
-    }
-  };
-
-  // Load available queries on mount
   useEffect(() => {
     const loadQueries = async () => {
       if (!scanId) {
@@ -205,7 +235,6 @@ export default function AttackPathsPage() {
       return;
     }
 
-    // Validate form before executing query
     const isValid = await queryBuilder.form.trigger();
     if (!isValid) {
       showErrorToast(
@@ -215,6 +244,9 @@ export default function AttackPathsPage() {
       return;
     }
 
+    // The tour's execute step is autoAdvance: the real Execute click moves it forward.
+    advanceActiveTour();
+
     graphState.startLoading();
     graphState.setError(null);
 
@@ -257,7 +289,6 @@ export default function AttackPathsPage() {
           variant: "default",
         });
 
-        // Scroll to graph after successful query execution
         setTimeout(() => {
           graphContainerRef.current?.scrollIntoView({
             behavior: "smooth",
@@ -297,13 +328,9 @@ export default function AttackPathsPage() {
       }
 
       findingNavigationInFlightRef.current = true;
-      // Findings skip the intermediate node-details modal. The finding drawer
-      // is the useful destination, so open it directly from the graph click.
+      // Open finding drawer directly, bypassing the node-details modal.
       graphState.enterFilteredView(node.id);
-      // enterFilteredView stores the filtered node as selected so the graph can
-      // highlight it. Clear the selection right after for findings so the node
-      // details modal does not open before the finding drawer.
-      graphState.selectNode(null);
+      graphState.selectNode(null); // clear so node-details modal doesn't open first
       void handleViewFinding(String(node.properties?.id || node.id));
       return;
     }
@@ -368,14 +395,19 @@ export default function AttackPathsPage() {
 
   return (
     <div className="flex flex-col gap-6">
-      {/* Auto-refresh scans when there's an executing scan */}
       <AutoRefresh
         hasExecutingScan={hasExecutingScan}
         onRefresh={refreshScans}
       />
 
-      {/* Page introduction */}
-      <div>
+      {isAttackPathsReplay && !scansLoading && hasReadyScan && (
+        <AttackPathsReplayTrigger onReplay={startAttackPathsReplay} />
+      )}
+
+      {/* Enables the navbar replay icon once the initial scan load resolves. */}
+      {!scansLoading && <PageReady />}
+
+      <div data-tour-id="attack-paths-intro">
         <p className="text-text-neutral-secondary text-sm">
           Select a scan, build a query, and visualize Attack Paths in your
           infrastructure.
@@ -390,27 +422,27 @@ export default function AttackPathsPage() {
         <div className="minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4">
           <p className="text-sm">Loading scans...</p>
         </div>
-      ) : scans.length === 0 ? (
-        <Alert variant="info">
-          <Info className="size-4" />
-          <AlertTitle>No scans available</AlertTitle>
-          <AlertDescription>
-            <span>
-              You need to run a scan before you can analyze attack paths.{" "}
-              <Link href="/scans" className="font-medium underline">
-                Go to Scan Jobs
-              </Link>
-            </span>
-          </AlertDescription>
-        </Alert>
+      ) : hasNoScans ? (
+        <div data-tour-id="attack-paths-empty-scans-cta">
+          <Alert variant="info">
+            <Info className="size-4" />
+            <AlertTitle>No scans available</AlertTitle>
+            <AlertDescription>
+              <span>
+                You need to run a scan before you can analyze attack paths.{" "}
+                <Link href="/scans" className="font-medium underline">
+                  Go to Scan Jobs
+                </Link>
+              </span>
+            </AlertDescription>
+          </Alert>
+        </div>
       ) : (
         <>
-          {/* Scans Table */}
           <Suspense fallback={<div>Loading scans...</div>}>
             <ScanListTable scans={scans} />
           </Suspense>
 
-          {/* Banner: viewing data from a previous scan cycle */}
           {isViewingPreviousCycleData && (
             <Alert variant="info">
               <Info className="size-4" />
@@ -425,7 +457,6 @@ export default function AttackPathsPage() {
             </Alert>
           )}
 
-          {/* Query Builder Section - shown only after selecting a scan */}
           {scanId && (
             <div className="minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4">
               {queriesLoading ? (
@@ -438,11 +469,13 @@ export default function AttackPathsPage() {
               ) : (
                 <>
                   <FormProvider {...queryBuilder.form}>
-                    <QuerySelector
-                      queries={queries}
-                      selectedQueryId={queryBuilder.selectedQuery}
-                      onQueryChange={queryBuilder.handleQueryChange}
-                    />
+                    <div data-tour-id="attack-paths-query-selector">
+                      <QuerySelector
+                        queries={queries}
+                        selectedQueryId={queryBuilder.selectedQuery}
+                        onQueryChange={queryBuilder.handleQueryChange}
+                      />
+                    </div>
 
                     {queryBuilder.selectedQueryData && (
                       <QueryDescription
@@ -457,7 +490,10 @@ export default function AttackPathsPage() {
                     )}
                   </FormProvider>
 
-                  <div className="flex justify-end gap-3">
+                  <div
+                    data-tour-id="attack-paths-execute-button"
+                    className="flex justify-end gap-3"
+                  >
                     <ExecuteButton
                       isLoading={graphState.loading}
                       isDisabled={
@@ -476,7 +512,6 @@ export default function AttackPathsPage() {
             </div>
           )}
 
-          {/* Graph Visualization (Full Width) */}
           {(graphState.loading ||
             (graphState.data &&
               graphState.data.nodes &&
@@ -488,7 +523,6 @@ export default function AttackPathsPage() {
                 graphState.data.nodes &&
                 graphState.data.nodes.length > 0 ? (
                 <>
-                  {/* Info message and controls */}
                   <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
                     {graphState.isFilteredView ? (
                       <div className="flex items-center gap-3">
@@ -537,7 +571,6 @@ export default function AttackPathsPage() {
                       </div>
                     )}
 
-                    {/* Graph controls and fullscreen button together */}
                     <div className="flex items-center gap-2">
                       <GraphControls
                         onZoomIn={() => graphRef.current?.zoomIn()}
@@ -546,7 +579,6 @@ export default function AttackPathsPage() {
                         onExport={() => handleGraphExport("main")}
                       />
 
-                      {/* Fullscreen button */}
                       <div className="border-border-neutral-primary bg-bg-neutral-tertiary flex gap-1 rounded-lg border p-1">
                         <Dialog
                           open={isFullscreenOpen}
@@ -604,7 +636,6 @@ export default function AttackPathsPage() {
                     </div>
                   </div>
 
-                  {/* Graph in the middle */}
                   <div
                     ref={graphContainerRef}
                     className="h-[calc(100vh-22rem)]"
@@ -619,7 +650,6 @@ export default function AttackPathsPage() {
                     />
                   </div>
 
-                  {/* Legend below */}
                   <div className="flex justify-center overflow-x-auto">
                     <GraphLegend
                       data={graphState.data}
@@ -647,3 +677,26 @@ export default function AttackPathsPage() {
     </div>
   );
 }
+
+interface AttackPathsReplayTriggerProps {
+  onReplay: () => void;
+}
+
+// Conditional-mount trigger: the parent renders this only when the replay
+// should start. The microtask keeps driver.js/flushSync outside React's
+// mount lifecycle while still running before the next browser task.
+function AttackPathsReplayTrigger({ onReplay }: AttackPathsReplayTriggerProps) {
+  useMountEffect(() => {
+    let cancelled = false;
+
+    queueMicrotask(() => {
+      if (!cancelled) onReplay();
+    });
+
+    return () => {
+      cancelled = true;
+    };
+  });
+
+  return null;
+}
diff --git a/ui/app/(prowler)/attack-paths/layout.tsx b/ui/app/(prowler)/attack-paths/layout.tsx
index 5ff93faab2..3a9a90b6d1 100644
--- a/ui/app/(prowler)/attack-paths/layout.tsx
+++ b/ui/app/(prowler)/attack-paths/layout.tsx
@@ -6,7 +6,11 @@ export default function AttackPathsLayout({
   children: React.ReactNode;
 }) {
   return (
-    <ContentLayout title="Attack Paths" icon="lucide:git-branch">
+    <ContentLayout
+      title="Attack Paths"
+      icon="lucide:git-branch"
+      onboardingAction={{ flowId: "attack-paths" }}
+    >
       {children}
     </ContentLayout>
   );
diff --git a/ui/app/(prowler)/compliance/page.tsx b/ui/app/(prowler)/compliance/page.tsx
index a67509bed1..d4ee609a0c 100644
--- a/ui/app/(prowler)/compliance/page.tsx
+++ b/ui/app/(prowler)/compliance/page.tsx
@@ -46,16 +46,26 @@ export default async function Compliance({
   });
 
   if (!scansData?.data) {
-    return <NoScansAvailable />;
+    return (
+      <ContentLayout
+        title="Compliance"
+        icon="lucide:shield-check"
+        onboardingAction={{
+          flowId: "view-compliance",
+          fallbackFlowId: "view-first-scan",
+          useFallback: true,
+        }}
+      >
+        <NoScansAvailable />
+      </ContentLayout>
+    );
   }
 
-  // Process scans with provider information from included data
   const expandedScansData: ExpandedScanData[] = scansData.data
     .filter((scan: ScanProps) => scan.relationships?.provider?.data?.id)
     .map((scan: ScanProps) => {
       const providerId = scan.relationships!.provider!.data!.id;
 
-      // Find the provider data in the included array
       const providerData = scansData.included?.find(
         (item: { type: string; id: string }) =>
           item.type === "providers" && item.id === providerId,
@@ -76,15 +86,20 @@ export default async function Compliance({
     })
     .filter(Boolean) as ExpandedScanData[];
 
-  // Use scanId from URL, or select the first scan if not provided
   const scanIdParam = resolvedSearchParams.scanId;
   const scanIdFromUrl = Array.isArray(scanIdParam)
     ? scanIdParam[0]
     : scanIdParam;
   const selectedScanId: string | null =
     scanIdFromUrl || expandedScansData[0]?.id || null;
+  const onboardingAction = selectedScanId
+    ? { flowId: "view-compliance" }
+    : {
+        flowId: "view-compliance",
+        fallbackFlowId: "view-first-scan",
+        useFallback: true,
+      };
 
-  // Find the selected scan
   const selectedScan = expandedScansData.find(
     (scan) => scan.id === selectedScanId,
   );
@@ -100,7 +115,6 @@ export default async function Compliance({
       }
     : undefined;
 
-  // Fetch metadata if we have a selected scan
   const metadataInfoData = selectedScanId
     ? await getComplianceOverviewMetadataInfo({
         filters: {
@@ -111,7 +125,6 @@ export default async function Compliance({
 
   const uniqueRegions = metadataInfoData?.data?.attributes?.regions || [];
 
-  // Fetch ThreatScore data from API if we have a selected scan
   let threatScoreData = null;
   if (selectedScanId && typeof selectedScanId === "string") {
     const threatScoreResponse = await getThreatScore({
@@ -128,10 +141,13 @@ export default async function Compliance({
   }
 
   return (
-    <ContentLayout title="Compliance" icon="lucide:shield-check">
+    <ContentLayout
+      title="Compliance"
+      icon="lucide:shield-check"
+      onboardingAction={onboardingAction}
+    >
       {selectedScanId ? (
         <>
-          {/* Row 1: Filters */}
           <div className="mb-6">
             <ComplianceFilters
               scans={expandedScansData}
@@ -140,7 +156,6 @@ export default async function Compliance({
             />
           </div>
 
-          {/* Row 2: ThreatScore card — full width, horizontal */}
           {threatScoreData &&
             typeof selectedScanId === "string" &&
             selectedScan && (
@@ -155,7 +170,6 @@ export default async function Compliance({
               </div>
             )}
 
-          {/* Row 3: Compliance grid with client-side search */}
           <Suspense
             key={searchParamsKey}
             fallback={
@@ -189,7 +203,6 @@ const SSRComplianceGrid = async ({
 }) => {
   const regionFilter = searchParams["filter[region__in]"]?.toString() || "";
 
-  // Only fetch compliance data if we have a valid scanId
   const compliancesData =
     scanId && scanId.trim() !== ""
       ? await getCompliancesOverview({
@@ -207,7 +220,6 @@ const SSRComplianceGrid = async ({
       a.attributes.framework.localeCompare(b.attributes.framework),
     );
 
-  // Check if the response contains no data
   if (
     !compliancesData ||
     !compliancesData.data ||
@@ -225,7 +237,6 @@ const SSRComplianceGrid = async ({
     );
   }
 
-  // Handle errors returned by the API
   if (compliancesData?.errors?.length > 0) {
     return (
       <Alert variant="info">
@@ -235,10 +246,7 @@ const SSRComplianceGrid = async ({
     );
   }
 
-  // Compute the set of latest CIS variants per provider once, so each card
-  // can gate its PDF button without re-parsing on every render. The backend
-  // only generates a CIS PDF for the latest version per provider, so any
-  // other CIS card must not expose the PDF download button.
+  // Backend only generates CIS PDFs for the latest version per provider.
   const latestCisIds = pickLatestCisPerProvider(
     compliancesData.data.map(
       (compliance: ComplianceOverviewData) => compliance.id,
diff --git a/ui/app/(prowler)/findings/page.tsx b/ui/app/(prowler)/findings/page.tsx
index 7ff9780292..65e8eca9cd 100644
--- a/ui/app/(prowler)/findings/page.tsx
+++ b/ui/app/(prowler)/findings/page.tsx
@@ -59,7 +59,6 @@ export default async function Findings({
     filters: resolvedFilters,
   });
 
-  // Extract unique regions, services, categories, groups from the new endpoint
   const uniqueRegions = metadataInfoData?.data?.attributes?.regions || [];
   const uniqueServices = metadataInfoData?.data?.attributes?.services || [];
   const uniqueResourceTypes =
@@ -67,7 +66,6 @@ export default async function Findings({
   const uniqueCategories = metadataInfoData?.data?.attributes?.categories || [];
   const uniqueGroups = metadataInfoData?.data?.attributes?.groups || [];
 
-  // Extract scan UUIDs with "completed" state and more than one resource
   const completedScans = scansData?.data?.filter(
     (scan: ScanProps) =>
       scan.attributes.state === "completed" &&
@@ -76,6 +74,14 @@ export default async function Findings({
 
   const completedScanIds =
     completedScans?.map((scan: ScanProps) => scan.id) || [];
+  const onboardingAction =
+    completedScanIds.length > 0
+      ? { flowId: "explore-findings" }
+      : {
+          flowId: "explore-findings",
+          fallbackFlowId: "view-first-scan",
+          useFallback: true,
+        };
 
   const scanDetails = createScanDetailsMapping(
     completedScans || [],
@@ -84,7 +90,11 @@ export default async function Findings({
   const alertsEnabled = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
 
   return (
-    <ContentLayout title="Findings" icon="lucide:tag">
+    <ContentLayout
+      title="Findings"
+      icon="lucide:tag"
+      onboardingAction={onboardingAction}
+    >
       <FilterTransitionWrapper>
         <div className="mb-6">
           <FindingsFilters
@@ -146,9 +156,8 @@ const SSRDataTable = async ({
     pageSize,
   });
 
-  // Transform API response to FindingGroupRow[]
   const groups = adaptFindingGroupsResponse(findingGroupsData);
-  // Key resets all client state (selection, drill-down) when data changes
+  // Key resets client state (selection, drill-down) when data changes.
   const groupKey = groups.map((g) => g.id).join(",");
 
   return (
diff --git a/ui/app/(prowler)/layout.tsx b/ui/app/(prowler)/layout.tsx
index 958dfc80d6..a093232e1c 100644
--- a/ui/app/(prowler)/layout.tsx
+++ b/ui/app/(prowler)/layout.tsx
@@ -2,16 +2,24 @@ import "@/styles/globals.css";
 
 import * as Sentry from "@sentry/nextjs";
 import { Metadata, Viewport } from "next";
-import { ReactNode } from "react";
+import { ReactNode, Suspense } from "react";
 
 import { getProviders } from "@/actions/providers";
+import { getScansByState } from "@/actions/scans/scans";
+import {
+  OnboardingCheckpointWatcher,
+  OnboardingGate,
+  OnboardingSequenceBanner,
+} from "@/components/onboarding";
 import MainLayout from "@/components/ui/main-layout/main-layout";
 import { NavigationProgress } from "@/components/ui/navigation-progress";
 import { Toaster } from "@/components/ui/toast";
 import { fontSans } from "@/config/fonts";
 import { siteConfig } from "@/config/site";
+import { isCloud } from "@/lib/shared/env";
 import { cn } from "@/lib/utils";
 import { StoreInitializer } from "@/store/ui/store-initializer";
+import { SCAN_STATES } from "@/types/attack-paths";
 
 import { Providers } from "../providers";
 
@@ -41,8 +49,30 @@ export default async function RootLayout({
 }: {
   children: ReactNode;
 }) {
-  const providersData = await getProviders({ page: 1, pageSize: 1 });
-  const hasProviders = !!(providersData?.data && providersData.data.length > 0);
+  // Onboarding is Cloud-only; skip its fetches and orchestrators in OSS.
+  const onboardingEnabled = isCloud();
+
+  // Fail-open: unknown scan state is treated as "has data" so the banner never blocks
+  // progression on a fetch error.
+  let hasCompletedScan = true;
+  // Tri-state: true = has providers, false = zero providers, undefined = fetch failed (gate fails open).
+  let hasProviders: boolean | undefined = false;
+
+  if (onboardingEnabled) {
+    const [providersData, scansByState] = await Promise.all([
+      getProviders({ page: 1, pageSize: 1 }),
+      getScansByState(),
+    ]);
+    hasCompletedScan = Array.isArray(scansByState?.data)
+      ? scansByState.data.some(
+          (scan: { attributes?: { state?: string } }) =>
+            scan.attributes?.state === SCAN_STATES.COMPLETED,
+        )
+      : true;
+    hasProviders = Array.isArray(providersData?.data)
+      ? providersData.data.length > 0
+      : undefined;
+  }
 
   return (
     <html suppressHydrationWarning lang="en">
@@ -55,8 +85,22 @@ export default async function RootLayout({
         )}
       >
         <Providers themeProps={{ attribute: "class", defaultTheme: "dark" }}>
-          <NavigationProgress />
-          <StoreInitializer values={{ hasProviders }} />
+          {/* Suspense contains the useSearchParams() CSR bailout so statically
+              prerendered pages don't fail the build (matches the auth layout). */}
+          <Suspense>
+            <NavigationProgress />
+          </Suspense>
+          {/* Store uses boolean; gate receives tri-state to fail open on fetch errors. */}
+          <StoreInitializer values={{ hasProviders: hasProviders ?? false }} />
+          {onboardingEnabled && (
+            <>
+              <OnboardingGate hasProviders={hasProviders} />
+              {/* Single mount point so the watcher survives post-connect navigation. */}
+              <OnboardingCheckpointWatcher />
+              {/* Persistent banner shown only while a guided sequence is active. */}
+              <OnboardingSequenceBanner hasCompletedScan={hasCompletedScan} />
+            </>
+          )}
           <MainLayout>{children}</MainLayout>
           <Toaster />
         </Providers>
diff --git a/ui/app/(prowler)/providers/page.tsx b/ui/app/(prowler)/providers/page.tsx
index 0ec08e5e11..e6186df10a 100644
--- a/ui/app/(prowler)/providers/page.tsx
+++ b/ui/app/(prowler)/providers/page.tsx
@@ -22,12 +22,22 @@ export default async function Providers({
   const activeTab = getProviderTab(resolvedSearchParams.tab);
   const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
 
-  // Exclude `tab` from the Suspense key so switching tabs doesn't re-suspend
-  const { tab: _, ...paramsWithoutTab } = resolvedSearchParams || {};
-  const searchParamsKey = JSON.stringify(paramsWithoutTab);
+  // Exclude `tab` and `onboarding` from the key: tab switches must not re-suspend,
+  // and `onboarding` is ephemeral (stripped via history.replaceState) — keeping it
+  // would remount ProvidersAccountsView and reset the wizard mid-flow.
+  const {
+    tab: _tab,
+    onboarding: _onboarding,
+    ...stableParams
+  } = resolvedSearchParams || {};
+  const searchParamsKey = JSON.stringify(stableParams);
 
   return (
-    <ContentLayout title="Providers" icon="lucide:cloud-cog">
+    <ContentLayout
+      title="Providers"
+      icon="lucide:cloud-cog"
+      onboardingAction={{ flowId: "add-provider" }}
+    >
       {isCloudEnvironment && <CliImportBanner className="mb-6" />}
       <FilterTransitionWrapper>
         <ProviderPageTabs
@@ -58,15 +68,10 @@ const ProvidersTableFallback = () => {
   return (
     <div className="flex flex-col gap-6">
       <div className="flex flex-wrap items-center gap-4">
-        {/* ProviderTypeSelector */}
         <Skeleton className="h-[52px] min-w-[200px] flex-1 rounded-lg md:max-w-[280px]" />
-        {/* Organizations filter */}
         <Skeleton className="h-[52px] max-w-[240px] min-w-[180px] flex-1 rounded-lg" />
-        {/* Provider Groups filter */}
         <Skeleton className="h-[52px] max-w-[240px] min-w-[180px] flex-1 rounded-lg" />
-        {/* Status filter */}
         <Skeleton className="h-[52px] max-w-[240px] min-w-[180px] flex-1 rounded-lg" />
-        {/* Action buttons */}
         <div className="ml-auto flex flex-wrap gap-4">
           <Skeleton className="h-9 w-[160px] rounded-md" />
           <Skeleton className="h-9 w-[120px] rounded-md" />
diff --git a/ui/app/(prowler)/scans/page.test.ts b/ui/app/(prowler)/scans/page.test.ts
new file mode 100644
index 0000000000..3ea7bcfa7c
--- /dev/null
+++ b/ui/app/(prowler)/scans/page.test.ts
@@ -0,0 +1,23 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+import { describe, expect, it } from "vitest";
+
+describe("scans page onboarding", () => {
+  const currentDir = path.dirname(fileURLToPath(import.meta.url));
+  const pagePath = path.join(currentDir, "page.tsx");
+  const source = readFileSync(pagePath, "utf8");
+
+  it("redirects the scan tour replay to add-provider when providers are missing or disconnected", () => {
+    expect(source).toContain('redirect("/providers?onboarding=add-provider")');
+    expect(source).toContain(
+      'resolvedSearchParams.onboarding === "view-first-scan"',
+    );
+  });
+
+  it("passes the scan onboarding action to the page header when the tour can run", () => {
+    expect(source).toContain('flowId: "view-first-scan"');
+    expect(source).toContain("onboardingAction={onboardingAction}");
+  });
+});
diff --git a/ui/app/(prowler)/scans/page.tsx b/ui/app/(prowler)/scans/page.tsx
index 62aba551ae..4bde757224 100644
--- a/ui/app/(prowler)/scans/page.tsx
+++ b/ui/app/(prowler)/scans/page.tsx
@@ -1,8 +1,10 @@
+import { redirect } from "next/navigation";
 import { Suspense } from "react";
 
 import { getAllProviders } from "@/actions/providers";
 import { getScans } from "@/actions/scans";
 import { auth } from "@/auth.config";
+import { PageReady } from "@/components/onboarding";
 import {
   getScanJobsTab,
   getScanJobsTabFilters,
@@ -69,19 +71,45 @@ export default async function Scans({
   const thereIsNoProviders = providers.length === 0;
   const thereIsNoProvidersConnected =
     !thereIsNoProviders && connectedProviders.length === 0;
+  const missingScanPrerequisite =
+    thereIsNoProviders || thereIsNoProvidersConnected;
+
+  if (
+    missingScanPrerequisite &&
+    resolvedSearchParams.onboarding === "view-first-scan"
+  ) {
+    redirect("/providers?onboarding=add-provider");
+  }
 
   const hasManageScansPermission = Boolean(
     session?.user?.permissions?.manage_scans,
   );
-  const activeScanCount =
-    thereIsNoProviders || thereIsNoProvidersConnected
-      ? 0
-      : await getActiveScanCount(resolvedSearchParams);
+  const activeScanCount = missingScanPrerequisite
+    ? 0
+    : await getActiveScanCount(resolvedSearchParams);
+  const onboardingAction = missingScanPrerequisite
+    ? {
+        flowId: "view-first-scan",
+        fallbackFlowId: "add-provider",
+        useFallback: true,
+      }
+    : { flowId: "view-first-scan" };
 
   return (
-    <ContentLayout title="Scan Jobs" icon="lucide:timer">
-      {thereIsNoProviders || thereIsNoProvidersConnected ? (
-        <ScansProvidersEmptyState thereIsNoProviders={thereIsNoProviders} />
+    <ContentLayout
+      title="Scan Jobs"
+      icon="lucide:timer"
+      onboardingAction={onboardingAction}
+    >
+      {missingScanPrerequisite ? (
+        <>
+          {/* The populated branch mounts <PageReady/> inside ScansPageShell to
+              enable the navbar tour icon. The empty branch must mark the route
+              ready too, otherwise the icon (which falls back to the add-provider
+              flow here) stays hidden for users with no connected provider. */}
+          <PageReady />
+          <ScansProvidersEmptyState thereIsNoProviders={thereIsNoProviders} />
+        </>
       ) : (
         <ScansPageShell
           providers={providers}
diff --git a/ui/components/compliance/compliance-card.tsx b/ui/components/compliance/compliance-card.tsx
index 98d3949016..3972bb8db4 100644
--- a/ui/components/compliance/compliance-card.tsx
+++ b/ui/components/compliance/compliance-card.tsx
@@ -10,6 +10,7 @@ import {
   TooltipContent,
   TooltipTrigger,
 } from "@/components/shadcn/tooltip";
+import { buildComplianceDetailPath } from "@/lib/compliance/compliance-detail-url";
 import { getReportTypeForCompliance } from "@/lib/compliance/compliance-report-types";
 import {
   getScoreIndicatorClass,
@@ -69,20 +70,15 @@ export const ComplianceCard: React.FC<ComplianceCardProps> = ({
   };
 
   const navigateToDetail = () => {
-    const formattedTitleForUrl = encodeURIComponent(title);
-    const path = `/compliance/${formattedTitleForUrl}`;
-    const params = new URLSearchParams();
-
-    params.set("complianceId", id);
-    params.set("version", version);
-    params.set("scanId", scanId);
-
-    const regionFilter = searchParams.get("filter[region__in]");
-    if (regionFilter) {
-      params.set("filter[region__in]", regionFilter);
-    }
-
-    router.push(`${path}?${params.toString()}`);
+    router.push(
+      buildComplianceDetailPath({
+        title,
+        complianceId: id,
+        version,
+        scanId,
+        regionFilter: searchParams.get("filter[region__in]"),
+      }),
+    );
   };
 
   return (
diff --git a/ui/components/compliance/compliance-overview-grid.tsx b/ui/components/compliance/compliance-overview-grid.tsx
index 280465520a..b042ccc658 100644
--- a/ui/components/compliance/compliance-overview-grid.tsx
+++ b/ui/components/compliance/compliance-overview-grid.tsx
@@ -1,12 +1,26 @@
 "use client";
 
-import { useState } from "react";
+import { useRouter, useSearchParams } from "next/navigation";
+import { Suspense, useState } from "react";
 
 import { ComplianceCard } from "@/components/compliance/compliance-card";
+import { OnboardingTrigger, PageReady } from "@/components/onboarding";
 import { DataTableSearch } from "@/components/ui/table/data-table-search";
+import { buildComplianceDetailPath } from "@/lib/compliance/compliance-detail-url";
+import { getFlowById } from "@/lib/onboarding";
+import { createViewComplianceTourStepHandlers } from "@/lib/tours/view-compliance.tour";
 import type { ComplianceOverviewData } from "@/types/compliance";
 import type { ScanEntity } from "@/types/scans";
 
+const viewComplianceFlow = getFlowById("view-compliance")!;
+
+// Module-level so the identity is stable: `configOverrides` is an effect dependency in
+// `useDriverTour`, and a fresh object per keystroke would tear the tour down mid-typing.
+const VIEW_COMPLIANCE_TOUR_CONFIG = {
+  // Last step opens the first card (see createViewComplianceTourStepHandlers).
+  doneBtnText: "Open Compliance",
+};
+
 interface ComplianceOverviewGridProps {
   frameworks: ComplianceOverviewData[];
   scanId: string;
@@ -25,6 +39,8 @@ export const ComplianceOverviewGrid = ({
   selectedScan,
   latestCisIds,
 }: ComplianceOverviewGridProps) => {
+  const router = useRouter();
+  const searchParams = useSearchParams();
   const [searchTerm, setSearchTerm] = useState("");
 
   const filteredFrameworks = frameworks.filter((compliance) =>
@@ -33,20 +49,54 @@ export const ComplianceOverviewGrid = ({
       .includes(searchTerm.toLowerCase()),
   );
 
+  const resetSearch = () => {
+    setSearchTerm("");
+    return frameworks.length > 0;
+  };
+
+  const openFirstFramework = () => {
+    const first = frameworks[0];
+    if (!first) return;
+    router.push(
+      buildComplianceDetailPath({
+        title: first.attributes.framework,
+        complianceId: first.id,
+        version: first.attributes.version,
+        scanId,
+        regionFilter: searchParams.get("filter[region__in]"),
+      }),
+    );
+  };
+
   return (
     <>
-      <div className="flex items-center justify-between gap-4">
-        <DataTableSearch
-          controlledValue={searchTerm}
-          onSearchChange={setSearchTerm}
-          placeholder="Search frameworks..."
+      {/* Suspense required: OnboardingTrigger reads useSearchParams */}
+      <Suspense fallback={null}>
+        <OnboardingTrigger
+          flow={viewComplianceFlow}
+          stepHandlers={createViewComplianceTourStepHandlers({
+            resetSearch,
+            openFirstFramework,
+          })}
+          configOverrides={VIEW_COMPLIANCE_TOUR_CONFIG}
         />
+      </Suspense>
+      {/* Signals the navbar that this route's data has loaded (enables the replay icon). */}
+      <PageReady />
+      <div className="flex items-center justify-between gap-4">
+        <div data-tour-id="view-compliance-search">
+          <DataTableSearch
+            controlledValue={searchTerm}
+            onSearchChange={setSearchTerm}
+            placeholder="Search frameworks..."
+          />
+        </div>
         <span className="text-text-neutral-secondary shrink-0 text-sm">
           {filteredFrameworks.length.toLocaleString()} Total Entries
         </span>
       </div>
       <div className="grid grid-cols-1 gap-4 sm:grid-cols-2 lg:grid-cols-3 2xl:grid-cols-4">
-        {filteredFrameworks.map((compliance) => {
+        {filteredFrameworks.map((compliance, index) => {
           const { attributes, id } = compliance;
           const {
             framework,
@@ -55,9 +105,8 @@ export const ComplianceOverviewGrid = ({
             total_requirements,
           } = attributes;
 
-          return (
+          const card = (
             <ComplianceCard
-              key={id}
               title={framework}
               version={version}
               passingRequirements={requirements_passed}
@@ -71,6 +120,22 @@ export const ComplianceOverviewGrid = ({
               isLatestCisForProvider={latestCisIds?.has(id) ?? false}
             />
           );
+
+          // Anchor the tour to a single card, not the whole grid: highlighting the
+          // grid lit up the entire viewport and scrolled the page to the bottom.
+          return index === 0 ? (
+            <div
+              key={id}
+              data-tour-id="view-compliance-frameworks"
+              className="h-full [&>*]:h-full"
+            >
+              {card}
+            </div>
+          ) : (
+            <div key={id} className="h-full [&>*]:h-full">
+              {card}
+            </div>
+          );
         })}
       </div>
     </>
diff --git a/ui/components/findings/findings-filters.tsx b/ui/components/findings/findings-filters.tsx
index 02a3aec62d..349769f3ad 100644
--- a/ui/components/findings/findings-filters.tsx
+++ b/ui/components/findings/findings-filters.tsx
@@ -95,7 +95,6 @@ export const FindingsFilterBatchControls = ({
   const [isExpanded, setIsExpanded] = useState(false);
   const isAlertsEdit = variant === "alerts-edit";
 
-  // Custom filters for the expandable section.
   const customFilters = [
     ...filterFindings
       .filter((filter) => !isAlertsEdit || filter.key !== FilterType.STATUS)
@@ -182,8 +181,6 @@ export const FindingsFilterBatchControls = ({
   const showAppliedRow = appliedFilterChips.length > 0;
   const showPendingRow = hasChanges;
 
-  // Handler for removing a single chip: update the pending filter to remove that value.
-  // setPending handles both "filter[key]" and "key" formats internally.
   const handleChipRemove = (filterKey: string, value?: string) => {
     if (value === undefined) {
       setPending(filterKey, []);
@@ -195,7 +192,6 @@ export const FindingsFilterBatchControls = ({
     setPending(filterKey, nextValues);
   };
 
-  // For the date picker, read from pendingFilters
   const pendingDateValues = pendingFilters["filter[inserted_at]"];
   const pendingDateValue =
     pendingDateValues && pendingDateValues.length > 0
@@ -333,19 +329,21 @@ export const FindingsFilters = (props: FindingsFiltersProps) => {
   });
 
   return (
-    <FindingsFilterBatchControls
-      {...props}
-      appliedFilters={appliedFilters}
-      pendingFilters={pendingFilters}
-      changedFilters={changedFilters}
-      setPending={setPending}
-      applyAll={applyAll}
-      discardAll={discardAll}
-      clearAndApply={clearAndApply}
-      removeAppliedAndApply={removeAppliedAndApply}
-      hasChanges={hasChanges}
-      changeCount={changeCount}
-      getFilterValue={getFilterValue}
-    />
+    <div data-tour-id="explore-findings-filters">
+      <FindingsFilterBatchControls
+        {...props}
+        appliedFilters={appliedFilters}
+        pendingFilters={pendingFilters}
+        changedFilters={changedFilters}
+        setPending={setPending}
+        applyAll={applyAll}
+        discardAll={discardAll}
+        clearAndApply={clearAndApply}
+        removeAppliedAndApply={removeAppliedAndApply}
+        hasChanges={hasChanges}
+        changeCount={changeCount}
+        getFilterValue={getFilterValue}
+      />
+    </div>
   );
 };
diff --git a/ui/components/findings/table/findings-group-table.test.tsx b/ui/components/findings/table/findings-group-table.test.tsx
index 38887bf1fb..411f7a64f7 100644
--- a/ui/components/findings/table/findings-group-table.test.tsx
+++ b/ui/components/findings/table/findings-group-table.test.tsx
@@ -9,17 +9,47 @@ vi.mock("next/navigation", () => ({
     refresh: vi.fn(),
   }),
   useSearchParams: () => new URLSearchParams(),
+  usePathname: () => "/findings",
 }));
 
 vi.mock("@/components/ui/table", () => ({
-  DataTable: ({ toolbarRightContent }: { toolbarRightContent?: ReactNode }) => (
+  DataTable: ({
+    data,
+    toolbarRightContent,
+    getRowAttributes,
+  }: {
+    data?: Array<{ checkId?: string }>;
+    toolbarRightContent?: ReactNode;
+    getRowAttributes?: (row: {
+      index: number;
+      original: { checkId?: string };
+    }) => Record<string, string | undefined>;
+  }) => (
     <div>
       <div data-testid="table-toolbar-right">{toolbarRightContent}</div>
       <span>10 Total Entries</span>
+      <table>
+        <tbody>
+          {(data ?? []).map((original, index) => (
+            <tr
+              key={original.checkId ?? index}
+              data-testid={`row-${index}`}
+              {...getRowAttributes?.({ index, original })}
+            >
+              <td>{original.checkId}</td>
+            </tr>
+          ))}
+        </tbody>
+      </table>
     </div>
   ),
 }));
 
+vi.mock("@/components/onboarding", () => ({
+  OnboardingTrigger: () => <div data-testid="onboarding-trigger" />,
+  PageReady: () => <div data-testid="page-ready" />,
+}));
+
 vi.mock("@/components/filters/custom-checkbox-muted-findings", () => ({
   CustomCheckboxMutedFindings: () => (
     <label>
@@ -75,4 +105,68 @@ describe("FindingsGroupTable", () => {
       expect(toolbar).toHaveTextContent("Include muted findings");
     });
   });
+
+  describe("explore-findings tour gating", () => {
+    it("does not mount the tour trigger when there are no finding groups", () => {
+      // Given an empty table (e.g. a scan is still running)
+      render(
+        <FindingsGroupTable
+          data={[]}
+          resolvedFilters={{}}
+          hasHistoricalData={false}
+        />,
+      );
+
+      // Then the tour never starts — there is no first-row anchor for the
+      // "Open a finding group" step to resolve, which would otherwise throw.
+      expect(
+        screen.queryByTestId("onboarding-trigger"),
+      ).not.toBeInTheDocument();
+      // PageReady still signals the navbar that the route's data has loaded.
+      expect(screen.getByTestId("page-ready")).toBeInTheDocument();
+    });
+
+    it("mounts the tour trigger once at least one finding group exists", () => {
+      // Given a populated table
+      const data = [{ checkId: "check-a" }] as unknown as Parameters<
+        typeof FindingsGroupTable
+      >[0]["data"];
+
+      render(
+        <FindingsGroupTable
+          data={data}
+          resolvedFilters={{}}
+          hasHistoricalData={false}
+        />,
+      );
+
+      // Then the explore-findings tour is allowed to start.
+      expect(screen.getByTestId("onboarding-trigger")).toBeInTheDocument();
+    });
+  });
+
+  describe("onboarding anchor", () => {
+    it("anchors the finding-group tour step to the first row only", () => {
+      // Given two finding groups (the tour must point at the first, even if there is one)
+      const data = [
+        { checkId: "check-a" },
+        { checkId: "check-b" },
+      ] as unknown as Parameters<typeof FindingsGroupTable>[0]["data"];
+
+      render(
+        <FindingsGroupTable
+          data={data}
+          resolvedFilters={{}}
+          hasHistoricalData={false}
+        />,
+      );
+
+      // Then driver.js resolves `[data-tour-id="explore-findings-group"]` to the first row.
+      expect(screen.getByTestId("row-0")).toHaveAttribute(
+        "data-tour-id",
+        "explore-findings-group",
+      );
+      expect(screen.getByTestId("row-1")).not.toHaveAttribute("data-tour-id");
+    });
+  });
 });
diff --git a/ui/components/findings/table/findings-group-table.tsx b/ui/components/findings/table/findings-group-table.tsx
index 8c5e9def0d..86de935873 100644
--- a/ui/components/findings/table/findings-group-table.tsx
+++ b/ui/components/findings/table/findings-group-table.tsx
@@ -2,12 +2,15 @@
 
 import { Row, RowSelectionState } from "@tanstack/react-table";
 import { useRouter, useSearchParams } from "next/navigation";
-import { useRef, useState } from "react";
+import { Suspense, useRef, useState } from "react";
 
 import { resolveFindingIdsByVisibleGroupResources } from "@/actions/findings/findings-by-resource";
 import { CustomCheckboxMutedFindings } from "@/components/filters/custom-checkbox-muted-findings";
+import { OnboardingTrigger, PageReady } from "@/components/onboarding";
 import { DataTable } from "@/components/ui/table";
 import { canDrillDownFindingGroup } from "@/lib/findings-groups";
+import { getFlowById } from "@/lib/onboarding";
+import { createExploreFindingsTourStepHandlers } from "@/lib/tours/explore-findings.tour";
 import { FindingGroupRow, MetaDataProps } from "@/types";
 
 import { FloatingMuteButton } from "../floating-mute-button";
@@ -19,6 +22,8 @@ import {
   InlineResourceContainerHandle,
 } from "./inline-resource-container";
 
+const exploreFindingsFlow = getFlowById("explore-findings")!;
+
 function buildMuteLabel(groupCount: number, resourceCount: number): string {
   const parts: string[] = [];
   if (groupCount > 0) {
@@ -52,23 +57,17 @@ export function FindingsGroupTable({
   const [expandedGroup, setExpandedGroup] = useState<FindingGroupRow | null>(
     null,
   );
-  // Separate display state (updates on keystroke) from committed search (updates on Enter only).
-  // This prevents InlineResourceContainer from remounting on every keystroke.
+  // Separate input (keystroke) from committed search (Enter) to avoid remounting InlineResourceContainer.
   const [resourceSearchInput, setResourceSearchInput] = useState("");
   const [resourceSearch, setResourceSearch] = useState("");
   const [resourceSelection, setResourceSelection] = useState<string[]>([]);
   const inlineRef = useRef<InlineResourceContainerHandle>(null);
 
-  // State resets (selection, drill-down) are handled by the parent via
-  // key={groupKey} — when data changes, the component remounts with fresh state.
-
   const safeData = data ?? [];
   const hasResourceSelection = resourceSelection.length > 0;
   const filters = resolvedFilters;
 
-  // Get selected group check IDs. When the expanded group has individual resource
-  // selections, exclude it from group-level mute targets — the resource-level
-  // FloatingMuteButton handles those.
+  // Exclude expanded group from group-level mutes when it has resource selections.
   const selectedCheckIds = Object.keys(rowSelection)
     .filter((key) => rowSelection[key])
     .map((idx) => safeData[parseInt(idx)]?.checkId)
@@ -82,7 +81,6 @@ export function FindingsGroupTable({
     .map((idx) => safeData[parseInt(idx)])
     .filter(Boolean);
 
-  // Count of selectable rows (groups where not ALL findings are muted)
   const selectableRowCount = safeData.filter((g) =>
     canMuteFindingGroup({
       resourcesFail: g.resourcesFail,
@@ -128,7 +126,6 @@ export function FindingsGroupTable({
     return Array.from(new Set(results.flat()));
   };
 
-  /** Shared resolver for group row action dropdowns (via context). */
   const resolveMuteIds = async (checkIds: string[]) =>
     resolveGroupMuteIds(checkIds);
 
@@ -141,10 +138,9 @@ export function FindingsGroupTable({
   };
 
   const handleDrillDown = (checkId: string, group: FindingGroupRow) => {
-    // No resources in the group → nothing to show, skip drill-down
     if (!canDrillDownFindingGroup(group)) return;
 
-    // Toggle: same group = collapse, different = switch
+    // Toggle: same group collapses, different group switches
     if (expandedCheckId === checkId) {
       handleCollapse();
       return;
@@ -164,6 +160,19 @@ export function FindingsGroupTable({
     setResourceSelection([]);
   };
 
+  // Drives the onboarding "Open a finding group" step: opens the first row when
+  // drillable, otherwise the first drillable group. Returns false when none can
+  // open so the tour skips the resources step instead of hanging.
+  const openFirstFindingGroup = (): boolean => {
+    const target =
+      safeData[0] && canDrillDownFindingGroup(safeData[0])
+        ? safeData[0]
+        : safeData.find((group) => canDrillDownFindingGroup(group));
+    if (!target) return false;
+    handleDrillDown(target.checkId, target);
+    return true;
+  };
+
   const columns = getColumnFindingGroups({
     rowSelection,
     selectableRowCount,
@@ -201,29 +210,49 @@ export function FindingsGroupTable({
         resolveMuteIds,
       }}
     >
-      <DataTable
-        columns={columns}
-        data={safeData}
-        metadata={metadata}
-        enableRowSelection
-        rowSelection={rowSelection}
-        onRowSelectionChange={setRowSelection}
-        getRowCanSelect={getRowCanSelect}
-        showSearch
-        searchPlaceholder={
-          expandedCheckId ? "Search resources..." : "Search by name"
-        }
-        controlledSearch={expandedCheckId ? resourceSearchInput : undefined}
-        onSearchChange={expandedCheckId ? setResourceSearchInput : undefined}
-        onSearchCommit={expandedCheckId ? setResourceSearch : undefined}
-        searchBadge={
-          expandedGroup
-            ? { label: expandedGroup.checkTitle, onDismiss: handleCollapse }
-            : undefined
-        }
-        toolbarRightContent={<CustomCheckboxMutedFindings />}
-        renderAfterRow={renderAfterRow}
-      />
+      {/* Gate the tour on having at least one finding group */}
+      <div>
+        <Suspense fallback={null}>
+          {safeData.length > 0 && (
+            <OnboardingTrigger
+              flow={exploreFindingsFlow}
+              stepHandlers={createExploreFindingsTourStepHandlers(
+                openFirstFindingGroup,
+              )}
+            />
+          )}
+        </Suspense>
+        {/* Signals the navbar that this route's data has loaded (enables the replay icon). */}
+        <PageReady />
+        <DataTable
+          columns={columns}
+          data={safeData}
+          metadata={metadata}
+          enableRowSelection
+          rowSelection={rowSelection}
+          onRowSelectionChange={setRowSelection}
+          getRowCanSelect={getRowCanSelect}
+          showSearch
+          searchPlaceholder={
+            expandedCheckId ? "Search resources..." : "Search by name"
+          }
+          controlledSearch={expandedCheckId ? resourceSearchInput : undefined}
+          onSearchChange={expandedCheckId ? setResourceSearchInput : undefined}
+          onSearchCommit={expandedCheckId ? setResourceSearch : undefined}
+          searchBadge={
+            expandedGroup
+              ? { label: expandedGroup.checkTitle, onDismiss: handleCollapse }
+              : undefined
+          }
+          toolbarRightContent={<CustomCheckboxMutedFindings />}
+          renderAfterRow={renderAfterRow}
+          // Anchor the "Open a finding group" tour step to the first group row
+          // (there may be only one); driver.js resolves to the first match.
+          getRowAttributes={(row) =>
+            row.index === 0 ? { "data-tour-id": "explore-findings-group" } : {}
+          }
+        />
+      </div>
 
       {(selectedCheckIds.length > 0 || hasResourceSelection) && (
         <FloatingMuteButton
@@ -238,7 +267,6 @@ export function FindingsGroupTable({
               selectedCheckIds.length > 0
                 ? resolveGroupMuteIds(selectedCheckIds)
                 : Promise.resolve([]),
-              // resourceSelection already contains real finding UUIDs
               Promise.resolve(hasResourceSelection ? resourceSelection : []),
             ]);
             return [...groupIds, ...resourceIds];
diff --git a/ui/components/findings/table/inline-resource-container.tsx b/ui/components/findings/table/inline-resource-container.tsx
index 22ccb027e1..29115bca98 100644
--- a/ui/components/findings/table/inline-resource-container.tsx
+++ b/ui/components/findings/table/inline-resource-container.tsx
@@ -217,6 +217,8 @@ export function InlineResourceContainer({
         <td colSpan={columnCount} className="p-0">
           <AnimatePresence initial>
             <motion.div
+              // Onboarding anchor: the "Review the affected resources" tour step.
+              data-tour-id="explore-findings-resources"
               initial={{ height: 0, opacity: 0 }}
               animate={{ height: "auto", opacity: 1 }}
               exit={{ height: 0, opacity: 0 }}
diff --git a/ui/components/icons/Icons.tsx b/ui/components/icons/Icons.tsx
index eb746e8e83..4fc61dec6b 100644
--- a/ui/components/icons/Icons.tsx
+++ b/ui/components/icons/Icons.tsx
@@ -1322,69 +1322,3 @@ export const BellIcon: React.FC<IconSvgProps> = ({
     </svg>
   );
 };
-
-export const SidebarExpandIcon: React.FC<IconSvgProps> = ({
-  size = 24,
-  width,
-  height,
-  ...props
-}) => {
-  return (
-    <svg
-      xmlns="http://www.w3.org/2000/svg"
-      width={size || width}
-      height={size || height}
-      viewBox="0 0 24 24"
-      fill="none"
-      {...props}
-    >
-      <path
-        d="M19 21H5C4.46957 21 3.96086 20.7893 3.58579 20.4142C3.21071 20.0391 3 19.5304 3 19V5C3 4.46957 3.21071 3.96086 3.58579 3.58579C3.96086 3.21071 4.46957 3 5 3H19C19.5304 3 20.0391 3.21071 20.4142 3.58579C20.7893 3.96086 21 4.46957 21 5V19C21 19.5304 20.7893 20.0391 20.4142 20.4142C20.0391 20.7893 19.5304 21 19 21Z"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
-      <path
-        d="M7.25 10L5.5 12L7.25 14M9.5 21V3"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
-    </svg>
-  );
-};
-
-export const SidebarCollapseIcon: React.FC<IconSvgProps> = ({
-  size = 24,
-  width,
-  height,
-  ...props
-}) => {
-  return (
-    <svg
-      xmlns="http://www.w3.org/2000/svg"
-      width={size || width}
-      height={size || height}
-      viewBox="0 0 24 24"
-      fill="none"
-      {...props}
-    >
-      <path
-        d="M19 21H5C4.46957 21 3.96086 20.7893 3.58579 20.4142C3.21071 20.0391 3 19.5304 3 19V5C3 4.46957 3.21071 3.96086 3.58579 3.58579C3.96086 3.21071 4.46957 3 5 3H19C19.5304 3 20.0391 3.21071 20.4142 3.58579C20.7893 3.96086 21 4.46957 21 5V19C21 19.5304 20.7893 20.0391 20.4142 20.4142C20.0391 20.7893 19.5304 21 19 21Z"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
-      <path
-        d="M16.75 10L18.5 12L16.75 14M14.5 21V3"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
-    </svg>
-  );
-};
diff --git a/ui/components/onboarding/__tests__/onboarding-checkpoint-dialog.test.tsx b/ui/components/onboarding/__tests__/onboarding-checkpoint-dialog.test.tsx
new file mode 100644
index 0000000000..dfaf6bb676
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-checkpoint-dialog.test.tsx
@@ -0,0 +1,109 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { OnboardingCheckpointDialog } from "../onboarding-checkpoint-dialog";
+
+describe("OnboardingCheckpointDialog", () => {
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("when open", () => {
+    it("shows the checkpoint title and both choices", () => {
+      render(
+        <OnboardingCheckpointDialog
+          open
+          onContinue={vi.fn()}
+          onFinish={vi.fn()}
+        />,
+      );
+
+      expect(
+        screen.getByText("Provider added — keep exploring?"),
+      ).toBeInTheDocument();
+      expect(
+        screen.getByText(/Your first provider is added\./),
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole("button", { name: /continue the tour/i }),
+      ).toBeInTheDocument();
+      expect(
+        screen.getByRole("button", { name: /finish here/i }),
+      ).toBeInTheDocument();
+    });
+
+    it("calls onContinue when the primary button is clicked", async () => {
+      const user = userEvent.setup();
+      const onContinue = vi.fn();
+      const onFinish = vi.fn();
+      render(
+        <OnboardingCheckpointDialog
+          open
+          onContinue={onContinue}
+          onFinish={onFinish}
+        />,
+      );
+
+      await user.click(
+        screen.getByRole("button", { name: /continue the tour/i }),
+      );
+
+      expect(onContinue).toHaveBeenCalledTimes(1);
+      expect(onFinish).not.toHaveBeenCalled();
+    });
+
+    it("calls onFinish when the outline button is clicked", async () => {
+      const user = userEvent.setup();
+      const onContinue = vi.fn();
+      const onFinish = vi.fn();
+      render(
+        <OnboardingCheckpointDialog
+          open
+          onContinue={onContinue}
+          onFinish={onFinish}
+        />,
+      );
+
+      await user.click(screen.getByRole("button", { name: /finish here/i }));
+
+      expect(onFinish).toHaveBeenCalledTimes(1);
+      expect(onContinue).not.toHaveBeenCalled();
+    });
+
+    it("treats Escape (overlay/X dismiss) as finish", async () => {
+      const user = userEvent.setup();
+      const onContinue = vi.fn();
+      const onFinish = vi.fn();
+      render(
+        <OnboardingCheckpointDialog
+          open
+          onContinue={onContinue}
+          onFinish={onFinish}
+        />,
+      );
+
+      await user.keyboard("{Escape}");
+
+      // Escape/overlay dismiss must route to onFinish, not onContinue.
+      await waitFor(() => expect(onFinish).toHaveBeenCalledTimes(1));
+      expect(onContinue).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when closed", () => {
+    it("renders nothing", () => {
+      render(
+        <OnboardingCheckpointDialog
+          open={false}
+          onContinue={vi.fn()}
+          onFinish={vi.fn()}
+        />,
+      );
+
+      expect(
+        screen.queryByText("Provider added — keep exploring?"),
+      ).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-checkpoint-watcher.test.tsx b/ui/components/onboarding/__tests__/onboarding-checkpoint-watcher.test.tsx
new file mode 100644
index 0000000000..f30fca862d
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-checkpoint-watcher.test.tsx
@@ -0,0 +1,112 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getFlowById } from "@/lib/onboarding";
+
+import { OnboardingCheckpointWatcher } from "../onboarding-checkpoint-watcher";
+
+const pushMock = vi.fn();
+const startSequenceMock = vi.fn();
+const closeMock = vi.fn();
+
+const CHECKPOINT_MARKER = "prowler.onboarding.checkpoint";
+
+// Tests set this before render to control the store `open` flag the watcher subscribes to.
+let checkpointOpenState = false;
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: pushMock }),
+}));
+
+vi.mock("@/store/onboarding-sequence", () => ({
+  useOnboardingSequenceStore: {
+    getState: () => ({ startSequence: startSequenceMock }),
+  },
+}));
+
+vi.mock("@/store/onboarding-checkpoint", () => ({
+  CHECKPOINT_MARKER: "prowler.onboarding.checkpoint",
+  useOnboardingCheckpointStore: Object.assign(
+    (selector: (state: { open: boolean }) => unknown) =>
+      selector({ open: checkpointOpenState }),
+    {
+      getState: () => ({ close: closeMock }),
+    },
+  ),
+}));
+
+describe("OnboardingCheckpointWatcher", () => {
+  beforeEach(() => {
+    pushMock.mockClear();
+    startSequenceMock.mockClear();
+    closeMock.mockClear();
+    checkpointOpenState = false;
+    window.localStorage.clear();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("rendering", () => {
+    it("renders the dialog when the store open flag is true", () => {
+      checkpointOpenState = true;
+      render(<OnboardingCheckpointWatcher />);
+
+      expect(
+        screen.getByText("Provider added — keep exploring?"),
+      ).toBeInTheDocument();
+    });
+
+    it("does not render the dialog when the store open flag is false", () => {
+      checkpointOpenState = false;
+      render(<OnboardingCheckpointWatcher />);
+
+      expect(
+        screen.queryByText("Provider added — keep exploring?"),
+      ).not.toBeInTheDocument();
+    });
+  });
+
+  describe("when the user continues the tour", () => {
+    it("marks handled, starts the sequence at the next flow, navigates, and closes the store", async () => {
+      const user = userEvent.setup();
+      checkpointOpenState = true;
+      render(<OnboardingCheckpointWatcher />);
+      await screen.findByText("Provider added — keep exploring?");
+
+      await user.click(
+        screen.getByRole("button", { name: /continue the tour/i }),
+      );
+
+      const nextFlow = getFlowById("view-first-scan");
+      expect(window.localStorage.getItem(CHECKPOINT_MARKER)).not.toBeNull();
+      expect(closeMock).toHaveBeenCalledTimes(1);
+      if (nextFlow) {
+        expect(startSequenceMock).toHaveBeenCalledWith(nextFlow.id);
+        expect(pushMock).toHaveBeenCalledWith(nextFlow.route);
+      } else {
+        // Guard: registry is still add-provider-only.
+        expect(startSequenceMock).not.toHaveBeenCalled();
+        expect(pushMock).not.toHaveBeenCalled();
+      }
+    });
+  });
+
+  describe("when the user finishes here", () => {
+    it("marks handled, starts no sequence, does not navigate, and closes the store", async () => {
+      const user = userEvent.setup();
+      checkpointOpenState = true;
+      render(<OnboardingCheckpointWatcher />);
+      await screen.findByText("Provider added — keep exploring?");
+
+      await user.click(screen.getByRole("button", { name: /finish here/i }));
+
+      expect(window.localStorage.getItem(CHECKPOINT_MARKER)).not.toBeNull();
+      expect(startSequenceMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+      await waitFor(() => expect(closeMock).toHaveBeenCalledTimes(1));
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-gate.test.tsx b/ui/components/onboarding/__tests__/onboarding-gate.test.tsx
new file mode 100644
index 0000000000..4198ba5846
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-gate.test.tsx
@@ -0,0 +1,185 @@
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { addProviderTour } from "@/lib/tours/add-provider.tour";
+import { localStorageAdapter } from "@/lib/tours/store/local-storage-adapter";
+
+import { OnboardingGate } from "../onboarding-gate";
+
+const pushMock = vi.fn();
+const armMock = vi.fn();
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: pushMock, replace: vi.fn() }),
+}));
+
+vi.mock("@/store/onboarding-checkpoint", () => ({
+  useOnboardingCheckpointStore: {
+    getState: () => ({ arm: armMock }),
+  },
+}));
+
+const addProviderTourId = {
+  id: addProviderTour.id,
+  version: addProviderTour.version,
+};
+
+describe("OnboardingGate", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    pushMock.mockClear();
+    armMock.mockClear();
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("when the user has no providers and no completion record", () => {
+    it("shows the Welcome modal", async () => {
+      render(<OnboardingGate hasProviders={false} />);
+
+      expect(
+        await screen.findByRole("button", { name: /get started/i }),
+      ).toBeInTheDocument();
+    });
+  });
+
+  describe("when the user already has providers", () => {
+    it("does not show the Welcome modal", async () => {
+      render(<OnboardingGate hasProviders={true} />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe("when a completion record already exists in this browser", () => {
+    it("does not show the Welcome modal", async () => {
+      localStorageAdapter.set(addProviderTourId, {
+        tourId: addProviderTour.id,
+        version: addProviderTour.version,
+        state: "dismissed",
+        completedAt: new Date().toISOString(),
+      });
+
+      render(<OnboardingGate hasProviders={false} />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe("when the gate flow is dismissed but later sequence flows are incomplete", () => {
+    it("does not show the Welcome modal for a later flow", async () => {
+      // Later flows are only reachable via the checkpoint/sequence, never the gate.
+      localStorageAdapter.set(addProviderTourId, {
+        tourId: addProviderTour.id,
+        version: addProviderTour.version,
+        state: "dismissed",
+        completedAt: new Date().toISOString(),
+      });
+
+      render(<OnboardingGate hasProviders={false} />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe("when hasProviders is undefined (fail-open)", () => {
+    it("does not show the Welcome modal", async () => {
+      // `undefined` mirrors the tri-state layout forwards on a failed provider fetch.
+      render(<OnboardingGate hasProviders={undefined} />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+
+    it("can be mounted with the prop omitted entirely (fail-open)", async () => {
+      render(<OnboardingGate />);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /get started/i }),
+        ).not.toBeInTheDocument();
+      });
+    });
+  });
+
+  describe("when the user accepts the Welcome modal", () => {
+    it("navigates to the flow route with the onboarding query param and writes no record", async () => {
+      const user = userEvent.setup();
+      render(<OnboardingGate hasProviders={false} />);
+      const getStarted = await screen.findByRole("button", {
+        name: /get started/i,
+      });
+
+      await user.click(getStarted);
+
+      expect(pushMock).toHaveBeenCalledWith(
+        "/providers?onboarding=add-provider",
+      );
+      expect(localStorageAdapter.get(addProviderTourId)).toBeNull();
+    });
+
+    it("arms the onboarding checkpoint", async () => {
+      const user = userEvent.setup();
+      render(<OnboardingGate hasProviders={false} />);
+      const getStarted = await screen.findByRole("button", {
+        name: /get started/i,
+      });
+
+      await user.click(getStarted);
+
+      expect(armMock).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("when the user dismisses the Welcome modal", () => {
+    it("writes a dismissed record and stops showing the modal", async () => {
+      const user = userEvent.setup();
+      render(<OnboardingGate hasProviders={false} />);
+      const skip = await screen.findByRole("button", {
+        name: /skip for now/i,
+      });
+
+      await user.click(skip);
+
+      await waitFor(() => {
+        expect(
+          screen.queryByRole("button", { name: /skip for now/i }),
+        ).not.toBeInTheDocument();
+      });
+      const record = localStorageAdapter.get(addProviderTourId);
+      expect(record).not.toBeNull();
+      expect(record?.state).toBe("dismissed");
+    });
+
+    it("does NOT arm the onboarding checkpoint", async () => {
+      const user = userEvent.setup();
+      render(<OnboardingGate hasProviders={false} />);
+      const skip = await screen.findByRole("button", {
+        name: /skip for now/i,
+      });
+
+      await user.click(skip);
+
+      // Skipping must never arm the checkpoint (user opted out).
+      expect(armMock).not.toHaveBeenCalled();
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-sequence-banner.logic.test.ts b/ui/components/onboarding/__tests__/onboarding-sequence-banner.logic.test.ts
new file mode 100644
index 0000000000..71ff8c7fdd
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-sequence-banner.logic.test.ts
@@ -0,0 +1,63 @@
+import { describe, expect, it } from "vitest";
+
+import type { OnboardingFlow } from "@/lib/onboarding";
+
+import { getSequenceProgress } from "../onboarding-sequence-banner.logic";
+
+// Minimal fixtures — the progress helper only reads id/order/title/route and the optional dataRequirementHint.
+const buildFlow = (overrides: Partial<OnboardingFlow>): OnboardingFlow =>
+  ({
+    id: overrides.id ?? "flow",
+    order: overrides.order ?? 1,
+    title: overrides.title ?? "Title",
+    description: overrides.description ?? "Description",
+    route: overrides.route ?? "/route",
+    tour: overrides.tour ?? { id: "t", version: 1, coversFiles: [], steps: [] },
+    dataRequirementHint: overrides.dataRequirementHint,
+  }) as OnboardingFlow;
+
+const flows: OnboardingFlow[] = [
+  buildFlow({ id: "a", order: 1, title: "First", route: "/a" }),
+  buildFlow({
+    id: "b",
+    order: 2,
+    title: "Second",
+    route: "/b",
+    dataRequirementHint: "needs a scan",
+  }),
+  buildFlow({ id: "c", order: 3, title: "Third", route: "/c" }),
+];
+
+describe("getSequenceProgress", () => {
+  it("computes the index, total, current flow, and next flow for a middle step", () => {
+    const progress = getSequenceProgress("b", flows);
+
+    // 0-based index 1 of 3, current is b, next is c
+    expect(progress).not.toBeNull();
+    expect(progress?.index).toBe(1);
+    expect(progress?.total).toBe(3);
+    expect(progress?.flow.id).toBe("b");
+    expect(progress?.nextFlow?.id).toBe("c");
+  });
+
+  it("returns a null nextFlow on the last step", () => {
+    const progress = getSequenceProgress("c", flows);
+
+    expect(progress?.index).toBe(2);
+    expect(progress?.total).toBe(3);
+    expect(progress?.nextFlow).toBeNull();
+  });
+
+  it("returns null when the currentFlowId is unknown or null", () => {
+    expect(getSequenceProgress("missing", flows)).toBeNull();
+    expect(getSequenceProgress(null, flows)).toBeNull();
+  });
+
+  it("exposes the data requirement hint of the current flow when present", () => {
+    const withHint = getSequenceProgress("b", flows);
+    const withoutHint = getSequenceProgress("a", flows);
+
+    expect(withHint?.flow.dataRequirementHint).toBe("needs a scan");
+    expect(withoutHint?.flow.dataRequirementHint).toBeUndefined();
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-sequence-banner.test.tsx b/ui/components/onboarding/__tests__/onboarding-sequence-banner.test.tsx
new file mode 100644
index 0000000000..6b417e5ed6
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-sequence-banner.test.tsx
@@ -0,0 +1,193 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getFlowById } from "@/lib/onboarding";
+
+import { OnboardingSequenceBanner } from "../onboarding-sequence-banner";
+
+const pushMock = vi.fn();
+const advanceMock = vi.fn();
+const stopMock = vi.fn();
+
+// Mutable snapshot the mocked store hook returns; tests mutate via setSlice().
+let sliceState = {
+  active: false,
+  currentFlowId: null as string | null,
+  advance: advanceMock,
+  stop: stopMock,
+};
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: pushMock }),
+}));
+
+vi.mock("@/store/onboarding-sequence", () => {
+  const hook = (selector: (state: typeof sliceState) => unknown) =>
+    selector(sliceState);
+  hook.getState = () => sliceState;
+  return { useOnboardingSequenceStore: hook };
+});
+
+function setSlice(next: Partial<typeof sliceState>) {
+  sliceState = { ...sliceState, ...next };
+}
+
+describe("OnboardingSequenceBanner", () => {
+  beforeEach(() => {
+    pushMock.mockClear();
+    advanceMock.mockClear();
+    stopMock.mockClear();
+    sliceState = {
+      active: false,
+      currentFlowId: null,
+      advance: advanceMock,
+      stop: stopMock,
+    };
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("renders nothing when the sequence is inactive", () => {
+    const { container } = render(<OnboardingSequenceBanner />);
+
+    expect(container).toBeEmptyDOMElement();
+  });
+
+  it("shows the step progress for the active flow", () => {
+    setSlice({ active: true, currentFlowId: "view-first-scan" });
+    const flow = getFlowById("view-first-scan")!;
+
+    render(<OnboardingSequenceBanner />);
+
+    expect(screen.getByText(`Step 2 of 5: ${flow.title}`)).toBeInTheDocument();
+  });
+
+  it("announces step progress to screen readers via a polite live region", () => {
+    setSlice({ active: true, currentFlowId: "view-first-scan" });
+    const flow = getFlowById("view-first-scan")!;
+
+    render(<OnboardingSequenceBanner />);
+
+    // Polite live region so screen readers announce step transitions on update.
+    const status = screen.getByRole("status");
+    expect(status).toHaveTextContent(`Step 2 of 5: ${flow.title}`);
+    expect(status).toHaveAttribute("aria-live", "polite");
+  });
+
+  it("does not show the data requirement hint on a scan-dependent step once a scan has finished", () => {
+    // The Continue gate already guarantees we only reach this step with data,
+    // so the "wait for findings" hint would be stale/misleading here.
+    setSlice({ active: true, currentFlowId: "explore-findings" });
+
+    render(<OnboardingSequenceBanner hasCompletedScan={true} />);
+
+    expect(
+      screen.queryByText(/wait for the scan to finish/i),
+    ).not.toBeInTheDocument();
+  });
+
+  it("does not show a hint for a flow without one", () => {
+    setSlice({ active: true, currentFlowId: "view-first-scan" });
+
+    render(<OnboardingSequenceBanner />);
+
+    expect(
+      screen.queryByText(/wait for the scan to finish/i),
+    ).not.toBeInTheDocument();
+  });
+
+  it("advances and navigates to the next flow when Continue is clicked", async () => {
+    setSlice({ active: true, currentFlowId: "view-first-scan" });
+    const nextFlow = getFlowById("explore-findings")!;
+    const user = userEvent.setup();
+
+    render(<OnboardingSequenceBanner />);
+    await user.click(screen.getByRole("button", { name: /continue/i }));
+
+    expect(advanceMock).toHaveBeenCalledTimes(1);
+    expect(pushMock).toHaveBeenCalledWith(nextFlow.route);
+    expect(stopMock).not.toHaveBeenCalled();
+  });
+
+  it("stops the sequence without navigating when Continue is clicked on the last step", async () => {
+    setSlice({ active: true, currentFlowId: "attack-paths" });
+    const user = userEvent.setup();
+
+    render(<OnboardingSequenceBanner />);
+    await user.click(screen.getByRole("button", { name: /continue/i }));
+
+    expect(stopMock).toHaveBeenCalledTimes(1);
+    expect(pushMock).not.toHaveBeenCalled();
+  });
+
+  it("stops the sequence when Skip is clicked", async () => {
+    setSlice({ active: true, currentFlowId: "explore-findings" });
+    const user = userEvent.setup();
+
+    render(<OnboardingSequenceBanner />);
+    await user.click(screen.getByRole("button", { name: /skip/i }));
+
+    expect(stopMock).toHaveBeenCalledTimes(1);
+    expect(advanceMock).not.toHaveBeenCalled();
+    expect(pushMock).not.toHaveBeenCalled();
+  });
+
+  describe("scan-gated Continue", () => {
+    it("disables Continue when the next step needs scan data and none has finished", () => {
+      // On the scan step, advancing would land on explore-findings (scan-dependent).
+      setSlice({ active: true, currentFlowId: "view-first-scan" });
+
+      render(<OnboardingSequenceBanner hasCompletedScan={false} />);
+
+      expect(screen.getByRole("button", { name: /continue/i })).toBeDisabled();
+      // The next step's hint explains why progression is blocked.
+      expect(
+        screen.getByText(/wait for the scan to finish/i),
+      ).toBeInTheDocument();
+    });
+
+    it("does not advance even if a disabled Continue is force-clicked", async () => {
+      setSlice({ active: true, currentFlowId: "view-first-scan" });
+      const user = userEvent.setup();
+
+      render(<OnboardingSequenceBanner hasCompletedScan={false} />);
+      await user.click(screen.getByRole("button", { name: /continue/i }));
+
+      expect(advanceMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+
+    it("enables Continue once a scan has finished", () => {
+      setSlice({ active: true, currentFlowId: "view-first-scan" });
+
+      render(<OnboardingSequenceBanner hasCompletedScan={true} />);
+
+      expect(screen.getByRole("button", { name: /continue/i })).toBeEnabled();
+    });
+
+    it("surfaces the hint on a scan-dependent step itself when no scan has finished", () => {
+      // Edge case: if we somehow sit on findings without a completed scan, the
+      // next step (compliance) is still gated, so the hint explains the block.
+      setSlice({ active: true, currentFlowId: "explore-findings" });
+
+      render(<OnboardingSequenceBanner hasCompletedScan={false} />);
+
+      expect(screen.getByRole("button", { name: /continue/i })).toBeDisabled();
+      expect(
+        screen.getByText(/wait for the scan to finish/i),
+      ).toBeInTheDocument();
+    });
+
+    it("never gates Continue when the next step does not need scan data", () => {
+      // add-provider → view-first-scan: neither requires scan data.
+      setSlice({ active: true, currentFlowId: "add-provider" });
+
+      render(<OnboardingSequenceBanner hasCompletedScan={false} />);
+
+      expect(screen.getByRole("button", { name: /continue/i })).toBeEnabled();
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-trigger.decision.test.ts b/ui/components/onboarding/__tests__/onboarding-trigger.decision.test.ts
new file mode 100644
index 0000000000..b1b50c142e
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-trigger.decision.test.ts
@@ -0,0 +1,164 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  mapCloseToSequenceAction,
+  resolveTriggerRequest,
+} from "../onboarding-trigger.logic";
+
+describe("resolveTriggerRequest", () => {
+  describe("replay (param) path", () => {
+    it("requests a replay start when the param matches this flow", () => {
+      const result = resolveTriggerRequest({
+        param: "add-provider",
+        replayRequestFlowId: null,
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+
+    it("takes precedence over the sequence when the param matches", () => {
+      const result = resolveTriggerRequest({
+        param: "add-provider",
+        replayRequestFlowId: null,
+        sliceActive: true,
+        currentFlowId: "add-provider",
+        flowId: "add-provider",
+      });
+
+      // Param takes precedence over sequence when both match.
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+
+    it("takes precedence over an in-memory replay request", () => {
+      const result = resolveTriggerRequest({
+        param: "add-provider",
+        replayRequestFlowId: "add-provider",
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      // Both resolve to replay; the param branch wins but the mode is identical.
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+  });
+
+  describe("replay (in-memory request) path", () => {
+    it("requests a replay start when the store names this flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: "add-provider",
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+
+    it("takes precedence over the sequence when the store names this flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: "add-provider",
+        sliceActive: true,
+        currentFlowId: "add-provider",
+        flowId: "add-provider",
+      });
+
+      expect(result).toEqual({ start: true, mode: "replay" });
+    });
+
+    it("does not start when the store names a different flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: "view-first-scan",
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("sequence (slice) path", () => {
+    it("requests a sequence start when the active slice names this flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: null,
+        sliceActive: true,
+        currentFlowId: "add-provider",
+        flowId: "add-provider",
+      });
+
+      expect(result).toEqual({ start: true, mode: "sequence" });
+    });
+
+    it("does not start when the active slice names a different flow", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: null,
+        sliceActive: true,
+        currentFlowId: "view-first-scan",
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+
+    it("does not start when the slice is inactive even if the id matches", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: null,
+        sliceActive: false,
+        currentFlowId: "add-provider",
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+  });
+
+  describe("no-match path", () => {
+    it("returns null when the param targets a different flow and the slice is inactive", () => {
+      const result = resolveTriggerRequest({
+        param: "view-first-scan",
+        replayRequestFlowId: null,
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+
+    it("returns null when neither the param, the store, nor the slice match", () => {
+      const result = resolveTriggerRequest({
+        param: null,
+        replayRequestFlowId: null,
+        sliceActive: false,
+        currentFlowId: null,
+        flowId: "add-provider",
+      });
+
+      expect(result).toBeNull();
+    });
+  });
+});
+
+describe("mapCloseToSequenceAction", () => {
+  it("advances the sequence when the tour completes", () => {
+    expect(mapCloseToSequenceAction("completed")).toBe("advance");
+  });
+
+  it("stops the sequence when the tour is skipped", () => {
+    expect(mapCloseToSequenceAction("skipped")).toBe("stop");
+  });
+
+  it("stops the sequence when the tour is dismissed", () => {
+    expect(mapCloseToSequenceAction("dismissed")).toBe("stop");
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-trigger.test.tsx b/ui/components/onboarding/__tests__/onboarding-trigger.test.tsx
new file mode 100644
index 0000000000..ca9f2cd106
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-trigger.test.tsx
@@ -0,0 +1,300 @@
+import { render, waitFor } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getFlowById } from "@/lib/onboarding";
+import type { OnboardingSequenceMode } from "@/store/onboarding-sequence";
+
+import { OnboardingTrigger } from "../onboarding-trigger";
+
+const startMock = vi.fn();
+const pushMock = vi.fn();
+const advanceMock = vi.fn();
+const stopMock = vi.fn();
+const consumeMock = vi.fn();
+
+// Counts hook re-invocations; the regression test uses this to confirm the runner stays mounted.
+const useDriverTourMock = vi.fn();
+// Captures onClosed so close→action wiring can be exercised without driver.js.
+let capturedOnClosed: ((state: string) => void) | undefined;
+
+let searchParamsValue = new URLSearchParams();
+
+let sliceState = {
+  active: false,
+  currentFlowId: null as string | null,
+  mode: null as OnboardingSequenceMode | null,
+  advance: advanceMock,
+  stop: stopMock,
+};
+
+let replayState = {
+  flowId: null as string | null,
+  token: 0,
+  consume: consumeMock,
+};
+
+vi.mock("next/navigation", () => ({
+  useSearchParams: () => searchParamsValue,
+  usePathname: () => "/providers",
+  useRouter: () => ({ replace: vi.fn(), push: pushMock }),
+}));
+
+vi.mock("@/lib/tours/use-driver-tour", () => ({
+  useDriverTour: (
+    _tour: unknown,
+    options: { onClosed?: (state: string) => void },
+  ) => {
+    useDriverTourMock();
+    capturedOnClosed = options?.onClosed;
+    return { start: startMock, stop: vi.fn(), hasCompleted: false };
+  },
+}));
+
+vi.mock("@/store/onboarding-sequence", () => {
+  const hook = (selector: (state: typeof sliceState) => unknown) =>
+    selector(sliceState);
+  hook.getState = () => sliceState;
+  return { useOnboardingSequenceStore: hook };
+});
+
+vi.mock("@/store/onboarding-replay", () => {
+  const hook = (selector: (state: typeof replayState) => unknown) =>
+    selector(replayState);
+  hook.getState = () => replayState;
+  return { useOnboardingReplayStore: hook };
+});
+
+const addProviderFlow = getFlowById("add-provider")!;
+
+function setSlice(next: Partial<typeof sliceState>) {
+  sliceState = { ...sliceState, ...next };
+}
+
+function setReplay(next: Partial<typeof replayState>) {
+  replayState = { ...replayState, ...next };
+}
+
+describe("OnboardingTrigger", () => {
+  beforeEach(() => {
+    startMock.mockClear();
+    pushMock.mockClear();
+    advanceMock.mockClear();
+    stopMock.mockClear();
+    consumeMock.mockClear();
+    useDriverTourMock.mockClear();
+    capturedOnClosed = undefined;
+    // Trigger only resolves in cloud.
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    searchParamsValue = new URLSearchParams();
+    sliceState = {
+      active: false,
+      currentFlowId: null,
+      mode: null,
+      advance: advanceMock,
+      stop: stopMock,
+    };
+    replayState = { flowId: null, token: 0, consume: consumeMock };
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  describe("when the onboarding param matches this flow (replay)", () => {
+    it("force-starts the tour and strips the param", async () => {
+      searchParamsValue = new URLSearchParams("onboarding=add-provider");
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      // Param is stripped via history.replaceState (no router round-trip).
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+      await waitFor(() =>
+        expect(replaceStateSpy).toHaveBeenCalledWith(
+          null,
+          "",
+          window.location.pathname,
+        ),
+      );
+    });
+
+    it("strips only the onboarding param and preserves other query params", async () => {
+      searchParamsValue = new URLSearchParams(
+        "scanId=scan-1&onboarding=add-provider&tab=completed",
+      );
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+      await waitFor(() =>
+        expect(replaceStateSpy).toHaveBeenCalledWith(
+          null,
+          "",
+          `${window.location.pathname}?scanId=scan-1&tab=completed`,
+        ),
+      );
+    });
+  });
+
+  describe("when the in-memory replay store names this flow", () => {
+    it("force-starts the tour, consumes the request, and never touches the URL", async () => {
+      // Same-route navbar replay: started via the store, no `?onboarding=` param.
+      setReplay({ flowId: "add-provider", token: 1 });
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+      await waitFor(() => expect(consumeMock).toHaveBeenCalledTimes(1));
+      // No URL param to strip, and no router round-trip → no RSC refetch.
+      expect(replaceStateSpy).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when the sequence names this flow", () => {
+    it("force-starts the tour without stripping any param", async () => {
+      setSlice({
+        active: true,
+        currentFlowId: "add-provider",
+        mode: "sequence",
+      });
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+      expect(replaceStateSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when neither the param nor the sequence names this flow", () => {
+    it("renders null and does not start the tour", async () => {
+      searchParamsValue = new URLSearchParams();
+      const replaceStateSpy = vi.spyOn(window.history, "replaceState");
+
+      const { container } = render(
+        <OnboardingTrigger flow={addProviderFlow} />,
+      );
+
+      expect(container).toBeEmptyDOMElement();
+      await waitFor(() => expect(startMock).not.toHaveBeenCalled());
+      expect(replaceStateSpy).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when the onboarding param targets a different flow", () => {
+    it("does not start the tour", async () => {
+      searchParamsValue = new URLSearchParams("onboarding=explore-findings");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() => expect(startMock).not.toHaveBeenCalled());
+    });
+  });
+
+  describe("in self-hosted (OSS) deployments", () => {
+    it("renders null and never starts the tour, even with a matching param", async () => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+      searchParamsValue = new URLSearchParams("onboarding=add-provider");
+
+      const { container } = render(
+        <OnboardingTrigger flow={addProviderFlow} />,
+      );
+
+      expect(container).toBeEmptyDOMElement();
+      await waitFor(() => expect(startMock).not.toHaveBeenCalled());
+    });
+
+    it("ignores an active sequence slice in OSS", async () => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+      setSlice({
+        active: true,
+        currentFlowId: "add-provider",
+        mode: "sequence",
+      });
+
+      const { container } = render(
+        <OnboardingTrigger flow={addProviderFlow} />,
+      );
+
+      expect(container).toBeEmptyDOMElement();
+      await waitFor(() => expect(startMock).not.toHaveBeenCalled());
+    });
+  });
+
+  describe("when a sequence tour completes", () => {
+    it("leaves the sequence slice untouched (the banner owns advance now)", async () => {
+      setSlice({
+        active: true,
+        currentFlowId: "add-provider",
+        mode: "sequence",
+      });
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+      await waitFor(() => expect(capturedOnClosed).toBeDefined());
+      capturedOnClosed?.("completed");
+
+      // Banner is the sole advance/exit control; closing the tour must not auto-advance.
+      expect(advanceMock).not.toHaveBeenCalled();
+      expect(stopMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when a sequence tour is dismissed", () => {
+    it("leaves the sequence slice untouched (no auto-stop on close)", async () => {
+      setSlice({
+        active: true,
+        currentFlowId: "add-provider",
+        mode: "sequence",
+      });
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+      await waitFor(() => expect(capturedOnClosed).toBeDefined());
+      capturedOnClosed?.("skipped");
+
+      // Only the banner Exit button ends the sequence; closing the tour must not auto-stop.
+      expect(stopMock).not.toHaveBeenCalled();
+      expect(advanceMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when a replay tour closes", () => {
+    it("does not touch the sequence slice", async () => {
+      searchParamsValue = new URLSearchParams("onboarding=add-provider");
+
+      render(<OnboardingTrigger flow={addProviderFlow} />);
+      await waitFor(() => expect(capturedOnClosed).toBeDefined());
+      capturedOnClosed?.("completed");
+
+      // Single-flow replay never advances or stops the sequence.
+      expect(advanceMock).not.toHaveBeenCalled();
+      expect(stopMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when the param is cleared after the tour starts (regression)", () => {
+    it("keeps the runner mounted and does not restart the tour", async () => {
+      // StrictMode-safe latch: stripping the param must not unmount the runner or re-start the tour.
+      searchParamsValue = new URLSearchParams("onboarding=add-provider");
+      const { rerender } = render(<OnboardingTrigger flow={addProviderFlow} />);
+      await waitFor(() => expect(startMock).toHaveBeenCalledTimes(1));
+
+      const callsBeforeClear = useDriverTourMock.mock.calls.length;
+
+      searchParamsValue = new URLSearchParams();
+      rerender(<OnboardingTrigger flow={addProviderFlow} />);
+
+      await waitFor(() =>
+        expect(useDriverTourMock.mock.calls.length).toBeGreaterThan(
+          callsBeforeClear,
+        ),
+      );
+      expect(startMock).toHaveBeenCalledTimes(1);
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/onboarding-welcome-modal.test.tsx b/ui/components/onboarding/__tests__/onboarding-welcome-modal.test.tsx
new file mode 100644
index 0000000000..a3665031c2
--- /dev/null
+++ b/ui/components/onboarding/__tests__/onboarding-welcome-modal.test.tsx
@@ -0,0 +1,83 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { describe, expect, it, vi } from "vitest";
+
+import { OnboardingWelcomeModal } from "../onboarding-welcome-modal";
+
+describe("OnboardingWelcomeModal", () => {
+  describe("when open is true", () => {
+    it("renders the flow title and description", () => {
+      render(
+        <OnboardingWelcomeModal
+          open
+          flowTitle="Add your first provider"
+          flowDescription="Connect a cloud account so Prowler has something to scan."
+          onAccept={vi.fn()}
+          onDismiss={vi.fn()}
+        />,
+      );
+
+      expect(screen.getByText("Add your first provider")).toBeInTheDocument();
+      expect(
+        screen.getByText(
+          "Connect a cloud account so Prowler has something to scan.",
+        ),
+      ).toBeInTheDocument();
+    });
+
+    it("calls onAccept when the primary action is clicked", async () => {
+      const user = userEvent.setup();
+      const onAccept = vi.fn();
+      const onDismiss = vi.fn();
+      render(
+        <OnboardingWelcomeModal
+          open
+          flowTitle="Add your first provider"
+          onAccept={onAccept}
+          onDismiss={onDismiss}
+        />,
+      );
+
+      await user.click(screen.getByRole("button", { name: /get started/i }));
+
+      expect(onAccept).toHaveBeenCalledTimes(1);
+      expect(onDismiss).not.toHaveBeenCalled();
+    });
+
+    it("calls onDismiss when the skip action is clicked", async () => {
+      const user = userEvent.setup();
+      const onAccept = vi.fn();
+      const onDismiss = vi.fn();
+      render(
+        <OnboardingWelcomeModal
+          open
+          flowTitle="Add your first provider"
+          onAccept={onAccept}
+          onDismiss={onDismiss}
+        />,
+      );
+
+      await user.click(screen.getByRole("button", { name: /skip for now/i }));
+
+      expect(onDismiss).toHaveBeenCalledTimes(1);
+      expect(onAccept).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("when open is false", () => {
+    it("does not render the modal content", () => {
+      render(
+        <OnboardingWelcomeModal
+          open={false}
+          flowTitle="Add your first provider"
+          onAccept={vi.fn()}
+          onDismiss={vi.fn()}
+        />,
+      );
+
+      expect(
+        screen.queryByRole("button", { name: /get started/i }),
+      ).not.toBeInTheDocument();
+    });
+  });
+});
diff --git a/ui/components/onboarding/__tests__/page-ready.test.tsx b/ui/components/onboarding/__tests__/page-ready.test.tsx
new file mode 100644
index 0000000000..9037cdb803
--- /dev/null
+++ b/ui/components/onboarding/__tests__/page-ready.test.tsx
@@ -0,0 +1,30 @@
+import { render } from "@testing-library/react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { usePageReadyStore } from "@/store/page-ready";
+
+import { PageReady } from "../page-ready";
+
+vi.mock("next/navigation", () => ({
+  usePathname: () => "/compliance",
+}));
+
+describe("PageReady", () => {
+  beforeEach(() => usePageReadyStore.setState({ readyPath: null }));
+
+  it("marks the current route ready on mount", () => {
+    render(<PageReady />);
+    expect(usePageReadyStore.getState().readyPath).toBe("/compliance");
+  });
+
+  it("clears readiness on unmount", () => {
+    const { unmount } = render(<PageReady />);
+    unmount();
+    expect(usePageReadyStore.getState().readyPath).toBeNull();
+  });
+
+  it("renders nothing", () => {
+    const { container } = render(<PageReady />);
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/ui/components/onboarding/index.ts b/ui/components/onboarding/index.ts
new file mode 100644
index 0000000000..ba6a7e4128
--- /dev/null
+++ b/ui/components/onboarding/index.ts
@@ -0,0 +1,5 @@
+export { OnboardingCheckpointWatcher } from "./onboarding-checkpoint-watcher";
+export { OnboardingGate } from "./onboarding-gate";
+export { OnboardingSequenceBanner } from "./onboarding-sequence-banner";
+export { OnboardingTrigger } from "./onboarding-trigger";
+export { PageReady } from "./page-ready";
diff --git a/ui/components/onboarding/onboarding-checkpoint-dialog.tsx b/ui/components/onboarding/onboarding-checkpoint-dialog.tsx
new file mode 100644
index 0000000000..2517ef3692
--- /dev/null
+++ b/ui/components/onboarding/onboarding-checkpoint-dialog.tsx
@@ -0,0 +1,38 @@
+"use client";
+
+import { Button } from "@/components/shadcn";
+import { DialogFooter } from "@/components/shadcn/dialog";
+import { Modal } from "@/components/shadcn/modal/modal";
+
+interface OnboardingCheckpointDialogProps {
+  open: boolean;
+  onContinue: () => void;
+  onFinish: () => void;
+}
+
+export function OnboardingCheckpointDialog({
+  open,
+  onContinue,
+  onFinish,
+}: OnboardingCheckpointDialogProps) {
+  return (
+    <Modal
+      open={open}
+      title="Provider added — keep exploring?"
+      description="Your first provider is added. Want a quick guided tour of scans, findings, compliance, and attack paths? You can stop anytime."
+      size="lg"
+      // Overlay/Escape/X maps to "Finish here" — persists the handled marker once.
+      onOpenChange={(next) => {
+        if (!next) onFinish();
+      }}
+    >
+      <DialogFooter>
+        {/* Outline matches the app's modal secondary action (e.g. Launch Scan's Cancel). */}
+        <Button variant="outline" onClick={onFinish}>
+          Finish here
+        </Button>
+        <Button onClick={onContinue}>Continue the tour</Button>
+      </DialogFooter>
+    </Modal>
+  );
+}
diff --git a/ui/components/onboarding/onboarding-checkpoint-watcher.tsx b/ui/components/onboarding/onboarding-checkpoint-watcher.tsx
new file mode 100644
index 0000000000..1339b17f8c
--- /dev/null
+++ b/ui/components/onboarding/onboarding-checkpoint-watcher.tsx
@@ -0,0 +1,58 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+
+import { getOrderedFlows } from "@/lib/onboarding";
+import {
+  CHECKPOINT_MARKER,
+  useOnboardingCheckpointStore,
+} from "@/store/onboarding-checkpoint";
+import { useOnboardingSequenceStore } from "@/store/onboarding-sequence";
+
+import { OnboardingCheckpointDialog } from "./onboarding-checkpoint-dialog";
+
+// Sequence begins at the flow after `add-provider` (the gate).
+const FIRST_FLOW_ID = "add-provider";
+
+function markCheckpointHandled(): void {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(CHECKPOINT_MARKER, "true");
+  } catch {
+    // Non-fatal: a re-shown checkpoint beats a thrown render.
+  }
+}
+
+// Layout-level watcher: renders the checkpoint dialog when the store `open` flag is set.
+export function OnboardingCheckpointWatcher() {
+  const router = useRouter();
+  const open = useOnboardingCheckpointStore((state) => state.open);
+
+  const handleContinue = () => {
+    markCheckpointHandled(); // before navigation to prevent re-open on re-render
+    useOnboardingCheckpointStore.getState().close();
+
+    // Start at the flow immediately after the gate, not just any non-gate flow:
+    // a future registry insertion before it must not be skipped past.
+    const ordered = getOrderedFlows();
+    const gateIndex = ordered.findIndex((flow) => flow.id === FIRST_FLOW_ID);
+    const nextFlow = gateIndex >= 0 ? ordered[gateIndex + 1] : undefined;
+    if (!nextFlow) return;
+
+    useOnboardingSequenceStore.getState().startSequence(nextFlow.id);
+    router.push(nextFlow.route);
+  };
+
+  const handleFinish = () => {
+    markCheckpointHandled();
+    useOnboardingCheckpointStore.getState().close();
+  };
+
+  return (
+    <OnboardingCheckpointDialog
+      open={open}
+      onContinue={handleContinue}
+      onFinish={handleFinish}
+    />
+  );
+}
diff --git a/ui/components/onboarding/onboarding-gate.tsx b/ui/components/onboarding/onboarding-gate.tsx
new file mode 100644
index 0000000000..0161bffef4
--- /dev/null
+++ b/ui/components/onboarding/onboarding-gate.tsx
@@ -0,0 +1,74 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+
+import { getOrderedFlows, shouldStartOnboarding } from "@/lib/onboarding";
+import { localStorageAdapter } from "@/lib/tours/store/local-storage-adapter";
+import { TOUR_COMPLETION_STATES } from "@/lib/tours/tour-types";
+import { useTourCompletion } from "@/lib/tours/use-tour-completion";
+import { useOnboardingCheckpointStore } from "@/store/onboarding-checkpoint";
+
+import { OnboardingWelcomeModal } from "./onboarding-welcome-modal";
+
+interface OnboardingGateProps {
+  // `undefined` = fetch failed/ambiguous; fail-open (never force the modal).
+  hasProviders?: boolean;
+}
+
+// Mandatory new-user gate. Mounted once in the layout; decision derived during render
+// via useSyncExternalStore — server renders nothing, no hydration mismatch.
+export function OnboardingGate({ hasProviders }: OnboardingGateProps) {
+  const router = useRouter();
+
+  // Gate forces only the first flow (`add-provider`); remaining flows come via checkpoint/replay.
+  const flow = getOrderedFlows()[0] ?? null;
+
+  // Returns null on server/first render — gate stays closed until resolved client-side.
+  const completionRecord = useTourCompletion(flow?.tour ?? null);
+
+  // Session flag prevents the gate re-opening after accept/dismiss within this mount.
+  const [resolvedThisSession, setResolvedThisSession] = useState(false);
+
+  const activeFlow =
+    flow &&
+    !resolvedThisSession &&
+    shouldStartOnboarding({ hasProviders, completionRecord })
+      ? flow
+      : null;
+
+  if (!activeFlow) return null;
+
+  const handleAccept = () => {
+    // Arm checkpoint only on explicit accept — skip must never arm it.
+    useOnboardingCheckpointStore.getState().arm();
+    setResolvedThisSession(true);
+    // Routes may already carry a query string, so pick the right separator.
+    const separator = activeFlow.route.includes("?") ? "&" : "?";
+    router.push(`${activeFlow.route}${separator}onboarding=${activeFlow.id}`);
+  };
+
+  const handleDismiss = () => {
+    // Persist dismissal so the gate silently skips on future visits.
+    localStorageAdapter.set(
+      { id: activeFlow.tour.id, version: activeFlow.tour.version },
+      {
+        tourId: activeFlow.tour.id,
+        version: activeFlow.tour.version,
+        state: TOUR_COMPLETION_STATES.DISMISSED,
+        completedAt: new Date().toISOString(),
+      },
+    );
+    setResolvedThisSession(true);
+  };
+
+  return (
+    <OnboardingWelcomeModal
+      open
+      flowTitle={activeFlow.title}
+      flowDescription={activeFlow.description}
+      onAccept={handleAccept}
+      onDismiss={handleDismiss}
+    />
+  );
+}
diff --git a/ui/components/onboarding/onboarding-sequence-banner.logic.ts b/ui/components/onboarding/onboarding-sequence-banner.logic.ts
new file mode 100644
index 0000000000..cea460e983
--- /dev/null
+++ b/ui/components/onboarding/onboarding-sequence-banner.logic.ts
@@ -0,0 +1,32 @@
+import {
+  getOrderedFlows,
+  type OnboardingFlow,
+  onboardingFlows,
+} from "@/lib/onboarding";
+
+// Framework-free projection of the active sequence position — unit-testable without React.
+export interface SequenceProgress {
+  index: number; // 0-based
+  total: number;
+  flow: OnboardingFlow;
+  nextFlow: OnboardingFlow | null; // null when on the last step
+}
+
+// Returns null when `currentFlowId` is absent or not in the registry.
+export function getSequenceProgress(
+  currentFlowId: string | null,
+  flows: readonly OnboardingFlow[] = onboardingFlows,
+): SequenceProgress | null {
+  if (!currentFlowId) return null;
+
+  const ordered = getOrderedFlows(flows);
+  const index = ordered.findIndex((flow) => flow.id === currentFlowId);
+  if (index < 0) return null;
+
+  return {
+    index,
+    total: ordered.length,
+    flow: ordered[index],
+    nextFlow: ordered[index + 1] ?? null,
+  };
+}
diff --git a/ui/components/onboarding/onboarding-sequence-banner.tsx b/ui/components/onboarding/onboarding-sequence-banner.tsx
new file mode 100644
index 0000000000..3b9cce47cf
--- /dev/null
+++ b/ui/components/onboarding/onboarding-sequence-banner.tsx
@@ -0,0 +1,100 @@
+"use client";
+
+import { useRouter } from "next/navigation";
+
+import { Button } from "@/components/shadcn";
+import { cn } from "@/lib/utils";
+import { useOnboardingSequenceStore } from "@/store/onboarding-sequence";
+
+import { getSequenceProgress } from "./onboarding-sequence-banner.logic";
+
+interface OnboardingSequenceBannerProps {
+  // Defaults to true (fail-open) when scan state is unknown, so the banner never
+  // wrongly blocks progression.
+  hasCompletedScan?: boolean;
+}
+
+// Non-blocking bottom banner for an active sequence. Owns advance/exit; the per-route
+// tour only shows on arrival and no longer auto-advances on close.
+export function OnboardingSequenceBanner({
+  hasCompletedScan = true,
+}: OnboardingSequenceBannerProps = {}) {
+  const router = useRouter();
+  const active = useOnboardingSequenceStore((state) => state.active);
+  const currentFlowId = useOnboardingSequenceStore(
+    (state) => state.currentFlowId,
+  );
+
+  const progress = getSequenceProgress(currentFlowId);
+  if (!active || !progress) return null;
+
+  const { index, total, flow, nextFlow } = progress;
+
+  // Block advancing into a scan-dependent step (e.g. findings, compliance) until a
+  // scan has finished — those steps have no data to show otherwise.
+  const continueDisabled =
+    hasCompletedScan === false && Boolean(nextFlow?.dataRequirementHint);
+  // Only surface a hint to explain why Continue is disabled. The gate already
+  // guarantees scan-dependent steps are reached with data, so showing a step's
+  // own "wait for findings" hint once we're there would be stale/misleading.
+  const hint = continueDisabled ? nextFlow?.dataRequirementHint : undefined;
+
+  const handleContinue = () => {
+    if (continueDisabled) return;
+    const sequence = useOnboardingSequenceStore.getState();
+    if (!nextFlow) {
+      sequence.stop(); // last step — end in place
+      return;
+    }
+    sequence.advance();
+    router.push(nextFlow.route);
+  };
+
+  const handleExit = () => {
+    useOnboardingSequenceStore.getState().stop();
+  };
+
+  return (
+    <div
+      role="region"
+      aria-label="Onboarding tour progress"
+      className={cn(
+        "fixed inset-x-0 bottom-0 z-40",
+        "border-border-neutral-secondary bg-bg-neutral-secondary border-t",
+        "px-4 py-3 shadow-lg",
+      )}
+    >
+      {/* Everything aligned to the right edge: step text first, then the two buttons.
+          No max-width/centering — that left a gap between the content and the screen. */}
+      <div className="flex flex-col gap-2 sm:flex-row sm:items-center sm:justify-end sm:gap-6">
+        <div className="flex flex-col gap-1 sm:text-right">
+          {/* Polite live region: screen readers announce step transitions. */}
+          <p
+            role="status"
+            aria-live="polite"
+            className="text-text-neutral-primary text-sm font-medium"
+          >
+            Step {index + 1} of {total}: {flow.title}
+          </p>
+          {hint ? (
+            <p className="text-text-warning-primary text-xs">{hint}</p>
+          ) : null}
+        </div>
+        <div className="flex shrink-0 items-center gap-2">
+          {/* Secondary action: skips the whole tour. Outline matches the app's modal Cancel variant. */}
+          <Button variant="outline" size="sm" onClick={handleExit}>
+            Skip
+          </Button>
+          <Button
+            variant="default"
+            size="sm"
+            disabled={continueDisabled}
+            onClick={handleContinue}
+          >
+            Continue
+          </Button>
+        </div>
+      </div>
+    </div>
+  );
+}
diff --git a/ui/components/onboarding/onboarding-trigger.logic.ts b/ui/components/onboarding/onboarding-trigger.logic.ts
new file mode 100644
index 0000000000..841451304d
--- /dev/null
+++ b/ui/components/onboarding/onboarding-trigger.logic.ts
@@ -0,0 +1,48 @@
+import type { TourCompletionRecord } from "@/lib/tours/tour-types";
+import type { OnboardingSequenceMode } from "@/store/onboarding-sequence";
+
+// Flat, framework-free inputs for `resolveTriggerRequest` — unit-testable without React.
+export interface TriggerRequestInput {
+  param: string | null; // `?onboarding=<id>` value, or null
+  replayRequestFlowId: string | null; // in-memory replay request (same-route navbar), or null
+  sliceActive: boolean;
+  currentFlowId: string | null; // flow the active sequence points at
+  flowId: string; // flow this route owns
+}
+
+// Resolved start request, or null when this route's flow should not start.
+export interface TriggerRequest {
+  start: true;
+  mode: OnboardingSequenceMode;
+}
+
+// Replay (param or in-memory request) takes precedence over the sequence so a
+// manual replay is never hijacked. The in-memory request is how the navbar starts
+// a same-route replay without a `?onboarding=` URL param (which would force an RSC refetch).
+export function resolveTriggerRequest({
+  param,
+  replayRequestFlowId,
+  sliceActive,
+  currentFlowId,
+  flowId,
+}: TriggerRequestInput): TriggerRequest | null {
+  if (param === flowId) {
+    return { start: true, mode: "replay" };
+  }
+  if (replayRequestFlowId === flowId) {
+    return { start: true, mode: "replay" };
+  }
+  if (sliceActive && currentFlowId === flowId) {
+    return { start: true, mode: "sequence" };
+  }
+  return null;
+}
+
+// completed → advance the sequence; anything else → stop.
+export type SequenceCloseAction = "advance" | "stop";
+
+export function mapCloseToSequenceAction(
+  state: TourCompletionRecord["state"],
+): SequenceCloseAction {
+  return state === "completed" ? "advance" : "stop";
+}
diff --git a/ui/components/onboarding/onboarding-trigger.tsx b/ui/components/onboarding/onboarding-trigger.tsx
new file mode 100644
index 0000000000..2a1854f3c8
--- /dev/null
+++ b/ui/components/onboarding/onboarding-trigger.tsx
@@ -0,0 +1,165 @@
+"use client";
+
+import type { Config } from "driver.js";
+import { useSearchParams } from "next/navigation";
+import { useState } from "react";
+
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { type OnboardingFlow } from "@/lib/onboarding";
+import { isCloud } from "@/lib/shared/env";
+import type { TourStepHandlers } from "@/lib/tours/tour-types";
+import { useDriverTour } from "@/lib/tours/use-driver-tour";
+import { useOnboardingReplayStore } from "@/store/onboarding-replay";
+import {
+  type OnboardingSequenceMode,
+  useOnboardingSequenceStore,
+} from "@/store/onboarding-sequence";
+
+import { resolveTriggerRequest } from "./onboarding-trigger.logic";
+
+const ONBOARDING_PARAM = "onboarding";
+
+function stripOnboardingParamFromLocation(queryString: string) {
+  const params = new URLSearchParams(queryString);
+  params.delete(ONBOARDING_PARAM);
+  const query = params.toString();
+  window.history.replaceState(
+    null,
+    "",
+    `${window.location.pathname}${query ? `?${query}` : ""}${window.location.hash}`,
+  );
+}
+
+interface OnboardingTriggerProps<TTarget extends string = string> {
+  flow: OnboardingFlow; // force-started when the sequence names it or `?onboarding=<id>` matches
+  stepHandlers?: { [K in TTarget]?: TourStepHandlers<TTarget> };
+  configOverrides?: Partial<Config>;
+}
+
+// Latched per-trigger: `key` mounts a fresh runner on each re-trigger; `mode` drives param-strip logic.
+interface OnboardingRequest {
+  flow: OnboardingFlow;
+  key: number;
+  mode: OnboardingSequenceMode;
+  queryString: string;
+}
+
+// Per-route trigger: derives via `resolveTriggerRequest` whether this flow should start,
+// then mounts a keyed runner. Renders nothing.
+export function OnboardingTrigger<TTarget extends string = string>({
+  flow,
+  stepHandlers,
+  configOverrides,
+}: OnboardingTriggerProps<TTarget>) {
+  const searchParams = useSearchParams();
+  const param = searchParams?.get(ONBOARDING_PARAM) ?? null; // null outside Suspense context
+  const queryString = searchParams?.toString() ?? "";
+
+  const sliceActive = useOnboardingSequenceStore((state) => state.active);
+  const currentFlowId = useOnboardingSequenceStore(
+    (state) => state.currentFlowId,
+  );
+
+  // In-memory replay request (same-route navbar click): starts the tour without a
+  // `?onboarding=` URL param, so Next.js never refetches the page. `token` bumps on
+  // every request so re-clicking the same flow yields a fresh signal.
+  const replayRequestFlowId = useOnboardingReplayStore((state) => state.flowId);
+  const replayToken = useOnboardingReplayStore((state) => state.token);
+
+  // Cloud-only: in OSS the tour never resolves, so a manual `?onboarding=` URL can't start it.
+  const resolved = isCloud()
+    ? resolveTriggerRequest({
+        param,
+        replayRequestFlowId,
+        sliceActive,
+        currentFlowId,
+        flowId: flow.id,
+      })
+    : null;
+  // Token is part of the signal so a repeat same-route replay re-mints the key.
+  // For param/sequence starts the token is stable, so behaviour is unchanged.
+  const signal = resolved ? `${flow.id}:${resolved.mode}:${replayToken}` : null;
+
+  // Latched via "adjust state while rendering" (no useEffect): mints a fresh key on each
+  // new truthy signal; when signal drops to null (param stripped) the runner stays mounted.
+  const [request, setRequest] = useState<OnboardingRequest | null>(null);
+  const [lastSignal, setLastSignal] = useState<string | null>(null);
+
+  if (signal !== lastSignal) {
+    setLastSignal(signal);
+    if (resolved) {
+      setRequest((prev) => ({
+        flow,
+        key: (prev?.key ?? 0) + 1,
+        mode: resolved.mode,
+        queryString,
+      }));
+    }
+  }
+
+  if (!request) return null;
+
+  // Keyed runner: fresh mount per re-trigger; `useDriverTour` is unconditional so hooks rules hold.
+  return (
+    <OnboardingTourRunner<TTarget>
+      key={request.key}
+      flow={request.flow}
+      mode={request.mode}
+      queryString={request.queryString}
+      stepHandlers={stepHandlers}
+      configOverrides={configOverrides}
+    />
+  );
+}
+
+interface OnboardingTourRunnerProps<TTarget extends string> {
+  flow: OnboardingFlow;
+  mode: OnboardingSequenceMode;
+  queryString: string;
+  stepHandlers?: { [K in TTarget]?: TourStepHandlers<TTarget> };
+  configOverrides?: Partial<Config>;
+}
+
+function OnboardingTourRunner<TTarget extends string>({
+  flow,
+  mode,
+  queryString,
+  stepHandlers,
+  configOverrides,
+}: OnboardingTourRunnerProps<TTarget>) {
+  // onClosed is intentionally inert — the banner owns advance/exit for both modes.
+  const { start } = useDriverTour(flow.tour, {
+    autoOpen: false,
+    stepHandlers,
+    configOverrides,
+    onClosed: () => {},
+  });
+
+  // replaceState (not router.replace) avoids a useSearchParams re-trigger that would
+  // drop the latched runner. The microtask keeps driver.js/flushSync outside
+  // React's mount lifecycle.
+  useMountEffect(() => {
+    let cancelled = false;
+
+    queueMicrotask(() => {
+      if (cancelled) return;
+
+      start();
+      if (mode === "replay") {
+        // Only strip when the param actually started this replay; a same-route
+        // in-memory request leaves the URL untouched (no replaceState needed).
+        if (new URLSearchParams(queryString).has(ONBOARDING_PARAM)) {
+          stripOnboardingParamFromLocation(queryString);
+        }
+        // Clear any in-memory request so returning to this page won't auto-replay.
+        useOnboardingReplayStore.getState().consume();
+      }
+    });
+
+    return () => {
+      cancelled = true;
+    };
+  });
+
+  return null;
+}
diff --git a/ui/components/onboarding/onboarding-welcome-modal.tsx b/ui/components/onboarding/onboarding-welcome-modal.tsx
new file mode 100644
index 0000000000..566db34cba
--- /dev/null
+++ b/ui/components/onboarding/onboarding-welcome-modal.tsx
@@ -0,0 +1,42 @@
+"use client";
+
+import { Button } from "@/components/shadcn";
+import { DialogFooter } from "@/components/shadcn/dialog";
+import { Modal } from "@/components/shadcn/modal/modal";
+
+interface OnboardingWelcomeModalProps {
+  open: boolean;
+  flowTitle?: string;
+  flowDescription?: string;
+  onAccept: () => void;
+  onDismiss: () => void;
+}
+
+export function OnboardingWelcomeModal({
+  open,
+  flowTitle,
+  flowDescription,
+  onAccept,
+  onDismiss,
+}: OnboardingWelcomeModalProps) {
+  return (
+    <Modal
+      open={open}
+      title={flowTitle}
+      description={flowDescription}
+      size="lg"
+      // Overlay/Escape/X counts as dismiss — gate persists the record once.
+      onOpenChange={(next) => {
+        if (!next) onDismiss();
+      }}
+    >
+      <DialogFooter>
+        {/* Outline matches the app's modal secondary action (e.g. Launch Scan's Cancel). */}
+        <Button variant="outline" onClick={onDismiss}>
+          Skip for now
+        </Button>
+        <Button onClick={onAccept}>Get started</Button>
+      </DialogFooter>
+    </Modal>
+  );
+}
diff --git a/ui/components/onboarding/page-ready.tsx b/ui/components/onboarding/page-ready.tsx
new file mode 100644
index 0000000000..a24b0e4234
--- /dev/null
+++ b/ui/components/onboarding/page-ready.tsx
@@ -0,0 +1,25 @@
+"use client";
+
+import { usePathname } from "next/navigation";
+
+import { useMountEffect } from "@/hooks/use-mount-effect";
+import { usePageReadyStore } from "@/store/page-ready";
+
+/**
+ * Invisible marker rendered inside a page's post-Suspense (data-loaded) content.
+ * While it is unmounted the route counts as "still loading", which the navbar uses
+ * to keep the product-tour replay icon disabled until the page's requests resolve.
+ * Mounting marks the route ready; unmounting (navigation / in-page re-suspense) clears it.
+ */
+export function PageReady() {
+  const pathname = usePathname();
+  const markReady = usePageReadyStore((state) => state.markReady);
+  const clearReady = usePageReadyStore((state) => state.clearReady);
+
+  useMountEffect(() => {
+    markReady(pathname);
+    return () => clearReady(pathname);
+  });
+
+  return null;
+}
diff --git a/ui/components/providers/add-provider-button.tsx b/ui/components/providers/add-provider-button.tsx
index b296533ccc..0c965bd3cd 100644
--- a/ui/components/providers/add-provider-button.tsx
+++ b/ui/components/providers/add-provider-button.tsx
@@ -23,7 +23,9 @@ export const AddProviderButton = ({ onOpenWizard }: AddProviderButtonProps) => {
 
   return (
     <>
-      <Button onClick={handleOpen}>Add Provider</Button>
+      <Button data-tour-id="add-provider-trigger" onClick={handleOpen}>
+        Add Provider
+      </Button>
       {!onOpenWizard && (
         <ProviderWizardModal open={open} onOpenChange={setOpen} />
       )}
diff --git a/ui/components/providers/no-providers-added.tsx b/ui/components/providers/no-providers-added.tsx
index 0860f92d80..5bfb8836ea 100644
--- a/ui/components/providers/no-providers-added.tsx
+++ b/ui/components/providers/no-providers-added.tsx
@@ -13,6 +13,8 @@ const NO_PROVIDERS_ADDED_ACTION = {
 
 interface NoProvidersAddedBaseProps {
   containerClassName?: string;
+  // Tour anchor for the CTA; needed because this empty state replaces the table's AddProviderButton.
+  ctaTourId?: string;
 }
 
 interface NoProvidersAddedButtonProps extends NoProvidersAddedBaseProps {
@@ -40,7 +42,7 @@ const renderCta = (props: NoProvidersAddedProps) => {
         className="w-full max-w-xs justify-center"
         size="lg"
       >
-        <Link href={props.href}>Get Started</Link>
+        <Link href={props.href}>Add a Provider</Link>
       </Button>
     );
   }
@@ -49,10 +51,11 @@ const renderCta = (props: NoProvidersAddedProps) => {
     <Button
       aria-label="Open Add Provider modal"
       className="w-full max-w-xs justify-center"
+      data-tour-id={props.ctaTourId}
       size="lg"
       onClick={props.onOpenWizard}
     >
-      Get Started
+      Add a Provider
     </Button>
   );
 };
diff --git a/ui/components/providers/providers-accounts-view.tsx b/ui/components/providers/providers-accounts-view.tsx
index 62322e2ccd..a7b7702f0e 100644
--- a/ui/components/providers/providers-accounts-view.tsx
+++ b/ui/components/providers/providers-accounts-view.tsx
@@ -1,8 +1,9 @@
 "use client";
 
 import { usePathname, useSearchParams } from "next/navigation";
-import { useState } from "react";
+import { Suspense, useState } from "react";
 
+import { OnboardingTrigger, PageReady } from "@/components/onboarding";
 import { AddProviderButton } from "@/components/providers/add-provider-button";
 import { MutedFindingsConfigButton } from "@/components/providers/muted-findings-config-button";
 import { NoProvidersAdded } from "@/components/providers/no-providers-added";
@@ -13,13 +14,37 @@ import type {
   OrgWizardInitialData,
   ProviderWizardInitialData,
 } from "@/components/providers/wizard/types";
+import { getFlowById } from "@/lib/onboarding";
 import {
   ADD_PROVIDER_SEARCH_PARAM,
   ADD_PROVIDER_SEARCH_VALUE,
 } from "@/lib/providers-navigation";
+import {
+  ADD_PROVIDER_TOUR_TARGETS,
+  addProviderTour,
+} from "@/lib/tours/add-provider.tour";
+import {
+  advanceActiveTourWhenReady,
+  getTourTargetSelector,
+} from "@/lib/tours/use-driver-tour";
 import type { FilterOption, MetaDataProps, ProviderProps } from "@/types";
 import type { ProvidersTableRow } from "@/types/providers-table";
 
+const addProviderFlow = getFlowById("add-provider")!;
+
+// Softer overlay for this onboarding tour — a heavy dim over the wizard feels harsh
+// while the user fills the form. Module-level constant keeps the driver config stable
+// across renders (useDriverTour recreates the driver when configOverrides identity
+// changes).
+const ADD_PROVIDER_TOUR_CONFIG = { overlayOpacity: 0.45 } as const;
+
+// The tour's "trigger" step auto-advances when the wizard opens; this is the anchor
+// it waits for (the provider-type selector inside the wizard).
+const PROVIDER_TYPE_TOUR_SELECTOR = getTourTargetSelector(
+  addProviderTour.id,
+  ADD_PROVIDER_TOUR_TARGETS.PROVIDER_TYPE,
+);
+
 interface ProvidersAccountsViewProps {
   isCloud: boolean;
   filters: FilterOption[];
@@ -54,6 +79,9 @@ export function ProvidersAccountsView({
     setOrgWizardInitialData(undefined);
     setProviderWizardInitialData(initialData);
     setIsProviderWizardOpen(true);
+    // If the add-provider tour is on its "trigger" step, opening the wizard is the
+    // advance signal: move to the provider-type step once it mounts. No-op otherwise.
+    advanceActiveTourWhenReady(PROVIDER_TYPE_TOUR_SELECTOR);
   };
 
   const openOrganizationWizard = (initialData: OrgWizardInitialData) => {
@@ -70,12 +98,8 @@ export function ProvidersAccountsView({
     setProviderWizardInitialData(undefined);
     setOrgWizardInitialData(undefined);
 
-    // Only clean the one-shot ?addProvider intent from the URL bar, via the
-    // History API so it does NOT trigger an RSC refetch. We must not refresh
-    // here: the provider-creation actions (addProvider / addCredentialsProvider
-    // / checkConnectionProvider) already revalidatePath("/providers"), so the
-    // table updates behind the modal. A router.refresh()/replace() on close
-    // re-ran the whole /providers Server Component, which read as a full reload.
+    // Remove ?addProvider via History API (not router.replace) to avoid an RSC refetch;
+    // revalidatePath in the creation actions already refreshes the table.
     if (searchParams.has(ADD_PROVIDER_SEARCH_PARAM)) {
       const params = new URLSearchParams(searchParams.toString());
       params.delete(ADD_PROVIDER_SEARCH_PARAM);
@@ -90,11 +114,21 @@ export function ProvidersAccountsView({
 
   return (
     <>
+      {/* Suspense required: OnboardingTrigger reads useSearchParams */}
+      <Suspense fallback={null}>
+        <OnboardingTrigger
+          flow={addProviderFlow}
+          configOverrides={ADD_PROVIDER_TOUR_CONFIG}
+        />
+      </Suspense>
+      {/* Signals the navbar that this route's data has loaded (enables the replay icon). */}
+      <PageReady />
       {hasNoProviders ? (
         <NoProvidersAdded
           action="button"
           containerClassName="min-h-[calc(100dvh-28rem)]"
           onOpenWizard={() => openProviderWizard()}
+          ctaTourId="add-provider-trigger"
         />
       ) : (
         <div className="flex flex-col gap-6">
diff --git a/ui/components/providers/wizard/hooks/use-provider-wizard-controller.test.tsx b/ui/components/providers/wizard/hooks/use-provider-wizard-controller.test.tsx
index 9688c3d684..0d0ce0b0a2 100644
--- a/ui/components/providers/wizard/hooks/use-provider-wizard-controller.test.tsx
+++ b/ui/components/providers/wizard/hooks/use-provider-wizard-controller.test.tsx
@@ -12,8 +12,9 @@ import {
 import type { ProviderWizardInitialData } from "../types";
 import { useProviderWizardController } from "./use-provider-wizard-controller";
 
-const { refreshMock } = vi.hoisted(() => ({
+const { refreshMock, requestOpenOnWizardCloseMock } = vi.hoisted(() => ({
   refreshMock: vi.fn(),
+  requestOpenOnWizardCloseMock: vi.fn(),
 }));
 
 vi.mock("next/navigation", () => ({
@@ -22,6 +23,14 @@ vi.mock("next/navigation", () => ({
   }),
 }));
 
+vi.mock("@/store/onboarding-checkpoint", () => ({
+  useOnboardingCheckpointStore: {
+    getState: () => ({
+      requestOpenOnWizardClose: requestOpenOnWizardCloseMock,
+    }),
+  },
+}));
+
 vi.mock("next-auth/react", () => ({
   useSession: () => ({
     data: null,
@@ -33,8 +42,11 @@ describe("useProviderWizardController", () => {
   beforeEach(() => {
     vi.useRealTimers();
     vi.clearAllMocks();
+    requestOpenOnWizardCloseMock.mockClear();
     sessionStorage.clear();
     localStorage.clear();
+    // Checkpoint is Cloud-only.
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
     useProviderWizardStore.getState().reset();
     useOrgSetupStore.getState().reset();
   });
@@ -59,6 +71,78 @@ describe("useProviderWizardController", () => {
     expect(refreshMock).toHaveBeenCalledTimes(1);
   });
 
+  it("requests the onboarding checkpoint with providerConnected:true when a provider was created", () => {
+    const onOpenChange = vi.fn();
+    const { result } = renderHook(() =>
+      useProviderWizardController({
+        open: true,
+        onOpenChange,
+      }),
+    );
+    act(() => {
+      useProviderWizardStore.getState().setProvider({
+        id: "provider-1",
+        type: "aws",
+        uid: "111111111111",
+        alias: "production",
+      });
+    });
+
+    act(() => {
+      result.current.handleClose();
+    });
+
+    // providerId is read before the store reset clears it.
+    expect(requestOpenOnWizardCloseMock).toHaveBeenCalledWith({
+      providerConnected: true,
+    });
+  });
+
+  it("requests the onboarding checkpoint with providerConnected:false when no provider was created", () => {
+    const onOpenChange = vi.fn();
+    const { result } = renderHook(() =>
+      useProviderWizardController({
+        open: true,
+        onOpenChange,
+      }),
+    );
+
+    act(() => {
+      result.current.handleClose();
+    });
+
+    expect(requestOpenOnWizardCloseMock).toHaveBeenCalledWith({
+      providerConnected: false,
+    });
+  });
+
+  it("does not request the onboarding checkpoint in self-hosted (OSS) deployments", () => {
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+    const onOpenChange = vi.fn();
+    const { result } = renderHook(() =>
+      useProviderWizardController({
+        open: true,
+        onOpenChange,
+      }),
+    );
+    act(() => {
+      useProviderWizardStore.getState().setProvider({
+        id: "provider-1",
+        type: "aws",
+        uid: "111111111111",
+        alias: "production",
+      });
+    });
+
+    act(() => {
+      result.current.handleClose();
+    });
+
+    // Checkpoint stays untouched, but the close still refreshes.
+    expect(requestOpenOnWizardCloseMock).not.toHaveBeenCalled();
+    expect(refreshMock).toHaveBeenCalledTimes(1);
+  });
+
   it("hydrates update mode when initial data is provided", async () => {
     // Given
     const onOpenChange = vi.fn();
@@ -181,7 +265,7 @@ describe("useProviderWizardController", () => {
       result.current.handleTestSuccess();
     });
 
-    // Then: credential rotation never surfaces the launch/schedule step
+    // Credential rotation skips the launch/schedule step.
     expect(onOpenChange).toHaveBeenCalledWith(false);
     expect(refreshMock).toHaveBeenCalledTimes(1);
     expect(result.current.currentStep).not.toBe(PROVIDER_WIZARD_STEP.LAUNCH);
@@ -280,7 +364,7 @@ describe("useProviderWizardController", () => {
       result.current.setCurrentStep(PROVIDER_WIZARD_STEP.TEST);
     });
 
-    // When: provider data refreshes while modal is still open
+    // Provider data refreshes while modal is still open — user progress must be kept.
     rerender({
       open: true,
       initialData: {
@@ -293,7 +377,6 @@ describe("useProviderWizardController", () => {
       },
     });
 
-    // Then: keep user progress in the current flow
     expect(result.current.currentStep).toBe(PROVIDER_WIZARD_STEP.TEST);
     expect(useProviderWizardStore.getState().via).toBe("service-account");
   });
diff --git a/ui/components/providers/wizard/hooks/use-provider-wizard-controller.ts b/ui/components/providers/wizard/hooks/use-provider-wizard-controller.ts
index dea38e95a9..80c2182840 100644
--- a/ui/components/providers/wizard/hooks/use-provider-wizard-controller.ts
+++ b/ui/components/providers/wizard/hooks/use-provider-wizard-controller.ts
@@ -4,6 +4,9 @@ import { useRouter } from "next/navigation";
 import { useEffect, useRef, useState } from "react";
 
 import { DOCS_URLS, getProviderHelpText } from "@/lib/external-urls";
+import { isCloud } from "@/lib/shared/env";
+import { endActiveTour } from "@/lib/tours/use-driver-tour";
+import { useOnboardingCheckpointStore } from "@/store/onboarding-checkpoint";
 import { useOrgSetupStore } from "@/store/organizations/store";
 import { useProviderWizardStore } from "@/store/provider-wizard/store";
 import {
@@ -50,9 +53,7 @@ interface UseProviderWizardControllerProps {
   onOpenChange: (open: boolean) => void;
   initialData?: ProviderWizardInitialData;
   orgInitialData?: OrgWizardInitialData;
-  // When false, the caller skips the post-close router.refresh() and relies on
-  // the provider-creation actions' revalidatePath("/providers") to refresh the
-  // data. Defaults to true so standalone callers keep refreshing.
+  // When false, skips post-close router.refresh() — caller relies on revalidatePath instead.
   refreshOnClose?: boolean;
 }
 
@@ -181,6 +182,13 @@ export function useProviderWizardController({
   const isOrgDirectEntry = Boolean(orgInitialData);
 
   const handleClose = () => {
+    // Closing the wizard at any point ends the add-provider tour; the checkpoint
+    // logic below still drives the handoff to scans. No-op off-onboarding.
+    endActiveTour();
+
+    // Read providerId before reset clears it — non-null means a provider was connected.
+    const connectedProviderId = useProviderWizardStore.getState().providerId;
+
     resetProviderWizard();
     resetOrgWizard();
     setWizardVariant(WIZARD_VARIANT.PROVIDER);
@@ -190,6 +198,14 @@ export function useProviderWizardController({
     setProviderTypeHint(null);
     setOrgSetupPhase(ORG_SETUP_PHASE.DETAILS);
     onOpenChange(false);
+
+    // Cloud-only; only fires if the store is armed (user started onboarding).
+    if (isCloud()) {
+      useOnboardingCheckpointStore.getState().requestOpenOnWizardClose({
+        providerConnected: connectedProviderId !== null,
+      });
+    }
+
     if (refreshOnClose) {
       router.refresh();
     }
@@ -214,6 +230,9 @@ export function useProviderWizardController({
   };
 
   const openOrganizationsFlow = () => {
+    // AWS Organizations diverges from the credentials path the tour guides toward; end
+    // it so it doesn't dangle on a step that no longer fits. No-op off-onboarding.
+    endActiveTour();
     resetOrgWizard();
     setWizardVariant(WIZARD_VARIANT.ORGANIZATIONS);
     setOrgCurrentStep(ORG_WIZARD_STEP.SETUP);
diff --git a/ui/components/providers/wizard/provider-wizard-modal.tsx b/ui/components/providers/wizard/provider-wizard-modal.tsx
index 2d0646d957..36c5058120 100644
--- a/ui/components/providers/wizard/provider-wizard-modal.tsx
+++ b/ui/components/providers/wizard/provider-wizard-modal.tsx
@@ -9,6 +9,7 @@ import { Button } from "@/components/shadcn/button/button";
 import { DialogHeader, DialogTitle } from "@/components/shadcn/dialog";
 import { Modal } from "@/components/shadcn/modal";
 import { useScrollHint } from "@/hooks/use-scroll-hint";
+import { advanceActiveTour, endActiveTour } from "@/lib/tours/use-driver-tour";
 import { ORG_SETUP_PHASE, ORG_WIZARD_STEP } from "@/types/organizations";
 import {
   PROVIDER_WIZARD_MODE,
@@ -129,188 +130,212 @@ export function ProviderWizardModal({
         </div>
         <div aria-hidden className="hidden w-[100px] min-w-0 shrink lg:block" />
 
-        <div className="relative flex-1 overflow-hidden">
-          <div
-            ref={containerRef}
-            className="minimal-scrollbar h-full w-full overflow-y-scroll [scrollbar-gutter:stable] lg:ml-auto lg:max-w-[620px] xl:max-w-[700px]"
-          >
-            {isProviderFlow && currentStep === PROVIDER_WIZARD_STEP.CONNECT && (
-              <ConnectStep
-                onNext={() => setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS)}
-                onSelectOrganizations={openOrganizationsFlow}
-                onFooterChange={setFooterConfig}
-                onProviderTypeChange={setProviderTypeHint}
-              />
-            )}
+        {/* Anchors the add-provider tour's final step to the whole right section —
+            the form inputs AND the footer — so the spotlight covers the Next button
+            instead of leaving it under the overlay. The popover still pins to the left
+            of this section, beside the inputs. */}
+        <div
+          data-tour-id="add-provider-wizard-body"
+          className="relative flex min-h-0 flex-1 flex-col overflow-hidden"
+        >
+          <div className="relative min-h-0 flex-1 overflow-hidden">
+            <div
+              ref={containerRef}
+              className="minimal-scrollbar h-full w-full overflow-y-scroll [scrollbar-gutter:stable] lg:ml-auto lg:max-w-[620px] xl:max-w-[700px]"
+            >
+              {isProviderFlow &&
+                currentStep === PROVIDER_WIZARD_STEP.CONNECT && (
+                  <ConnectStep
+                    onNext={() => {
+                      setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS);
+                      // Reaching credentials is the tour's handoff point: end it so the
+                      // user continues on their own. No-op off-onboarding.
+                      endActiveTour();
+                    }}
+                    onSelectOrganizations={openOrganizationsFlow}
+                    onFooterChange={setFooterConfig}
+                    onProviderTypeChange={(providerType) => {
+                      // Picking a type reveals the account-detail inputs. Advance the tour
+                      // to its wizard-body step, pinned beside the form. No-op off-onboarding.
+                      if (providerType) advanceActiveTour();
+                      setProviderTypeHint(providerType);
+                    }}
+                  />
+                )}
 
-            {isProviderFlow &&
-              currentStep === PROVIDER_WIZARD_STEP.CREDENTIALS && (
-                <CredentialsStep
-                  onNext={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
-                  onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.CONNECT)}
+              {isProviderFlow &&
+                currentStep === PROVIDER_WIZARD_STEP.CREDENTIALS && (
+                  <CredentialsStep
+                    onNext={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
+                    onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.CONNECT)}
+                    onFooterChange={setFooterConfig}
+                  />
+                )}
+
+              {isProviderFlow && currentStep === PROVIDER_WIZARD_STEP.TEST && (
+                <TestConnectionStep
+                  onSuccess={handleTestSuccess}
+                  onResetCredentials={() =>
+                    setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS)
+                  }
                   onFooterChange={setFooterConfig}
                 />
               )}
 
-            {isProviderFlow && currentStep === PROVIDER_WIZARD_STEP.TEST && (
-              <TestConnectionStep
-                onSuccess={handleTestSuccess}
-                onResetCredentials={() =>
-                  setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS)
-                }
-                onFooterChange={setFooterConfig}
-              />
-            )}
+              {isProviderFlow &&
+                currentStep === PROVIDER_WIZARD_STEP.LAUNCH && (
+                  <LaunchStep
+                    onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
+                    onClose={handleClose}
+                    onFooterChange={setFooterConfig}
+                  />
+                )}
 
-            {isProviderFlow && currentStep === PROVIDER_WIZARD_STEP.LAUNCH && (
-              <LaunchStep
-                onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
-                onClose={handleClose}
-                onFooterChange={setFooterConfig}
-              />
-            )}
+              {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.SETUP && (
+                <OrgSetupForm
+                  onBack={isOrgDirectEntry ? handleClose : backToProviderFlow}
+                  onClose={handleClose}
+                  onNext={() => {
+                    setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
+                  }}
+                  onFooterChange={setFooterConfig}
+                  onPhaseChange={setOrgSetupPhase}
+                  initialPhase={orgSetupPhase}
+                  initialValues={
+                    orgInitialData
+                      ? {
+                          organizationName: orgInitialData.organizationName,
+                          awsOrgId: orgInitialData.externalId,
+                        }
+                      : undefined
+                  }
+                  intent={orgInitialData?.intent}
+                />
+              )}
 
-            {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.SETUP && (
-              <OrgSetupForm
-                onBack={isOrgDirectEntry ? handleClose : backToProviderFlow}
-                onClose={handleClose}
-                onNext={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
-                }}
-                onFooterChange={setFooterConfig}
-                onPhaseChange={setOrgSetupPhase}
-                initialPhase={orgSetupPhase}
-                initialValues={
-                  orgInitialData
-                    ? {
-                        organizationName: orgInitialData.organizationName,
-                        awsOrgId: orgInitialData.externalId,
-                      }
-                    : undefined
-                }
-                intent={orgInitialData?.intent}
-              />
-            )}
+              {!isProviderFlow &&
+                orgCurrentStep === ORG_WIZARD_STEP.VALIDATE && (
+                  <OrgAccountSelection
+                    onBack={() => {
+                      setOrgCurrentStep(ORG_WIZARD_STEP.SETUP);
+                      setOrgSetupPhase(ORG_SETUP_PHASE.ACCESS);
+                    }}
+                    onNext={() => {
+                      setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
+                    }}
+                    onSkip={() => {
+                      setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
+                    }}
+                    onFooterChange={setFooterConfig}
+                  />
+                )}
 
-            {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.VALIDATE && (
-              <OrgAccountSelection
-                onBack={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.SETUP);
-                  setOrgSetupPhase(ORG_SETUP_PHASE.ACCESS);
-                }}
-                onNext={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
-                }}
-                onSkip={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
-                }}
-                onFooterChange={setFooterConfig}
-              />
-            )}
+              {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.LAUNCH && (
+                <OrgLaunchScan
+                  onClose={handleClose}
+                  onBack={() => {
+                    setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
+                  }}
+                  onFooterChange={setFooterConfig}
+                />
+              )}
 
-            {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.LAUNCH && (
-              <OrgLaunchScan
-                onClose={handleClose}
-                onBack={() => {
-                  setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
-                }}
-                onFooterChange={setFooterConfig}
-              />
-            )}
+              {/* Sentinel element for IntersectionObserver scroll detection */}
+              <div ref={sentinelRef} aria-hidden className="h-px shrink-0" />
+            </div>
 
-            {/* Sentinel element for IntersectionObserver scroll detection */}
-            <div ref={sentinelRef} aria-hidden className="h-px shrink-0" />
+            {showScrollHint && (
+              <div className="pointer-events-none absolute right-0 bottom-0 left-0 z-10">
+                <div className="from-bg-neutral-secondary h-12 bg-gradient-to-t to-transparent" />
+                <div className="absolute inset-x-0 bottom-2 flex justify-center">
+                  <span className="bg-bg-neutral-secondary/85 text-text-neutral-tertiary rounded-full px-3 py-1 text-xs backdrop-blur-sm">
+                    Scroll to see more
+                  </span>
+                </div>
+              </div>
+            )}
           </div>
+          {/* Inside the highlighted right section so the tour spotlight covers the Next
+            button (no longer dimmed by the overlay). Aligned to the form width so Next
+            stays at the right edge. */}
+          {(resolvedFooterConfig.showBack ||
+            resolvedFooterConfig.showSecondaryAction ||
+            resolvedFooterConfig.showAction) && (
+            <div className="mt-8 w-full pt-6 lg:ml-auto lg:max-w-[620px] xl:max-w-[700px]">
+              <div className="flex items-center justify-between">
+                <div>
+                  {resolvedFooterConfig.showBack && (
+                    <Button
+                      type="button"
+                      variant="outline"
+                      size="xl"
+                      disabled={resolvedFooterConfig.backDisabled}
+                      onClick={resolvedFooterConfig.onBack}
+                    >
+                      {resolvedFooterConfig.backLabel}
+                    </Button>
+                  )}
+                </div>
+                <div className="flex items-center gap-6">
+                  {resolvedFooterConfig.showSecondaryAction && (
+                    <Button
+                      size={
+                        resolvedFooterConfig.secondaryActionVariant === "link"
+                          ? "link-sm"
+                          : "xl"
+                      }
+                      className={
+                        resolvedFooterConfig.secondaryActionVariant === "link"
+                          ? "h-auto p-0"
+                          : undefined
+                      }
+                      variant={resolvedFooterConfig.secondaryActionVariant}
+                      type={
+                        resolvedFooterConfig.secondaryActionType ===
+                        WIZARD_FOOTER_ACTION_TYPE.SUBMIT
+                          ? "submit"
+                          : "button"
+                      }
+                      form={resolvedFooterConfig.secondaryActionFormId}
+                      disabled={resolvedFooterConfig.secondaryActionDisabled}
+                      onClick={
+                        resolvedFooterConfig.secondaryActionType ===
+                        WIZARD_FOOTER_ACTION_TYPE.BUTTON
+                          ? resolvedFooterConfig.onSecondaryAction
+                          : undefined
+                      }
+                    >
+                      {resolvedFooterConfig.secondaryActionLabel}
+                    </Button>
+                  )}
 
-          {showScrollHint && (
-            <div className="pointer-events-none absolute right-0 bottom-0 left-0 z-10">
-              <div className="from-bg-neutral-secondary h-12 bg-gradient-to-t to-transparent" />
-              <div className="absolute inset-x-0 bottom-2 flex justify-center">
-                <span className="bg-bg-neutral-secondary/85 text-text-neutral-tertiary rounded-full px-3 py-1 text-xs backdrop-blur-sm">
-                  Scroll to see more
-                </span>
+                  {resolvedFooterConfig.showAction && (
+                    <Button
+                      size="xl"
+                      type={
+                        resolvedFooterConfig.actionType ===
+                        WIZARD_FOOTER_ACTION_TYPE.SUBMIT
+                          ? "submit"
+                          : "button"
+                      }
+                      form={resolvedFooterConfig.actionFormId}
+                      disabled={resolvedFooterConfig.actionDisabled}
+                      onClick={
+                        resolvedFooterConfig.actionType ===
+                        WIZARD_FOOTER_ACTION_TYPE.BUTTON
+                          ? resolvedFooterConfig.onAction
+                          : undefined
+                      }
+                    >
+                      {resolvedFooterConfig.actionLabel}
+                    </Button>
+                  )}
+                </div>
               </div>
             </div>
           )}
         </div>
       </div>
-
-      {(resolvedFooterConfig.showBack ||
-        resolvedFooterConfig.showSecondaryAction ||
-        resolvedFooterConfig.showAction) && (
-        <div className="mt-8 pt-6">
-          <div className="flex items-center justify-between">
-            <div>
-              {resolvedFooterConfig.showBack && (
-                <Button
-                  type="button"
-                  variant="outline"
-                  size="xl"
-                  disabled={resolvedFooterConfig.backDisabled}
-                  onClick={resolvedFooterConfig.onBack}
-                >
-                  {resolvedFooterConfig.backLabel}
-                </Button>
-              )}
-            </div>
-            <div className="flex items-center gap-6">
-              {resolvedFooterConfig.showSecondaryAction && (
-                <Button
-                  size={
-                    resolvedFooterConfig.secondaryActionVariant === "link"
-                      ? "link-sm"
-                      : "xl"
-                  }
-                  className={
-                    resolvedFooterConfig.secondaryActionVariant === "link"
-                      ? "h-auto p-0"
-                      : undefined
-                  }
-                  variant={resolvedFooterConfig.secondaryActionVariant}
-                  type={
-                    resolvedFooterConfig.secondaryActionType ===
-                    WIZARD_FOOTER_ACTION_TYPE.SUBMIT
-                      ? "submit"
-                      : "button"
-                  }
-                  form={resolvedFooterConfig.secondaryActionFormId}
-                  disabled={resolvedFooterConfig.secondaryActionDisabled}
-                  onClick={
-                    resolvedFooterConfig.secondaryActionType ===
-                    WIZARD_FOOTER_ACTION_TYPE.BUTTON
-                      ? resolvedFooterConfig.onSecondaryAction
-                      : undefined
-                  }
-                >
-                  {resolvedFooterConfig.secondaryActionLabel}
-                </Button>
-              )}
-
-              {resolvedFooterConfig.showAction && (
-                <Button
-                  size="xl"
-                  type={
-                    resolvedFooterConfig.actionType ===
-                    WIZARD_FOOTER_ACTION_TYPE.SUBMIT
-                      ? "submit"
-                      : "button"
-                  }
-                  form={resolvedFooterConfig.actionFormId}
-                  disabled={resolvedFooterConfig.actionDisabled}
-                  onClick={
-                    resolvedFooterConfig.actionType ===
-                    WIZARD_FOOTER_ACTION_TYPE.BUTTON
-                      ? resolvedFooterConfig.onAction
-                      : undefined
-                  }
-                >
-                  {resolvedFooterConfig.actionLabel}
-                </Button>
-              )}
-            </div>
-          </div>
-        </div>
-      )}
     </Modal>
   );
 }
diff --git a/ui/components/providers/workflow/forms/connect-account-form.tsx b/ui/components/providers/workflow/forms/connect-account-form.tsx
index c4a242a5c3..ddc5038160 100644
--- a/ui/components/providers/workflow/forms/connect-account-form.tsx
+++ b/ui/components/providers/workflow/forms/connect-account-form.tsx
@@ -147,7 +147,6 @@ function applyBackStep({
   setPrevStep: Dispatch<SetStateAction<number>>;
   setAwsMethod: Dispatch<SetStateAction<"single" | null>>;
 }) {
-  // If in UID form after choosing single, go back to method selector
   if (prevStep === 2 && awsMethod === "single") {
     setAwsMethod(null);
     form.setValue("providerUid", "", { shouldValidate: false });
@@ -156,17 +155,14 @@ function applyBackStep({
   }
 
   setPrevStep((prev) => prev - 1);
-  // Deselect the providerType if the user is going back to the first step
   if (prevStep === 2) {
     form.setValue("providerType", undefined as unknown as ProviderType, {
       shouldValidate: false,
     });
     setAwsMethod(null);
   }
-  // Reset the providerUid and providerAlias fields when going back
   form.setValue("providerUid", "", { shouldValidate: false });
   form.setValue("providerAlias", "", { shouldValidate: false });
-  // Clear all validation errors so the radio buttons don't show red borders
   form.clearErrors();
 }
 
@@ -215,7 +211,6 @@ export const ConnectAccountForm = ({
       const data = await addProvider(formData);
 
       if (data?.errors && data.errors.length > 0) {
-        // Handle server-side validation errors
         data.errors.forEach((error: ApiError) => {
           const errorMessage = error.detail;
           const pointer = error.source?.pointer;
@@ -250,7 +245,6 @@ export const ConnectAccountForm = ({
         });
         return;
       } else {
-        // Go to the next step after successful submission
         const {
           id,
           attributes: { provider: createdProviderType, uid, alias },
@@ -347,11 +341,13 @@ export const ConnectAccountForm = ({
       >
         {/* Step 1: Provider selection */}
         {prevStep === 1 && (
-          <RadioGroupProvider
-            control={form.control}
-            isInvalid={!!form.formState.errors.providerType}
-            errorMessage={form.formState.errors.providerType?.message}
-          />
+          <div data-tour-id="add-provider-provider-type">
+            <RadioGroupProvider
+              control={form.control}
+              isInvalid={!!form.formState.errors.providerType}
+              errorMessage={form.formState.errors.providerType?.message}
+            />
+          </div>
         )}
         {/* Step 2: AWS method selector (only for AWS, before choosing method) */}
         {prevStep === 2 && providerType === "aws" && awsMethod === null && (
diff --git a/ui/components/scans/scans-page-shell.test.tsx b/ui/components/scans/scans-page-shell.test.tsx
index 8c3bbddd7d..d8a40407e7 100644
--- a/ui/components/scans/scans-page-shell.test.tsx
+++ b/ui/components/scans/scans-page-shell.test.tsx
@@ -302,9 +302,10 @@ describe("ScansPageShell", () => {
     expect(screen.getByRole("dialog")).toHaveTextContent(/launch scan/i);
   });
 
-  it("strips the launchScan URL param when closing the URL-opened modal", async () => {
+  it("strips the launchScan URL param via the History API when closing the URL-opened modal", async () => {
     vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
     searchParamsValue.current = "tab=completed&launchScan=true";
+    const replaceStateSpy = vi.spyOn(window.history, "replaceState");
     const user = userEvent.setup();
 
     render(
@@ -316,11 +317,17 @@ describe("ScansPageShell", () => {
     await user.click(screen.getByRole("button", { name: /close/i }));
 
     expect(screen.queryByRole("dialog")).not.toBeInTheDocument();
-    expect(replaceMock).toHaveBeenCalledWith(
+    // History API (not router.replace) so Next.js does not refetch and reload the page;
+    // scanOnDemand's revalidatePath already refreshes the list when a scan launches.
+    expect(replaceStateSpy).toHaveBeenCalledWith(
+      null,
+      "",
       "/scans?tab=completed",
-      expect.objectContaining({ scroll: false }),
     );
+    expect(replaceMock).not.toHaveBeenCalled();
     expect(pushMock).not.toHaveBeenCalled();
+
+    replaceStateSpy.mockRestore();
   });
 
   it("opens and closes the launch scan modal from client state without navigation", async () => {
diff --git a/ui/components/scans/scans-page-shell.tsx b/ui/components/scans/scans-page-shell.tsx
index 7e068f3f58..9994f8d7bc 100644
--- a/ui/components/scans/scans-page-shell.tsx
+++ b/ui/components/scans/scans-page-shell.tsx
@@ -1,8 +1,9 @@
 "use client";
 
-import { usePathname, useRouter, useSearchParams } from "next/navigation";
-import { type ReactNode, useState } from "react";
+import { usePathname, useSearchParams } from "next/navigation";
+import { type ReactNode, Suspense, useState } from "react";
 
+import { OnboardingTrigger, PageReady } from "@/components/onboarding";
 import { MutedFindingsConfigButton } from "@/components/providers/muted-findings-config-button";
 import {
   Button,
@@ -11,14 +12,18 @@ import {
   TabsList,
   TabsTrigger,
 } from "@/components/shadcn";
+import { getFlowById } from "@/lib/onboarding";
 import {
   LAUNCH_SCAN_SEARCH_PARAM,
   LAUNCH_SCAN_SEARCH_VALUE,
 } from "@/lib/scans-navigation";
+import { buildViewFirstScanTour } from "@/lib/tours/view-first-scan.tour";
 import { useScansStore } from "@/store";
 import { SCAN_JOBS_TAB, SCAN_TAB_LABELS, type ScanJobsTab } from "@/types";
 import type { ProviderProps } from "@/types/providers";
 
+const viewFirstScanFlow = getFlowById("view-first-scan")!;
+
 import { CliImportBanner } from "./cli-import-banner";
 import { LaunchScanModal } from "./launch-scan-modal";
 import { ScansFilterBar } from "./scans-filter-bar";
@@ -37,7 +42,6 @@ export function ScansPageShell({
   activeScanCount = 0,
   children,
 }: ScansPageShellProps) {
-  const router = useRouter();
   const pathname = usePathname();
   const searchParams = useSearchParams();
   const [urlLaunchOpen, setUrlLaunchOpen] = useState(
@@ -57,6 +61,9 @@ export function ScansPageShell({
   const isCloudEnvironment = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
   const launchDisabled = !hasManageScansPermission || !hasConnectedProviders;
   const launchOpen = isLaunchScanModalOpen || urlLaunchOpen;
+  // When a scan is already running, the tour highlights its row (anchored in
+  // ScanJobsTable); otherwise it falls back to the Launch Scan button + tabs.
+  const hasInProgressScan = activeScanCount > 0;
 
   const getTabLabel = (tab: ScanJobsTab) => {
     const label = SCAN_TAB_LABELS[tab];
@@ -69,17 +76,33 @@ export function ScansPageShell({
     setLaunchScanModalOpen(open);
     if (open) return;
     setUrlLaunchOpen(false);
+    // Remove ?launchScan via History API (not router.replace) to avoid an RSC
+    // refetch that reloads the page; revalidatePath in scanOnDemand already
+    // refreshes the scans list when a scan is launched.
     if (!searchParams.has(LAUNCH_SCAN_SEARCH_PARAM)) return;
     const params = new URLSearchParams(searchParams.toString());
     params.delete(LAUNCH_SCAN_SEARCH_PARAM);
     const query = params.toString();
-    router.replace(query ? `${pathname}?${query}` : pathname, {
-      scroll: false,
-    });
+    window.history.replaceState(
+      null,
+      "",
+      query ? `${pathname}?${query}` : pathname,
+    );
   };
 
   return (
     <div className="flex flex-col gap-[18px]">
+      {/* Suspense required: OnboardingTrigger reads useSearchParams */}
+      <Suspense fallback={null}>
+        <OnboardingTrigger
+          flow={{
+            ...viewFirstScanFlow,
+            tour: buildViewFirstScanTour(hasInProgressScan),
+          }}
+        />
+      </Suspense>
+      {/* Signals the navbar that this route's data has loaded (enables the replay icon). */}
+      <PageReady />
       <div
         role="group"
         aria-label="Scan filters and actions"
@@ -101,6 +124,7 @@ export function ScansPageShell({
           onClick={() => handleLaunchOpenChange(true)}
           disabled={launchDisabled}
           className="w-full md:w-auto"
+          data-tour-id="view-first-scan-launch"
         >
           Launch Scan
         </Button>
@@ -118,7 +142,10 @@ export function ScansPageShell({
           aria-label="Scan tabs"
           className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between"
         >
-          <TabsList className="overflow-x-auto">
+          <TabsList
+            className="overflow-x-auto"
+            data-tour-id="view-first-scan-tabs"
+          >
             {Object.values(SCAN_JOBS_TAB).map((tab) => (
               <TabsTrigger key={tab} value={tab}>
                 {getTabLabel(tab as ScanJobsTab)}
diff --git a/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx b/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx
new file mode 100644
index 0000000000..8251bdddc4
--- /dev/null
+++ b/ui/components/scans/table/__tests__/scan-jobs-table.test.tsx
@@ -0,0 +1,77 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { SCAN_JOBS_TAB, type ScanProps } from "@/types";
+
+import { ScanJobsTable } from "../scan-jobs-table";
+
+// Mock DataTable to a minimal table that applies getRowAttributes per row, so we can
+// assert the view-first-scan "in-progress" anchor lands on the right row/tab.
+vi.mock("@/components/ui/table", () => ({
+  DataTable: ({
+    data,
+    getRowAttributes,
+  }: {
+    data?: ScanProps[];
+    getRowAttributes?: (row: {
+      index: number;
+      original: ScanProps;
+    }) => Record<string, string | undefined>;
+  }) => (
+    <table>
+      <tbody>
+        {(data ?? []).map((original, index) => (
+          <tr
+            key={index}
+            data-testid={`row-${index}`}
+            {...getRowAttributes?.({ index, original })}
+          >
+            <td>scan</td>
+          </tr>
+        ))}
+      </tbody>
+    </table>
+  ),
+}));
+
+// AutoRefresh polls via router on a timer; irrelevant to anchor placement.
+vi.mock("../../auto-refresh", () => ({ AutoRefresh: () => null }));
+vi.mock("../scan-jobs-columns", () => ({ getScanJobsColumns: () => [] }));
+// Not rendered (data is non-empty), but mocked so its server/auth import chain
+// doesn't load under vitest.
+vi.mock("../../no-scans-empty-state", () => ({
+  NoScansEmptyState: () => null,
+}));
+
+const scan = (state: string): ScanProps =>
+  ({ attributes: { state } }) as unknown as ScanProps;
+
+describe("ScanJobsTable in-progress tour anchor", () => {
+  it("anchors the tour to the first row on the active (In Progress) tab", () => {
+    render(
+      <ScanJobsTable
+        data={[scan("executing"), scan("executing")]}
+        tab={SCAN_JOBS_TAB.ACTIVE}
+      />,
+    );
+
+    // Only the first active-tab row carries the anchor — driver.js resolves the
+    // running scan from it.
+    expect(screen.getByTestId("row-0")).toHaveAttribute(
+      "data-tour-id",
+      "view-first-scan-in-progress",
+    );
+    expect(screen.getByTestId("row-1")).not.toHaveAttribute("data-tour-id");
+  });
+
+  it("never anchors on a non-active tab (no running scan to point at)", () => {
+    render(
+      <ScanJobsTable
+        data={[scan("completed")]}
+        tab={SCAN_JOBS_TAB.COMPLETED}
+      />,
+    );
+
+    expect(screen.getByTestId("row-0")).not.toHaveAttribute("data-tour-id");
+  });
+});
diff --git a/ui/components/scans/table/scan-jobs-table.tsx b/ui/components/scans/table/scan-jobs-table.tsx
index d10b16cdb9..e94f6cb490 100644
--- a/ui/components/scans/table/scan-jobs-table.tsx
+++ b/ui/components/scans/table/scan-jobs-table.tsx
@@ -2,6 +2,7 @@
 
 import { DataTable } from "@/components/ui/table";
 import type { MetaDataProps, ScanJobsTab, ScanProps } from "@/types";
+import { SCAN_JOBS_TAB } from "@/types";
 
 import { AutoRefresh } from "../auto-refresh";
 import { NoScansEmptyState } from "../no-scans-empty-state";
@@ -41,6 +42,14 @@ export function ScanJobsTable({
           columns={columns}
           data={data}
           metadata={meta}
+          // Anchor the view-first-scan tour's "in-progress" step to the first row of
+          // the active (In Progress) tab; absent on other tabs so the tour only points
+          // at a running scan.
+          getRowAttributes={(row) =>
+            row.index === 0 && tab === SCAN_JOBS_TAB.ACTIVE
+              ? { "data-tour-id": "view-first-scan-in-progress" }
+              : {}
+          }
         />
       )}
     </>
diff --git a/ui/components/shadcn/button/button.test.tsx b/ui/components/shadcn/button/button.test.tsx
index 975a1a35f8..bbf019f45b 100644
--- a/ui/components/shadcn/button/button.test.tsx
+++ b/ui/components/shadcn/button/button.test.tsx
@@ -32,4 +32,29 @@ describe("Button", () => {
       "text-xs",
     );
   });
+
+  it("supports extra-small icon buttons", () => {
+    render(
+      <Button size="icon-xs" aria-label="Open tour">
+        Open tour
+      </Button>,
+    );
+
+    expect(screen.getByRole("button", { name: "Open tour" })).toHaveClass(
+      "size-7",
+    );
+  });
+
+  it("renders the bare variant chrome-free (no background or border)", () => {
+    render(
+      <Button variant="bare" size="icon-sm" aria-label="Toggle sidebar">
+        <svg />
+      </Button>,
+    );
+
+    const button = screen.getByRole("button", { name: "Toggle sidebar" });
+    expect(button).toHaveClass("bg-transparent");
+    expect(button).toHaveClass("border-0");
+    expect(button).toHaveClass("p-0");
+  });
 });
diff --git a/ui/components/shadcn/button/button.tsx b/ui/components/shadcn/button/button.tsx
index b2a251d562..44c7788cb4 100644
--- a/ui/components/shadcn/button/button.tsx
+++ b/ui/components/shadcn/button/button.tsx
@@ -22,6 +22,9 @@ const buttonVariants = cva(
         ghost:
           "border border-transparent text-text-neutral-primary hover:bg-bg-neutral-tertiary active:bg-border-neutral-secondary focus-visible:ring-border-neutral-secondary/50",
         link: "text-button-tertiary underline-offset-4 hover:text-button-tertiary-hover disabled:bg-transparent",
+        // Chrome-free: no border/background, only the icon shows. Hover/active shift
+        // the icon color instead of painting a box. Pair with an `icon*` size.
+        bare: "border-0 bg-transparent p-0 text-text-neutral-secondary hover:text-text-neutral-primary active:text-text-neutral-primary focus-visible:ring-border-neutral-secondary/50 disabled:bg-transparent",
         // Menu variant like secondary but more padding and the back is almost transparent
         menu: "backdrop-blur-xl bg-white/60 dark:bg-white/5 border border-white/80 dark:border-white/10 text-text-neutral-primary dark:text-white shadow-lg hover:bg-white/70 dark:hover:bg-white/10 hover:border-white/90 dark:hover:border-white/30 active:bg-white/80 dark:active:bg-white/15 active:scale-[0.98] focus-visible:ring-button-primary/50 transition-all duration-200",
         "menu-active":
@@ -35,6 +38,7 @@ const buttonVariants = cva(
         lg: "h-10 px-6 has-[>svg]:px-4",
         xl: "h-12 px-8 text-base has-[>svg]:px-6",
         icon: "size-9",
+        "icon-xs": "size-7",
         "icon-sm": "size-8",
         "icon-lg": "size-10",
         "link-xs": "text-xs",
diff --git a/ui/components/shadcn/tabs/tabs.tsx b/ui/components/shadcn/tabs/tabs.tsx
index 22379000d6..d66d4bfa2c 100644
--- a/ui/components/shadcn/tabs/tabs.tsx
+++ b/ui/components/shadcn/tabs/tabs.tsx
@@ -10,9 +10,6 @@ import {
 } from "@/components/shadcn/tooltip";
 import { cn } from "@/lib/utils";
 
-/**
- * Trigger component style parts using semantic class names
- */
 const TRIGGER_STYLES = {
   base: "relative inline-flex min-w-0 items-center justify-center gap-2 py-3 text-sm font-medium transition-colors disabled:pointer-events-none disabled:opacity-50 [&:not(:first-child)]:pl-4 [&:not(:last-child)]:pr-4",
   border: "border-r border-[#E9E9F0] last:border-r-0 dark:border-[#171D30]",
@@ -26,15 +23,9 @@ const TRIGGER_STYLES = {
   icon: "[&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 } as const;
 
-/**
- * Content component styles
- */
 const CONTENT_STYLES =
   "mt-2 focus-visible:rounded-md focus-visible:outline-1 focus-visible:ring-[3px] focus-visible:border-ring focus-visible:outline-ring focus-visible:ring-ring/50" as const;
 
-/**
- * Build trigger className by combining style parts
- */
 function buildTriggerClassName(): string {
   return [
     TRIGGER_STYLES.base,
@@ -47,13 +38,8 @@ function buildTriggerClassName(): string {
   ].join(" ");
 }
 
-/**
- * Build list className
- */
 function buildListClassName(): string {
-  // `flex` + `min-w-0` lets the triggers shrink proportionally when the
-  // container is narrow, so each trigger truncates with ellipsis instead
-  // of forcing a horizontal scrollbar.
+  // min-w-0 lets triggers shrink to ellipsis instead of forcing a scrollbar
   return "flex w-full min-w-0 items-center border-[#E9E9F0] dark:border-[#171D30]";
 }
 
@@ -85,11 +71,7 @@ function TabsList({
 
 interface TabsTriggerProps
   extends ComponentProps<typeof TabsPrimitive.Trigger> {
-  /**
-   * When set, the trigger is wrapped in a shadcn Tooltip rendered below
-   * the bar. Useful for showing the full name when the label is truncated
-   * to ellipsis on narrow containers.
-   */
+  /** Tooltip shown below the trigger — useful when the label is truncated. */
   tooltip?: ReactNode;
 }
 
@@ -105,9 +87,7 @@ function TabsTrigger({
       className={cn(buildTriggerClassName(), className)}
       {...props}
     >
-      {/* Wrapper provides the block-level box needed for `truncate` to
-       * actually render an ellipsis. Padding and gap on the trigger stay
-       * constant; only this span shrinks below its content width. */}
+      {/* block + min-w-0 needed for truncate to render ellipsis */}
       <span className="block min-w-0 truncate">{children}</span>
     </TabsPrimitive.Trigger>
   );
diff --git a/ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx b/ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx
new file mode 100644
index 0000000000..6277782433
--- /dev/null
+++ b/ui/components/ui/breadcrumbs/breadcrumb-navigation.test.tsx
@@ -0,0 +1,43 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { BreadcrumbNavigation } from "./breadcrumb-navigation";
+
+vi.mock("next/navigation", () => ({
+  usePathname: () => "/findings",
+  useSearchParams: () => new URLSearchParams(),
+}));
+
+vi.mock("@iconify/react", () => ({
+  Icon: ({ icon }: { icon: string }) => <span aria-label={icon} />,
+}));
+
+vi.mock("@heroui/breadcrumbs", () => ({
+  Breadcrumbs: ({ children }: { children: React.ReactNode }) => (
+    <nav aria-label="Breadcrumb">{children}</nav>
+  ),
+  BreadcrumbItem: ({ children }: { children: React.ReactNode }) => (
+    <span>{children}</span>
+  ),
+}));
+
+describe("BreadcrumbNavigation", () => {
+  it("renders the title action next to the current breadcrumb title", () => {
+    // Given / When
+    render(
+      <BreadcrumbNavigation
+        mode="auto"
+        title="Findings"
+        titleAction={<button type="button">Start product tour</button>}
+      />,
+    );
+
+    // Then
+    expect(
+      screen.getByRole("heading", { name: "Findings" }),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByRole("button", { name: "Start product tour" }),
+    ).toBeInTheDocument();
+  });
+});
diff --git a/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx b/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx
index 974c1dffc4..6becf7d4db 100644
--- a/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx
+++ b/ui/components/ui/breadcrumbs/breadcrumb-navigation.tsx
@@ -22,6 +22,7 @@ interface BreadcrumbNavigationProps {
   mode?: "auto" | "custom" | "hybrid";
   title?: string;
   icon?: string | ReactNode;
+  titleAction?: ReactNode;
   customItems?: CustomBreadcrumbItem[];
   className?: string;
   paramToPreserve?: string;
@@ -32,6 +33,7 @@ export function BreadcrumbNavigation({
   mode = "auto",
   title,
   icon,
+  titleAction,
   customItems = [],
   className = "",
   paramToPreserve = "scanId",
@@ -74,7 +76,6 @@ export function BreadcrumbNavigation({
       const isLast = index === pathSegments.length - 1;
       let displayName = segment.charAt(0).toUpperCase() + segment.slice(1);
 
-      // Special cases:
       if (segment.includes("-")) {
         displayName = segment
           .split("-")
@@ -126,10 +127,10 @@ export function BreadcrumbNavigation({
       >
         {titleText}
       </h1>
+      {titleAction}
     </div>
   );
 
-  // Determine which breadcrumbs to use
   let breadcrumbItems: CustomBreadcrumbItem[] = [];
 
   switch (mode) {
diff --git a/ui/components/ui/content-layout/content-layout.tsx b/ui/components/ui/content-layout/content-layout.tsx
index d059968332..37f04b6899 100644
--- a/ui/components/ui/content-layout/content-layout.tsx
+++ b/ui/components/ui/content-layout/content-layout.tsx
@@ -1,18 +1,24 @@
 import { ReactNode } from "react";
 
-import { Navbar } from "../nav-bar/navbar";
+import { Navbar, type OnboardingActionConfig } from "../nav-bar/navbar";
 
 interface ContentLayoutProps {
   title: string;
   icon?: string | ReactNode;
+  onboardingAction?: OnboardingActionConfig;
   children: React.ReactNode;
 }
 
-export function ContentLayout({ title, icon, children }: ContentLayoutProps) {
+export function ContentLayout({
+  title,
+  icon,
+  onboardingAction,
+  children,
+}: ContentLayoutProps) {
   return (
     <>
-      <Navbar title={title} icon={icon} />
-      <div className="px-6 py-4 sm:px-8">{children}</div>
+      <Navbar title={title} icon={icon} onboardingAction={onboardingAction} />
+      <div className="py-4 pr-6">{children}</div>
     </>
   );
 }
diff --git a/ui/components/ui/nav-bar/navbar-client.test.tsx b/ui/components/ui/nav-bar/navbar-client.test.tsx
new file mode 100644
index 0000000000..43356c3cde
--- /dev/null
+++ b/ui/components/ui/nav-bar/navbar-client.test.tsx
@@ -0,0 +1,255 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { ReactNode } from "react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { getFlowById } from "@/lib/onboarding";
+import { localStorageAdapter } from "@/lib/tours/store/local-storage-adapter";
+import { usePageReadyStore } from "@/store/page-ready";
+
+import { NavbarClient } from "./navbar-client";
+
+const navigationMocks = vi.hoisted(() => ({
+  pathname: "/findings",
+  push: vi.fn(),
+  searchParams: new URLSearchParams(),
+}));
+
+const requestReplayMock = vi.hoisted(() => vi.fn());
+
+vi.mock("next/navigation", () => ({
+  usePathname: () => navigationMocks.pathname,
+  useRouter: () => ({ push: navigationMocks.push }),
+  useSearchParams: () => navigationMocks.searchParams,
+}));
+
+vi.mock("@/store/onboarding-replay", () => {
+  const state = { requestReplay: requestReplayMock };
+  const hook = (selector: (s: typeof state) => unknown) => selector(state);
+  hook.getState = () => state;
+  return { useOnboardingReplayStore: hook };
+});
+
+vi.mock("@/hooks/use-sidebar", () => ({
+  useSidebar: () => ({ isOpen: true, toggleOpen: vi.fn() }),
+}));
+
+vi.mock("@/components/ThemeSwitch", () => ({
+  ThemeSwitch: () => <button type="button">Theme switch</button>,
+}));
+
+vi.mock("@/components/ui", () => ({
+  BreadcrumbNavigation: ({
+    title,
+    titleAction,
+  }: {
+    title: string;
+    titleAction?: ReactNode;
+  }) => (
+    <nav aria-label="Breadcrumb">
+      <h1>{title}</h1>
+      {titleAction}
+    </nav>
+  ),
+}));
+
+vi.mock("../sidebar/sheet-menu", () => ({
+  SheetMenu: () => <button type="button">Open menu</button>,
+}));
+
+vi.mock("../sidebar/sidebar-toggle", () => ({
+  SidebarToggle: () => <button type="button">Toggle sidebar</button>,
+}));
+
+vi.mock("../user-nav/user-nav", () => ({
+  UserNav: () => <button type="button">User menu</button>,
+}));
+
+describe("NavbarClient", () => {
+  beforeEach(() => {
+    navigationMocks.pathname = "/findings";
+    navigationMocks.push.mockClear();
+    requestReplayMock.mockClear();
+    navigationMocks.searchParams = new URLSearchParams();
+    window.localStorage.clear();
+    // Replay icon is Cloud-only.
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    // Default: the current route's content has loaded, so the icon is enabled.
+    usePageReadyStore.setState({ readyPath: "/findings" });
+  });
+
+  it("renders an accessible contextual onboarding button in the breadcrumb", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+
+    // When
+    await user.hover(
+      screen.getByRole("button", {
+        name: /start product tour: explore your findings/i,
+      }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("heading", { name: "Findings" }),
+    ).toBeInTheDocument();
+    expect(screen.getAllByText("See how it works")).not.toHaveLength(0);
+    expect(
+      screen.getByRole("button", {
+        name: /start product tour: explore your findings/i,
+      }),
+    ).toHaveClass("size-7");
+  });
+
+  it("pulses the onboarding icon while the tour has not been seen", () => {
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+
+    const icon = screen
+      .getByRole("button", {
+        name: /start product tour: explore your findings/i,
+      })
+      .querySelector("svg");
+    expect(icon).toHaveClass("animate-pulse");
+  });
+
+  it("keeps the onboarding button but stops pulsing once the tour is closed", () => {
+    const flow = getFlowById("explore-findings");
+    localStorageAdapter.set(flow!.tour, {
+      tourId: flow!.tour.id,
+      version: flow!.tour.version,
+      state: "dismissed",
+      completedAt: "2026-01-01T00:00:00.000Z",
+    });
+
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+
+    const button = screen.getByRole("button", {
+      name: /start product tour: explore your findings/i,
+    });
+    expect(button).toBeInTheDocument();
+    expect(button.querySelector("svg")).not.toHaveClass("animate-pulse");
+  });
+
+  it("starts the replay in-memory (no navigation) when already on the flow's route", async () => {
+    // Given the user is already on the flow's page
+    navigationMocks.pathname = "/compliance";
+    navigationMocks.searchParams = new URLSearchParams("scanId=scan-1&foo=bar");
+    usePageReadyStore.setState({ readyPath: "/compliance" });
+    const user = userEvent.setup();
+    render(
+      <NavbarClient
+        title="Compliance"
+        onboardingAction={{ flowId: "view-compliance" }}
+      />,
+    );
+
+    // When
+    await user.click(
+      screen.getByRole("button", {
+        name: /start product tour: check compliance/i,
+      }),
+    );
+
+    // Then the replay is requested via the in-memory store — no router.push, so no
+    // `?onboarding=` URL param and no Next.js RSC refetch of the page.
+    expect(requestReplayMock).toHaveBeenCalledWith("view-compliance");
+    expect(navigationMocks.push).not.toHaveBeenCalled();
+  });
+
+  it("navigates to the fallback flow without leaking current-route params", async () => {
+    // Given
+    navigationMocks.pathname = "/findings";
+    navigationMocks.searchParams = new URLSearchParams(
+      "filter%5Bseverity__in%5D=critical",
+    );
+    const user = userEvent.setup();
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{
+          flowId: "explore-findings",
+          fallbackFlowId: "view-first-scan",
+          useFallback: true,
+        }}
+      />,
+    );
+
+    // When
+    await user.click(
+      screen.getByRole("button", {
+        name: /start product tour: run your first scan/i,
+      }),
+    );
+
+    // Then: the flow's own route (incl. its `?tab=active`) is preserved and the
+    // onboarding param is appended with `&` — the current /findings filter is dropped.
+    expect(navigationMocks.push).toHaveBeenCalledWith(
+      "/scans?tab=active&onboarding=view-first-scan",
+    );
+  });
+
+  it("hides the replay icon until the route's content has loaded", () => {
+    // Given the page has not signalled ready for the current route
+    usePageReadyStore.setState({ readyPath: null });
+
+    // When
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+
+    // Then the icon is not rendered at all
+    expect(
+      screen.queryByRole("button", {
+        name: /start product tour: explore your findings/i,
+      }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("hides the replay icon entirely in self-hosted (OSS) deployments", () => {
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "explore-findings" }}
+      />,
+    );
+    expect(
+      screen.queryByRole("button", { name: /start product tour/i }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("does not render a contextual onboarding button for unknown flows", () => {
+    // Given / When
+    render(
+      <NavbarClient
+        title="Findings"
+        onboardingAction={{ flowId: "unknown-flow" }}
+      />,
+    );
+
+    // Then
+    expect(
+      screen.queryByRole("button", { name: /start product tour/i }),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/ui/components/ui/nav-bar/navbar-client.tsx b/ui/components/ui/nav-bar/navbar-client.tsx
index fa48c9c103..bdeb879034 100644
--- a/ui/components/ui/nav-bar/navbar-client.tsx
+++ b/ui/components/ui/nav-bar/navbar-client.tsx
@@ -1,40 +1,130 @@
 "use client";
 
-import { BellRing } from "lucide-react";
-import { ReactNode } from "react";
+import { BellRing, Info } from "lucide-react";
+import { usePathname, useRouter } from "next/navigation";
+import { ReactNode, Suspense } from "react";
 
-import { Button } from "@/components/shadcn";
+import {
+  Button,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/shadcn";
 import { ThemeSwitch } from "@/components/ThemeSwitch";
 import { BreadcrumbNavigation } from "@/components/ui";
 import { useSidebar } from "@/hooks/use-sidebar";
+import { getFlowById } from "@/lib/onboarding";
+import { isCloud } from "@/lib/shared/env";
+import { useTourCompletion } from "@/lib/tours/use-tour-completion";
+import { cn } from "@/lib/utils";
+import { useOnboardingReplayStore } from "@/store/onboarding-replay";
+import { usePageReadyStore } from "@/store/page-ready";
 
 import { SheetMenu } from "../sidebar/sheet-menu";
 import { SidebarToggle } from "../sidebar/sidebar-toggle";
 import { UserNav } from "../user-nav/user-nav";
 
+export interface OnboardingActionConfig {
+  flowId: string;
+  fallbackFlowId?: string;
+  useFallback?: boolean;
+}
+
 interface NavbarClientProps {
   title: string;
   icon?: string | ReactNode;
+  onboardingAction?: OnboardingActionConfig;
   feedsSlot?: ReactNode;
 }
 
-export function NavbarClient({ title, icon, feedsSlot }: NavbarClientProps) {
+export function NavbarClient({
+  title,
+  icon,
+  onboardingAction,
+  feedsSlot,
+}: NavbarClientProps) {
   const { isOpen, toggleOpen } = useSidebar();
+  const pathname = usePathname();
+  const router = useRouter();
+  const requestReplay = useOnboardingReplayStore(
+    (state) => state.requestReplay,
+  );
+  const targetFlowId =
+    onboardingAction?.useFallback && onboardingAction.fallbackFlowId
+      ? onboardingAction.fallbackFlowId
+      : onboardingAction?.flowId;
+  // Cloud-only: no flow → no replay icon in OSS.
+  const flow =
+    isCloud() && targetFlowId ? getFlowById(targetFlowId) : undefined;
+  // Pulse only until the tour is seen; any close (completed/skipped/dismissed)
+  // calms it. The replay button itself stays.
+  const seen = useTourCompletion(flow?.tour ?? null) !== null;
+
+  // Keep the replay icon disabled until this route's content has finished loading,
+  // so a tour never starts before its anchors are in the DOM.
+  const readyPath = usePageReadyStore((state) => state.readyPath);
+  const pageReady = readyPath === pathname;
+
+  const replayFlow = () => {
+    if (!flow) return;
+
+    // Already on the flow's page: start the replay via an in-memory signal so the
+    // URL never changes and Next.js never refetches the (often heavy) page.
+    if (flow.route === pathname) {
+      requestReplay(flow.id);
+      return;
+    }
+    // Different page: a real navigation is needed; the `onboarding=` param survives
+    // it and starts the tour on the destination route. Routes may already carry a
+    // query string (e.g. `/scans?tab=active`), so pick the right separator.
+    const separator = flow.route.includes("?") ? "&" : "?";
+    router.push(`${flow.route}${separator}onboarding=${flow.id}`);
+  };
 
   return (
     <header className="sticky top-0 z-10 w-full pt-4 backdrop-blur-sm">
-      <div className="mx-4 flex h-14 items-center sm:mx-8">
+      <div className="flex h-14 items-center pr-6">
         <div className="flex items-center gap-2">
           <SheetMenu />
           <div className="hidden lg:block">
             <SidebarToggle isOpen={isOpen} setIsOpen={toggleOpen} />
           </div>
-          <BreadcrumbNavigation
-            mode="auto"
-            title={title}
-            icon={icon}
-            paramToPreserve="scanId"
-          />
+          {/* Suspense contains the useSearchParams() CSR bailout in BreadcrumbNavigation
+              so statically prerendered pages don't fail the build. */}
+          <Suspense fallback={null}>
+            <BreadcrumbNavigation
+              mode="auto"
+              title={title}
+              icon={icon}
+              titleAction={
+                // Hidden until the route's content has loaded, so the tour never starts
+                // before its anchors exist (and we avoid a disabled-then-enabled flash).
+                flow && pageReady ? (
+                  <Tooltip>
+                    <TooltipTrigger asChild>
+                      <Button
+                        type="button"
+                        variant="ghost"
+                        size="icon-xs"
+                        aria-label={`Start product tour: ${flow.title}`}
+                        onClick={replayFlow}
+                      >
+                        <Info
+                          className={cn(
+                            "text-bg-data-info size-4",
+                            !seen && "animate-pulse",
+                          )}
+                          aria-hidden="true"
+                        />
+                      </Button>
+                    </TooltipTrigger>
+                    <TooltipContent>See how it works</TooltipContent>
+                  </Tooltip>
+                ) : null
+              }
+              paramToPreserve="scanId"
+            />
+          </Suspense>
         </div>
         <div className="flex flex-1 items-center justify-end gap-3">
           <ThemeSwitch />
diff --git a/ui/components/ui/nav-bar/navbar.tsx b/ui/components/ui/nav-bar/navbar.tsx
index f0024fdc76..5d397cb3e2 100644
--- a/ui/components/ui/nav-bar/navbar.tsx
+++ b/ui/components/ui/nav-bar/navbar.tsx
@@ -2,18 +2,26 @@ import { ReactNode, Suspense } from "react";
 
 import { FeedsServer } from "@/components/feeds";
 
-import { FeedsLoadingFallback, NavbarClient } from "./navbar-client";
+import {
+  FeedsLoadingFallback,
+  NavbarClient,
+  type OnboardingActionConfig,
+} from "./navbar-client";
+
+export type { OnboardingActionConfig };
 
 interface NavbarProps {
   title: string;
   icon?: string | ReactNode;
+  onboardingAction?: OnboardingActionConfig;
 }
 
-export function Navbar({ title, icon }: NavbarProps) {
+export function Navbar({ title, icon, onboardingAction }: NavbarProps) {
   return (
     <NavbarClient
       title={title}
       icon={icon}
+      onboardingAction={onboardingAction}
       feedsSlot={
         <Suspense key="feeds" fallback={<FeedsLoadingFallback />}>
           <FeedsServer limit={15} />
diff --git a/ui/components/ui/sidebar/sidebar-toggle.tsx b/ui/components/ui/sidebar/sidebar-toggle.tsx
index c479aab84a..27e1fdab27 100644
--- a/ui/components/ui/sidebar/sidebar-toggle.tsx
+++ b/ui/components/ui/sidebar/sidebar-toggle.tsx
@@ -1,39 +1,37 @@
-import {
-  SidebarCollapseIcon,
-  SidebarExpandIcon,
-} from "@/components/icons/Icons";
+import { ChevronLeft, ChevronRight } from "lucide-react";
+
+import { Button } from "@/components/shadcn/button/button";
 import {
   Tooltip,
   TooltipContent,
   TooltipTrigger,
 } from "@/components/shadcn/tooltip";
 
-import { Button } from "../button/button";
-
 interface SidebarToggleProps {
   isOpen: boolean | undefined;
   setIsOpen?: () => void;
 }
 
 export function SidebarToggle({ isOpen, setIsOpen }: SidebarToggleProps) {
+  // Closed → chevron right (will open); open/undefined → chevron left (will collapse).
+  const isClosed = isOpen === false;
+  const Chevron = isClosed ? ChevronRight : ChevronLeft;
+
   return (
     <Tooltip>
       <TooltipTrigger asChild>
         <Button
+          type="button"
+          variant="bare"
+          size="icon-sm"
           onClick={() => setIsOpen?.()}
-          className="h-8 w-8 rounded-md"
-          variant="outline"
-          size="icon"
+          aria-label={isClosed ? "Expand sidebar" : "Collapse sidebar"}
         >
-          {isOpen === false ? (
-            <SidebarCollapseIcon className="h-5 w-5" />
-          ) : (
-            <SidebarExpandIcon className="h-5 w-5" />
-          )}
+          <Chevron className="size-5" />
         </Button>
       </TooltipTrigger>
-      <TooltipContent>
-        {isOpen ? "Collapse Sidebar" : "Expand Sidebar"}
+      <TooltipContent side="bottom">
+        {isClosed ? "Expand Sidebar" : "Collapse Sidebar"}
       </TooltipContent>
     </Tooltip>
   );
diff --git a/ui/components/ui/table/data-table.tsx b/ui/components/ui/table/data-table.tsx
index e3d6e90b22..dba6a450e6 100644
--- a/ui/components/ui/table/data-table.tsx
+++ b/ui/components/ui/table/data-table.tsx
@@ -34,6 +34,10 @@ import { useFilterTransitionOptional } from "@/contexts";
 import { cn } from "@/lib";
 import { FilterOption, MetaDataProps } from "@/types";
 
+type DataTableRowAttributes = {
+  [key: `data-${string}`]: string | undefined;
+};
+
 /**
  * Default column size used by TanStack Table when no explicit size is set.
  * We skip applying inline width styles for columns with this default value
@@ -110,6 +114,8 @@ interface DataTableProviderProps<TData, TValue> {
   searchBadge?: { label: string; onDismiss: () => void };
   /** Optional click handler for top-level rows. */
   onRowClick?: (row: Row<TData>) => void;
+  /** Optional data attributes applied to each top-level row. */
+  getRowAttributes?: (row: Row<TData>) => DataTableRowAttributes;
   /** Optional header rendered inside the table container, above the toolbar. */
   header?: ReactNode;
   /** Optional content rendered in the toolbar before the total entries count. */
@@ -144,6 +150,7 @@ export function DataTable<TData, TValue>({
   renderAfterRow,
   searchBadge,
   onRowClick,
+  getRowAttributes,
   header,
   toolbarRightContent,
 }: DataTableProviderProps<TData, TValue>) {
@@ -314,6 +321,7 @@ export function DataTable<TData, TValue>({
                 ) : (
                   <Fragment key={row.id}>
                     <TableRow
+                      {...getRowAttributes?.(row)}
                       data-state={row.getIsSelected() && "selected"}
                       className={cn(onRowClick && "cursor-pointer")}
                       onClick={(event) =>
diff --git a/ui/dependency-log.json b/ui/dependency-log.json
index fd6317898e..c851552b08 100644
--- a/ui/dependency-log.json
+++ b/ui/dependency-log.json
@@ -407,6 +407,14 @@
     "strategy": "installed",
     "generatedAt": "2025-10-22T12:36:37.962Z"
   },
+  {
+    "section": "dependencies",
+    "name": "driver.js",
+    "from": "1.4.0",
+    "to": "1.4.0",
+    "strategy": "installed",
+    "generatedAt": "2026-05-26T13:05:09.776Z"
+  },
   {
     "section": "dependencies",
     "name": "framer-motion",
diff --git a/ui/lib/compliance/compliance-detail-url.test.ts b/ui/lib/compliance/compliance-detail-url.test.ts
new file mode 100644
index 0000000000..423f0138f9
--- /dev/null
+++ b/ui/lib/compliance/compliance-detail-url.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+
+import { buildComplianceDetailPath } from "./compliance-detail-url";
+
+describe("buildComplianceDetailPath", () => {
+  it("builds the detail path with the encoded title and required params", () => {
+    const path = buildComplianceDetailPath({
+      title: "CIS 2.0 (AWS)",
+      complianceId: "cis_2.0_aws",
+      version: "2.0",
+      scanId: "scan-123",
+    });
+
+    expect(path).toBe(
+      "/compliance/CIS%202.0%20(AWS)?complianceId=cis_2.0_aws&version=2.0&scanId=scan-123",
+    );
+  });
+
+  it("propagates the region filter only when present", () => {
+    const withRegion = buildComplianceDetailPath({
+      title: "ens",
+      complianceId: "ens_rd2022_aws",
+      version: "RD2022",
+      scanId: "scan-1",
+      regionFilter: "eu-west-1",
+    });
+    const withoutRegion = buildComplianceDetailPath({
+      title: "ens",
+      complianceId: "ens_rd2022_aws",
+      version: "RD2022",
+      scanId: "scan-1",
+      regionFilter: null,
+    });
+
+    expect(withRegion).toContain("filter%5Bregion__in%5D=eu-west-1");
+    expect(withoutRegion).not.toContain("region__in");
+  });
+});
diff --git a/ui/lib/compliance/compliance-detail-url.ts b/ui/lib/compliance/compliance-detail-url.ts
new file mode 100644
index 0000000000..945426cb11
--- /dev/null
+++ b/ui/lib/compliance/compliance-detail-url.ts
@@ -0,0 +1,26 @@
+interface ComplianceDetailPathParams {
+  /** Framework title as shown on the card (URL-encoded into the path). */
+  title: string;
+  complianceId: string;
+  version: string;
+  scanId: string;
+  regionFilter?: string | null;
+}
+
+/** Builds the `/compliance/[compliancetitle]` detail URL used by the overview cards. */
+export function buildComplianceDetailPath({
+  title,
+  complianceId,
+  version,
+  scanId,
+  regionFilter,
+}: ComplianceDetailPathParams): string {
+  const params = new URLSearchParams();
+  params.set("complianceId", complianceId);
+  params.set("version", version);
+  params.set("scanId", scanId);
+  if (regionFilter) {
+    params.set("filter[region__in]", regionFilter);
+  }
+  return `/compliance/${encodeURIComponent(title)}?${params.toString()}`;
+}
diff --git a/ui/lib/onboarding/README.md b/ui/lib/onboarding/README.md
new file mode 100644
index 0000000000..e1e5532cd0
--- /dev/null
+++ b/ui/lib/onboarding/README.md
@@ -0,0 +1,76 @@
+# Onboarding system (developer guide)
+
+The onboarding system runs short, anchored driver.js tours and orchestrates a
+cross-route **guided sequence** after a user connects their first provider.
+Everything lives in client state and localStorage — there is **zero backend
+coupling**.
+
+## Building blocks
+
+| Concern                                | File                                                                  |
+| -------------------------------------- | --------------------------------------------------------------------- |
+| Flow registry (single source of truth) | `ui/lib/onboarding/registry.ts`                                       |
+| Flow type (`OnboardingFlow`)           | `ui/lib/onboarding/onboarding-types.ts`                               |
+| Tour definitions (`*.tour.ts`)         | `ui/lib/tours/`                                                       |
+| Driver primitive (`useDriverTour`)     | `ui/lib/tours/use-driver-tour.ts`                                     |
+| Per-route trigger                      | `ui/components/onboarding/onboarding-trigger.tsx`                     |
+| Ephemeral sequence slice               | `ui/store/onboarding-sequence.ts`                                     |
+| Checkpoint watcher + dialog            | `ui/components/onboarding/onboarding-checkpoint-{watcher,dialog}.tsx` |
+| Mandatory new-user gate                | `ui/components/onboarding/onboarding-gate.tsx`                        |
+| Manual replay list                     | `ui/components/ui/user-nav/user-nav.tsx`                              |
+
+## How the guided sequence works
+
+1. The `(prowler)/layout.tsx` derives a tri-state `hasProviders` on every
+   navigation and mounts `<OnboardingCheckpointWatcher />` (sibling to the gate).
+2. When the watcher observes a concrete `false → true` `hasProviders` flip (the
+   user actually connected a provider), it opens the checkpoint dialog **once**.
+   An `undefined → true` (user already had providers) never fires. A localStorage
+   marker (`prowler.onboarding.checkpoint`) prevents re-appearance.
+3. "Continue the tour" calls `startSequence(nextFlowId)` on the ephemeral
+   `useOnboardingSequenceStore` and navigates to that flow's route.
+4. Each route mounts an `<OnboardingTrigger flow={...} />`. The trigger force
+   starts the flow when `slice.currentFlowId === flow.id` (sequence) **or** when
+   the `?onboarding=<id>` param matches (replay). The StrictMode-safe latch /
+   keyed runner / empty-deps force-start is preserved verbatim.
+5. On tour close, `useDriverTour`'s `onClosed(state)` reports the outcome:
+   `completed` → `advance()` (navigate to the next flow), `skipped`/`dismissed`
+   → `stop()` (the sequence ends; closing any tour ends the sequence).
+6. The slice is **ephemeral** (plain Zustand `create`, no `persist`). It carries
+   `currentFlowId` across client navigations but resets on a hard reload, so a
+   mid-sequence refresh never re-fires.
+
+`attack-paths` is special: its page already owns a driver, so its registry entry
+sets `ownsAutoOpen: true`, the trigger does **not** mount a runner for it, and
+the page wires `onClosed` to the slice itself (single-fire).
+
+## Add a new flow (the extensibility contract)
+
+A new flow is **one registry entry + one tour file + its anchors + a trigger
+mount** — no gate, modal, or nav edits.
+
+1. **Tour file** — `ui/lib/tours/<flow-id>.tour.ts` via `defineTour<Target>` and
+   the `assets/tour-template.ts`. Keep it shallow: a centered welcome step plus
+   1–2 anchored steps. `coversFiles` scopes the drift check.
+2. **Anchors** — add `data-tour-id="<flow-id>-<target>"` on the page-specific
+   **client** component for each anchored step (never the shared Navbar).
+   The tour file and its anchors MUST ship in the SAME PR (`tour:check`
+   hard-fails a tour target with no matching anchor).
+3. **Registry entry** — add `{ id, order, title, description, route, tour }` to
+   `onboardingFlows` in `registry.ts`. Ordering is data (`order`).
+4. **Trigger mount** — render `<OnboardingTrigger flow={getFlowById("<id>")!} />`
+   inside the route's client host. Pass `stepHandlers`/`configOverrides` only if
+   the flow needs them (e.g. add-provider opens the wizard).
+
+The avatar "Product tour" submenu and `advance()` both derive from
+`getOrderedFlows()`, so a new flow appears in the replay list and participates in
+the sequence automatically.
+
+## CI gates
+
+- `pnpm run tour:check` (`ui/scripts/check-tour-alignment.mjs`) — every tour
+  `target` must resolve to a real `data-tour-id` anchor within its `coversFiles`.
+- `pnpm exec vitest run --project unit` — pure logic (slice, helpers, registry,
+  tour shapes). The driver primitive short-circuits in `NODE_ENV==="test"`.
+- `pnpm run test:e2e tests/onboarding/` — full-system behavior (sequence,
+  checkpoint, replay, single-fire, refresh). Requires the Prowler stack.
diff --git a/ui/lib/onboarding/__tests__/gate-decision.test.ts b/ui/lib/onboarding/__tests__/gate-decision.test.ts
new file mode 100644
index 0000000000..833987be7e
--- /dev/null
+++ b/ui/lib/onboarding/__tests__/gate-decision.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+
+import type { TourCompletionRecord } from "@/lib/tours/tour-types";
+import { TOUR_COMPLETION_STATES } from "@/lib/tours/tour-types";
+
+import { shouldStartOnboarding } from "../gate-decision";
+
+const recordWithState = (
+  state: TourCompletionRecord["state"],
+): TourCompletionRecord => ({
+  tourId: "add-provider",
+  version: 1,
+  state,
+  completedAt: "2026-01-15T12:00:00.000Z",
+});
+
+describe("shouldStartOnboarding", () => {
+  it("returns true for a zero-provider user with no completion record", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: false,
+      completionRecord: null,
+    });
+    expect(result).toBe(true);
+  });
+
+  it("returns false when the user already has providers", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: true,
+      completionRecord: null,
+    });
+    expect(result).toBe(false);
+  });
+
+  it("returns false when a dismissed record exists", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: false,
+      completionRecord: recordWithState(TOUR_COMPLETION_STATES.DISMISSED),
+    });
+    expect(result).toBe(false);
+  });
+
+  it("returns false when a completed record exists", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: false,
+      completionRecord: recordWithState(TOUR_COMPLETION_STATES.COMPLETED),
+    });
+    expect(result).toBe(false);
+  });
+
+  it("returns false when a skipped record exists", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: false,
+      completionRecord: recordWithState(TOUR_COMPLETION_STATES.SKIPPED),
+    });
+    expect(result).toBe(false);
+  });
+
+  it("fails open when hasProviders is undefined", () => {
+    // strict === false check rejects non-false values; don't force onboarding on unknown state
+    const result = shouldStartOnboarding({
+      hasProviders: undefined,
+      completionRecord: null,
+    });
+    expect(result).toBe(false);
+  });
+
+  it("fails open when hasProviders is null", () => {
+    const result = shouldStartOnboarding({
+      hasProviders: null as unknown as boolean,
+      completionRecord: null,
+    });
+    expect(result).toBe(false);
+  });
+});
diff --git a/ui/lib/onboarding/__tests__/registry.test.ts b/ui/lib/onboarding/__tests__/registry.test.ts
new file mode 100644
index 0000000000..cb677a268d
--- /dev/null
+++ b/ui/lib/onboarding/__tests__/registry.test.ts
@@ -0,0 +1,185 @@
+import { describe, expect, it } from "vitest";
+
+import type { TourDefinition } from "@/lib/tours/tour-types";
+
+import * as onboardingPublicApi from "../index";
+import type { OnboardingContext, OnboardingFlow } from "../onboarding-types";
+import { getFlowById, getOrderedFlows, onboardingFlows } from "../registry";
+
+// Registry only reads { id, version } from tours, so a flat stub is sufficient.
+const buildTour = (id: string, version = 1): TourDefinition => ({
+  id,
+  version,
+  coversFiles: [],
+  steps: [],
+});
+
+const buildFlow = (
+  overrides: Partial<OnboardingFlow> = {},
+): OnboardingFlow => ({
+  id: overrides.id ?? "flow",
+  order: overrides.order ?? 1,
+  title: overrides.title ?? "Title",
+  description: overrides.description ?? "Description",
+  route: overrides.route ?? "/route",
+  tour: overrides.tour ?? buildTour(overrides.id ?? "flow"),
+  isComplete: overrides.isComplete,
+  ownsAutoOpen: overrides.ownsAutoOpen,
+});
+
+describe("OnboardingFlow / OnboardingContext types", () => {
+  it("compiles a fully-populated OnboardingFlow against the declared contract", () => {
+    const ctx: OnboardingContext = { hasProviders: false };
+    const flow: OnboardingFlow = {
+      id: "add-provider",
+      order: 1,
+      title: "Add your first provider",
+      description: "Connect a cloud account to start scanning.",
+      route: "/providers",
+      tour: buildTour("add-provider"),
+      isComplete: (c: OnboardingContext) => c.hasProviders,
+    };
+
+    expect(flow.id).toBe("add-provider");
+    expect(flow.order).toBe(1);
+    expect(flow.route).toBe("/providers");
+    expect(flow.isComplete?.(ctx)).toBe(false);
+    expect(flow.isComplete?.({ hasProviders: true })).toBe(true);
+  });
+});
+
+describe("onboardingFlows (production registry)", () => {
+  it("registers the add-provider flow as the first onboarding flow", () => {
+    const addProvider = getFlowById("add-provider", onboardingFlows);
+    expect(addProvider).toBeDefined();
+    expect(addProvider?.order).toBe(1);
+    expect(addProvider?.route).toBe("/providers");
+    expect(addProvider?.tour.id).toBe("add-provider");
+  });
+
+  it("treats add-provider as complete when the context reports providers", () => {
+    const addProvider = getFlowById("add-provider", onboardingFlows);
+    expect(addProvider?.isComplete?.({ hasProviders: true })).toBe(true);
+    expect(addProvider?.isComplete?.({ hasProviders: false })).toBe(false);
+  });
+
+  it("registers the view-first-scan flow at order 2 on the active scans tab", () => {
+    const flow = getFlowById("view-first-scan", onboardingFlows);
+    expect(flow).toBeDefined();
+    expect(flow?.order).toBe(2);
+    expect(flow?.route).toBe("/scans?tab=active");
+    expect(flow?.tour.id).toBe("view-first-scan");
+  });
+
+  it("registers the explore-findings flow at order 3 on the findings route", () => {
+    const flow = getFlowById("explore-findings", onboardingFlows);
+    expect(flow).toBeDefined();
+    expect(flow?.order).toBe(3);
+    expect(flow?.route).toBe("/findings");
+    expect(flow?.tour.id).toBe("explore-findings");
+  });
+
+  it("registers the view-compliance flow at order 4 on the compliance route", () => {
+    const flow = getFlowById("view-compliance", onboardingFlows);
+    expect(flow).toBeDefined();
+    expect(flow?.order).toBe(4);
+    expect(flow?.route).toBe("/compliance");
+    expect(flow?.tour.id).toBe("view-compliance");
+  });
+
+  it("registers the attack-paths flow at order 5 on the attack-paths route", () => {
+    const flow = getFlowById("attack-paths", onboardingFlows);
+    expect(flow).toBeDefined();
+    expect(flow?.order).toBe(5);
+    expect(flow?.route).toBe("/attack-paths");
+    expect(flow?.tour.id).toBe("attack-paths");
+  });
+
+  it("flags attack-paths with ownsAutoOpen so the shared trigger never drives it", () => {
+    // attack-paths page owns its own driver; all other flows must be falsy
+    const attackPaths = getFlowById("attack-paths", onboardingFlows);
+    expect(attackPaths?.ownsAutoOpen).toBe(true);
+    for (const flow of onboardingFlows) {
+      if (flow.id === "attack-paths") continue;
+      expect(flow.ownsAutoOpen).toBeFalsy();
+    }
+  });
+
+  it("sets a data requirement hint on the scan-dependent flows only", () => {
+    const scanDependent = [
+      "explore-findings",
+      "view-compliance",
+      "attack-paths",
+    ];
+    const standalone = ["add-provider", "view-first-scan"];
+    const expectedHint = "Wait for the scan to finish and have findings.";
+
+    for (const id of scanDependent) {
+      const flow = getFlowById(id, onboardingFlows);
+      expect(flow?.dataRequirementHint).toBe(expectedHint);
+    }
+    for (const id of standalone) {
+      const flow = getFlowById(id, onboardingFlows);
+      expect(flow?.dataRequirementHint).toBeUndefined();
+    }
+  });
+
+  it("orders the five sequence flows 1..5 by registry order", () => {
+    const ordered = getOrderedFlows(onboardingFlows);
+    expect(ordered.map((flow) => flow.id)).toEqual([
+      "add-provider",
+      "view-first-scan",
+      "explore-findings",
+      "view-compliance",
+      "attack-paths",
+    ]);
+  });
+});
+
+describe("public api barrel", () => {
+  it("re-exports the registry and gate-decision surface", () => {
+    expect(onboardingPublicApi.getOrderedFlows).toBe(getOrderedFlows);
+    expect(onboardingPublicApi.getFlowById).toBe(getFlowById);
+    expect(onboardingPublicApi.onboardingFlows).toBe(onboardingFlows);
+    expect(typeof onboardingPublicApi.shouldStartOnboarding).toBe("function");
+  });
+});
+
+describe("getOrderedFlows", () => {
+  it("returns an empty array when the registry has no flows", () => {
+    expect(getOrderedFlows([])).toEqual([]);
+  });
+
+  it("sorts ascending by order, stably preserving array position on ties", () => {
+    const second = buildFlow({ id: "second", order: 2 });
+    const first = buildFlow({ id: "first", order: 1 });
+    const secondTie = buildFlow({ id: "second-tie", order: 2 });
+    const flows = [second, first, secondTie];
+
+    // order 1 first, then the two order-2 entries in original sequence
+    expect(getOrderedFlows(flows).map((f) => f.id)).toEqual([
+      "first",
+      "second",
+      "second-tie",
+    ]);
+  });
+});
+
+describe("getFlowById", () => {
+  it("returns the matching flow when the id exists", () => {
+    const addProvider = buildFlow({ id: "add-provider", order: 1 });
+    const flows = [addProvider, buildFlow({ id: "other", order: 2 })];
+    expect(getFlowById("add-provider", flows)).toBe(addProvider);
+  });
+
+  it("returns undefined when the id is unknown", () => {
+    const flows = [buildFlow({ id: "add-provider", order: 1 })];
+    expect(getFlowById("unknown-xyz", flows)).toBeUndefined();
+  });
+});
+
+describe("getFlowById fallback", () => {
+  it("returns undefined for an unknown id against the production registry", () => {
+    expect(getFlowById("does-not-exist", onboardingFlows)).toBeUndefined();
+  });
+});
diff --git a/ui/lib/onboarding/gate-decision.ts b/ui/lib/onboarding/gate-decision.ts
new file mode 100644
index 0000000000..656a3b0cb4
--- /dev/null
+++ b/ui/lib/onboarding/gate-decision.ts
@@ -0,0 +1,17 @@
+import type { TourCompletionRecord } from "@/lib/tours/tour-types";
+
+export interface GateDecisionInput {
+  // `undefined` allowed; strict `=== false` check below fails open on ambiguous signals.
+  hasProviders: boolean | undefined;
+  completionRecord: TourCompletionRecord | null;
+}
+
+// Only forces onboarding when providers are provably absent and no record exists.
+export function shouldStartOnboarding({
+  hasProviders,
+  completionRecord,
+}: GateDecisionInput): boolean {
+  const hasNoRecord =
+    completionRecord === null || completionRecord === undefined;
+  return hasProviders === false && hasNoRecord;
+}
diff --git a/ui/lib/onboarding/index.ts b/ui/lib/onboarding/index.ts
new file mode 100644
index 0000000000..8ba6906ff2
--- /dev/null
+++ b/ui/lib/onboarding/index.ts
@@ -0,0 +1,6 @@
+// Public barrel — import from `@/lib/onboarding`, not individual modules.
+
+export type { GateDecisionInput } from "./gate-decision";
+export { shouldStartOnboarding } from "./gate-decision";
+export type { OnboardingContext, OnboardingFlow } from "./onboarding-types";
+export { getFlowById, getOrderedFlows, onboardingFlows } from "./registry";
diff --git a/ui/lib/onboarding/onboarding-types.ts b/ui/lib/onboarding/onboarding-types.ts
new file mode 100644
index 0000000000..7733120ec3
--- /dev/null
+++ b/ui/lib/onboarding/onboarding-types.ts
@@ -0,0 +1,22 @@
+import type { TourDefinition } from "@/lib/tours/tour-types";
+
+// Single argument passed to every `isComplete(ctx)` predicate.
+export interface OnboardingContext {
+  hasProviders: boolean;
+}
+
+// Completion is persisted via the tour's own id/version — no second source of truth.
+// `order` gaps are allowed; reordering is a data edit.
+export interface OnboardingFlow {
+  id: string;
+  order: number;
+  title: string;
+  description: string;
+  route: string;
+  tour: TourDefinition;
+  isComplete?: (ctx: OnboardingContext) => boolean;
+  // When true, the page owns auto-open; OnboardingTrigger must not mount a second runner.
+  ownsAutoOpen?: boolean;
+  // Shown in the sequence banner when the step needs a completed scan to display data.
+  dataRequirementHint?: string;
+}
diff --git a/ui/lib/onboarding/registry.ts b/ui/lib/onboarding/registry.ts
new file mode 100644
index 0000000000..32a6a12afa
--- /dev/null
+++ b/ui/lib/onboarding/registry.ts
@@ -0,0 +1,80 @@
+import { addProviderTour } from "@/lib/tours/add-provider.tour";
+import { attackPathsTour } from "@/lib/tours/attack-paths.tour";
+import { exploreFindingsTour } from "@/lib/tours/explore-findings.tour";
+import { viewComplianceTour } from "@/lib/tours/view-compliance.tour";
+import { viewFirstScanTour } from "@/lib/tours/view-first-scan.tour";
+
+import type { OnboardingFlow } from "./onboarding-types";
+
+// Shown in the sequence banner when the step needs a completed scan.
+const SCAN_DATA_HINT = "Wait for the scan to finish and have findings.";
+
+// Add a flow: one entry here + a `*.tour.ts` file. No gate/modal/nav edits needed.
+export const onboardingFlows: readonly OnboardingFlow[] = [
+  {
+    id: "add-provider",
+    order: 1,
+    title: "Add your first provider",
+    description:
+      "Connect a provider so Prowler has something to scan and assess.",
+    route: "/providers",
+    tour: addProviderTour,
+    // Server-derived: existing providers bypass this flow regardless of local record.
+    isComplete: (ctx) => ctx.hasProviders,
+  },
+  {
+    id: "view-first-scan",
+    order: 2,
+    title: "Run your first scan",
+    description:
+      "Launch a scan and watch Prowler assess your connected provider.",
+    // Land on the In Progress tab so a running scan is the first thing the tour shows.
+    route: "/scans?tab=active",
+    tour: viewFirstScanTour,
+  },
+  {
+    id: "explore-findings",
+    order: 3,
+    title: "Explore your findings",
+    description: "See what Prowler detected and how to fix it.",
+    route: "/findings",
+    tour: exploreFindingsTour,
+    dataRequirementHint: SCAN_DATA_HINT,
+  },
+  {
+    id: "view-compliance",
+    order: 4,
+    title: "Check compliance",
+    description: "Map your findings to frameworks like CIS.",
+    route: "/compliance",
+    tour: viewComplianceTour,
+    dataRequirementHint: SCAN_DATA_HINT,
+  },
+  {
+    id: "attack-paths",
+    order: 5,
+    title: "Visualize attack paths",
+    description: "See how a compromise could spread across your cloud.",
+    route: "/attack-paths",
+    tour: attackPathsTour,
+    dataRequirementHint: SCAN_DATA_HINT,
+    ownsAutoOpen: true, // page drives this tour; OnboardingTrigger must not mount a second runner
+  },
+];
+
+// Stable sort by `order`; `flows` defaults to the production registry so tests can inject.
+export function getOrderedFlows(
+  flows: readonly OnboardingFlow[] = onboardingFlows,
+): OnboardingFlow[] {
+  return flows
+    .map((flow, index) => ({ flow, index }))
+    .sort((a, b) => a.flow.order - b.flow.order || a.index - b.index)
+    .map(({ flow }) => flow);
+}
+
+export function getFlowById(
+  id: string,
+  flows: readonly OnboardingFlow[] = onboardingFlows,
+): OnboardingFlow | undefined {
+  return flows.find((flow) => flow.id === id);
+}
diff --git a/ui/lib/shared/env.ts b/ui/lib/shared/env.ts
new file mode 100644
index 0000000000..766394b970
--- /dev/null
+++ b/ui/lib/shared/env.ts
@@ -0,0 +1,14 @@
+/**
+ * Shared environment helpers.
+ */
+
+/**
+ * Whether the UI is running inside a Prowler Cloud deployment.
+ *
+ * `NEXT_PUBLIC_*` vars are statically inlined by Next.js wherever the literal
+ * `process.env.NEXT_PUBLIC_IS_CLOUD_ENV` appears in source, so keeping this read
+ * inside a helper is safe.
+ */
+export function isCloud(): boolean {
+  return process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+}
diff --git a/ui/lib/tours/__tests__/add-provider.tour.test.ts b/ui/lib/tours/__tests__/add-provider.tour.test.ts
new file mode 100644
index 0000000000..b361283d0a
--- /dev/null
+++ b/ui/lib/tours/__tests__/add-provider.tour.test.ts
@@ -0,0 +1,59 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  addProviderTour,
+  type AddProviderTourTarget,
+} from "../add-provider.tour";
+
+// These carry a `data-tour-id` in the UI; the welcome step has no target.
+const ALLOWED_TARGETS = ["trigger", "provider-type", "wizard-body"] as const;
+
+const definedTargets = (): AddProviderTourTarget[] =>
+  addProviderTour.steps
+    .map((step) => step.target)
+    .filter((target): target is AddProviderTourTarget => target !== undefined);
+
+describe("addProviderTour shape", () => {
+  it("declares the add-provider id", () => {
+    expect(addProviderTour.id).toBe("add-provider");
+  });
+
+  it("declares a positive integer version", () => {
+    expect(Number.isInteger(addProviderTour.version)).toBe(true);
+    expect(addProviderTour.version).toBeGreaterThan(0);
+  });
+
+  it("includes the trigger, provider-type, and wizard-body steps in order", () => {
+    const targets = definedTargets();
+    expect(targets).toEqual(["trigger", "provider-type", "wizard-body"]);
+  });
+
+  it("marks every anchored step as autoAdvance (no Next button)", () => {
+    // All anchored steps advance imperatively from the UI (clicking the real
+    // "Add a Provider" button, picking a type, etc.), so none renders a Next button.
+    const byTarget = (target: AddProviderTourTarget) =>
+      addProviderTour.steps.find((step) => step.target === target);
+
+    expect(byTarget("trigger")?.autoAdvance).toBe(true);
+    expect(byTarget("provider-type")?.autoAdvance).toBe(true);
+    expect(byTarget("wizard-body")?.autoAdvance).toBe(true);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    const targets = definedTargets();
+    for (const target of targets) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("includes a non-anchored welcome step (no target)", () => {
+    const welcomeSteps = addProviderTour.steps.filter(
+      (step) => step.target === undefined,
+    );
+    expect(welcomeSteps.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("covers the providers component tree for the tour:check gate", () => {
+    expect(addProviderTour.coversFiles).toContain("ui/components/providers/**");
+  });
+});
diff --git a/ui/lib/tours/__tests__/attack-paths.tour.test.ts b/ui/lib/tours/__tests__/attack-paths.tour.test.ts
new file mode 100644
index 0000000000..27e22b6313
--- /dev/null
+++ b/ui/lib/tours/__tests__/attack-paths.tour.test.ts
@@ -0,0 +1,120 @@
+import { describe, expect, it } from "vitest";
+
+import type { AttackPathQuery, AttackPathScan } from "@/types/attack-paths";
+import { ATTACK_PATH_QUERY_IDS } from "@/types/attack-paths";
+
+import {
+  attackPathsTour,
+  type AttackPathsTourTarget,
+  pickDemoQuery,
+  pickDemoScan,
+} from "../attack-paths.tour";
+
+// Only these carry a `data-tour-id` in the page; keep in sync with tour:check.
+const ALLOWED_TARGETS = [
+  "intro",
+  "scan-list",
+  "query-selector",
+  "execute-button",
+] as const;
+
+const definedTargets = (): AttackPathsTourTarget[] =>
+  attackPathsTour.steps
+    .map((step) => step.target)
+    .filter((target): target is AttackPathsTourTarget => target !== undefined);
+
+const makeScan = (overrides: {
+  id: string;
+  ready: boolean;
+  provider: AttackPathScan["attributes"]["provider_type"];
+}): AttackPathScan =>
+  ({
+    type: "attack-paths-scans",
+    id: overrides.id,
+    attributes: {
+      graph_data_ready: overrides.ready,
+      provider_type: overrides.provider,
+    },
+  }) as AttackPathScan;
+
+const makeQuery = (overrides: {
+  id: string;
+  paramCount: number;
+}): AttackPathQuery =>
+  ({
+    type: "attack-paths-scans",
+    id: overrides.id,
+    attributes: {
+      parameters: Array.from({ length: overrides.paramCount }, (_, index) => ({
+        name: `p${index}`,
+      })),
+    },
+  }) as AttackPathQuery;
+
+describe("attackPathsTour shape", () => {
+  it("declares the attack-paths id", () => {
+    expect(attackPathsTour.id).toBe("attack-paths");
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    for (const target of definedTargets()) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+});
+
+describe("pickDemoScan", () => {
+  it("prefers a ready AWS scan over other ready scans", () => {
+    const scans = [
+      makeScan({ id: "gcp", ready: true, provider: "gcp" }),
+      makeScan({ id: "aws", ready: true, provider: "aws" }),
+    ];
+    expect(pickDemoScan(scans)?.id).toBe("aws");
+  });
+
+  it("falls back to any ready scan when no ready AWS scan exists", () => {
+    const scans = [
+      makeScan({ id: "aws-not-ready", ready: false, provider: "aws" }),
+      makeScan({ id: "gcp-ready", ready: true, provider: "gcp" }),
+    ];
+    expect(pickDemoScan(scans)?.id).toBe("gcp-ready");
+  });
+
+  it("returns undefined when no scan is ready", () => {
+    const scans = [makeScan({ id: "x", ready: false, provider: "aws" })];
+    expect(pickDemoScan(scans)).toBeUndefined();
+  });
+});
+
+describe("pickDemoQuery", () => {
+  it("prefers the IAM wildcard query when it is runnable", () => {
+    const queries = [
+      makeQuery({ id: "other", paramCount: 0 }),
+      makeQuery({ id: "aws-iam-statements-allow-all-actions", paramCount: 0 }),
+    ];
+    expect(pickDemoQuery(queries)?.id).toBe(
+      "aws-iam-statements-allow-all-actions",
+    );
+  });
+
+  it("falls back to any parameter-free non-custom query", () => {
+    const queries = [
+      makeQuery({ id: ATTACK_PATH_QUERY_IDS.CUSTOM, paramCount: 0 }),
+      makeQuery({ id: "needs-params", paramCount: 2 }),
+      makeQuery({ id: "runnable", paramCount: 0 }),
+    ];
+    expect(pickDemoQuery(queries)?.id).toBe("runnable");
+  });
+
+  it("never picks the custom query (it needs Cypher input)", () => {
+    const queries = [
+      makeQuery({ id: ATTACK_PATH_QUERY_IDS.CUSTOM, paramCount: 0 }),
+    ];
+    expect(pickDemoQuery(queries)).toBeUndefined();
+  });
+
+  it("never picks a query with required parameters", () => {
+    const queries = [makeQuery({ id: "needs-params", paramCount: 1 })];
+    expect(pickDemoQuery(queries)).toBeUndefined();
+  });
+});
diff --git a/ui/lib/tours/__tests__/explore-findings.tour.test.ts b/ui/lib/tours/__tests__/explore-findings.tour.test.ts
new file mode 100644
index 0000000000..0c8ba2a063
--- /dev/null
+++ b/ui/lib/tours/__tests__/explore-findings.tour.test.ts
@@ -0,0 +1,89 @@
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  createExploreFindingsTourStepHandlers,
+  exploreFindingsTour,
+  type ExploreFindingsTourTarget,
+} from "../explore-findings.tour";
+
+// Only these carry a `data-tour-id` in the UI; welcome step has no target.
+const ALLOWED_TARGETS = ["filters", "group", "resources"] as const;
+
+const definedTargets = (): ExploreFindingsTourTarget[] =>
+  exploreFindingsTour.steps
+    .map((step) => step.target)
+    .filter(
+      (target): target is ExploreFindingsTourTarget => target !== undefined,
+    );
+
+describe("exploreFindingsTour shape", () => {
+  it("declares the explore-findings id", () => {
+    expect(exploreFindingsTour.id).toBe("explore-findings");
+  });
+
+  it("declares a positive integer version", () => {
+    expect(Number.isInteger(exploreFindingsTour.version)).toBe(true);
+    expect(exploreFindingsTour.version).toBeGreaterThan(0);
+  });
+
+  it("anchors filters, then the first group, then its resources, in that order", () => {
+    const targets = definedTargets();
+    // filters mounts immediately; group/resources appear after Suspense + drill-down, so order matters
+    expect(targets).toEqual(["filters", "group", "resources"]);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    const targets = definedTargets();
+    for (const target of targets) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("includes a non-anchored welcome step (no target)", () => {
+    const welcomeSteps = exploreFindingsTour.steps.filter(
+      (step) => step.target === undefined,
+    );
+    expect(welcomeSteps.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("covers the findings route and component trees for the tour:check gate", () => {
+    expect(exploreFindingsTour.coversFiles).toContain(
+      "ui/app/(prowler)/findings/**",
+    );
+    expect(exploreFindingsTour.coversFiles).toContain(
+      "ui/components/findings/**",
+    );
+  });
+});
+
+describe("createExploreFindingsTourStepHandlers", () => {
+  it("opens the first group and waits for the resources anchor before advancing", async () => {
+    const openFirstGroup = vi.fn(() => true);
+    const waitForStep = vi
+      .fn()
+      .mockResolvedValue(document.createElement("div"));
+    const handlers = createExploreFindingsTourStepHandlers(openFirstGroup);
+
+    await handlers.group?.onNext?.({ waitForStep });
+
+    expect(openFirstGroup).toHaveBeenCalledTimes(1);
+    expect(waitForStep).toHaveBeenCalledWith("resources");
+  });
+
+  it("does not wait for resources when no group can be opened", async () => {
+    const openFirstGroup = vi.fn(() => false);
+    const waitForStep = vi.fn();
+    const handlers = createExploreFindingsTourStepHandlers(openFirstGroup);
+
+    await handlers.group?.onNext?.({ waitForStep });
+
+    expect(openFirstGroup).toHaveBeenCalledTimes(1);
+    expect(waitForStep).not.toHaveBeenCalled();
+  });
+
+  it("registers a handler only for the group step", () => {
+    const handlers = createExploreFindingsTourStepHandlers(() => true);
+
+    expect(Object.keys(handlers)).toEqual(["group"]);
+  });
+});
diff --git a/ui/lib/tours/__tests__/use-driver-tour.lifecycle.test.tsx b/ui/lib/tours/__tests__/use-driver-tour.lifecycle.test.tsx
new file mode 100644
index 0000000000..1c300787d4
--- /dev/null
+++ b/ui/lib/tours/__tests__/use-driver-tour.lifecycle.test.tsx
@@ -0,0 +1,198 @@
+import { act, render } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { TourCompletionStore } from "../store/tour-completion-store";
+import type { TourCompletionRecord, TourDefinition } from "../tour-types";
+import { useDriverTour, type UseDriverTourResult } from "../use-driver-tour";
+
+const driverHarness = vi.hoisted(() => {
+  const instances: Array<{
+    destroy: ReturnType<typeof vi.fn>;
+    drive: ReturnType<typeof vi.fn>;
+    isActive: ReturnType<typeof vi.fn>;
+    isLastStep: ReturnType<typeof vi.fn>;
+  }> = [];
+
+  const driverMock = vi.fn((config: { onDestroyed?: () => void }) => {
+    let active = false;
+    const instance = {
+      destroy: vi.fn(() => {
+        active = false;
+        config.onDestroyed?.();
+      }),
+      drive: vi.fn(() => {
+        active = true;
+      }),
+      isActive: vi.fn(() => active),
+      isLastStep: vi.fn(() => false),
+      moveNext: vi.fn(),
+      movePrevious: vi.fn(),
+    };
+    instances.push(instance);
+    return instance;
+  });
+
+  return { driverMock, instances };
+});
+
+vi.mock("driver.js", () => ({
+  driver: driverHarness.driverMock,
+}));
+
+const themeHarness = vi.hoisted(() => ({ resolvedTheme: "dark" }));
+
+vi.mock("next-themes", () => ({
+  useTheme: () => ({ resolvedTheme: themeHarness.resolvedTheme }),
+}));
+
+const tour = {
+  id: "lifecycle-tour",
+  version: 1,
+  coversFiles: [],
+  steps: [
+    {
+      title: "Welcome",
+      description: "Tour lifecycle",
+    },
+  ],
+} satisfies TourDefinition;
+
+function createStore(): TourCompletionStore {
+  const records = new Map<string, TourCompletionRecord>();
+
+  return {
+    get: ({ id, version }) => records.get(`${id}.${version}`) ?? null,
+    set: ({ id, version }, record) => {
+      records.set(`${id}.${version}`, record);
+    },
+    clear: ({ id, version }) => {
+      records.delete(`${id}.${version}`);
+    },
+  };
+}
+
+function HookProbe({
+  autoOpen,
+  onResult,
+  store,
+}: {
+  autoOpen: boolean;
+  onResult: (result: UseDriverTourResult) => void;
+  store: TourCompletionStore;
+}) {
+  const result = useDriverTour(tour, { autoOpen, store });
+  onResult(result);
+  return null;
+}
+
+describe("useDriverTour lifecycle", () => {
+  beforeEach(() => {
+    vi.stubEnv("NODE_ENV", "development");
+    themeHarness.resolvedTheme = "dark";
+    driverHarness.driverMock.mockClear();
+    driverHarness.instances.length = 0;
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+    vi.unstubAllEnvs();
+  });
+
+  it("does not destroy an active manually-started tour when autoOpen changes after replay param cleanup", () => {
+    const store = createStore();
+    let latestResult: UseDriverTourResult | undefined;
+
+    const { rerender } = render(
+      <HookProbe
+        autoOpen={false}
+        store={store}
+        onResult={(result) => {
+          latestResult = result;
+        }}
+      />,
+    );
+
+    expect(driverHarness.instances).toHaveLength(1);
+
+    act(() => {
+      latestResult?.start();
+    });
+
+    rerender(
+      <HookProbe
+        autoOpen
+        store={store}
+        onResult={(result) => {
+          latestResult = result;
+        }}
+      />,
+    );
+
+    expect(driverHarness.instances[0].drive).toHaveBeenCalledTimes(1);
+    expect(driverHarness.instances[0].destroy).not.toHaveBeenCalled();
+  });
+
+  it("still auto-opens a new incomplete tour after the configured delay", () => {
+    vi.useFakeTimers();
+    const store = createStore();
+
+    render(
+      <HookProbe
+        autoOpen
+        store={store}
+        onResult={() => {
+          // Result surface is irrelevant for auto-open behavior.
+        }}
+      />,
+    );
+
+    expect(driverHarness.instances).toHaveLength(1);
+    expect(driverHarness.instances[0].drive).not.toHaveBeenCalled();
+
+    act(() => {
+      vi.advanceTimersByTime(50);
+    });
+
+    expect(driverHarness.instances[0].drive).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not record a completion when an active tour is torn down by a theme change", () => {
+    const store = createStore();
+    let latestResult: UseDriverTourResult | undefined;
+
+    const { rerender } = render(
+      <HookProbe
+        autoOpen={false}
+        store={store}
+        onResult={(result) => {
+          latestResult = result;
+        }}
+      />,
+    );
+
+    act(() => {
+      latestResult?.start();
+    });
+
+    // Toggling theme re-runs the driver effect; its cleanup destroys the active
+    // instance, which (like real driver.js) fires onDestroyed directly.
+    act(() => {
+      themeHarness.resolvedTheme = "light";
+      rerender(
+        <HookProbe
+          autoOpen={false}
+          store={store}
+          onResult={(result) => {
+            latestResult = result;
+          }}
+        />,
+      );
+    });
+
+    // The first instance was destroyed and a fresh one created for the new theme...
+    expect(driverHarness.instances[0].destroy).toHaveBeenCalledTimes(1);
+    expect(driverHarness.instances).toHaveLength(2);
+    // ...but no completion record was persisted, so the tour can reappear later.
+    expect(store.get({ id: tour.id, version: tour.version })).toBeNull();
+  });
+});
diff --git a/ui/lib/tours/__tests__/use-driver-tour.test.tsx b/ui/lib/tours/__tests__/use-driver-tour.test.tsx
new file mode 100644
index 0000000000..f9a523d80c
--- /dev/null
+++ b/ui/lib/tours/__tests__/use-driver-tour.test.tsx
@@ -0,0 +1,96 @@
+import { render } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { addProviderTour } from "../add-provider.tour";
+import type { TourCompletionRecord } from "../tour-types";
+import {
+  adaptStep,
+  advanceActiveTour,
+  endActiveTour,
+  useDriverTour,
+} from "../use-driver-tour";
+
+// Hook short-circuits driver.js in NODE_ENV=test; asserts public contract only.
+// Driver.js close behavior is covered by E2E (slice 9).
+
+function HookProbe({
+  onClosed,
+  onResult,
+}: {
+  onClosed?: (state: TourCompletionRecord["state"]) => void;
+  onResult: (result: ReturnType<typeof useDriverTour>) => void;
+}) {
+  const result = useDriverTour(addProviderTour, { autoOpen: false, onClosed });
+  onResult(result);
+  return null;
+}
+
+describe("useDriverTour onClosed option", () => {
+  it("accepts the onClosed option and returns the existing result surface", () => {
+    const onClosed = vi.fn();
+    const results: ReturnType<typeof useDriverTour>[] = [];
+
+    render(<HookProbe onClosed={onClosed} onResult={(r) => results.push(r)} />);
+
+    const result = results.at(-1);
+    expect(result).toBeDefined();
+    expect(typeof result?.start).toBe("function");
+    expect(typeof result?.stop).toBe("function");
+    expect(typeof result?.hasCompleted).toBe("boolean");
+    // onClosed is input-only; it must not leak into the returned surface
+    expect(result && "onClosed" in result).toBe(false);
+  });
+
+  it("keeps the same result surface when onClosed is omitted (backward-compatible)", () => {
+    const results: ReturnType<typeof useDriverTour>[] = [];
+
+    render(<HookProbe onResult={(r) => results.push(r)} />);
+
+    const result = results.at(-1);
+    expect(result).toBeDefined();
+    expect(typeof result?.start).toBe("function");
+    expect(typeof result?.stop).toBe("function");
+    expect(typeof result?.hasCompleted).toBe("boolean");
+  });
+});
+
+describe("endActiveTour", () => {
+  // The actual destroy path runs only outside NODE_ENV=test (driver.js is
+  // short-circuited here), so this asserts the imperative escape hatch the
+  // provider wizard relies on is exported and safe to call unconditionally.
+  it("is a no-op that does not throw when no tour is active", () => {
+    expect(() => endActiveTour()).not.toThrow();
+    expect(endActiveTour()).toBeUndefined();
+  });
+});
+
+describe("advanceActiveTour", () => {
+  // Sibling escape hatch to endActiveTour: the wizard calls it on provider-type
+  // selection to move past the autoAdvance step. Same NODE_ENV=test short-circuit.
+  it("is a no-op that does not throw when no tour is active", () => {
+    expect(() => advanceActiveTour()).not.toThrow();
+    expect(advanceActiveTour()).toBeUndefined();
+  });
+});
+
+describe("adaptStep autoAdvance", () => {
+  it("limits an autoAdvance step's popover to the close button only", () => {
+    const driveStep = adaptStep("add-provider", {
+      target: "provider-type",
+      autoAdvance: true,
+      title: "Pick a provider type",
+    });
+
+    // No Next/Back — the covered UI drives the flow via advanceActiveTour().
+    expect(driveStep.popover?.showButtons).toEqual(["close"]);
+  });
+
+  it("leaves showButtons unset on a normal step (driver.js defaults apply)", () => {
+    const driveStep = adaptStep("add-provider", {
+      target: "trigger",
+      title: "Open the wizard",
+    });
+
+    expect(driveStep.popover?.showButtons).toBeUndefined();
+  });
+});
diff --git a/ui/lib/tours/__tests__/view-compliance.tour.test.ts b/ui/lib/tours/__tests__/view-compliance.tour.test.ts
new file mode 100644
index 0000000000..4d6c042b51
--- /dev/null
+++ b/ui/lib/tours/__tests__/view-compliance.tour.test.ts
@@ -0,0 +1,105 @@
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  createViewComplianceTourStepHandlers,
+  viewComplianceTour,
+  type ViewComplianceTourTarget,
+} from "../view-compliance.tour";
+
+// Only these two carry a `data-tour-id` in the UI; welcome step has no target.
+const ALLOWED_TARGETS = ["frameworks", "search"] as const;
+
+const definedTargets = (): ViewComplianceTourTarget[] =>
+  viewComplianceTour.steps
+    .map((step) => step.target)
+    .filter(
+      (target): target is ViewComplianceTourTarget => target !== undefined,
+    );
+
+describe("viewComplianceTour shape", () => {
+  it("declares the view-compliance id", () => {
+    expect(viewComplianceTour.id).toBe("view-compliance");
+  });
+
+  it("declares a positive integer version", () => {
+    expect(Number.isInteger(viewComplianceTour.version)).toBe(true);
+    expect(viewComplianceTour.version).toBeGreaterThan(0);
+  });
+
+  it("anchors exactly the search and frameworks steps, in that order", () => {
+    // Search sits above the cards in the DOM; the tour must follow top-to-bottom
+    // so the spotlight never jumps back up the page.
+    const targets = definedTargets();
+    expect(targets).toEqual(["search", "frameworks"]);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    const targets = definedTargets();
+    for (const target of targets) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("includes a non-anchored welcome step (no target)", () => {
+    const welcomeSteps = viewComplianceTour.steps.filter(
+      (step) => step.target === undefined,
+    );
+    expect(welcomeSteps.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("covers the compliance route and component trees for the tour:check gate", () => {
+    expect(viewComplianceTour.coversFiles).toContain(
+      "ui/app/(prowler)/compliance/**",
+    );
+    expect(viewComplianceTour.coversFiles).toContain(
+      "ui/components/compliance/**",
+    );
+  });
+});
+
+describe("createViewComplianceTourStepHandlers", () => {
+  const makeHandlers = (overrides?: {
+    resetSearch?: () => boolean;
+    openFirstFramework?: () => void;
+  }) =>
+    createViewComplianceTourStepHandlers({
+      resetSearch: overrides?.resetSearch ?? vi.fn(() => true),
+      openFirstFramework: overrides?.openFirstFramework ?? vi.fn(),
+    });
+
+  it("resets the search and waits for the frameworks anchor before advancing", async () => {
+    // An empty search result unmounts every card (anchor included); resetting first
+    // guarantees the next step has an element to highlight.
+    const resetSearch = vi.fn(() => true);
+    const waitForStep = vi
+      .fn()
+      .mockResolvedValue(document.createElement("div"));
+    const handlers = makeHandlers({ resetSearch });
+
+    await handlers.search?.onNext?.({ waitForStep });
+
+    expect(resetSearch).toHaveBeenCalledTimes(1);
+    expect(waitForStep).toHaveBeenCalledWith("frameworks");
+  });
+
+  it("does not wait for frameworks when no card can render", async () => {
+    const resetSearch = vi.fn(() => false);
+    const waitForStep = vi.fn();
+    const handlers = makeHandlers({ resetSearch });
+
+    await handlers.search?.onNext?.({ waitForStep });
+
+    expect(waitForStep).not.toHaveBeenCalled();
+  });
+
+  it("opens the first framework when leaving the last step", async () => {
+    const openFirstFramework = vi.fn();
+    const waitForStep = vi.fn();
+    const handlers = makeHandlers({ openFirstFramework });
+
+    await handlers.frameworks?.onNext?.({ waitForStep });
+
+    expect(openFirstFramework).toHaveBeenCalledTimes(1);
+    expect(waitForStep).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/lib/tours/__tests__/view-first-scan.tour.test.ts b/ui/lib/tours/__tests__/view-first-scan.tour.test.ts
new file mode 100644
index 0000000000..8fead9fd33
--- /dev/null
+++ b/ui/lib/tours/__tests__/view-first-scan.tour.test.ts
@@ -0,0 +1,86 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  buildViewFirstScanTour,
+  viewFirstScanTour,
+  type ViewFirstScanTourTarget,
+} from "../view-first-scan.tour";
+
+// These carry a `data-tour-id` in the UI; the welcome step has no target.
+const ALLOWED_TARGETS = ["in-progress", "launch", "tabs"] as const;
+
+const definedTargets = (tour = viewFirstScanTour): ViewFirstScanTourTarget[] =>
+  tour.steps
+    .map((step) => step.target)
+    .filter(
+      (target): target is ViewFirstScanTourTarget => target !== undefined,
+    );
+
+describe("viewFirstScanTour shape (default, no running scan)", () => {
+  it("declares the view-first-scan id", () => {
+    expect(viewFirstScanTour.id).toBe("view-first-scan");
+  });
+
+  it("declares a positive integer version", () => {
+    expect(Number.isInteger(viewFirstScanTour.version)).toBe(true);
+    expect(viewFirstScanTour.version).toBeGreaterThan(0);
+  });
+
+  it("anchors exactly the launch and tabs steps, in that order", () => {
+    expect(definedTargets()).toEqual(["launch", "tabs"]);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    for (const target of definedTargets()) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("includes a non-anchored welcome step (no target)", () => {
+    const welcomeSteps = viewFirstScanTour.steps.filter(
+      (step) => step.target === undefined,
+    );
+    expect(welcomeSteps.length).toBeGreaterThanOrEqual(1);
+  });
+
+  it("covers the scans route and component trees for the tour:check gate", () => {
+    expect(viewFirstScanTour.coversFiles).toContain(
+      "ui/app/(prowler)/scans/**",
+    );
+    expect(viewFirstScanTour.coversFiles).toContain("ui/components/scans/**");
+  });
+
+  it("is the build output for the no-running-scan case", () => {
+    // The registry's default flow uses this variant; the scans page rebuilds live.
+    expect(definedTargets(buildViewFirstScanTour(false))).toEqual([
+      "launch",
+      "tabs",
+    ]);
+  });
+});
+
+describe("buildViewFirstScanTour with a running scan", () => {
+  const tour = buildViewFirstScanTour(true);
+
+  it("anchors the in-progress row first, then launch (no tabs step)", () => {
+    // The tabs are mentioned in the in-progress step's copy instead of a separate step.
+    expect(definedTargets(tour)).toEqual(["in-progress", "launch"]);
+  });
+
+  it("shares the same id and version as the default variant", () => {
+    expect(tour.id).toBe(viewFirstScanTour.id);
+    expect(tour.version).toBe(viewFirstScanTour.version);
+  });
+
+  it("never targets an element outside the allowed anchor set", () => {
+    for (const target of definedTargets(tour)) {
+      expect(ALLOWED_TARGETS).toContain(target);
+    }
+  });
+
+  it("keeps a non-anchored welcome step", () => {
+    expect(
+      tour.steps.filter((step) => step.target === undefined).length,
+    ).toBeGreaterThanOrEqual(1);
+  });
+});
diff --git a/ui/lib/tours/add-provider.tour.ts b/ui/lib/tours/add-provider.tour.ts
new file mode 100644
index 0000000000..614735d79b
--- /dev/null
+++ b/ui/lib/tours/add-provider.tour.ts
@@ -0,0 +1,67 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+} from "./tour-types";
+
+// Const map keeps the union narrow so `useDriverTour` can validate step keys.
+export const ADD_PROVIDER_TOUR_TARGETS = {
+  TRIGGER: "trigger",
+  PROVIDER_TYPE: "provider-type",
+  // Wraps the whole wizard modal so the final step's spotlight covers every input
+  // (UID, alias) and the footer — driver.js only keeps the highlighted element and
+  // its descendants interactive, so anchoring here stops the overlay from freezing
+  // those inputs.
+  WIZARD_BODY: "wizard-body",
+} as const;
+
+export type AddProviderTourTarget =
+  (typeof ADD_PROVIDER_TOUR_TARGETS)[keyof typeof ADD_PROVIDER_TOUR_TARGETS];
+
+export const addProviderTour = defineTour<AddProviderTourTarget>({
+  id: "add-provider",
+  // v2: the tour now drives the user into the wizard body (provider-type + wizard-body
+  // steps) instead of ending at type selection.
+  version: 2,
+  coversFiles: ["ui/components/providers/**"],
+  steps: [
+    {
+      title: "Connect your first provider",
+      description:
+        "Prowler scans the providers you connect. Let's walk through adding your first provider so scans have something to assess.",
+    },
+    {
+      target: "trigger",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      // No Next button: clicking the highlighted "Add a Provider" button opens the
+      // wizard and advances the tour (see openProviderWizard).
+      autoAdvance: true,
+      title: "Open the Add Provider wizard",
+      description:
+        "Click Add a Provider to open the setup wizard. We'll point out the first thing to choose.",
+    },
+    {
+      target: "provider-type",
+      side: TOUR_STEP_SIDES.RIGHT,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      // No Next button: the wizard advances the tour when a type is picked.
+      autoAdvance: true,
+      title: "Pick a provider type",
+      description:
+        "Choose the cloud you want to connect (AWS, Azure, GCP, and more). Selecting one takes you to the account details.",
+    },
+    {
+      target: "wizard-body",
+      // Pinned to the left of the form column, mirroring the provider-type step.
+      side: TOUR_STEP_SIDES.LEFT,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      // Final step: stays until the user closes it or advances to credentials, which
+      // the wizard ends the tour from. No Next button.
+      autoAdvance: true,
+      title: "Add your account details",
+      description:
+        "Enter your account ID and an optional alias, then continue. From here you'll add credentials, test the connection, and launch your first scan — at your own pace.",
+    },
+  ],
+});
diff --git a/ui/lib/tours/attack-paths-empty.tour.ts b/ui/lib/tours/attack-paths-empty.tour.ts
new file mode 100644
index 0000000000..34a1949eff
--- /dev/null
+++ b/ui/lib/tours/attack-paths-empty.tour.ts
@@ -0,0 +1,31 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+} from "./tour-types";
+
+// Companion to `attack-paths.tour.ts` with a distinct id so completing one
+// does not suppress the other.
+export const attackPathsEmptyTour = defineTour({
+  id: "attack-paths-empty",
+  version: 1,
+  coversFiles: [
+    "ui/app/(prowler)/attack-paths/**",
+    "ui/components/attack-paths/**",
+  ],
+  steps: [
+    {
+      title: "Welcome to Attack Paths",
+      description:
+        "Attack Paths visualizes how a compromise in one resource could spread through your cloud. It's currently available for AWS accounts only — you'll need a completed AWS scan first.",
+    },
+    {
+      target: "scans-cta",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Run your first scan",
+      description:
+        "Open Scan Jobs to launch one. The Attack Paths tour will pick up here once a scan is ready.",
+    },
+  ],
+});
diff --git a/ui/lib/tours/attack-paths.tour.ts b/ui/lib/tours/attack-paths.tour.ts
new file mode 100644
index 0000000000..b44a11e5b1
--- /dev/null
+++ b/ui/lib/tours/attack-paths.tour.ts
@@ -0,0 +1,98 @@
+import type { AttackPathQuery, AttackPathScan } from "@/types/attack-paths";
+import { ATTACK_PATH_QUERY_IDS } from "@/types/attack-paths";
+
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+} from "./tour-types";
+
+export const attackPathsTour = defineTour({
+  id: "attack-paths",
+  version: 1,
+  coversFiles: [
+    "ui/app/(prowler)/attack-paths/**",
+    "ui/components/attack-paths/**",
+  ],
+  steps: [
+    {
+      title: "Welcome to Attack Paths",
+      description:
+        "Attack Paths visualizes how a compromise in one resource could spread through your cloud. It's currently available for AWS accounts only.",
+    },
+    {
+      target: "intro",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Start with a scan",
+      description:
+        "Attack Paths analyses are generated from your existing AWS scans. Each scan is a point-in-time snapshot of one account.",
+    },
+    {
+      target: "scan-list",
+      side: TOUR_STEP_SIDES.TOP,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Pick a scan",
+      description:
+        "Each row is a scan. Click the radio button on the left to select one.",
+    },
+    {
+      target: "query-selector",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Choose a query",
+      description:
+        "Predefined queries cover common risk patterns (privilege escalation, public exposure, lateral movement). You can also write your own query.",
+    },
+    {
+      target: "execute-button",
+      side: TOUR_STEP_SIDES.TOP,
+      align: TOUR_STEP_ALIGNMENTS.END,
+      // No Next button: clicking the highlighted Execute Query button runs the query
+      // and advances the tour (see handleExecuteQuery in attack-paths-page).
+      autoAdvance: true,
+      title: "Run it whenever you're ready",
+      description:
+        "Click Execute Query to see the graph with the possible attack paths.",
+    },
+    {
+      title: "You're all set",
+      description:
+        "Explore the attack paths and dig into anything that looks risky.",
+    },
+  ],
+});
+
+export type AttackPathsTourTarget = NonNullable<
+  (typeof attackPathsTour.steps)[number]["target"]
+>;
+
+// Demo-pick logic lives here so page code never decides what to auto-run.
+// Preferred demo query: well-known and usually returns findings.
+const PREFERRED_DEMO_QUERY_ID = "aws-iam-statements-allow-all-actions";
+
+const isReadyScan = (scan: AttackPathScan): boolean =>
+  scan.attributes.graph_data_ready;
+
+// Prefer a ready AWS scan; fall back to any ready scan for non-AWS tenants.
+export function pickDemoScan(
+  scans: readonly AttackPathScan[],
+): AttackPathScan | undefined {
+  const preferredAws = scans.find(
+    (scan) => isReadyScan(scan) && scan.attributes.provider_type === "aws",
+  );
+  return preferredAws ?? scans.find(isReadyScan);
+}
+
+// Runnable = no required params and not Custom (needs manual Cypher).
+export function pickDemoQuery(
+  queries: readonly AttackPathQuery[],
+): AttackPathQuery | undefined {
+  const isRunnable = (query: AttackPathQuery): boolean =>
+    query.id !== ATTACK_PATH_QUERY_IDS.CUSTOM &&
+    query.attributes.parameters.length === 0;
+  const preferredIam = queries.find(
+    (query) => query.id === PREFERRED_DEMO_QUERY_ID && isRunnable(query),
+  );
+  return preferredIam ?? queries.find(isRunnable);
+}
diff --git a/ui/lib/tours/explore-findings.tour.ts b/ui/lib/tours/explore-findings.tour.ts
new file mode 100644
index 0000000000..920cd0742f
--- /dev/null
+++ b/ui/lib/tours/explore-findings.tour.ts
@@ -0,0 +1,74 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+  type TourStepHandlers,
+} from "./tour-types";
+
+// Const map keeps the union narrow so `useDriverTour` can validate step keys.
+export const EXPLORE_FINDINGS_TOUR_TARGETS = {
+  FILTERS: "filters",
+  // Anchored to the first finding group row (there may be only one), not the whole table.
+  GROUP: "group",
+  // The expanded resources panel revealed after opening a finding group.
+  RESOURCES: "resources",
+} as const;
+
+export type ExploreFindingsTourTarget =
+  (typeof EXPLORE_FINDINGS_TOUR_TARGETS)[keyof typeof EXPLORE_FINDINGS_TOUR_TARGETS];
+
+export const exploreFindingsTour = defineTour<ExploreFindingsTourTarget>({
+  id: "explore-findings",
+  version: 1,
+  coversFiles: ["ui/app/(prowler)/findings/**", "ui/components/findings/**"],
+  steps: [
+    {
+      title: "Explore your findings",
+      description:
+        "Findings are the issues Prowler detected across your scans, grouped so you can act on what matters most.",
+    },
+    {
+      // `filters` renders immediately; `group` waits on Suspense — order matters.
+      target: "filters",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Focus on what matters",
+      description:
+        "Filter by provider, severity, service, and more to narrow down to the findings you care about.",
+    },
+    {
+      target: "group",
+      side: TOUR_STEP_SIDES.TOP,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Open a finding group",
+      description:
+        "Each row groups related findings from a single check. Continue and we'll open the first one for you.",
+    },
+    {
+      target: "resources",
+      side: TOUR_STEP_SIDES.TOP,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Review the affected resources",
+      description:
+        "These are the resources flagged by the check. Click any row to inspect the finding details and how to remediate it.",
+    },
+  ],
+});
+
+// Step handlers are passed to `useDriverTour` at consumption time (not part of `TourDefinition`).
+// `group` opens the first finding group and waits for the resources panel before advancing.
+export function createExploreFindingsTourStepHandlers(
+  openFirstGroup: () => boolean,
+): {
+  [K in ExploreFindingsTourTarget]?: TourStepHandlers<ExploreFindingsTourTarget>;
+} {
+  return {
+    [EXPLORE_FINDINGS_TOUR_TARGETS.GROUP]: {
+      onNext: async ({ waitForStep }) => {
+        // No drillable group → skip the wait so the tour doesn't hang; driver advances next.
+        if (!openFirstGroup()) return;
+        await waitForStep(EXPLORE_FINDINGS_TOUR_TARGETS.RESOURCES);
+      },
+    },
+  };
+}
diff --git a/ui/lib/tours/store/local-storage-adapter.test.ts b/ui/lib/tours/store/local-storage-adapter.test.ts
new file mode 100644
index 0000000000..a071b4c169
--- /dev/null
+++ b/ui/lib/tours/store/local-storage-adapter.test.ts
@@ -0,0 +1,103 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import { TOUR_COMPLETION_STATES } from "../tour-types";
+import { buildStorageKey, localStorageAdapter } from "./local-storage-adapter";
+
+const TOUR_ID = { id: "attack-paths", version: 1 };
+// All tour records share one key as a single object — no per-tour proliferation.
+const STORAGE_KEY = "prowler.tours";
+
+const sampleRecord = {
+  tourId: "attack-paths",
+  version: 1,
+  state: TOUR_COMPLETION_STATES.COMPLETED,
+  completedAt: "2026-01-15T12:34:56.000Z",
+} as const;
+
+describe("buildStorageKey", () => {
+  it("composes the field key for the tours object", () => {
+    expect(buildStorageKey({ id: "attack-paths", version: 1 })).toBe(
+      "attack-paths.v1",
+    );
+  });
+
+  it("renders multi-digit versions verbatim", () => {
+    expect(buildStorageKey({ id: "lighthouse", version: 42 })).toBe(
+      "lighthouse.v42",
+    );
+  });
+});
+
+describe("localStorageAdapter", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+  });
+
+  afterEach(() => {
+    window.localStorage.clear();
+  });
+
+  it("set/get round-trips a record inside the single tours object", () => {
+    localStorageAdapter.set(TOUR_ID, sampleRecord);
+
+    const raw = window.localStorage.getItem(STORAGE_KEY);
+    expect(raw).not.toBeNull();
+    expect(JSON.parse(raw as string)).toEqual({
+      "attack-paths.v1": sampleRecord,
+    });
+
+    const fetched = localStorageAdapter.get(TOUR_ID);
+    expect(fetched).toEqual(sampleRecord);
+  });
+
+  it("stores every tour under one localStorage key", () => {
+    localStorageAdapter.set(TOUR_ID, sampleRecord);
+    localStorageAdapter.set({ id: "add-provider", version: 1 }, sampleRecord);
+
+    expect(window.localStorage.length).toBe(1);
+    expect(window.localStorage.key(0)).toBe(STORAGE_KEY);
+  });
+
+  it("returns null when no record exists for that (id, version)", () => {
+    expect(localStorageAdapter.get(TOUR_ID)).toBeNull();
+  });
+
+  it("isolates records by version under the same id", () => {
+    localStorageAdapter.set(TOUR_ID, sampleRecord);
+
+    const v2Record = { ...sampleRecord, version: 2 };
+    localStorageAdapter.set({ id: TOUR_ID.id, version: 2 }, v2Record);
+
+    expect(localStorageAdapter.get(TOUR_ID)).toEqual(sampleRecord);
+    expect(localStorageAdapter.get({ id: TOUR_ID.id, version: 2 })).toEqual(
+      v2Record,
+    );
+  });
+
+  it("clear() removes only the matching record", () => {
+    localStorageAdapter.set(TOUR_ID, sampleRecord);
+    localStorageAdapter.set({ id: "other", version: 1 }, sampleRecord);
+
+    localStorageAdapter.clear(TOUR_ID);
+
+    expect(localStorageAdapter.get(TOUR_ID)).toBeNull();
+    expect(localStorageAdapter.get({ id: "other", version: 1 })).toEqual(
+      sampleRecord,
+    );
+  });
+
+  it("returns null when the stored object is malformed JSON", () => {
+    window.localStorage.setItem(STORAGE_KEY, "{not json");
+
+    expect(localStorageAdapter.get(TOUR_ID)).toBeNull();
+  });
+
+  it("returns null when the stored record is missing required fields", () => {
+    window.localStorage.setItem(
+      STORAGE_KEY,
+      JSON.stringify({ "attack-paths.v1": { tourId: "attack-paths" } }),
+    );
+
+    expect(localStorageAdapter.get(TOUR_ID)).toBeNull();
+  });
+});
diff --git a/ui/lib/tours/store/local-storage-adapter.ts b/ui/lib/tours/store/local-storage-adapter.ts
new file mode 100644
index 0000000000..9ace12fd69
--- /dev/null
+++ b/ui/lib/tours/store/local-storage-adapter.ts
@@ -0,0 +1,70 @@
+import type { TourCompletionRecord, TourId } from "../tour-types";
+import type { TourCompletionStore } from "./tour-completion-store";
+
+// All records share ONE localStorage key, keyed by `<id>.v<version>`.
+const STORAGE_KEY = "prowler.tours";
+
+type ToursObject = Record<string, TourCompletionRecord>;
+
+export function buildStorageKey({ id, version }: TourId): string {
+  return `${id}.v${version}`;
+}
+
+function isValidRecord(value: unknown): value is TourCompletionRecord {
+  if (typeof value !== "object" || value === null) return false;
+  const record = value as Partial<TourCompletionRecord>;
+  return (
+    typeof record.tourId === "string" &&
+    typeof record.version === "number" &&
+    typeof record.state === "string" &&
+    typeof record.completedAt === "string"
+  );
+}
+
+function readAll(): ToursObject {
+  if (typeof window === "undefined") return {};
+
+  let raw: string | null;
+  try {
+    raw = window.localStorage.getItem(STORAGE_KEY);
+  } catch {
+    return {};
+  }
+  if (raw === null) return {};
+
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null) {
+      return parsed as ToursObject;
+    }
+    return {};
+  } catch {
+    return {};
+  }
+}
+
+function writeAll(tours: ToursObject): void {
+  if (typeof window === "undefined") return;
+  try {
+    window.localStorage.setItem(STORAGE_KEY, JSON.stringify(tours));
+  } catch {
+    // Non-fatal: a re-shown tour beats a thrown render.
+  }
+}
+
+export const localStorageAdapter: TourCompletionStore = {
+  get(id) {
+    const record = readAll()[buildStorageKey(id)];
+    return isValidRecord(record) ? record : null;
+  },
+  set(id, record) {
+    const tours = readAll();
+    tours[buildStorageKey(id)] = record;
+    writeAll(tours);
+  },
+  clear(id) {
+    const tours = readAll();
+    delete tours[buildStorageKey(id)];
+    writeAll(tours);
+  },
+};
diff --git a/ui/lib/tours/store/tour-completion-store.ts b/ui/lib/tours/store/tour-completion-store.ts
new file mode 100644
index 0000000000..4fd79258f7
--- /dev/null
+++ b/ui/lib/tours/store/tour-completion-store.ts
@@ -0,0 +1,8 @@
+import type { TourCompletionRecord, TourId } from "../tour-types";
+
+// Persistence backend contract; swap the adapter without touching consumers.
+export interface TourCompletionStore {
+  get(id: TourId): TourCompletionRecord | null;
+  set(id: TourId, record: TourCompletionRecord): void;
+  clear(id: TourId): void;
+}
diff --git a/ui/lib/tours/tour-config.test.ts b/ui/lib/tours/tour-config.test.ts
new file mode 100644
index 0000000000..6676caa44e
--- /dev/null
+++ b/ui/lib/tours/tour-config.test.ts
@@ -0,0 +1,56 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  baseDriverConfig,
+  getDriverConfig,
+  TOUR_OVERLAY_COLORS,
+  TOUR_THEMES,
+} from "./tour-config";
+
+describe("getDriverConfig", () => {
+  it("returns dark overlay color for the dark theme", () => {
+    const config = getDriverConfig(TOUR_THEMES.DARK);
+    expect(config.overlayColor).toBe(TOUR_OVERLAY_COLORS[TOUR_THEMES.DARK]);
+  });
+
+  it("returns light overlay color for the light theme", () => {
+    const config = getDriverConfig(TOUR_THEMES.LIGHT);
+    expect(config.overlayColor).toBe(TOUR_OVERLAY_COLORS[TOUR_THEMES.LIGHT]);
+  });
+
+  it("preserves base config defaults when no overrides are passed", () => {
+    const config = getDriverConfig(TOUR_THEMES.LIGHT);
+
+    expect(config.popoverClass).toBe("prowler-theme");
+    expect(config.showProgress).toBe(true);
+    expect(config.progressText).toBe("Step {{current}} of {{total}}");
+    expect(config.prevBtnText).toBe("Back");
+    expect(config.doneBtnText).toBe("Got it");
+    expect(config.stagePadding).toBe(baseDriverConfig.stagePadding);
+  });
+
+  it("merges overrides on top of the base config", () => {
+    const config = getDriverConfig(TOUR_THEMES.LIGHT, {
+      stagePadding: 24,
+      doneBtnText: "Finish",
+    });
+
+    expect(config.stagePadding).toBe(24);
+    expect(config.doneBtnText).toBe("Finish");
+    expect(config.popoverClass).toBe("prowler-theme");
+  });
+
+  it("lets overrides win over the theme-derived overlayColor", () => {
+    const config = getDriverConfig(TOUR_THEMES.LIGHT, {
+      overlayColor: "#abcdef",
+    });
+
+    expect(config.overlayColor).toBe("#abcdef");
+  });
+
+  it("does not mutate the shared baseDriverConfig", () => {
+    const snapshot = { ...baseDriverConfig };
+    getDriverConfig(TOUR_THEMES.DARK, { stagePadding: 99 });
+    expect(baseDriverConfig).toEqual(snapshot);
+  });
+});
diff --git a/ui/lib/tours/tour-config.ts b/ui/lib/tours/tour-config.ts
new file mode 100644
index 0000000000..d7c2ce851f
--- /dev/null
+++ b/ui/lib/tours/tour-config.ts
@@ -0,0 +1,50 @@
+import type { Config } from "driver.js";
+
+import { renderTourPopover } from "./tour-popover-render";
+
+export const TOUR_THEMES = {
+  LIGHT: "light",
+  DARK: "dark",
+} as const;
+
+export type TourTheme = (typeof TOUR_THEMES)[keyof typeof TOUR_THEMES];
+
+export const TOUR_OVERLAY_COLORS = {
+  [TOUR_THEMES.LIGHT]: "#0f172a",
+  [TOUR_THEMES.DARK]: "#0a0a0a",
+} as const;
+
+// Per-step overrides go on the step; per-tour overrides merge in via getDriverConfig.
+export const baseDriverConfig: Config = {
+  popoverClass: "prowler-theme",
+  animate: true,
+  smoothScroll: true,
+  allowClose: true,
+  overlayClickBehavior: "close",
+  overlayOpacity: 0.72,
+  stagePadding: 10,
+  stageRadius: 10,
+  popoverOffset: 12,
+  showButtons: ["next", "previous", "close"],
+  showProgress: true,
+  progressText: "Step {{current}} of {{total}}",
+  nextBtnText: "Next",
+  prevBtnText: "Back",
+  doneBtnText: "Got it",
+  allowKeyboardControl: true,
+  disableActiveInteraction: false,
+  onPopoverRender: renderTourPopover,
+};
+
+// driver.js exposes `overlayColor` only via JS (no CSS variable hook), so the
+// theme is resolved at the call site and passed in here.
+export function getDriverConfig(
+  theme: TourTheme,
+  overrides?: Partial<Config>,
+): Config {
+  return {
+    ...baseDriverConfig,
+    overlayColor: TOUR_OVERLAY_COLORS[theme],
+    ...(overrides ?? {}),
+  };
+}
diff --git a/ui/lib/tours/tour-popover-render.test.tsx b/ui/lib/tours/tour-popover-render.test.tsx
new file mode 100644
index 0000000000..598f7f8bab
--- /dev/null
+++ b/ui/lib/tours/tour-popover-render.test.tsx
@@ -0,0 +1,139 @@
+import { act, screen, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import type { PopoverDOM } from "driver.js";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import {
+  renderTourPopover,
+  unmountActiveTourPopover,
+} from "./tour-popover-render";
+
+function createPopover(): PopoverDOM {
+  const wrapper = document.createElement("div");
+  const arrow = document.createElement("div");
+  const title = document.createElement("header");
+  const description = document.createElement("div");
+  const footer = document.createElement("footer");
+  const progress = document.createElement("span");
+  const previousButton = document.createElement("button");
+  const nextButton = document.createElement("button");
+  const closeButton = document.createElement("button");
+  const footerButtons = document.createElement("span");
+
+  title.textContent = "Explore findings";
+  description.textContent = "Review grouped findings and resources.";
+  progress.textContent = "Step 2 of 4";
+  previousButton.textContent = "Back";
+  nextButton.textContent = "Next";
+  closeButton.setAttribute("aria-label", "Close");
+
+  wrapper.append(title, description, footer, closeButton, arrow);
+  footer.append(progress, footerButtons);
+  footerButtons.append(previousButton, nextButton);
+  document.body.appendChild(wrapper);
+
+  return {
+    wrapper,
+    arrow,
+    title,
+    description,
+    footer,
+    progress,
+    previousButton,
+    nextButton,
+    closeButton,
+    footerButtons,
+  };
+}
+
+describe("renderTourPopover", () => {
+  afterEach(() => {
+    act(() => unmountActiveTourPopover());
+    document.body.innerHTML = "";
+  });
+
+  it("renders tour UI with existing app components", async () => {
+    // Given
+    const popover = createPopover();
+
+    // When
+    await act(async () => renderTourPopover(popover));
+    const tourUi = within(
+      popover.wrapper.querySelector<HTMLElement>("[data-tour-popover-root]")!,
+    );
+
+    // Then
+    expect(tourUi.getByText("Explore findings")).toBeVisible();
+    expect(
+      tourUi.getByText("Review grouped findings and resources."),
+    ).toBeVisible();
+    expect(tourUi.getByText("Step 2 of 4")).toBeVisible();
+    expect(tourUi.getByRole("progressbar")).toHaveAttribute(
+      "aria-valuenow",
+      "50",
+    );
+    expect(tourUi.getByText("Explore findings")).toHaveAttribute(
+      "data-slot",
+      "card-title",
+    );
+    expect(tourUi.getByRole("button", { name: "Next" })).toHaveAttribute(
+      "data-slot",
+      "button",
+    );
+    expect(popover.title).not.toBeVisible();
+    expect(popover.footer).not.toBeVisible();
+  });
+
+  it("renders synchronously so driver.js measures the real card dimensions", () => {
+    // Given
+    const popover = createPopover();
+
+    // When
+    renderTourPopover(popover);
+
+    // Then
+    expect(
+      popover.wrapper.querySelector('[data-slot="card"]'),
+    ).toBeInTheDocument();
+  });
+
+  it("applies the onboarding popover styling on the card and its slots", async () => {
+    // Given
+    const popover = createPopover();
+
+    // When
+    await act(async () => renderTourPopover(popover));
+
+    // Then — styling lives at this callsite, not in a shared Card variant.
+    const card = popover.wrapper.querySelector('[data-slot="card"]')!;
+    expect(card).toHaveClass("gap-0");
+    expect(card).toHaveClass("shadow-lg");
+    const footer = popover.wrapper.querySelector('[data-slot="card-footer"]')!;
+    expect(footer).toHaveClass("justify-end");
+    expect(footer).toHaveClass("gap-2");
+    expect(footer).toHaveClass("px-0");
+  });
+
+  it("delegates visible button clicks to driver.js native controls", async () => {
+    // Given
+    const user = userEvent.setup();
+    const popover = createPopover();
+    const onPrevious = vi.fn();
+    const onNext = vi.fn();
+    const onClose = vi.fn();
+    popover.previousButton.addEventListener("click", onPrevious);
+    popover.nextButton.addEventListener("click", onNext);
+    popover.closeButton.addEventListener("click", onClose);
+    await act(async () => renderTourPopover(popover));
+
+    // When
+    await user.click(screen.getByRole("button", { name: "Back" }));
+    await user.click(screen.getByRole("button", { name: "Next" }));
+    await user.click(screen.getByRole("button", { name: "Close" }));
+
+    // Then
+    expect(onPrevious).toHaveBeenCalledTimes(1);
+    expect(onNext).toHaveBeenCalledTimes(1);
+    expect(onClose).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/ui/lib/tours/tour-popover-render.tsx b/ui/lib/tours/tour-popover-render.tsx
new file mode 100644
index 0000000000..5dc2bbd19d
--- /dev/null
+++ b/ui/lib/tours/tour-popover-render.tsx
@@ -0,0 +1,197 @@
+"use client";
+
+import type { PopoverDOM } from "driver.js";
+import { XIcon } from "lucide-react";
+import { flushSync } from "react-dom";
+import { createRoot, type Root } from "react-dom/client";
+
+import {
+  Button,
+  Card,
+  CardAction,
+  CardContent,
+  CardDescription,
+  CardFooter,
+  CardHeader,
+  CardTitle,
+  Progress,
+} from "@/components/shadcn";
+
+interface TourPopoverProps {
+  title: string;
+  description: string;
+  progressText: string;
+  progressValue: number;
+  previousLabel: string;
+  nextLabel: string;
+  closeLabel: string;
+  showPrevious: boolean;
+  showNext: boolean;
+  showClose: boolean;
+  previousDisabled: boolean;
+  onPrevious: () => void;
+  onNext: () => void;
+  onClose: () => void;
+}
+
+let activeRoot: Root | null = null;
+let activeWrapper: HTMLElement | null = null;
+
+function isDisplayed(element: HTMLElement): boolean {
+  return element.style.display !== "none";
+}
+
+function parseProgressValue(progressText: string): number {
+  const match = progressText.match(/(\d+)\D+(\d+)/);
+  if (!match) return 0;
+
+  const current = Number(match[1]);
+  const total = Number(match[2]);
+  if (total <= 0) return 0;
+
+  return Math.min(100, Math.max(0, (current / total) * 100));
+}
+
+function getText(element: HTMLElement, fallback: string): string {
+  const text = element.textContent?.trim();
+  return text && text.length > 0 ? text : fallback;
+}
+
+function hideDriverPopoverDom(popover: PopoverDOM) {
+  popover.title.hidden = true;
+  popover.description.hidden = true;
+  popover.footer.hidden = true;
+  popover.closeButton.hidden = true;
+  popover.arrow.hidden = true;
+}
+
+function getOrCreateMount(popover: PopoverDOM): HTMLElement {
+  const existing = popover.wrapper.querySelector<HTMLElement>(
+    "[data-tour-popover-root]",
+  );
+  if (existing) {
+    existing.style.width = "100%";
+    return existing;
+  }
+
+  const mount = document.createElement("div");
+  mount.dataset.tourPopoverRoot = "";
+  mount.style.width = "100%";
+  popover.wrapper.appendChild(mount);
+  return mount;
+}
+
+function TourPopover({
+  title,
+  description,
+  progressText,
+  progressValue,
+  previousLabel,
+  nextLabel,
+  closeLabel,
+  showPrevious,
+  showNext,
+  showClose,
+  previousDisabled,
+  onPrevious,
+  onNext,
+  onClose,
+}: TourPopoverProps) {
+  return (
+    <Card variant="inner" className="gap-0 shadow-lg">
+      <CardHeader className="mb-4">
+        <CardTitle className="text-base leading-snug">{title}</CardTitle>
+        {showClose ? (
+          <CardAction>
+            <Button
+              aria-label={closeLabel}
+              size="icon-xs"
+              variant="bare"
+              onClick={onClose}
+            >
+              <XIcon aria-hidden="true" />
+            </Button>
+          </CardAction>
+        ) : null}
+        {description ? (
+          <CardDescription className="mt-2 text-xs leading-relaxed">
+            {description}
+          </CardDescription>
+        ) : null}
+      </CardHeader>
+      <CardContent className="mt-2">
+        {progressText ? (
+          <>
+            <CardDescription className="mt-2 text-xs leading-relaxed">
+              {progressText}
+            </CardDescription>
+            <Progress value={progressValue} />
+          </>
+        ) : null}
+      </CardContent>
+      <CardFooter className="mt-4 justify-end gap-2 px-0">
+        {showPrevious ? (
+          <Button
+            disabled={previousDisabled}
+            size="sm"
+            // Match the app's modal secondary action (e.g. Launch Scan's Cancel).
+            variant="outline"
+            onClick={onPrevious}
+          >
+            {previousLabel}
+          </Button>
+        ) : null}
+        {showNext ? (
+          <Button size="sm" onClick={onNext}>
+            {nextLabel}
+          </Button>
+        ) : null}
+      </CardFooter>
+    </Card>
+  );
+}
+
+export function unmountActiveTourPopover() {
+  activeRoot?.unmount();
+  activeRoot = null;
+  activeWrapper = null;
+}
+
+export function renderTourPopover(popover: PopoverDOM) {
+  if (activeWrapper !== popover.wrapper) {
+    unmountActiveTourPopover();
+  }
+
+  hideDriverPopoverDom(popover);
+
+  const mount = getOrCreateMount(popover);
+  activeRoot = activeRoot ?? createRoot(mount);
+  activeWrapper = popover.wrapper;
+
+  const progressText = isDisplayed(popover.progress)
+    ? getText(popover.progress, "")
+    : "";
+
+  flushSync(() => {
+    activeRoot?.render(
+      <TourPopover
+        title={getText(popover.title, "")}
+        description={getText(popover.description, "")}
+        progressText={progressText}
+        progressValue={parseProgressValue(progressText)}
+        previousLabel={getText(popover.previousButton, "Back")}
+        nextLabel={getText(popover.nextButton, "Next")}
+        closeLabel={popover.closeButton.getAttribute("aria-label") ?? "Close"}
+        showPrevious={isDisplayed(popover.previousButton)}
+        showNext={isDisplayed(popover.nextButton)}
+        showClose={isDisplayed(popover.closeButton)}
+        previousDisabled={popover.previousButton.disabled}
+        onPrevious={() => {
+          if (!popover.previousButton.disabled) popover.previousButton.click();
+        }}
+        onNext={() => popover.nextButton.click()}
+        onClose={() => popover.closeButton.click()}
+      />,
+    );
+  });
+}
diff --git a/ui/lib/tours/tour-types.ts b/ui/lib/tours/tour-types.ts
new file mode 100644
index 0000000000..d443f21489
--- /dev/null
+++ b/ui/lib/tours/tour-types.ts
@@ -0,0 +1,91 @@
+// Import from this module — never from `driver.js` directly — to keep the
+// library a swappable implementation detail.
+
+export const TOUR_COMPLETION_STATES = {
+  COMPLETED: "completed",
+  SKIPPED: "skipped",
+  DISMISSED: "dismissed",
+} as const;
+
+export type TourCompletionState =
+  (typeof TOUR_COMPLETION_STATES)[keyof typeof TOUR_COMPLETION_STATES];
+
+export const TOUR_STEP_SIDES = {
+  TOP: "top",
+  RIGHT: "right",
+  BOTTOM: "bottom",
+  LEFT: "left",
+  OVER: "over",
+} as const;
+
+export type TourStepSide =
+  (typeof TOUR_STEP_SIDES)[keyof typeof TOUR_STEP_SIDES];
+
+export const TOUR_STEP_ALIGNMENTS = {
+  START: "start",
+  CENTER: "center",
+  END: "end",
+} as const;
+
+export type TourStepAlignment =
+  (typeof TOUR_STEP_ALIGNMENTS)[keyof typeof TOUR_STEP_ALIGNMENTS];
+
+export interface TourId {
+  id: string;
+  version: number;
+}
+
+export interface TourCompletionRecord {
+  tourId: string;
+  version: number;
+  state: TourCompletionState;
+  completedAt: string;
+}
+
+// Modal step omits `target`; anchored step provides the `data-tour-id` value (no brackets).
+export interface TourStep<TTarget extends string = string> {
+  target?: TTarget;
+  title?: string;
+  description?: string;
+  side?: TourStepSide;
+  align?: TourStepAlignment;
+  disableActiveInteraction?: boolean;
+  // Step with no Next/Back buttons (only Close); the flow advances via imperative
+  // `advanceActiveTour()` calls from the covered UI instead of popover clicks. Used
+  // when progress is driven by a user action (e.g. picking a provider type) rather
+  // than the tour's own button.
+  autoAdvance?: boolean;
+}
+
+// `coversFiles` is consumed by the `prowler-tour` skill to scope drift checks.
+export interface TourDefinition<TTarget extends string = string> {
+  id: string;
+  version: number;
+  coversFiles: readonly string[];
+  steps: ReadonlyArray<TourStep<TTarget>>;
+}
+
+// `waitForStep` resolves when `data-tour-id="<tour-id>-<target>"` appears in the document.
+export interface TourStepHandlerContext<TTarget extends string = string> {
+  waitForStep: (
+    target: TTarget,
+    options?: WaitForStepOptions,
+  ) => Promise<Element>;
+}
+
+export interface WaitForStepOptions {
+  timeoutMs?: number;
+}
+
+// Overrides driver.js's default Next/Back for the step it's registered on.
+export interface TourStepHandlers<TTarget extends string = string> {
+  onNext?: (context: TourStepHandlerContext<TTarget>) => void | Promise<void>;
+  onPrev?: (context: TourStepHandlerContext<TTarget>) => void | Promise<void>;
+}
+
+// Use instead of `: TourDefinition` to preserve literal step targets for `stepHandlers`/`waitForStep` validation.
+export function defineTour<const TTarget extends string>(
+  definition: TourDefinition<TTarget>,
+): TourDefinition<TTarget> {
+  return definition;
+}
diff --git a/ui/lib/tours/use-driver-tour.ts b/ui/lib/tours/use-driver-tour.ts
new file mode 100644
index 0000000000..a0ab78523b
--- /dev/null
+++ b/ui/lib/tours/use-driver-tour.ts
@@ -0,0 +1,401 @@
+"use client";
+
+// driver.js's own stylesheet provides the overlay/stage geometry and base popover
+// positioning. tours.css only themes on top of it (strips the popover chrome so our
+// React card shows). Without this import the spotlight and popover placement break.
+import "driver.js/dist/driver.css";
+
+import { type Config, type Driver, driver, type DriveStep } from "driver.js";
+import { useTheme } from "next-themes";
+import { useEffect, useRef } from "react";
+
+import { localStorageAdapter } from "./store/local-storage-adapter";
+import type { TourCompletionStore } from "./store/tour-completion-store";
+import { getDriverConfig, type TourTheme } from "./tour-config";
+import { unmountActiveTourPopover } from "./tour-popover-render";
+import {
+  TOUR_COMPLETION_STATES,
+  type TourCompletionRecord,
+  type TourDefinition,
+  type TourStep,
+  type TourStepHandlerContext,
+  type TourStepHandlers,
+  type WaitForStepOptions,
+} from "./tour-types";
+
+const AUTO_OPEN_DELAY_MS = 50;
+const DEFAULT_WAIT_TIMEOUT_MS = 8000;
+
+// Handle to the tour that is currently driving. driver.js permits a single active
+// tour at a time, so one module-level ref is enough. It lets imperative callers
+// outside the tour's React subtree end it — e.g. the provider wizard ends the
+// add-provider tour once the user advances past the anchored step, so driver.js's
+// overlay stops applying `pointer-events: none` to the rest of the wizard's inputs.
+let activeTourInstance: Driver | null = null;
+
+/** Ends whatever tour is currently driving. No-op when none is active. */
+export function endActiveTour(): void {
+  const instance = activeTourInstance;
+  activeTourInstance = null;
+  if (!instance?.isActive()) return;
+  // Defer out of React's render/commit cycle: destroy() synchronously unmounts the
+  // popover's React root (see tour-popover-render), and React 19 throws if that
+  // happens mid-render — e.g. when this is called from an effect reacting to a
+  // provider-type selection. The microtask runs before paint, so no visible flash.
+  queueMicrotask(() => {
+    if (instance.isActive()) instance.destroy();
+  });
+}
+
+/**
+ * Advances the currently driving tour by one step. No-op when none is active or
+ * the tour is already on its last step. Used to drive `autoAdvance` steps — those
+ * have no Next button, so the covered UI moves the tour forward when the user takes
+ * the expected action (e.g. the provider wizard advances past the provider-type
+ * step once a type is picked).
+ */
+export function advanceActiveTour(): void {
+  const instance = activeTourInstance;
+  if (!instance?.isActive()) return;
+  // Same React-19 reason as endActiveTour: moveNext re-renders the popover via
+  // flushSync, which throws if called mid-render (this fires from a change handler).
+  // Idempotent: re-checking isActive/isLastStep inside the microtask means repeat
+  // calls after reaching the final step are no-ops, never overshooting.
+  queueMicrotask(() => {
+    if (instance.isActive() && !instance.isLastStep()) instance.moveNext();
+  });
+}
+
+/**
+ * Advances the active tour once `targetSelector` appears in the DOM. Used when the
+ * next step anchors to an element that mounts asynchronously after a user action —
+ * e.g. clicking "Add a Provider" opens the wizard, and the provider-type anchor only
+ * exists once the modal renders. No-op when no tour is active; silently gives up if
+ * the element never mounts (e.g. the modal was closed again).
+ */
+export function advanceActiveTourWhenReady(targetSelector: string): void {
+  const instance = activeTourInstance;
+  if (!instance?.isActive()) return;
+  waitForElement(targetSelector)
+    .then(() => {
+      // .then is already off the render path, so moveNext()'s flushSync is safe here
+      // (same pattern as the step onNext handlers below).
+      if (instance.isActive() && !instance.isLastStep()) instance.moveNext();
+    })
+    .catch(() => {
+      // Target never appeared (e.g. the wizard was dismissed); leave the tour as-is.
+    });
+}
+
+export interface UseDriverTourOptions<TTarget extends string = string> {
+  /** Auto-open on mount when no completion record exists. Defaults to true. */
+  autoOpen?: boolean;
+  /** Gate that delays initialization until anchored DOM is ready. Defaults to true. */
+  enabled?: boolean;
+  /** Defaults to `localStorageAdapter`. */
+  store?: TourCompletionStore;
+  configOverrides?: Partial<Config>;
+  /** Indexed by step `target`; overrides driver.js's default Next/Back for that step. */
+  stepHandlers?: { [K in TTarget]?: TourStepHandlers<TTarget> };
+  /** Fired after persist when the tour is destroyed; invoked via ref so identity changes don't recreate the driver. */
+  onClosed?: (state: TourCompletionRecord["state"]) => void;
+}
+
+export interface UseDriverTourResult {
+  start: () => void;
+  stop: () => void;
+  /** True if a completion record exists for `(tour.id, tour.version)`. */
+  hasCompleted: boolean;
+}
+
+function resolveTheme(resolvedTheme: string | undefined): TourTheme {
+  return resolvedTheme === "dark" ? "dark" : "light";
+}
+
+function toSelector(target: string): string {
+  return `[data-tour-id="${target}"]`;
+}
+
+/** Builds the `[data-tour-id="<tourId>-<target>"]` selector for a step's anchor. */
+export function getTourTargetSelector(tourId: string, target: string): string {
+  return toSelector(`${tourId}-${target}`);
+}
+
+function waitForElement(
+  selector: string,
+  options: WaitForStepOptions = {},
+): Promise<Element> {
+  const { timeoutMs = DEFAULT_WAIT_TIMEOUT_MS } = options;
+  if (typeof document === "undefined") {
+    return Promise.reject(new Error("waitForElement called without a DOM"));
+  }
+
+  const existing = document.querySelector(selector);
+  if (existing) return Promise.resolve(existing);
+
+  return new Promise((resolve, reject) => {
+    const observer = new MutationObserver(() => {
+      const found = document.querySelector(selector);
+      if (found) {
+        observer.disconnect();
+        window.clearTimeout(timer);
+        resolve(found);
+      }
+    });
+
+    observer.observe(document.body, { childList: true, subtree: true });
+
+    const timer = window.setTimeout(() => {
+      observer.disconnect();
+      reject(
+        new Error(
+          `Tour element ${selector} did not appear within ${timeoutMs}ms`,
+        ),
+      );
+    }, timeoutMs);
+  });
+}
+
+// Exported for unit testing the step → driver.js mapping (e.g. autoAdvance buttons).
+export function adaptStep<TTarget extends string>(
+  tourId: string,
+  step: TourStep<TTarget>,
+): DriveStep {
+  const driveStep: DriveStep = {
+    popover: {
+      title: step.title,
+      description: step.description,
+      side: step.side,
+      align: step.align,
+    },
+  };
+
+  if (step.target) {
+    const selector = toSelector(`${tourId}-${step.target}`);
+    driveStep.element = () => {
+      if (typeof document === "undefined") {
+        throw new Error("Tour element resolved without a DOM");
+      }
+      const found = document.querySelector(selector);
+      if (!found) {
+        throw new Error(
+          `Tour "${tourId}" references missing selector: ${selector}`,
+        );
+      }
+      return found;
+    };
+  }
+
+  if (step.disableActiveInteraction !== undefined) {
+    driveStep.disableActiveInteraction = step.disableActiveInteraction;
+  }
+
+  if (step.autoAdvance) {
+    // No Next/Back — only Close. driver.js hides the other buttons (display:none),
+    // so the React popover's showNext/showPrevious resolve false. The flow advances
+    // via advanceActiveTour() called imperatively from the covered UI.
+    driveStep.popover = { ...driveStep.popover, showButtons: ["close"] };
+  }
+
+  return driveStep;
+}
+
+function nowIso(): string {
+  return new Date().toISOString();
+}
+
+function buildHandlerContext<TTarget extends string>(
+  tourId: string,
+): TourStepHandlerContext<TTarget> {
+  return {
+    waitForStep: (target, options) =>
+      waitForElement(toSelector(`${tourId}-${target}`), options),
+  };
+}
+
+// Generic over `TTarget` so `stepHandlers` keys and `waitForStep` calls are type-checked against the tour's literal union.
+export function useDriverTour<TTarget extends string>(
+  tour: TourDefinition<TTarget>,
+  options: UseDriverTourOptions<TTarget> = {},
+): UseDriverTourResult {
+  const {
+    autoOpen = true,
+    enabled = true,
+    store = localStorageAdapter,
+    configOverrides,
+    stepHandlers,
+    onClosed,
+  } = options;
+
+  const { resolvedTheme } = useTheme();
+  const theme = resolveTheme(resolvedTheme);
+
+  const driverRef = useRef<Driver | null>(null);
+  const finalStateRef = useRef<TourCompletionRecord["state"]>(
+    TOUR_COMPLETION_STATES.DISMISSED,
+  );
+  // Widened internally: indexing `{ [K in TTarget]?: ... }` by a generic `TTarget` resolves to `never`.
+  const stepHandlersRef = useRef<
+    Record<string, TourStepHandlers<TTarget> | undefined> | undefined
+  >(stepHandlers as Record<string, TourStepHandlers<TTarget> | undefined>);
+  stepHandlersRef.current = stepHandlers as
+    | Record<string, TourStepHandlers<TTarget> | undefined>
+    | undefined;
+
+  // Stable ref — not in the effect dep array, so changing identity never recreates the driver.
+  const onClosedRef = useRef<
+    ((state: TourCompletionRecord["state"]) => void) | undefined
+  >(onClosed);
+  onClosedRef.current = onClosed;
+
+  // True while an involuntary teardown is in flight (theme re-render / unmount).
+  // driver.js's destroy() bypasses onDestroyStarted but still fires onDestroyed, so
+  // without this flag onDestroyed would persist the default DISMISSED record and the
+  // tour would be marked resolved forever after a simple theme toggle.
+  const teardownRef = useRef(false);
+
+  const tourId = tour.id;
+  const tourVersion = tour.version;
+  const existing = store.get({ id: tourId, version: tourVersion });
+  const hasCompleted = existing !== null;
+
+  useEffect(() => {
+    // Skip in vitest — the driver.js overlay would race click-through tests.
+    if (process.env.NODE_ENV === "test") return;
+    if (!enabled) return;
+    if (tour.steps.length === 0) return;
+
+    finalStateRef.current = TOUR_COMPLETION_STATES.DISMISSED;
+    const tourKey = { id: tourId, version: tourVersion };
+
+    const persist = (state: TourCompletionRecord["state"]) => {
+      store.set(tourKey, {
+        tourId,
+        version: tourVersion,
+        state,
+        completedAt: nowIso(),
+      });
+    };
+
+    const handlerContext = buildHandlerContext(tourId);
+
+    const steps: DriveStep[] = tour.steps.map((step) => {
+      const driveStep = adaptStep(tourId, step);
+      const target = step.target;
+      if (!target) return driveStep;
+
+      // Read handlers via ref so identity changes don't recreate the driver.
+      driveStep.popover = {
+        ...driveStep.popover,
+        onNextClick: (_element, _step, { driver: instance }) => {
+          const handler = stepHandlersRef.current?.[target]?.onNext;
+          if (!handler) {
+            instance.moveNext();
+            return;
+          }
+          Promise.resolve(handler(handlerContext))
+            .then(() => {
+              if (instance.isActive()) instance.moveNext();
+            })
+            .catch((err) => {
+              console.error(
+                `Tour "${tourId}" step "${target}" onNext failed:`,
+                err,
+              );
+              if (instance.isActive()) instance.destroy();
+            });
+        },
+        onPrevClick: (_element, _step, { driver: instance }) => {
+          const handler = stepHandlersRef.current?.[target]?.onPrev;
+          if (!handler) {
+            instance.movePrevious();
+            return;
+          }
+          Promise.resolve(handler(handlerContext))
+            .then(() => {
+              if (instance.isActive()) instance.movePrevious();
+            })
+            .catch((err) => {
+              console.error(
+                `Tour "${tourId}" step "${target}" onPrev failed:`,
+                err,
+              );
+              if (instance.isActive()) instance.destroy();
+            });
+        },
+      };
+
+      return driveStep;
+    });
+
+    const config = getDriverConfig(theme, {
+      ...configOverrides,
+      steps,
+      onDestroyStarted: (_element, _step, { driver: instance }) => {
+        if (instance.isLastStep()) {
+          finalStateRef.current = TOUR_COMPLETION_STATES.COMPLETED;
+        } else {
+          finalStateRef.current = TOUR_COMPLETION_STATES.SKIPPED;
+        }
+        instance.destroy();
+      },
+      onDestroyed: () => {
+        unmountActiveTourPopover();
+        if (activeTourInstance === driverRef.current) {
+          activeTourInstance = null;
+        }
+        // Involuntary teardown: close the tour without recording a resolution so it
+        // can reappear later (e.g. the user just switched theme mid-tour).
+        if (teardownRef.current) {
+          teardownRef.current = false;
+          return;
+        }
+        persist(finalStateRef.current);
+        onClosedRef.current?.(finalStateRef.current);
+      },
+    });
+
+    driverRef.current = driver(config);
+
+    return () => {
+      const instance = driverRef.current;
+      if (instance?.isActive()) {
+        teardownRef.current = true;
+        instance.destroy();
+      }
+      unmountActiveTourPopover();
+      driverRef.current = null;
+    };
+  }, [theme, tour, tourId, tourVersion, enabled, store, configOverrides]);
+
+  useEffect(() => {
+    // Skip in vitest — the driver.js overlay would race click-through tests.
+    if (process.env.NODE_ENV === "test") return;
+    if (!enabled || !autoOpen || hasCompleted) return;
+
+    const instance = driverRef.current;
+    if (!instance || instance.isActive()) return;
+
+    const timer = window.setTimeout(() => {
+      if (!instance.isActive()) {
+        activeTourInstance = instance;
+        instance.drive();
+      }
+    }, AUTO_OPEN_DELAY_MS);
+
+    return () => {
+      window.clearTimeout(timer);
+    };
+  }, [autoOpen, enabled, hasCompleted, tourId, tourVersion]);
+
+  return {
+    start: () => {
+      const instance = driverRef.current;
+      if (!instance) return;
+      activeTourInstance = instance;
+      instance.drive();
+    },
+    stop: () => driverRef.current?.destroy(),
+    hasCompleted,
+  };
+}
diff --git a/ui/lib/tours/use-tour-completion.ts b/ui/lib/tours/use-tour-completion.ts
new file mode 100644
index 0000000000..70a685fde4
--- /dev/null
+++ b/ui/lib/tours/use-tour-completion.ts
@@ -0,0 +1,36 @@
+"use client";
+
+import { useSyncExternalStore } from "react";
+
+import { localStorageAdapter } from "./store/local-storage-adapter";
+import type { TourCompletionRecord, TourId } from "./tour-types";
+
+// Subscribes to cross-tab storage events only; same-tab writes manage their own state.
+function subscribe(callback: () => void): () => void {
+  if (typeof window === "undefined") return () => {};
+  window.addEventListener("storage", callback);
+  return () => window.removeEventListener("storage", callback);
+}
+
+// `localStorageAdapter.get` re-parses JSON each call; cache by serialized form to keep snapshot reference-stable.
+const recordCache = new Map<string, TourCompletionRecord | null>();
+const serializedCache = new Map<string, string | null>();
+
+// Server snapshot is `null` (no localStorage), avoiding hydration mismatch.
+export function useTourCompletion(
+  tour: TourId | null,
+): TourCompletionRecord | null {
+  const getSnapshot = (): TourCompletionRecord | null => {
+    if (!tour) return null;
+    const cacheKey = `${tour.id}.v${tour.version}`;
+    const record = localStorageAdapter.get(tour);
+    const serialized = record ? JSON.stringify(record) : null;
+    if (serializedCache.get(cacheKey) !== serialized) {
+      serializedCache.set(cacheKey, serialized);
+      recordCache.set(cacheKey, record);
+    }
+    return recordCache.get(cacheKey) ?? null;
+  };
+
+  return useSyncExternalStore(subscribe, getSnapshot, () => null);
+}
diff --git a/ui/lib/tours/view-compliance.tour.ts b/ui/lib/tours/view-compliance.tour.ts
new file mode 100644
index 0000000000..5aa23c77ca
--- /dev/null
+++ b/ui/lib/tours/view-compliance.tour.ts
@@ -0,0 +1,76 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+  type TourStepHandlers,
+} from "./tour-types";
+
+// Const map keeps the union narrow so `useDriverTour` can validate step keys.
+export const VIEW_COMPLIANCE_TOUR_TARGETS = {
+  FRAMEWORKS: "frameworks",
+  SEARCH: "search",
+} as const;
+
+export type ViewComplianceTourTarget =
+  (typeof VIEW_COMPLIANCE_TOUR_TARGETS)[keyof typeof VIEW_COMPLIANCE_TOUR_TARGETS];
+
+export const viewComplianceTour = defineTour<ViewComplianceTourTarget>({
+  id: "view-compliance",
+  version: 1,
+  coversFiles: [
+    "ui/app/(prowler)/compliance/**",
+    "ui/components/compliance/**",
+  ],
+  steps: [
+    {
+      title: "Check your compliance",
+      description:
+        "Compliance maps your findings to frameworks like CIS so you can see where you stand against each standard.",
+    },
+    {
+      target: "search",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Find a framework fast",
+      description:
+        "Search by name to jump straight to a specific framework instead of scrolling through every card.",
+    },
+    {
+      target: "frameworks",
+      side: TOUR_STEP_SIDES.BOTTOM,
+      align: TOUR_STEP_ALIGNMENTS.START,
+      title: "Browse the frameworks",
+      description:
+        "Each card is a framework with your passed and total requirement counts. Continue and we'll open the first one so you can drill into its requirements.",
+    },
+  ],
+});
+
+// Step handlers are passed to `useDriverTour` at consumption time (not part of `TourDefinition`).
+// `search` resets the query so the frameworks anchor is back in the DOM (an empty result
+// set unmounts every card, including the anchored one, and breaks navigation otherwise).
+// `frameworks` is the last step: opening the card navigates to the detail route, and the
+// tour is destroyed as completed (persisted synchronously) before the grid unmounts.
+export function createViewComplianceTourStepHandlers(handlers: {
+  /** Clears the search box; returns false when no framework card will render. */
+  resetSearch: () => boolean;
+  /** Opens the first framework card's detail page. */
+  openFirstFramework: () => void;
+}): {
+  [K in ViewComplianceTourTarget]?: TourStepHandlers<ViewComplianceTourTarget>;
+} {
+  return {
+    [VIEW_COMPLIANCE_TOUR_TARGETS.SEARCH]: {
+      onNext: async ({ waitForStep }) => {
+        // No card at all → skip the wait so the tour doesn't hang; driver advances next.
+        if (!handlers.resetSearch()) return;
+        await waitForStep(VIEW_COMPLIANCE_TOUR_TARGETS.FRAMEWORKS);
+      },
+    },
+    [VIEW_COMPLIANCE_TOUR_TARGETS.FRAMEWORKS]: {
+      onNext: () => {
+        handlers.openFirstFramework();
+      },
+    },
+  };
+}
diff --git a/ui/lib/tours/view-first-scan.tour.ts b/ui/lib/tours/view-first-scan.tour.ts
new file mode 100644
index 0000000000..c6b5a00d8d
--- /dev/null
+++ b/ui/lib/tours/view-first-scan.tour.ts
@@ -0,0 +1,98 @@
+import {
+  defineTour,
+  TOUR_STEP_ALIGNMENTS,
+  TOUR_STEP_SIDES,
+  type TourDefinition,
+} from "./tour-types";
+
+// Const map keeps the union narrow so `useDriverTour` can validate step keys.
+export const VIEW_FIRST_SCAN_TOUR_TARGETS = {
+  // The first row of the active (In Progress) tab — present only while a scan runs.
+  IN_PROGRESS: "in-progress",
+  LAUNCH: "launch",
+  TABS: "tabs",
+} as const;
+
+export type ViewFirstScanTourTarget =
+  (typeof VIEW_FIRST_SCAN_TOUR_TARGETS)[keyof typeof VIEW_FIRST_SCAN_TOUR_TARGETS];
+
+const COVERS_FILES = [
+  "ui/app/(prowler)/scans/**",
+  "ui/components/scans/**",
+] as const;
+
+// v2: lands on the In Progress tab and highlights the running scan when there is one.
+const VERSION = 2;
+
+const INTRO_STEP = {
+  title: "This is Scan Jobs",
+  description:
+    "Scan Jobs is where you run and track scans against your connected providers.",
+} as const;
+
+/**
+ * Builds the tour for the scans page. When a scan is already running we anchor the
+ * In Progress row first (and mention the other tabs in copy); otherwise we fall back
+ * to highlighting Launch Scan and the tabs. Gating on `hasInProgressScan` keeps the
+ * tour from anchoring to a missing row — the same guard pattern the findings tour
+ * uses for an empty table.
+ */
+export function buildViewFirstScanTour(
+  hasInProgressScan: boolean,
+): TourDefinition<ViewFirstScanTourTarget> {
+  if (hasInProgressScan) {
+    return defineTour<ViewFirstScanTourTarget>({
+      id: "view-first-scan",
+      version: VERSION,
+      coversFiles: COVERS_FILES,
+      steps: [
+        INTRO_STEP,
+        {
+          target: "in-progress",
+          side: TOUR_STEP_SIDES.BOTTOM,
+          align: TOUR_STEP_ALIGNMENTS.START,
+          title: "Your scan is running",
+          description:
+            "Prowler is assessing your provider right now. Use the In Progress, Completed, and Scheduled tabs to follow this and other scan jobs as they progress.",
+        },
+        {
+          target: "launch",
+          side: TOUR_STEP_SIDES.BOTTOM,
+          align: TOUR_STEP_ALIGNMENTS.END,
+          title: "Launch another scan",
+          description:
+            "Click Launch Scan whenever you want to assess another connected provider. You can pick which provider and when to scan.",
+        },
+      ],
+    });
+  }
+
+  return defineTour<ViewFirstScanTourTarget>({
+    id: "view-first-scan",
+    version: VERSION,
+    coversFiles: COVERS_FILES,
+    steps: [
+      INTRO_STEP,
+      {
+        target: "launch",
+        side: TOUR_STEP_SIDES.BOTTOM,
+        align: TOUR_STEP_ALIGNMENTS.END,
+        title: "Launch a scan",
+        description:
+          "Click Launch Scan to start assessing a connected provider. You can pick which provider and when to scan.",
+      },
+      {
+        target: "tabs",
+        side: TOUR_STEP_SIDES.BOTTOM,
+        align: TOUR_STEP_ALIGNMENTS.START,
+        title: "Track your scan jobs",
+        description:
+          "Switch between these tabs to follow running, scheduled, and completed scan jobs as they progress.",
+      },
+    ],
+  });
+}
+
+// Default definition used by the onboarding registry; the scans page rebuilds it with
+// the live `hasInProgressScan` flag at render time.
+export const viewFirstScanTour = buildViewFirstScanTour(false);
diff --git a/ui/package.json b/ui/package.json
index 1c3709e9b4..2b6a20bf14 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -31,6 +31,7 @@
     "test:e2e:ui": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --ui",
     "test:unit": "vitest run --project unit",
     "test:watch": "vitest",
+    "tour:check": "node scripts/check-tour-alignment.mjs",
     "typecheck": "tsc"
   },
   "dependencies": {
@@ -85,6 +86,7 @@
     "cmdk": "1.1.1",
     "d3": "7.9.0",
     "date-fns": "4.1.0",
+    "driver.js": "1.4.0",
     "framer-motion": "11.18.2",
     "import-in-the-middle": "2.0.0",
     "js-yaml": "4.1.1",
diff --git a/ui/playwright.config.ts b/ui/playwright.config.ts
index 922fa0b125..1f878028ba 100644
--- a/ui/playwright.config.ts
+++ b/ui/playwright.config.ts
@@ -138,6 +138,12 @@ export default defineConfig({
       testMatch: "invitations.spec.ts",
       dependencies: ["admin.auth.setup"],
     },
+    // This project runs the onboarding test suite
+    {
+      name: "onboarding",
+      testMatch: "onboarding.spec.ts",
+      dependencies: ["admin.auth.setup"],
+    },
   ],
 
   webServer: {
@@ -148,6 +154,8 @@ export default defineConfig({
     env: {
       NEXT_PUBLIC_API_BASE_URL:
         process.env.NEXT_PUBLIC_API_BASE_URL || "http://localhost:8080/api/v1",
+      // Lets the onboarding suite opt into Cloud-only behavior; it skips otherwise.
+      NEXT_PUBLIC_IS_CLOUD_ENV: process.env.NEXT_PUBLIC_IS_CLOUD_ENV || "",
       AUTH_SECRET: process.env.AUTH_SECRET || "fallback-ci-secret-for-testing",
       AUTH_TRUST_HOST: process.env.AUTH_TRUST_HOST || "true",
       NEXTAUTH_URL: process.env.NEXTAUTH_URL || "http://localhost:3000",
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 4767064b4f..6a5e7bb464 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -187,6 +187,9 @@ importers:
       date-fns:
         specifier: 4.1.0
         version: 4.1.0
+      driver.js:
+        specifier: 1.4.0
+        version: 1.4.0
       framer-motion:
         specifier: 11.18.2
         version: 11.18.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
@@ -5601,6 +5604,9 @@ packages:
     resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
     engines: {node: '>=12'}
 
+  driver.js@1.4.0:
+    resolution: {integrity: sha512-Gm64jm6PmcU+si21sQhBrTAM1JvUrR0QhNmjkprNLxohOBzul9+pNHXgQaT9lW84gwg9GMLB3NZGuGolsz5uew==}
+
   dunder-proto@1.0.1:
     resolution: {integrity: sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==}
     engines: {node: '>= 0.4'}
@@ -15172,6 +15178,8 @@ snapshots:
 
   dotenv@16.6.1: {}
 
+  driver.js@1.4.0: {}
+
   dunder-proto@1.0.1:
     dependencies:
       call-bind-apply-helpers: 1.0.2
diff --git a/ui/scripts/check-tour-alignment.mjs b/ui/scripts/check-tour-alignment.mjs
new file mode 100644
index 0000000000..12863fd303
--- /dev/null
+++ b/ui/scripts/check-tour-alignment.mjs
@@ -0,0 +1,178 @@
+#!/usr/bin/env node
+// Tour alignment check (syntactic). Extracts `data-tour-id` values from every
+// `ui/lib/tours/*.tour.ts` and verifies a matching attribute exists under `ui/`,
+// in either the JSX form (`data-tour-id="..."`) or the object-property form
+// (`"data-tour-id": "..."`) used for dynamically-spread anchors. Two directions:
+//   - Tour → DOM: fails on any tour `target` with no matching attribute.
+//   - DOM → tour: warns on any `data-tour-id` not referenced by any tour
+//     (does not fail — staged anchors during multi-PR rollouts are OK).
+// Complements the semantic `prowler-tour` skill for CI/local runs without
+// invoking Claude Code.
+import { readFile, readdir } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { join, dirname, relative, resolve } from "node:path";
+
+const UI_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const TOURS_DIR = join(UI_DIR, "lib", "tours");
+const TOUR_FILE_SUFFIX = ".tour.ts";
+
+const EXCLUDED_DIRS = new Set([
+  "node_modules",
+  ".next",
+  "dist",
+  "build",
+  "coverage",
+]);
+
+async function readDirEntries(dir) {
+  try {
+    return await readdir(dir, { withFileTypes: true });
+  } catch (err) {
+    if (err && err.code === "ENOENT") return [];
+    throw err;
+  }
+}
+
+async function findTourFiles(dir) {
+  const entries = await readDirEntries(dir);
+  return entries
+    .filter((entry) => entry.isFile() && entry.name.endsWith(TOUR_FILE_SUFFIX))
+    .map((entry) => join(dir, entry.name));
+}
+
+const TOUR_ID_PATTERN = /\bid\s*:\s*["']([a-z0-9-]+)["']/m;
+const TARGET_PATTERN = /\btarget\s*:\s*["']([a-z0-9-]+)["']/g;
+
+async function parseTour(filePath) {
+  const source = await readFile(filePath, "utf8");
+  const idMatch = source.match(TOUR_ID_PATTERN);
+  if (!idMatch) {
+    throw new Error(
+      `${relative(UI_DIR, filePath)}: cannot find tour 'id' — expected a literal like \`id: "attack-paths"\``,
+    );
+  }
+  const tourId = idMatch[1];
+
+  const targets = [];
+  for (const match of source.matchAll(TARGET_PATTERN)) {
+    targets.push(match[1]);
+  }
+
+  return {
+    file: relative(UI_DIR, filePath),
+    tourId,
+    selectors: targets.map((target) => `${tourId}-${target}`),
+  };
+}
+
+async function* walk(dir) {
+  const entries = await readDirEntries(dir);
+  for (const entry of entries) {
+    if (EXCLUDED_DIRS.has(entry.name)) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      yield* walk(full);
+    } else if (entry.isFile()) {
+      yield full;
+    }
+  }
+}
+
+const ATTRIBUTE_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx"];
+
+async function collectAttributeValues() {
+  const values = new Map();
+  for await (const file of walk(UI_DIR)) {
+    if (!ATTRIBUTE_EXTENSIONS.some((ext) => file.endsWith(ext))) continue;
+    if (file.endsWith(TOUR_FILE_SUFFIX)) continue;
+    const source = await readFile(file, "utf8");
+    // Match both the JSX attribute form (`data-tour-id="x"`) and the
+    // object-property form (`"data-tour-id": "x"`) used when an anchor is spread
+    // dynamically — e.g. a table's per-row getRowAttributes returning the id.
+    const pattern = /["']?data-tour-id["']?\s*[=:]\s*["']([a-z0-9-]+)["']/g;
+    for (const match of source.matchAll(pattern)) {
+      const value = match[1];
+      const existing = values.get(value);
+      if (existing) {
+        existing.push(file);
+      } else {
+        values.set(value, [file]);
+      }
+    }
+  }
+  return values;
+}
+
+async function main() {
+  const tourFiles = await findTourFiles(TOURS_DIR);
+  if (tourFiles.length === 0) {
+    console.log("No tour files under ui/lib/tours/ — nothing to check.");
+    return;
+  }
+
+  const tours = await Promise.all(tourFiles.map(parseTour));
+  const attrValues = await collectAttributeValues();
+
+  const tourOrphans = [];
+  for (const tour of tours) {
+    for (const selector of tour.selectors) {
+      if (!attrValues.has(selector)) {
+        tourOrphans.push({ tour: tour.file, selector });
+      }
+    }
+  }
+
+  const referencedSelectors = new Set(tours.flatMap((t) => t.selectors));
+  const domOrphans = [];
+  for (const [value, files] of attrValues) {
+    if (referencedSelectors.has(value)) continue;
+    domOrphans.push({
+      value,
+      files: [...files].sort((a, b) => a.localeCompare(b)),
+    });
+  }
+  domOrphans.sort((a, b) => a.value.localeCompare(b.value));
+  tourOrphans.sort(
+    (a, b) =>
+      a.tour.localeCompare(b.tour) || a.selector.localeCompare(b.selector),
+  );
+
+  if (domOrphans.length > 0) {
+    console.warn(
+      `⚠ ${domOrphans.length} data-tour-id attribute(s) not referenced by any tour:`,
+    );
+    for (const orphan of domOrphans) {
+      const locations = orphan.files
+        .map((file) => relative(UI_DIR, file))
+        .join(", ");
+      console.warn(`  data-tour-id="${orphan.value}" — ${locations}`);
+    }
+    console.warn(
+      "  Wire it into a tour step or remove the attribute (warning only, does not fail).\n",
+    );
+  }
+
+  if (tourOrphans.length === 0) {
+    const referenced = tours.reduce((sum, t) => sum + t.selectors.length, 0);
+    console.log(
+      `✓ Tour alignment OK — ${tours.length} tour(s), ${referenced} anchored step(s).`,
+    );
+    return;
+  }
+
+  console.error("✗ Tour alignment failed.\n");
+  for (const orphan of tourOrphans) {
+    console.error(
+      `  ${orphan.tour} references data-tour-id="${orphan.selector}" but no element carries that attribute.`,
+    );
+  }
+  console.error(
+    "\nFix the drift before merging: add the attribute, fix the tour's `target`, or remove the orphan step.",
+  );
+  process.exit(1);
+}
+
+main().catch((err) => {
+  console.error(err.stack || err.message);
+  process.exit(1);
+});
diff --git a/ui/store/__tests__/onboarding-checkpoint.test.ts b/ui/store/__tests__/onboarding-checkpoint.test.ts
new file mode 100644
index 0000000000..6ac0d4be85
--- /dev/null
+++ b/ui/store/__tests__/onboarding-checkpoint.test.ts
@@ -0,0 +1,85 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+
+import {
+  CHECKPOINT_MARKER,
+  useOnboardingCheckpointStore,
+} from "../onboarding-checkpoint";
+
+describe("useOnboardingCheckpointStore", () => {
+  beforeEach(() => {
+    window.localStorage.clear();
+    useOnboardingCheckpointStore.setState({ armed: false, open: false });
+  });
+
+  afterEach(() => {
+    window.localStorage.clear();
+  });
+
+  it("starts disarmed and closed", () => {
+    const state = useOnboardingCheckpointStore.getState();
+    expect(state.armed).toBe(false);
+    expect(state.open).toBe(false);
+  });
+
+  it("arm() sets armed without opening", () => {
+    useOnboardingCheckpointStore.getState().arm();
+
+    const state = useOnboardingCheckpointStore.getState();
+    expect(state.armed).toBe(true);
+    expect(state.open).toBe(false);
+  });
+
+  it("requestOpenOnWizardClose opens only when armed, a provider connected, and not handled", () => {
+    useOnboardingCheckpointStore.getState().arm();
+
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: true });
+
+    expect(useOnboardingCheckpointStore.getState().open).toBe(true);
+  });
+
+  it("does NOT open when not armed even if a provider connected", () => {
+    // Covers established users who skipped onboarding but later add a provider.
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: true });
+
+    expect(useOnboardingCheckpointStore.getState().open).toBe(false);
+  });
+
+  it("does NOT open when armed but no provider connected (wizard closed empty)", () => {
+    useOnboardingCheckpointStore.getState().arm();
+
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: false });
+
+    expect(useOnboardingCheckpointStore.getState().open).toBe(false);
+  });
+
+  it("does NOT open when the checkpoint was already handled in this browser", () => {
+    window.localStorage.setItem(CHECKPOINT_MARKER, "true");
+    useOnboardingCheckpointStore.getState().arm();
+
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: true });
+
+    expect(useOnboardingCheckpointStore.getState().open).toBe(false);
+  });
+
+  it("close() resets open and disarms", () => {
+    useOnboardingCheckpointStore.getState().arm();
+    useOnboardingCheckpointStore
+      .getState()
+      .requestOpenOnWizardClose({ providerConnected: true });
+    expect(useOnboardingCheckpointStore.getState().open).toBe(true);
+
+    useOnboardingCheckpointStore.getState().close();
+
+    const state = useOnboardingCheckpointStore.getState();
+    expect(state.open).toBe(false);
+    expect(state.armed).toBe(false);
+  });
+});
diff --git a/ui/store/__tests__/onboarding-replay.test.ts b/ui/store/__tests__/onboarding-replay.test.ts
new file mode 100644
index 0000000000..ef4c662797
--- /dev/null
+++ b/ui/store/__tests__/onboarding-replay.test.ts
@@ -0,0 +1,62 @@
+import { beforeEach, describe, expect, it } from "vitest";
+
+import { getOrderedFlows } from "@/lib/onboarding";
+
+import { useOnboardingReplayStore } from "../onboarding-replay";
+
+// Plain (no-persist) slice — setState is sufficient to isolate tests.
+function resetStore(): void {
+  useOnboardingReplayStore.setState({ flowId: null, token: 0 });
+}
+
+describe("useOnboardingReplayStore", () => {
+  beforeEach(() => {
+    resetStore();
+  });
+
+  describe("requestReplay", () => {
+    it("sets the flow id and bumps the token for a known flow", () => {
+      const target = getOrderedFlows()[0];
+
+      useOnboardingReplayStore.getState().requestReplay(target.id);
+
+      const state = useOnboardingReplayStore.getState();
+      expect(state.flowId).toBe(target.id);
+      expect(state.token).toBe(1);
+    });
+
+    it("bumps the token again when the same flow is requested twice", () => {
+      const target = getOrderedFlows()[0];
+
+      useOnboardingReplayStore.getState().requestReplay(target.id);
+      useOnboardingReplayStore.getState().consume();
+      useOnboardingReplayStore.getState().requestReplay(target.id);
+
+      const state = useOnboardingReplayStore.getState();
+      expect(state.flowId).toBe(target.id);
+      // Monotonic token guarantees a fresh signal so the runner re-mounts.
+      expect(state.token).toBe(2);
+    });
+
+    it("is a no-op for an unknown flow id", () => {
+      useOnboardingReplayStore.getState().requestReplay("does-not-exist");
+
+      const state = useOnboardingReplayStore.getState();
+      expect(state.flowId).toBeNull();
+      expect(state.token).toBe(0);
+    });
+  });
+
+  describe("consume", () => {
+    it("clears the flow id without resetting the token", () => {
+      const target = getOrderedFlows()[0];
+      useOnboardingReplayStore.getState().requestReplay(target.id);
+
+      useOnboardingReplayStore.getState().consume();
+
+      const state = useOnboardingReplayStore.getState();
+      expect(state.flowId).toBeNull();
+      expect(state.token).toBe(1);
+    });
+  });
+});
diff --git a/ui/store/__tests__/onboarding-sequence.test.ts b/ui/store/__tests__/onboarding-sequence.test.ts
new file mode 100644
index 0000000000..96a3a64589
--- /dev/null
+++ b/ui/store/__tests__/onboarding-sequence.test.ts
@@ -0,0 +1,132 @@
+import { beforeEach, describe, expect, it } from "vitest";
+
+import { getOrderedFlows } from "@/lib/onboarding";
+
+import { useOnboardingSequenceStore } from "../onboarding-sequence";
+
+// Plain (no-persist) slice — setState is sufficient to isolate tests.
+function resetStore(): void {
+  useOnboardingSequenceStore.setState({
+    active: false,
+    currentFlowId: null,
+    mode: null,
+  });
+}
+
+describe("useOnboardingSequenceStore", () => {
+  beforeEach(() => {
+    resetStore();
+  });
+
+  describe("startSequence", () => {
+    it("starts at the first ordered flow when called with no argument", () => {
+      useOnboardingSequenceStore.getState().startSequence();
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(getOrderedFlows()[0].id);
+      expect(state.mode).toBe("sequence");
+    });
+
+    it("starts at the requested flow when given an explicit id", () => {
+      const targetId = getOrderedFlows()[0].id;
+      useOnboardingSequenceStore.getState().startSequence(targetId);
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(targetId);
+      expect(state.mode).toBe("sequence");
+    });
+  });
+
+  describe("advance", () => {
+    it("moves to the next ordered flow when the current one is not last", () => {
+      const ordered = getOrderedFlows();
+      if (ordered.length < 2) {
+        // Skip until the registry has at least two flows.
+        return;
+      }
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: ordered[0].id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().advance();
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(ordered[1].id);
+      expect(state.mode).toBe("sequence");
+    });
+
+    it("resets to inactive when advancing past the last ordered flow", () => {
+      const ordered = getOrderedFlows();
+      const lastFlow = ordered[ordered.length - 1];
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: lastFlow.id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().advance();
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(false);
+      expect(state.currentFlowId).toBeNull();
+      expect(state.mode).toBeNull();
+    });
+  });
+
+  describe("goToFlow", () => {
+    it("re-points currentFlowId to a known flow while staying active in sequence mode", () => {
+      const ordered = getOrderedFlows();
+      const target = ordered[1];
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: ordered[2].id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().goToFlow(target.id);
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(target.id);
+      expect(state.mode).toBe("sequence");
+    });
+
+    it("is a no-op for an unknown flow id", () => {
+      const ordered = getOrderedFlows();
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: ordered[0].id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().goToFlow("does-not-exist");
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(true);
+      expect(state.currentFlowId).toBe(ordered[0].id);
+      expect(state.mode).toBe("sequence");
+    });
+  });
+
+  describe("stop", () => {
+    it("resets every field to its inactive value", () => {
+      useOnboardingSequenceStore.setState({
+        active: true,
+        currentFlowId: getOrderedFlows()[0].id,
+        mode: "sequence",
+      });
+
+      useOnboardingSequenceStore.getState().stop();
+
+      const state = useOnboardingSequenceStore.getState();
+      expect(state.active).toBe(false);
+      expect(state.currentFlowId).toBeNull();
+      expect(state.mode).toBeNull();
+    });
+  });
+});
diff --git a/ui/store/__tests__/page-ready.test.ts b/ui/store/__tests__/page-ready.test.ts
new file mode 100644
index 0000000000..6fc164a116
--- /dev/null
+++ b/ui/store/__tests__/page-ready.test.ts
@@ -0,0 +1,31 @@
+import { beforeEach, describe, expect, it } from "vitest";
+
+import { usePageReadyStore } from "../page-ready";
+
+const reset = () => usePageReadyStore.setState({ readyPath: null });
+
+describe("usePageReadyStore", () => {
+  beforeEach(reset);
+
+  it("marks a route ready", () => {
+    usePageReadyStore.getState().markReady("/compliance");
+    expect(usePageReadyStore.getState().readyPath).toBe("/compliance");
+  });
+
+  it("clears readiness only when the path still matches", () => {
+    const store = usePageReadyStore.getState();
+    store.markReady("/compliance");
+    store.clearReady("/compliance");
+    expect(usePageReadyStore.getState().readyPath).toBeNull();
+  });
+
+  it("ignores a stale clear once a newer route is ready", () => {
+    const store = usePageReadyStore.getState();
+    // Fast navigation: /findings mounts and marks itself ready before the old
+    // /compliance marker's cleanup runs. The stale clear must not wipe it.
+    store.markReady("/compliance");
+    store.markReady("/findings");
+    store.clearReady("/compliance");
+    expect(usePageReadyStore.getState().readyPath).toBe("/findings");
+  });
+});
diff --git a/ui/store/onboarding-checkpoint.ts b/ui/store/onboarding-checkpoint.ts
new file mode 100644
index 0000000000..7d47ba0d94
--- /dev/null
+++ b/ui/store/onboarding-checkpoint.ts
@@ -0,0 +1,46 @@
+import { create } from "zustand";
+
+// Persisted flag that prevents the checkpoint dialog from re-appearing after it has been handled.
+export const CHECKPOINT_MARKER = "prowler.onboarding.checkpoint";
+
+function isCheckpointHandled(): boolean {
+  if (typeof window === "undefined") return false;
+  try {
+    return window.localStorage.getItem(CHECKPOINT_MARKER) !== null;
+  } catch {
+    // Fail open: unreadable storage should not block the checkpoint.
+    return false;
+  }
+}
+
+interface OnboardingCheckpointState {
+  // armed: set by the gate's "Get started"; prevents established users from seeing the dialog.
+  armed: boolean;
+  open: boolean;
+
+  arm: () => void;
+  // Opens the checkpoint only when armed, a provider was connected, and the marker is unset.
+  requestOpenOnWizardClose: (input: { providerConnected: boolean }) => void;
+  // Resets ephemeral open/armed state; the durable marker is managed by the watcher.
+  close: () => void;
+}
+
+// Ephemeral, NOT persisted: durable "already saw this" memory stays in CHECKPOINT_MARKER.
+export const useOnboardingCheckpointStore = create<OnboardingCheckpointState>(
+  (set) => ({
+    armed: false,
+    open: false,
+
+    arm: () => set({ armed: true }),
+
+    requestOpenOnWizardClose: ({ providerConnected }) =>
+      set((state) => {
+        if (state.armed && providerConnected && !isCheckpointHandled()) {
+          return { open: true };
+        }
+        return {};
+      }),
+
+    close: () => set({ open: false, armed: false }),
+  }),
+);
diff --git a/ui/store/onboarding-replay.ts b/ui/store/onboarding-replay.ts
new file mode 100644
index 0000000000..8e43296f64
--- /dev/null
+++ b/ui/store/onboarding-replay.ts
@@ -0,0 +1,34 @@
+import { create } from "zustand";
+
+import { getFlowById } from "@/lib/onboarding";
+
+interface OnboardingReplayState {
+  // Flow whose replay was requested in-memory (navbar, same route), or null.
+  flowId: string | null;
+  // Monotonic counter bumped on every request so re-clicking the same flow
+  // produces a fresh signal and the OnboardingTrigger re-mounts its runner.
+  token: number;
+
+  // Requests a replay for the given flow. No-op for unknown ids.
+  requestReplay: (flowId: string) => void;
+  // Clears flowId once the runner has started. Keeps token so the next request
+  // still advances it.
+  consume: () => void;
+}
+
+// Ephemeral, NOT persisted: a replay request must never survive a refresh.
+// Same-route replays use this in-memory signal instead of a `?onboarding=` URL
+// param, which would force a Next.js RSC refetch of the whole page.
+export const useOnboardingReplayStore = create<OnboardingReplayState>(
+  (set) => ({
+    flowId: null,
+    token: 0,
+
+    requestReplay: (flowId) => {
+      if (!getFlowById(flowId)) return;
+      set((state) => ({ flowId, token: state.token + 1 }));
+    },
+
+    consume: () => set({ flowId: null }),
+  }),
+);
diff --git a/ui/store/onboarding-sequence.ts b/ui/store/onboarding-sequence.ts
new file mode 100644
index 0000000000..4d1b4c1b4a
--- /dev/null
+++ b/ui/store/onboarding-sequence.ts
@@ -0,0 +1,71 @@
+import { create } from "zustand";
+
+import { getFlowById, getOrderedFlows } from "@/lib/onboarding";
+
+// "sequence" = slice-driven; "replay" = single-flow replay from ?onboarding= param.
+export const ONBOARDING_SEQUENCE_MODES = {
+  SEQUENCE: "sequence",
+  REPLAY: "replay",
+} as const;
+
+export type OnboardingSequenceMode =
+  (typeof ONBOARDING_SEQUENCE_MODES)[keyof typeof ONBOARDING_SEQUENCE_MODES];
+
+interface OnboardingSequenceState {
+  active: boolean;
+  currentFlowId: string | null;
+  mode: OnboardingSequenceMode | null;
+
+  startSequence: (startFlowId?: string) => void;
+  // Advances to next flow; clears state when the current flow is last.
+  advance: () => void;
+  // Jumps to a known flow. No-op for unknown ids.
+  goToFlow: (flowId: string) => void;
+  stop: () => void;
+}
+
+// Ephemeral, NOT persisted: persisting would resurrect sequences after refresh.
+// Durable completion memory stays in the per-tour localStorage TourCompletionRecord.
+export const useOnboardingSequenceStore = create<OnboardingSequenceState>(
+  (set, get) => ({
+    active: false,
+    currentFlowId: null,
+    mode: null,
+
+    startSequence: (startFlowId) => {
+      const ordered = getOrderedFlows();
+      const start = startFlowId
+        ? (getFlowById(startFlowId) ?? ordered[0])
+        : ordered[0];
+      if (!start) return;
+      set({
+        active: true,
+        currentFlowId: start.id,
+        mode: ONBOARDING_SEQUENCE_MODES.SEQUENCE,
+      });
+    },
+
+    advance: () => {
+      const { currentFlowId } = get();
+      const ordered = getOrderedFlows();
+      const idx = ordered.findIndex((flow) => flow.id === currentFlowId);
+      const next = idx >= 0 ? ordered[idx + 1] : undefined;
+      if (!next) {
+        set({ active: false, currentFlowId: null, mode: null });
+        return;
+      }
+      set({ currentFlowId: next.id });
+    },
+
+    goToFlow: (flowId) => {
+      if (!getFlowById(flowId)) return;
+      set({
+        active: true,
+        currentFlowId: flowId,
+        mode: ONBOARDING_SEQUENCE_MODES.SEQUENCE,
+      });
+    },
+
+    stop: () => set({ active: false, currentFlowId: null, mode: null }),
+  }),
+);
diff --git a/ui/store/page-ready.ts b/ui/store/page-ready.ts
new file mode 100644
index 0000000000..51b4860d80
--- /dev/null
+++ b/ui/store/page-ready.ts
@@ -0,0 +1,24 @@
+import { create } from "zustand";
+
+interface PageReadyState {
+  // The pathname whose data-fetching content is currently mounted. The replay icon
+  // in the navbar is enabled only when this matches the active route, so it stays
+  // disabled while a page is still streaming its data.
+  readyPath: string | null;
+
+  // Marks the given route as loaded (called when a page's post-Suspense content mounts).
+  markReady: (path: string) => void;
+  // Clears readiness for the given route, but only if it is still the current one —
+  // a newer page may already have marked itself ready during a fast navigation.
+  clearReady: (path: string) => void;
+}
+
+// Ephemeral, NOT persisted: readiness is a per-render signal, never durable.
+export const usePageReadyStore = create<PageReadyState>((set) => ({
+  readyPath: null,
+
+  markReady: (path) => set({ readyPath: path }),
+
+  clearReady: (path) =>
+    set((state) => (state.readyPath === path ? { readyPath: null } : {})),
+}));
diff --git a/ui/styles/globals.css b/ui/styles/globals.css
index 32391a2099..56d8dc1d9e 100644
--- a/ui/styles/globals.css
+++ b/ui/styles/globals.css
@@ -1,4 +1,8 @@
 @import "tailwindcss";
+/* All @import rules must precede @config/@source — a late @import is invalid
+ * per the CSS spec and lightningcss (Tailwind v4) silently drops it. */
+@import "./tours.css";
+
 @config "../tailwind.config.js";
 @source "../node_modules/streamdown/dist/*.js";
 
diff --git a/ui/styles/tours.css b/ui/styles/tours.css
new file mode 100644
index 0000000000..3764e606b8
--- /dev/null
+++ b/ui/styles/tours.css
@@ -0,0 +1,78 @@
+.driver-active .driver-overlay,
+.driver-active * {
+  pointer-events: none;
+}
+
+.driver-active .driver-active-element,
+.driver-active .driver-active-element *,
+.driver-popover,
+.driver-popover * {
+  pointer-events: auto;
+}
+
+@keyframes driver-fade-in {
+  0% {
+    opacity: 0;
+  }
+
+  100% {
+    opacity: 1;
+  }
+}
+
+.driver-fade .driver-overlay,
+.driver-fade .driver-popover {
+  animation: driver-fade-in 0.2s ease-in-out;
+}
+
+/* Theme layer over driver.css: keep its positioning/stage, strip the default popover
+ * chrome (background, border, padding, shadow) so the React tour card is the only
+ * visible surface. Do NOT set position/top/right here — driver.js places the popover. */
+.driver-popover.prowler-theme {
+  box-sizing: border-box;
+  margin: 0;
+  padding: 0;
+  background: transparent;
+  border: 0;
+  border-radius: 0;
+  box-shadow: none;
+  min-width: min(250px, calc(100vw - 32px));
+  max-width: min(320px, calc(100vw - 32px));
+  font-family: inherit;
+  /* Reset driver.css's hard-coded #2d2d2d so the card text follows the app theme
+   * (the card title inherits this; descriptions set their own muted token). */
+  color: var(--color-text-neutral-primary);
+}
+
+.driver-popover.prowler-theme * {
+  box-sizing: border-box;
+  font-family: inherit;
+}
+
+/* The visible popover is our React card (mounted at [data-tour-popover-root]).
+ * Keep driver.js's native chrome in the DOM (tour-popover-render reads its text and
+ * progress) but force it hidden — driver.css sets display:block/flex on these, which
+ * would otherwise override the `hidden` attribute and duplicate the card content. */
+.driver-popover.prowler-theme .driver-popover-title,
+.driver-popover.prowler-theme .driver-popover-description,
+.driver-popover.prowler-theme .driver-popover-footer,
+.driver-popover.prowler-theme .driver-popover-progress-text,
+.driver-popover.prowler-theme .driver-popover-close-btn,
+.driver-popover.prowler-theme .driver-popover-arrow {
+  display: none !important;
+}
+
+:not(body):has(> .driver-active-element) {
+  overflow: hidden !important;
+}
+
+.driver-no-interaction,
+.driver-no-interaction * {
+  pointer-events: none !important;
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .driver-popover.prowler-theme {
+    transition: none !important;
+  }
+}
diff --git a/ui/tests/onboarding/onboarding-page.ts b/ui/tests/onboarding/onboarding-page.ts
new file mode 100644
index 0000000000..979810a7d2
--- /dev/null
+++ b/ui/tests/onboarding/onboarding-page.ts
@@ -0,0 +1,259 @@
+import { Locator, Page, expect } from "@playwright/test";
+
+import { BasePage } from "../base-page";
+
+const TOUR_KEY_PREFIX = "prowler.tour";
+// Keep in sync with addProviderTour.version (lib/tours/add-provider.tour.ts).
+const ADD_PROVIDER_TOUR_VERSION = 2;
+const ADD_PROVIDER_TOUR_KEY = `${TOUR_KEY_PREFIX}.add-provider.v${ADD_PROVIDER_TOUR_VERSION}`;
+const CHECKPOINT_MARKER_KEY = "prowler.onboarding.checkpoint";
+
+// One popover per active driver.js tour; used to assert single-fire / no auto-fire.
+const DRIVER_POPOVER_SELECTOR = ".driver-popover";
+
+// POM for onboarding flows. URL assertions live here; the spec only orchestrates actions.
+// Note: the sequence store is ephemeral (no persist) — a fresh goto/reload resets it.
+export class OnboardingPage extends BasePage {
+  readonly welcomeModal: Locator;
+  readonly getStartedButton: Locator;
+  readonly skipButton: Locator;
+
+  readonly checkpointDialog: Locator;
+  readonly checkpointContinueButton: Locator;
+  readonly checkpointFinishButton: Locator;
+
+  readonly addProviderTriggerAnchor: Locator;
+  readonly providerTypeAnchor: Locator;
+
+  readonly viewFirstScanLaunchAnchor: Locator;
+  readonly viewFirstScanTabsAnchor: Locator;
+  readonly exploreFindingsFiltersAnchor: Locator;
+  readonly exploreFindingsGroupAnchor: Locator;
+  readonly exploreFindingsResourcesAnchor: Locator;
+  readonly viewComplianceFrameworksAnchor: Locator;
+  readonly viewComplianceSearchAnchor: Locator;
+  readonly attackPathsIntroAnchor: Locator;
+  readonly attackPathsScanListAnchor: Locator;
+
+  readonly accountMenuTrigger: Locator;
+  readonly productTourSubTrigger: Locator;
+
+  readonly driverPopover: Locator;
+
+  constructor(page: Page) {
+    super(page);
+
+    this.welcomeModal = page.getByRole("dialog").filter({
+      has: page.getByRole("heading", { name: /Add your first provider/i }),
+    });
+    this.getStartedButton = page.getByRole("button", { name: "Get started" });
+    this.skipButton = page.getByRole("button", { name: "Skip for now" });
+
+    this.checkpointDialog = page.getByRole("dialog").filter({
+      has: page.getByRole("heading", {
+        name: /Provider added — keep exploring\?/i,
+      }),
+    });
+    this.checkpointContinueButton = page.getByRole("button", {
+      name: "Continue the tour",
+    });
+    this.checkpointFinishButton = page.getByRole("button", {
+      name: "Finish here",
+    });
+
+    this.addProviderTriggerAnchor = page.locator(
+      '[data-tour-id="add-provider-trigger"]',
+    );
+    this.providerTypeAnchor = page.locator(
+      '[data-tour-id="add-provider-provider-type"]',
+    );
+
+    this.viewFirstScanLaunchAnchor = page.locator(
+      '[data-tour-id="view-first-scan-launch"]',
+    );
+    this.viewFirstScanTabsAnchor = page.locator(
+      '[data-tour-id="view-first-scan-tabs"]',
+    );
+    this.exploreFindingsFiltersAnchor = page.locator(
+      '[data-tour-id="explore-findings-filters"]',
+    );
+    this.exploreFindingsGroupAnchor = page.locator(
+      '[data-tour-id="explore-findings-group"]',
+    );
+    this.exploreFindingsResourcesAnchor = page.locator(
+      '[data-tour-id="explore-findings-resources"]',
+    );
+    this.viewComplianceFrameworksAnchor = page.locator(
+      '[data-tour-id="view-compliance-frameworks"]',
+    );
+    this.viewComplianceSearchAnchor = page.locator(
+      '[data-tour-id="view-compliance-search"]',
+    );
+    this.attackPathsIntroAnchor = page.locator(
+      '[data-tour-id="attack-paths-intro"]',
+    );
+    this.attackPathsScanListAnchor = page.locator(
+      '[data-tour-id="attack-paths-scan-list"]',
+    );
+
+    this.accountMenuTrigger = page.getByRole("button", {
+      name: "Account menu",
+    });
+    this.productTourSubTrigger = page.getByRole("menuitem", {
+      name: "Product tour",
+    });
+
+    this.driverPopover = page.locator(DRIVER_POPOVER_SELECTOR);
+  }
+
+  // Clears all tour records and the checkpoint marker so the gate evaluates as a fresh browser.
+  async clearOnboardingState(): Promise<void> {
+    await this.page.evaluate(
+      ({ prefix, checkpointKey }) => {
+        const keys: string[] = [];
+        for (let i = 0; i < window.localStorage.length; i++) {
+          const key = window.localStorage.key(i);
+          if (key && key.startsWith(prefix)) keys.push(key);
+        }
+        keys.forEach((key) => window.localStorage.removeItem(key));
+        window.localStorage.removeItem(checkpointKey);
+      },
+      { prefix: TOUR_KEY_PREFIX, checkpointKey: CHECKPOINT_MARKER_KEY },
+    );
+  }
+
+  // Seeds a completed record so the restart path can prove the tour re-fires anyway.
+  async seedCompletedAddProviderRecord(): Promise<void> {
+    await this.page.evaluate(
+      ({ key, version }) => {
+        window.localStorage.setItem(
+          key,
+          JSON.stringify({
+            tourId: "add-provider",
+            version,
+            state: "completed",
+            completedAt: new Date().toISOString(),
+          }),
+        );
+      },
+      { key: ADD_PROVIDER_TOUR_KEY, version: ADD_PROVIDER_TOUR_VERSION },
+    );
+  }
+
+  async openAccountMenu(): Promise<void> {
+    await this.accountMenuTrigger.click();
+  }
+
+  // Hover the sub-trigger to open the per-flow submenu.
+  async openProductTourSubmenu(): Promise<void> {
+    await this.openAccountMenu();
+    await expect(this.productTourSubTrigger).toBeVisible();
+    await this.productTourSubTrigger.hover();
+  }
+
+  tourFlowMenuItem(title: string): Locator {
+    return this.page.getByRole("menuitem", { name: title, exact: true });
+  }
+
+  async selectTourFlow(title: string): Promise<void> {
+    await this.openProductTourSubmenu();
+    const item = this.tourFlowMenuItem(title);
+    await expect(item).toBeVisible();
+    await item.click();
+  }
+
+  async clickGetStarted(): Promise<void> {
+    await this.getStartedButton.click();
+  }
+
+  async clickCheckpointContinue(): Promise<void> {
+    await this.checkpointContinueButton.click();
+  }
+
+  async clickCheckpointFinish(): Promise<void> {
+    await this.checkpointFinishButton.click();
+  }
+
+  async closeActiveTour(): Promise<void> {
+    await this.page.keyboard.press("Escape");
+  }
+
+  async verifyWelcomeModalVisible(): Promise<void> {
+    await expect(this.welcomeModal).toBeVisible();
+  }
+
+  async verifyWelcomeModalNotVisible(): Promise<void> {
+    await expect(this.welcomeModal).not.toBeVisible();
+  }
+
+  async verifyCheckpointDialogVisible(): Promise<void> {
+    await expect(this.checkpointDialog).toBeVisible();
+  }
+
+  async verifyTriggerAnchorPresent(): Promise<void> {
+    await expect(this.addProviderTriggerAnchor).toBeVisible();
+  }
+
+  async verifyAnchorsPresent(): Promise<void> {
+    await expect(this.addProviderTriggerAnchor).toBeVisible();
+    await expect(this.providerTypeAnchor).toBeVisible();
+  }
+
+  async verifyViewFirstScanAnchorPresent(): Promise<void> {
+    await expect(this.viewFirstScanLaunchAnchor).toBeVisible();
+  }
+
+  async verifyExploreFindingsAnchorPresent(): Promise<void> {
+    await expect(this.exploreFindingsFiltersAnchor).toBeVisible();
+  }
+
+  async verifyViewComplianceAnchorPresent(): Promise<void> {
+    await expect(this.viewComplianceFrameworksAnchor).toBeVisible();
+  }
+
+  async verifyAttackPathsAnchorPresent(): Promise<void> {
+    await expect(this.attackPathsIntroAnchor).toBeVisible();
+  }
+
+  // OB-E2E-006: page owns the driver; onboarding must not mount a second one.
+  async verifySingleDriverPopover(): Promise<void> {
+    await expect(this.driverPopover).toHaveCount(1);
+  }
+
+  // OB-E2E-007/004: no tour auto-fires after a reload or stop.
+  async verifyNoDriverPopover(): Promise<void> {
+    await expect(this.driverPopover).toHaveCount(0);
+  }
+
+  async verifyOnProvidersPage(): Promise<void> {
+    await this.page.waitForURL(/\/providers(\?|$)/);
+  }
+
+  async verifyOnProvidersPageWithOnboardingParam(): Promise<void> {
+    await this.page.waitForURL(/\/providers\?onboarding=add-provider/);
+  }
+
+  async verifyOnScansPage(): Promise<void> {
+    await this.page.waitForURL(/\/scans(\?|$)/);
+  }
+
+  async verifyOnFindingsPage(): Promise<void> {
+    await this.page.waitForURL(/\/findings(\?|$)/);
+  }
+
+  async verifyOnFindingsReplayPage(): Promise<void> {
+    await this.page.waitForURL(/\/findings\?onboarding=explore-findings/);
+  }
+
+  async verifyOnCompliancePage(): Promise<void> {
+    await this.page.waitForURL(/\/compliance(\?|$)/);
+  }
+
+  async verifyOnAttackPathsPage(): Promise<void> {
+    await this.page.waitForURL(/\/attack-paths/);
+  }
+
+  async verifyStillOnFindingsPage(): Promise<void> {
+    await expect(this.page).toHaveURL(/\/findings/);
+  }
+}
diff --git a/ui/tests/onboarding/onboarding.md b/ui/tests/onboarding/onboarding.md
new file mode 100644
index 0000000000..e6b2adba03
--- /dev/null
+++ b/ui/tests/onboarding/onboarding.md
@@ -0,0 +1,334 @@
+### E2E Tests: Onboarding System
+
+**Suite ID:** `OB-E2E`
+**Feature:** Extensible UI onboarding system: the guided add-provider tour, the
+cross-route guided sequence after the first provider connects, and per-flow
+manual replay from the avatar menu.
+
+> Behavioral assertions only: Welcome modal visibility, checkpoint dialog
+> visibility, navigation to each flow route, presence of the `data-tour-id`
+> anchors in the DOM, and localStorage markers. Driver.js overlay animation is
+> never asserted. Waits use `expect(...).toBeVisible()` and
+> `page.waitForURL()` — never `networkidle`.
+
+---
+
+## Test Case: `OB-E2E-001` - Mandatory new-user onboarding path
+
+**Priority:** `critical`
+
+**Tags:**
+
+- type → @e2e
+- feature → @onboarding
+
+**Description/Objective:** A zero-provider authenticated user is forced into the
+Welcome modal on first load; accepting it navigates to the add-provider flow and
+exposes the tour trigger anchor.
+
+**Preconditions:**
+
+- Admin user authentication required (`admin.auth.setup`, reused `storageState`)
+- All `prowler.tour.*` localStorage keys cleared before the test
+- The account has zero providers (existing providers removed via `deleteProviderIfExists`)
+
+### Flow Steps
+
+1. Navigate to a page inside `app/(prowler)/`
+2. Assert the Welcome modal is visible
+3. Click "Get started"
+4. Assert navigation to `/providers` (the `?onboarding=add-provider` param is consumed)
+5. Assert the `data-tour-id="add-provider-trigger"` anchor is present in the DOM
+
+### Expected Result
+
+- Welcome modal is displayed for the zero-provider user
+- Accepting navigates to the providers route
+- The add-provider trigger anchor is mounted on the providers page
+
+### Key verification points
+
+- Welcome modal visible on first authenticated load (gate forced it)
+- After accept, the URL is `/providers`
+- `[data-tour-id="add-provider-trigger"]` exists in the DOM
+
+### Notes
+
+- Maps to spec: "Zero-provider user on first authenticated load", "User accepts
+  the Welcome modal", "Every tour step target has a matching data-tour-id anchor"
+- Full execution requires the Prowler stack (API + DB + auth env). The trigger
+  anchor proves the tour surface is reachable without asserting overlay animation
+
+---
+
+## Test Case: `OB-E2E-002` - Restart onboarding from the avatar menu
+
+**Priority:** `high`
+
+**Tags:**
+
+- type → @e2e
+- feature → @onboarding
+
+**Description/Objective:** A user who already completed the tour can restart it
+from the avatar menu; the tour starts again despite the existing completion
+record.
+
+**Preconditions:**
+
+- Admin user authentication required (`admin.auth.setup`, reused `storageState`)
+- A `completed` record exists in localStorage for `add-provider`
+  (`prowler.tour.add-provider.v2`)
+
+### Flow Steps
+
+1. Navigate to a page with the user nav visible
+2. Open the avatar account menu
+3. Click "Product tour"
+4. Assert navigation to `/providers?onboarding=add-provider`
+5. Assert the `data-tour-id="add-provider-trigger"` anchor is present in the DOM
+
+### Expected Result
+
+- The restart entry navigates to the add-provider flow route with the onboarding param
+- The tour starts despite the existing completion record (no Welcome modal)
+- The add-provider trigger anchor is mounted on the providers page
+
+### Key verification points
+
+- "Product tour" entry is present in the avatar menu
+- After selecting it, the URL is `/providers?onboarding=add-provider`
+- `[data-tour-id="add-provider-trigger"]` exists in the DOM (re-trigger bypassed the completion record)
+
+### Notes
+
+- Maps to spec: "User activates the restart entry point from the avatar menu",
+  "Re-trigger works after a full page reload", "Re-trigger does not depend on
+  prior browser state"
+- Full execution requires the Prowler stack (API + DB + auth env)
+
+---
+
+## Test Case: `OB-E2E-003` - First-run guided sequence + checkpoint
+
+**Priority:** `critical`
+
+**Tags:**
+
+- type → @e2e
+- feature → @onboarding
+
+**Description/Objective:** After the first provider connects, the checkpoint
+dialog offers a guided sequence; "Continue the tour" chains through scans,
+findings, compliance, and attack paths, advancing only on tour completion.
+
+**Preconditions:**
+
+- Admin user authentication required (`admin.auth.setup`, reused `storageState`)
+- All `prowler.tour.*` keys and the `prowler.onboarding.checkpoint` marker cleared
+- A connected provider exists (a `false → true` `hasProviders` flip is reachable);
+  guarded/skipped when `E2E_AWS_PROVIDER_ACCOUNT_ID` is unset
+
+### Flow Steps
+
+1. Start zero-provider; assert the Welcome modal is visible
+2. Connect a provider (real flip via `addAWSProvider`)
+3. Assert the checkpoint dialog "Provider added — keep exploring?" is visible
+4. Click "Continue the tour"
+5. Assert `/scans` with `data-tour-id="view-first-scan-launch"` present
+6. Complete the scans tour; assert `/findings` with `explore-findings-filters`
+7. Complete; assert `/compliance` with `view-compliance-frameworks`
+8. Complete; assert `/attack-paths` with `attack-paths-intro` present
+
+### Expected Result
+
+- The checkpoint fires once on the real provider-connected flip
+- Continuing chains through each flow route in registry order
+- Each route exposes its first anchor in the DOM
+
+### Key verification points
+
+- Checkpoint dialog visible after the provider connects
+- Sequence visits `/scans → /findings → /compliance → /attack-paths`
+- The route-specific anchor is present at each step
+- `prowler.onboarding.checkpoint` marker is set after a choice
+
+### Notes
+
+- Maps to spec `onboarding-sequence`: "Checkpoint after first provider connects",
+  "Continue starts the sequence", "Next flow starts after navigating to its route"
+- Full execution requires the Prowler stack (API + DB + auth env)
+
+---
+
+## Test Case: `OB-E2E-004` - Stop the sequence at any time
+
+**Priority:** `high`
+
+**Tags:**
+
+- type → @e2e
+- feature → @onboarding
+
+**Description/Objective:** Closing any tour mid-sequence ends the sequence; no
+further flow auto-fires and a reload does not resume it.
+
+**Preconditions:**
+
+- Admin user authentication required (reused `storageState`)
+- A connected provider exists; guarded/skipped when `E2E_AWS_PROVIDER_ACCOUNT_ID` is unset
+- Tour state and checkpoint marker cleared in `beforeEach`
+
+### Flow Steps
+
+1. Start the guided sequence (continue from the checkpoint)
+2. On `/findings`, close the active tour (press Escape)
+3. Wait briefly and assert the URL is still `/findings` (no advance to `/compliance`)
+4. Reload the page
+5. Assert no tour auto-fires (no `.driver-popover` in the DOM)
+
+### Expected Result
+
+- Closing the tour stops the sequence immediately
+- No navigation to `/compliance` occurs
+- A reload does not resume the sequence
+
+### Key verification points
+
+- URL remains `/findings` after Escape (no auto-advance)
+- After reload, zero `.driver-popover` elements exist
+
+### Notes
+
+- Maps to spec `onboarding-sequence`: "Stopping any tour ends the sequence"
+- Full execution requires the Prowler stack (API + DB + auth env)
+
+---
+
+## Test Case: `OB-E2E-005` - Manual single-flow replay from the avatar menu
+
+**Priority:** `high`
+
+**Tags:**
+
+- type → @e2e
+- feature → @onboarding
+
+**Description/Objective:** The avatar "Product tour" submenu lists every flow;
+selecting one replays that single flow only and never chains into the sequence.
+
+**Preconditions:**
+
+- Admin user authentication required (reused `storageState`)
+- `completed` records seeded for the flows so the list represents replay state
+
+### Flow Steps
+
+1. Open the avatar account menu
+2. Open the "Product tour" submenu
+3. Assert all five flow titles are listed (registry order)
+4. Select "Explore your findings"
+5. Assert navigation to `/findings?onboarding=explore-findings`
+6. Assert `data-tour-id="explore-findings-filters"` present
+7. Close the tour and assert no navigation to `/compliance` (no sequence chaining)
+
+### Expected Result
+
+- The submenu lists all five flows by title
+- Selecting a flow replays it standalone with the `?onboarding=<id>` param
+- Closing the replayed tour does not advance to the next flow
+
+### Key verification points
+
+- Submenu contains `Add your first provider`, `Run your first scan`,
+  `Explore your findings`, `Check compliance`, `Visualize attack paths`
+- URL is `/findings?onboarding=explore-findings`
+- No advance to `/compliance` after closing
+
+### Notes
+
+- Maps to spec `onboarding` (MODIFIED): "Avatar entry opens an ordered list of
+  flows", "Selecting a flow replays that single flow only"
+- Full execution requires the Prowler stack (API + DB + auth env)
+
+---
+
+## Test Case: `OB-E2E-006` - Attack-paths single-fire
+
+**Priority:** `high`
+
+**Tags:**
+
+- type → @e2e
+- feature → @onboarding
+
+**Description/Objective:** On `/attack-paths` only one driver popover exists at a
+time — the page owns the driver and onboarding never mounts a second runner.
+
+**Preconditions:**
+
+- Admin user authentication required (reused `storageState`)
+- A connected provider with at least one ready scan exists; guarded/skipped when
+  `E2E_AWS_PROVIDER_ACCOUNT_ID` is unset
+
+### Flow Steps
+
+1. Navigate to `/attack-paths?onboarding=attack-paths`
+2. Wait for the attack-paths tour popover to appear
+3. Count `.driver-popover` elements in the DOM
+
+### Expected Result
+
+- Exactly one driver popover exists (no double-fire)
+
+### Key verification points
+
+- `.driver-popover` count is exactly `1`
+
+### Notes
+
+- Maps to spec `onboarding-sequence`: "Attack-Paths Single-Fire Integration"
+- Full execution requires the Prowler stack (API + DB + auth env)
+
+---
+
+## Test Case: `OB-E2E-007` - Refresh mid-sequence does not re-fire
+
+**Priority:** `high`
+
+**Tags:**
+
+- type → @e2e
+- feature → @onboarding
+
+**Description/Objective:** The sequence slice is ephemeral; a hard reload mid-tour
+resets it so no tour auto-fires, and no Welcome modal appears (provider connected).
+
+**Preconditions:**
+
+- Admin user authentication required (reused `storageState`)
+- A connected provider exists; guarded/skipped when `E2E_AWS_PROVIDER_ACCOUNT_ID` is unset
+- Tour state and checkpoint marker cleared in `beforeEach`
+
+### Flow Steps
+
+1. Start the guided sequence and land on `/scans`
+2. Hard-reload the page
+3. Assert no `.driver-popover` auto-fires
+4. Assert the Welcome modal is not visible
+
+### Expected Result
+
+- No tour auto-fires after the reload (ephemeral slice reset)
+- No Welcome modal (the provider is connected, so the gate stays closed)
+
+### Key verification points
+
+- Zero `.driver-popover` elements after reload
+- Welcome modal is not visible
+
+### Notes
+
+- Maps to spec `onboarding-sequence`: "Refresh mid-sequence does not re-fire
+  infinitely"
+- Full execution requires the Prowler stack (API + DB + auth env)
diff --git a/ui/tests/onboarding/onboarding.spec.ts b/ui/tests/onboarding/onboarding.spec.ts
new file mode 100644
index 0000000000..c86c7bc0a9
--- /dev/null
+++ b/ui/tests/onboarding/onboarding.spec.ts
@@ -0,0 +1,245 @@
+import { test } from "@playwright/test";
+
+import { addAWSProvider, deleteProviderIfExists } from "../helpers";
+import { ProvidersPage } from "../providers/providers-page";
+import { OnboardingPage } from "./onboarding-page";
+
+// Real AWS credentials for the hasProviders false→true flip; tests skip when unset.
+const accountId = process.env.E2E_AWS_PROVIDER_ACCOUNT_ID ?? "";
+const accessKey = process.env.E2E_AWS_PROVIDER_ACCESS_KEY ?? "";
+const secretKey = process.env.E2E_AWS_PROVIDER_SECRET_KEY ?? "";
+const hasAwsCredentials = Boolean(accountId && accessKey && secretKey);
+
+// Guided onboarding is a Prowler Cloud-only feature; it never mounts in OSS.
+const isCloudEnv = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
+
+test.describe("Onboarding", () => {
+  test.skip(
+    !isCloudEnv,
+    "Guided onboarding is a Prowler Cloud-only feature (NEXT_PUBLIC_IS_CLOUD_ENV != true)",
+  );
+  test.use({ storageState: "playwright/.auth/admin_user.json" });
+
+  test.describe("Mandatory new-user path", () => {
+    test.beforeEach(async ({ page }) => {
+      const providersPage = new ProvidersPage(page);
+      if (accountId) {
+        await deleteProviderIfExists(providersPage, accountId);
+      }
+
+      await providersPage.goto();
+      const onboardingPage = new OnboardingPage(page);
+      await onboardingPage.clearOnboardingState();
+    });
+
+    test(
+      "forces the Welcome modal and hands off to the add-provider tour",
+      {
+        tag: ["@critical", "@e2e", "@onboarding", "@OB-E2E-001"],
+      },
+      async ({ page }) => {
+        test.skip(
+          !accountId,
+          "E2E_AWS_PROVIDER_ACCOUNT_ID is not set; cannot guarantee a zero-provider account",
+        );
+
+        const onboardingPage = new OnboardingPage(page);
+
+        await onboardingPage.goto("/providers");
+        await onboardingPage.verifyWelcomeModalVisible();
+        await onboardingPage.clickGetStarted();
+        await onboardingPage.verifyOnProvidersPage();
+        await onboardingPage.verifyTriggerAnchorPresent();
+      },
+    );
+  });
+
+  test.describe("Restart path", () => {
+    test.beforeEach(async ({ page }) => {
+      const onboardingPage = new OnboardingPage(page);
+      await onboardingPage.goto("/providers");
+      await onboardingPage.seedCompletedAddProviderRecord();
+    });
+
+    test(
+      "restarts the tour from the avatar menu despite a completion record",
+      {
+        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-002"],
+      },
+      async ({ page }) => {
+        const onboardingPage = new OnboardingPage(page);
+
+        await onboardingPage.goto("/providers");
+        await onboardingPage.selectTourFlow("Add your first provider");
+        await onboardingPage.verifyOnProvidersPageWithOnboardingParam();
+        await onboardingPage.verifyTriggerAnchorPresent();
+      },
+    );
+  });
+
+  test.describe("Guided sequence", () => {
+    test.beforeEach(async ({ page }) => {
+      const providersPage = new ProvidersPage(page);
+      if (accountId) {
+        await deleteProviderIfExists(providersPage, accountId);
+      }
+      await providersPage.goto();
+      const onboardingPage = new OnboardingPage(page);
+      await onboardingPage.clearOnboardingState();
+    });
+
+    test(
+      "runs the first-run sequence after the checkpoint and chains every flow",
+      {
+        tag: ["@critical", "@e2e", "@onboarding", "@OB-E2E-003"],
+      },
+      async ({ page }) => {
+        test.skip(
+          !hasAwsCredentials,
+          "E2E AWS provider credentials are not set; cannot drive a real hasProviders flip",
+        );
+
+        const onboardingPage = new OnboardingPage(page);
+
+        await onboardingPage.goto("/providers");
+        await onboardingPage.verifyWelcomeModalVisible();
+
+        // Connect a provider to drive the genuine hasProviders false→true flip.
+        await addAWSProvider(page, accountId, accessKey, secretKey);
+
+        await onboardingPage.verifyCheckpointDialogVisible();
+        await onboardingPage.clickCheckpointContinue();
+
+        await onboardingPage.verifyOnScansPage();
+        await onboardingPage.verifyViewFirstScanAnchorPresent();
+        await onboardingPage.closeActiveTour();
+
+        await onboardingPage.verifyExploreFindingsAnchorPresent();
+
+        await onboardingPage.goto("/compliance");
+        await onboardingPage.verifyViewComplianceAnchorPresent();
+        await onboardingPage.goto("/attack-paths");
+        await onboardingPage.verifyAttackPathsAnchorPresent();
+      },
+    );
+
+    test(
+      "stops the sequence when a tour is closed and does not resume on reload",
+      {
+        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-004"],
+      },
+      async ({ page }) => {
+        test.skip(
+          !hasAwsCredentials,
+          "E2E AWS provider credentials are not set; cannot drive the guided sequence",
+        );
+
+        const onboardingPage = new OnboardingPage(page);
+
+        await onboardingPage.goto("/providers");
+        await addAWSProvider(page, accountId, accessKey, secretKey);
+        await onboardingPage.verifyCheckpointDialogVisible();
+        await onboardingPage.clickCheckpointContinue();
+
+        await onboardingPage.verifyOnScansPage();
+        await onboardingPage.closeActiveTour();
+        await onboardingPage.verifyExploreFindingsAnchorPresent();
+        await onboardingPage.closeActiveTour();
+
+        // Closing the tour stops the sequence — no auto-advance to compliance.
+        await onboardingPage.verifyStillOnFindingsPage();
+
+        // Ephemeral sequence must not resume after a hard reload.
+        await onboardingPage.refresh();
+        await onboardingPage.verifyNoDriverPopover();
+      },
+    );
+
+    test(
+      "does not re-fire after a hard reload mid-sequence",
+      {
+        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-007"],
+      },
+      async ({ page }) => {
+        test.skip(
+          !hasAwsCredentials,
+          "E2E AWS provider credentials are not set; cannot drive the guided sequence",
+        );
+
+        const onboardingPage = new OnboardingPage(page);
+
+        await onboardingPage.goto("/providers");
+        await addAWSProvider(page, accountId, accessKey, secretKey);
+        await onboardingPage.verifyCheckpointDialogVisible();
+        await onboardingPage.clickCheckpointContinue();
+        await onboardingPage.verifyOnScansPage();
+
+        // Hard reload resets the ephemeral slice; provider is connected so the gate stays silent.
+        await onboardingPage.refresh();
+        await onboardingPage.verifyNoDriverPopover();
+        await onboardingPage.verifyWelcomeModalNotVisible();
+      },
+    );
+  });
+
+  test.describe("Manual replay", () => {
+    test.beforeEach(async ({ page }) => {
+      const onboardingPage = new OnboardingPage(page);
+      await onboardingPage.goto("/providers");
+      await onboardingPage.seedCompletedAddProviderRecord();
+    });
+
+    test(
+      "replays a single flow from the avatar submenu without chaining",
+      {
+        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-005"],
+      },
+      async ({ page }) => {
+        const onboardingPage = new OnboardingPage(page);
+
+        await onboardingPage.goto("/providers");
+        await onboardingPage.openProductTourSubmenu();
+        for (const title of [
+          "Add your first provider",
+          "Run your first scan",
+          "Explore your findings",
+          "Check compliance",
+          "Visualize attack paths",
+        ]) {
+          await onboardingPage.verifyElementVisible(
+            onboardingPage.tourFlowMenuItem(title),
+          );
+        }
+
+        await onboardingPage.tourFlowMenuItem("Explore your findings").click();
+        await onboardingPage.verifyOnFindingsReplayPage();
+        await onboardingPage.verifyExploreFindingsAnchorPresent();
+
+        // Replay must not chain to the next flow on close.
+        await onboardingPage.closeActiveTour();
+        await onboardingPage.verifyStillOnFindingsPage();
+      },
+    );
+  });
+
+  test.describe("Attack-paths single-fire", () => {
+    test(
+      "renders exactly one driver popover on the attack-paths route",
+      {
+        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-006"],
+      },
+      async ({ page }) => {
+        test.skip(
+          !hasAwsCredentials,
+          "E2E AWS provider credentials are not set; attack-paths needs a ready scan",
+        );
+
+        const onboardingPage = new OnboardingPage(page);
+
+        await onboardingPage.goto("/attack-paths?onboarding=attack-paths");
+        await onboardingPage.verifyOnAttackPathsPage();
+        await onboardingPage.verifySingleDriverPopover();
+      },
+    );
+  });
+});

From 24e3182329a65b175a62d63183053c70ee36a00a Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Mon, 15 Jun 2026 15:22:47 +0200
Subject: [PATCH 035/126] fix(ui): remove onboarding changelog entry (#11593)

---
 ui/CHANGELOG.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index dbf87d055e..ede3aedff4 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -25,7 +25,6 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 - DISA Okta IDaaS STIG V1R2 compliance framework support with its dedicated mapper, details panel, and icon [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
 - DORA compliance framework support [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
-- Guided product onboarding for new users — step-by-step tours covering providers, scans, findings, compliance, and attack paths, replayable anytime from the info icon in the page header [(#11430)](https://github.com/prowler-cloud/prowler/pull/11430)
 
 ### 🔄 Changed
 

From 3cb360e9aea9a5dfd81588c1623b50ef773e108f Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Mon, 15 Jun 2026 15:31:24 +0200
Subject: [PATCH 036/126] chore(docker): pin dependencies (#11292)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Pepe Fagoaga <pepe@prowler.com>
---
 contrib/aws/multi-account-securityhub/Dockerfile       | 2 +-
 contrib/reverse-proxy/docker-compose.reverse-proxy.yml | 2 +-
 docker-compose-dev.yml                                 | 8 ++++----
 docker-compose.yml                                     | 8 ++++----
 mcp_server/Dockerfile                                  | 4 ++--
 5 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/contrib/aws/multi-account-securityhub/Dockerfile b/contrib/aws/multi-account-securityhub/Dockerfile
index 1cc6c326b7..de5c57ba7b 100644
--- a/contrib/aws/multi-account-securityhub/Dockerfile
+++ b/contrib/aws/multi-account-securityhub/Dockerfile
@@ -1,7 +1,7 @@
 # Build command
 # docker build --platform=linux/amd64  --no-cache -t prowler:latest .
 
-ARG PROWLER_VERSION=latest
+ARG PROWLER_VERSION=latest@sha256:4b796c6df40a3350c7947747b59bdda230d0da6222287500e13b0a8e1574aad4
 
 FROM toniblyx/prowler:${PROWLER_VERSION}
 
diff --git a/contrib/reverse-proxy/docker-compose.reverse-proxy.yml b/contrib/reverse-proxy/docker-compose.reverse-proxy.yml
index 08c52f3558..b8f8edec30 100644
--- a/contrib/reverse-proxy/docker-compose.reverse-proxy.yml
+++ b/contrib/reverse-proxy/docker-compose.reverse-proxy.yml
@@ -16,7 +16,7 @@
 
 services:
   nginx:
-    image: nginx:alpine
+    image: nginx:alpine@sha256:8b1e78743a03dbb2c95171cc58639fef29abc8816598e27fb910ed2e621e589a
     container_name: prowler-nginx
     restart: unless-stopped
     ports:
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index 522aaf5413..f68bf9dcc3 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -1,6 +1,6 @@
 services:
   api-dev-init:
-    image: busybox:1.37.0
+    image: busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
     volumes:
       - ./_data/api:/data
     command: ["sh", "-c", "chown -R 1000:1000 /data"]
@@ -64,7 +64,7 @@ services:
         condition: service_healthy
 
   postgres:
-    image: postgres:16.3-alpine3.20
+    image: postgres:16.3-alpine3.20@sha256:36ed71227ae36305d26382657c0b96cbaf298427b3f1eaeb10d77a6dea3eec41
     hostname: "postgres-db"
     volumes:
       - ./_data/postgres:/var/lib/postgresql/data
@@ -88,7 +88,7 @@ services:
       retries: 5
 
   valkey:
-    image: valkey/valkey:7-alpine3.19
+    image: valkey/valkey:7-alpine3.19@sha256:4054fe7fc607b9326ac7c4691ed26e9670d2ff17a9fb28c2577adecf928acbcc
     hostname: "valkey"
     volumes:
       - ./_data/valkey:/data
@@ -104,7 +104,7 @@ services:
       retries: 3
 
   neo4j:
-    image: graphstack/dozerdb:5.26.3.0
+    image: graphstack/dozerdb:5.26.3.0@sha256:a77526ea3918fdc46d1fff70c4aea7d71d3874a26ecec059179d6775845b1247
     hostname: "neo4j"
     volumes:
       - ./_data/neo4j:/data
diff --git a/docker-compose.yml b/docker-compose.yml
index 1519946afd..0ce78cbf1f 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -6,7 +6,7 @@
 #
 services:
   api-init:
-    image: busybox:1.37.0
+    image: busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
     volumes:
       - ./_data/api:/data
     command: ["sh", "-c", "chown -R 1000:1000 /data"]
@@ -60,7 +60,7 @@ services:
       start_period: 60s
 
   postgres:
-    image: postgres:16.3-alpine3.20
+    image: postgres:16.3-alpine3.20@sha256:36ed71227ae36305d26382657c0b96cbaf298427b3f1eaeb10d77a6dea3eec41
     hostname: "postgres-db"
     volumes:
       - ./_data/postgres:/var/lib/postgresql/data
@@ -80,7 +80,7 @@ services:
       retries: 5
 
   valkey:
-    image: valkey/valkey:7-alpine3.19
+    image: valkey/valkey:7-alpine3.19@sha256:4054fe7fc607b9326ac7c4691ed26e9670d2ff17a9fb28c2577adecf928acbcc
     hostname: "valkey"
     volumes:
       - ./_data/valkey:/data
@@ -96,7 +96,7 @@ services:
       retries: 3
 
   neo4j:
-    image: graphstack/dozerdb:5.26.3.0
+    image: graphstack/dozerdb:5.26.3.0@sha256:a77526ea3918fdc46d1fff70c4aea7d71d3874a26ecec059179d6775845b1247
     hostname: "neo4j"
     volumes:
       - ./_data/neo4j:/data
diff --git a/mcp_server/Dockerfile b/mcp_server/Dockerfile
index d8377a1762..c2759b20de 100644
--- a/mcp_server/Dockerfile
+++ b/mcp_server/Dockerfile
@@ -1,7 +1,7 @@
 # =============================================================================
 # Build stage - Install dependencies and build the application
 # =============================================================================
-FROM ghcr.io/astral-sh/uv:python3.13-alpine@sha256:8f53782bb232ab0b5558f3071e86e2bbfde884e18815f2b19cc57f2d336e9ee2 AS builder
+FROM ghcr.io/astral-sh/uv:0.11.21-python3.13-alpine3.23@sha256:f09cc61ffc001f202701fdeae14dbdd50f6ca4cfcf248f41fd3234a302c8534f AS builder
 
 WORKDIR /app
 
@@ -25,7 +25,7 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 # =============================================================================
 # Final stage - Minimal runtime environment
 # =============================================================================
-FROM python:3.13-alpine@sha256:bb1f2fdb1065c85468775c9d680dcd344f6442a2d1181ef7916b60a623f11d40
+FROM python:3.13.14-alpine3.23@sha256:b0513989fa9be54569cac73f48a60320b74bb0f9ffa886568eea7e48a2432c04
 
 LABEL maintainer="https://github.com/prowler-cloud"
 

From 566167489b4d824465b25dab6a422372afd6f73a Mon Sep 17 00:00:00 2001
From: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com>
Date: Mon, 15 Jun 2026 16:59:44 +0200
Subject: [PATCH 037/126] fix(sdk): patch container CVEs and suppress unfixable
 bookworm criticals (#11592)

---
 .github/actions/trivy-scan/action.yml |  4 +-
 .trivyignore                          | 53 +++++++++++++++++++++++++++
 Dockerfile                            |  4 +-
 api/CHANGELOG.md                      |  8 ++++
 api/Dockerfile                        |  2 +-
 prowler/CHANGELOG.md                  |  4 ++
 6 files changed, 70 insertions(+), 5 deletions(-)
 create mode 100644 .trivyignore

diff --git a/.github/actions/trivy-scan/action.yml b/.github/actions/trivy-scan/action.yml
index 9073e2fbcb..45034ddd6a 100644
--- a/.github/actions/trivy-scan/action.yml
+++ b/.github/actions/trivy-scan/action.yml
@@ -63,7 +63,7 @@ runs:
         exit-code: '0'
         scanners: 'vuln'
         timeout: '5m'
-        version: 'v0.69.2'
+        version: 'v0.71.0'
 
     - name: Run Trivy vulnerability scan (SARIF)
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
@@ -76,7 +76,7 @@ runs:
         exit-code: '0'
         scanners: 'vuln'
         timeout: '5m'
-        version: 'v0.69.2'
+        version: 'v0.71.0'
 
     - name: Upload Trivy results to GitHub Security tab
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000000..c9fcc7efbf
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,53 @@
+# Trivy ignore file for prowlercloud/prowler SDK container image.
+# Each entry below documents (a) the affected package and why it ships in the
+# image, (b) why the CVE is not exploitable in Prowler's runtime, and (c) the
+# upstream fix status. Entries carry an expiry so they auto-force re-review.
+# Entries are scoped per-package so suppressions cannot drift onto unrelated
+# packages that may be assigned the same CVE in the future.
+#
+# Scanned by: .github/actions/trivy-scan via .github/workflows/sdk-container-checks.yml
+
+# CVE-2026-42496 — perl-archive-tar path traversal via crafted symlinks.
+# CVE-2026-8376  — perl heap buffer overflow when compiling regex.
+# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
+# Why ignored: perl-base is part of Debian's "Essential: yes" set; it cannot be
+# removed without breaking dpkg. The Prowler SDK does not invoke perl at runtime;
+# neither vulnerable code path (Archive::Tar parsing or regex compilation of
+# attacker-controlled input) is reachable from Prowler. No Debian bookworm fix
+# is available yet.
+CVE-2026-42496 pkg:perl exp:2026-07-15
+CVE-2026-42496 pkg:perl-base exp:2026-07-15
+CVE-2026-42496 pkg:perl-modules-5.36 exp:2026-07-15
+CVE-2026-42496 pkg:libperl5.36 exp:2026-07-15
+CVE-2026-8376 pkg:perl exp:2026-07-15
+CVE-2026-8376 pkg:perl-base exp:2026-07-15
+CVE-2026-8376 pkg:perl-modules-5.36 exp:2026-07-15
+CVE-2026-8376 pkg:libperl5.36 exp:2026-07-15
+
+# CVE-2025-7458 — SQLite integer overflow.
+# Package: libsqlite3-0.
+# Why ignored: transitive dependency of CPython's stdlib sqlite3 module. The
+# Prowler SDK does not open user-supplied SQLite databases; SQLite usage is
+# internal and bounded. No Debian bookworm fix is available.
+CVE-2025-7458 pkg:libsqlite3-0 exp:2026-07-15
+
+# CVE-2026-43185 — Linux kernel ksmbd signedness bug.
+# Package: linux-libc-dev.
+# Why ignored: linux-libc-dev ships kernel headers for build-time compilation,
+# not a running kernel. Containers execute against the host kernel, so these
+# headers are inert at runtime. The upstream fix landed in kernel 7.0-rc2 and
+# has not been backported to Debian's 6.1 LTS line.
+CVE-2026-43185 pkg:linux-libc-dev exp:2026-07-15
+
+# CVE-2023-45853 — zlib MiniZip integer overflow / heap overflow in
+# zipOpenNewFileInZip4_64.
+# Packages: zlib1g, zlib1g-dev.
+# Why ignored: Debian Security Tracker status for bookworm is <ignored>, with
+# the published rationale "contrib/minizip not built and src:zlib not producing
+# binary packages" — i.e. the vulnerable symbol is not present in the libz.so
+# shipped by Debian. Real-not-affected, not unpatched. Upstream fix is in
+# zlib 1.3.1, available in Debian trixie (13); migrating the base image would
+# clear it fully.
+# Ref: https://security-tracker.debian.org/tracker/CVE-2023-45853
+CVE-2023-45853 pkg:zlib1g exp:2026-07-15
+CVE-2023-45853 pkg:zlib1g-dev exp:2026-07-15
diff --git a/Dockerfile b/Dockerfile
index 0ab4458fad..678cb2b36f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7 AS build
+FROM python:3.12.13-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
@@ -6,7 +6,7 @@ LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
 ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 
-ARG TRIVY_VERSION=0.70.0
+ARG TRIVY_VERSION=0.71.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index cc86538823..4eec1e74ef 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
+## [1.32.0] (Prowler UNRELEASED)
+
+### 🔐 Security
+
+- `trivy` binary bumped to 0.71.0 patching embedded `golang.org/x/crypto`, `golang.org/x/net`, and Go `stdlib` CVEs [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
+
+---
+
 ## [1.31.1] (Prowler v5.30.1)
 
 ### 🐞 Fixed
diff --git a/api/Dockerfile b/api/Dockerfile
index 259492cb08..df56d8ec1e 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -5,7 +5,7 @@ LABEL maintainer="https://github.com/prowler-cloud/api"
 ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 
-ARG TRIVY_VERSION=0.70.0
+ARG TRIVY_VERSION=0.71.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 7d058a6be0..c8de54e740 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -18,6 +18,10 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 - Replaced the unmaintained `awsipranges` dependency with a small standard-library helper for the `route53_dangling_ip_subdomain_takeover` check [(#9293)](https://github.com/prowler-cloud/prowler/pull/9293)
 
+### 🔐 Security
+
+- Container base image bumped to `python:3.12.13-slim-bookworm` (patches `libgnutls30` CVE-2026-33845 and CVE-2026-42010) and `trivy` bumped to 0.71.0 (patches embedded `golang.org/x/crypto` and Go stdlib CVEs); `.trivyignore` documents remaining bookworm criticals with no-fix or not-affected rationale [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
+
 ---
 
 ## [5.30.0] (Prowler v5.30.0)

From e5bbffd47c2b4c347f9858f70e07c46f46d1b33e Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Mon, 15 Jun 2026 17:19:40 +0200
Subject: [PATCH 038/126] fix(ui): exclude onboarding e2e from oss (#11597)

---
 ui/playwright.config.ts | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/ui/playwright.config.ts b/ui/playwright.config.ts
index 1f878028ba..922fa0b125 100644
--- a/ui/playwright.config.ts
+++ b/ui/playwright.config.ts
@@ -138,12 +138,6 @@ export default defineConfig({
       testMatch: "invitations.spec.ts",
       dependencies: ["admin.auth.setup"],
     },
-    // This project runs the onboarding test suite
-    {
-      name: "onboarding",
-      testMatch: "onboarding.spec.ts",
-      dependencies: ["admin.auth.setup"],
-    },
   ],
 
   webServer: {
@@ -154,8 +148,6 @@ export default defineConfig({
     env: {
       NEXT_PUBLIC_API_BASE_URL:
         process.env.NEXT_PUBLIC_API_BASE_URL || "http://localhost:8080/api/v1",
-      // Lets the onboarding suite opt into Cloud-only behavior; it skips otherwise.
-      NEXT_PUBLIC_IS_CLOUD_ENV: process.env.NEXT_PUBLIC_IS_CLOUD_ENV || "",
       AUTH_SECRET: process.env.AUTH_SECRET || "fallback-ci-secret-for-testing",
       AUTH_TRUST_HOST: process.env.AUTH_TRUST_HOST || "true",
       NEXTAUTH_URL: process.env.NEXTAUTH_URL || "http://localhost:3000",

From 36fe48dbc56581d3a61d780f091cb1ef02a6c569 Mon Sep 17 00:00:00 2001
From: Davidm4r <david.copo@gmail.com>
Date: Mon, 15 Jun 2026 18:24:55 +0200
Subject: [PATCH 039/126] fix(api): patch dependency and container CVEs
 (#11596)

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .trivyignore         |  32 +++++++
 api/CHANGELOG.md     |   2 +
 api/Dockerfile       |   2 +-
 api/pyproject.toml   |  10 +--
 api/uv.lock          | 155 +++++++++++++++-----------------
 prowler/CHANGELOG.md |   1 +
 pyproject.toml       |  16 ++--
 uv.lock              | 208 +++++++++++++++++++++++--------------------
 8 files changed, 232 insertions(+), 194 deletions(-)

diff --git a/.trivyignore b/.trivyignore
index c9fcc7efbf..117925354f 100644
--- a/.trivyignore
+++ b/.trivyignore
@@ -51,3 +51,35 @@ CVE-2026-43185 pkg:linux-libc-dev exp:2026-07-15
 # Ref: https://security-tracker.debian.org/tracker/CVE-2023-45853
 CVE-2023-45853 pkg:zlib1g exp:2026-07-15
 CVE-2023-45853 pkg:zlib1g-dev exp:2026-07-15
+
+# --- API container image (api/Dockerfile) ---
+# The entries below are specific to the Prowler API image, which ships
+# PowerShell and additional build tooling on top of the same bookworm base.
+
+# CVE-2026-7210 — CPython/Expat hash-flooding denial of service in
+# `xml.parsers.expat` and `xml.etree.ElementTree`.
+# Packages: the Debian system Python 3.11 (python3.11*, libpython3.11*).
+# Why ignored: the API runs under the Python 3.12 interpreter shipped in its
+# `.venv`; the system `python3.11` is only present because `python3-dev` is
+# pulled in to compile native extensions (xmlsec, lxml) and is never executed
+# at runtime. The vulnerable path requires parsing attacker-controlled XML with
+# the affected interpreter, which Prowler does not do with the system Python.
+# Full mitigation also needs libexpat >= 2.8.0; no Debian bookworm fix yet.
+CVE-2026-7210 pkg:python3.11 exp:2026-07-15
+CVE-2026-7210 pkg:python3.11-dev exp:2026-07-15
+CVE-2026-7210 pkg:python3.11-minimal exp:2026-07-15
+CVE-2026-7210 pkg:libpython3.11 exp:2026-07-15
+CVE-2026-7210 pkg:libpython3.11-dev exp:2026-07-15
+CVE-2026-7210 pkg:libpython3.11-minimal exp:2026-07-15
+CVE-2026-7210 pkg:libpython3.11-stdlib exp:2026-07-15
+
+# CVE-2026-33278 — Unbound DNSSEC validator use-after-free (DoS, possible RCE).
+# CVE-2026-42960 — Unbound DNS cache poisoning via promiscuous additional records.
+# Package: libunbound8.
+# Why ignored: libunbound8 is a transitive apt dependency of the TLS/networking
+# stack (GnuTLS DANE support); only the shared library ships in the image. Both
+# vulnerabilities require operating a live Unbound recursive DNSSEC validator
+# that processes attacker-influenced DNS responses. Prowler never starts an
+# Unbound resolver, so neither code path is reachable. No Debian bookworm fix yet.
+CVE-2026-33278 pkg:libunbound8 exp:2026-07-15
+CVE-2026-42960 pkg:libunbound8 exp:2026-07-15
diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 4eec1e74ef..6fa66193e3 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -6,6 +6,8 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ### 🔐 Security
 
+- `aiohttp` to 3.14.0 and `idna` to 3.15, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
+- Container base image to `python:3.12.13-slim-bookworm` and `trivy` to 0.71.0, patching OS and Go module CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
 - `trivy` binary bumped to 0.71.0 patching embedded `golang.org/x/crypto`, `golang.org/x/net`, and Go `stdlib` CVEs [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
 
 ---
diff --git a/api/Dockerfile b/api/Dockerfile
index df56d8ec1e..bb9da0b280 100644
--- a/api/Dockerfile
+++ b/api/Dockerfile
@@ -1,4 +1,4 @@
-FROM python:3.12.10-slim-bookworm@sha256:fd95fa221297a88e1cf49c55ec1828edd7c5a428187e67b5d1805692d11588db AS build
+FROM python:3.12.13-slim-bookworm@sha256:76d4b7b6305788c6b4c6a19d6a22a3921bf802e9af4d5e1e5bd771208dba74bf AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/api"
 
diff --git a/api/pyproject.toml b/api/pyproject.toml
index 2b34eb6e19..521d496e5b 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -79,7 +79,7 @@ constraint-dependencies = [
   "aiobotocore==2.25.1",
   "aiofiles==24.1.0",
   "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.13.5",
+  "aiohttp==3.14.0",
   "aioitertools==0.13.0",
   "aiosignal==1.4.0",
   "alibabacloud-actiontrail20200706==2.4.1",
@@ -124,7 +124,7 @@ constraint-dependencies = [
   "astroid==3.2.4",
   "async-timeout==5.0.1",
   "attrs==25.4.0",
-  "authlib==1.6.9",
+  "authlib==1.6.12",
   "autopep8==2.3.2",
   "awsipranges==0.3.3",
   "azure-cli-core==2.83.0",
@@ -263,7 +263,7 @@ constraint-dependencies = [
   "humanfriendly==10.0",
   "hyperframe==6.1.0",
   "iamdata==0.1.202602021",
-  "idna==3.11",
+  "idna==3.15",
   "importlib-metadata==8.7.1",
   "inflection==0.5.1",
   "iniconfig==2.3.0",
@@ -315,7 +315,7 @@ constraint-dependencies = [
   "neo4j==6.1.0",
   "nest-asyncio==1.6.0",
   "nltk==3.9.4",
-  "numpy==2.0.2",
+  "numpy==2.2.6",
   "oauthlib==3.3.1",
   "oci==2.169.0",
   "openai==1.109.1",
@@ -344,7 +344,7 @@ constraint-dependencies = [
   "psutil==7.2.2",
   "psycopg2-binary==2.9.9",
   "py-deviceid==0.1.1",
-  "py-iam-expand==0.1.0",
+  "py-iam-expand==0.3.0",
   "py-ocsf-models==0.8.1",
   "pyasn1==0.6.3",
   "pyasn1-modules==0.4.2",
diff --git a/api/uv.lock b/api/uv.lock
index d36993b516..921cc70390 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -16,7 +16,7 @@ constraints = [
     { name = "aiobotocore", specifier = "==2.25.1" },
     { name = "aiofiles", specifier = "==24.1.0" },
     { name = "aiohappyeyeballs", specifier = "==2.6.1" },
-    { name = "aiohttp", specifier = "==3.13.5" },
+    { name = "aiohttp", specifier = "==3.14.0" },
     { name = "aioitertools", specifier = "==0.13.0" },
     { name = "aiosignal", specifier = "==1.4.0" },
     { name = "alibabacloud-actiontrail20200706", specifier = "==2.4.1" },
@@ -61,7 +61,7 @@ constraints = [
     { name = "astroid", specifier = "==3.2.4" },
     { name = "async-timeout", specifier = "==5.0.1" },
     { name = "attrs", specifier = "==25.4.0" },
-    { name = "authlib", specifier = "==1.6.9" },
+    { name = "authlib", specifier = "==1.6.12" },
     { name = "autopep8", specifier = "==2.3.2" },
     { name = "awsipranges", specifier = "==0.3.3" },
     { name = "azure-cli-core", specifier = "==2.83.0" },
@@ -200,7 +200,7 @@ constraints = [
     { name = "humanfriendly", specifier = "==10.0" },
     { name = "hyperframe", specifier = "==6.1.0" },
     { name = "iamdata", specifier = "==0.1.202602021" },
-    { name = "idna", specifier = "==3.11" },
+    { name = "idna", specifier = "==3.15" },
     { name = "importlib-metadata", specifier = "==8.7.1" },
     { name = "inflection", specifier = "==0.5.1" },
     { name = "iniconfig", specifier = "==2.3.0" },
@@ -252,7 +252,7 @@ constraints = [
     { name = "neo4j", specifier = "==6.1.0" },
     { name = "nest-asyncio", specifier = "==1.6.0" },
     { name = "nltk", specifier = "==3.9.4" },
-    { name = "numpy", specifier = "==2.0.2" },
+    { name = "numpy", specifier = "==2.2.6" },
     { name = "oauthlib", specifier = "==3.3.1" },
     { name = "oci", specifier = "==2.169.0" },
     { name = "openai", specifier = "==1.109.1" },
@@ -281,7 +281,7 @@ constraints = [
     { name = "psutil", specifier = "==7.2.2" },
     { name = "psycopg2-binary", specifier = "==2.9.9" },
     { name = "py-deviceid", specifier = "==0.1.1" },
-    { name = "py-iam-expand", specifier = "==0.1.0" },
+    { name = "py-iam-expand", specifier = "==0.3.0" },
     { name = "py-ocsf-models", specifier = "==0.8.1" },
     { name = "pyasn1", specifier = "==0.6.3" },
     { name = "pyasn1-modules", specifier = "==0.4.2" },
@@ -469,7 +469,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.13.5"
+version = "3.14.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -478,44 +478,47 @@ dependencies = [
     { name = "frozenlist" },
     { name = "multidict" },
     { name = "propcache" },
+    { name = "typing-extensions" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/77/9a/152096d4808df8e4268befa55fba462f440f14beab85e8ad9bf990516918/aiohttp-3.13.5.tar.gz", hash = "sha256:9d98cc980ecc96be6eb4c1994ce35d28d8b1f5e5208a23b421187d1209dbb7d1", size = 7858271, upload-time = "2026-03-31T22:01:03.343Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/ab/93ce242f899b68c51b0578c027aafa791ab3614cb9345fa5d37b5f5c8e3e/aiohttp-3.14.0.tar.gz", hash = "sha256:2882de819734c715fd1b9c11c97e09fa020d14438203d1d354d8ed1702791c9b", size = 7940674, upload-time = "2026-06-01T19:41:02.763Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d6/f5/a20c4ac64aeaef1679e25c9983573618ff765d7aa829fa2b84ae7573169e/aiohttp-3.13.5-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7ab7229b6f9b5c1ba4910d6c41a9eb11f543eadb3f384df1b4c293f4e73d44d6", size = 757513, upload-time = "2026-03-31T21:57:02.146Z" },
-    { url = "https://files.pythonhosted.org/packages/75/0a/39fa6c6b179b53fcb3e4b3d2b6d6cad0180854eda17060c7218540102bef/aiohttp-3.13.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:8f14c50708bb156b3a3ca7230b3d820199d56a48e3af76fa21c2d6087190fe3d", size = 506748, upload-time = "2026-03-31T21:57:04.275Z" },
-    { url = "https://files.pythonhosted.org/packages/87/ec/e38ce072e724fd7add6243613f8d1810da084f54175353d25ccf9f9c7e5a/aiohttp-3.13.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e7d2f8616f0ff60bd332022279011776c3ac0faa0f1b463f7bb12326fbc97a1c", size = 501673, upload-time = "2026-03-31T21:57:06.208Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/ba/3bc7525d7e2beaa11b309a70d48b0d3cfc3c2089ec6a7d0820d59c657053/aiohttp-3.13.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a2567b72e1ffc3ab25510db43f355b29eeada56c0a622e58dcdb19530eb0a3cb", size = 1763757, upload-time = "2026-03-31T21:57:07.882Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/ab/e87744cf18f1bd78263aba24924d4953b41086bd3a31d22452378e9028a0/aiohttp-3.13.5-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:fb0540c854ac9c0c5ad495908fdfd3e332d553ec731698c0e29b1877ba0d2ec6", size = 1720152, upload-time = "2026-03-31T21:57:09.946Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/f3/ed17a6f2d742af17b50bae2d152315ed1b164b07a5fd5cc1754d99e4dfa5/aiohttp-3.13.5-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c9883051c6972f58bfc4ebb2116345ee2aa151178e99c3f2b2bbe2af712abd13", size = 1818010, upload-time = "2026-03-31T21:57:12.157Z" },
-    { url = "https://files.pythonhosted.org/packages/53/06/ecbc63dc937192e2a5cb46df4d3edb21deb8225535818802f210a6ea5816/aiohttp-3.13.5-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2294172ce08a82fb7c7273485895de1fa1186cc8294cfeb6aef4af42ad261174", size = 1907251, upload-time = "2026-03-31T21:57:14.023Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/a5/0521aa32c1ddf3aa1e71dcc466be0b7db2771907a13f18cddaa45967d97b/aiohttp-3.13.5-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3a807cabd5115fb55af198b98178997a5e0e57dead43eb74a93d9c07d6d4a7dc", size = 1759969, upload-time = "2026-03-31T21:57:16.146Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/78/a38f8c9105199dd3b9706745865a8a59d0041b6be0ca0cc4b2ccf1bab374/aiohttp-3.13.5-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:aa6d0d932e0f39c02b80744273cd5c388a2d9bc07760a03164f229c8e02662f6", size = 1616871, upload-time = "2026-03-31T21:57:17.856Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/41/27392a61ead8ab38072105c71aa44ff891e71653fe53d576a7067da2b4e8/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:60869c7ac4aaabe7110f26499f3e6e5696eae98144735b12a9c3d9eae2b51a49", size = 1739844, upload-time = "2026-03-31T21:57:19.679Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/55/5564e7ae26d94f3214250009a0b1c65a0c6af4bf88924ccb6fdab901de28/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:26d2f8546f1dfa75efa50c3488215a903c0168d253b75fba4210f57ab77a0fb8", size = 1731969, upload-time = "2026-03-31T21:57:22.006Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/c5/705a3929149865fc941bcbdd1047b238e4a72bcb215a9b16b9d7a2e8d992/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:f1162a1492032c82f14271e831c8f4b49f2b6078f4f5fc74de2c912fa225d51d", size = 1795193, upload-time = "2026-03-31T21:57:24.256Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/19/edabed62f718d02cff7231ca0db4ef1c72504235bc467f7b67adb1679f48/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:8b14eb3262fad0dc2f89c1a43b13727e709504972186ff6a99a3ecaa77102b6c", size = 1606477, upload-time = "2026-03-31T21:57:26.364Z" },
-    { url = "https://files.pythonhosted.org/packages/de/fc/76f80ef008675637d88d0b21584596dc27410a990b0918cb1e5776545b5b/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:ca9ac61ac6db4eb6c2a0cd1d0f7e1357647b638ccc92f7e9d8d133e71ed3c6ac", size = 1813198, upload-time = "2026-03-31T21:57:28.316Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/67/5b3ac26b80adb20ea541c487f73730dc8fa107d632c998f25bbbab98fcda/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:7996023b2ed59489ae4762256c8516df9820f751cf2c5da8ed2fb20ee50abab3", size = 1752321, upload-time = "2026-03-31T21:57:30.549Z" },
-    { url = "https://files.pythonhosted.org/packages/88/06/e4a2e49255ea23fa4feeb5ab092d90240d927c15e47b5b5c48dff5a9ce29/aiohttp-3.13.5-cp311-cp311-win32.whl", hash = "sha256:77dfa48c9f8013271011e51c00f8ada19851f013cde2c48fca1ba5e0caf5bb06", size = 439069, upload-time = "2026-03-31T21:57:32.388Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/43/8c7163a596dab4f8be12c190cf467a1e07e4734cf90eebb39f7f5d53fc6a/aiohttp-3.13.5-cp311-cp311-win_amd64.whl", hash = "sha256:d3a4834f221061624b8887090637db9ad4f61752001eae37d56c52fddade2dc8", size = 462859, upload-time = "2026-03-31T21:57:34.455Z" },
-    { url = "https://files.pythonhosted.org/packages/be/6f/353954c29e7dcce7cf00280a02c75f30e133c00793c7a2ed3776d7b2f426/aiohttp-3.13.5-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:023ecba036ddd840b0b19bf195bfae970083fd7024ce1ac22e9bba90464620e9", size = 748876, upload-time = "2026-03-31T21:57:36.319Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/1b/428a7c64687b3b2e9cd293186695affc0e1e54a445d0361743b231f11066/aiohttp-3.13.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:15c933ad7920b7d9a20de151efcd05a6e38302cbf0e10c9b2acb9a42210a2416", size = 499557, upload-time = "2026-03-31T21:57:38.236Z" },
-    { url = "https://files.pythonhosted.org/packages/29/47/7be41556bfbb6917069d6a6634bb7dd5e163ba445b783a90d40f5ac7e3a7/aiohttp-3.13.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ab2899f9fa2f9f741896ebb6fa07c4c883bfa5c7f2ddd8cf2aafa86fa981b2d2", size = 500258, upload-time = "2026-03-31T21:57:39.923Z" },
-    { url = "https://files.pythonhosted.org/packages/67/84/c9ecc5828cb0b3695856c07c0a6817a99d51e2473400f705275a2b3d9239/aiohttp-3.13.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a60eaa2d440cd4707696b52e40ed3e2b0f73f65be07fd0ef23b6b539c9c0b0b4", size = 1749199, upload-time = "2026-03-31T21:57:41.938Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/d3/3c6d610e66b495657622edb6ae7c7fd31b2e9086b4ec50b47897ad6042a9/aiohttp-3.13.5-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:55b3bdd3292283295774ab585160c4004f4f2f203946997f49aac032c84649e9", size = 1721013, upload-time = "2026-03-31T21:57:43.904Z" },
-    { url = "https://files.pythonhosted.org/packages/49/a0/24409c12217456df0bae7babe3b014e460b0b38a8e60753d6cb339f6556d/aiohttp-3.13.5-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c2b2355dc094e5f7d45a7bb262fe7207aa0460b37a0d87027dcf21b5d890e7d5", size = 1781501, upload-time = "2026-03-31T21:57:46.285Z" },
-    { url = "https://files.pythonhosted.org/packages/98/9d/b65ec649adc5bccc008b0957a9a9c691070aeac4e41cea18559fef49958b/aiohttp-3.13.5-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b38765950832f7d728297689ad78f5f2cf79ff82487131c4d26fe6ceecdc5f8e", size = 1878981, upload-time = "2026-03-31T21:57:48.734Z" },
-    { url = "https://files.pythonhosted.org/packages/57/d8/8d44036d7eb7b6a8ec4c5494ea0c8c8b94fbc0ed3991c1a7adf230df03bf/aiohttp-3.13.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b18f31b80d5a33661e08c89e202edabf1986e9b49c42b4504371daeaa11b47c1", size = 1767934, upload-time = "2026-03-31T21:57:51.171Z" },
-    { url = "https://files.pythonhosted.org/packages/31/04/d3f8211f273356f158e3464e9e45484d3fb8c4ce5eb2f6fe9405c3273983/aiohttp-3.13.5-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:33add2463dde55c4f2d9635c6ab33ce154e5ecf322bd26d09af95c5f81cfa286", size = 1566671, upload-time = "2026-03-31T21:57:53.326Z" },
-    { url = "https://files.pythonhosted.org/packages/41/db/073e4ebe00b78e2dfcacff734291651729a62953b48933d765dc513bf798/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:327cc432fdf1356fb4fbc6fe833ad4e9f6aacb71a8acaa5f1855e4b25910e4a9", size = 1705219, upload-time = "2026-03-31T21:57:55.385Z" },
-    { url = "https://files.pythonhosted.org/packages/48/45/7dfba71a2f9fd97b15c95c06819de7eb38113d2cdb6319669195a7d64270/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:7c35b0bf0b48a70b4cb4fc5d7bed9b932532728e124874355de1a0af8ec4bc88", size = 1743049, upload-time = "2026-03-31T21:57:57.341Z" },
-    { url = "https://files.pythonhosted.org/packages/18/71/901db0061e0f717d226386a7f471bb59b19566f2cae5f0d93874b017271f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:df23d57718f24badef8656c49743e11a89fd6f5358fa8a7b96e728fda2abf7d3", size = 1749557, upload-time = "2026-03-31T21:57:59.626Z" },
-    { url = "https://files.pythonhosted.org/packages/08/d5/41eebd16066e59cd43728fe74bce953d7402f2b4ddfdfef2c0e9f17ca274/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:02e048037a6501a5ec1f6fc9736135aec6eb8a004ce48838cb951c515f32c80b", size = 1558931, upload-time = "2026-03-31T21:58:01.972Z" },
-    { url = "https://files.pythonhosted.org/packages/30/e6/4a799798bf05740e66c3a1161079bda7a3dd8e22ca392481d7a7f9af82a6/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:31cebae8b26f8a615d2b546fee45d5ffb76852ae6450e2a03f42c9102260d6fe", size = 1774125, upload-time = "2026-03-31T21:58:04.007Z" },
-    { url = "https://files.pythonhosted.org/packages/84/63/7749337c90f92bc2cb18f9560d67aa6258c7060d1397d21529b8004fcf6f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:888e78eb5ca55a615d285c3c09a7a91b42e9dd6fc699b166ebd5dee87c9ccf14", size = 1732427, upload-time = "2026-03-31T21:58:06.337Z" },
-    { url = "https://files.pythonhosted.org/packages/98/de/cf2f44ff98d307e72fb97d5f5bbae3bfcb442f0ea9790c0bf5c5c2331404/aiohttp-3.13.5-cp312-cp312-win32.whl", hash = "sha256:8bd3ec6376e68a41f9f95f5ed170e2fcf22d4eb27a1f8cb361d0508f6e0557f3", size = 433534, upload-time = "2026-03-31T21:58:08.712Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/ca/eadf6f9c8fa5e31d40993e3db153fb5ed0b11008ad5d9de98a95045bed84/aiohttp-3.13.5-cp312-cp312-win_amd64.whl", hash = "sha256:110e448e02c729bcebb18c60b9214a87ba33bac4a9fa5e9a5f139938b56c6cb1", size = 460446, upload-time = "2026-03-31T21:58:10.945Z" },
+    { url = "https://files.pythonhosted.org/packages/67/47/7727bfe8db93f8835a001bd4359d8480cc68d1259b8bce334668f8be97bd/aiohttp-3.14.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:54bf3522d6f7351e55f89a62d5c2bf138ad557b031670266c5df604ae88e0b5a", size = 759147, upload-time = "2026-06-01T19:37:12.918Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/f2/cd3fedff6fade73d71df9ec908c210cec518ef90fd00289250684b90aecf/aiohttp-3.14.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0746d9fb0ac4fdef643a84494efe3f06d50335dd8c7a530228b86448aae0a803", size = 513705, upload-time = "2026-06-01T19:37:14.633Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/fe/49746b6b610144a06323bebd8e1211a390310d8c69b98dd6d52df341bc3e/aiohttp-3.14.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:9f3a96b6d39a4872222beee72e1df41d2ff886ae96152cf3e757ef8c5673ef0e", size = 509627, upload-time = "2026-06-01T19:37:16.385Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/3f/28f2f6cf3d5c0e7b01b27140d0e7873fd11fb341169ad3ce78ad04aba628/aiohttp-3.14.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d336820adbb914debbc90a1d8c1bfc4bea55996aecf64866a989d35d1f9fd903", size = 1769293, upload-time = "2026-06-01T19:37:18.067Z" },
+    { url = "https://files.pythonhosted.org/packages/97/6f/2e5f1b525d5474b12b3c60abf733a755845f3bceff21542081ada515f837/aiohttp-3.14.0-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:71b2604c9bfc1b115547d63a094d5244b3f02799833513a99a68aaa7b167c4cb", size = 1732363, upload-time = "2026-06-01T19:37:20.138Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/ce/596120faa85ca7b19cd061e3f2f3be23aa8f11a0aedf9191db9e0da1bd76/aiohttp-3.14.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:610d68800435903e303ca0542b9d3e4eb72a12ff33a6d471a070c1d81eebd3c2", size = 1840375, upload-time = "2026-06-01T19:37:22.104Z" },
+    { url = "https://files.pythonhosted.org/packages/72/3c/a7ffe05a757a4a7867643da69357ec41f506879fbd1b231d2ed90af246b2/aiohttp-3.14.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:514db9a79337068981ee2137310283a07b4b885c584991097a91a4da419bcb81", size = 1921484, upload-time = "2026-06-01T19:37:24.068Z" },
+    { url = "https://files.pythonhosted.org/packages/93/fa/2c861170bbd4a491de93a69e081db1d971092569e0d593a98ef62c384dc1/aiohttp-3.14.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c452d17eeb95d563fc8b936f3050301dbd1d268126c4632d8b70ede9696202ee", size = 1774153, upload-time = "2026-06-01T19:37:26.256Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/da/1d2f5a165f47ec9b1f69d37b8b977fdc4d501aa72ffb7930db27bb9e49ea/aiohttp-3.14.0-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ed94a81506e3d1bdbad5108f497a58f2a2354aedb4ca314d5326f07d1fd1ac2d", size = 1632569, upload-time = "2026-06-01T19:37:28.192Z" },
+    { url = "https://files.pythonhosted.org/packages/46/1d/7a6e295c4257252f70f69e90864fdad74b6a1293054fb3f9e65a15de6d63/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1394dce36e0f0d260ac0b555a654de19cb989f3c1b8bdd24f505314dfea18a00", size = 1740325, upload-time = "2026-06-01T19:37:30.08Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/7e/e1899b1ca3ec62f1eab2a5cbde14039b97493f7f53eb88d9b668562ffa8d/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:d1467d1e7b48a73ca7237e0ee4335f3d02b923dbc27b82fd254bc301c97d4026", size = 1748691, upload-time = "2026-06-01T19:37:32.211Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/54/4e6b61c1fe7d3433f82bcc6bd7e4d7c683a742a10c9b12a025fd3695c047/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:6a5f3532125233c261cf61f32df4059cfcf482eb793c7d3db8452e3142028b86", size = 1814477, upload-time = "2026-06-01T19:37:34.173Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/38/86fd51be2e08d8e45c83d879d255f10391903cd9fe2a16512f7591a15873/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:3ea81eb518a2ecb319d8ec6d1424a37c773f6634bd87d6985eb606b2faac419f", size = 1623393, upload-time = "2026-06-01T19:37:36.281Z" },
+    { url = "https://files.pythonhosted.org/packages/78/49/466e947a42a88ee23c486d036e7e5d1b097f1bafd8084ad9c9a0a92f0f43/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:32e735c3182de7b64f6941a4ede48b38c7f47d9437bd615dd30b5bda8fa1bc93", size = 1824097, upload-time = "2026-06-01T19:37:38.421Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/89/35f3410bc284682338a1be6b6ea0c5abfa05f063942cfaa9256608440434/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:c21ca9a1c63d4509158f478aeb9d02914dcc52adc68d1bc9dee2452284ee5996", size = 1764790, upload-time = "2026-06-01T19:37:40.755Z" },
+    { url = "https://files.pythonhosted.org/packages/42/80/2d4291bd5724d3d17e5951aff5a3e02281483fb47295f0788276ee66cd73/aiohttp-3.14.0-cp311-cp311-win32.whl", hash = "sha256:19ca5fc84130675ba11c6ca5c7da5cb65f7bf8a32cdd2b616bf49cd334688aae", size = 454176, upload-time = "2026-06-01T19:37:42.837Z" },
+    { url = "https://files.pythonhosted.org/packages/59/ed/41d0ad4f6ececffc32bdf1f7b494e5498f7ca5c849ea2e3cc9bbd1668251/aiohttp-3.14.0-cp311-cp311-win_amd64.whl", hash = "sha256:d488e6e9d3bb8ba5ae7066d5be885ae9670eba021b8c6ccb9a3a568e6b19d6e5", size = 479334, upload-time = "2026-06-01T19:37:44.776Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/86/c0b5e305c770053f8c3d069bb52b8196917ba91949d1962d52eb307fb0d2/aiohttp-3.14.0-cp311-cp311-win_arm64.whl", hash = "sha256:8b93618102caf12801638a01a2b478a55410ddd71bd41cfaf6f707953a49ac43", size = 450262, upload-time = "2026-06-01T19:37:46.461Z" },
+    { url = "https://files.pythonhosted.org/packages/89/97/2b6889bfb6b6847520d50d95eb8c4307a45e28aaca39faf4a9454b3d1b2f/aiohttp-3.14.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:b29518c9c2ec7e373e68259206a137c7f4f5439c58baaec4b5ab3ab799850a4e", size = 750194, upload-time = "2026-06-01T19:37:48.164Z" },
+    { url = "https://files.pythonhosted.org/packages/21/e2/62634b7fff918ed98c3c6b2f0e70d520f7f28846cb412d451b04354c6459/aiohttp-3.14.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:dbec68ce61b64cb73cab4d33df9433427b1713c8bcccb181dce695c1b6f8e87c", size = 506966, upload-time = "2026-06-01T19:37:50.014Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/fb/5ce075150828c797a5106f1c2fb26034e709d4289b9d2bf8b07f1e59fac6/aiohttp-3.14.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:3cdf534aa455593e589302990c5097aa5c92c06c4262a20da22934f9186a5fff", size = 507527, upload-time = "2026-06-01T19:37:51.96Z" },
+    { url = "https://files.pythonhosted.org/packages/01/d5/405a0ae4e6b081754a3609c1c97c63a950e000a2def16046f1e736933a0e/aiohttp-3.14.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cb6c657104393b5fbff01a5f59b2023db74058a8077d94475d6c25d03882a108", size = 1762420, upload-time = "2026-06-01T19:37:53.839Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/1d/e05a7c896b15a6bc6fb8fc5319eb437861c2c49c34559ef928add6590315/aiohttp-3.14.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:46fbbec4e4fab7428d4396a3823f9320e4560aa3113b89eeebce712c27c9ed5a", size = 1733672, upload-time = "2026-06-01T19:37:55.791Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/22/a72f7c459e195fa41bf4f7abd1f925b91fe91f8097e51c654229ba144a33/aiohttp-3.14.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2c2c7e05dd5335b298085abf45ddf98673934c3ee1c083d0b9ea13d4186ad500", size = 1805064, upload-time = "2026-06-01T19:37:57.931Z" },
+    { url = "https://files.pythonhosted.org/packages/80/50/e85bdaba0be59ca4838005ebfef4048fcdd5f35a02b07057a9a123394440/aiohttp-3.14.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3c7139100fbaae76515b73051d8f0aa3a3ff02e415eec8a8eee8e2223d9ba955", size = 1902125, upload-time = "2026-06-01T19:38:00.225Z" },
+    { url = "https://files.pythonhosted.org/packages/19/d8/51de5c6b971c27bb1ef620293b8d1ca611ec78736b34b3f6ccf68e4c8785/aiohttp-3.14.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78d6f9286a629ce52728430afe18f8ed2b6c39a1fddb3802d7244b9983910ad2", size = 1783112, upload-time = "2026-06-01T19:38:02.641Z" },
+    { url = "https://files.pythonhosted.org/packages/73/ae/b4402bfde77e43dfb1b6ccff83c7b7ab63ed06b50c4754f0c5423fb374fe/aiohttp-3.14.0-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:cc3c3e12cdaeb92d7dcf13db00e9f6b1956b910e47256e696df1cfa946d02159", size = 1586356, upload-time = "2026-06-01T19:38:04.637Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/05/750a3265ca4dc54a460bd0cb1121a8f2ce9171fce4a135fb47ea7fd594d2/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4d6a998191f5ebe3b8c28463ff72bc030250008b3193c402464efadd08b5ca02", size = 1723119, upload-time = "2026-06-01T19:38:06.713Z" },
+    { url = "https://files.pythonhosted.org/packages/37/01/8c0812c50b3b1b1c37b323bf170d6be8847a8f234060485b7d1e71953f60/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:0fc2b75ae8d169d853be2862d960be8550da6c5c65711d5476407eb3fdb006bd", size = 1757216, upload-time = "2026-06-01T19:38:08.736Z" },
+    { url = "https://files.pythonhosted.org/packages/47/2a/50fb98028a26887cbe48dcc1df92a90825615bc73b5584301304090cded8/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:16eee56bcc72d04600bc56c1759982c2385ec0b41d3fd3521f836bf64a0957ef", size = 1770500, upload-time = "2026-06-01T19:38:11.111Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/32/0ffd598a2fa2b9a423daf242e700cfdabda35d6e602394ad9ae58972c1c7/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:5a2e7ca615c3ddc15b82687e05a624e5f5cba3f1d6c20cb81172d70ea498451e", size = 1576224, upload-time = "2026-06-01T19:38:13.391Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/f9/b9fc381dd9b66afb33f2634c40e229d106467be0afcabe79648631ab6712/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:f0b7b8bbbec3ce9467ee0ebe334622fd90624f593edd3136c567811453fc4fae", size = 1794252, upload-time = "2026-06-01T19:38:15.498Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/fb/05d9214c975f23225a8cd5c439325e338c7c377b315480ef3871db51f54e/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5ba10966d4f03dd96a14365be4b8e37c327c76f11c3ca867116966cdd9f98066", size = 1760193, upload-time = "2026-06-01T19:38:17.624Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/4b/02992fc4fb9e1b6673ee3f888a8e587a6447afda1f6f4aca776c148c2876/aiohttp-3.14.0-cp312-cp312-win32.whl", hash = "sha256:101df7779c80c0636014a6b2c6642acd3efb5b355d48347c9d7dfb720aee9430", size = 448650, upload-time = "2026-06-01T19:38:19.545Z" },
+    { url = "https://files.pythonhosted.org/packages/39/e9/246532214c3abda518477cbaaf16d420295ad8effa5233844cbb38f299ab/aiohttp-3.14.0-cp312-cp312-win_amd64.whl", hash = "sha256:b0a5747586d4467efd1f932710b269131c9717a872dce082cd92a00c1c13123a", size = 476145, upload-time = "2026-06-01T19:38:21.505Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c3/63f8c20090048915711598b0adf475b149216d736157961de06480a45b15/aiohttp-3.14.0-cp312-cp312-win_arm64.whl", hash = "sha256:5f1c5be60add78fabb4aacd13c5a348ae79d2fcbfc7fa78da8f1eb192273b370", size = 444250, upload-time = "2026-06-01T19:38:24.027Z" },
 ]
 
 [[package]]
@@ -1045,15 +1048,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9e/43/53afb8ba17218f19b77c7834128566c5bbb100a0ad9ba2e8e89d089d7079/autopep8-2.3.2-py2.py3-none-any.whl", hash = "sha256:ce8ad498672c845a0c3de2629c15b635ec2b05ef8177a6e7c91c74f3e9b51128", size = 45807, upload-time = "2025-01-14T14:46:15.466Z" },
 ]
 
-[[package]]
-name = "awsipranges"
-version = "0.3.3"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/19/2e/6efa95f995369da828715f41705686cd214b9259ed758266942553d40441/awsipranges-0.3.3.tar.gz", hash = "sha256:4f0b3f22a9dc1163c85b513bed812b6c92bdacd674e6a7b68252a3c25b99e2c0", size = 16739, upload-time = "2022-02-10T21:08:32.825Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/83/ce/5c9a8bf91bdc9592a409c99e58fd99f2727ab8d634719c0ad796021b76d7/awsipranges-0.3.3-py3-none-any.whl", hash = "sha256:f3d7a54aeaf7fe310beb5d377a4034a63a51b72677ae6af3e0967bc4de7eedaf", size = 18106, upload-time = "2022-02-10T21:08:31.497Z" },
-]
-
 [[package]]
 name = "azure-cli-core"
 version = "2.83.0"
@@ -3164,11 +3158,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.15"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/77/7b3966d0b9d1d31a36ddf1746926a11dface89a83409bf1483f0237aa758/idna-3.15.tar.gz", hash = "sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc", size = 199245, upload-time = "2026-05-12T22:45:57.011Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/23/408243171aa9aaba178d3e2559159c24c1171a641aa83b67bdd3394ead8e/idna-3.15-py3-none-any.whl", hash = "sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8", size = 72340, upload-time = "2026-05-12T22:45:55.733Z" },
 ]
 
 [[package]]
@@ -3971,30 +3965,30 @@ wheels = [
 
 [[package]]
 name = "numpy"
-version = "2.0.2"
+version = "2.2.6"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/a9/75/10dd1f8116a8b796cb2c737b674e02d02e80454bda953fa7e65d8c12b016/numpy-2.0.2.tar.gz", hash = "sha256:883c987dee1880e2a864ab0dc9892292582510604156762362d9326444636e78", size = 18902015, upload-time = "2024-08-26T20:19:40.945Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/76/21/7d2a95e4bba9dc13d043ee156a356c0a8f0c6309dff6b21b4d71a073b8a8/numpy-2.2.6.tar.gz", hash = "sha256:e29554e2bef54a90aa5cc07da6ce955accb83f21ab5de01a62c8478897b264fd", size = 20276440, upload-time = "2025-05-17T22:38:04.611Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/8b/cf/034500fb83041aa0286e0fb16e7c76e5c8b67c0711bb6e9e9737a717d5fe/numpy-2.0.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:49ca4decb342d66018b01932139c0961a8f9ddc7589611158cb3c27cbcf76448", size = 21169137, upload-time = "2024-08-26T20:07:45.345Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/d9/32de45561811a4b87fbdee23b5797394e3d1504b4a7cf40c10199848893e/numpy-2.0.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:11a76c372d1d37437857280aa142086476136a8c0f373b2e648ab2c8f18fb195", size = 13703552, upload-time = "2024-08-26T20:08:06.666Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/ca/2f384720020c7b244d22508cb7ab23d95f179fcfff33c31a6eeba8d6c512/numpy-2.0.2-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:807ec44583fd708a21d4a11d94aedf2f4f3c3719035c76a2bbe1fe8e217bdc57", size = 5298957, upload-time = "2024-08-26T20:08:15.83Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/78/a3e4f9fb6aa4e6fdca0c5428e8ba039408514388cf62d89651aade838269/numpy-2.0.2-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:8cafab480740e22f8d833acefed5cc87ce276f4ece12fdaa2e8903db2f82897a", size = 6905573, upload-time = "2024-08-26T20:08:27.185Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/72/cfc3a1beb2caf4efc9d0b38a15fe34025230da27e1c08cc2eb9bfb1c7231/numpy-2.0.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a15f476a45e6e5a3a79d8a14e62161d27ad897381fecfa4a09ed5322f2085669", size = 13914330, upload-time = "2024-08-26T20:08:48.058Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/a8/c17acf65a931ce551fee11b72e8de63bf7e8a6f0e21add4c937c83563538/numpy-2.0.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:13e689d772146140a252c3a28501da66dfecd77490b498b168b501835041f951", size = 19534895, upload-time = "2024-08-26T20:09:16.536Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/86/8767f3d54f6ae0165749f84648da9dcc8cd78ab65d415494962c86fac80f/numpy-2.0.2-cp311-cp311-musllinux_1_1_x86_64.whl", hash = "sha256:9ea91dfb7c3d1c56a0e55657c0afb38cf1eeae4544c208dc465c3c9f3a7c09f9", size = 19937253, upload-time = "2024-08-26T20:09:46.263Z" },
-    { url = "https://files.pythonhosted.org/packages/df/87/f76450e6e1c14e5bb1eae6836478b1028e096fd02e85c1c37674606ab752/numpy-2.0.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c1c9307701fec8f3f7a1e6711f9089c06e6284b3afbbcd259f7791282d660a15", size = 14414074, upload-time = "2024-08-26T20:10:08.483Z" },
-    { url = "https://files.pythonhosted.org/packages/5c/ca/0f0f328e1e59f73754f06e1adfb909de43726d4f24c6a3f8805f34f2b0fa/numpy-2.0.2-cp311-cp311-win32.whl", hash = "sha256:a392a68bd329eafac5817e5aefeb39038c48b671afd242710b451e76090e81f4", size = 6470640, upload-time = "2024-08-26T20:10:19.732Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/57/3a3f14d3a759dcf9bf6e9eda905794726b758819df4663f217d658a58695/numpy-2.0.2-cp311-cp311-win_amd64.whl", hash = "sha256:286cd40ce2b7d652a6f22efdfc6d1edf879440e53e76a75955bc0c826c7e64dc", size = 15910230, upload-time = "2024-08-26T20:10:43.413Z" },
-    { url = "https://files.pythonhosted.org/packages/45/40/2e117be60ec50d98fa08c2f8c48e09b3edea93cfcabd5a9ff6925d54b1c2/numpy-2.0.2-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:df55d490dea7934f330006d0f81e8551ba6010a5bf035a249ef61a94f21c500b", size = 20895803, upload-time = "2024-08-26T20:11:13.916Z" },
-    { url = "https://files.pythonhosted.org/packages/46/92/1b8b8dee833f53cef3e0a3f69b2374467789e0bb7399689582314df02651/numpy-2.0.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8df823f570d9adf0978347d1f926b2a867d5608f434a7cff7f7908c6570dcf5e", size = 13471835, upload-time = "2024-08-26T20:11:34.779Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/19/e2793bde475f1edaea6945be141aef6c8b4c669b90c90a300a8954d08f0a/numpy-2.0.2-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:9a92ae5c14811e390f3767053ff54eaee3bf84576d99a2456391401323f4ec2c", size = 5038499, upload-time = "2024-08-26T20:11:43.902Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/ff/ddf6dac2ff0dd50a7327bcdba45cb0264d0e96bb44d33324853f781a8f3c/numpy-2.0.2-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:a842d573724391493a97a62ebbb8e731f8a5dcc5d285dfc99141ca15a3302d0c", size = 6633497, upload-time = "2024-08-26T20:11:55.09Z" },
-    { url = "https://files.pythonhosted.org/packages/72/21/67f36eac8e2d2cd652a2e69595a54128297cdcb1ff3931cfc87838874bd4/numpy-2.0.2-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c05e238064fc0610c840d1cf6a13bf63d7e391717d247f1bf0318172e759e692", size = 13621158, upload-time = "2024-08-26T20:12:14.95Z" },
-    { url = "https://files.pythonhosted.org/packages/39/68/e9f1126d757653496dbc096cb429014347a36b228f5a991dae2c6b6cfd40/numpy-2.0.2-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0123ffdaa88fa4ab64835dcbde75dcdf89c453c922f18dced6e27c90d1d0ec5a", size = 19236173, upload-time = "2024-08-26T20:12:44.049Z" },
-    { url = "https://files.pythonhosted.org/packages/d1/e9/1f5333281e4ebf483ba1c888b1d61ba7e78d7e910fdd8e6499667041cc35/numpy-2.0.2-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:96a55f64139912d61de9137f11bf39a55ec8faec288c75a54f93dfd39f7eb40c", size = 19634174, upload-time = "2024-08-26T20:13:13.634Z" },
-    { url = "https://files.pythonhosted.org/packages/71/af/a469674070c8d8408384e3012e064299f7a2de540738a8e414dcfd639996/numpy-2.0.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:ec9852fb39354b5a45a80bdab5ac02dd02b15f44b3804e9f00c556bf24b4bded", size = 14099701, upload-time = "2024-08-26T20:13:34.851Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/3d/08ea9f239d0e0e939b6ca52ad403c84a2bce1bde301a8eb4888c1c1543f1/numpy-2.0.2-cp312-cp312-win32.whl", hash = "sha256:671bec6496f83202ed2d3c8fdc486a8fc86942f2e69ff0e986140339a63bcbe5", size = 6174313, upload-time = "2024-08-26T20:13:45.653Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/b5/4ac39baebf1fdb2e72585c8352c56d063b6126be9fc95bd2bb5ef5770c20/numpy-2.0.2-cp312-cp312-win_amd64.whl", hash = "sha256:cfd41e13fdc257aa5778496b8caa5e856dc4896d4ccf01841daee1d96465467a", size = 15606179, upload-time = "2024-08-26T20:14:08.786Z" },
+    { url = "https://files.pythonhosted.org/packages/da/a8/4f83e2aa666a9fbf56d6118faaaf5f1974d456b1823fda0a176eff722839/numpy-2.2.6-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f9f1adb22318e121c5c69a09142811a201ef17ab257a1e66ca3025065b7f53ae", size = 21176963, upload-time = "2025-05-17T21:31:19.36Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/2b/64e1affc7972decb74c9e29e5649fac940514910960ba25cd9af4488b66c/numpy-2.2.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:c820a93b0255bc360f53eca31a0e676fd1101f673dda8da93454a12e23fc5f7a", size = 14406743, upload-time = "2025-05-17T21:31:41.087Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/9f/0121e375000b5e50ffdd8b25bf78d8e1a5aa4cca3f185d41265198c7b834/numpy-2.2.6-cp311-cp311-macosx_14_0_arm64.whl", hash = "sha256:3d70692235e759f260c3d837193090014aebdf026dfd167834bcba43e30c2a42", size = 5352616, upload-time = "2025-05-17T21:31:50.072Z" },
+    { url = "https://files.pythonhosted.org/packages/31/0d/b48c405c91693635fbe2dcd7bc84a33a602add5f63286e024d3b6741411c/numpy-2.2.6-cp311-cp311-macosx_14_0_x86_64.whl", hash = "sha256:481b49095335f8eed42e39e8041327c05b0f6f4780488f61286ed3c01368d491", size = 6889579, upload-time = "2025-05-17T21:32:01.712Z" },
+    { url = "https://files.pythonhosted.org/packages/52/b8/7f0554d49b565d0171eab6e99001846882000883998e7b7d9f0d98b1f934/numpy-2.2.6-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:b64d8d4d17135e00c8e346e0a738deb17e754230d7e0810ac5012750bbd85a5a", size = 14312005, upload-time = "2025-05-17T21:32:23.332Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/dd/2238b898e51bd6d389b7389ffb20d7f4c10066d80351187ec8e303a5a475/numpy-2.2.6-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ba10f8411898fc418a521833e014a77d3ca01c15b0c6cdcce6a0d2897e6dbbdf", size = 16821570, upload-time = "2025-05-17T21:32:47.991Z" },
+    { url = "https://files.pythonhosted.org/packages/83/6c/44d0325722cf644f191042bf47eedad61c1e6df2432ed65cbe28509d404e/numpy-2.2.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bd48227a919f1bafbdda0583705e547892342c26fb127219d60a5c36882609d1", size = 15818548, upload-time = "2025-05-17T21:33:11.728Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/9d/81e8216030ce66be25279098789b665d49ff19eef08bfa8cb96d4957f422/numpy-2.2.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:9551a499bf125c1d4f9e250377c1ee2eddd02e01eac6644c080162c0c51778ab", size = 18620521, upload-time = "2025-05-17T21:33:39.139Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/fd/e19617b9530b031db51b0926eed5345ce8ddc669bb3bc0044b23e275ebe8/numpy-2.2.6-cp311-cp311-win32.whl", hash = "sha256:0678000bb9ac1475cd454c6b8c799206af8107e310843532b04d49649c717a47", size = 6525866, upload-time = "2025-05-17T21:33:50.273Z" },
+    { url = "https://files.pythonhosted.org/packages/31/0a/f354fb7176b81747d870f7991dc763e157a934c717b67b58456bc63da3df/numpy-2.2.6-cp311-cp311-win_amd64.whl", hash = "sha256:e8213002e427c69c45a52bbd94163084025f533a55a59d6f9c5b820774ef3303", size = 12907455, upload-time = "2025-05-17T21:34:09.135Z" },
+    { url = "https://files.pythonhosted.org/packages/82/5d/c00588b6cf18e1da539b45d3598d3557084990dcc4331960c15ee776ee41/numpy-2.2.6-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:41c5a21f4a04fa86436124d388f6ed60a9343a6f767fced1a8a71c3fbca038ff", size = 20875348, upload-time = "2025-05-17T21:34:39.648Z" },
+    { url = "https://files.pythonhosted.org/packages/66/ee/560deadcdde6c2f90200450d5938f63a34b37e27ebff162810f716f6a230/numpy-2.2.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:de749064336d37e340f640b05f24e9e3dd678c57318c7289d222a8a2f543e90c", size = 14119362, upload-time = "2025-05-17T21:35:01.241Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/65/4baa99f1c53b30adf0acd9a5519078871ddde8d2339dc5a7fde80d9d87da/numpy-2.2.6-cp312-cp312-macosx_14_0_arm64.whl", hash = "sha256:894b3a42502226a1cac872f840030665f33326fc3dac8e57c607905773cdcde3", size = 5084103, upload-time = "2025-05-17T21:35:10.622Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/89/e5a34c071a0570cc40c9a54eb472d113eea6d002e9ae12bb3a8407fb912e/numpy-2.2.6-cp312-cp312-macosx_14_0_x86_64.whl", hash = "sha256:71594f7c51a18e728451bb50cc60a3ce4e6538822731b2933209a1f3614e9282", size = 6625382, upload-time = "2025-05-17T21:35:21.414Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/35/8c80729f1ff76b3921d5c9487c7ac3de9b2a103b1cd05e905b3090513510/numpy-2.2.6-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:f2618db89be1b4e05f7a1a847a9c1c0abd63e63a1607d892dd54668dd92faf87", size = 14018462, upload-time = "2025-05-17T21:35:42.174Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/3d/1e1db36cfd41f895d266b103df00ca5b3cbe965184df824dec5c08c6b803/numpy-2.2.6-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:fd83c01228a688733f1ded5201c678f0c53ecc1006ffbc404db9f7a899ac6249", size = 16527618, upload-time = "2025-05-17T21:36:06.711Z" },
+    { url = "https://files.pythonhosted.org/packages/61/c6/03ed30992602c85aa3cd95b9070a514f8b3c33e31124694438d88809ae36/numpy-2.2.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:37c0ca431f82cd5fa716eca9506aefcabc247fb27ba69c5062a6d3ade8cf8f49", size = 15505511, upload-time = "2025-05-17T21:36:29.965Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/25/5761d832a81df431e260719ec45de696414266613c9ee268394dd5ad8236/numpy-2.2.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fe27749d33bb772c80dcd84ae7e8df2adc920ae8297400dabec45f0dedb3f6de", size = 18313783, upload-time = "2025-05-17T21:36:56.883Z" },
+    { url = "https://files.pythonhosted.org/packages/57/0a/72d5a3527c5ebffcd47bde9162c39fae1f90138c961e5296491ce778e682/numpy-2.2.6-cp312-cp312-win32.whl", hash = "sha256:4eeaae00d789f66c7a25ac5f34b71a7035bb474e679f410e5e1a94deb24cf2d4", size = 6246506, upload-time = "2025-05-17T21:37:07.368Z" },
+    { url = "https://files.pythonhosted.org/packages/36/fa/8c9210162ca1b88529ab76b41ba02d433fd54fecaf6feb70ef9f124683f1/numpy-2.2.6-cp312-cp312-win_amd64.whl", hash = "sha256:c1f9540be57940698ed329904db803cf7a402f3fc200bfe599334c9bd84a40b2", size = 12614190, upload-time = "2025-05-17T21:37:26.213Z" },
 ]
 
 [[package]]
@@ -4415,8 +4409,8 @@ wheels = [
 
 [[package]]
 name = "prowler"
-version = "5.30.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#f1d741214a60df17158c3fdc97804fd1fde64f3a" }
+version = "5.31.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#8081d0fd0552131dfbd885f1074377eb653fc785" }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },
     { name = "alibabacloud-credentials" },
@@ -4432,7 +4426,6 @@ dependencies = [
     { name = "alibabacloud-tea-openapi" },
     { name = "alibabacloud-vpc20160428" },
     { name = "alive-progress" },
-    { name = "awsipranges" },
     { name = "azure-identity" },
     { name = "azure-keyvault-keys" },
     { name = "azure-mgmt-apimanagement" },
@@ -4692,14 +4685,14 @@ wheels = [
 
 [[package]]
 name = "py-iam-expand"
-version = "0.1.0"
+version = "0.3.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "iamdata" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/22/99/8d31a30b37825577275bb3663885b55075fba80257fcd6813b85d3aaffa8/py_iam_expand-0.1.0.tar.gz", hash = "sha256:5a2884dc267ac59a02c3a80fefc0b34c309dac681baa0f87c436067c6cf53a96", size = 10228, upload-time = "2025-04-30T07:15:35.304Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a3/08/f6e11a029b81f0bec4b7b1f18704aadf509a882cc386c90ef1ac043c18cc/py_iam_expand-0.3.0.tar.gz", hash = "sha256:4ccfe25f40ba0633a152c4f86b49cde8972ee3d4b6009b017a4310cc4b9e64c7", size = 10234, upload-time = "2026-02-24T09:47:47.772Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/79/19/482c2e0768cda7afaed07918e4fbd951e2418255fb5d1d9b35b284871716/py_iam_expand-0.1.0-py3-none-any.whl", hash = "sha256:b845ce7b50ac895b02b4f338e09c62a68ea51849794f76e189b02009bd388510", size = 12522, upload-time = "2025-04-30T07:15:33.799Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/dd/4056d0bc3d6317039d2dd2ee7cd6a5389575603e270399a8f9f20e11e721/py_iam_expand-0.3.0-py3-none-any.whl", hash = "sha256:94c0a1e9dd60316ce60ddc0cdc9a046119bde335b5bb9593ee29224857860d5a", size = 12527, upload-time = "2026-02-24T09:47:45.602Z" },
 ]
 
 [[package]]
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index c8de54e740..3bac1d8e40 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -20,6 +20,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ### 🔐 Security
 
+- `microsoft-kiota-*` to 1.9.9 and `aiohttp` to 3.14.0, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
 - Container base image bumped to `python:3.12.13-slim-bookworm` (patches `libgnutls30` CVE-2026-33845 and CVE-2026-42010) and `trivy` bumped to 0.71.0 (patches embedded `golang.org/x/crypto` and Go stdlib CVEs); `.trivyignore` documents remaining bookworm criticals with no-fix or not-affected rationale [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
 
 ---
diff --git a/pyproject.toml b/pyproject.toml
index ed4c9f31fb..8da017bf21 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -79,7 +79,7 @@ dependencies = [
   "jsonschema==4.23.0",
   "kubernetes==32.0.1",
   "markdown==3.10.2",
-  "microsoft-kiota-abstractions==1.9.2",
+  "microsoft-kiota-abstractions==1.9.9",
   "numpy==2.2.6",
   "msgraph-sdk==1.55.0",
   "okta==3.4.2",
@@ -162,7 +162,7 @@ constraint-dependencies = [
   "aenum==3.1.17",
   "aiofiles==24.1.0",
   "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.13.5",
+  "aiohttp==3.14.0",
   "aiosignal==1.4.0",
   "alibabacloud-actiontrail20200706==2.4.1",
   "alibabacloud-credentials==1.0.3",
@@ -267,12 +267,12 @@ constraint-dependencies = [
   "markupsafe==3.0.3",
   "mccabe==0.7.0",
   "mdurl==0.1.2",
-  "microsoft-kiota-authentication-azure==1.9.2",
-  "microsoft-kiota-http==1.9.2",
-  "microsoft-kiota-serialization-form==1.9.2",
-  "microsoft-kiota-serialization-json==1.9.2",
-  "microsoft-kiota-serialization-multipart==1.9.2",
-  "microsoft-kiota-serialization-text==1.9.2",
+  "microsoft-kiota-authentication-azure==1.9.9",
+  "microsoft-kiota-http==1.9.9",
+  "microsoft-kiota-serialization-form==1.9.9",
+  "microsoft-kiota-serialization-json==1.9.9",
+  "microsoft-kiota-serialization-multipart==1.9.9",
+  "microsoft-kiota-serialization-text==1.9.9",
   "mock==5.2.0",
   "moto==5.1.11",
   "mpmath==1.3.0",
diff --git a/uv.lock b/uv.lock
index 42fef8fe94..666d67b4b2 100644
--- a/uv.lock
+++ b/uv.lock
@@ -14,7 +14,7 @@ constraints = [
     { name = "aenum", specifier = "==3.1.17" },
     { name = "aiofiles", specifier = "==24.1.0" },
     { name = "aiohappyeyeballs", specifier = "==2.6.1" },
-    { name = "aiohttp", specifier = "==3.13.5" },
+    { name = "aiohttp", specifier = "==3.14.0" },
     { name = "aiosignal", specifier = "==1.4.0" },
     { name = "alibabacloud-actiontrail20200706", specifier = "==2.4.1" },
     { name = "alibabacloud-credentials", specifier = "==1.0.3" },
@@ -119,12 +119,12 @@ constraints = [
     { name = "markupsafe", specifier = "==3.0.3" },
     { name = "mccabe", specifier = "==0.7.0" },
     { name = "mdurl", specifier = "==0.1.2" },
-    { name = "microsoft-kiota-authentication-azure", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-http", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-serialization-form", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-serialization-json", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.2" },
-    { name = "microsoft-kiota-serialization-text", specifier = "==1.9.2" },
+    { name = "microsoft-kiota-authentication-azure", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-http", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-form", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-json", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.9" },
+    { name = "microsoft-kiota-serialization-text", specifier = "==1.9.9" },
     { name = "mock", specifier = "==5.2.0" },
     { name = "moto", specifier = "==5.1.11" },
     { name = "mpmath", specifier = "==1.3.0" },
@@ -255,7 +255,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.13.5"
+version = "3.14.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -265,78 +265,88 @@ dependencies = [
     { name = "frozenlist" },
     { name = "multidict" },
     { name = "propcache" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/77/9a/152096d4808df8e4268befa55fba462f440f14beab85e8ad9bf990516918/aiohttp-3.13.5.tar.gz", hash = "sha256:9d98cc980ecc96be6eb4c1994ce35d28d8b1f5e5208a23b421187d1209dbb7d1", size = 7858271, upload-time = "2026-03-31T22:01:03.343Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/ab/93ce242f899b68c51b0578c027aafa791ab3614cb9345fa5d37b5f5c8e3e/aiohttp-3.14.0.tar.gz", hash = "sha256:2882de819734c715fd1b9c11c97e09fa020d14438203d1d354d8ed1702791c9b", size = 7940674, upload-time = "2026-06-01T19:41:02.763Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bd/85/cebc47ee74d8b408749073a1a46c6fcba13d170dc8af7e61996c6c9394ac/aiohttp-3.13.5-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:02222e7e233295f40e011c1b00e3b0bd451f22cf853a0304c3595633ee47da4b", size = 750547, upload-time = "2026-03-31T21:56:30.024Z" },
-    { url = "https://files.pythonhosted.org/packages/05/98/afd308e35b9d3d8c9ec54c0918f1d722c86dc17ddfec272fcdbcce5a3124/aiohttp-3.13.5-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:bace460460ed20614fa6bc8cb09966c0b8517b8c58ad8046828c6078d25333b5", size = 503535, upload-time = "2026-03-31T21:56:31.935Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/4d/926c183e06b09d5270a309eb50fbde7b09782bfd305dec1e800f329834fb/aiohttp-3.13.5-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:8f546a4dc1e6a5edbb9fd1fd6ad18134550e096a5a43f4ad74acfbd834fc6670", size = 497830, upload-time = "2026-03-31T21:56:33.654Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/d6/f47d1c690f115a5c2a5e8938cce4a232a5be9aac5c5fb2647efcbbbda333/aiohttp-3.13.5-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c86969d012e51b8e415a8c6ce96f7857d6a87d6207303ab02d5d11ef0cad2274", size = 1682474, upload-time = "2026-03-31T21:56:35.513Z" },
-    { url = "https://files.pythonhosted.org/packages/01/44/056fd37b1bb52eac760303e5196acc74d9d546631b035704ae5927f7b4ac/aiohttp-3.13.5-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b6f6cd1560c5fa427e3b6074bb24d2c64e225afbb7165008903bd42e4e33e28a", size = 1655259, upload-time = "2026-03-31T21:56:37.843Z" },
-    { url = "https://files.pythonhosted.org/packages/91/9f/78eb1a20c1c28ae02f6a3c0f4d7b0dcc66abce5290cadd53d78ce3084175/aiohttp-3.13.5-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:636bc362f0c5bbc7372bc3ae49737f9e3030dbce469f0f422c8f38079780363d", size = 1736204, upload-time = "2026-03-31T21:56:39.822Z" },
-    { url = "https://files.pythonhosted.org/packages/de/6c/d20d7de23f0b52b8c1d9e2033b2db1ac4dacbb470bb74c56de0f5f86bb4f/aiohttp-3.13.5-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6a7cbeb06d1070f1d14895eeeed4dac5913b22d7b456f2eb969f11f4b3993796", size = 1826198, upload-time = "2026-03-31T21:56:41.378Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/86/a6f3ff1fd795f49545a7c74b2c92f62729135d73e7e4055bf74da5a26c82/aiohttp-3.13.5-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bca9ef7517fd7874a1a08970ae88f497bf5c984610caa0bf40bd7e8450852b95", size = 1681329, upload-time = "2026-03-31T21:56:43.374Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/68/84cd3dab6b7b4f3e6fe9459a961acb142aaab846417f6e8905110d7027e5/aiohttp-3.13.5-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:019a67772e034a0e6b9b17c13d0a8fe56ad9fb150fc724b7f3ffd3724288d9e5", size = 1560023, upload-time = "2026-03-31T21:56:45.031Z" },
-    { url = "https://files.pythonhosted.org/packages/41/2c/db61b64b0249e30f954a65ab4cb4970ced57544b1de2e3c98ee5dc24165f/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:f34ecee82858e41dd217734f0c41a532bd066bcaab636ad830f03a30b2a96f2a", size = 1652372, upload-time = "2026-03-31T21:56:47.075Z" },
-    { url = "https://files.pythonhosted.org/packages/25/6f/e96988a6c982d047810c772e28c43c64c300c943b0ed5c1c0c4ce1e1027c/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:4eac02d9af4813ee289cd63a361576da36dba57f5a1ab36377bc2600db0cbb73", size = 1662031, upload-time = "2026-03-31T21:56:48.835Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/26/a56feace81f3d347b4052403a9d03754a0ab23f7940780dada0849a38c92/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:4beac52e9fe46d6abf98b0176a88154b742e878fdf209d2248e99fcdf73cd297", size = 1708118, upload-time = "2026-03-31T21:56:50.833Z" },
-    { url = "https://files.pythonhosted.org/packages/78/6e/b6173a8ff03d01d5e1a694bc06764b5dad1df2d4ed8f0ceec12bb3277936/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:c180f480207a9b2475f2b8d8bd7204e47aec952d084b2a2be58a782ffcf96074", size = 1548667, upload-time = "2026-03-31T21:56:52.81Z" },
-    { url = "https://files.pythonhosted.org/packages/16/13/13296ffe2c132d888b3fe2c195c8b9c0c24c89c3fa5cc2c44464dc23b22e/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:2837fb92951564d6339cedae4a7231692aa9f73cbc4fb2e04263b96844e03b4e", size = 1724490, upload-time = "2026-03-31T21:56:54.541Z" },
-    { url = "https://files.pythonhosted.org/packages/7a/b4/1f1c287f4a79782ef36e5a6e62954c85343bc30470d862d30bd5f26c9fa2/aiohttp-3.13.5-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:d9010032a0b9710f58012a1e9c222528763d860ba2ee1422c03473eab47703e7", size = 1667109, upload-time = "2026-03-31T21:56:56.21Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/42/8461a2aaf60a8f4ea4549a4056be36b904b0eb03d97ca9a8a2604681a500/aiohttp-3.13.5-cp310-cp310-win32.whl", hash = "sha256:7c4b6668b2b2b9027f209ddf647f2a4407784b5d88b8be4efcc72036f365baf9", size = 439478, upload-time = "2026-03-31T21:56:58.292Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/71/06956304cb5ee439dfe8d86e1b2e70088bd88ed1ced1f42fb29e5d855f0e/aiohttp-3.13.5-cp310-cp310-win_amd64.whl", hash = "sha256:cd3db5927bf9167d5a6157ddb2f036f6b6b0ad001ac82355d43e97a4bde76d76", size = 462047, upload-time = "2026-03-31T21:57:00.257Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/f5/a20c4ac64aeaef1679e25c9983573618ff765d7aa829fa2b84ae7573169e/aiohttp-3.13.5-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7ab7229b6f9b5c1ba4910d6c41a9eb11f543eadb3f384df1b4c293f4e73d44d6", size = 757513, upload-time = "2026-03-31T21:57:02.146Z" },
-    { url = "https://files.pythonhosted.org/packages/75/0a/39fa6c6b179b53fcb3e4b3d2b6d6cad0180854eda17060c7218540102bef/aiohttp-3.13.5-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:8f14c50708bb156b3a3ca7230b3d820199d56a48e3af76fa21c2d6087190fe3d", size = 506748, upload-time = "2026-03-31T21:57:04.275Z" },
-    { url = "https://files.pythonhosted.org/packages/87/ec/e38ce072e724fd7add6243613f8d1810da084f54175353d25ccf9f9c7e5a/aiohttp-3.13.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:e7d2f8616f0ff60bd332022279011776c3ac0faa0f1b463f7bb12326fbc97a1c", size = 501673, upload-time = "2026-03-31T21:57:06.208Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/ba/3bc7525d7e2beaa11b309a70d48b0d3cfc3c2089ec6a7d0820d59c657053/aiohttp-3.13.5-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a2567b72e1ffc3ab25510db43f355b29eeada56c0a622e58dcdb19530eb0a3cb", size = 1763757, upload-time = "2026-03-31T21:57:07.882Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/ab/e87744cf18f1bd78263aba24924d4953b41086bd3a31d22452378e9028a0/aiohttp-3.13.5-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:fb0540c854ac9c0c5ad495908fdfd3e332d553ec731698c0e29b1877ba0d2ec6", size = 1720152, upload-time = "2026-03-31T21:57:09.946Z" },
-    { url = "https://files.pythonhosted.org/packages/6b/f3/ed17a6f2d742af17b50bae2d152315ed1b164b07a5fd5cc1754d99e4dfa5/aiohttp-3.13.5-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c9883051c6972f58bfc4ebb2116345ee2aa151178e99c3f2b2bbe2af712abd13", size = 1818010, upload-time = "2026-03-31T21:57:12.157Z" },
-    { url = "https://files.pythonhosted.org/packages/53/06/ecbc63dc937192e2a5cb46df4d3edb21deb8225535818802f210a6ea5816/aiohttp-3.13.5-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:2294172ce08a82fb7c7273485895de1fa1186cc8294cfeb6aef4af42ad261174", size = 1907251, upload-time = "2026-03-31T21:57:14.023Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/a5/0521aa32c1ddf3aa1e71dcc466be0b7db2771907a13f18cddaa45967d97b/aiohttp-3.13.5-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3a807cabd5115fb55af198b98178997a5e0e57dead43eb74a93d9c07d6d4a7dc", size = 1759969, upload-time = "2026-03-31T21:57:16.146Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/78/a38f8c9105199dd3b9706745865a8a59d0041b6be0ca0cc4b2ccf1bab374/aiohttp-3.13.5-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:aa6d0d932e0f39c02b80744273cd5c388a2d9bc07760a03164f229c8e02662f6", size = 1616871, upload-time = "2026-03-31T21:57:17.856Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/41/27392a61ead8ab38072105c71aa44ff891e71653fe53d576a7067da2b4e8/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:60869c7ac4aaabe7110f26499f3e6e5696eae98144735b12a9c3d9eae2b51a49", size = 1739844, upload-time = "2026-03-31T21:57:19.679Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/55/5564e7ae26d94f3214250009a0b1c65a0c6af4bf88924ccb6fdab901de28/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:26d2f8546f1dfa75efa50c3488215a903c0168d253b75fba4210f57ab77a0fb8", size = 1731969, upload-time = "2026-03-31T21:57:22.006Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/c5/705a3929149865fc941bcbdd1047b238e4a72bcb215a9b16b9d7a2e8d992/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:f1162a1492032c82f14271e831c8f4b49f2b6078f4f5fc74de2c912fa225d51d", size = 1795193, upload-time = "2026-03-31T21:57:24.256Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/19/edabed62f718d02cff7231ca0db4ef1c72504235bc467f7b67adb1679f48/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:8b14eb3262fad0dc2f89c1a43b13727e709504972186ff6a99a3ecaa77102b6c", size = 1606477, upload-time = "2026-03-31T21:57:26.364Z" },
-    { url = "https://files.pythonhosted.org/packages/de/fc/76f80ef008675637d88d0b21584596dc27410a990b0918cb1e5776545b5b/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:ca9ac61ac6db4eb6c2a0cd1d0f7e1357647b638ccc92f7e9d8d133e71ed3c6ac", size = 1813198, upload-time = "2026-03-31T21:57:28.316Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/67/5b3ac26b80adb20ea541c487f73730dc8fa107d632c998f25bbbab98fcda/aiohttp-3.13.5-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:7996023b2ed59489ae4762256c8516df9820f751cf2c5da8ed2fb20ee50abab3", size = 1752321, upload-time = "2026-03-31T21:57:30.549Z" },
-    { url = "https://files.pythonhosted.org/packages/88/06/e4a2e49255ea23fa4feeb5ab092d90240d927c15e47b5b5c48dff5a9ce29/aiohttp-3.13.5-cp311-cp311-win32.whl", hash = "sha256:77dfa48c9f8013271011e51c00f8ada19851f013cde2c48fca1ba5e0caf5bb06", size = 439069, upload-time = "2026-03-31T21:57:32.388Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/43/8c7163a596dab4f8be12c190cf467a1e07e4734cf90eebb39f7f5d53fc6a/aiohttp-3.13.5-cp311-cp311-win_amd64.whl", hash = "sha256:d3a4834f221061624b8887090637db9ad4f61752001eae37d56c52fddade2dc8", size = 462859, upload-time = "2026-03-31T21:57:34.455Z" },
-    { url = "https://files.pythonhosted.org/packages/be/6f/353954c29e7dcce7cf00280a02c75f30e133c00793c7a2ed3776d7b2f426/aiohttp-3.13.5-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:023ecba036ddd840b0b19bf195bfae970083fd7024ce1ac22e9bba90464620e9", size = 748876, upload-time = "2026-03-31T21:57:36.319Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/1b/428a7c64687b3b2e9cd293186695affc0e1e54a445d0361743b231f11066/aiohttp-3.13.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:15c933ad7920b7d9a20de151efcd05a6e38302cbf0e10c9b2acb9a42210a2416", size = 499557, upload-time = "2026-03-31T21:57:38.236Z" },
-    { url = "https://files.pythonhosted.org/packages/29/47/7be41556bfbb6917069d6a6634bb7dd5e163ba445b783a90d40f5ac7e3a7/aiohttp-3.13.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ab2899f9fa2f9f741896ebb6fa07c4c883bfa5c7f2ddd8cf2aafa86fa981b2d2", size = 500258, upload-time = "2026-03-31T21:57:39.923Z" },
-    { url = "https://files.pythonhosted.org/packages/67/84/c9ecc5828cb0b3695856c07c0a6817a99d51e2473400f705275a2b3d9239/aiohttp-3.13.5-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a60eaa2d440cd4707696b52e40ed3e2b0f73f65be07fd0ef23b6b539c9c0b0b4", size = 1749199, upload-time = "2026-03-31T21:57:41.938Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/d3/3c6d610e66b495657622edb6ae7c7fd31b2e9086b4ec50b47897ad6042a9/aiohttp-3.13.5-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:55b3bdd3292283295774ab585160c4004f4f2f203946997f49aac032c84649e9", size = 1721013, upload-time = "2026-03-31T21:57:43.904Z" },
-    { url = "https://files.pythonhosted.org/packages/49/a0/24409c12217456df0bae7babe3b014e460b0b38a8e60753d6cb339f6556d/aiohttp-3.13.5-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c2b2355dc094e5f7d45a7bb262fe7207aa0460b37a0d87027dcf21b5d890e7d5", size = 1781501, upload-time = "2026-03-31T21:57:46.285Z" },
-    { url = "https://files.pythonhosted.org/packages/98/9d/b65ec649adc5bccc008b0957a9a9c691070aeac4e41cea18559fef49958b/aiohttp-3.13.5-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b38765950832f7d728297689ad78f5f2cf79ff82487131c4d26fe6ceecdc5f8e", size = 1878981, upload-time = "2026-03-31T21:57:48.734Z" },
-    { url = "https://files.pythonhosted.org/packages/57/d8/8d44036d7eb7b6a8ec4c5494ea0c8c8b94fbc0ed3991c1a7adf230df03bf/aiohttp-3.13.5-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b18f31b80d5a33661e08c89e202edabf1986e9b49c42b4504371daeaa11b47c1", size = 1767934, upload-time = "2026-03-31T21:57:51.171Z" },
-    { url = "https://files.pythonhosted.org/packages/31/04/d3f8211f273356f158e3464e9e45484d3fb8c4ce5eb2f6fe9405c3273983/aiohttp-3.13.5-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:33add2463dde55c4f2d9635c6ab33ce154e5ecf322bd26d09af95c5f81cfa286", size = 1566671, upload-time = "2026-03-31T21:57:53.326Z" },
-    { url = "https://files.pythonhosted.org/packages/41/db/073e4ebe00b78e2dfcacff734291651729a62953b48933d765dc513bf798/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:327cc432fdf1356fb4fbc6fe833ad4e9f6aacb71a8acaa5f1855e4b25910e4a9", size = 1705219, upload-time = "2026-03-31T21:57:55.385Z" },
-    { url = "https://files.pythonhosted.org/packages/48/45/7dfba71a2f9fd97b15c95c06819de7eb38113d2cdb6319669195a7d64270/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:7c35b0bf0b48a70b4cb4fc5d7bed9b932532728e124874355de1a0af8ec4bc88", size = 1743049, upload-time = "2026-03-31T21:57:57.341Z" },
-    { url = "https://files.pythonhosted.org/packages/18/71/901db0061e0f717d226386a7f471bb59b19566f2cae5f0d93874b017271f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:df23d57718f24badef8656c49743e11a89fd6f5358fa8a7b96e728fda2abf7d3", size = 1749557, upload-time = "2026-03-31T21:57:59.626Z" },
-    { url = "https://files.pythonhosted.org/packages/08/d5/41eebd16066e59cd43728fe74bce953d7402f2b4ddfdfef2c0e9f17ca274/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:02e048037a6501a5ec1f6fc9736135aec6eb8a004ce48838cb951c515f32c80b", size = 1558931, upload-time = "2026-03-31T21:58:01.972Z" },
-    { url = "https://files.pythonhosted.org/packages/30/e6/4a799798bf05740e66c3a1161079bda7a3dd8e22ca392481d7a7f9af82a6/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:31cebae8b26f8a615d2b546fee45d5ffb76852ae6450e2a03f42c9102260d6fe", size = 1774125, upload-time = "2026-03-31T21:58:04.007Z" },
-    { url = "https://files.pythonhosted.org/packages/84/63/7749337c90f92bc2cb18f9560d67aa6258c7060d1397d21529b8004fcf6f/aiohttp-3.13.5-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:888e78eb5ca55a615d285c3c09a7a91b42e9dd6fc699b166ebd5dee87c9ccf14", size = 1732427, upload-time = "2026-03-31T21:58:06.337Z" },
-    { url = "https://files.pythonhosted.org/packages/98/de/cf2f44ff98d307e72fb97d5f5bbae3bfcb442f0ea9790c0bf5c5c2331404/aiohttp-3.13.5-cp312-cp312-win32.whl", hash = "sha256:8bd3ec6376e68a41f9f95f5ed170e2fcf22d4eb27a1f8cb361d0508f6e0557f3", size = 433534, upload-time = "2026-03-31T21:58:08.712Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/ca/eadf6f9c8fa5e31d40993e3db153fb5ed0b11008ad5d9de98a95045bed84/aiohttp-3.13.5-cp312-cp312-win_amd64.whl", hash = "sha256:110e448e02c729bcebb18c60b9214a87ba33bac4a9fa5e9a5f139938b56c6cb1", size = 460446, upload-time = "2026-03-31T21:58:10.945Z" },
-    { url = "https://files.pythonhosted.org/packages/78/e9/d76bf503005709e390122d34e15256b88f7008e246c4bdbe915cd4f1adce/aiohttp-3.13.5-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:a5029cc80718bbd545123cd8fe5d15025eccaaaace5d0eeec6bd556ad6163d61", size = 742930, upload-time = "2026-03-31T21:58:13.155Z" },
-    { url = "https://files.pythonhosted.org/packages/57/00/4b7b70223deaebd9bb85984d01a764b0d7bd6526fcdc73cca83bcbe7243e/aiohttp-3.13.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4bb6bf5811620003614076bdc807ef3b5e38244f9d25ca5fe888eaccea2a9832", size = 496927, upload-time = "2026-03-31T21:58:15.073Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/f5/0fb20fb49f8efdcdce6cd8127604ad2c503e754a8f139f5e02b01626523f/aiohttp-3.13.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a84792f8631bf5a94e52d9cc881c0b824ab42717165a5579c760b830d9392ac9", size = 497141, upload-time = "2026-03-31T21:58:17.009Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/86/b7c870053e36a94e8951b803cb5b909bfbc9b90ca941527f5fcafbf6b0fa/aiohttp-3.13.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:57653eac22c6a4c13eb22ecf4d673d64a12f266e72785ab1c8b8e5940d0e8090", size = 1732476, upload-time = "2026-03-31T21:58:18.925Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/e5/4e161f84f98d80c03a238671b4136e6530453d65262867d989bbe78244d0/aiohttp-3.13.5-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e5e5f7debc7a57af53fdf5c5009f9391d9f4c12867049d509bf7bb164a6e295b", size = 1706507, upload-time = "2026-03-31T21:58:21.094Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/56/ea11a9f01518bd5a2a2fcee869d248c4b8a0cfa0bb13401574fa31adf4d4/aiohttp-3.13.5-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c719f65bebcdf6716f10e9eff80d27567f7892d8988c06de12bbbd39307c6e3a", size = 1773465, upload-time = "2026-03-31T21:58:23.159Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/40/333ca27fb74b0383f17c90570c748f7582501507307350a79d9f9f3c6eb1/aiohttp-3.13.5-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d97f93fdae594d886c5a866636397e2bcab146fd7a132fd6bb9ce182224452f8", size = 1873523, upload-time = "2026-03-31T21:58:25.59Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/d2/e2f77eef1acb7111405433c707dc735e63f67a56e176e72e9e7a2cd3f493/aiohttp-3.13.5-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3df334e39d4c2f899a914f1dba283c1aadc311790733f705182998c6f7cae665", size = 1754113, upload-time = "2026-03-31T21:58:27.624Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/56/3f653d7f53c89669301ec9e42c95233e2a0c0a6dd051269e6e678db4fdb0/aiohttp-3.13.5-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fe6970addfea9e5e081401bcbadf865d2b6da045472f58af08427e108d618540", size = 1562351, upload-time = "2026-03-31T21:58:29.918Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/a6/9b3e91eb8ae791cce4ee736da02211c85c6f835f1bdfac0594a8a3b7018c/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7becdf835feff2f4f335d7477f121af787e3504b48b449ff737afb35869ba7bb", size = 1693205, upload-time = "2026-03-31T21:58:32.214Z" },
-    { url = "https://files.pythonhosted.org/packages/98/fc/bfb437a99a2fcebd6b6eaec609571954de2ed424f01c352f4b5504371dd3/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:676e5651705ad5d8a70aeb8eb6936c436d8ebbd56e63436cb7dd9bb36d2a9a46", size = 1730618, upload-time = "2026-03-31T21:58:34.728Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/b6/c8534862126191a034f68153194c389addc285a0f1347d85096d349bbc15/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:9b16c653d38eb1a611cc898c41e76859ca27f119d25b53c12875fd0474ae31a8", size = 1745185, upload-time = "2026-03-31T21:58:36.909Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/93/4ca8ee2ef5236e2707e0fd5fecb10ce214aee1ff4ab307af9c558bda3b37/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:999802d5fa0389f58decd24b537c54aa63c01c3219ce17d1214cbda3c2b22d2d", size = 1557311, upload-time = "2026-03-31T21:58:39.38Z" },
-    { url = "https://files.pythonhosted.org/packages/57/ae/76177b15f18c5f5d094f19901d284025db28eccc5ae374d1d254181d33f4/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:ec707059ee75732b1ba130ed5f9580fe10ff75180c812bc267ded039db5128c6", size = 1773147, upload-time = "2026-03-31T21:58:41.476Z" },
-    { url = "https://files.pythonhosted.org/packages/01/a4/62f05a0a98d88af59d93b7fcac564e5f18f513cb7471696ac286db970d6a/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2d6d44a5b48132053c2f6cd5c8cb14bc67e99a63594e336b0f2af81e94d5530c", size = 1730356, upload-time = "2026-03-31T21:58:44.049Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/85/fc8601f59dfa8c9523808281f2da571f8b4699685f9809a228adcc90838d/aiohttp-3.13.5-cp313-cp313-win32.whl", hash = "sha256:329f292ed14d38a6c4c435e465f48bebb47479fd676a0411936cc371643225cc", size = 432637, upload-time = "2026-03-31T21:58:46.167Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/1b/ac685a8882896acf0f6b31d689e3792199cfe7aba37969fa91da63a7fa27/aiohttp-3.13.5-cp313-cp313-win_amd64.whl", hash = "sha256:69f571de7500e0557801c0b51f4780482c0ec5fe2ac851af5a92cfce1af1cb83", size = 458896, upload-time = "2026-03-31T21:58:48.119Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/f0/f81190ba488cd106c2fc6d92680e56bb223bbbbf1e6908c2617011290112/aiohttp-3.14.0-cp310-cp310-macosx_10_9_universal2.whl", hash = "sha256:692e409052e7436029bbb32977cd7c5bf806ac5fa4085b973996785ffadad33c", size = 760606, upload-time = "2026-06-01T19:36:39.054Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/54/444d37eebf0f15db661ca44ec7caf93962f3c5ca92eb4c9a5d888b70aaa2/aiohttp-3.14.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:40af7ebe53c7990e110dc4ad03566b12c3ac996254298a3d39046dd69cfcb2c2", size = 514677, upload-time = "2026-06-01T19:36:42.408Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/d1/da280e23321c132c0a3fa7c8cc2830621d79174edc64c829443346489a36/aiohttp-3.14.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:02cb2ffbb7da32f82e21ad9952669c45bd88a80e0878264c2f59fe1c6fb2badd", size = 510155, upload-time = "2026-06-01T19:36:44.072Z" },
+    { url = "https://files.pythonhosted.org/packages/09/b8/2e36d54d0991ec5bba451444004591ee0af58cb1662a3a81c562878b9c1f/aiohttp-3.14.0-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2e2514cb7195f6d7c219339635bea71ae47d1569b051300d32df9dcfabcdb869", size = 1699947, upload-time = "2026-06-01T19:36:45.762Z" },
+    { url = "https://files.pythonhosted.org/packages/57/95/a31d8ea1a0b9ecc084f5a7dd0b431ce64ef585918bb7bdc82afe11843877/aiohttp-3.14.0-cp310-cp310-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:30e8b7eeb42d02c120ca90d6c6e076a221a16b70a6dac9ae44c7ab5104cc7fe4", size = 1664364, upload-time = "2026-06-01T19:36:47.653Z" },
+    { url = "https://files.pythonhosted.org/packages/01/f6/5de3ddffc87a9e8d09b3be38fbd6dd1a736b2ad477a7e787dcb85f57f338/aiohttp-3.14.0-cp310-cp310-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:63e38be0d75a654deaa06be32fb4cab883a4222940be1d05861b6717679cbadb", size = 1761186, upload-time = "2026-06-01T19:36:49.355Z" },
+    { url = "https://files.pythonhosted.org/packages/33/8c/03c5438ec35d7e3a4f33fe895d6c3ec7540a7cec46065f21851211e1ee4d/aiohttp-3.14.0-cp310-cp310-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1210d4c87cc00128160c7384ab41877a701295b97cffa6362f908a49b6e8a7ca", size = 1849727, upload-time = "2026-06-01T19:36:51.478Z" },
+    { url = "https://files.pythonhosted.org/packages/22/32/5a05303b0874458920b73f48b8779cc3a93d503f121b38dcc0456dbd698c/aiohttp-3.14.0-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1a78a77366ed158a0a54b076990e575d7b7cdb728cbfd02711eadab150f2269f", size = 1708197, upload-time = "2026-06-01T19:36:53.241Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/62/478f169488d61414c0a05e7fe423b59ae3d9dcc933d1f0e4acc2c5d5bc3e/aiohttp-3.14.0-cp310-cp310-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f4d2038c64f36df96cfd3fa0937910e231eafbf897e70a06c155a817bb632fa6", size = 1578147, upload-time = "2026-06-01T19:36:55.154Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/af/b20af85765658972d3337834bd5eebba91b962794f2b4fc3e0ee8c85c0e1/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_aarch64.whl", hash = "sha256:4714c70067a08b604d0bf3bc4dfdf82e52944afab41d0428d460862763d2f79b", size = 1665836, upload-time = "2026-06-01T19:36:56.94Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/a3/771879cfd59948f4544b172189048905feff802f20f1c6c5411e998a3e06/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_armv7l.whl", hash = "sha256:f79bfd2847513a7ac801bbafd1de02348a37926ac439eeb4bfe96fcff4eada15", size = 1680335, upload-time = "2026-06-01T19:36:58.642Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/16/582e36ad1d32133cd40659f3bc98e71c22179665a1cfbbb4713bce339c06/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_ppc64le.whl", hash = "sha256:25e9f1d2465a210d60edb64d7b204a147e85d4c194eecef3d1604fb5ace678ce", size = 1731180, upload-time = "2026-06-01T19:37:00.583Z" },
+    { url = "https://files.pythonhosted.org/packages/11/bc/80708fe3f64a07a2c306a42fc7b009118a952709761d215f6d1b4c57195b/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_riscv64.whl", hash = "sha256:b5314743ebe926c2fda35d0a298c565c885505f6635c2a30936363404cf274a7", size = 1565805, upload-time = "2026-06-01T19:37:02.446Z" },
+    { url = "https://files.pythonhosted.org/packages/57/8f/8d25897f8273a32fe4ad40a8885eec4f397377ed46e8e383078169f60316/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_s390x.whl", hash = "sha256:28eee8de1d69711c53116df8202f1c2aa0e3f80ef912a88fc18d159d53e7110b", size = 1742496, upload-time = "2026-06-01T19:37:04.222Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/7d/c341d32ab2dec56c8478740695743dc6c21b383cace9376a3eab16311a07/aiohttp-3.14.0-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:89ed35666c95d3efe1955056afcde09e62a57a34e2a4398b17f9f6c1564f0b25", size = 1691240, upload-time = "2026-06-01T19:37:06.277Z" },
+    { url = "https://files.pythonhosted.org/packages/37/0f/a81207dd7a2d4a4f645b3a3f8b5a1da1159dc63117ffb137b698fd6df50f/aiohttp-3.14.0-cp310-cp310-win32.whl", hash = "sha256:5e4646e9a6af29af354204011bf5769cb0276ec5b64653e42f90b3e13845169f", size = 454686, upload-time = "2026-06-01T19:37:07.96Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/ae/842357f2afb9c915715c6f5775239d987f5d0f845abf7675fa794e0a9d40/aiohttp-3.14.0-cp310-cp310-win_amd64.whl", hash = "sha256:22a8d06f204e0518a586d770032db3c7043c9ba3693081b3e3ad425e1458d594", size = 478677, upload-time = "2026-06-01T19:37:09.652Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/d1/330fb22c9535ec177b52396905131c6e39447244b6ca876262939af668ef/aiohttp-3.14.0-cp310-cp310-win_arm64.whl", hash = "sha256:4acfc34bd4d3c58754fc9f22ff1b5e92aabce68f3d4bf7b71a0b732d9bceb78a", size = 450364, upload-time = "2026-06-01T19:37:11.279Z" },
+    { url = "https://files.pythonhosted.org/packages/67/47/7727bfe8db93f8835a001bd4359d8480cc68d1259b8bce334668f8be97bd/aiohttp-3.14.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:54bf3522d6f7351e55f89a62d5c2bf138ad557b031670266c5df604ae88e0b5a", size = 759147, upload-time = "2026-06-01T19:37:12.918Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/f2/cd3fedff6fade73d71df9ec908c210cec518ef90fd00289250684b90aecf/aiohttp-3.14.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:0746d9fb0ac4fdef643a84494efe3f06d50335dd8c7a530228b86448aae0a803", size = 513705, upload-time = "2026-06-01T19:37:14.633Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/fe/49746b6b610144a06323bebd8e1211a390310d8c69b98dd6d52df341bc3e/aiohttp-3.14.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:9f3a96b6d39a4872222beee72e1df41d2ff886ae96152cf3e757ef8c5673ef0e", size = 509627, upload-time = "2026-06-01T19:37:16.385Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/3f/28f2f6cf3d5c0e7b01b27140d0e7873fd11fb341169ad3ce78ad04aba628/aiohttp-3.14.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d336820adbb914debbc90a1d8c1bfc4bea55996aecf64866a989d35d1f9fd903", size = 1769293, upload-time = "2026-06-01T19:37:18.067Z" },
+    { url = "https://files.pythonhosted.org/packages/97/6f/2e5f1b525d5474b12b3c60abf733a755845f3bceff21542081ada515f837/aiohttp-3.14.0-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:71b2604c9bfc1b115547d63a094d5244b3f02799833513a99a68aaa7b167c4cb", size = 1732363, upload-time = "2026-06-01T19:37:20.138Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/ce/596120faa85ca7b19cd061e3f2f3be23aa8f11a0aedf9191db9e0da1bd76/aiohttp-3.14.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:610d68800435903e303ca0542b9d3e4eb72a12ff33a6d471a070c1d81eebd3c2", size = 1840375, upload-time = "2026-06-01T19:37:22.104Z" },
+    { url = "https://files.pythonhosted.org/packages/72/3c/a7ffe05a757a4a7867643da69357ec41f506879fbd1b231d2ed90af246b2/aiohttp-3.14.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:514db9a79337068981ee2137310283a07b4b885c584991097a91a4da419bcb81", size = 1921484, upload-time = "2026-06-01T19:37:24.068Z" },
+    { url = "https://files.pythonhosted.org/packages/93/fa/2c861170bbd4a491de93a69e081db1d971092569e0d593a98ef62c384dc1/aiohttp-3.14.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c452d17eeb95d563fc8b936f3050301dbd1d268126c4632d8b70ede9696202ee", size = 1774153, upload-time = "2026-06-01T19:37:26.256Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/da/1d2f5a165f47ec9b1f69d37b8b977fdc4d501aa72ffb7930db27bb9e49ea/aiohttp-3.14.0-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:ed94a81506e3d1bdbad5108f497a58f2a2354aedb4ca314d5326f07d1fd1ac2d", size = 1632569, upload-time = "2026-06-01T19:37:28.192Z" },
+    { url = "https://files.pythonhosted.org/packages/46/1d/7a6e295c4257252f70f69e90864fdad74b6a1293054fb3f9e65a15de6d63/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1394dce36e0f0d260ac0b555a654de19cb989f3c1b8bdd24f505314dfea18a00", size = 1740325, upload-time = "2026-06-01T19:37:30.08Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/7e/e1899b1ca3ec62f1eab2a5cbde14039b97493f7f53eb88d9b668562ffa8d/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:d1467d1e7b48a73ca7237e0ee4335f3d02b923dbc27b82fd254bc301c97d4026", size = 1748691, upload-time = "2026-06-01T19:37:32.211Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/54/4e6b61c1fe7d3433f82bcc6bd7e4d7c683a742a10c9b12a025fd3695c047/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:6a5f3532125233c261cf61f32df4059cfcf482eb793c7d3db8452e3142028b86", size = 1814477, upload-time = "2026-06-01T19:37:34.173Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/38/86fd51be2e08d8e45c83d879d255f10391903cd9fe2a16512f7591a15873/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:3ea81eb518a2ecb319d8ec6d1424a37c773f6634bd87d6985eb606b2faac419f", size = 1623393, upload-time = "2026-06-01T19:37:36.281Z" },
+    { url = "https://files.pythonhosted.org/packages/78/49/466e947a42a88ee23c486d036e7e5d1b097f1bafd8084ad9c9a0a92f0f43/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:32e735c3182de7b64f6941a4ede48b38c7f47d9437bd615dd30b5bda8fa1bc93", size = 1824097, upload-time = "2026-06-01T19:37:38.421Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/89/35f3410bc284682338a1be6b6ea0c5abfa05f063942cfaa9256608440434/aiohttp-3.14.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:c21ca9a1c63d4509158f478aeb9d02914dcc52adc68d1bc9dee2452284ee5996", size = 1764790, upload-time = "2026-06-01T19:37:40.755Z" },
+    { url = "https://files.pythonhosted.org/packages/42/80/2d4291bd5724d3d17e5951aff5a3e02281483fb47295f0788276ee66cd73/aiohttp-3.14.0-cp311-cp311-win32.whl", hash = "sha256:19ca5fc84130675ba11c6ca5c7da5cb65f7bf8a32cdd2b616bf49cd334688aae", size = 454176, upload-time = "2026-06-01T19:37:42.837Z" },
+    { url = "https://files.pythonhosted.org/packages/59/ed/41d0ad4f6ececffc32bdf1f7b494e5498f7ca5c849ea2e3cc9bbd1668251/aiohttp-3.14.0-cp311-cp311-win_amd64.whl", hash = "sha256:d488e6e9d3bb8ba5ae7066d5be885ae9670eba021b8c6ccb9a3a568e6b19d6e5", size = 479334, upload-time = "2026-06-01T19:37:44.776Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/86/c0b5e305c770053f8c3d069bb52b8196917ba91949d1962d52eb307fb0d2/aiohttp-3.14.0-cp311-cp311-win_arm64.whl", hash = "sha256:8b93618102caf12801638a01a2b478a55410ddd71bd41cfaf6f707953a49ac43", size = 450262, upload-time = "2026-06-01T19:37:46.461Z" },
+    { url = "https://files.pythonhosted.org/packages/89/97/2b6889bfb6b6847520d50d95eb8c4307a45e28aaca39faf4a9454b3d1b2f/aiohttp-3.14.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:b29518c9c2ec7e373e68259206a137c7f4f5439c58baaec4b5ab3ab799850a4e", size = 750194, upload-time = "2026-06-01T19:37:48.164Z" },
+    { url = "https://files.pythonhosted.org/packages/21/e2/62634b7fff918ed98c3c6b2f0e70d520f7f28846cb412d451b04354c6459/aiohttp-3.14.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:dbec68ce61b64cb73cab4d33df9433427b1713c8bcccb181dce695c1b6f8e87c", size = 506966, upload-time = "2026-06-01T19:37:50.014Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/fb/5ce075150828c797a5106f1c2fb26034e709d4289b9d2bf8b07f1e59fac6/aiohttp-3.14.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:3cdf534aa455593e589302990c5097aa5c92c06c4262a20da22934f9186a5fff", size = 507527, upload-time = "2026-06-01T19:37:51.96Z" },
+    { url = "https://files.pythonhosted.org/packages/01/d5/405a0ae4e6b081754a3609c1c97c63a950e000a2def16046f1e736933a0e/aiohttp-3.14.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cb6c657104393b5fbff01a5f59b2023db74058a8077d94475d6c25d03882a108", size = 1762420, upload-time = "2026-06-01T19:37:53.839Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/1d/e05a7c896b15a6bc6fb8fc5319eb437861c2c49c34559ef928add6590315/aiohttp-3.14.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:46fbbec4e4fab7428d4396a3823f9320e4560aa3113b89eeebce712c27c9ed5a", size = 1733672, upload-time = "2026-06-01T19:37:55.791Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/22/a72f7c459e195fa41bf4f7abd1f925b91fe91f8097e51c654229ba144a33/aiohttp-3.14.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2c2c7e05dd5335b298085abf45ddf98673934c3ee1c083d0b9ea13d4186ad500", size = 1805064, upload-time = "2026-06-01T19:37:57.931Z" },
+    { url = "https://files.pythonhosted.org/packages/80/50/e85bdaba0be59ca4838005ebfef4048fcdd5f35a02b07057a9a123394440/aiohttp-3.14.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3c7139100fbaae76515b73051d8f0aa3a3ff02e415eec8a8eee8e2223d9ba955", size = 1902125, upload-time = "2026-06-01T19:38:00.225Z" },
+    { url = "https://files.pythonhosted.org/packages/19/d8/51de5c6b971c27bb1ef620293b8d1ca611ec78736b34b3f6ccf68e4c8785/aiohttp-3.14.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:78d6f9286a629ce52728430afe18f8ed2b6c39a1fddb3802d7244b9983910ad2", size = 1783112, upload-time = "2026-06-01T19:38:02.641Z" },
+    { url = "https://files.pythonhosted.org/packages/73/ae/b4402bfde77e43dfb1b6ccff83c7b7ab63ed06b50c4754f0c5423fb374fe/aiohttp-3.14.0-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:cc3c3e12cdaeb92d7dcf13db00e9f6b1956b910e47256e696df1cfa946d02159", size = 1586356, upload-time = "2026-06-01T19:38:04.637Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/05/750a3265ca4dc54a460bd0cb1121a8f2ce9171fce4a135fb47ea7fd594d2/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4d6a998191f5ebe3b8c28463ff72bc030250008b3193c402464efadd08b5ca02", size = 1723119, upload-time = "2026-06-01T19:38:06.713Z" },
+    { url = "https://files.pythonhosted.org/packages/37/01/8c0812c50b3b1b1c37b323bf170d6be8847a8f234060485b7d1e71953f60/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:0fc2b75ae8d169d853be2862d960be8550da6c5c65711d5476407eb3fdb006bd", size = 1757216, upload-time = "2026-06-01T19:38:08.736Z" },
+    { url = "https://files.pythonhosted.org/packages/47/2a/50fb98028a26887cbe48dcc1df92a90825615bc73b5584301304090cded8/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:16eee56bcc72d04600bc56c1759982c2385ec0b41d3fd3521f836bf64a0957ef", size = 1770500, upload-time = "2026-06-01T19:38:11.111Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/32/0ffd598a2fa2b9a423daf242e700cfdabda35d6e602394ad9ae58972c1c7/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:5a2e7ca615c3ddc15b82687e05a624e5f5cba3f1d6c20cb81172d70ea498451e", size = 1576224, upload-time = "2026-06-01T19:38:13.391Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/f9/b9fc381dd9b66afb33f2634c40e229d106467be0afcabe79648631ab6712/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:f0b7b8bbbec3ce9467ee0ebe334622fd90624f593edd3136c567811453fc4fae", size = 1794252, upload-time = "2026-06-01T19:38:15.498Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/fb/05d9214c975f23225a8cd5c439325e338c7c377b315480ef3871db51f54e/aiohttp-3.14.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5ba10966d4f03dd96a14365be4b8e37c327c76f11c3ca867116966cdd9f98066", size = 1760193, upload-time = "2026-06-01T19:38:17.624Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/4b/02992fc4fb9e1b6673ee3f888a8e587a6447afda1f6f4aca776c148c2876/aiohttp-3.14.0-cp312-cp312-win32.whl", hash = "sha256:101df7779c80c0636014a6b2c6642acd3efb5b355d48347c9d7dfb720aee9430", size = 448650, upload-time = "2026-06-01T19:38:19.545Z" },
+    { url = "https://files.pythonhosted.org/packages/39/e9/246532214c3abda518477cbaaf16d420295ad8effa5233844cbb38f299ab/aiohttp-3.14.0-cp312-cp312-win_amd64.whl", hash = "sha256:b0a5747586d4467efd1f932710b269131c9717a872dce082cd92a00c1c13123a", size = 476145, upload-time = "2026-06-01T19:38:21.505Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/c3/63f8c20090048915711598b0adf475b149216d736157961de06480a45b15/aiohttp-3.14.0-cp312-cp312-win_arm64.whl", hash = "sha256:5f1c5be60add78fabb4aacd13c5a348ae79d2fcbfc7fa78da8f1eb192273b370", size = 444250, upload-time = "2026-06-01T19:38:24.027Z" },
+    { url = "https://files.pythonhosted.org/packages/21/61/d11f7d9a3144bffe825247d6367cd93053666da50b94707c9129c78868d5/aiohttp-3.14.0-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:25400d710641a8040bf022a8a99f579e581ffa1c5bd42c33255d7d6f3957c127", size = 502399, upload-time = "2026-06-01T19:38:25.955Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/9b/a7e317625d36356844f8bb022cabd305b541f968856cc3c2e0b58e53ee6e/aiohttp-3.14.0-cp313-cp313-android_21_x86_64.whl", hash = "sha256:c5492b9929826e07cc3fcb9739ae87aab05dff6b5e67a9b73fd1700c6d008981", size = 510068, upload-time = "2026-06-01T19:38:27.828Z" },
+    { url = "https://files.pythonhosted.org/packages/11/41/cc2d2cfbfbdc3126ba258f3cd27d1ac8a33492ae3c35a4583ee21f0ba7f1/aiohttp-3.14.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:3366751d68d237c621264233a32f3078bbc21b7904ab90a77e03d21390c742c6", size = 481670, upload-time = "2026-06-01T19:38:29.836Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/07/381f4023c3b08cb616e520f566d8c58957abad54e56441d41fe67cfb0195/aiohttp-3.14.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:57ea07d28695a7a40304d42251892a8df765e5588c10ee32afeddcd5df33c0a2", size = 487591, upload-time = "2026-06-01T19:38:31.704Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/4d/4506fdb7a022bdf70011a3bbb4ca00c5c570026ef6a3c5bd7bc70c39089c/aiohttp-3.14.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:076cb014191ae2e65d949e1ad01f1dcfe33e32789b5172510f3e79c79fc04d50", size = 496503, upload-time = "2026-06-01T19:38:33.6Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/7d/c814111e04894a45d9e2defc94443879a6f118d9633d5fedfe6e2e8af5f0/aiohttp-3.14.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:2f3fc37054564dee64a855b5b092d87ec35dcddfaabf7dacb1c8a2b1f83dc0a9", size = 745870, upload-time = "2026-06-01T19:38:36.013Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/ee/80eee0efddfe187e7cd05027086b7ce1c0e492e82a4eda58f5c5543a44a0/aiohttp-3.14.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8fcaef74d2ab0f607d7ff85a0d15e21bb5a258c4a58df1908396eb50d7f4ed3c", size = 505588, upload-time = "2026-06-01T19:38:38.282Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/f8/0f28f04eef75d52fc9c715dde7ce9c0abb810fd20cfeb0fea7afd2ab1e98/aiohttp-3.14.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:e4c01b0bfc6209590960e68eac083cd22d5d87c21f974dd6208cafa5d3542bc8", size = 504492, upload-time = "2026-06-01T19:38:40.611Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/db/44c755232085545065c94378dfce38641b1aee647f4939fcd32f5b32e719/aiohttp-3.14.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f12eb7896e81caf403a2b18c9406426f1207361e7239c057ab29c076d4257e83", size = 1752111, upload-time = "2026-06-01T19:38:42.682Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/6a/42e030a46743841414402a3b00cd3d78419055e86c66fb5822c14b5abfc6/aiohttp-3.14.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:6c79a044cacf360ec46738d863d2f41c9300d2a06ef4a7402ea0df306a350e61", size = 1729674, upload-time = "2026-06-01T19:38:44.79Z" },
+    { url = "https://files.pythonhosted.org/packages/34/26/3199beb415202e3108e7b83ecebe10914d806d33fb9860c3e4aa60a19be3/aiohttp-3.14.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:85e0675f47be4eff0636bf88c02140ea89168ae0df3ff1f3f464e9de9610d277", size = 1798808, upload-time = "2026-06-01T19:38:47.01Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/94/b9b6fcf0ee17c21d0d19fb8c22bf83ad18f82e702a9c3bd901a868f5e446/aiohttp-3.14.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:7b33e751cab03fdc960095b1e326cb5a03f5ee577d6ded59f3d1c100f8668882", size = 1891921, upload-time = "2026-06-01T19:38:49.233Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/a3/3800dbd095cb2bb165a7ea5d94d790914677e27f45638c7d80e3f34c8945/aiohttp-3.14.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:26d9224c6dd7f5c749aba4f61315a894601448b28d94d12f4dea0903e26d2096", size = 1777241, upload-time = "2026-06-01T19:38:52.04Z" },
+    { url = "https://files.pythonhosted.org/packages/21/2a/45be91ad1b860508557448d4cc2e165a2ee68dd865657b73bf66cc5a00fb/aiohttp-3.14.0-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:6281aecdf2732940f4fe06bd6adec5ae4d59b78b080b8e3a6b81467301010988", size = 1579554, upload-time = "2026-06-01T19:38:54.508Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/3d/dc94df99ed1511fdf28314f722643ed334112643cab00223577085e788c4/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:23e8314e7aed8576fbe33314d218bd81447a3adbc91dc36f1163bf583cd3084c", size = 1714864, upload-time = "2026-06-01T19:38:56.788Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/e4/1f1c8acbb3acd5c8f795473b92c9c3d44eb60a5692c6104256c8a1c83a0c/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:3b54fbff46127aeafdd764cecd0d99fa2f24a0e37ea5c18a7c3a4ac450df1db3", size = 1749803, upload-time = "2026-06-01T19:38:59.367Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/c8/c45ea6e7ed84cebba939b9c334498a045ba19d79c61b0110df5f21580de3/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:b27d89af91a555f58e08e4902dbcbc48862fd40095720ca705990476bd93b7ac", size = 1765023, upload-time = "2026-06-01T19:39:01.651Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/a1/a932941784432962fe390e1066823aaef64b4e5ac9fa595df57b5fe472a9/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:25d2326a4967bf705a9f9913a13005e93b6020ad8a9f6bd6bd78850d5171332e", size = 1571671, upload-time = "2026-06-01T19:39:04.044Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/01/e1280feac522597a4d46eb67a0cdfa053cfae263033030b761ab146f29fb/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:a1d209375c503472b3c0a340cdf3c55fcd82e84b46dda7caeaced59faba373ec", size = 1789904, upload-time = "2026-06-01T19:39:06.294Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/10/ab28818262f4d26bdb47ed5f1fc7999b69e2fc6e0370b02d0f49011f45ea/aiohttp-3.14.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:666c7c5036df57b693026398b69b41874a1931ac5b3485fd910e57bfac253869", size = 1754516, upload-time = "2026-06-01T19:39:08.788Z" },
+    { url = "https://files.pythonhosted.org/packages/af/cc/c122eabd7a1b7e0c9bbdd6be60e4715905b858399145d9df872bb94f1427/aiohttp-3.14.0-cp313-cp313-win32.whl", hash = "sha256:23f094a1ef64823fd35854ddf5c7a80a078162f37f9d2f7c6142b51a6affa456", size = 448656, upload-time = "2026-06-01T19:39:11.171Z" },
+    { url = "https://files.pythonhosted.org/packages/41/a5/bab07d79848a00eedd8ed979ccb302aaea3ac6eb9fa16bd0ed87135869b4/aiohttp-3.14.0-cp313-cp313-win_amd64.whl", hash = "sha256:e03abdaa17d553f17e1d1d06bb266b3970106c78051d06795723e748d8e49d11", size = 475803, upload-time = "2026-06-01T19:39:13.439Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/a0/f03ade8566c153666a3871afccbedf6d99911da006325e1fc6cf72a2de99/aiohttp-3.14.0-cp313-cp313-win_arm64.whl", hash = "sha256:acdb400538cf4769543548bb5d1eb23d39bed4f96554a6078cb728c7cb2c268b", size = 443889, upload-time = "2026-06-01T19:39:15.945Z" },
 ]
 
 [[package]]
@@ -2652,21 +2662,21 @@ wheels = [
 
 [[package]]
 name = "microsoft-kiota-abstractions"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "opentelemetry-api" },
     { name = "opentelemetry-sdk" },
     { name = "std-uritemplate" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/fa/42/e9ddbdf6c2c772651e09ad74bd28dbf1c11e3f54bbb7cdb88ce57959f7c3/microsoft_kiota_abstractions-1.9.2.tar.gz", hash = "sha256:29cdafe8d0672f23099556e0b120dca6231c752cca9393e1e0092fa9ca594572", size = 24456, upload-time = "2025-02-06T13:12:37.979Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/8f/94/37315b82a1bcc08145e5bc2af7396a4be8160ac138ec269611c3b9589b7a/microsoft_kiota_abstractions-1.9.9.tar.gz", hash = "sha256:5df9a8e0517a4568726c2cac6d9789284cc6ffa66043b68eba42ae55749fb861", size = 24468, upload-time = "2026-03-02T21:03:50.133Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4c/29/5d2f55d5925236e7c4c1a1b521567bc89ecf0b439354eae0f10e7f10aba2/microsoft_kiota_abstractions-1.9.2-py3-none-any.whl", hash = "sha256:a8853d272a84da59d6a2fe11a76c28e9c55bdab268a345ba48e918cb6822b607", size = 44411, upload-time = "2025-02-06T13:12:36.093Z" },
+    { url = "https://files.pythonhosted.org/packages/53/6a/7d5a1a8131f0eccc6b45839c091aa00ba29661854e7defaa7936cf342fa7/microsoft_kiota_abstractions-1.9.9-py3-none-any.whl", hash = "sha256:8d0a14eda42f3f0ccac2e9512227a338f69998dc9b782fd21cb8ca7c48302caa", size = 44453, upload-time = "2026-03-02T21:03:51.11Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-authentication-azure"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohttp" },
@@ -2675,14 +2685,14 @@ dependencies = [
     { name = "opentelemetry-api" },
     { name = "opentelemetry-sdk" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/97/bc/91b07dd6923f351afaa3121d12eab99a49f4da8128975fc8eefc1d1bef9b/microsoft_kiota_authentication_azure-1.9.2.tar.gz", hash = "sha256:171045f522a93d9340fbddc4cabb218f14f1d9d289e82e535b3d9291986c3d5a", size = 4986, upload-time = "2025-02-06T13:12:47.76Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ca/ce/5ae8b37ee4a50f0ed5e092c2d0105d60b592e6102a190959f76658a0994c/microsoft_kiota_authentication_azure-1.9.9.tar.gz", hash = "sha256:aca5e7dc8a0a28224f9025a479349ac2f9aaf166bfd6bc707f232658b45eec28", size = 5000, upload-time = "2026-03-02T21:04:02.355Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/31/91/30a29f828b40d85c0bcef803fafbca6a30761fe5cef451dee0e6ad95a74a/microsoft_kiota_authentication_azure-1.9.2-py3-none-any.whl", hash = "sha256:56840f8b15df8aedfd143fb2deb7cc7fae4ac0bafb1a50546b7313a7b3ab4ca0", size = 6908, upload-time = "2025-02-06T13:12:46.153Z" },
+    { url = "https://files.pythonhosted.org/packages/98/de/dc504324b776d00a420886cc6f39e04be2cf48cab0e9b18f8450a5efcc29/microsoft_kiota_authentication_azure-1.9.9-py3-none-any.whl", hash = "sha256:73dc21a1a2861ea78a135327291db3322e2255542a18b311dd03fd908342e902", size = 6951, upload-time = "2026-03-02T21:04:03.18Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-http"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "httpx", extra = ["http2"] },
@@ -2690,57 +2700,57 @@ dependencies = [
     { name = "opentelemetry-api" },
     { name = "opentelemetry-sdk" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5d/f3/4738613a6711917a1b4f829c962f3ce09a286c12a1037dc0fd666a9f4ad7/microsoft_kiota_http-1.9.2.tar.gz", hash = "sha256:2ba3d04a3d1d5d600736eebc1e33533d54d87799ac4fbb92c9cce4a97809af61", size = 21205, upload-time = "2025-02-06T13:12:56.783Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5d/3f/fc18eb0d1d845daf6355fd54fd990af7f7e10043ef6a6da39b9e5981cbaf/microsoft_kiota_http-1.9.9.tar.gz", hash = "sha256:ae672b145df71b644f8da0951767a12a4ce47a40576d86eba19b7c22d9e160f9", size = 21493, upload-time = "2026-03-02T21:04:11.662Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/95/2d/1b23c6f3c3fd1bbf065c11cdb66f59ccefcfed7bae0b7de9adb260260e05/microsoft_kiota_http-1.9.2-py3-none-any.whl", hash = "sha256:3a2d930a70d0184d9f4848473f929ee892462cae1acfaf33b2d193f1828c76c2", size = 31507, upload-time = "2025-02-06T13:12:55.022Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/6a/cc1b1055b4b6d4dfc1be7a71917c2f0ef19c070c6a18b16d3c1032d20925/microsoft_kiota_http-1.9.9-py3-none-any.whl", hash = "sha256:a5b1b217ac9afeb4054f12515417e3b1d2be12a9385a70a41d18d64379ea2e7e", size = 31945, upload-time = "2026-03-02T21:04:12.328Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-serialization-form"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5d/51/ddbed9c6a3d7197c94d03d5a71bd01181fa0e6051b5919ca81e116061a30/microsoft_kiota_serialization_form-1.9.2.tar.gz", hash = "sha256:badfbe65d8ec3369bd58b01022d13ef590edf14babeef94188efe3f4ec24fe41", size = 8987, upload-time = "2025-02-06T13:13:07.425Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ee/b4/18e9fce60a30c8b6ea0a6278fb81cf352127340d48df2d7c52ff1b579488/microsoft_kiota_serialization_form-1.9.9.tar.gz", hash = "sha256:3cdc8b172baec5b5282af72f2ce02715edcd23252ce0b5af96075256edd75114", size = 9015, upload-time = "2026-03-02T21:04:20.39Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/68/e1/5cd5f6c636f9913ccf9143fc78f61563cecdf3c268a5d0743d3da26e3add/microsoft_kiota_serialization_form-1.9.2-py3-none-any.whl", hash = "sha256:7b997efb2c8750b1d4fbc00878ba2a3e6e1df3fcefc8815226c90fcc9c54f218", size = 10664, upload-time = "2025-02-06T13:13:04.482Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/24/eb8436b882f1473bd0a868848d214df3df2d9b3db8e5422d111032f1114f/microsoft_kiota_serialization_form-1.9.9-py3-none-any.whl", hash = "sha256:1c426d4f0d463fc9215c41d7fa0f3dc5fe8d3c80573d555cf63ea67000148d84", size = 10718, upload-time = "2026-03-02T21:04:21.25Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-serialization-json"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/7d/ea/fee81f1cb68d5163573294935311a9c45d7da7dc08aa4acd86690ddafdcb/microsoft_kiota_serialization_json-1.9.2.tar.gz", hash = "sha256:19f7beb69c67b2cb77ca96f77824ee78a693929e20237bb5476ea54f69118bf1", size = 9345, upload-time = "2025-02-06T13:13:15.582Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b8/2f/d36eba916c00136da122d1701acb862c5b1f2e22b6dc6fa4e0f4abda2786/microsoft_kiota_serialization_json-1.9.9.tar.gz", hash = "sha256:9b27479427f49bbac15ead8e8ff0176e47fcdf81153611acc408f5f399342079", size = 9545, upload-time = "2026-03-02T21:04:29.177Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/95/1a/30dbe36cbd3f5d55d63f7ba086d51e90875806723a336e4782b17df80541/microsoft_kiota_serialization_json-1.9.2-py3-none-any.whl", hash = "sha256:8f4ecf485607fff3df5ce8fa9b9c957bc7f4bff1658b183703e180af753098e3", size = 10963, upload-time = "2025-02-06T13:13:14.351Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/7b/b3f606ef2dcbdebe12ae27004ed6e7542370cb2494265f11a8877a1de2d1/microsoft_kiota_serialization_json-1.9.9-py3-none-any.whl", hash = "sha256:bb80b93e81bab41dc142e9b254f79bf0b7b9fe49a796ca0c8e8691925bd3967f", size = 11210, upload-time = "2026-03-02T21:04:29.844Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-serialization-multipart"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d0/10/a8ea0a0f58bbc79c5f22bf868f10eac9f505f092e3f72ba1f050ab13316c/microsoft_kiota_serialization_multipart-1.9.2.tar.gz", hash = "sha256:b1851409205668d83f5c7a35a8b6fca974b341985b4a92841e95aaec93b7ca0a", size = 5152, upload-time = "2025-02-06T13:13:37.39Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5f/44/24087f0fac7c5682c13c7fb61468a0c5a5185b9f243de3a99309aa6fcaa7/microsoft_kiota_serialization_multipart-1.9.9.tar.gz", hash = "sha256:f8730be6da5f6c63a6bf4ea310a9723b9998a47a04745887dc156d08f119a829", size = 5162, upload-time = "2026-03-02T21:04:48.1Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ca/2a/2109bbf9865685bbedf756b8b8a25284c366870496f8fe3a5a0ee7c476f5/microsoft_kiota_serialization_multipart-1.9.2-py3-none-any.whl", hash = "sha256:641ad374046f1c7adff90d110bdc68d77418adb1e479a716f4ffea3647f0ead6", size = 6649, upload-time = "2025-02-06T13:13:34.579Z" },
+    { url = "https://files.pythonhosted.org/packages/61/db/6b988fdf771c3d07dff4a116176d575832daf2a43823444d145d71da5b61/microsoft_kiota_serialization_multipart-1.9.9-py3-none-any.whl", hash = "sha256:572e9cbafa2eb946452cdadfb019a4e9245768c0d61c3089d3436d4f5106c550", size = 6696, upload-time = "2026-03-02T21:04:48.98Z" },
 ]
 
 [[package]]
 name = "microsoft-kiota-serialization-text"
-version = "1.9.2"
+version = "1.9.9"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "microsoft-kiota-abstractions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/81/20/aac457a8a0ce90510dc82ca5ba0d80484aeaf87d75d08ebefcbb81373683/microsoft_kiota_serialization_text-1.9.2.tar.gz", hash = "sha256:4289508ebac0cefdc4fa21c545051769a9409913972355ccda9116b647f978f2", size = 7306, upload-time = "2025-02-06T13:13:25.045Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a3/3c/d244ad08e03003134871698aa54de8243bcc61c0faf3ab114293bb76d6ad/microsoft_kiota_serialization_text-1.9.9.tar.gz", hash = "sha256:18bc0764dda4078a4c953300253344e05d0cdb9c17136f1a2f695d438cedb402", size = 7325, upload-time = "2026-03-02T21:04:37.567Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5a/3a/81c75a275183ceadfd3b87731adff69ebb46c5f43b8617c88375a53808e5/microsoft_kiota_serialization_text-1.9.2-py3-none-any.whl", hash = "sha256:6e63129ea29eb9b976f4ed56fc6595d204e29fc309958b639299e9f9f4e5edb4", size = 8840, upload-time = "2025-02-06T13:13:22.997Z" },
+    { url = "https://files.pythonhosted.org/packages/37/f8/43f8d00fed6e090810d3ce0c05e06c23eaa5dee6e87ab1fb89d96ca9559f/microsoft_kiota_serialization_text-1.9.9-py3-none-any.whl", hash = "sha256:84418119d4929a76fde7f31e957e240e003bf145757838b9aa3a0f36dec1b789", size = 8885, upload-time = "2026-03-02T21:04:38.76Z" },
 ]
 
 [[package]]
@@ -3671,7 +3681,7 @@ requires-dist = [
     { name = "jsonschema", specifier = "==4.23.0" },
     { name = "kubernetes", specifier = "==32.0.1" },
     { name = "markdown", specifier = "==3.10.2" },
-    { name = "microsoft-kiota-abstractions", specifier = "==1.9.2" },
+    { name = "microsoft-kiota-abstractions", specifier = "==1.9.9" },
     { name = "msgraph-sdk", specifier = "==1.55.0" },
     { name = "numpy", specifier = "==2.2.6" },
     { name = "oci", specifier = "==2.169.0" },

From b5bb85c9564f6ca6a7f66c851bb56bde719205ee Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Tue, 16 Jun 2026 02:20:38 +0900
Subject: [PATCH 040/126] feat(azure): add
 cosmosdb_account_backup_policy_continuous check (#11032)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 prowler/compliance/azure/hipaa_azure.json     |   3 +-
 .../compliance/azure/iso27001_2022_azure.json |   4 +-
 prowler/compliance/csa_ccm_4.0.json           |   3 +-
 .../__init__.py                               |   0
 ...unt_backup_policy_continuous.metadata.json |  38 +++++
 ...smosdb_account_backup_policy_continuous.py |  30 ++++
 ...b_account_backup_policy_continuous_test.py | 157 ++++++++++++++++++
 8 files changed, 233 insertions(+), 3 deletions(-)
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/__init__.py
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.metadata.json
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.py
 create mode 100644 tests/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 3bac1d8e40..006e08082a 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -13,6 +13,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `cloudsql_instance_high_availability_enabled` check for GCP provider, verifying Cloud SQL primary instances use `REGIONAL` availability for automatic zone failover [(#11024)](https://github.com/prowler-cloud/prowler/pull/11024)
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
+- `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
 
 ### 🔄 Changed
 
diff --git a/prowler/compliance/azure/hipaa_azure.json b/prowler/compliance/azure/hipaa_azure.json
index 332d081590..3b1184e0e5 100644
--- a/prowler/compliance/azure/hipaa_azure.json
+++ b/prowler/compliance/azure/hipaa_azure.json
@@ -438,7 +438,8 @@
         "storage_geo_redundant_enabled",
         "keyvault_recoverable",
         "sqlserver_auditing_retention_90_days",
-        "postgresql_flexible_server_log_retention_days_greater_3"
+        "postgresql_flexible_server_log_retention_days_greater_3",
+        "cosmosdb_account_backup_policy_continuous"
       ]
     },
     {
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 8e5458f526..635d55a854 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1266,7 +1266,9 @@
           "Check_Summary": "Backup copies of information, software and systems should be maintained and regularly tested in accordance with the agreed topic-specific policy on backup."
         }
       ],
-      "Checks": []
+      "Checks": [
+        "cosmosdb_account_backup_policy_continuous"
+      ]
     },
     {
       "Id": "A.8.14",
diff --git a/prowler/compliance/csa_ccm_4.0.json b/prowler/compliance/csa_ccm_4.0.json
index e25ba23c6f..57f1a67758 100644
--- a/prowler/compliance/csa_ccm_4.0.json
+++ b/prowler/compliance/csa_ccm_4.0.json
@@ -1088,7 +1088,8 @@
           "storage_geo_redundant_enabled",
           "vm_scaleset_associated_with_load_balancer",
           "vm_scaleset_not_empty",
-          "cosmosdb_account_automatic_failover_enabled"
+          "cosmosdb_account_automatic_failover_enabled",
+          "cosmosdb_account_backup_policy_continuous"
         ],
         "gcp": [
           "compute_instance_automatic_restart_enabled",
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/__init__.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.metadata.json b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.metadata.json
new file mode 100644
index 0000000000..1631aa5b3a
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "cosmosdb_account_backup_policy_continuous",
+  "CheckTitle": "Cosmos DB account uses continuous backup policy",
+  "CheckType": [],
+  "ServiceName": "cosmosdb",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.documentdb/databaseaccounts",
+  "ResourceGroup": "database",
+  "Description": "**Azure Cosmos DB accounts** are evaluated for **continuous backup** policy. Continuous backup provides **point-in-time restore (PITR)** enabling recovery to any point within the retention window, unlike periodic backup which only supports full restores at fixed intervals.",
+  "Risk": "**Periodic backup** limits recovery to the last backup snapshot. Data changes between snapshots are lost during restore. **Continuous backup** enables **granular recovery** from accidental deletes, corruption, or ransomware.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/continuous-backup-restore-introduction",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/migrate-continuous-backup",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/restore-account-continuous-backup"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --backup-policy-type Continuous --continuous-tier Continuous30Days",
+      "NativeIaC": "```bicep\n// Bicep: Switch a Cosmos DB account to Continuous backup (irreversible)\nresource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  kind: 'GlobalDocumentDB'\n  properties: {\n    databaseAccountOfferType: 'Standard'\n    locations: [{ locationName: resourceGroup().location }]\n    backupPolicy: {\n      type: 'Continuous' // Critical: Enables point-in-time restore. Migration from Periodic is one-way.\n      continuousModeProperties: {\n        tier: 'Continuous30Days' // or 'Continuous7Days' for the lower-cost tier\n      }\n    }\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Cosmos DB account\n2. In the left menu, select Backup & Restore\n3. Click Switch to Continuous backup\n4. Select the retention tier (Continuous30Days or Continuous7Days)\n5. Acknowledge that the migration from Periodic to Continuous is irreversible\n6. Click Save",
+      "Terraform": "```hcl\n# Terraform: Configure Cosmos DB account with Continuous backup (irreversible)\nresource \"azurerm_cosmosdb_account\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<example_resource_name>\"\n  offer_type          = \"Standard\"\n  kind                = \"GlobalDocumentDB\"\n\n  geo_location {\n    location          = \"<example_resource_name>\"\n    failover_priority = 0\n  }\n\n  backup {\n    type = \"Continuous\"          # Critical: Enables point-in-time restore. One-way migration from Periodic.\n    tier = \"Continuous30Days\"    # or \"Continuous7Days\" for the lower-cost tier\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Use **Continuous backup** for Cosmos DB accounts that require **point-in-time restore (PITR)**. Pick the retention tier (`Continuous7Days` or `Continuous30Days`) based on recovery objectives, and validate restore procedures with periodic drills. Note that switching from **Periodic** to **Continuous** is a **one-way** migration; plan the change and review pricing before applying.",
+      "Url": "https://hub.prowler.com/check/cosmosdb_account_backup_policy_continuous"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.py
new file mode 100644
index 0000000000..f1a00fc2e8
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous.py
@@ -0,0 +1,30 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client
+
+
+class cosmosdb_account_backup_policy_continuous(Check):
+    """Ensure that Cosmos DB accounts use the continuous backup policy."""
+
+    def execute(self) -> Check_Report_Azure:
+        """Execute the Cosmos DB continuous-backup check.
+
+        Iterates over every Cosmos DB account fetched by the service and reports
+        PASS when `backupPolicy.type` is `Continuous`, FAIL otherwise (including
+        when the property is missing).
+
+        Returns:
+            A list of Check_Report_Azure with one report per Cosmos DB account.
+        """
+        findings = []
+        for subscription, accounts in cosmosdb_client.accounts.items():
+            for account in accounts:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
+                report.subscription = subscription
+                report.status = "FAIL"
+                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not use continuous backup policy."
+                if account.backup_policy_type == "Continuous":
+                    report.status = "PASS"
+                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} uses continuous backup policy."
+                findings.append(report)
+
+        return findings
diff --git a/tests/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous_test.py b/tests/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous_test.py
new file mode 100644
index 0000000000..0cc282485b
--- /dev/null
+++ b/tests/providers/azure/services/cosmosdb/cosmosdb_account_backup_policy_continuous/cosmosdb_account_backup_policy_continuous_test.py
@@ -0,0 +1,157 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+class Test_cosmosdb_account_backup_policy_continuous:
+    def test_no_subscriptions(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous import (
+                cosmosdb_account_backup_policy_continuous,
+            )
+
+            cosmosdb_client.accounts = {}
+
+            check = cosmosdb_account_backup_policy_continuous()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous import (
+                cosmosdb_account_backup_policy_continuous,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        backup_policy_type="Continuous",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_backup_policy_continuous()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_fail_periodic(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous import (
+                cosmosdb_account_backup_policy_continuous,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        backup_policy_type="Periodic",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_backup_policy_continuous()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+
+    def test_fail_no_backup_policy(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_backup_policy_continuous.cosmosdb_account_backup_policy_continuous import (
+                cosmosdb_account_backup_policy_continuous,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        backup_policy_type=None,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_backup_policy_continuous()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"

From dd1895d2c43bb54f6daa04ad5d1282cbcd2266a3 Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Tue, 16 Jun 2026 09:32:37 +0200
Subject: [PATCH 041/126] test(ui): remove onboarding e2e suite (#11605)

---
 ui/lib/onboarding/README.md            |   2 -
 ui/tests/onboarding/onboarding-page.ts | 259 -------------------
 ui/tests/onboarding/onboarding.md      | 334 -------------------------
 ui/tests/onboarding/onboarding.spec.ts | 245 ------------------
 4 files changed, 840 deletions(-)
 delete mode 100644 ui/tests/onboarding/onboarding-page.ts
 delete mode 100644 ui/tests/onboarding/onboarding.md
 delete mode 100644 ui/tests/onboarding/onboarding.spec.ts

diff --git a/ui/lib/onboarding/README.md b/ui/lib/onboarding/README.md
index e1e5532cd0..eab352ca2b 100644
--- a/ui/lib/onboarding/README.md
+++ b/ui/lib/onboarding/README.md
@@ -72,5 +72,3 @@ the sequence automatically.
   `target` must resolve to a real `data-tour-id` anchor within its `coversFiles`.
 - `pnpm exec vitest run --project unit` — pure logic (slice, helpers, registry,
   tour shapes). The driver primitive short-circuits in `NODE_ENV==="test"`.
-- `pnpm run test:e2e tests/onboarding/` — full-system behavior (sequence,
-  checkpoint, replay, single-fire, refresh). Requires the Prowler stack.
diff --git a/ui/tests/onboarding/onboarding-page.ts b/ui/tests/onboarding/onboarding-page.ts
deleted file mode 100644
index 979810a7d2..0000000000
--- a/ui/tests/onboarding/onboarding-page.ts
+++ /dev/null
@@ -1,259 +0,0 @@
-import { Locator, Page, expect } from "@playwright/test";
-
-import { BasePage } from "../base-page";
-
-const TOUR_KEY_PREFIX = "prowler.tour";
-// Keep in sync with addProviderTour.version (lib/tours/add-provider.tour.ts).
-const ADD_PROVIDER_TOUR_VERSION = 2;
-const ADD_PROVIDER_TOUR_KEY = `${TOUR_KEY_PREFIX}.add-provider.v${ADD_PROVIDER_TOUR_VERSION}`;
-const CHECKPOINT_MARKER_KEY = "prowler.onboarding.checkpoint";
-
-// One popover per active driver.js tour; used to assert single-fire / no auto-fire.
-const DRIVER_POPOVER_SELECTOR = ".driver-popover";
-
-// POM for onboarding flows. URL assertions live here; the spec only orchestrates actions.
-// Note: the sequence store is ephemeral (no persist) — a fresh goto/reload resets it.
-export class OnboardingPage extends BasePage {
-  readonly welcomeModal: Locator;
-  readonly getStartedButton: Locator;
-  readonly skipButton: Locator;
-
-  readonly checkpointDialog: Locator;
-  readonly checkpointContinueButton: Locator;
-  readonly checkpointFinishButton: Locator;
-
-  readonly addProviderTriggerAnchor: Locator;
-  readonly providerTypeAnchor: Locator;
-
-  readonly viewFirstScanLaunchAnchor: Locator;
-  readonly viewFirstScanTabsAnchor: Locator;
-  readonly exploreFindingsFiltersAnchor: Locator;
-  readonly exploreFindingsGroupAnchor: Locator;
-  readonly exploreFindingsResourcesAnchor: Locator;
-  readonly viewComplianceFrameworksAnchor: Locator;
-  readonly viewComplianceSearchAnchor: Locator;
-  readonly attackPathsIntroAnchor: Locator;
-  readonly attackPathsScanListAnchor: Locator;
-
-  readonly accountMenuTrigger: Locator;
-  readonly productTourSubTrigger: Locator;
-
-  readonly driverPopover: Locator;
-
-  constructor(page: Page) {
-    super(page);
-
-    this.welcomeModal = page.getByRole("dialog").filter({
-      has: page.getByRole("heading", { name: /Add your first provider/i }),
-    });
-    this.getStartedButton = page.getByRole("button", { name: "Get started" });
-    this.skipButton = page.getByRole("button", { name: "Skip for now" });
-
-    this.checkpointDialog = page.getByRole("dialog").filter({
-      has: page.getByRole("heading", {
-        name: /Provider added — keep exploring\?/i,
-      }),
-    });
-    this.checkpointContinueButton = page.getByRole("button", {
-      name: "Continue the tour",
-    });
-    this.checkpointFinishButton = page.getByRole("button", {
-      name: "Finish here",
-    });
-
-    this.addProviderTriggerAnchor = page.locator(
-      '[data-tour-id="add-provider-trigger"]',
-    );
-    this.providerTypeAnchor = page.locator(
-      '[data-tour-id="add-provider-provider-type"]',
-    );
-
-    this.viewFirstScanLaunchAnchor = page.locator(
-      '[data-tour-id="view-first-scan-launch"]',
-    );
-    this.viewFirstScanTabsAnchor = page.locator(
-      '[data-tour-id="view-first-scan-tabs"]',
-    );
-    this.exploreFindingsFiltersAnchor = page.locator(
-      '[data-tour-id="explore-findings-filters"]',
-    );
-    this.exploreFindingsGroupAnchor = page.locator(
-      '[data-tour-id="explore-findings-group"]',
-    );
-    this.exploreFindingsResourcesAnchor = page.locator(
-      '[data-tour-id="explore-findings-resources"]',
-    );
-    this.viewComplianceFrameworksAnchor = page.locator(
-      '[data-tour-id="view-compliance-frameworks"]',
-    );
-    this.viewComplianceSearchAnchor = page.locator(
-      '[data-tour-id="view-compliance-search"]',
-    );
-    this.attackPathsIntroAnchor = page.locator(
-      '[data-tour-id="attack-paths-intro"]',
-    );
-    this.attackPathsScanListAnchor = page.locator(
-      '[data-tour-id="attack-paths-scan-list"]',
-    );
-
-    this.accountMenuTrigger = page.getByRole("button", {
-      name: "Account menu",
-    });
-    this.productTourSubTrigger = page.getByRole("menuitem", {
-      name: "Product tour",
-    });
-
-    this.driverPopover = page.locator(DRIVER_POPOVER_SELECTOR);
-  }
-
-  // Clears all tour records and the checkpoint marker so the gate evaluates as a fresh browser.
-  async clearOnboardingState(): Promise<void> {
-    await this.page.evaluate(
-      ({ prefix, checkpointKey }) => {
-        const keys: string[] = [];
-        for (let i = 0; i < window.localStorage.length; i++) {
-          const key = window.localStorage.key(i);
-          if (key && key.startsWith(prefix)) keys.push(key);
-        }
-        keys.forEach((key) => window.localStorage.removeItem(key));
-        window.localStorage.removeItem(checkpointKey);
-      },
-      { prefix: TOUR_KEY_PREFIX, checkpointKey: CHECKPOINT_MARKER_KEY },
-    );
-  }
-
-  // Seeds a completed record so the restart path can prove the tour re-fires anyway.
-  async seedCompletedAddProviderRecord(): Promise<void> {
-    await this.page.evaluate(
-      ({ key, version }) => {
-        window.localStorage.setItem(
-          key,
-          JSON.stringify({
-            tourId: "add-provider",
-            version,
-            state: "completed",
-            completedAt: new Date().toISOString(),
-          }),
-        );
-      },
-      { key: ADD_PROVIDER_TOUR_KEY, version: ADD_PROVIDER_TOUR_VERSION },
-    );
-  }
-
-  async openAccountMenu(): Promise<void> {
-    await this.accountMenuTrigger.click();
-  }
-
-  // Hover the sub-trigger to open the per-flow submenu.
-  async openProductTourSubmenu(): Promise<void> {
-    await this.openAccountMenu();
-    await expect(this.productTourSubTrigger).toBeVisible();
-    await this.productTourSubTrigger.hover();
-  }
-
-  tourFlowMenuItem(title: string): Locator {
-    return this.page.getByRole("menuitem", { name: title, exact: true });
-  }
-
-  async selectTourFlow(title: string): Promise<void> {
-    await this.openProductTourSubmenu();
-    const item = this.tourFlowMenuItem(title);
-    await expect(item).toBeVisible();
-    await item.click();
-  }
-
-  async clickGetStarted(): Promise<void> {
-    await this.getStartedButton.click();
-  }
-
-  async clickCheckpointContinue(): Promise<void> {
-    await this.checkpointContinueButton.click();
-  }
-
-  async clickCheckpointFinish(): Promise<void> {
-    await this.checkpointFinishButton.click();
-  }
-
-  async closeActiveTour(): Promise<void> {
-    await this.page.keyboard.press("Escape");
-  }
-
-  async verifyWelcomeModalVisible(): Promise<void> {
-    await expect(this.welcomeModal).toBeVisible();
-  }
-
-  async verifyWelcomeModalNotVisible(): Promise<void> {
-    await expect(this.welcomeModal).not.toBeVisible();
-  }
-
-  async verifyCheckpointDialogVisible(): Promise<void> {
-    await expect(this.checkpointDialog).toBeVisible();
-  }
-
-  async verifyTriggerAnchorPresent(): Promise<void> {
-    await expect(this.addProviderTriggerAnchor).toBeVisible();
-  }
-
-  async verifyAnchorsPresent(): Promise<void> {
-    await expect(this.addProviderTriggerAnchor).toBeVisible();
-    await expect(this.providerTypeAnchor).toBeVisible();
-  }
-
-  async verifyViewFirstScanAnchorPresent(): Promise<void> {
-    await expect(this.viewFirstScanLaunchAnchor).toBeVisible();
-  }
-
-  async verifyExploreFindingsAnchorPresent(): Promise<void> {
-    await expect(this.exploreFindingsFiltersAnchor).toBeVisible();
-  }
-
-  async verifyViewComplianceAnchorPresent(): Promise<void> {
-    await expect(this.viewComplianceFrameworksAnchor).toBeVisible();
-  }
-
-  async verifyAttackPathsAnchorPresent(): Promise<void> {
-    await expect(this.attackPathsIntroAnchor).toBeVisible();
-  }
-
-  // OB-E2E-006: page owns the driver; onboarding must not mount a second one.
-  async verifySingleDriverPopover(): Promise<void> {
-    await expect(this.driverPopover).toHaveCount(1);
-  }
-
-  // OB-E2E-007/004: no tour auto-fires after a reload or stop.
-  async verifyNoDriverPopover(): Promise<void> {
-    await expect(this.driverPopover).toHaveCount(0);
-  }
-
-  async verifyOnProvidersPage(): Promise<void> {
-    await this.page.waitForURL(/\/providers(\?|$)/);
-  }
-
-  async verifyOnProvidersPageWithOnboardingParam(): Promise<void> {
-    await this.page.waitForURL(/\/providers\?onboarding=add-provider/);
-  }
-
-  async verifyOnScansPage(): Promise<void> {
-    await this.page.waitForURL(/\/scans(\?|$)/);
-  }
-
-  async verifyOnFindingsPage(): Promise<void> {
-    await this.page.waitForURL(/\/findings(\?|$)/);
-  }
-
-  async verifyOnFindingsReplayPage(): Promise<void> {
-    await this.page.waitForURL(/\/findings\?onboarding=explore-findings/);
-  }
-
-  async verifyOnCompliancePage(): Promise<void> {
-    await this.page.waitForURL(/\/compliance(\?|$)/);
-  }
-
-  async verifyOnAttackPathsPage(): Promise<void> {
-    await this.page.waitForURL(/\/attack-paths/);
-  }
-
-  async verifyStillOnFindingsPage(): Promise<void> {
-    await expect(this.page).toHaveURL(/\/findings/);
-  }
-}
diff --git a/ui/tests/onboarding/onboarding.md b/ui/tests/onboarding/onboarding.md
deleted file mode 100644
index e6b2adba03..0000000000
--- a/ui/tests/onboarding/onboarding.md
+++ /dev/null
@@ -1,334 +0,0 @@
-### E2E Tests: Onboarding System
-
-**Suite ID:** `OB-E2E`
-**Feature:** Extensible UI onboarding system: the guided add-provider tour, the
-cross-route guided sequence after the first provider connects, and per-flow
-manual replay from the avatar menu.
-
-> Behavioral assertions only: Welcome modal visibility, checkpoint dialog
-> visibility, navigation to each flow route, presence of the `data-tour-id`
-> anchors in the DOM, and localStorage markers. Driver.js overlay animation is
-> never asserted. Waits use `expect(...).toBeVisible()` and
-> `page.waitForURL()` — never `networkidle`.
-
----
-
-## Test Case: `OB-E2E-001` - Mandatory new-user onboarding path
-
-**Priority:** `critical`
-
-**Tags:**
-
-- type → @e2e
-- feature → @onboarding
-
-**Description/Objective:** A zero-provider authenticated user is forced into the
-Welcome modal on first load; accepting it navigates to the add-provider flow and
-exposes the tour trigger anchor.
-
-**Preconditions:**
-
-- Admin user authentication required (`admin.auth.setup`, reused `storageState`)
-- All `prowler.tour.*` localStorage keys cleared before the test
-- The account has zero providers (existing providers removed via `deleteProviderIfExists`)
-
-### Flow Steps
-
-1. Navigate to a page inside `app/(prowler)/`
-2. Assert the Welcome modal is visible
-3. Click "Get started"
-4. Assert navigation to `/providers` (the `?onboarding=add-provider` param is consumed)
-5. Assert the `data-tour-id="add-provider-trigger"` anchor is present in the DOM
-
-### Expected Result
-
-- Welcome modal is displayed for the zero-provider user
-- Accepting navigates to the providers route
-- The add-provider trigger anchor is mounted on the providers page
-
-### Key verification points
-
-- Welcome modal visible on first authenticated load (gate forced it)
-- After accept, the URL is `/providers`
-- `[data-tour-id="add-provider-trigger"]` exists in the DOM
-
-### Notes
-
-- Maps to spec: "Zero-provider user on first authenticated load", "User accepts
-  the Welcome modal", "Every tour step target has a matching data-tour-id anchor"
-- Full execution requires the Prowler stack (API + DB + auth env). The trigger
-  anchor proves the tour surface is reachable without asserting overlay animation
-
----
-
-## Test Case: `OB-E2E-002` - Restart onboarding from the avatar menu
-
-**Priority:** `high`
-
-**Tags:**
-
-- type → @e2e
-- feature → @onboarding
-
-**Description/Objective:** A user who already completed the tour can restart it
-from the avatar menu; the tour starts again despite the existing completion
-record.
-
-**Preconditions:**
-
-- Admin user authentication required (`admin.auth.setup`, reused `storageState`)
-- A `completed` record exists in localStorage for `add-provider`
-  (`prowler.tour.add-provider.v2`)
-
-### Flow Steps
-
-1. Navigate to a page with the user nav visible
-2. Open the avatar account menu
-3. Click "Product tour"
-4. Assert navigation to `/providers?onboarding=add-provider`
-5. Assert the `data-tour-id="add-provider-trigger"` anchor is present in the DOM
-
-### Expected Result
-
-- The restart entry navigates to the add-provider flow route with the onboarding param
-- The tour starts despite the existing completion record (no Welcome modal)
-- The add-provider trigger anchor is mounted on the providers page
-
-### Key verification points
-
-- "Product tour" entry is present in the avatar menu
-- After selecting it, the URL is `/providers?onboarding=add-provider`
-- `[data-tour-id="add-provider-trigger"]` exists in the DOM (re-trigger bypassed the completion record)
-
-### Notes
-
-- Maps to spec: "User activates the restart entry point from the avatar menu",
-  "Re-trigger works after a full page reload", "Re-trigger does not depend on
-  prior browser state"
-- Full execution requires the Prowler stack (API + DB + auth env)
-
----
-
-## Test Case: `OB-E2E-003` - First-run guided sequence + checkpoint
-
-**Priority:** `critical`
-
-**Tags:**
-
-- type → @e2e
-- feature → @onboarding
-
-**Description/Objective:** After the first provider connects, the checkpoint
-dialog offers a guided sequence; "Continue the tour" chains through scans,
-findings, compliance, and attack paths, advancing only on tour completion.
-
-**Preconditions:**
-
-- Admin user authentication required (`admin.auth.setup`, reused `storageState`)
-- All `prowler.tour.*` keys and the `prowler.onboarding.checkpoint` marker cleared
-- A connected provider exists (a `false → true` `hasProviders` flip is reachable);
-  guarded/skipped when `E2E_AWS_PROVIDER_ACCOUNT_ID` is unset
-
-### Flow Steps
-
-1. Start zero-provider; assert the Welcome modal is visible
-2. Connect a provider (real flip via `addAWSProvider`)
-3. Assert the checkpoint dialog "Provider added — keep exploring?" is visible
-4. Click "Continue the tour"
-5. Assert `/scans` with `data-tour-id="view-first-scan-launch"` present
-6. Complete the scans tour; assert `/findings` with `explore-findings-filters`
-7. Complete; assert `/compliance` with `view-compliance-frameworks`
-8. Complete; assert `/attack-paths` with `attack-paths-intro` present
-
-### Expected Result
-
-- The checkpoint fires once on the real provider-connected flip
-- Continuing chains through each flow route in registry order
-- Each route exposes its first anchor in the DOM
-
-### Key verification points
-
-- Checkpoint dialog visible after the provider connects
-- Sequence visits `/scans → /findings → /compliance → /attack-paths`
-- The route-specific anchor is present at each step
-- `prowler.onboarding.checkpoint` marker is set after a choice
-
-### Notes
-
-- Maps to spec `onboarding-sequence`: "Checkpoint after first provider connects",
-  "Continue starts the sequence", "Next flow starts after navigating to its route"
-- Full execution requires the Prowler stack (API + DB + auth env)
-
----
-
-## Test Case: `OB-E2E-004` - Stop the sequence at any time
-
-**Priority:** `high`
-
-**Tags:**
-
-- type → @e2e
-- feature → @onboarding
-
-**Description/Objective:** Closing any tour mid-sequence ends the sequence; no
-further flow auto-fires and a reload does not resume it.
-
-**Preconditions:**
-
-- Admin user authentication required (reused `storageState`)
-- A connected provider exists; guarded/skipped when `E2E_AWS_PROVIDER_ACCOUNT_ID` is unset
-- Tour state and checkpoint marker cleared in `beforeEach`
-
-### Flow Steps
-
-1. Start the guided sequence (continue from the checkpoint)
-2. On `/findings`, close the active tour (press Escape)
-3. Wait briefly and assert the URL is still `/findings` (no advance to `/compliance`)
-4. Reload the page
-5. Assert no tour auto-fires (no `.driver-popover` in the DOM)
-
-### Expected Result
-
-- Closing the tour stops the sequence immediately
-- No navigation to `/compliance` occurs
-- A reload does not resume the sequence
-
-### Key verification points
-
-- URL remains `/findings` after Escape (no auto-advance)
-- After reload, zero `.driver-popover` elements exist
-
-### Notes
-
-- Maps to spec `onboarding-sequence`: "Stopping any tour ends the sequence"
-- Full execution requires the Prowler stack (API + DB + auth env)
-
----
-
-## Test Case: `OB-E2E-005` - Manual single-flow replay from the avatar menu
-
-**Priority:** `high`
-
-**Tags:**
-
-- type → @e2e
-- feature → @onboarding
-
-**Description/Objective:** The avatar "Product tour" submenu lists every flow;
-selecting one replays that single flow only and never chains into the sequence.
-
-**Preconditions:**
-
-- Admin user authentication required (reused `storageState`)
-- `completed` records seeded for the flows so the list represents replay state
-
-### Flow Steps
-
-1. Open the avatar account menu
-2. Open the "Product tour" submenu
-3. Assert all five flow titles are listed (registry order)
-4. Select "Explore your findings"
-5. Assert navigation to `/findings?onboarding=explore-findings`
-6. Assert `data-tour-id="explore-findings-filters"` present
-7. Close the tour and assert no navigation to `/compliance` (no sequence chaining)
-
-### Expected Result
-
-- The submenu lists all five flows by title
-- Selecting a flow replays it standalone with the `?onboarding=<id>` param
-- Closing the replayed tour does not advance to the next flow
-
-### Key verification points
-
-- Submenu contains `Add your first provider`, `Run your first scan`,
-  `Explore your findings`, `Check compliance`, `Visualize attack paths`
-- URL is `/findings?onboarding=explore-findings`
-- No advance to `/compliance` after closing
-
-### Notes
-
-- Maps to spec `onboarding` (MODIFIED): "Avatar entry opens an ordered list of
-  flows", "Selecting a flow replays that single flow only"
-- Full execution requires the Prowler stack (API + DB + auth env)
-
----
-
-## Test Case: `OB-E2E-006` - Attack-paths single-fire
-
-**Priority:** `high`
-
-**Tags:**
-
-- type → @e2e
-- feature → @onboarding
-
-**Description/Objective:** On `/attack-paths` only one driver popover exists at a
-time — the page owns the driver and onboarding never mounts a second runner.
-
-**Preconditions:**
-
-- Admin user authentication required (reused `storageState`)
-- A connected provider with at least one ready scan exists; guarded/skipped when
-  `E2E_AWS_PROVIDER_ACCOUNT_ID` is unset
-
-### Flow Steps
-
-1. Navigate to `/attack-paths?onboarding=attack-paths`
-2. Wait for the attack-paths tour popover to appear
-3. Count `.driver-popover` elements in the DOM
-
-### Expected Result
-
-- Exactly one driver popover exists (no double-fire)
-
-### Key verification points
-
-- `.driver-popover` count is exactly `1`
-
-### Notes
-
-- Maps to spec `onboarding-sequence`: "Attack-Paths Single-Fire Integration"
-- Full execution requires the Prowler stack (API + DB + auth env)
-
----
-
-## Test Case: `OB-E2E-007` - Refresh mid-sequence does not re-fire
-
-**Priority:** `high`
-
-**Tags:**
-
-- type → @e2e
-- feature → @onboarding
-
-**Description/Objective:** The sequence slice is ephemeral; a hard reload mid-tour
-resets it so no tour auto-fires, and no Welcome modal appears (provider connected).
-
-**Preconditions:**
-
-- Admin user authentication required (reused `storageState`)
-- A connected provider exists; guarded/skipped when `E2E_AWS_PROVIDER_ACCOUNT_ID` is unset
-- Tour state and checkpoint marker cleared in `beforeEach`
-
-### Flow Steps
-
-1. Start the guided sequence and land on `/scans`
-2. Hard-reload the page
-3. Assert no `.driver-popover` auto-fires
-4. Assert the Welcome modal is not visible
-
-### Expected Result
-
-- No tour auto-fires after the reload (ephemeral slice reset)
-- No Welcome modal (the provider is connected, so the gate stays closed)
-
-### Key verification points
-
-- Zero `.driver-popover` elements after reload
-- Welcome modal is not visible
-
-### Notes
-
-- Maps to spec `onboarding-sequence`: "Refresh mid-sequence does not re-fire
-  infinitely"
-- Full execution requires the Prowler stack (API + DB + auth env)
diff --git a/ui/tests/onboarding/onboarding.spec.ts b/ui/tests/onboarding/onboarding.spec.ts
deleted file mode 100644
index c86c7bc0a9..0000000000
--- a/ui/tests/onboarding/onboarding.spec.ts
+++ /dev/null
@@ -1,245 +0,0 @@
-import { test } from "@playwright/test";
-
-import { addAWSProvider, deleteProviderIfExists } from "../helpers";
-import { ProvidersPage } from "../providers/providers-page";
-import { OnboardingPage } from "./onboarding-page";
-
-// Real AWS credentials for the hasProviders false→true flip; tests skip when unset.
-const accountId = process.env.E2E_AWS_PROVIDER_ACCOUNT_ID ?? "";
-const accessKey = process.env.E2E_AWS_PROVIDER_ACCESS_KEY ?? "";
-const secretKey = process.env.E2E_AWS_PROVIDER_SECRET_KEY ?? "";
-const hasAwsCredentials = Boolean(accountId && accessKey && secretKey);
-
-// Guided onboarding is a Prowler Cloud-only feature; it never mounts in OSS.
-const isCloudEnv = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
-
-test.describe("Onboarding", () => {
-  test.skip(
-    !isCloudEnv,
-    "Guided onboarding is a Prowler Cloud-only feature (NEXT_PUBLIC_IS_CLOUD_ENV != true)",
-  );
-  test.use({ storageState: "playwright/.auth/admin_user.json" });
-
-  test.describe("Mandatory new-user path", () => {
-    test.beforeEach(async ({ page }) => {
-      const providersPage = new ProvidersPage(page);
-      if (accountId) {
-        await deleteProviderIfExists(providersPage, accountId);
-      }
-
-      await providersPage.goto();
-      const onboardingPage = new OnboardingPage(page);
-      await onboardingPage.clearOnboardingState();
-    });
-
-    test(
-      "forces the Welcome modal and hands off to the add-provider tour",
-      {
-        tag: ["@critical", "@e2e", "@onboarding", "@OB-E2E-001"],
-      },
-      async ({ page }) => {
-        test.skip(
-          !accountId,
-          "E2E_AWS_PROVIDER_ACCOUNT_ID is not set; cannot guarantee a zero-provider account",
-        );
-
-        const onboardingPage = new OnboardingPage(page);
-
-        await onboardingPage.goto("/providers");
-        await onboardingPage.verifyWelcomeModalVisible();
-        await onboardingPage.clickGetStarted();
-        await onboardingPage.verifyOnProvidersPage();
-        await onboardingPage.verifyTriggerAnchorPresent();
-      },
-    );
-  });
-
-  test.describe("Restart path", () => {
-    test.beforeEach(async ({ page }) => {
-      const onboardingPage = new OnboardingPage(page);
-      await onboardingPage.goto("/providers");
-      await onboardingPage.seedCompletedAddProviderRecord();
-    });
-
-    test(
-      "restarts the tour from the avatar menu despite a completion record",
-      {
-        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-002"],
-      },
-      async ({ page }) => {
-        const onboardingPage = new OnboardingPage(page);
-
-        await onboardingPage.goto("/providers");
-        await onboardingPage.selectTourFlow("Add your first provider");
-        await onboardingPage.verifyOnProvidersPageWithOnboardingParam();
-        await onboardingPage.verifyTriggerAnchorPresent();
-      },
-    );
-  });
-
-  test.describe("Guided sequence", () => {
-    test.beforeEach(async ({ page }) => {
-      const providersPage = new ProvidersPage(page);
-      if (accountId) {
-        await deleteProviderIfExists(providersPage, accountId);
-      }
-      await providersPage.goto();
-      const onboardingPage = new OnboardingPage(page);
-      await onboardingPage.clearOnboardingState();
-    });
-
-    test(
-      "runs the first-run sequence after the checkpoint and chains every flow",
-      {
-        tag: ["@critical", "@e2e", "@onboarding", "@OB-E2E-003"],
-      },
-      async ({ page }) => {
-        test.skip(
-          !hasAwsCredentials,
-          "E2E AWS provider credentials are not set; cannot drive a real hasProviders flip",
-        );
-
-        const onboardingPage = new OnboardingPage(page);
-
-        await onboardingPage.goto("/providers");
-        await onboardingPage.verifyWelcomeModalVisible();
-
-        // Connect a provider to drive the genuine hasProviders false→true flip.
-        await addAWSProvider(page, accountId, accessKey, secretKey);
-
-        await onboardingPage.verifyCheckpointDialogVisible();
-        await onboardingPage.clickCheckpointContinue();
-
-        await onboardingPage.verifyOnScansPage();
-        await onboardingPage.verifyViewFirstScanAnchorPresent();
-        await onboardingPage.closeActiveTour();
-
-        await onboardingPage.verifyExploreFindingsAnchorPresent();
-
-        await onboardingPage.goto("/compliance");
-        await onboardingPage.verifyViewComplianceAnchorPresent();
-        await onboardingPage.goto("/attack-paths");
-        await onboardingPage.verifyAttackPathsAnchorPresent();
-      },
-    );
-
-    test(
-      "stops the sequence when a tour is closed and does not resume on reload",
-      {
-        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-004"],
-      },
-      async ({ page }) => {
-        test.skip(
-          !hasAwsCredentials,
-          "E2E AWS provider credentials are not set; cannot drive the guided sequence",
-        );
-
-        const onboardingPage = new OnboardingPage(page);
-
-        await onboardingPage.goto("/providers");
-        await addAWSProvider(page, accountId, accessKey, secretKey);
-        await onboardingPage.verifyCheckpointDialogVisible();
-        await onboardingPage.clickCheckpointContinue();
-
-        await onboardingPage.verifyOnScansPage();
-        await onboardingPage.closeActiveTour();
-        await onboardingPage.verifyExploreFindingsAnchorPresent();
-        await onboardingPage.closeActiveTour();
-
-        // Closing the tour stops the sequence — no auto-advance to compliance.
-        await onboardingPage.verifyStillOnFindingsPage();
-
-        // Ephemeral sequence must not resume after a hard reload.
-        await onboardingPage.refresh();
-        await onboardingPage.verifyNoDriverPopover();
-      },
-    );
-
-    test(
-      "does not re-fire after a hard reload mid-sequence",
-      {
-        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-007"],
-      },
-      async ({ page }) => {
-        test.skip(
-          !hasAwsCredentials,
-          "E2E AWS provider credentials are not set; cannot drive the guided sequence",
-        );
-
-        const onboardingPage = new OnboardingPage(page);
-
-        await onboardingPage.goto("/providers");
-        await addAWSProvider(page, accountId, accessKey, secretKey);
-        await onboardingPage.verifyCheckpointDialogVisible();
-        await onboardingPage.clickCheckpointContinue();
-        await onboardingPage.verifyOnScansPage();
-
-        // Hard reload resets the ephemeral slice; provider is connected so the gate stays silent.
-        await onboardingPage.refresh();
-        await onboardingPage.verifyNoDriverPopover();
-        await onboardingPage.verifyWelcomeModalNotVisible();
-      },
-    );
-  });
-
-  test.describe("Manual replay", () => {
-    test.beforeEach(async ({ page }) => {
-      const onboardingPage = new OnboardingPage(page);
-      await onboardingPage.goto("/providers");
-      await onboardingPage.seedCompletedAddProviderRecord();
-    });
-
-    test(
-      "replays a single flow from the avatar submenu without chaining",
-      {
-        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-005"],
-      },
-      async ({ page }) => {
-        const onboardingPage = new OnboardingPage(page);
-
-        await onboardingPage.goto("/providers");
-        await onboardingPage.openProductTourSubmenu();
-        for (const title of [
-          "Add your first provider",
-          "Run your first scan",
-          "Explore your findings",
-          "Check compliance",
-          "Visualize attack paths",
-        ]) {
-          await onboardingPage.verifyElementVisible(
-            onboardingPage.tourFlowMenuItem(title),
-          );
-        }
-
-        await onboardingPage.tourFlowMenuItem("Explore your findings").click();
-        await onboardingPage.verifyOnFindingsReplayPage();
-        await onboardingPage.verifyExploreFindingsAnchorPresent();
-
-        // Replay must not chain to the next flow on close.
-        await onboardingPage.closeActiveTour();
-        await onboardingPage.verifyStillOnFindingsPage();
-      },
-    );
-  });
-
-  test.describe("Attack-paths single-fire", () => {
-    test(
-      "renders exactly one driver popover on the attack-paths route",
-      {
-        tag: ["@high", "@e2e", "@onboarding", "@OB-E2E-006"],
-      },
-      async ({ page }) => {
-        test.skip(
-          !hasAwsCredentials,
-          "E2E AWS provider credentials are not set; attack-paths needs a ready scan",
-        );
-
-        const onboardingPage = new OnboardingPage(page);
-
-        await onboardingPage.goto("/attack-paths?onboarding=attack-paths");
-        await onboardingPage.verifyOnAttackPathsPage();
-        await onboardingPage.verifySingleDriverPopover();
-      },
-    );
-  });
-});

From 810d8d7686ca1937d7dd720e36b6d31ce159845c Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Tue, 16 Jun 2026 09:35:11 +0200
Subject: [PATCH 042/126] chore(codepipeline): verify if repo is public with
 TLS (#11603)

---
 prowler/CHANGELOG.md                          |   1 +
 .../codepipeline_project_repo_private.py      |   7 +-
 .../codepipeline_project_repo_private_test.py | 146 +++++++++++++++++-
 3 files changed, 148 insertions(+), 6 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 006e08082a..19009ddbef 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -14,6 +14,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 - `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
+- TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
 
 ### 🔄 Changed
 
diff --git a/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py b/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py
index 0c745fc658..bc9f569f1b 100644
--- a/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py
+++ b/prowler/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private.py
@@ -7,6 +7,8 @@ from prowler.providers.aws.services.codepipeline.codepipeline_client import (
     codepipeline_client,
 )
 
+HTTP_TIMEOUT = 30
+
 
 class codepipeline_project_repo_private(Check):
     """Checks if AWS CodePipeline source repositories are configured as private.
@@ -87,9 +89,8 @@ class codepipeline_project_repo_private(Check):
             repo_url = repo_url[:-4]
 
         try:
-            context = ssl._create_unverified_context()
             req = urllib.request.Request(repo_url, method="HEAD")
-            response = urllib.request.urlopen(req, context=context)
+            response = urllib.request.urlopen(req, timeout=HTTP_TIMEOUT)
             return not response.geturl().endswith("sign_in")
-        except (urllib.error.HTTPError, urllib.error.URLError):
+        except (urllib.error.URLError, TimeoutError, ssl.SSLError):
             return False
diff --git a/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py b/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py
index d0d1057307..bf27c29632 100644
--- a/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py
+++ b/tests/providers/aws/services/codepipeline/codepipeline_project_repo_private/codepipeline_project_repo_private_test.py
@@ -1,3 +1,4 @@
+import ssl
 import urllib.error
 import urllib.request
 from unittest import mock
@@ -67,7 +68,7 @@ class Test_codepipeline_project_repo_private:
                     "Connection": {"ProviderType": "GitHub"}
                 }
 
-                def mock_urlopen_side_effect(req, context=None):
+                def mock_urlopen_side_effect(req, **kwargs):
                     raise urllib.error.HTTPError(
                         url="", code=404, msg="", hdrs={}, fp=None
                     )
@@ -145,7 +146,7 @@ class Test_codepipeline_project_repo_private:
                 mock_response.getcode.return_value = 200
                 mock_response.geturl.return_value = f"https://github.com/{repo_id}"
 
-                def mock_urlopen_side_effect(req, context=None):
+                def mock_urlopen_side_effect(req, **kwargs):
                     if "github.com" in req.get_full_url():
                         return mock_response
                     raise urllib.error.HTTPError(
@@ -172,6 +173,145 @@ class Test_codepipeline_project_repo_private:
                 assert result[0].resource_tags == []
                 assert result[0].region == AWS_REGION
 
+    def test_pipeline_repo_ssl_verification_failure(self):
+        """Test that a TLS certificate verification failure is treated as private.
+        When the probe cannot verify the server certificate (e.g. a MITM
+        presenting a forged certificate), the repository must not be reported
+        as public.
+        """
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_aws_provider([AWS_REGION]),
+        ):
+            codepipeline_client = mock.MagicMock
+            pipeline_name = "test-pipeline"
+            pipeline_arn = f"arn:aws:codepipeline:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:pipeline/{pipeline_name}"
+            connection_arn = f"arn:aws:codestar-connections:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:connection/test-connection"
+            repo_id = "prowler-cloud/prowler-private"
+
+            codepipeline_client.pipelines = {
+                pipeline_arn: Pipeline(
+                    name=pipeline_name,
+                    arn=pipeline_arn,
+                    region=AWS_REGION,
+                    source=Source(
+                        type="CodeStarSourceConnection",
+                        repository_id=repo_id,
+                        configuration={
+                            "FullRepositoryId": repo_id,
+                            "ConnectionArn": connection_arn,
+                        },
+                    ),
+                    tags=[],
+                )
+            }
+
+            with (
+                mock.patch(
+                    "prowler.providers.aws.services.codepipeline.codepipeline_service.CodePipeline",
+                    codepipeline_client,
+                ),
+                mock.patch(
+                    "prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private.codepipeline_client",
+                    codepipeline_client,
+                ),
+                mock.patch("boto3.client") as mock_client,
+                mock.patch("urllib.request.urlopen") as mock_urlopen,
+            ):
+                mock_connection = mock_client.return_value
+                mock_connection.get_connection.return_value = {
+                    "Connection": {"ProviderType": "GitHub"}
+                }
+
+                def mock_urlopen_side_effect(req, **kwargs):
+                    raise ssl.SSLError("certificate verify failed")
+
+                mock_urlopen.side_effect = mock_urlopen_side_effect
+
+                from prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private import (
+                    codepipeline_project_repo_private,
+                )
+
+                check = codepipeline_project_repo_private()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+                assert (
+                    result[0].status_extended
+                    == f"CodePipeline {pipeline_name} source repository {repo_id} is private."
+                )
+
+    def test_pipeline_repo_probe_verifies_certificate_and_sets_timeout(self):
+        """Test the probe never disables certificate verification and sets a timeout.
+        Regression test for the SSL verification bypass: the check must not use
+        an unverified SSL context, and every request must carry a timeout.
+        """
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_aws_provider([AWS_REGION]),
+        ):
+            codepipeline_client = mock.MagicMock
+            pipeline_name = "test-pipeline"
+            pipeline_arn = f"arn:aws:codepipeline:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:pipeline/{pipeline_name}"
+            connection_arn = f"arn:aws:codestar-connections:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:connection/test-connection"
+            repo_id = "prowler-cloud/prowler-private"
+
+            codepipeline_client.pipelines = {
+                pipeline_arn: Pipeline(
+                    name=pipeline_name,
+                    arn=pipeline_arn,
+                    region=AWS_REGION,
+                    source=Source(
+                        type="CodeStarSourceConnection",
+                        repository_id=repo_id,
+                        configuration={
+                            "FullRepositoryId": repo_id,
+                            "ConnectionArn": connection_arn,
+                        },
+                    ),
+                    tags=[],
+                )
+            }
+
+            with (
+                mock.patch(
+                    "prowler.providers.aws.services.codepipeline.codepipeline_service.CodePipeline",
+                    codepipeline_client,
+                ),
+                mock.patch(
+                    "prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private.codepipeline_client",
+                    codepipeline_client,
+                ),
+                mock.patch("boto3.client") as mock_client,
+                mock.patch("urllib.request.urlopen") as mock_urlopen,
+                mock.patch("ssl._create_unverified_context") as mock_unverified,
+            ):
+                mock_connection = mock_client.return_value
+                mock_connection.get_connection.return_value = {
+                    "Connection": {"ProviderType": "GitHub"}
+                }
+
+                def mock_urlopen_side_effect(req, **kwargs):
+                    raise urllib.error.HTTPError(
+                        url="", code=404, msg="", hdrs={}, fp=None
+                    )
+
+                mock_urlopen.side_effect = mock_urlopen_side_effect
+
+                from prowler.providers.aws.services.codepipeline.codepipeline_project_repo_private.codepipeline_project_repo_private import (
+                    HTTP_TIMEOUT,
+                    codepipeline_project_repo_private,
+                )
+
+                check = codepipeline_project_repo_private()
+                check.execute()
+
+                mock_unverified.assert_not_called()
+                assert mock_urlopen.call_count > 0
+                for call in mock_urlopen.call_args_list:
+                    assert call.kwargs.get("timeout") == HTTP_TIMEOUT
+
     def test_pipeline_public_gitlab_repo(self):
         """Test detection of public GitLab repository in CodePipeline.
         Tests that the check correctly identifies a public GitLab repository
@@ -225,7 +365,7 @@ class Test_codepipeline_project_repo_private:
                 mock_response.getcode.return_value = 200
                 mock_response.geturl.return_value = f"https://gitlab.com/{repo_id}"
 
-                def mock_urlopen_side_effect(req, context=None):
+                def mock_urlopen_side_effect(req, **kwargs):
                     if "gitlab.com" in req.get_full_url():
                         return mock_response
                     raise urllib.error.HTTPError(

From ca7ce5a8c3e976413d20acd7ba8c27ba7a6eabaa Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Tue, 16 Jun 2026 09:36:22 +0200
Subject: [PATCH 043/126] feat(jira): request timeout (#11602)

---
 prowler/CHANGELOG.md                |  1 +
 prowler/lib/outputs/jira/jira.py    | 28 ++++++++--
 tests/lib/outputs/jira/jira_test.py | 82 +++++++++++++++++++++++++++++
 3 files changed, 108 insertions(+), 3 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 19009ddbef..91c58f6cf9 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -14,6 +14,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 - `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
+- Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
 
 ### 🔄 Changed
diff --git a/prowler/lib/outputs/jira/jira.py b/prowler/lib/outputs/jira/jira.py
index f7f31666e1..f826d09026 100644
--- a/prowler/lib/outputs/jira/jira.py
+++ b/prowler/lib/outputs/jira/jira.py
@@ -341,6 +341,7 @@ class Jira:
     }
     TOKEN_URL = "https://auth.atlassian.com/oauth/token"
     API_TOKEN_URL = "https://api.atlassian.com/oauth/token/accessible-resources"
+    REQUEST_TIMEOUT = 30
     HEADER_TEMPLATE = {
         "Content-Type": "application/json",
         "X-Force-Accept-Language": "true",
@@ -578,7 +579,12 @@ class Jira:
             }
 
             headers = self.get_headers(content_type_json=True)
-            response = requests.post(self.TOKEN_URL, json=body, headers=headers)
+            response = requests.post(
+                self.TOKEN_URL,
+                json=body,
+                headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
+            )
 
             if response.status_code == 200:
                 tokens = response.json()
@@ -630,12 +636,17 @@ class Jira:
                 response = requests.get(
                     f"https://{domain}.atlassian.net/_edge/tenant_info",
                     headers=headers,
+                    timeout=self.REQUEST_TIMEOUT,
                 )
                 response = response.json()
                 return response.get("cloudId")
             else:
                 headers = self.get_headers(access_token)
-                response = requests.get(self.API_TOKEN_URL, headers=headers)
+                response = requests.get(
+                    self.API_TOKEN_URL,
+                    headers=headers,
+                    timeout=self.REQUEST_TIMEOUT,
+                )
 
             if response.status_code == 200:
                 resources = response.json()
@@ -717,7 +728,12 @@ class Jira:
             }
 
             headers = self.get_headers(content_type_json=True)
-            response = requests.post(url, json=body, headers=headers)
+            response = requests.post(
+                url,
+                json=body,
+                headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
+            )
 
             if response.status_code == 200:
                 tokens = response.json()
@@ -874,6 +890,7 @@ class Jira:
             response = requests.get(
                 f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/project",
                 headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
             )
 
             if response.status_code == 200:
@@ -941,6 +958,7 @@ class Jira:
             response = requests.get(
                 f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/issue/createmeta?projectKeys={project_key}&expand=projects.issuetypes.fields",
                 headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
             )
 
             if response.status_code == 200:
@@ -986,6 +1004,7 @@ class Jira:
             response = requests.get(
                 f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/project",
                 headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
             )
             if response.status_code == 200:
                 projects_data = {}
@@ -1001,6 +1020,7 @@ class Jira:
                         project_response = requests.get(
                             f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/issue/createmeta?projectKeys={project['key']}&expand=projects.issuetypes.fields",
                             headers=headers,
+                            timeout=self.REQUEST_TIMEOUT,
                         )
                         if project_response.status_code == 200:
                             project_metadata = project_response.json()
@@ -1923,6 +1943,7 @@ class Jira:
                     f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/issue",
                     json=payload,
                     headers=headers,
+                    timeout=self.REQUEST_TIMEOUT,
                 )
 
                 if response.status_code != 201:
@@ -2127,6 +2148,7 @@ class Jira:
                 f"https://api.atlassian.com/ex/jira/{self.cloud_id}/rest/api/3/issue",
                 json=payload,
                 headers=headers,
+                timeout=self.REQUEST_TIMEOUT,
             )
 
             if response.status_code != 201:
diff --git a/tests/lib/outputs/jira/jira_test.py b/tests/lib/outputs/jira/jira_test.py
index 788d6ba7c9..76352cb297 100644
--- a/tests/lib/outputs/jira/jira_test.py
+++ b/tests/lib/outputs/jira/jira_test.py
@@ -339,6 +339,88 @@ class TestJiraIntegration:
         with pytest.raises(JiraRefreshTokenError):
             self.jira_integration.refresh_access_token()
 
+    @patch("prowler.lib.outputs.jira.jira.requests.post")
+    @patch.object(Jira, "get_cloud_id", return_value="test_cloud_id")
+    def test_get_auth_sends_timeout(self, mock_get_cloud_id, mock_post):
+        """get_auth must pass a request timeout to avoid hanging on an unresponsive Jira."""
+        # To disable vulture
+        mock_get_cloud_id = mock_get_cloud_id
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "access_token": "test_access_token",
+            "refresh_token": "test_refresh_token",
+            "expires_in": 3600,
+        }
+        mock_post.return_value = mock_response
+
+        self.jira_integration.get_auth("test_auth_code")
+
+        assert mock_post.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
+    @patch("prowler.lib.outputs.jira.jira.requests.get")
+    def test_get_cloud_id_sends_timeout(self, mock_get):
+        """get_cloud_id (OAuth path) must pass a request timeout."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = [{"id": "test_cloud_id"}]
+        mock_get.return_value = mock_response
+
+        self.jira_integration.get_cloud_id("test_access_token")
+
+        assert mock_get.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
+    @patch("prowler.lib.outputs.jira.jira.requests.get")
+    def test_get_cloud_id_basic_auth_sends_timeout(self, mock_get):
+        """get_cloud_id (basic-auth tenant_info path) must pass a request timeout."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"cloudId": "test_cloud_id"}
+        mock_get.return_value = mock_response
+
+        self.jira_integration_basic_auth.get_cloud_id(domain=self.domain)
+
+        assert mock_get.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
+    @patch("prowler.lib.outputs.jira.jira.requests.post")
+    def test_refresh_access_token_sends_timeout(self, mock_post):
+        """refresh_access_token must pass a request timeout."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "access_token": "new_access_token",
+            "refresh_token": "new_refresh_token",
+            "expires_in": 3600,
+        }
+        mock_post.return_value = mock_response
+
+        self.jira_integration.refresh_access_token()
+
+        assert mock_post.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
+    @patch.object(Jira, "get_access_token", return_value="valid_access_token")
+    @patch.object(
+        Jira, "cloud_id", new_callable=PropertyMock, return_value="test_cloud_id"
+    )
+    @patch("prowler.lib.outputs.jira.jira.requests.get")
+    def test_get_projects_sends_timeout(
+        self, mock_get, mock_cloud_id, mock_get_access_token
+    ):
+        """get_projects must pass a request timeout."""
+        # To disable vulture
+        mock_cloud_id = mock_cloud_id
+        mock_get_access_token = mock_get_access_token
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = [{"key": "PROJ1", "name": "Project One"}]
+        mock_get.return_value = mock_response
+
+        self.jira_integration.get_projects()
+
+        assert mock_get.call_args.kwargs["timeout"] == Jira.REQUEST_TIMEOUT
+
     @patch.object(Jira, "get_auth", return_value=None)
     @patch.object(
         Jira,

From f1e42d168124b097add5829c82070e1d4498ead5 Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Tue, 16 Jun 2026 09:44:18 +0200
Subject: [PATCH 044/126] chore(api-beat): absolute entrypoint (#11604)

---
 contrib/k8s/helm/prowler-api/values.yaml | 2 +-
 contrib/k8s/helm/prowler-app/values.yaml | 2 +-
 docker-compose-dev.yml                   | 2 +-
 docker-compose.yml                       | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/contrib/k8s/helm/prowler-api/values.yaml b/contrib/k8s/helm/prowler-api/values.yaml
index 81eda5f690..0395c6f704 100644
--- a/contrib/k8s/helm/prowler-api/values.yaml
+++ b/contrib/k8s/helm/prowler-api/values.yaml
@@ -28,7 +28,7 @@ containers:
     image:
       repository: prowlercloud/prowler-api
       pullPolicy: IfNotPresent
-    command: ["../docker-entrypoint.sh", "beat"]
+    command: ["/home/prowler/docker-entrypoint.sh", "beat"]
 
 secrets:
   POSTGRES_HOST:
diff --git a/contrib/k8s/helm/prowler-app/values.yaml b/contrib/k8s/helm/prowler-app/values.yaml
index 9acca09f2a..ed390af29e 100644
--- a/contrib/k8s/helm/prowler-app/values.yaml
+++ b/contrib/k8s/helm/prowler-app/values.yaml
@@ -440,7 +440,7 @@ worker_beat:
     tag: ""
 
   command:
-    - ../docker-entrypoint.sh
+    - /home/prowler/docker-entrypoint.sh
   args:
     - beat
 
diff --git a/docker-compose-dev.yml b/docker-compose-dev.yml
index f68bf9dcc3..d737298183 100644
--- a/docker-compose-dev.yml
+++ b/docker-compose-dev.yml
@@ -185,7 +185,7 @@ services:
         soft: 65536
         hard: 65536
     entrypoint:
-      - "../docker-entrypoint.sh"
+      - "/home/prowler/docker-entrypoint.sh"
       - "beat"
 
   mcp-server:
diff --git a/docker-compose.yml b/docker-compose.yml
index 0ce78cbf1f..6cb5ac237d 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -160,7 +160,7 @@ services:
         soft: 65536
         hard: 65536
     entrypoint:
-      - "../docker-entrypoint.sh"
+      - "/home/prowler/docker-entrypoint.sh"
       - "beat"
 
   mcp-server:

From cb4b889b200d30985c0217087f3dd6aecb03ba2c Mon Sep 17 00:00:00 2001
From: Aline Almeida <aline@tuplita.ai>
Date: Tue, 16 Jun 2026 09:11:16 +0100
Subject: [PATCH 045/126] fix(gcp): credit audit-filtered aggregated sinks in
 metric-filter checks (#11575)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 prowler/CHANGELOG.md                          |  8 ++
 .../gcp/services/logging/logging_service.py   | 90 ++++++++++++++++++-
 .../services/logging/logging_service_test.py  | 89 ++++++++++++++++++
 3 files changed, 184 insertions(+), 3 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 91c58f6cf9..6dc2aafb60 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -28,6 +28,14 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ---
 
+## [5.30.2] (Prowler UNRELEASED)
+
+### 🐞 Fixed
+
+- GCP `logging_log_metric_filter_and_alert_*` checks now credit org-level aggregated sinks filtered to the Admin Activity audit stream [(#11575)](https://github.com/prowler-cloud/prowler/pull/11575)
+
+---
+
 ## [5.30.0] (Prowler v5.30.0)
 
 ### 🚀 Added
diff --git a/prowler/providers/gcp/services/logging/logging_service.py b/prowler/providers/gcp/services/logging/logging_service.py
index 3d5b0d1e79..7d8843584e 100644
--- a/prowler/providers/gcp/services/logging/logging_service.py
+++ b/prowler/providers/gcp/services/logging/logging_service.py
@@ -1,9 +1,12 @@
+import re
+
 from pydantic.v1 import BaseModel
 
 from prowler.lib.logger import logger
 from prowler.providers.gcp.config import DEFAULT_RETRY_ATTEMPTS
 from prowler.providers.gcp.gcp_provider import GcpProvider
 from prowler.providers.gcp.lib.service.service import GCPService
+from prowler.providers.gcp.services.monitoring.monitoring_service import Monitoring
 
 
 class Logging(GCPService):
@@ -121,9 +124,86 @@ class Metric(BaseModel):
     bucket_name: str = ""
 
 
+# A positive selector of the Admin Activity stream: a ``logName`` predicate
+# (``:`` has-substring or ``=`` equals) or a ``log_id()`` call. Written verbose
+# so each fragment stays legible; ``(?![a-z_])`` keeps a longer stream name
+# (``.../activity_v2``) from impersonating Admin Activity.
+_ACTIVITY_SELECTOR = re.compile(
+    r"""
+    (?: logName \s* [:=] \s* | log_id \s* \( \s* )   # logName: / logName= / log_id(
+    ["']? [^"'\s)]*                                  # optional quote, then path prefix
+    cloudaudit\.googleapis\.com/activity (?![a-z_])  # the Admin Activity stream itself
+    """,
+    re.IGNORECASE | re.VERBOSE,
+)
+
+# The same selector for *any* Cloud Audit stream (activity, data_access,
+# system_event, policy, access_transparency, …). Used to strip the OR-combined
+# audit clauses so we can prove nothing restrictive is left over.
+_CLOUDAUDIT_SELECTOR = re.compile(
+    r"""
+    (?: logName \s* [:=] \s* | log_id \s* \( \s* )   # logName: / logName= / log_id(
+    ["']? [^"'\s)]*                                  # optional quote, then path prefix
+    cloudaudit\.googleapis\.com/[a-z_]+              # any cloudaudit stream
+    ["']? \s* \)?                                    # optional closing quote / paren
+    """,
+    re.IGNORECASE | re.VERBOSE,
+)
+
+# Operators that exclude or narrow coverage. Any of these means we cannot prove
+# the sink delivers the *whole* Admin Activity stream, so it is not credited.
+_NEGATION_OR_RESTRICTION = re.compile(
+    r"""
+      \bNOT\b                       # NOT exclusion
+    | \bAND\b                       # AND conjunction (restriction)
+    | != | !:                       # "!=" / "!:" inequality
+    | (?:^|[\s(]) -\s* [A-Za-z_]    # leading "-" exclusion operator
+    """,
+    re.IGNORECASE | re.VERBOSE,
+)
+
+
+def _sink_delivers_activity_logs(sink_filter: str) -> bool:
+    """True only when a sink's filter *provably* exports the full Admin Activity
+    audit stream (or everything).
+
+    Crediting flips a child project to PASS on a CIS security control, so the
+    match is deliberately conservative: a false FAIL is safe, a false PASS is
+    not. A non-``"all"`` filter is credited only when
+
+      1. it positively selects the Admin Activity stream
+         (``logName:.../activity``, ``logName="...activity"`` or
+         ``log_id("...activity")``);
+      2. it carries no operator that excludes or narrows the stream — ``NOT`` /
+         ``-`` / ``!=`` (negation) or ``AND`` (restriction); and
+      3. nothing but ``OR``-combined Cloud Audit selectors remains once those are
+         stripped — an ``OR`` only widens coverage, but any leftover predicate
+         (``severity>=ERROR``, ``resource.type=...``) could narrow it.
+
+    Sink filters encode the stream URL-encoded (``...%2Factivity``) or as a path
+    — normalize before matching.
+    """
+    if not sink_filter or sink_filter.strip().lower() == "all":
+        return True
+    normalized = sink_filter.replace("%2F", "/").replace("%2f", "/")
+    # 1. The Admin Activity stream must be positively selected.
+    if not _ACTIVITY_SELECTOR.search(normalized):
+        return False
+    # 2. No operator may exclude or narrow that coverage.
+    if _NEGATION_OR_RESTRICTION.search(normalized):
+        return False
+    # 3. Only OR-combined audit selectors may remain — strip them and the OR
+    #    glue; anything left is a predicate we cannot prove is full-coverage.
+    remainder = _CLOUDAUDIT_SELECTOR.sub(" ", normalized)
+    remainder = re.sub(r"\bOR\b|[()\s]", " ", remainder, flags=re.IGNORECASE)
+    return remainder.strip() == ""
+
+
 def get_projects_covered_by_aggregated_metric(
-    logging_client, monitoring_client, metric_filter
-):
+    logging_client: Logging,
+    monitoring_client: Monitoring,
+    metric_filter: str,
+) -> dict[str, str]:
     """Return {project_id: metric_name} for scanned projects whose logs are routed,
     via an organization-level sink with includeChildren=True, to a bucket that holds
     a bucket-scoped log metric matching ``metric_filter`` that has an alert policy.
@@ -133,6 +213,10 @@ def get_projects_covered_by_aggregated_metric(
     every child project's logs into one bucket, where a single bucket-scoped metric
     + alert covers them all. Without crediting that, those child projects are falsely
     failed. Mirrors the org-sink handling already in ``logging_sink_created`` (#11355).
+
+    A sink is credited when it exports everything (``filter == "all"``) or when its
+    filter carries the Admin Activity audit stream — the only stream the CIS metric
+    filters can match (see ``_sink_delivers_activity_logs``).
     """
     # Buckets that hold a matching, alerted, bucket-scoped metric -> metric name.
     bucket_to_metric = {}
@@ -155,7 +239,7 @@ def get_projects_covered_by_aggregated_metric(
     for sink in logging_client.sinks:
         if not getattr(sink, "include_children", False):
             continue
-        if getattr(sink, "filter", "all") != "all":
+        if not _sink_delivers_activity_logs(getattr(sink, "filter", "all")):
             continue
         for bucket, metric_name in bucket_to_metric.items():
             # sink.destination e.g. "logging.googleapis.com/projects/.../buckets/X";
diff --git a/tests/providers/gcp/services/logging/logging_service_test.py b/tests/providers/gcp/services/logging/logging_service_test.py
index 72e18eddbb..e466a17314 100644
--- a/tests/providers/gcp/services/logging/logging_service_test.py
+++ b/tests/providers/gcp/services/logging/logging_service_test.py
@@ -1,5 +1,7 @@
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 from prowler.providers.gcp.services.logging.logging_service import Logging
 from tests.providers.gcp.gcp_fixtures import (
     GCP_PROJECT_ID,
@@ -291,6 +293,93 @@ class TestGetProjectsCoveredByAggregatedMetric:
         )
         assert self._run(logging_client, monitoring_client) == {}
 
+    def test_not_covered_when_sink_filter_omits_activity_stream(self):
+        """A sink that routes cloudaudit streams but NOT Admin Activity (here,
+        data_access only) does not deliver the entries the CIS metric filters
+        match, so it must not be credited — right service, wrong stream."""
+        logging_client, monitoring_client = self._clients(
+            sink_filter="logName: /logs/cloudaudit.googleapis.com%2Fdata_access"
+        )
+        assert self._run(logging_client, monitoring_client) == {}
+
+    def test_covered_when_sink_filter_carries_activity_stream_encoded(self):
+        """A sink filtered to the cloudaudit streams (URL-encoded logName form,
+        as returned by the Logging API) delivers every Admin Activity entry the
+        CIS metric filters can match, so it must be credited."""
+        logging_client, monitoring_client = self._clients(
+            sink_filter=(
+                "logName: /logs/cloudaudit.googleapis.com%2Factivity OR "
+                "logName: /logs/cloudaudit.googleapis.com%2Fdata_access"
+            )
+        )
+        assert self._run(logging_client, monitoring_client) == {
+            GCP_PROJECT_ID: "central-metric"
+        }
+
+    def test_covered_when_sink_filter_carries_activity_stream_plain(self):
+        logging_client, monitoring_client = self._clients(
+            sink_filter='logName="projects/p/logs/cloudaudit.googleapis.com/activity"'
+        )
+        assert self._run(logging_client, monitoring_client) == {
+            GCP_PROJECT_ID: "central-metric"
+        }
+
+    @pytest.mark.parametrize(
+        "sink_filter",
+        [
+            # --- Negation: the stream is named but excluded. ---
+            'NOT logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity"',
+            '-logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity"',
+            'NOT log_id("cloudaudit.googleapis.com/activity")',
+            # "!=" inequality (and its spaced form) excludes the stream.
+            'logName!="projects/p/logs/cloudaudit.googleapis.com%2Factivity"',
+            'logName != "projects/p/logs/cloudaudit.googleapis.com/activity"',
+            # Activity negated inside a compound filter.
+            'resource.type="gce_instance" AND '
+            'NOT logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity"',
+            # --- Restriction: the stream is named but AND-narrowed, so only a
+            # subset of Admin Activity entries reaches the bucket. ---
+            'logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity" '
+            'AND resource.type="gce_instance"',
+            'log_id("cloudaudit.googleapis.com/activity") '
+            'AND resource.type="gce_instance"',
+            'logName="projects/p/logs/cloudaudit.googleapis.com/activity" '
+            "AND severity>=ERROR",
+            'logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity" '
+            'AND protoPayload.methodName="SetIamPolicy"',
+            # --- OR-ed with a non-audit predicate: fail closed, since we credit
+            # only unions of provable Cloud Audit stream selectors. ---
+            'logName:"projects/p/logs/cloudaudit.googleapis.com%2Factivity" '
+            "OR severity>=ERROR",
+        ],
+    )
+    def test_not_covered_when_sink_filter_negated_or_restrictive(self, sink_filter):
+        """A filter that names the Admin Activity stream but negates, narrows, or
+        mixes in an unprovable predicate is not credited — we credit only filters
+        we can prove deliver every Admin Activity entry the CIS metrics match."""
+        logging_client, monitoring_client = self._clients(sink_filter=sink_filter)
+        assert self._run(logging_client, monitoring_client) == {}
+
+    def test_covered_when_activity_logname_has_hyphenated_path(self):
+        """A hyphen in the project path must not be mistaken for the ``-`` (NOT)
+        negation operator — the activity stream is still delivered."""
+        logging_client, monitoring_client = self._clients(
+            sink_filter='logName="projects/my-project/logs/cloudaudit.googleapis.com/activity"'
+        )
+        assert self._run(logging_client, monitoring_client) == {
+            GCP_PROJECT_ID: "central-metric"
+        }
+
+    def test_covered_when_sink_filter_uses_log_id_selector(self):
+        """The ``log_id()`` form is an equivalent positive full-coverage selector
+        of the Admin Activity stream and is credited like the ``logName`` form."""
+        logging_client, monitoring_client = self._clients(
+            sink_filter='log_id("cloudaudit.googleapis.com/activity")'
+        )
+        assert self._run(logging_client, monitoring_client) == {
+            GCP_PROJECT_ID: "central-metric"
+        }
+
     def test_not_covered_when_sink_destination_bucket_differs(self):
         logging_client, monitoring_client = self._clients(
             sink_destination="logging.googleapis.com/projects/x/locations/eu/buckets/other"

From eeb02453d1f9a0b5f73dbd24cf8351829696afa6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 10:14:21 +0200
Subject: [PATCH 046/126] chore(deps): bump pyjwt from 2.12.1 to 2.13.0 in
 /mcp_server (#11606)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 mcp_server/uv.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mcp_server/uv.lock b/mcp_server/uv.lock
index fd0a9349f9..dcc91b3851 100644
--- a/mcp_server/uv.lock
+++ b/mcp_server/uv.lock
@@ -857,11 +857,11 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.12.1"
+version = "2.13.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c2/27/a3b6e5bf6ff856d2509292e95c8f57f0df7017cf5394921fc4e4ef40308a/pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b", size = 102564, upload-time = "2026-03-13T19:27:37.25Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
 ]
 
 [package.optional-dependencies]

From 28c064a9b7369b4f5c69bda0dec4ead3707c194f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= <ruben@prowler.com>
Date: Tue, 16 Jun 2026 10:26:20 +0200
Subject: [PATCH 047/126] feat(api): add Server-Sent Events (SSE)
 infrastructure (#11556)

---
 api/CHANGELOG.md                              |   4 +
 api/docker-entrypoint.sh                      |  12 +-
 api/pyproject.toml                            |   6 +-
 api/src/backend/api/authentication.py         |  27 ++
 api/src/backend/api/sse/__init__.py           |  13 +
 api/src/backend/api/sse/base_views.py         |  46 ++++
 api/src/backend/api/sse/channelmanager.py     |  75 ++++++
 api/src/backend/api/sse/utils.py              |  51 ++++
 .../backend/api/tests/test_authentication.py  |  63 ++++-
 api/src/backend/api/tests/test_sse.py         | 191 ++++++++++++++
 api/src/backend/config/django/base.py         |   3 +
 api/src/backend/config/guniconf.py            |   9 +
 .../backend/config/settings/eventstream.py    |  41 +++
 api/uv.lock                                   |  60 ++++-
 docs/developer-guide/server-sent-events.mdx   | 241 ++++++++++++++++++
 docs/docs.json                                |   3 +-
 16 files changed, 832 insertions(+), 13 deletions(-)
 create mode 100644 api/src/backend/api/sse/__init__.py
 create mode 100644 api/src/backend/api/sse/base_views.py
 create mode 100644 api/src/backend/api/sse/channelmanager.py
 create mode 100644 api/src/backend/api/sse/utils.py
 create mode 100644 api/src/backend/api/tests/test_sse.py
 create mode 100644 api/src/backend/config/settings/eventstream.py
 create mode 100644 docs/developer-guide/server-sent-events.mdx

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 6fa66193e3..afd8b4b071 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ## [1.32.0] (Prowler UNRELEASED)
 
+### 🚀 Added
+
+- Server-Sent Events (SSE) infrastructure for the API: a base viewset, a tenant-aware channel manager, and channel-name helpers backed by `django-eventstream` over Valkey Pub/Sub and served through the Gunicorn ASGI worker, so feature endpoints can stream events to clients over a single long-lived connection [(#11556)](https://github.com/prowler-cloud/prowler/pull/11556)
+
 ### 🔐 Security
 
 - `aiohttp` to 3.14.0 and `idna` to 3.15, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
diff --git a/api/docker-entrypoint.sh b/api/docker-entrypoint.sh
index 9b2964b479..e077a3bfd6 100755
--- a/api/docker-entrypoint.sh
+++ b/api/docker-entrypoint.sh
@@ -21,13 +21,19 @@ apply_fixtures() {
 }
 
 start_dev_server() {
-  echo "Starting the development server..."
-  exec uv run python manage.py runserver 0.0.0.0:"${DJANGO_PORT:-8080}"
+  echo "Starting the development server (Gunicorn ASGI, debug + reload)..."
+  # Same server/worker as prod (config.asgi via the native `asgi` worker), so
+  # SSE streams run on the event loop exactly as they do in production. DEBUG is
+  # on so guniconf's `reload = DEBUG` hot-reloads edited code (and flips
+  # `preload_app` off so reload actually takes).
+  export DJANGO_DEBUG="${DJANGO_DEBUG:-True}"
+  export DJANGO_BIND_ADDRESS="${DJANGO_BIND_ADDRESS:-0.0.0.0}"
+  exec uv run gunicorn -c config/guniconf.py config.asgi:application
 }
 
 start_prod_server() {
   echo "Starting the Gunicorn server..."
-  exec uv run gunicorn -c config/guniconf.py config.wsgi:application
+  exec uv run gunicorn -c config/guniconf.py config.asgi:application
 }
 
 resolve_worker_hostname() {
diff --git a/api/pyproject.toml b/api/pyproject.toml
index 521d496e5b..baeeb6ea0a 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -41,7 +41,8 @@ dependencies = [
   "drf-spectacular==0.27.2",
   "drf-spectacular-jsonapi==0.5.1",
   "defusedxml==0.7.1",
-  "gunicorn==23.0.0",
+  "django-eventstream==5.3.3",
+  "gunicorn==26.0.0",
   "lxml==6.1.0",
   "prowler @ git+https://github.com/prowler-cloud/prowler.git@master",
   "psycopg2-binary==2.9.9",
@@ -209,6 +210,7 @@ constraint-dependencies = [
   "django-celery-results==2.6.0",
   "django-cors-headers==4.4.0",
   "django-environ==0.11.2",
+  "django-eventstream==5.3.3",
   "django-filter==24.3",
   "django-guid==3.5.0",
   "django-postgres-extra==2.0.9",
@@ -253,7 +255,7 @@ constraint-dependencies = [
   "grpc-google-iam-v1==0.14.3",
   "grpcio==1.76.0",
   "grpcio-status==1.76.0",
-  "gunicorn==23.0.0",
+  "gunicorn==26.0.0",
   "h11==0.16.0",
   "h2==4.3.0",
   "hpack==4.1.0",
diff --git a/api/src/backend/api/authentication.py b/api/src/backend/api/authentication.py
index 499e290bb7..04740ac219 100644
--- a/api/src/backend/api/authentication.py
+++ b/api/src/backend/api/authentication.py
@@ -93,3 +93,30 @@ class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):
 
         # Default fallback
         return self.jwt_auth.authenticate(request)
+
+
+class SSEAuthentication(CombinedJWTOrAPIKeyAuthentication):
+    """JWT/API-Key auth that also accepts `?access_token=<jwt>`.
+
+    Browser `EventSource` is the only widely available SSE client API
+    and it cannot set the `Authorization` header (its constructor takes
+    only a URL and `withCredentials`). To keep browser SSE clients on
+    the same auth stack as the rest of the API, SSE endpoints additionally
+    accept a JWT via the `?access_token=<jwt>` query parameter — the
+    standard parameter name defined in RFC 6750 Section 2.3 for bearer tokens.
+    """
+
+    def authenticate(self, request: Request):
+        auth_header = request.headers.get("Authorization", "")
+        if auth_header:
+            return super().authenticate(request)
+
+        raw_token = request.query_params.get("access_token")
+        if not raw_token:
+            # No header and no query token — let the default path raise
+            # the canonical AuthenticationFailed via the parent class.
+            return super().authenticate(request)
+
+        validated_token = self.jwt_auth.get_validated_token(raw_token)
+        user = self.jwt_auth.get_user(validated_token)
+        return user, validated_token
diff --git a/api/src/backend/api/sse/__init__.py b/api/src/backend/api/sse/__init__.py
new file mode 100644
index 0000000000..244bd3c9ad
--- /dev/null
+++ b/api/src/backend/api/sse/__init__.py
@@ -0,0 +1,13 @@
+"""Platform Server-Sent Events (SSE) infrastructure.
+
+Wires `django-eventstream` into the API: a base viewset features
+subclass to expose an SSE endpoint
+(:class:`api.sse.base_views.BaseSSEViewSet`), the channel manager that
+enforces the tenant gate (:class:`api.sse.channelmanager.SSEChannelManager`),
+and the channel-name helpers (:func:`api.sse.utils.make_channel_name`).
+"""
+
+from api.sse.utils import make_channel_name
+from api.sse.base_views import BaseSSEViewSet
+
+__all__ = ["BaseSSEViewSet", "make_channel_name"]
diff --git a/api/src/backend/api/sse/base_views.py b/api/src/backend/api/sse/base_views.py
new file mode 100644
index 0000000000..c4a24540ee
--- /dev/null
+++ b/api/src/backend/api/sse/base_views.py
@@ -0,0 +1,46 @@
+"""Base view class for SSE endpoints."""
+
+from api.authentication import SSEAuthentication
+from api.base_views import BaseRLSViewSet
+from django_eventstream.renderers import SSEEventRenderer
+from django_eventstream.views import events
+
+
+class BaseSSEViewSet(BaseRLSViewSet):
+    """Base class for platform SSE endpoints.
+
+    Subclasses override method `get_channels` to declare the channel
+    names the connection should subscribe to — the same way a regular
+    DRF viewset overrides method `get_queryset`. The channel manager
+    reads the result from `request.sse_channels`; there is no other
+    coupling between platform and feature.
+    """
+
+    authentication_classes = [SSEAuthentication]
+    # Pin the SSE renderer so content negotiation accepts the browser's
+    # `Accept: text/event-stream`.
+    renderer_classes = [SSEEventRenderer]
+
+    def get_channels(self) -> set[str]:
+        """Return the channels this connection subscribes to.
+
+        Implementations MUST raise the relevant DRF exceptions
+        (`NotAuthenticated`, `PermissionDenied`, `NotFound`) when
+        authorization fails. Returning an empty set would surface as
+        django-eventstream's "No channels specified" which masks the
+        real cause.
+        """
+        raise NotImplementedError
+
+    def get_queryset(self):
+        # Most SSE viewsets only need `get_channels` and never call
+        # `get_queryset` (the SSE list path bypasses serialization
+        # entirely). Subclasses that perform their own queryset lookup
+        # inside `get_channels` should override; the default raises
+        # the same error a missing override on a ModelViewSet would.
+        raise NotImplementedError
+
+    def list(self, request, *_args, **kwargs):
+        """Resolve channels under the regular DRF stack and stream."""
+        request.sse_channels = self.get_channels()
+        return events(request, **kwargs)
diff --git a/api/src/backend/api/sse/channelmanager.py b/api/src/backend/api/sse/channelmanager.py
new file mode 100644
index 0000000000..72b2c18367
--- /dev/null
+++ b/api/src/backend/api/sse/channelmanager.py
@@ -0,0 +1,75 @@
+"""Channel manager that wires `django-eventstream` to platform SSE views."""
+
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+from uuid import UUID
+
+from django_eventstream.channelmanager import DefaultChannelManager
+from rest_framework.request import Request
+
+from api.sse.utils import tenant_id_from_channel
+
+if TYPE_CHECKING:
+    from api.models import User
+
+
+class SSEChannelManager(DefaultChannelManager):
+    """Connect `django-eventstream` to the platform's SSE viewsets."""
+
+    def get_channels_for_request(self, request: Request, view_kwargs: dict) -> set[str]:  # noqa: vulture
+        """Return the request's channels scoped to the active JWT tenant.
+
+        Args:
+            request: The authenticated DRF request, carrying `tenant_id`
+                (set by `BaseRLSViewSet`) and `sse_channels` (set by
+                `BaseSSEViewSet.list`).
+            view_kwargs: URL keyword arguments from django-eventstream;
+                unused because channels are resolved on the request.
+
+        Returns:
+            The subset of `request.sse_channels` whose embedded tenant
+            matches the active request tenant.
+        """
+        try:
+            request_tenant_id = UUID(str(getattr(request, "tenant_id", None)))
+        except (TypeError, ValueError):
+            return set()
+        return {
+            channel
+            for channel in getattr(request, "sse_channels", set())
+            if tenant_id_from_channel(channel) == request_tenant_id
+        }
+
+    def can_read_channel(self, user: "User | None", channel: str) -> bool:
+        """Re-verify tenant membership once the stream is established.
+
+        Args:
+            user: The connection's authenticated `User`, or `None` for an
+                anonymous connection — django-eventstream passes `None`
+                rather than an `AnonymousUser`.
+            channel: The channel name being read, in the canonical
+                `<prefix>:<tenant_id>:<resource_id>` format.
+
+        Returns:
+            `True` only when `user` is authenticated and a member of the
+            tenant embedded in `channel`; `False` otherwise, including for
+            anonymous connections and malformed channel names.
+        """
+        if user is None or not user.is_authenticated:
+            return False
+        tenant_id = tenant_id_from_channel(channel)
+        if tenant_id is None:
+            return False
+        return user.is_member_of_tenant(tenant_id)
+
+    def is_channel_reliable(self, channel: str) -> bool:
+        """Report whether the channel keeps a server-side replay buffer.
+
+        Args:
+            channel: The channel name being queried.
+
+        Returns:
+            `False`, unconditionally. Replay storage is not configured
+        """
+        return False
diff --git a/api/src/backend/api/sse/utils.py b/api/src/backend/api/sse/utils.py
new file mode 100644
index 0000000000..a30ed26311
--- /dev/null
+++ b/api/src/backend/api/sse/utils.py
@@ -0,0 +1,51 @@
+"""Channel-name convention shared by SSE publishers, consumers, and the
+channel manager. The format is `<prefix>:<tenant_id>:<resource_id>`.
+"""
+
+from __future__ import annotations
+
+import uuid
+
+CHANNEL_SEPARATOR = ":"
+
+
+def make_channel_name(
+    prefix: str,
+    tenant_id: str | uuid.UUID,
+    resource_id: str | uuid.UUID,
+) -> str:
+    """Build the canonical channel name for a resource.
+
+    Args:
+        prefix: Feature-owned prefix (e.g. `"lighthouse-session"`).
+        tenant_id: Tenant the resource belongs to.
+        resource_id: Resource identifier within the tenant.
+
+    Raises:
+        ValueError: If any segment contains `CHANNEL_SEPARATOR`, which
+            would break the `<prefix>:<tenant_id>:<resource_id>` contract
+            and let a crafted name smuggle extra segments past the parser.
+    """
+    segments = (str(prefix), str(tenant_id), str(resource_id))
+    if any(CHANNEL_SEPARATOR in segment for segment in segments):
+        raise ValueError(
+            f"Channel segments must not contain '{CHANNEL_SEPARATOR}': {segments!r}"
+        )
+    return CHANNEL_SEPARATOR.join(segments)
+
+
+def tenant_id_from_channel(channel: str) -> uuid.UUID | None:
+    """Return the tenant UUID embedded in *channel*, or `None` if
+    *channel* does not follow the platform convention.
+
+    A `None` result MUST be treated by callers as "not authorized" or
+    a malformed channel cannot be safely read.
+    """
+    segments = channel.split(CHANNEL_SEPARATOR)
+    if len(segments) != 3:
+        # Reject non-canonical names
+        return None
+    try:
+        return uuid.UUID(segments[1])
+    except ValueError:
+        return None
diff --git a/api/src/backend/api/tests/test_authentication.py b/api/src/backend/api/tests/test_authentication.py
index 6745c36e91..505d7c9320 100644
--- a/api/src/backend/api/tests/test_authentication.py
+++ b/api/src/backend/api/tests/test_authentication.py
@@ -1,13 +1,13 @@
 import time
 from datetime import datetime, timedelta, timezone
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
 import pytest
 from django.test import RequestFactory
 from rest_framework.exceptions import AuthenticationFailed
 
-from api.authentication import TenantAPIKeyAuthentication
+from api.authentication import SSEAuthentication, TenantAPIKeyAuthentication
 from api.db_router import MainRouter
 from api.models import TenantAPIKey
 
@@ -382,3 +382,62 @@ class TestTenantAPIKeyAuthentication:
             auth_backend.authenticate(request)
 
         assert str(exc_info.value.detail) == "API Key has already expired."
+
+
+class TestSSEAuthentication:
+    """`SSEAuthentication` adds an `?access_token=<jwt>` fallback for
+    browser `EventSource` clients while keeping the standard
+    `Authorization` header as the authoritative source."""
+
+    def test_header_present_delegates_to_super(self):
+        request = MagicMock()
+        request.headers = {"Authorization": "Bearer header-token"}
+        with patch.object(
+            SSEAuthentication.__bases__[0], "authenticate", return_value=("user", "tok")
+        ) as super_auth:
+            result = SSEAuthentication().authenticate(request)
+        super_auth.assert_called_once_with(request)
+        assert result == ("user", "tok")
+
+    def test_no_header_no_query_token_delegates_to_super(self):
+        request = MagicMock()
+        request.headers = {}
+        request.query_params = {}
+        with patch.object(
+            SSEAuthentication.__bases__[0], "authenticate", return_value=None
+        ) as super_auth:
+            result = SSEAuthentication().authenticate(request)
+        super_auth.assert_called_once_with(request)
+        assert result is None
+
+    def test_query_token_used_only_as_fallback(self):
+        request = MagicMock()
+        request.headers = {}
+        request.query_params = {"access_token": "query-jwt"}
+
+        jwt_instance = MagicMock()
+        jwt_instance.get_validated_token.return_value = "validated"
+        jwt_instance.get_user.return_value = "query-user"
+
+        with patch.object(SSEAuthentication, "jwt_auth", jwt_instance):
+            user, token = SSEAuthentication().authenticate(request)
+
+        jwt_instance.get_validated_token.assert_called_once_with("query-jwt")
+        assert user == "query-user"
+        assert token == "validated"
+
+    def test_query_token_invalid_raises_authentication_failed(self):
+        request = MagicMock()
+        request.headers = {}
+        request.query_params = {"access_token": "bad-token"}
+
+        jwt_instance = MagicMock()
+        jwt_instance.get_validated_token.side_effect = AuthenticationFailed(
+            "Invalid token"
+        )
+
+        with patch.object(SSEAuthentication, "jwt_auth", jwt_instance):
+            with pytest.raises(AuthenticationFailed):
+                SSEAuthentication().authenticate(request)
+
+        jwt_instance.get_validated_token.assert_called_once_with("bad-token")
diff --git a/api/src/backend/api/tests/test_sse.py b/api/src/backend/api/tests/test_sse.py
new file mode 100644
index 0000000000..beba821e64
--- /dev/null
+++ b/api/src/backend/api/tests/test_sse.py
@@ -0,0 +1,191 @@
+"""Tests for the platform SSE infrastructure (``api.sse``).
+
+Cover the two security-critical platform pieces — the channel-name
+convention (:mod:`api.sse.utils`) and the tenant gate enforced by
+:class:`api.sse.channelmanager.SSEChannelManager`. The SSE authentication
+class lives in :mod:`api.authentication` with the rest of the auth stack,
+so its tests live in ``test_authentication.py``. Per-feature SSE endpoints
+add their own tests on top of these.
+"""
+
+import uuid
+from unittest.mock import MagicMock
+
+import pytest
+from django.http import StreamingHttpResponse
+from rest_framework.test import APIRequestFactory, force_authenticate
+
+from api.sse.base_views import BaseSSEViewSet
+from api.sse.channelmanager import SSEChannelManager
+from api.sse.utils import make_channel_name, tenant_id_from_channel
+
+
+class TestMakeChannel:
+    def test_round_trips_tenant_id(self):
+        tenant_id = uuid.uuid4()
+        channel = make_channel_name("lighthouse-session", tenant_id, uuid.uuid4())
+        assert tenant_id_from_channel(channel) == tenant_id
+
+    def test_accepts_str_arguments(self):
+        tenant_id = uuid.uuid4()
+        channel = make_channel_name("lighthouse-session", str(tenant_id), "resource-1")
+        assert channel == f"lighthouse-session:{tenant_id}:resource-1"
+
+    def test_prefix_with_hyphen_is_not_split(self):
+        # Prefixes contain hyphens but never colons, so the tenant id is
+        # always the second colon-separated segment.
+        tenant_id = uuid.uuid4()
+        channel = make_channel_name("a-long-hyphenated-prefix", tenant_id, "res")
+        assert tenant_id_from_channel(channel) == tenant_id
+
+    @pytest.mark.parametrize(
+        "prefix, tenant_id, resource_id",
+        [
+            ("evil:prefix", uuid.uuid4(), "res"),
+            ("prefix", uuid.uuid4(), "res:extra"),
+            ("prefix", "tenant:smuggled", "res"),
+        ],
+    )
+    def test_rejects_separator_injection(self, prefix, tenant_id, resource_id):
+        # A colon in any segment would let a crafted name smuggle extra
+        # segments past the parser, so construction must fail loudly.
+        with pytest.raises(ValueError):
+            make_channel_name(prefix, tenant_id, resource_id)
+
+
+class TestTenantIdFromChannel:
+    def test_returns_none_for_too_few_segments(self):
+        assert tenant_id_from_channel("prefix:only") is None
+        assert tenant_id_from_channel("garbage") is None
+
+    def test_returns_none_for_too_many_segments(self):
+        # A valid tenant UUID in position 1 must not authorize a
+        # non-canonical name that carries extra segments.
+        tenant_id = uuid.uuid4()
+        assert tenant_id_from_channel(f"prefix:{tenant_id}:resource:extra") is None
+
+    def test_returns_none_for_non_uuid_tenant_segment(self):
+        assert tenant_id_from_channel("prefix:not-a-uuid:resource") is None
+
+    def test_parses_valid_channel(self):
+        tenant_id = uuid.uuid4()
+        assert tenant_id_from_channel(f"prefix:{tenant_id}:resource") == tenant_id
+
+
+@pytest.mark.django_db
+class TestSSEChannelManager:
+    def test_member_can_read_own_tenant_channel(
+        self, create_test_user, tenants_fixture
+    ):
+        tenant = tenants_fixture[0]
+        channel = make_channel_name("lighthouse-session", tenant.id, uuid.uuid4())
+        assert SSEChannelManager().can_read_channel(create_test_user, channel)
+
+    def test_non_member_cannot_read_other_tenant_channel(
+        self, create_test_user, tenants_fixture
+    ):
+        # create_test_user is a member of tenant1 and tenant2 but not tenant3.
+        foreign_tenant = tenants_fixture[2]
+        channel = make_channel_name(
+            "lighthouse-session", foreign_tenant.id, uuid.uuid4()
+        )
+        assert not SSEChannelManager().can_read_channel(create_test_user, channel)
+
+    def test_anonymous_user_is_rejected(self, tenants_fixture):
+        channel = make_channel_name(
+            "lighthouse-session", tenants_fixture[0].id, uuid.uuid4()
+        )
+        assert not SSEChannelManager().can_read_channel(None, channel)
+
+        anon = MagicMock(is_authenticated=False)
+        assert not SSEChannelManager().can_read_channel(anon, channel)
+
+    def test_malformed_channel_is_rejected(self, create_test_user, tenants_fixture):
+        assert not SSEChannelManager().can_read_channel(create_test_user, "garbage")
+
+    def test_get_channels_for_request_returns_active_tenant_channels(self):
+        tenant_id = uuid.uuid4()
+        own = make_channel_name("prefix", tenant_id, "resource")
+        request = MagicMock()
+        request.tenant_id = str(tenant_id)
+        request.sse_channels = {own}
+        assert SSEChannelManager().get_channels_for_request(request, {}) == {own}
+
+    def test_get_channels_for_request_drops_other_tenant_channels(self):
+        # Fail-closed: a channel for a tenant other than the active JWT
+        # tenant is dropped before reaching django-eventstream, even if the
+        # viewset mistakenly stashed it. This is the primary tenant gate that
+        # binds authorization to request.tenant_id, not just membership.
+        active_tenant = uuid.uuid4()
+        own = make_channel_name("prefix", active_tenant, "resource")
+        foreign = make_channel_name("prefix", uuid.uuid4(), "resource")
+        request = MagicMock()
+        request.tenant_id = str(active_tenant)
+        request.sse_channels = {own, foreign}
+        assert SSEChannelManager().get_channels_for_request(request, {}) == {own}
+
+    def test_get_channels_for_request_drops_malformed_channels(self):
+        request = MagicMock()
+        request.tenant_id = str(uuid.uuid4())
+        request.sse_channels = {"garbage", "prefix:not-a-uuid:resource"}
+        assert SSEChannelManager().get_channels_for_request(request, {}) == set()
+
+    def test_get_channels_for_request_without_tenant_returns_empty(self):
+        # No active tenant on the request (auth/RLS never ran) → fail closed,
+        # regardless of any channels stashed on it.
+        request = MagicMock(spec=[])
+        assert SSEChannelManager().get_channels_for_request(request, {}) == set()
+
+    def test_get_channels_for_request_defaults_to_empty(self):
+        # A request that never went through BaseSSEViewSet.list has no
+        # sse_channels attribute; the manager must not raise.
+        request = object()
+        assert SSEChannelManager().get_channels_for_request(request, {}) == set()
+
+    def test_channel_is_not_reliable(self):
+        # v1 ships without server-side replay storage.
+        assert (
+            SSEChannelManager().is_channel_reliable("prefix:tenant:resource") is False
+        )
+
+
+@pytest.mark.django_db
+class TestBaseSSEViewSet:
+    """End-to-end check that the base viewset opens a stream.
+
+    ``BaseSSEViewSet.list`` hands the DRF ``Request`` straight to
+    django-eventstream's ``events()``, which is written for a plain
+    Django request. This drives a real request through the full DRF
+    stack (authentication, RLS, content negotiation, channel manager)
+    and asserts the result is an SSE stream, so the DRF/Django request
+    mismatch cannot regress silently.
+    """
+
+    def test_list_opens_event_stream(self, create_test_user, tenants_fixture):
+        tenant = tenants_fixture[0]
+        channel = make_channel_name("test-sse", tenant.id, uuid.uuid4())
+        seen_tenant_ids = []
+
+        class _StreamingSSEViewSet(BaseSSEViewSet):
+            def get_channels(self):
+                # Reached only after dispatch/initial ran, so the RLS
+                # tenant context is already on the request.
+                seen_tenant_ids.append(self.request.tenant_id)
+                return {channel}
+
+        request = APIRequestFactory().get("/api/v1/test-sse/stream")
+        force_authenticate(
+            request, user=create_test_user, token={"tenant_id": str(tenant.id)}
+        )
+
+        view = _StreamingSSEViewSet.as_view({"get": "list"})
+        response = view(request)
+
+        # A StreamingHttpResponse (not the plain HttpResponse used for SSE
+        # error envelopes) means events() accepted the DRF request, the
+        # channel manager handed it a non-empty channel set, and the
+        # stream was opened end to end.
+        assert isinstance(response, StreamingHttpResponse)
+        assert response.status_code == 200
+        assert response["Content-Type"] == "text/event-stream"
+        assert seen_tenant_ids == [str(tenant.id)]
diff --git a/api/src/backend/config/django/base.py b/api/src/backend/config/django/base.py
index 38cf047ac2..3308561b48 100644
--- a/api/src/backend/config/django/base.py
+++ b/api/src/backend/config/django/base.py
@@ -3,6 +3,7 @@ from datetime import timedelta
 from config.custom_logging import LOGGING  # noqa
 from config.env import BASE_DIR, env  # noqa
 from config.settings.celery import *  # noqa
+from config.settings.eventstream import *  # noqa
 from config.settings.partitions import *  # noqa
 from config.settings.sentry import *  # noqa
 from config.settings.social_login import *  # noqa
@@ -44,6 +45,7 @@ INSTALLED_APPS = [
     "dj_rest_auth.registration",
     "rest_framework.authtoken",
     "drf_simple_apikey",
+    "django_eventstream",
 ]
 
 MIDDLEWARE = [
@@ -136,6 +138,7 @@ SPECTACULAR_SETTINGS = {
 }
 
 WSGI_APPLICATION = "config.wsgi.application"
+ASGI_APPLICATION = "config.asgi.application"
 
 DJANGO_GUID = {
     "GUID_HEADER_NAME": "Transaction-ID",
diff --git a/api/src/backend/config/guniconf.py b/api/src/backend/config/guniconf.py
index a16c8de9a0..6f07913e81 100644
--- a/api/src/backend/config/guniconf.py
+++ b/api/src/backend/config/guniconf.py
@@ -25,6 +25,15 @@ bind = f"{BIND_ADDRESS}:{PORT}"
 workers = env.int("DJANGO_WORKERS", default=multiprocessing.cpu_count() * 2 + 1)
 reload = DEBUG
 
+# Native ASGI worker (gunicorn 24+). Required so SSE endpoints can keep the
+# event loop alive while waiting for events.
+worker_class = env("DJANGO_WORKER_CLASS", default="asgi")
+
+# Preload the application before forking workers in production: the app is
+# imported once in the master and workers fork from it. In development, disable
+# preload so the server restarts on code changes.
+preload_app = not DEBUG
+
 # Logging
 logconfig_dict = DJANGO_LOGGERS
 gunicorn_logger = logging.getLogger(BackendLogger.GUNICORN)
diff --git a/api/src/backend/config/settings/eventstream.py b/api/src/backend/config/settings/eventstream.py
new file mode 100644
index 0000000000..470062050b
--- /dev/null
+++ b/api/src/backend/config/settings/eventstream.py
@@ -0,0 +1,41 @@
+"""Server-Sent Events (SSE) configuration.
+
+Wires django-eventstream into the platform: Valkey Pub/Sub backend on a
+dedicated DB (separate from the Celery broker), the platform channel
+manager, and headers that match the existing CORS allowlist.
+"""
+
+from config.env import env
+from config.settings.celery import (
+    VALKEY_HOST,
+    VALKEY_PASSWORD,
+    VALKEY_PORT,
+    VALKEY_SCHEME,
+    VALKEY_USERNAME,
+)
+
+# Dedicated Valkey DB for the SSE Pub/Sub bus. Kept distinct from the
+# Celery broker DB so a noisy broker can't shoulder out streaming
+# traffic on the same keyspace.
+EVENTSTREAM_VALKEY_DB = env.int("EVENTSTREAM_VALKEY_DB", default=2)
+
+EVENTSTREAM_REDIS: dict = {
+    "host": VALKEY_HOST,
+    "port": int(VALKEY_PORT),
+    "db": EVENTSTREAM_VALKEY_DB,
+}
+if VALKEY_PASSWORD:
+    EVENTSTREAM_REDIS["password"] = VALKEY_PASSWORD
+if VALKEY_USERNAME:
+    EVENTSTREAM_REDIS["username"] = VALKEY_USERNAME
+if VALKEY_SCHEME == "rediss":
+    EVENTSTREAM_REDIS["ssl"] = True
+
+# Platform channel manager — performs the per-feature authorization and
+# rewrites the placeholder channel from the URL into the canonical
+# tenant-scoped channel name. See ``api.sse.channelmanager``.
+EVENTSTREAM_CHANNELMANAGER_CLASS = "api.sse.channelmanager.SSEChannelManager"
+
+# Headers a browser EventSource may legitimately send. Keep tight; the
+# stream itself reads no body, so no permissive defaults.
+EVENTSTREAM_ALLOW_HEADERS = "Cache-Control, Last-Event-ID"
diff --git a/api/uv.lock b/api/uv.lock
index 921cc70390..8673b8873b 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -146,6 +146,7 @@ constraints = [
     { name = "django-celery-results", specifier = "==2.6.0" },
     { name = "django-cors-headers", specifier = "==4.4.0" },
     { name = "django-environ", specifier = "==0.11.2" },
+    { name = "django-eventstream", specifier = "==5.3.3" },
     { name = "django-filter", specifier = "==24.3" },
     { name = "django-guid", specifier = "==3.5.0" },
     { name = "django-postgres-extra", specifier = "==2.0.9" },
@@ -190,7 +191,7 @@ constraints = [
     { name = "grpc-google-iam-v1", specifier = "==0.14.3" },
     { name = "grpcio", specifier = "==1.76.0" },
     { name = "grpcio-status", specifier = "==1.76.0" },
-    { name = "gunicorn", specifier = "==23.0.0" },
+    { name = "gunicorn", specifier = "==26.0.0" },
     { name = "h11", specifier = "==0.16.0" },
     { name = "h2", specifier = "==4.3.0" },
     { name = "hpack", specifier = "==4.1.0" },
@@ -2356,6 +2357,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c4/f1/468b49cccba3b42dda571063a14c668bb0b53a1d5712426d18e36663bd53/django_environ-0.11.2-py2.py3-none-any.whl", hash = "sha256:0ff95ab4344bfeff693836aa978e6840abef2e2f1145adff7735892711590c05", size = 19141, upload-time = "2023-09-01T21:02:59.88Z" },
 ]
 
+[[package]]
+name = "django-eventstream"
+version = "5.3.3"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+    { name = "django-grip" },
+    { name = "gripcontrol" },
+    { name = "pyjwt", extra = ["crypto"] },
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/f2/49/ec6cbc24f3f30465370df7096cfea9722bad2b0c1f35a7ff5d45fb96cff6/django_eventstream-5.3.3.tar.gz", hash = "sha256:6880b03298eebf18c1b736b972fb862eaf631dfbb79f8b27496418a3495d08dc", size = 47622, upload-time = "2025-10-23T00:22:40.291Z" }
+
 [[package]]
 name = "django-filter"
 version = "24.3"
@@ -2368,6 +2382,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/09/b1/92f1c30b47c1ebf510c35a2ccad9448f73437e5891bbd2b4febe357cc3de/django_filter-24.3-py3-none-any.whl", hash = "sha256:c4852822928ce17fb699bcfccd644b3574f1a2d80aeb2b4ff4f16b02dd49dc64", size = 95011, upload-time = "2024-08-02T13:27:55.616Z" },
 ]
 
+[[package]]
+name = "django-grip"
+version = "3.5.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "django" },
+    { name = "gripcontrol" },
+    { name = "pubcontrol" },
+    { name = "six" },
+    { name = "werkzeug" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/cb/d0/2c7b04fa864073cd8cb324f8674672162282d97540d56732cbd3a9ae5bca/django-grip-3.5.2.tar.gz", hash = "sha256:1ee1601492cd110256bd03e4a68797a9fbefa27c15f5a838bf245df97db0450c", size = 7626, upload-time = "2025-03-24T18:53:58.677Z" }
+
 [[package]]
 name = "django-guid"
 version = "3.5.0"
@@ -2979,6 +3006,17 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/c8/ab/717c58343cf02c5265b531384b248787e04d8160b8afe53d9eec053d7b44/greenlet-3.3.1-cp312-cp312-win_arm64.whl", hash = "sha256:bfb2d1763d777de5ee495c85309460f6fd8146e50ec9d0ae0183dbf6f0a829d1", size = 226403, upload-time = "2026-01-23T15:31:39.372Z" },
 ]
 
+[[package]]
+name = "gripcontrol"
+version = "4.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pubcontrol" },
+    { name = "pyjwt", extra = ["crypto"] },
+    { name = "six" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/4f/51/1cbf88384fbe97a1454fb0adddcdca8cb90ceb99c3250274c334db844f4f/gripcontrol-4.4.0.tar.gz", hash = "sha256:44ee6fe244a02870aa4e5bc810138ccaf5070dce5eb149b8ee9e27b960a95c2d", size = 12526, upload-time = "2026-05-14T21:19:28.49Z" }
+
 [[package]]
 name = "grpc-google-iam-v1"
 version = "0.14.3"
@@ -3040,14 +3078,14 @@ wheels = [
 
 [[package]]
 name = "gunicorn"
-version = "23.0.0"
+version = "26.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "packaging" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/34/72/9614c465dc206155d93eff0ca20d42e1e35afc533971379482de953521a4/gunicorn-23.0.0.tar.gz", hash = "sha256:f014447a0101dc57e294f6c18ca6b40227a4c90e9bdb586042628030cba004ec", size = 375031, upload-time = "2024-08-10T20:25:27.378Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6d/b7/a4a3f632f823e432ce6bc65f62961b7980c898c77f075a2f7118cb3846fe/gunicorn-26.0.0.tar.gz", hash = "sha256:ca9346f85e3a4aeeb64d491045c16b9a35647abd37ea15efe53080eb8b090baf", size = 727286, upload-time = "2026-05-05T06:38:25.529Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/cb/7d/6dac2a6e1eba33ee43f318edbed4ff29151a49b5d37f080aad1e6469bca4/gunicorn-23.0.0-py3-none-any.whl", hash = "sha256:ec400d38950de4dfd418cff8328b2c8faed0edb0d517d3394e457c317908ca4d", size = 85029, upload-time = "2024-08-10T20:25:24.996Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/40/9c2384fc2be4ad25dd4a49decd5ad9ea5a3639814c11bd40ab77cb9f0a14/gunicorn-26.0.0-py3-none-any.whl", hash = "sha256:40233d26a5f0d1872916188c276e21641155111c2853f0c2cd55260aec0d24fc", size = 212009, upload-time = "2026-05-05T06:38:23.007Z" },
 ]
 
 [[package]]
@@ -4510,6 +4548,7 @@ dependencies = [
     { name = "django-celery-results" },
     { name = "django-cors-headers" },
     { name = "django-environ" },
+    { name = "django-eventstream" },
     { name = "django-filter" },
     { name = "django-guid" },
     { name = "django-postgres-extra" },
@@ -4574,6 +4613,7 @@ requires-dist = [
     { name = "django-celery-results", specifier = "==2.6.0" },
     { name = "django-cors-headers", specifier = "==4.4.0" },
     { name = "django-environ", specifier = "==0.11.2" },
+    { name = "django-eventstream", specifier = "==5.3.3" },
     { name = "django-filter", specifier = "==24.3" },
     { name = "django-guid", specifier = "==3.5.0" },
     { name = "django-postgres-extra", specifier = "==2.0.9" },
@@ -4586,7 +4626,7 @@ requires-dist = [
     { name = "drf-spectacular-jsonapi", specifier = "==0.5.1" },
     { name = "fonttools", specifier = "==4.62.1" },
     { name = "gevent", specifier = "==25.9.1" },
-    { name = "gunicorn", specifier = "==23.0.0" },
+    { name = "gunicorn", specifier = "==26.0.0" },
     { name = "h2", specifier = "==4.3.0" },
     { name = "lxml", specifier = "==6.1.0" },
     { name = "markdown", specifier = "==3.10.2" },
@@ -4674,6 +4714,16 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/7b/08/9c66c269b0d417a0af9fb969535f0371b8c538633535a7a6a5ca3f9231e2/psycopg2_binary-2.9.9-cp312-cp312-win_amd64.whl", hash = "sha256:81ff62668af011f9a48787564ab7eded4e9fb17a4a6a74af5ffa6a457400d2ab", size = 1163864, upload-time = "2023-10-28T09:37:28.155Z" },
 ]
 
+[[package]]
+name = "pubcontrol"
+version = "3.5.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pyjwt", extra = ["crypto"] },
+    { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/25/6a/02202a247214a6ffd5148ab1b16aca1c334b40dca211bca0442c8b7c7447/pubcontrol-3.5.0.tar.gz", hash = "sha256:a5ec6b3f53edfd005675518e5e4cc23b34122776835ae7c6dbd1db173d1ff0cb", size = 18199, upload-time = "2023-07-05T19:11:40.477Z" }
+
 [[package]]
 name = "py-deviceid"
 version = "0.1.1"
diff --git a/docs/developer-guide/server-sent-events.mdx b/docs/developer-guide/server-sent-events.mdx
new file mode 100644
index 0000000000..c91f27227f
--- /dev/null
+++ b/docs/developer-guide/server-sent-events.mdx
@@ -0,0 +1,241 @@
+---
+title: 'Server-Sent Events (SSE)'
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+<VersionBadge version="1.32.0" />
+
+This guide explains how to add a **Server-Sent Events (SSE)** endpoint to the Prowler API. SSE lets the backend push a one-way stream of events to a client over a single long-lived HTTP connection — ideal for live progress, token-by-token LLM output, or any "the server has news for you" use case where the client should not poll.
+
+<Info>
+The platform ships the SSE **infrastructure** (`api.sse`) and wiring. No feature endpoint streams over SSE out of the box — this guide shows how to build one on top of the shared base.
+</Info>
+
+## When to use SSE
+
+| Need | Use |
+|------|-----|
+| Server pushes incremental updates, client only reads | **SSE** |
+| Bidirectional, low-latency messaging (chat both ways, games) | WebSocket |
+| Client asks, server answers once | Plain REST |
+
+SSE is the right tool when the **client only consumes**: scan progress, long-running job checkpoints, streamed LLM tokens, cross-client resource-sync notifications. It rides on plain HTTP, reconnects automatically in the browser via the native [`EventSource`](https://developer.mozilla.org/en-US/docs/Web/API/EventSource) API, and needs no extra protocol.
+
+## How it works
+
+SSE is wired through [`django-eventstream`](https://github.com/fanout/django_eventstream) and a small platform layer in `api/src/backend/api/sse/`:
+
+| Piece | File | Responsibility |
+|-------|------|----------------|
+| `BaseSSEViewSet` | `api/sse/base_views.py` | Base DRF viewset a feature subclasses. The feature implements `get_channels`; the base handles auth, the tenant transaction, and delegates streaming to `django-eventstream`. |
+| `SSEChannelManager` | `api/sse/channelmanager.py` | Registered in `settings.EVENTSTREAM_CHANNELMANAGER_CLASS`. Reads the channel set off the request and enforces the platform-wide tenant gate. |
+| `SSEAuthentication` | `api/authentication.py` | Same JWT/API-key stack as the rest of the API, plus an `?access_token=<jwt>` fallback for browser `EventSource` clients. Lives with the other authentication classes, not in the `sse` package. |
+| `make_channel_name` / `tenant_id_from_channel` | `api/sse/utils.py` | Single source of truth for the channel-name format, so publishers and the channel manager agree byte-for-byte. |
+| Settings | `config/settings/eventstream.py` | Valkey Pub/Sub backend (dedicated DB), channel manager, allowed headers. |
+
+### Transport: the server runs on ASGI
+
+SSE connections are long-lived. Holding one open per synchronous worker would exhaust the worker pool, so the API runs under Gunicorn's native **`asgi` worker** (`config.asgi:application`). Streams are parked on the event loop while ordinary CRUD endpoints keep their synchronous execution (Django runs sync views in a thread-sensitive executor under ASGI). This is configured in `config/guniconf.py` and used by both the dev and production entrypoints — no separate server process is needed.
+
+### The data flow
+
+```
+publisher (Celery task / view)             subscriber (browser, CLI)
+        │                                          │
+        │  send_event(channel, "scan.progress", …) │  GET …/event-stream
+        ▼                                          ▼
+   Valkey Pub/Sub  ◄────────────────────►  BaseSSEViewSet.list
+   (EVENTSTREAM_VALKEY_DB)                  → get_channels() (RLS-scoped)
+                                            → SSEChannelManager (tenant gate)
+                                            → StreamingHttpResponse (text/event-stream)
+```
+
+A publisher anywhere in the system (most often a Celery task) calls `send_event(channel, event_type, payload)`. `django-eventstream` fans it out over Valkey Pub/Sub to every connection subscribed to that channel.
+
+## Adding an SSE endpoint to your feature
+
+The example below streams progress for a long-running **scan**. Adapt the resource, prefix, and event names to your feature.
+
+<Steps>
+
+<Step title="Pick a channel prefix">
+
+Channels follow the format `<prefix>:<tenant_id>:<resource_id>`, built only through `make_channel_name`. The prefix is owned by your feature and may contain hyphens but **never colons** (the parser splits on `:`).
+
+```python
+CHANNEL_PREFIX = "scan-progress"
+```
+
+The tenant id is baked into every channel name. That is what lets the platform enforce cross-tenant isolation without knowing anything about your feature.
+
+</Step>
+
+<Step title="Subclass BaseSSEViewSet">
+
+Create the viewset for the SSE sub-resource. The only required method is `get_channels`; it runs inside the tenant transaction set up by the base class, so any database lookup inside it is automatically RLS-scoped.
+
+```python
+# scans/event_streams.py
+from api.sse import BaseSSEViewSet, make_channel_name
+from django.shortcuts import get_object_or_404
+from scans.models import Scan
+
+CHANNEL_PREFIX = "scan-progress"
+
+
+class ScanEventStreamViewSet(BaseSSEViewSet):
+    def get_queryset(self):
+        # RLS already scopes to the tenant; narrow further as needed
+        # (e.g. only scans the requesting user may see).
+        return Scan.objects.filter(tenant_id=self.request.tenant_id)
+
+    def get_channels(self) -> set[str]:
+        scan = get_object_or_404(self.get_queryset(), pk=self.kwargs["scan_pk"])
+        return {make_channel_name(CHANNEL_PREFIX, scan.tenant_id, scan.id)}
+```
+
+<Warning>
+`get_channels` **must raise** the relevant DRF exception (`NotFound`, `PermissionDenied`, `NotAuthenticated`) when authorization fails — `get_object_or_404` does this for you. Returning an empty set surfaces as django-eventstream's confusing "No channels specified" error instead of the real cause.
+</Warning>
+
+</Step>
+
+<Step title="Wire the URL as a sub-resource">
+
+Mount the endpoint as an `event-stream` sub-resource. Keep it **outside the DRF router**, which would force the URL into a list/detail convention. Route the `get` method to the viewset's `list` action.
+
+```python
+# scans/urls.py
+path(
+    "scans/<uuid:scan_pk>/event-stream",
+    ScanEventStreamViewSet.as_view({"get": "list"}),
+    name="scan-event-stream",
+),
+```
+
+</Step>
+
+<Step title="Define your event vocabulary">
+
+A feature owns its event types in `<app>/<domain>/events.py`: one `publish_<event>` function per event type, each body a **single** `send_event` call so the wire-level string lives in exactly one place.
+
+```python
+# scans/events.py
+from django_eventstream import send_event
+
+
+def publish_progress(channel: str, checked: int, total: int) -> None:
+    send_event(channel, "scan.progress", {"checked": checked, "total": total})
+
+
+def publish_end(channel: str, scan_id: str) -> None:
+    # Terminal event carries the canonical id so reconnecting clients
+    # can refetch the persisted resource over REST.
+    send_event(channel, "scan.end", {"scan_id": scan_id})
+
+
+def publish_error(channel: str, code: str, detail: str) -> None:
+    send_event(channel, "scan.error", {"code": code, "detail": detail})
+```
+
+There is no platform-side enum, registry, or dispatch table — **the naming convention is the contract** (see below).
+
+</Step>
+
+<Step title="Publish from the producer">
+
+Wherever the work happens — usually a Celery task — build the channel the same way and publish:
+
+```python
+from api.sse import make_channel_name
+from scans.events import publish_progress, publish_end
+
+channel = make_channel_name("scan-progress", scan.tenant_id, scan.id)
+publish_progress(channel, checked=42, total=100)
+...
+publish_end(channel, scan_id=str(scan.id))
+```
+
+</Step>
+
+</Steps>
+
+## Event naming convention
+
+Every event uses an event type of the form **`<resource>.<verb>`** (lowercased, dot-separated). The verb comes from this platform-wide vocabulary — if you need a verb that is not listed, document the addition in this guide so the catalog stays discoverable.
+
+| Verb | When to use |
+|------|-------------|
+| `delta` | An incremental piece of a stream the client concatenates (LLM text tokens, audio chunks). Standard term across OpenAI / Anthropic / LiteLLM / Vercel AI SDK. |
+| `start` | Begin marker for a compound operation (e.g. a tool call whose execution will be reported by a matching `end`). |
+| `end` | Terminal marker. Carries the canonical resource id so reconnecting clients can refetch persisted state via REST. |
+| `progress` | Periodic checkpoint with quantifiable completion, e.g. `{"checked": 42, "total": 100}`. |
+| `created` / `updated` / `deleted` | Resource-lifecycle events for cross-client sync streams. |
+| `error` | Terminal failure. Carries a stable `code` for client switching and a human-readable `detail`. |
+
+<Note>
+Payloads are **flat JSON**. The wire-level `event:` field already names the event type, so do **not** wrap the payload in `{"type": ..., "data": ...}`. Include the canonical resource UUID on terminal events so reconnecting clients can reconcile via REST.
+</Note>
+
+## Authentication
+
+SSE endpoints use the same authentication stack as the rest of the API. Non-browser clients (CLI, programmatic) send the standard `Authorization` header — JWT or API key.
+
+Browser `EventSource` is the only widely available SSE client API and it **cannot set custom headers**. For that case only, the endpoint accepts a JWT via the `?access_token=<jwt>` query parameter. The header always wins when present — a header is intentional, while a query parameter can leak into referers and logs, so it is consulted only as a fallback.
+
+```javascript
+// Browser
+const es = new EventSource(
+  `/api/v1/scans/${scanId}/event-stream?access_token=${jwt}`
+);
+```
+
+```bash
+# CLI / programmatic — header, exactly like every other endpoint
+curl -N -H "Authorization: Bearer $JWT" \
+  https://<host>/api/v1/scans/$SCAN_ID/event-stream
+```
+
+## Tenant isolation & security model
+
+Authorization is enforced at two layers:
+
+1. **At connect**, `get_channels` runs under the regular DRF stack inside the tenant transaction (`rls_transaction`). Resource lookups are RLS-scoped, so a user cannot even resolve a channel for a resource they cannot see. Narrow the queryset further (e.g. `created_by=request.user`) when a resource is per-user within a tenant.
+2. **After connect**, `SSEChannelManager.can_read_channel` re-verifies tenant membership by parsing the tenant id embedded in the channel name. Cross-tenant subscription is rejected even if a URL-level check ever has a bug. A malformed channel name is treated as "not authorized".
+
+Because the tenant id lives inside the channel name, this gate works for any feature without the platform knowing anything about it.
+
+## Reconnect & state recovery
+
+The platform deliberately ships **without server-side replay** (`is_channel_reliable` returns `False`). When a client reconnects, it does **not** receive missed events. Instead:
+
+- Terminal events (`*.end`) carry the canonical resource **UUID**.
+- On reconnect, the client refetches the authoritative state from the normal REST endpoint using that id.
+
+Design your event payloads accordingly: deltas are ephemeral and concatenated in-flight; the durable truth always lives behind a REST resource.
+
+## Local development
+
+- The dev and production entrypoints both launch Gunicorn with the `asgi` worker (`config.asgi:application`). In dev, `DJANGO_DEBUG=True` enables hot reload; `preload_app` is automatically disabled under debug so edited code is picked up.
+- SSE uses a **dedicated Valkey database** (`EVENTSTREAM_VALKEY_DB`, default `2`) kept separate from the Celery broker so a noisy broker cannot crowd out streaming traffic. It reuses the same `VALKEY_*` connection settings as the rest of the platform.
+
+| Env var | Default | Purpose |
+|---------|---------|---------|
+| `EVENTSTREAM_VALKEY_DB` | `2` | Valkey DB index for the SSE Pub/Sub bus |
+| `DJANGO_WORKER_CLASS` | `asgi` | Gunicorn worker class |
+
+Test the stream end to end with `curl -N` (disable buffering) and an auth header:
+
+```bash
+curl -N -H "Authorization: Bearer $JWT" \
+  http://localhost:8080/api/v1/scans/$SCAN_ID/event-stream
+```
+
+## Testing
+
+The platform basis is covered by `api/tests/test_sse.py` (channel parsing, the tenant gate, and auth precedence). For a feature endpoint, test:
+
+- `get_channels` returns the expected channel for an authorized resource and raises `NotFound`/`PermissionDenied` otherwise.
+- Each `publish_<event>` helper emits the correct event type and flat payload (mock `send_event`).
+- The producer builds the channel with `make_channel_name` using the resource's own `tenant_id`.
diff --git a/docs/docs.json b/docs/docs.json
index e31575878e..51c7e739b0 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -395,7 +395,8 @@
               "developer-guide/lighthouse-architecture",
               "developer-guide/mcp-server",
               "developer-guide/ai-skills",
-              "developer-guide/prowler-studio"
+              "developer-guide/prowler-studio",
+              "developer-guide/server-sent-events"
             ]
           },
           {

From 94ce76d679852a2b22b96d951be4ebddc150e1c5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Tue, 16 Jun 2026 10:31:58 +0200
Subject: [PATCH 048/126] ci: authenticate GitHub API curl in setup-python-uv
 action (#11610)

---
 .github/actions/setup-python-uv/action.yml | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/.github/actions/setup-python-uv/action.yml b/.github/actions/setup-python-uv/action.yml
index e23388d86e..14b9b81d15 100644
--- a/.github/actions/setup-python-uv/action.yml
+++ b/.github/actions/setup-python-uv/action.yml
@@ -43,8 +43,17 @@ runs:
       if: github.repository_owner == 'prowler-cloud' && github.repository != 'prowler-cloud/prowler'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha')
+        LATEST_COMMIT=$(curl -sf \
+          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+          -H "Accept: application/vnd.github+json" \
+          "https://api.github.com/repos/prowler-cloud/prowler/commits/master" \
+          | jq -er '.sha') || {
+          echo "::error::Failed to fetch latest prowler/master commit from the GitHub API (HTTP error or missing .sha). Check the GITHUB_TOKEN and API rate limits."
+          exit 1
+        }
         echo "Latest commit hash: $LATEST_COMMIT"
         sed -i "s|\(git = \"https://github\.com/prowler-cloud/prowler\.git?rev=master\)#[a-f0-9]\{40\}\"|\1#${LATEST_COMMIT}\"|g" uv.lock
         echo "Updated uv.lock entry:"
@@ -54,8 +63,17 @@ runs:
       if: github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'prowler-cloud/prowler'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha')
+        LATEST_COMMIT=$(curl -sf \
+          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
+          -H "Accept: application/vnd.github+json" \
+          "https://api.github.com/repos/prowler-cloud/prowler/commits/master" \
+          | jq -er '.sha') || {
+          echo "::error::Failed to fetch latest prowler/master commit from the GitHub API (HTTP error or missing .sha). Check the GITHUB_TOKEN and API rate limits."
+          exit 1
+        }
         echo "Latest commit hash: $LATEST_COMMIT"
         sed -i "s|\(git = \"https://github\.com/prowler-cloud/prowler\.git?rev=master\)#[a-f0-9]\{40\}\"|\1#${LATEST_COMMIT}\"|g" uv.lock
         echo "Updated uv.lock entry:"

From e419771b04faf81baa3ae20d9ee79bdc366e1da0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Tue, 16 Jun 2026 10:48:55 +0200
Subject: [PATCH 049/126] perf(api): optimize scan-compliance-overviews task
 (#11591)

---
 api/CHANGELOG.md                         |   8 +
 api/src/backend/tasks/jobs/scan.py       | 298 ++++++++++++-----------
 api/src/backend/tasks/tests/test_scan.py | 247 +++++++++++++------
 3 files changed, 342 insertions(+), 211 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index afd8b4b071..b2084c1969 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -16,6 +16,14 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ---
 
+## [1.31.2] (Prowler UNRELEASED)
+
+### 🔄 Changed
+
+- `scan-compliance-overviews` task now streams the findings aggregation and the requirement-row writes (reading the denormalized `resource_regions` instead of prefetching resources, and batching rows into COPY instead of building the full list first), so it runs faster and its peak memory no longer grows with the number of regions and frameworks — a previous worker OOM risk on large scans — with no change to the compliance overview output [(#11591)](https://github.com/prowler-cloud/prowler/pull/11591)
+
+---
+
 ## [1.31.1] (Prowler v5.30.1)
 
 ### 🐞 Fixed
diff --git a/api/src/backend/tasks/jobs/scan.py b/api/src/backend/tasks/jobs/scan.py
index ded3ee57dc..f6ae3e6402 100644
--- a/api/src/backend/tasks/jobs/scan.py
+++ b/api/src/backend/tasks/jobs/scan.py
@@ -5,6 +5,7 @@ import re
 import time
 import uuid
 from collections import defaultdict
+from collections.abc import Iterable
 from datetime import datetime, timezone
 from typing import Any
 
@@ -22,7 +23,6 @@ from django.db.models import (
     Max,
     Min,
     OuterRef,
-    Prefetch,
     Q,
     Sum,
     When,
@@ -357,68 +357,71 @@ def _copy_compliance_requirement_rows(
 
 
 def _persist_compliance_requirement_rows(
-    tenant_id: str, rows: list[dict[str, Any]], batch_size: int = 10000
-) -> None:
+    tenant_id: str, rows: Iterable[dict[str, Any]], batch_size: int = 10000
+) -> int:
     """Persist compliance requirement rows using batched COPY with ORM fallback.
 
-    Splits large row sets into batches to reduce lock duration and improve concurrency.
+    ``rows`` is consumed lazily in batches, so peak memory stays at ~``batch_size``
+    rows instead of the full set. A batch that fails COPY falls back to an ORM
+    ``bulk_create`` of just that batch.
 
     Args:
         tenant_id: Target tenant UUID.
-        rows: Precomputed row dictionaries that reflect the compliance
-            overview state for a scan.
+        rows: Iterable of row dictionaries reflecting the compliance overview
+            state for a scan.
         batch_size: Number of rows per COPY batch (default: 10000).
+
+    Returns:
+        int: total number of rows persisted.
     """
-    if not rows:
-        return
-
-    total_rows = len(rows)
-    total_batches = (total_rows + batch_size - 1) // batch_size
-
-    try:
-        # Process rows in batches to reduce lock duration
-        for batch_num in range(total_batches):
-            start_idx = batch_num * batch_size
-            end_idx = min(start_idx + batch_size, total_rows)
-            batch = rows[start_idx:end_idx]
+    total_rows = 0
+    batch_num = 0
 
+    for batch, _is_last in batched(rows, batch_size):
+        if not batch:
+            continue
+        batch_num += 1
+        try:
             _copy_compliance_requirement_rows(tenant_id, batch)
+        except Exception as error:
+            logger.exception(
+                f"COPY bulk insert for compliance requirements batch {batch_num} "
+                "failed; falling back to ORM bulk_create for this batch",
+                exc_info=error,
+            )
+            fallback_objects = [
+                ComplianceRequirementOverview(
+                    id=row["id"],
+                    tenant_id=row["tenant_id"],
+                    inserted_at=row["inserted_at"],
+                    compliance_id=row["compliance_id"],
+                    framework=row["framework"],
+                    version=row["version"],
+                    description=row["description"],
+                    region=row["region"],
+                    requirement_id=row["requirement_id"],
+                    requirement_status=row["requirement_status"],
+                    passed_checks=row["passed_checks"],
+                    failed_checks=row["failed_checks"],
+                    total_checks=row["total_checks"],
+                    passed_findings=row.get("passed_findings", 0),
+                    total_findings=row.get("total_findings", 0),
+                    scan_id=row["scan_id"],
+                )
+                for row in batch
+            ]
+            with rls_transaction(tenant_id):
+                ComplianceRequirementOverview.objects.bulk_create(
+                    fallback_objects, batch_size=500
+                )
 
-            logger.info(
-                f"Compliance COPY batch {batch_num + 1}/{total_batches}: "
-                f"inserted {len(batch)} rows ({start_idx + len(batch)}/{total_rows} total)"
-            )
-    except Exception as error:
-        logger.exception(
-            "COPY bulk insert for compliance requirements failed; falling back to ORM bulk_create",
-            exc_info=error,
+        total_rows += len(batch)
+        logger.info(
+            f"Compliance COPY batch {batch_num}: inserted {len(batch)} rows "
+            f"({total_rows} total)"
         )
-        # Fallback: use ORM bulk_create for all remaining rows
-        fallback_objects = [
-            ComplianceRequirementOverview(
-                id=row["id"],
-                tenant_id=row["tenant_id"],
-                inserted_at=row["inserted_at"],
-                compliance_id=row["compliance_id"],
-                framework=row["framework"],
-                version=row["version"],
-                description=row["description"],
-                region=row["region"],
-                requirement_id=row["requirement_id"],
-                requirement_status=row["requirement_status"],
-                passed_checks=row["passed_checks"],
-                failed_checks=row["failed_checks"],
-                total_checks=row["total_checks"],
-                passed_findings=row.get("passed_findings", 0),
-                total_findings=row.get("total_findings", 0),
-                scan_id=row["scan_id"],
-            )
-            for row in rows
-        ]
-        with rls_transaction(tenant_id):
-            ComplianceRequirementOverview.objects.bulk_create(
-                fallback_objects, batch_size=500
-            )
+
+    return total_rows
 
 
 def _create_compliance_summaries(
@@ -1445,9 +1448,13 @@ def _aggregate_findings_by_region(
     tenant_id: str, scan_id: str, modeled_threatscore_compliance_id: str
 ) -> tuple[dict, dict]:
     """
-    Aggregate findings by region using optimized ORM queries.
+    Aggregate findings by region using streaming, column-scoped ORM reads.
 
-    Replaces nested Python loops with efficient queries and aggregation.
+    Reads only the consumed columns as tuples via ``values_list`` and streams
+    them with ``.iterator()``, using the denormalized ``resource_regions`` array
+    instead of ``prefetch_related("resources")``. ``resource_regions`` mirrors the
+    regions of a finding's related resources, so it yields the same per-region
+    tally without joining the resource table.
 
     Args:
         tenant_id: Tenant UUID
@@ -1459,12 +1466,12 @@ def _aggregate_findings_by_region(
             - check_status_by_region: {region: {check_id: status}}
             - findings_count_by_compliance: {region: {normalized_id: {requirement_id: {total, pass}}}}
     """
-    check_status_by_region = {}
-    findings_count_by_compliance = {}
+    check_status_by_region: dict = {}
+    findings_count_by_compliance: dict = {}
+
+    normalized_id = re.sub(r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower())
 
     with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
-        # Fetch only PASS/FAIL findings (optimized query reduces data transfer)
-        # Other statuses are not needed for check_status or ThreatScore calculation
         findings = (
             Finding.all_objects.filter(
                 tenant_id=tenant_id,
@@ -1472,42 +1479,28 @@ def _aggregate_findings_by_region(
                 muted=False,
                 status__in=["PASS", "FAIL"],
             )
-            .only("id", "check_id", "status", "compliance")
-            .prefetch_related(
-                Prefetch(
-                    "resources",
-                    queryset=Resource.objects.only("id", "region"),
-                    to_attr="small_resources",
-                )
+            .values_list("check_id", "status", "resource_regions", "compliance")
+            .iterator(chunk_size=DJANGO_FINDINGS_BATCH_SIZE)
+        )
+
+        for check_id, status, resource_regions, compliance in findings:
+            threatscore_requirements = (compliance or {}).get(
+                modeled_threatscore_compliance_id
             )
-        )
 
-        # Process findings in a single pass (more efficient than original nested loops)
-        normalized_id = re.sub(
-            r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
-        )
-
-        for finding in findings:
-            status = finding.status
-
-            for resource in finding.small_resources:
-                region = resource.region
-
-                # Aggregate check status by region
-                current_status = check_status_by_region.setdefault(region, {})
+            for region in resource_regions or ():
                 # Priority: FAIL > any other status
-                if current_status.get(finding.check_id) != "FAIL":
-                    current_status[finding.check_id] = status
+                current_status = check_status_by_region.setdefault(region, {})
+                if current_status.get(check_id) != "FAIL":
+                    current_status[check_id] = status
 
                 # Aggregate ThreatScore compliance counts
-                if modeled_threatscore_compliance_id in (finding.compliance or {}):
+                if threatscore_requirements:
                     compliance_key = findings_count_by_compliance.setdefault(
                         region, {}
                     ).setdefault(normalized_id, {})
 
-                    for requirement_id in finding.compliance[
-                        modeled_threatscore_compliance_id
-                    ]:
+                    for requirement_id in threatscore_requirements:
                         requirement_stats = compliance_key.setdefault(
                             requirement_id, {"total": 0, "pass": 0}
                         )
@@ -1554,8 +1547,8 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                         (compliance_id, requirement_id)
                     )
 
-        compliance_requirement_rows: list[dict[str, Any]] = []
         regions = []
+        requirements_created = 0
         requirement_statuses = defaultdict(
             lambda: {"fail_count": 0, "pass_count": 0, "total_count": 0}
         )
@@ -1595,44 +1588,93 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                         else:
                             requirement_stats["failed_checks"] += 1
 
-            # Prepare compliance requirement rows and compute summaries in single pass
             utc_datetime_now = datetime.now(tz=timezone.utc)
-
-            # Pre-compute shared strings (optimization: reduces string conversions)
             tenant_id_str = str(tenant_id)
             scan_id_str = str(scan_instance.id)
 
-            for region in regions:
-                region_stats = region_requirement_stats.get(region, {})
-                for compliance_id, compliance in compliance_template.items():
-                    modeled_compliance_id = _normalized_compliance_key(
-                        compliance["framework"], compliance["version"]
+            # Per-framework constants that don't depend on the region.
+            compliance_plan = []
+            for compliance_id, compliance in compliance_template.items():
+                modeled_compliance_id = _normalized_compliance_key(
+                    compliance["framework"], compliance["version"]
+                )
+                framework = compliance["framework"]
+                version = compliance["version"] or ""
+                requirements = [
+                    (
+                        requirement_id,
+                        requirement.get("description") or "",
+                        len(requirement["checks"]),
                     )
-                    compliance_stats = region_stats.get(compliance_id, {})
-                    # Create an overview record for each requirement within each compliance framework
                     for requirement_id, requirement in compliance[
                         "requirements"
-                    ].items():
-                        stats = compliance_stats.get(requirement_id)
-                        passed_checks = stats["passed_checks"] if stats else 0
-                        failed_checks = stats["failed_checks"] if stats else 0
-                        total_checks = len(requirement["checks"])
-                        if total_checks == 0:
-                            requirement_status = "MANUAL"
-                        elif failed_checks > 0:
-                            requirement_status = "FAIL"
-                        else:
-                            requirement_status = "PASS"
+                    ].items()
+                ]
+                compliance_plan.append(
+                    (
+                        compliance_id,
+                        framework,
+                        version,
+                        modeled_compliance_id,
+                        requirements,
+                    )
+                )
 
-                        compliance_requirement_rows.append(
-                            {
+            # Yield rows lazily (consumed batch-by-batch by COPY) so peak memory
+            # stays bounded; tally requirement_statuses in the same pass.
+            def _iter_compliance_requirement_rows():
+                for region in regions:
+                    region_stats = region_requirement_stats.get(region, {})
+                    region_findings = findings_count_by_compliance.get(region, {})
+                    for (
+                        compliance_id,
+                        framework,
+                        version,
+                        modeled_compliance_id,
+                        requirements,
+                    ) in compliance_plan:
+                        compliance_stats = region_stats.get(compliance_id, {})
+                        compliance_findings = region_findings.get(
+                            modeled_compliance_id, {}
+                        )
+                        for requirement_id, description, total_checks in requirements:
+                            stats = compliance_stats.get(requirement_id)
+                            if stats:
+                                passed_checks = stats["passed_checks"]
+                                failed_checks = stats["failed_checks"]
+                            else:
+                                passed_checks = 0
+                                failed_checks = 0
+                            if total_checks == 0:
+                                requirement_status = "MANUAL"
+                            elif failed_checks > 0:
+                                requirement_status = "FAIL"
+                            else:
+                                requirement_status = "PASS"
+
+                            finding_counts = compliance_findings.get(requirement_id)
+                            if finding_counts:
+                                passed_findings = finding_counts.get("pass", 0)
+                                total_findings = finding_counts.get("total", 0)
+                            else:
+                                passed_findings = 0
+                                total_findings = 0
+
+                            key = (compliance_id, requirement_id)
+                            requirement_statuses[key]["total_count"] += 1
+                            if requirement_status == "FAIL":
+                                requirement_statuses[key]["fail_count"] += 1
+                            elif requirement_status == "PASS":
+                                requirement_statuses[key]["pass_count"] += 1
+
+                            yield {
                                 "id": uuid.uuid4(),
                                 "tenant_id": tenant_id_str,
                                 "inserted_at": utc_datetime_now,
                                 "compliance_id": compliance_id,
-                                "framework": compliance["framework"],
-                                "version": compliance["version"] or "",
-                                "description": requirement.get("description") or "",
+                                "framework": framework,
+                                "version": version,
+                                "description": description,
                                 "region": region,
                                 "requirement_id": requirement_id,
                                 "requirement_status": requirement_status,
@@ -1640,41 +1682,23 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                                 "failed_checks": failed_checks,
                                 "total_checks": total_checks,
                                 "scan_id": scan_id_str,
-                                "passed_findings": findings_count_by_compliance.get(
-                                    region, {}
-                                )
-                                .get(modeled_compliance_id, {})
-                                .get(requirement_id, {})
-                                .get("pass", 0),
-                                "total_findings": findings_count_by_compliance.get(
-                                    region, {}
-                                )
-                                .get(modeled_compliance_id, {})
-                                .get(requirement_id, {})
-                                .get("total", 0),
+                                "passed_findings": passed_findings,
+                                "total_findings": total_findings,
                             }
-                        )
 
-                        # Update summary tracking (single-pass optimization)
-                        key = (compliance_id, requirement_id)
-                        requirement_statuses[key]["total_count"] += 1
-                        if requirement_status == "FAIL":
-                            requirement_statuses[key]["fail_count"] += 1
-                        elif requirement_status == "PASS":
-                            requirement_statuses[key]["pass_count"] += 1
-
-            # Idempotent re-run: COPY can't ON CONFLICT, so clear this scan's rows first.
+            # Idempotent re-run: clear this scan's rows before re-inserting.
             with rls_transaction(tenant_id):
                 ComplianceRequirementOverview.objects.filter(scan_id=scan_id).delete()
 
-            # Bulk create requirement records using PostgreSQL COPY
-            _persist_compliance_requirement_rows(tenant_id, compliance_requirement_rows)
+            requirements_created = _persist_compliance_requirement_rows(
+                tenant_id, _iter_compliance_requirement_rows()
+            )
 
         # Create pre-aggregated summaries for fast compliance overview lookups
         _create_compliance_summaries(tenant_id, scan_id, requirement_statuses)
 
         return {
-            "requirements_created": len(compliance_requirement_rows),
+            "requirements_created": requirements_created,
             "regions_processed": list(regions),
             "compliance_frameworks": (
                 list(compliance_template.keys()) if regions else []
diff --git a/api/src/backend/tasks/tests/test_scan.py b/api/src/backend/tasks/tests/test_scan.py
index 6961659acf..130d8ae118 100644
--- a/api/src/backend/tasks/tests/test_scan.py
+++ b/api/src/backend/tasks/tests/test_scan.py
@@ -3674,19 +3674,19 @@ class TestAggregateFindingsByRegion:
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        # Mock findings with resources
-        mock_finding1 = MagicMock()
-        mock_finding1.check_id = "check1"
-        mock_finding1.status = "FAIL"
-        mock_finding1.compliance = {modeled_threatscore_compliance_id: ["req1", "req2"]}
-
-        mock_resource1 = MagicMock()
-        mock_resource1.region = "us-east-1"
-        mock_finding1.small_resources = [mock_resource1]
+        # (check_id, status, resource_regions, compliance) tuples
+        finding_rows = [
+            (
+                "check1",
+                "FAIL",
+                ["us-east-1"],
+                {modeled_threatscore_compliance_id: ["req1", "req2"]},
+            )
+        ]
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = [mock_finding1]
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3700,6 +3700,12 @@ class TestAggregateFindingsByRegion:
             )
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # Verify structure of check_status_by_region
         assert isinstance(check_status_by_region, dict)
         assert "us-east-1" in check_status_by_region
@@ -3719,27 +3725,15 @@ class TestAggregateFindingsByRegion:
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        # First finding with PASS status
-        mock_finding1 = MagicMock()
-        mock_finding1.check_id = "check1"
-        mock_finding1.status = "PASS"
-        mock_finding1.compliance = {}
-        mock_resource1 = MagicMock()
-        mock_resource1.region = "us-east-1"
-        mock_finding1.small_resources = [mock_resource1]
-
-        # Second finding with FAIL status for same check/region
-        mock_finding2 = MagicMock()
-        mock_finding2.check_id = "check1"
-        mock_finding2.status = "FAIL"
-        mock_finding2.compliance = {}
-        mock_resource2 = MagicMock()
-        mock_resource2.region = "us-east-1"
-        mock_finding2.small_resources = [mock_resource2]
+        # Same check/region: PASS first, then FAIL — FAIL must win
+        finding_rows = [
+            ("check1", "PASS", ["us-east-1"], {}),
+            ("check1", "FAIL", ["us-east-1"], {}),
+        ]
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = [mock_finding1, mock_finding2]
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3751,6 +3745,12 @@ class TestAggregateFindingsByRegion:
             tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # FAIL should override PASS
         assert check_status_by_region["us-east-1"]["check1"] == "FAIL"
 
@@ -3765,8 +3765,8 @@ class TestAggregateFindingsByRegion:
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = []
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = []
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3778,6 +3778,12 @@ class TestAggregateFindingsByRegion:
             tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # Verify filter was called with muted=False
         mock_findings_filter.assert_called_once_with(
             tenant_id=tenant_id,
@@ -3796,27 +3802,25 @@ class TestAggregateFindingsByRegion:
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        # Finding with PASS status
-        mock_finding1 = MagicMock()
-        mock_finding1.check_id = "check1"
-        mock_finding1.status = "PASS"
-        mock_finding1.compliance = {modeled_threatscore_compliance_id: ["req1"]}
-        mock_resource1 = MagicMock()
-        mock_resource1.region = "us-east-1"
-        mock_finding1.small_resources = [mock_resource1]
-
-        # Finding with FAIL status
-        mock_finding2 = MagicMock()
-        mock_finding2.check_id = "check2"
-        mock_finding2.status = "FAIL"
-        mock_finding2.compliance = {modeled_threatscore_compliance_id: ["req1"]}
-        mock_resource2 = MagicMock()
-        mock_resource2.region = "us-east-1"
-        mock_finding2.small_resources = [mock_resource2]
+        # PASS and FAIL findings mapped to the same ThreatScore requirement
+        finding_rows = [
+            (
+                "check1",
+                "PASS",
+                ["us-east-1"],
+                {modeled_threatscore_compliance_id: ["req1"]},
+            ),
+            (
+                "check2",
+                "FAIL",
+                ["us-east-1"],
+                {modeled_threatscore_compliance_id: ["req1"]},
+            ),
+        ]
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = [mock_finding1, mock_finding2]
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3828,6 +3832,12 @@ class TestAggregateFindingsByRegion:
             tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # Verify compliance counts
         normalized_id = re.sub(
             r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
@@ -3850,27 +3860,15 @@ class TestAggregateFindingsByRegion:
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
-        # Finding in us-east-1
-        mock_finding1 = MagicMock()
-        mock_finding1.check_id = "check1"
-        mock_finding1.status = "FAIL"
-        mock_finding1.compliance = {}
-        mock_resource1 = MagicMock()
-        mock_resource1.region = "us-east-1"
-        mock_finding1.small_resources = [mock_resource1]
-
-        # Finding in us-west-2
-        mock_finding2 = MagicMock()
-        mock_finding2.check_id = "check1"
-        mock_finding2.status = "PASS"
-        mock_finding2.compliance = {}
-        mock_resource2 = MagicMock()
-        mock_resource2.region = "us-west-2"
-        mock_finding2.small_resources = [mock_resource2]
+        # One finding per region
+        finding_rows = [
+            ("check1", "FAIL", ["us-east-1"], {}),
+            ("check1", "PASS", ["us-west-2"], {}),
+        ]
 
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = [mock_finding1, mock_finding2]
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3882,6 +3880,12 @@ class TestAggregateFindingsByRegion:
             tenant_id, scan_id, modeled_threatscore_compliance_id
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         # Verify both regions are present with correct statuses
         assert "us-east-1" in check_status_by_region
         assert "us-west-2" in check_status_by_region
@@ -3890,17 +3894,26 @@ class TestAggregateFindingsByRegion:
 
     @patch("tasks.jobs.scan.Finding.all_objects.filter")
     @patch("tasks.jobs.scan.rls_transaction")
-    def test_aggregate_findings_by_region_empty_findings(
+    def test_aggregate_findings_by_region_multi_region_finding(
         self, mock_rls_transaction, mock_findings_filter
     ):
-        """Test with no findings - should return empty dicts."""
+        """A finding with multiple resource_regions is tallied in every region."""
         tenant_id = str(uuid.uuid4())
         scan_id = str(uuid.uuid4())
         modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
 
+        finding_rows = [
+            (
+                "check1",
+                "FAIL",
+                ["us-east-1", "eu-west-1"],
+                {modeled_threatscore_compliance_id: ["req1"]},
+            )
+        ]
+
         mock_queryset = MagicMock()
-        mock_queryset.only.return_value = mock_queryset
-        mock_queryset.prefetch_related.return_value = []
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
@@ -3914,6 +3927,92 @@ class TestAggregateFindingsByRegion:
             )
         )
 
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
+        normalized_id = re.sub(
+            r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
+        )
+        for region in ("us-east-1", "eu-west-1"):
+            assert check_status_by_region[region]["check1"] == "FAIL"
+            req_stats = findings_count_by_compliance[region][normalized_id]["req1"]
+            assert req_stats == {"total": 1, "pass": 0}
+
+    @patch("tasks.jobs.scan.Finding.all_objects.filter")
+    @patch("tasks.jobs.scan.rls_transaction")
+    def test_aggregate_findings_by_region_skips_empty_regions(
+        self, mock_rls_transaction, mock_findings_filter
+    ):
+        """A finding with no denormalized regions contributes nothing."""
+        tenant_id = str(uuid.uuid4())
+        scan_id = str(uuid.uuid4())
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+
+        finding_rows = [
+            ("check1", "FAIL", [], {modeled_threatscore_compliance_id: ["req1"]}),
+            ("check2", "PASS", None, {}),
+        ]
+
+        mock_queryset = MagicMock()
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = finding_rows
+
+        ctx = MagicMock()
+        ctx.__enter__.return_value = None
+        ctx.__exit__.return_value = False
+        mock_rls_transaction.return_value = ctx
+        mock_findings_filter.return_value = mock_queryset
+
+        check_status_by_region, findings_count_by_compliance = (
+            _aggregate_findings_by_region(
+                tenant_id, scan_id, modeled_threatscore_compliance_id
+            )
+        )
+
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
+        assert check_status_by_region == {}
+        assert findings_count_by_compliance == {}
+
+    @patch("tasks.jobs.scan.Finding.all_objects.filter")
+    @patch("tasks.jobs.scan.rls_transaction")
+    def test_aggregate_findings_by_region_empty_findings(
+        self, mock_rls_transaction, mock_findings_filter
+    ):
+        """Test with no findings - should return empty dicts."""
+        tenant_id = str(uuid.uuid4())
+        scan_id = str(uuid.uuid4())
+        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+
+        mock_queryset = MagicMock()
+        mock_queryset.values_list.return_value = mock_queryset
+        mock_queryset.iterator.return_value = []
+
+        ctx = MagicMock()
+        ctx.__enter__.return_value = None
+        ctx.__exit__.return_value = False
+        mock_rls_transaction.return_value = ctx
+        mock_findings_filter.return_value = mock_queryset
+
+        check_status_by_region, findings_count_by_compliance = (
+            _aggregate_findings_by_region(
+                tenant_id, scan_id, modeled_threatscore_compliance_id
+            )
+        )
+
+        # Streaming query contract: column-scoped values_list + iterator
+        mock_queryset.values_list.assert_called_once_with(
+            "check_id", "status", "resource_regions", "compliance"
+        )
+        mock_queryset.iterator.assert_called_once()
+
         assert check_status_by_region == {}
         assert findings_count_by_compliance == {}
 

From 3960827a9c9d6cb9ab4fff4e8de174f9da6f6d4f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 11:09:11 +0200
Subject: [PATCH 050/126] chore(deps): bump starlette from 1.0.0 to 1.3.1 in
 /mcp_server (#11468)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 mcp_server/uv.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/mcp_server/uv.lock b/mcp_server/uv.lock
index dcc91b3851..14b8dcf4f3 100644
--- a/mcp_server/uv.lock
+++ b/mcp_server/uv.lock
@@ -1132,15 +1132,15 @@ wheels = [
 
 [[package]]
 name = "starlette"
-version = "1.0.0"
+version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/81/69/17425771797c36cded50b7fe44e850315d039f28b15901ab44839e70b593/starlette-1.0.0.tar.gz", hash = "sha256:6a4beaf1f81bb472fd19ea9b918b50dc3a77a6f2e190a12954b25e6ed5eea149", size = 2655289, upload-time = "2026-03-22T18:29:46.779Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/eb/e3/7c1dc7381d9f8ab7d854328ebfa884e62cb3f3d8549ddfd37c7814f42afa/starlette-1.3.1.tar.gz", hash = "sha256:05d0213193f2fbaae60e2ecb593b4add4262ad4e46536b54abe36f11a71724e0", size = 2703240, upload-time = "2026-06-12T09:23:11.602Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0b/c9/584bc9651441b4ba60cc4d557d8a547b5aff901af35bda3a4ee30c819b82/starlette-1.0.0-py3-none-any.whl", hash = "sha256:d3ec55e0bb321692d275455ddfd3df75fff145d009685eb40dc91fc66b03d38b", size = 72651, upload-time = "2026-03-22T18:29:45.111Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/bb/2799cc2ede3ed41131f8975621e7213dfc7ef4acbbaadfa440f32500c370/starlette-1.3.1-py3-none-any.whl", hash = "sha256:c7372aae11c3c3f26a42df7bd626cec2f47d03483d261d369516a615a53714c6", size = 73632, upload-time = "2026-06-12T09:23:10.017Z" },
 ]
 
 [[package]]

From 26b8c6b66394839adeb7a32e1a19f49c02e7e809 Mon Sep 17 00:00:00 2001
From: "Pablo Fernandez Guerra (PFE)"
 <148432447+pfe-nazaries@users.noreply.github.com>
Date: Tue, 16 Jun 2026 11:54:14 +0200
Subject: [PATCH 051/126] fix(ui): prevent radio button dot shift when checked
 (#11608)

Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ui/CHANGELOG.md                                  | 4 ++++
 ui/components/shadcn/radio-group/radio-group.tsx | 4 ++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index ede3aedff4..8e44db2eb2 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 ## [1.31.0] (Prowler UNRELEASED)
 
+### 🐞 Fixed
+
+- Radio button no longer shifts vertically when selected [(#11608)](https://github.com/prowler-cloud/prowler/pull/11608)
+
 ### 🔐 Security
 
 - Bump vulnerable `Next.js`, React, AI SDK, `postcss`, `hono`, `qs`, `esbuild`, and Alpine OpenSSL packages (`libcrypto3` and `libssl3`) [(#11581)](https://github.com/prowler-cloud/prowler/pull/11581)
diff --git a/ui/components/shadcn/radio-group/radio-group.tsx b/ui/components/shadcn/radio-group/radio-group.tsx
index 5765073031..5d2f286a4e 100644
--- a/ui/components/shadcn/radio-group/radio-group.tsx
+++ b/ui/components/shadcn/radio-group/radio-group.tsx
@@ -35,9 +35,9 @@ function RadioGroupItem({
     >
       <RadioGroupPrimitive.Indicator
         data-slot="radio-group-indicator"
-        className="grid place-content-center"
+        className="relative flex items-center justify-center"
       >
-        <span className="bg-button-primary size-2 rounded-full" />
+        <span className="bg-button-primary absolute top-1/2 left-1/2 size-2 -translate-x-1/2 -translate-y-1/2 rounded-full" />
       </RadioGroupPrimitive.Indicator>
     </RadioGroupPrimitive.Item>
   );

From e1f20487ce7abbca4911daf16ac72763d94d97a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= <ruben@prowler.com>
Date: Tue, 16 Jun 2026 12:00:18 +0200
Subject: [PATCH 052/126] chore(api): align uv constraints with SDK deps
 (numpy, py-iam-expand, iamdata; drop awsipranges) (#11594)

---
 api/pyproject.toml |  3 +--
 api/uv.lock        | 11 +++++------
 2 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/api/pyproject.toml b/api/pyproject.toml
index baeeb6ea0a..2bda12b993 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -127,7 +127,6 @@ constraint-dependencies = [
   "attrs==25.4.0",
   "authlib==1.6.12",
   "autopep8==2.3.2",
-  "awsipranges==0.3.3",
   "azure-cli-core==2.83.0",
   "azure-cli-telemetry==1.1.0",
   "azure-common==1.1.28",
@@ -264,7 +263,7 @@ constraint-dependencies = [
   "httpx==0.28.1",
   "humanfriendly==10.0",
   "hyperframe==6.1.0",
-  "iamdata==0.1.202602021",
+  "iamdata==0.1.202605131",
   "idna==3.15",
   "importlib-metadata==8.7.1",
   "inflection==0.5.1",
diff --git a/api/uv.lock b/api/uv.lock
index 8673b8873b..541a98e208 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -63,7 +63,6 @@ constraints = [
     { name = "attrs", specifier = "==25.4.0" },
     { name = "authlib", specifier = "==1.6.12" },
     { name = "autopep8", specifier = "==2.3.2" },
-    { name = "awsipranges", specifier = "==0.3.3" },
     { name = "azure-cli-core", specifier = "==2.83.0" },
     { name = "azure-cli-telemetry", specifier = "==1.1.0" },
     { name = "azure-common", specifier = "==1.1.28" },
@@ -200,7 +199,7 @@ constraints = [
     { name = "httpx", specifier = "==0.28.1" },
     { name = "humanfriendly", specifier = "==10.0" },
     { name = "hyperframe", specifier = "==6.1.0" },
-    { name = "iamdata", specifier = "==0.1.202602021" },
+    { name = "iamdata", specifier = "==0.1.202605131" },
     { name = "idna", specifier = "==3.15" },
     { name = "importlib-metadata", specifier = "==8.7.1" },
     { name = "inflection", specifier = "==0.5.1" },
@@ -3187,11 +3186,11 @@ wheels = [
 
 [[package]]
 name = "iamdata"
-version = "0.1.202602021"
+version = "0.1.202605131"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/93/5e/8179963b7a528c548824a8e4088150509d9fa8571dd622b7399f6d2d5680/iamdata-0.1.202602021.tar.gz", hash = "sha256:c24265fc3694076f65da91a8aa9361b60da25f7b8cfd8ba4ddd6aa1b9bb5153e", size = 771233, upload-time = "2026-02-02T05:49:56.76Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cc/ea/d68e25aa4392e8a9f8e6523adc95a5fb86baf98d052efa2cec4d4a00e7ce/iamdata-0.1.202605131.tar.gz", hash = "sha256:ab4e8f1ea080394157848fecd0ca643633e35b2e0cb1965c9ed9bdd673afe00c", size = 793465, upload-time = "2026-05-13T05:57:10.607Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/74/9e/ae7a3019aa5a27d70412b74da4f0304695efa5d9a88f0689f37ea2602ea2/iamdata-0.1.202602021-py3-none-any.whl", hash = "sha256:48419662d75dd0e1ea22b9cc98fd70201d4c72760c6897acc46ad9ab90633d18", size = 1226614, upload-time = "2026-02-02T05:49:54.735Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/93/03396b477b0faa9f1a12142209b59aa13d0fe4f64e2be47883f607789c14/iamdata-0.1.202605131-py3-none-any.whl", hash = "sha256:350e317d96fb8c8ddf30aa6da222788d302af5f13c9e357b59f9eefe50b8af5a", size = 1259166, upload-time = "2026-05-13T05:57:09.093Z" },
 ]
 
 [[package]]
@@ -4448,7 +4447,7 @@ wheels = [
 [[package]]
 name = "prowler"
 version = "5.31.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#8081d0fd0552131dfbd885f1074377eb653fc785" }
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#b5bb85c9564f6ca6a7f66c851bb56bde719205ee" }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },
     { name = "alibabacloud-credentials" },

From 0c9f4f65786551e8acfbde0a171b0e5dacb262ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Tue, 16 Jun 2026 12:25:57 +0200
Subject: [PATCH 053/126] ci: run ui/mcp dependency vulnerability scans in
 prowler-cloud (match api-security) (#11617)

---
 .github/workflows/mcp-security.yml | 1 -
 .github/workflows/ui-security.yml  | 1 -
 2 files changed, 2 deletions(-)

diff --git a/.github/workflows/mcp-security.yml b/.github/workflows/mcp-security.yml
index fc76756e40..4deb6a478d 100644
--- a/.github/workflows/mcp-security.yml
+++ b/.github/workflows/mcp-security.yml
@@ -24,7 +24,6 @@ permissions: {}
 
 jobs:
   mcp-security-scans:
-    if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
diff --git a/.github/workflows/ui-security.yml b/.github/workflows/ui-security.yml
index e178e9b3b0..2dc444654f 100644
--- a/.github/workflows/ui-security.yml
+++ b/.github/workflows/ui-security.yml
@@ -24,7 +24,6 @@ permissions: {}
 
 jobs:
   ui-security-scans:
-    if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:

From d1ed1eddef596ecd218f06709be65ee4d77b081a Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 12:42:32 +0200
Subject: [PATCH 054/126] chore(sdk): update dependency black to v26 [security]
 (#11290)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 .../inventory-graph/lib/inventory_output.py   |  1 -
 prowler/CHANGELOG.md                          |  1 +
 prowler/lib/banner.py                         | 12 +--
 prowler/lib/outputs/html/html.py              | 18 ++---
 pyproject.toml                                |  5 +-
 tests/lib/outputs/outputs_test.py             |  5 +-
 .../openstack/openstack_provider_test.py      | 78 +++++++------------
 .../nuke_providers.py                         |  6 +-
 uv.lock                                       | 77 +++++++++++++-----
 9 files changed, 99 insertions(+), 104 deletions(-)

diff --git a/contrib/inventory-graph/lib/inventory_output.py b/contrib/inventory-graph/lib/inventory_output.py
index 359e7eb91f..459dc37cdb 100644
--- a/contrib/inventory-graph/lib/inventory_output.py
+++ b/contrib/inventory-graph/lib/inventory_output.py
@@ -16,7 +16,6 @@ from typing import Optional
 from prowler.lib.logger import logger
 from lib.models import ConnectivityGraph
 
-
 # ---------------------------------------------------------------------------
 # JSON output
 # ---------------------------------------------------------------------------
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 6dc2aafb60..ed24d989e7 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -23,6 +23,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ### 🔐 Security
 
+- `black` from 25.1.0 to 26.3.1, patching a known vulnerability in the SDK formatter dependency [(#11290)](https://github.com/prowler-cloud/prowler/pull/11290)
 - `microsoft-kiota-*` to 1.9.9 and `aiohttp` to 3.14.0, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
 - Container base image bumped to `python:3.12.13-slim-bookworm` (patches `libgnutls30` CVE-2026-33845 and CVE-2026-42010) and `trivy` bumped to 0.71.0 (patches embedded `golang.org/x/crypto` and Go stdlib CVEs); `.trivyignore` documents remaining bookworm criticals with no-fix or not-affected rationale [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
 
diff --git a/prowler/lib/banner.py b/prowler/lib/banner.py
index bccebaaab8..8115983bc6 100644
--- a/prowler/lib/banner.py
+++ b/prowler/lib/banner.py
@@ -28,15 +28,13 @@ def print_banner(legend: bool = False, provider: str = None):
     print_prowler_cloud_banner(provider)
 
     if legend:
-        print(
-            f"""
+        print(f"""
 {Style.BRIGHT}Color code for results:{Style.RESET_ALL}
 - {Fore.YELLOW}MANUAL (Manual check){Style.RESET_ALL}
 - {Fore.GREEN}PASS (Recommended value){Style.RESET_ALL}
 - {orange_color}MUTED (Muted by muted list){Style.RESET_ALL}
 - {Fore.RED}FAIL (Fix required){Style.RESET_ALL}
-            """
-        )
+            """)
 
 
 def print_prowler_cloud_banner(provider: str = None):
@@ -56,8 +54,7 @@ def print_prowler_cloud_banner(provider: str = None):
     """
     check = f"{Fore.GREEN}✓{Style.RESET_ALL}"
     bar = f"{banner_color}│{Style.RESET_ALL}"
-    print(
-        f"""
+    print(f"""
 {bar} {Style.BRIGHT}You're getting a snapshot 📸. Prowler Cloud gives you the full picture:{Style.RESET_ALL}
 {bar}
 {bar} {check} {Style.BRIGHT}Continuous Security Monitoring{Style.RESET_ALL} - scheduled scans with history, trends and alerts.
@@ -70,5 +67,4 @@ def print_prowler_cloud_banner(provider: str = None):
 {bar} {check} {Style.BRIGHT}Integrations{Style.RESET_ALL} - Anything with our MCP + Jira, Slack, AWS Security Hub, Amazon S3, SSO and RBAC.
 {bar}
 {bar} {Fore.BLUE}Start free at 👉 cloud.prowler.com{Style.RESET_ALL}
-"""
-    )
+""")
diff --git a/prowler/lib/outputs/html/html.py b/prowler/lib/outputs/html/html.py
index 52afd071ae..545bcbc456 100644
--- a/prowler/lib/outputs/html/html.py
+++ b/prowler/lib/outputs/html/html.py
@@ -73,8 +73,7 @@ class HTML(Output):
                 elif finding.status == "FAIL":
                     row_class = "table-danger"
 
-                self._data.append(
-                    f"""
+                self._data.append(f"""
                         <tr class="{row_class}">
                             <td>{finding_status}</td>
                             <td>{finding.metadata.Severity.value}</td>
@@ -89,8 +88,7 @@ class HTML(Output):
                             <td><p class="show-read-more">{HTML.process_markdown(finding.metadata.Remediation.Recommendation.Text)}</p> <a class="read-more" href="{finding.metadata.Remediation.Recommendation.Url}"><i class="fas fa-external-link-alt"></i></a></td>
                             <td><p class="show-read-more">{parse_html_string(unroll_dict(finding.compliance, separator=": "))}</p></td>
                         </tr>
-                        """
-                )
+                        """)
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -143,8 +141,7 @@ class HTML(Output):
             from_cli (bool): whether the request is from the CLI or not
         """
         try:
-            file_descriptor.write(
-                f"""<!DOCTYPE html>
+            file_descriptor.write(f"""<!DOCTYPE html>
     <html lang="en">
     <head>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
@@ -253,8 +250,7 @@ class HTML(Output):
                     <th scope="col">Compliance</th>
                 </tr>
             </thead>
-            <tbody>"""
-            )
+            <tbody>""")
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
@@ -269,8 +265,7 @@ class HTML(Output):
             file_descriptor (file): the file descriptor to write the footer
         """
         try:
-            file_descriptor.write(
-                """
+            file_descriptor.write("""
             </tbody>
             </table>
         </div>
@@ -409,8 +404,7 @@ class HTML(Output):
 </body>
 
 </html>
-"""
-            )
+""")
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
diff --git a/pyproject.toml b/pyproject.toml
index 8da017bf21..5b8f87c218 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -5,7 +5,7 @@ requires = ["hatchling"]
 [dependency-groups]
 dev = [
   "bandit==1.8.3",
-  "black==25.1.0",
+  "black==26.3.1",
   "coverage==7.6.12",
   "docker==7.1.0",
   "filelock==3.20.3",
@@ -205,7 +205,7 @@ constraint-dependencies = [
   "azure-core==1.41.0",
   "azure-mgmt-core==1.6.0",
   "bandit==1.8.3",
-  "black==25.1.0",
+  "black==26.3.1",
   "blinker==1.9.0",
   "certifi==2026.4.22",
   "cffi==2.0.0",
@@ -325,6 +325,7 @@ constraint-dependencies = [
   "pytest-env==1.1.5",
   "pytest-randomly==3.16.0",
   "pytest-xdist==3.6.1",
+  "pytokens==0.4.1",
   "pywin32==311",
   "pyyaml==6.0.3",
   "referencing==0.36.2",
diff --git a/tests/lib/outputs/outputs_test.py b/tests/lib/outputs/outputs_test.py
index 87901bd290..ca18717847 100644
--- a/tests/lib/outputs/outputs_test.py
+++ b/tests/lib/outputs/outputs_test.py
@@ -51,9 +51,7 @@ class TestOutputs:
 
     def test_parse_html_string(self):
         string = "CISA: your-systems-3, your-data-1, your-data-2 | CIS-1.4: 2.1.1 | CIS-1.5: 2.1.1 | GDPR: article_32 | AWS-Foundational-Security-Best-Practices: s3 | HIPAA: 164_308_a_1_ii_b, 164_308_a_4_ii_a, 164_312_a_2_iv, 164_312_c_1, 164_312_c_2, 164_312_e_2_ii | GxP-21-CFR-Part-11: 11.10-c, 11.30 | GxP-EU-Annex-11: 7.1-data-storage-damage-protection | NIST-800-171-Revision-2: 3_3_8, 3_5_10, 3_13_11, 3_13_16 | NIST-800-53-Revision-4: sc_28 | NIST-800-53-Revision-5: au_9_3, cm_6_a, cm_9_b, cp_9_d, cp_9_8, pm_11_b, sc_8_3, sc_8_4, sc_13_a, sc_16_1, sc_28_1, si_19_4 | ENS-RD2022: mp.si.2.aws.s3.1 | NIST-CSF-1.1: ds_1 | RBI-Cyber-Security-Framework: annex_i_1_3 | FFIEC: d3-pc-am-b-12 | PCI-3.2.1: s3 | FedRamp-Moderate-Revision-4: sc-13, sc-28 | FedRAMP-Low-Revision-4: sc-13 | KISA-ISMS-P-2023: 2.6.1 | KISA-ISMS-P-2023-korean: 2.6.1"
-        assert (
-            parse_html_string(string)
-            == """
+        assert parse_html_string(string) == """
 &#x2022;CISA: your-systems-3, your-data-1, your-data-2
 
 &#x2022;CIS-1.4: 2.1.1
@@ -94,7 +92,6 @@ class TestOutputs:
 
 &#x2022;KISA-ISMS-P-2023-korean: 2.6.1
 """
-        )
 
     def test_unroll_tags(self):
         dict_list = [
diff --git a/tests/providers/openstack/openstack_provider_test.py b/tests/providers/openstack/openstack_provider_test.py
index 654d109134..b36fcd97a5 100644
--- a/tests/providers/openstack/openstack_provider_test.py
+++ b/tests/providers/openstack/openstack_provider_test.py
@@ -631,8 +631,7 @@ class TestOpenstackProviderCloudsYaml:
     def test_clouds_yaml_explicit_file_path(self, tmp_path):
         """Test loading clouds.yaml from an explicit file path."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -644,8 +643,7 @@ clouds:
       project_domain_name: YamlProjectDomain
     region_name: RegionOne
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -681,8 +679,7 @@ clouds:
     def test_clouds_yaml_with_explicit_cloud_name(self, tmp_path):
         """Test loading clouds.yaml with an explicit cloud name."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   default-cloud:
     auth:
@@ -692,8 +689,7 @@ clouds:
       project_id: default-project-id
     region_name: RegionOne
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -719,8 +715,7 @@ clouds:
     def test_clouds_yaml_file_without_cloud_name(self, tmp_path):
         """Test error when clouds.yaml file is provided without cloud name."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -729,8 +724,7 @@ clouds:
       password: test-password
       project_id: test-project-id
     region_name: RegionOne
-"""
-        )
+""")
 
         with pytest.raises(OpenStackInvalidConfigError) as excinfo:
             OpenstackProvider(clouds_yaml_file=str(clouds_yaml))
@@ -750,8 +744,7 @@ clouds:
     def test_clouds_yaml_cloud_not_found(self, tmp_path):
         """Test error when specified cloud is not in clouds.yaml."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   existing-cloud:
     auth:
@@ -760,8 +753,7 @@ clouds:
       password: test-password
       project_id: test-project-id
     region_name: RegionOne
-"""
-        )
+""")
 
         with pytest.raises(OpenStackCloudNotFoundError) as excinfo:
             OpenstackProvider(
@@ -774,8 +766,7 @@ clouds:
     def test_clouds_yaml_missing_required_fields(self, tmp_path):
         """Test error when clouds.yaml is missing required fields."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   incomplete-cloud:
     auth:
@@ -783,8 +774,7 @@ clouds:
       username: test-user
       # Missing password and other required fields
     region_name: RegionOne
-"""
-        )
+""")
 
         with pytest.raises(OpenStackInvalidConfigError) as excinfo:
             OpenstackProvider(
@@ -798,16 +788,14 @@ clouds:
     def test_clouds_yaml_malformed_yaml(self, tmp_path):
         """Test error when clouds.yaml is malformed."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   malformed-cloud:
     auth:
       auth_url: https://openstack.example.com:5000/v3
       username: test-user
     - invalid: yaml: structure
-"""
-        )
+""")
 
         with pytest.raises(OpenStackInvalidConfigError):
             OpenstackProvider(
@@ -818,8 +806,7 @@ clouds:
     def test_clouds_yaml_with_project_name(self, tmp_path):
         """Test clouds.yaml using project_name instead of project_id."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -831,8 +818,7 @@ clouds:
       project_domain_name: Default
     region_name: RegionOne
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -863,8 +849,7 @@ clouds:
         monkeypatch.setenv("OS_REGION_NAME", "EnvRegion")
 
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -874,8 +859,7 @@ clouds:
       project_id: yaml-project-id
     region_name: YamlRegion
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -902,8 +886,7 @@ clouds:
     def test_test_connection_with_clouds_yaml(self, tmp_path):
         """Test static test_connection method with clouds.yaml."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -913,8 +896,7 @@ clouds:
       project_id: test-project-id
     region_name: RegionOne
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -950,8 +932,7 @@ clouds:
     def test_test_connection_clouds_yaml_cloud_not_found(self, tmp_path):
         """Test test_connection error when cloud is not in clouds.yaml."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   existing-cloud:
     auth:
@@ -960,8 +941,7 @@ clouds:
       password: test-password
       project_id: test-project-id
     region_name: RegionOne
-"""
-        )
+""")
 
         connection_result = OpenstackProvider.test_connection(
             clouds_yaml_file=str(clouds_yaml),
@@ -1139,8 +1119,7 @@ clouds:
     def test_clouds_yaml_file_with_regions_list(self, tmp_path):
         """Test loading clouds.yaml file with regions list."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -1152,8 +1131,7 @@ clouds:
       - RegionOne
       - RegionTwo
     identity_api_version: 3
-"""
-        )
+""")
 
         mock_connection = MagicMock()
         mock_connection.authorize.return_value = None
@@ -1177,8 +1155,7 @@ clouds:
     def test_clouds_yaml_file_with_both_regions_raises_error(self, tmp_path):
         """Test that clouds.yaml file with both region_name and regions raises error."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -1191,8 +1168,7 @@ clouds:
       - RegionOne
       - RegionTwo
     identity_api_version: 3
-"""
-        )
+""")
 
         with pytest.raises(OpenStackAmbiguousRegionError):
             OpenstackProvider(
@@ -1203,8 +1179,7 @@ clouds:
     def test_clouds_yaml_file_with_no_region_raises_error(self, tmp_path):
         """Test that clouds.yaml file with neither region_name nor regions raises error."""
         clouds_yaml = tmp_path / "clouds.yaml"
-        clouds_yaml.write_text(
-            """
+        clouds_yaml.write_text("""
 clouds:
   test-cloud:
     auth:
@@ -1213,8 +1188,7 @@ clouds:
       password: test-password
       project_id: test-project-id
     identity_api_version: 3
-"""
-        )
+""")
 
         with pytest.raises(OpenStackNoRegionError):
             OpenstackProvider(
diff --git a/util/prowler-bulk-provisioning/nuke_providers.py b/util/prowler-bulk-provisioning/nuke_providers.py
index 9759ac4626..8ddaa89f7b 100755
--- a/util/prowler-bulk-provisioning/nuke_providers.py
+++ b/util/prowler-bulk-provisioning/nuke_providers.py
@@ -414,8 +414,7 @@ def main():
     # Summary with nuclear explosion art if successful
     if successes > 0 and failures == 0:
         # Nuclear explosion ASCII art
-        print(
-            r"""
+        print(r"""
                 _.-^^---....,,--
             _--                  --_
             <                        >)
@@ -427,8 +426,7 @@ def main():
                 `-=#$%&%$#=-'
                     | ;  :|
             _____.,-#%&$@%#&#~,._____
-        """
-        )
+        """)
         print(f"\n{'=' * 60}")
         print("💥 NUCLEAR DELETION COMPLETE 💥")
         print(f"{'=' * 60}")
diff --git a/uv.lock b/uv.lock
index 666d67b4b2..e2d82196f7 100644
--- a/uv.lock
+++ b/uv.lock
@@ -57,7 +57,7 @@ constraints = [
     { name = "azure-core", specifier = "==1.41.0" },
     { name = "azure-mgmt-core", specifier = "==1.6.0" },
     { name = "bandit", specifier = "==1.8.3" },
-    { name = "black", specifier = "==25.1.0" },
+    { name = "black", specifier = "==26.3.1" },
     { name = "blinker", specifier = "==1.9.0" },
     { name = "certifi", specifier = "==2026.4.22" },
     { name = "cffi", specifier = "==2.0.0" },
@@ -177,6 +177,7 @@ constraints = [
     { name = "pytest-env", specifier = "==1.1.5" },
     { name = "pytest-randomly", specifier = "==3.16.0" },
     { name = "pytest-xdist", specifier = "==3.6.1" },
+    { name = "pytokens", specifier = "==0.4.1" },
     { name = "pywin32", specifier = "==311" },
     { name = "pyyaml", specifier = "==6.0.3" },
     { name = "referencing", specifier = "==0.36.2" },
@@ -1304,7 +1305,7 @@ wheels = [
 
 [[package]]
 name = "black"
-version = "25.1.0"
+version = "26.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "click" },
@@ -1312,28 +1313,33 @@ dependencies = [
     { name = "packaging" },
     { name = "pathspec" },
     { name = "platformdirs" },
+    { name = "pytokens" },
     { name = "tomli", marker = "python_full_version < '3.11'" },
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/94/49/26a7b0f3f35da4b5a65f081943b7bcd22d7002f5f0fb8098ec1ff21cb6ef/black-25.1.0.tar.gz", hash = "sha256:33496d5cd1222ad73391352b4ae8da15253c5de89b93a80b3e2c8d9a19ec2666", size = 649449, upload-time = "2025-01-29T04:15:40.373Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e1/c5/61175d618685d42b005847464b8fb4743a67b1b8fdb75e50e5a96c31a27a/black-26.3.1.tar.gz", hash = "sha256:2c50f5063a9641c7eed7795014ba37b0f5fa227f3d408b968936e24bc0566b07", size = 666155, upload-time = "2026-03-12T03:36:03.593Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4d/3b/4ba3f93ac8d90410423fdd31d7541ada9bcee1df32fb90d26de41ed40e1d/black-25.1.0-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:759e7ec1e050a15f89b770cefbf91ebee8917aac5c20483bc2d80a6c3a04df32", size = 1629419, upload-time = "2025-01-29T05:37:06.642Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/02/0bde0485146a8a5e694daed47561785e8b77a0466ccc1f3e485d5ef2925e/black-25.1.0-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:0e519ecf93120f34243e6b0054db49c00a35f84f195d5bce7e9f5cfc578fc2da", size = 1461080, upload-time = "2025-01-29T05:37:09.321Z" },
-    { url = "https://files.pythonhosted.org/packages/52/0e/abdf75183c830eaca7589144ff96d49bce73d7ec6ad12ef62185cc0f79a2/black-25.1.0-cp310-cp310-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:055e59b198df7ac0b7efca5ad7ff2516bca343276c466be72eb04a3bcc1f82d7", size = 1766886, upload-time = "2025-01-29T04:18:24.432Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/a6/97d8bb65b1d8a41f8a6736222ba0a334db7b7b77b8023ab4568288f23973/black-25.1.0-cp310-cp310-win_amd64.whl", hash = "sha256:db8ea9917d6f8fc62abd90d944920d95e73c83a5ee3383493e35d271aca872e9", size = 1419404, upload-time = "2025-01-29T04:19:04.296Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/4f/87f596aca05c3ce5b94b8663dbfe242a12843caaa82dd3f85f1ffdc3f177/black-25.1.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a39337598244de4bae26475f77dda852ea00a93bd4c728e09eacd827ec929df0", size = 1614372, upload-time = "2025-01-29T05:37:11.71Z" },
-    { url = "https://files.pythonhosted.org/packages/e7/d0/2c34c36190b741c59c901e56ab7f6e54dad8df05a6272a9747ecef7c6036/black-25.1.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:96c1c7cd856bba8e20094e36e0f948718dc688dba4a9d78c3adde52b9e6c2299", size = 1442865, upload-time = "2025-01-29T05:37:14.309Z" },
-    { url = "https://files.pythonhosted.org/packages/21/d4/7518c72262468430ead45cf22bd86c883a6448b9eb43672765d69a8f1248/black-25.1.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bce2e264d59c91e52d8000d507eb20a9aca4a778731a08cfff7e5ac4a4bb7096", size = 1749699, upload-time = "2025-01-29T04:18:17.688Z" },
-    { url = "https://files.pythonhosted.org/packages/58/db/4f5beb989b547f79096e035c4981ceb36ac2b552d0ac5f2620e941501c99/black-25.1.0-cp311-cp311-win_amd64.whl", hash = "sha256:172b1dbff09f86ce6f4eb8edf9dede08b1fce58ba194c87d7a4f1a5aa2f5b3c2", size = 1428028, upload-time = "2025-01-29T04:18:51.711Z" },
-    { url = "https://files.pythonhosted.org/packages/83/71/3fe4741df7adf015ad8dfa082dd36c94ca86bb21f25608eb247b4afb15b2/black-25.1.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:4b60580e829091e6f9238c848ea6750efed72140b91b048770b64e74fe04908b", size = 1650988, upload-time = "2025-01-29T05:37:16.707Z" },
-    { url = "https://files.pythonhosted.org/packages/13/f3/89aac8a83d73937ccd39bbe8fc6ac8860c11cfa0af5b1c96d081facac844/black-25.1.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1e2978f6df243b155ef5fa7e558a43037c3079093ed5d10fd84c43900f2d8ecc", size = 1453985, upload-time = "2025-01-29T05:37:18.273Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/22/b99efca33f1f3a1d2552c714b1e1b5ae92efac6c43e790ad539a163d1754/black-25.1.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3b48735872ec535027d979e8dcb20bf4f70b5ac75a8ea99f127c106a7d7aba9f", size = 1783816, upload-time = "2025-01-29T04:18:33.823Z" },
-    { url = "https://files.pythonhosted.org/packages/18/7e/a27c3ad3822b6f2e0e00d63d58ff6299a99a5b3aee69fa77cd4b0076b261/black-25.1.0-cp312-cp312-win_amd64.whl", hash = "sha256:ea0213189960bda9cf99be5b8c8ce66bb054af5e9e861249cd23471bd7b0b3ba", size = 1440860, upload-time = "2025-01-29T04:19:12.944Z" },
-    { url = "https://files.pythonhosted.org/packages/98/87/0edf98916640efa5d0696e1abb0a8357b52e69e82322628f25bf14d263d1/black-25.1.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8f0b18a02996a836cc9c9c78e5babec10930862827b1b724ddfe98ccf2f2fe4f", size = 1650673, upload-time = "2025-01-29T05:37:20.574Z" },
-    { url = "https://files.pythonhosted.org/packages/52/e5/f7bf17207cf87fa6e9b676576749c6b6ed0d70f179a3d812c997870291c3/black-25.1.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:afebb7098bfbc70037a053b91ae8437c3857482d3a690fefc03e9ff7aa9a5fd3", size = 1453190, upload-time = "2025-01-29T05:37:22.106Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/ee/adda3d46d4a9120772fae6de454c8495603c37c4c3b9c60f25b1ab6401fe/black-25.1.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:030b9759066a4ee5e5aca28c3c77f9c64789cdd4de8ac1df642c40b708be6171", size = 1782926, upload-time = "2025-01-29T04:18:58.564Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/64/94eb5f45dcb997d2082f097a3944cfc7fe87e071907f677e80788a2d7b7a/black-25.1.0-cp313-cp313-win_amd64.whl", hash = "sha256:a22f402b410566e2d1c950708c77ebf5ebd5d0d88a6a2e87c86d9fb48afa0d18", size = 1442613, upload-time = "2025-01-29T04:19:27.63Z" },
-    { url = "https://files.pythonhosted.org/packages/09/71/54e999902aed72baf26bca0d50781b01838251a462612966e9fc4891eadd/black-25.1.0-py3-none-any.whl", hash = "sha256:95e8176dae143ba9097f351d174fdaf0ccd29efb414b362ae3fd72bf0f710717", size = 207646, upload-time = "2025-01-29T04:15:38.082Z" },
+    { url = "https://files.pythonhosted.org/packages/32/a8/11170031095655d36ebc6664fe0897866f6023892396900eec0e8fdc4299/black-26.3.1-cp310-cp310-macosx_10_9_x86_64.whl", hash = "sha256:86a8b5035fce64f5dcd1b794cf8ec4d31fe458cf6ce3986a30deb434df82a1d2", size = 1866562, upload-time = "2026-03-12T03:39:58.639Z" },
+    { url = "https://files.pythonhosted.org/packages/69/ce/9e7548d719c3248c6c2abfd555d11169457cbd584d98d179111338423790/black-26.3.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:5602bdb96d52d2d0672f24f6ffe5218795736dd34807fd0fd55ccd6bf206168b", size = 1703623, upload-time = "2026-03-12T03:40:00.347Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/0a/8d17d1a9c06f88d3d030d0b1d4373c1551146e252afe4547ed601c0e697f/black-26.3.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6c54a4a82e291a1fee5137371ab488866b7c86a3305af4026bdd4dc78642e1ac", size = 1768388, upload-time = "2026-03-12T03:40:01.765Z" },
+    { url = "https://files.pythonhosted.org/packages/52/79/c1ee726e221c863cde5164f925bacf183dfdf0397d4e3f94889439b947b4/black-26.3.1-cp310-cp310-win_amd64.whl", hash = "sha256:6e131579c243c98f35bce64a7e08e87fb2d610544754675d4a0e73a070a5aa3a", size = 1412969, upload-time = "2026-03-12T03:40:03.252Z" },
+    { url = "https://files.pythonhosted.org/packages/73/a5/15c01d613f5756f68ed8f6d4ec0a1e24b82b18889fa71affd3d1f7fad058/black-26.3.1-cp310-cp310-win_arm64.whl", hash = "sha256:5ed0ca58586c8d9a487352a96b15272b7fa55d139fc8496b519e78023a8dab0a", size = 1220345, upload-time = "2026-03-12T03:40:04.892Z" },
+    { url = "https://files.pythonhosted.org/packages/17/57/5f11c92861f9c92eb9dddf515530bc2d06db843e44bdcf1c83c1427824bc/black-26.3.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:28ef38aee69e4b12fda8dba75e21f9b4f979b490c8ac0baa7cb505369ac9e1ff", size = 1851987, upload-time = "2026-03-12T03:40:06.248Z" },
+    { url = "https://files.pythonhosted.org/packages/54/aa/340a1463660bf6831f9e39646bf774086dbd8ca7fc3cded9d59bbdf4ad0a/black-26.3.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:bf9bf162ed91a26f1adba8efda0b573bc6924ec1408a52cc6f82cb73ec2b142c", size = 1689499, upload-time = "2026-03-12T03:40:07.642Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/01/b726c93d717d72733da031d2de10b92c9fa4c8d0c67e8a8a372076579279/black-26.3.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:474c27574d6d7037c1bc875a81d9be0a9a4f9ee95e62800dab3cfaadbf75acd5", size = 1754369, upload-time = "2026-03-12T03:40:09.279Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/09/61e91881ca291f150cfc9eb7ba19473c2e59df28859a11a88248b5cbbc4d/black-26.3.1-cp311-cp311-win_amd64.whl", hash = "sha256:5e9d0d86df21f2e1677cc4bd090cd0e446278bcbbe49bf3659c308c3e402843e", size = 1413613, upload-time = "2026-03-12T03:40:10.943Z" },
+    { url = "https://files.pythonhosted.org/packages/16/73/544f23891b22e7efe4d8f812371ab85b57f6a01b2fc45e3ba2e52ba985b8/black-26.3.1-cp311-cp311-win_arm64.whl", hash = "sha256:9a5e9f45e5d5e1c5b5c29b3bd4265dcc90e8b92cf4534520896ed77f791f4da5", size = 1219719, upload-time = "2026-03-12T03:40:12.597Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/f8/da5eae4fc75e78e6dceb60624e1b9662ab00d6b452996046dfa9b8a6025b/black-26.3.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:b5e6f89631eb88a7302d416594a32faeee9fb8fb848290da9d0a5f2903519fc1", size = 1895920, upload-time = "2026-03-12T03:40:13.921Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/9f/04e6f26534da2e1629b2b48255c264cabf5eedc5141d04516d9d68a24111/black-26.3.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:41cd2012d35b47d589cb8a16faf8a32ef7a336f56356babd9fcf70939ad1897f", size = 1718499, upload-time = "2026-03-12T03:40:15.239Z" },
+    { url = "https://files.pythonhosted.org/packages/04/91/a5935b2a63e31b331060c4a9fdb5a6c725840858c599032a6f3aac94055f/black-26.3.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f76ff19ec5297dd8e66eb64deda23631e642c9393ab592826fd4bdc97a4bce7", size = 1794994, upload-time = "2026-03-12T03:40:17.124Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/0a/86e462cdd311a3c2a8ece708d22aba17d0b2a0d5348ca34b40cdcbea512e/black-26.3.1-cp312-cp312-win_amd64.whl", hash = "sha256:ddb113db38838eb9f043623ba274cfaf7d51d5b0c22ecb30afe58b1bb8322983", size = 1420867, upload-time = "2026-03-12T03:40:18.83Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/e5/22515a19cb7eaee3440325a6b0d95d2c0e88dd180cb011b12ae488e031d1/black-26.3.1-cp312-cp312-win_arm64.whl", hash = "sha256:dfdd51fc3e64ea4f35873d1b3fb25326773d55d2329ff8449139ebaad7357efb", size = 1230124, upload-time = "2026-03-12T03:40:20.425Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/77/5728052a3c0450c53d9bb3945c4c46b91baa62b2cafab6801411b6271e45/black-26.3.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:855822d90f884905362f602880ed8b5df1b7e3ee7d0db2502d4388a954cc8c54", size = 1895034, upload-time = "2026-03-12T03:40:21.813Z" },
+    { url = "https://files.pythonhosted.org/packages/52/73/7cae55fdfdfbe9d19e9a8d25d145018965fe2079fa908101c3733b0c55a0/black-26.3.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:8a33d657f3276328ce00e4d37fe70361e1ec7614da5d7b6e78de5426cb56332f", size = 1718503, upload-time = "2026-03-12T03:40:23.666Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/87/af89ad449e8254fdbc74654e6467e3c9381b61472cc532ee350d28cfdafb/black-26.3.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f1cd08e99d2f9317292a311dfe578fd2a24b15dbce97792f9c4d752275c1fa56", size = 1793557, upload-time = "2026-03-12T03:40:25.497Z" },
+    { url = "https://files.pythonhosted.org/packages/43/10/d6c06a791d8124b843bf325ab4ac7d2f5b98731dff84d6064eafd687ded1/black-26.3.1-cp313-cp313-win_amd64.whl", hash = "sha256:c7e72339f841b5a237ff14f7d3880ddd0fc7f98a1199e8c4327f9a4f478c1839", size = 1422766, upload-time = "2026-03-12T03:40:27.14Z" },
+    { url = "https://files.pythonhosted.org/packages/59/4f/40a582c015f2d841ac24fed6390bd68f0fc896069ff3a886317959c9daf8/black-26.3.1-cp313-cp313-win_arm64.whl", hash = "sha256:afc622538b430aa4c8c853f7f63bc582b3b8030fd8c80b70fb5fa5b834e575c2", size = 1232140, upload-time = "2026-03-12T03:40:28.882Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/0d/52d98722666d6fc6c3dd4c76df339501d6efd40e0ff95e6186a7b7f0befd/black-26.3.1-py3-none-any.whl", hash = "sha256:2bd5aa94fc267d38bb21a70d7410a89f1a1d318841855f698746f8e7f51acd1b", size = 207542, upload-time = "2026-03-12T03:36:01.668Z" },
 ]
 
 [[package]]
@@ -3710,7 +3716,7 @@ requires-dist = [
 [package.metadata.requires-dev]
 dev = [
     { name = "bandit", specifier = "==1.8.3" },
-    { name = "black", specifier = "==25.1.0" },
+    { name = "black", specifier = "==26.3.1" },
     { name = "coverage", specifier = "==7.6.12" },
     { name = "docker", specifier = "==7.1.0" },
     { name = "filelock", specifier = "==3.20.3" },
@@ -4173,6 +4179,35 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ec/57/56b9bcc3c9c6a792fcbaf139543cee77261f3651ca9da0c93f5c1221264b/python_dateutil-2.9.0.post0-py2.py3-none-any.whl", hash = "sha256:a8b2bc7bffae282281c8140a97d3aa9c14da0b136dfe83f850eea9a5f7470427", size = 229892, upload-time = "2024-03-01T18:36:18.57Z" },
 ]
 
+[[package]]
+name = "pytokens"
+version = "0.4.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/b6/34/b4e015b99031667a7b960f888889c5bd34ef585c85e1cb56a594b92836ac/pytokens-0.4.1.tar.gz", hash = "sha256:292052fe80923aae2260c073f822ceba21f3872ced9a68bb7953b348e561179a", size = 23015, upload-time = "2026-01-30T01:03:45.924Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/42/24/f206113e05cb8ef51b3850e7ef88f20da6f4bf932190ceb48bd3da103e10/pytokens-0.4.1-cp310-cp310-macosx_11_0_arm64.whl", hash = "sha256:2a44ed93ea23415c54f3face3b65ef2b844d96aeb3455b8a69b3df6beab6acc5", size = 161522, upload-time = "2026-01-30T01:02:50.393Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/e9/06a6bf1b90c2ed81a9c7d2544232fe5d2891d1cd480e8a1809ca354a8eb2/pytokens-0.4.1-cp310-cp310-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:add8bf86b71a5d9fb5b89f023a80b791e04fba57960aa790cc6125f7f1d39dfe", size = 246945, upload-time = "2026-01-30T01:02:52.399Z" },
+    { url = "https://files.pythonhosted.org/packages/69/66/f6fb1007a4c3d8b682d5d65b7c1fb33257587a5f782647091e3408abe0b8/pytokens-0.4.1-cp310-cp310-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:670d286910b531c7b7e3c0b453fd8156f250adb140146d234a82219459b9640c", size = 259525, upload-time = "2026-01-30T01:02:53.737Z" },
+    { url = "https://files.pythonhosted.org/packages/04/92/086f89b4d622a18418bac74ab5db7f68cf0c21cf7cc92de6c7b919d76c88/pytokens-0.4.1-cp310-cp310-musllinux_1_2_x86_64.whl", hash = "sha256:4e691d7f5186bd2842c14813f79f8884bb03f5995f0575272009982c5ac6c0f7", size = 262693, upload-time = "2026-01-30T01:02:54.871Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/7b/8b31c347cf94a3f900bdde750b2e9131575a61fdb620d3d3c75832262137/pytokens-0.4.1-cp310-cp310-win_amd64.whl", hash = "sha256:27b83ad28825978742beef057bfe406ad6ed524b2d28c252c5de7b4a6dd48fa2", size = 103567, upload-time = "2026-01-30T01:02:56.414Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/92/790ebe03f07b57e53b10884c329b9a1a308648fc083a6d4a39a10a28c8fc/pytokens-0.4.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:d70e77c55ae8380c91c0c18dea05951482e263982911fc7410b1ffd1dadd3440", size = 160864, upload-time = "2026-01-30T01:02:57.882Z" },
+    { url = "https://files.pythonhosted.org/packages/13/25/a4f555281d975bfdd1eba731450e2fe3a95870274da73fb12c40aeae7625/pytokens-0.4.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4a58d057208cb9075c144950d789511220b07636dd2e4708d5645d24de666bdc", size = 248565, upload-time = "2026-01-30T01:02:59.912Z" },
+    { url = "https://files.pythonhosted.org/packages/17/50/bc0394b4ad5b1601be22fa43652173d47e4c9efbf0044c62e9a59b747c56/pytokens-0.4.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b49750419d300e2b5a3813cf229d4e5a4c728dae470bcc89867a9ad6f25a722d", size = 260824, upload-time = "2026-01-30T01:03:01.471Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/54/3e04f9d92a4be4fc6c80016bc396b923d2a6933ae94b5f557c939c460ee0/pytokens-0.4.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:d9907d61f15bf7261d7e775bd5d7ee4d2930e04424bab1972591918497623a16", size = 264075, upload-time = "2026-01-30T01:03:04.143Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/1b/44b0326cb5470a4375f37988aea5d61b5cc52407143303015ebee94abfd6/pytokens-0.4.1-cp311-cp311-win_amd64.whl", hash = "sha256:ee44d0f85b803321710f9239f335aafe16553b39106384cef8e6de40cb4ef2f6", size = 103323, upload-time = "2026-01-30T01:03:05.412Z" },
+    { url = "https://files.pythonhosted.org/packages/41/5d/e44573011401fb82e9d51e97f1290ceb377800fb4eed650b96f4753b499c/pytokens-0.4.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:140709331e846b728475786df8aeb27d24f48cbcf7bcd449f8de75cae7a45083", size = 160663, upload-time = "2026-01-30T01:03:06.473Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/e6/5bbc3019f8e6f21d09c41f8b8654536117e5e211a85d89212d59cbdab381/pytokens-0.4.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6d6c4268598f762bc8e91f5dbf2ab2f61f7b95bdc07953b602db879b3c8c18e1", size = 255626, upload-time = "2026-01-30T01:03:08.177Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/3c/2d5297d82286f6f3d92770289fd439956b201c0a4fc7e72efb9b2293758e/pytokens-0.4.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:24afde1f53d95348b5a0eb19488661147285ca4dd7ed752bbc3e1c6242a304d1", size = 269779, upload-time = "2026-01-30T01:03:09.756Z" },
+    { url = "https://files.pythonhosted.org/packages/20/01/7436e9ad693cebda0551203e0bf28f7669976c60ad07d6402098208476de/pytokens-0.4.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5ad948d085ed6c16413eb5fec6b3e02fa00dc29a2534f088d3302c47eb59adf9", size = 268076, upload-time = "2026-01-30T01:03:10.957Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/df/533c82a3c752ba13ae7ef238b7f8cdd272cf1475f03c63ac6cf3fcfb00b6/pytokens-0.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:3f901fe783e06e48e8cbdc82d631fca8f118333798193e026a50ce1b3757ea68", size = 103552, upload-time = "2026-01-30T01:03:12.066Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/dc/08b1a080372afda3cceb4f3c0a7ba2bde9d6a5241f1edb02a22a019ee147/pytokens-0.4.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:8bdb9d0ce90cbf99c525e75a2fa415144fd570a1ba987380190e8b786bc6ef9b", size = 160720, upload-time = "2026-01-30T01:03:13.843Z" },
+    { url = "https://files.pythonhosted.org/packages/64/0c/41ea22205da480837a700e395507e6a24425151dfb7ead73343d6e2d7ffe/pytokens-0.4.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5502408cab1cb18e128570f8d598981c68a50d0cbd7c61312a90507cd3a1276f", size = 254204, upload-time = "2026-01-30T01:03:14.886Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/d2/afe5c7f8607018beb99971489dbb846508f1b8f351fcefc225fcf4b2adc0/pytokens-0.4.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:29d1d8fb1030af4d231789959f21821ab6325e463f0503a61d204343c9b355d1", size = 268423, upload-time = "2026-01-30T01:03:15.936Z" },
+    { url = "https://files.pythonhosted.org/packages/68/d4/00ffdbd370410c04e9591da9220a68dc1693ef7499173eb3e30d06e05ed1/pytokens-0.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:970b08dd6b86058b6dc07efe9e98414f5102974716232d10f32ff39701e841c4", size = 266859, upload-time = "2026-01-30T01:03:17.458Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/c9/c3161313b4ca0c601eeefabd3d3b576edaa9afdefd32da97210700e47652/pytokens-0.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:9bd7d7f544d362576be74f9d5901a22f317efc20046efe2034dced238cbbfe78", size = 103520, upload-time = "2026-01-30T01:03:18.652Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/78/397db326746f0a342855b81216ae1f0a32965deccfd7c830a2dbc66d2483/pytokens-0.4.1-py3-none-any.whl", hash = "sha256:26cef14744a8385f35d0e095dc8b3a7583f6c953c2e3d269c7f82484bf5ad2de", size = 13729, upload-time = "2026-01-30T01:03:45.029Z" },
+]
+
 [[package]]
 name = "pytz"
 version = "2025.1"

From 6b4fb934f8d8b88ecc85571d8adf121b61465db6 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Tue, 16 Jun 2026 20:56:40 +0900
Subject: [PATCH 055/126] feat(azure): add aks_cluster_auto_upgrade_enabled
 check (#11027)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 prowler/CHANGELOG.md                          |  1 +
 .../__init__.py                               |  0
 ...cluster_auto_upgrade_enabled.metadata.json | 38 +++++++
 .../aks_cluster_auto_upgrade_enabled.py       | 28 ++++++
 .../azure/services/aks/aks_service.py         | 56 ++++++++++-
 .../aks_cluster_auto_upgrade_enabled_test.py  | 99 +++++++++++++++++++
 6 files changed, 221 insertions(+), 1 deletion(-)
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.py
 create mode 100644 tests/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index ed24d989e7..4ef065cbbe 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -14,6 +14,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 - `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
+- `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
 
diff --git a/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/__init__.py b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.metadata.json b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.metadata.json
new file mode 100644
index 0000000000..77096d6a20
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "aks_cluster_auto_upgrade_enabled",
+  "CheckTitle": "AKS cluster has automatic upgrade enabled",
+  "CheckType": [],
+  "ServiceName": "aks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.containerservice/managedclusters",
+  "ResourceGroup": "container",
+  "Description": "**AKS clusters** are evaluated for an **automatic upgrade channel** other than `none`. Automatic upgrades keep the Kubernetes control plane and node pools on supported patch/minor versions and reduce version drift across clusters.",
+  "Risk": "Without automatic upgrades, AKS clusters can remain on unsupported or vulnerable Kubernetes versions. Delayed patching increases exposure to **known CVEs**, control plane/node defects, and exploit chains that can affect workload **confidentiality**, **integrity**, and **availability**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/aks/auto-upgrade-cluster",
+    "https://learn.microsoft.com/en-us/azure/aks/supported-kubernetes-versions"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --auto-upgrade-channel patch",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure an AKS automatic upgrade channel so clusters receive Kubernetes version updates and security patches without relying only on manual upgrade processes. Use `patch` or `stable` for conservative production upgrades, reserve faster channels such as `rapid` for environments that can absorb quicker version changes, and avoid `none` unless a documented exception and manual patching process exists.",
+      "Url": "https://hub.prowler.com/check/aks_cluster_auto_upgrade_enabled"
+    }
+  },
+  "Categories": [
+    "vulnerabilities",
+    "cluster-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Automatic upgrade channels can change cluster versions during Azure-managed upgrade windows. Select a channel that matches the workload change tolerance and use planned maintenance windows, staging validation, and documented rollback procedures for production clusters."
+}
diff --git a/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.py b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.py
new file mode 100644
index 0000000000..9d1f8b48a1
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled.py
@@ -0,0 +1,28 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.aks.aks_client import aks_client
+
+
+class aks_cluster_auto_upgrade_enabled(Check):
+    def execute(self) -> list[Check_Report_Azure]:
+        findings = []
+
+        for subscription_name, clusters in aks_client.clusters.items():
+            for cluster in clusters.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
+                report.subscription = subscription_name
+
+                auto_upgrade_channel = (
+                    (cluster.auto_upgrade_channel or "").strip().lower()
+                )
+                if auto_upgrade_channel and auto_upgrade_channel != "none":
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Cluster '{cluster.name}' has auto-upgrade channel."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Cluster '{cluster.name}' does not have auto-upgrade configured."
+
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/aks/aks_service.py b/prowler/providers/azure/services/aks/aks_service.py
index 3d158a2f70..081edd7b17 100644
--- a/prowler/providers/azure/services/aks/aks_service.py
+++ b/prowler/providers/azure/services/aks/aks_service.py
@@ -1,5 +1,5 @@
 from dataclasses import dataclass
-from typing import List
+from typing import List, Optional
 
 from azure.mgmt.containerservice import ContainerServiceClient
 
@@ -55,6 +55,56 @@ class AKS(AzureService):
                                         )
                                     ],
                                     rbac_enabled=getattr(cluster, "enable_rbac", False),
+                                    auto_upgrade_channel=getattr(
+                                        getattr(cluster, "auto_upgrade_profile", None),
+                                        "upgrade_channel",
+                                        None,
+                                    ),
+                                    defender_enabled=bool(
+                                        getattr(
+                                            getattr(
+                                                getattr(
+                                                    getattr(
+                                                        cluster,
+                                                        "security_profile",
+                                                        None,
+                                                    ),
+                                                    "defender",
+                                                    None,
+                                                ),
+                                                "security_monitoring",
+                                                None,
+                                            ),
+                                            "enabled",
+                                            False,
+                                        )
+                                    ),
+                                    azure_monitor_enabled=(
+                                        bool(
+                                            getattr(
+                                                getattr(
+                                                    getattr(
+                                                        cluster,
+                                                        "azure_monitor_profile",
+                                                        None,
+                                                    ),
+                                                    "metrics",
+                                                    None,
+                                                ),
+                                                "enabled",
+                                                False,
+                                            )
+                                        )
+                                        if getattr(
+                                            cluster, "azure_monitor_profile", None
+                                        )
+                                        else False
+                                    ),
+                                    local_accounts_disabled=bool(
+                                        getattr(
+                                            cluster, "disable_local_accounts", False
+                                        )
+                                    ),
                                 )
                             }
                         )
@@ -82,3 +132,7 @@ class Cluster:
     agent_pool_profiles: List[ManagedClusterAgentPoolProfile]
     rbac_enabled: bool
     location: str
+    auto_upgrade_channel: Optional[str] = None
+    defender_enabled: bool = False
+    azure_monitor_enabled: bool = False
+    local_accounts_disabled: bool = False
diff --git a/tests/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled_test.py b/tests/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled_test.py
new file mode 100644
index 0000000000..b7c2ac3bd9
--- /dev/null
+++ b/tests/providers/azure/services/aks/aks_cluster_auto_upgrade_enabled/aks_cluster_auto_upgrade_enabled_test.py
@@ -0,0 +1,99 @@
+from unittest import mock
+
+import pytest
+
+from prowler.providers.azure.services.aks.aks_service import Cluster
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+def build_cluster(auto_upgrade_channel):
+    return Cluster(
+        id="/sub/rg/cluster1",
+        name="test-cluster",
+        public_fqdn="test.azmk8s.io",
+        private_fqdn=None,
+        network_policy=None,
+        agent_pool_profiles=[],
+        rbac_enabled=True,
+        location="eastus",
+        auto_upgrade_channel=auto_upgrade_channel,
+    )
+
+
+class Test_aks_cluster_auto_upgrade_enabled:
+    def test_no_subscriptions(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled.aks_client",
+                new=aks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled import (
+                aks_cluster_auto_upgrade_enabled,
+            )
+
+            aks_client.clusters = {}
+
+            check = aks_cluster_auto_upgrade_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled.aks_client",
+                new=aks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled import (
+                aks_cluster_auto_upgrade_enabled,
+            )
+
+            cluster = build_cluster(auto_upgrade_channel="stable")
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_auto_upgrade_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    @pytest.mark.parametrize("auto_upgrade_channel", [None, "", "none", "None"])
+    def test_fail(self, auto_upgrade_channel):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled.aks_client",
+                new=aks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.aks.aks_cluster_auto_upgrade_enabled.aks_cluster_auto_upgrade_enabled import (
+                aks_cluster_auto_upgrade_enabled,
+            )
+
+            cluster = build_cluster(auto_upgrade_channel=auto_upgrade_channel)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_auto_upgrade_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"

From 0cf48a2c3533ac482408a5a28ebd0426af369479 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= <ruben@prowler.com>
Date: Tue, 16 Jun 2026 14:03:13 +0200
Subject: [PATCH 056/126] fix(gcp): surface organization-scan failures instead
 of silently scanning the home project (#11280)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 .../providers/gcp/authentication.mdx          |  4 ++
 .../user-guide/providers/gcp/organization.mdx | 15 ++++-
 prowler/CHANGELOG.md                          |  1 +
 .../providers/gcp/exceptions/exceptions.py    | 15 ++++-
 prowler/providers/gcp/gcp_provider.py         | 42 ++++++++----
 tests/providers/gcp/gcp_provider_test.py      | 64 +++++++++++++++++++
 6 files changed, 126 insertions(+), 15 deletions(-)

diff --git a/docs/user-guide/providers/gcp/authentication.mdx b/docs/user-guide/providers/gcp/authentication.mdx
index 9447d73a20..ec53445c84 100644
--- a/docs/user-guide/providers/gcp/authentication.mdx
+++ b/docs/user-guide/providers/gcp/authentication.mdx
@@ -138,6 +138,10 @@ To keep permissions focused:
 
 4. Continue through the wizard and finish. No principals need to be granted access in step 3 unless you want other identities to impersonate this account.
 
+<Note>
+To use this service account with `--organization-id`, additionally grant `roles/cloudasset.viewer` at the organization node and enable the Cloud Asset API in the service account's host project. See [Scanning a Specific GCP Organization](./organization). Without these, organization-wide scans silently fall back to listing only the projects accessible to the service account.
+</Note>
+
 ### Step 3: Generate a JSON Key
 
 1. Open the newly created service account, move to the **Keys** tab, and choose **Add key > Create new key**.
diff --git a/docs/user-guide/providers/gcp/organization.mdx b/docs/user-guide/providers/gcp/organization.mdx
index 6f4f7658e5..6790be5827 100644
--- a/docs/user-guide/providers/gcp/organization.mdx
+++ b/docs/user-guide/providers/gcp/organization.mdx
@@ -11,8 +11,19 @@ prowler gcp --organization-id organization-id
 ```
 
 <Warning>
-Ensure the credentials used have one of the following roles at the organization level:
-Cloud Asset Viewer (`roles/cloudasset.viewer`), or Cloud Asset Owner (`roles/cloudasset.owner`).
+Ensure the credentials used have one of the following roles bound **at the organization node** (not at a project): Cloud Asset Viewer (`roles/cloudasset.viewer`) or Cloud Asset Owner (`roles/cloudasset.owner`). The role must be bound directly on the organization so the Cloud Asset API can enumerate projects across the whole hierarchy.
+
+```bash
+gcloud organizations add-iam-policy-binding <organization-id> \
+  --member="serviceAccount:<service-account-email>" \
+  --role="roles/cloudasset.viewer"
+```
+
+The Cloud Asset API (`cloudasset.googleapis.com`) must also be enabled in the project that owns the credentials (the service account's host project, or the quota project for user credentials):
+
+```bash
+gcloud services enable cloudasset.googleapis.com --project <credentials-project-id>
+```
 
 </Warning>
 <Note>
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 4ef065cbbe..ef030c5a71 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -35,6 +35,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 ### 🐞 Fixed
 
 - GCP `logging_log_metric_filter_and_alert_*` checks now credit org-level aggregated sinks filtered to the Admin Activity audit stream [(#11575)](https://github.com/prowler-cloud/prowler/pull/11575)
+- GCP organization scans with `--organization-id` no longer silently fall back to the credentials' host project when the Cloud Asset API call fails; the new `GCPGetOrganizationProjectsError` (3011) is raised instead, naming the required `roles/cloudasset.viewer` binding and Cloud Asset API enablement [(#11280)](https://github.com/prowler-cloud/prowler/pull/11280)
 
 ---
 
diff --git a/prowler/providers/gcp/exceptions/exceptions.py b/prowler/providers/gcp/exceptions/exceptions.py
index 5c5845951c..09cb642cba 100644
--- a/prowler/providers/gcp/exceptions/exceptions.py
+++ b/prowler/providers/gcp/exceptions/exceptions.py
@@ -34,11 +34,17 @@ class GCPBaseException(ProwlerException):
             "message": "Error loading Service Account Private Key credentials from dictionary",
             "remediation": "Check the dictionary and ensure it contains a Service Account Private Key.",
         },
+        (3011, "GCPGetOrganizationProjectsError"): {
+            "message": "Error retrieving projects under the organization via the Cloud Asset API",
+            "remediation": "Ensure the Cloud Asset API is enabled in the credentials' project and that the principal has 'roles/cloudasset.viewer' bound at the organization level. See https://cloud.google.com/asset-inventory/docs/access-control.",
+        },
     }
 
     def __init__(self, code, file=None, original_exception=None, message=None):
         provider = "GCP"
-        error_info = self.GCP_ERROR_CODES.get((code, self.__class__.__name__))
+        # Copy the catalog entry so a custom message does not mutate the
+        # class-level GCP_ERROR_CODES shared across exception instances.
+        error_info = dict(self.GCP_ERROR_CODES.get((code, self.__class__.__name__)))
         if message:
             error_info["message"] = message
         super().__init__(
@@ -104,3 +110,10 @@ class GCPLoadServiceAccountKeyFromDictError(GCPCredentialsError):
         super().__init__(
             3010, file=file, original_exception=original_exception, message=message
         )
+
+
+class GCPGetOrganizationProjectsError(GCPBaseException):
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            3011, file=file, original_exception=original_exception, message=message
+        )
diff --git a/prowler/providers/gcp/gcp_provider.py b/prowler/providers/gcp/gcp_provider.py
index 5017b84c42..39b3392fdf 100644
--- a/prowler/providers/gcp/gcp_provider.py
+++ b/prowler/providers/gcp/gcp_provider.py
@@ -21,6 +21,8 @@ from prowler.providers.common.models import Audit_Metadata, Connection
 from prowler.providers.common.provider import Provider
 from prowler.providers.gcp.config import DEFAULT_RETRY_ATTEMPTS
 from prowler.providers.gcp.exceptions.exceptions import (
+    GCPBaseException,
+    GCPGetOrganizationProjectsError,
     GCPInvalidProviderIdError,
     GCPLoadADCFromDictError,
     GCPLoadServiceAccountKeyFromDictError,
@@ -621,10 +623,7 @@ class GcpProvider(Provider):
             credentials_file: str
 
         Returns:
-            dict[str, GCPProject]
-
-        Usage:
-            >>> GcpProvider.get_projects(credentials=credentials, organization_id=organization_id)
+            dict of project_id and GCPProject object
         """
         projects = {}
         try:
@@ -632,7 +631,10 @@ class GcpProvider(Provider):
                 try:
                     # Initialize Cloud Asset Inventory API for recursive project retrieval
                     asset_service = discovery.build(
-                        "cloudasset", "v1", credentials=credentials
+                        "cloudasset",
+                        "v1",
+                        credentials=credentials,
+                        num_retries=DEFAULT_RETRY_ATTEMPTS,
                     )
                     # Set the scope to the specified organization and filter for projects
                     scope = f"organizations/{organization_id}"
@@ -643,7 +645,7 @@ class GcpProvider(Provider):
                     )
 
                     while request is not None:
-                        response = request.execute()
+                        response = request.execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
 
                         for asset in response.get("assets", []):
                             # Extract labels and other project details
@@ -688,13 +690,25 @@ class GcpProvider(Provider):
                         )
                 except HttpError as http_error:
                     if "Cloud Asset API has not been used" in str(http_error):
-                        logger.error(
-                            f"Projects cannot be retrieved from the Organization since Cloud Asset API has not been used before or it is disabled [{http_error.__traceback__.tb_lineno}]. Enable it by visiting https://console.developers.google.com/apis/api/cloudasset.googleapis.com/ then retry."
+                        message = (
+                            "Projects cannot be retrieved from the Organization since the Cloud Asset API "
+                            "has not been used before or it is disabled. Enable it by visiting "
+                            "https://console.developers.google.com/apis/api/cloudasset.googleapis.com/ then retry."
                         )
                     else:
-                        logger.error(
-                            f"{http_error.__class__.__name__}[{http_error.__traceback__.tb_lineno}]: {http_error}"
+                        message = (
+                            f"Cloud Asset API call failed while listing projects under organization "
+                            f"'{organization_id}': {http_error}. Ensure the credentials' principal has "
+                            "'roles/cloudasset.viewer' bound at the organization level."
                         )
+                    logger.critical(
+                        f"{http_error.__class__.__name__}[{http_error.__traceback__.tb_lineno}]: {message}"
+                    )
+                    raise GCPGetOrganizationProjectsError(
+                        file=__file__,
+                        original_exception=http_error,
+                        message=message,
+                    )
             else:
                 try:
                     # Initialize Cloud Resource Manager API for simple project listing
@@ -781,8 +795,10 @@ class GcpProvider(Provider):
                             labels={},
                             lifecycle_state="ACTIVE",
                         )
-                # If no projects were able to be accessed via API, add them manually from the credentials file
-                elif credentials_file:
+                # If no projects were able to be accessed via API, add them manually from the credentials file.
+                # Skip this fallback when an organization scan was explicitly requested: silently
+                # downgrading scope to the service account's home project hides permission errors.
+                elif credentials_file and not organization_id:
                     with open(credentials_file, "r", encoding="utf-8") as file:
                         project_id = json.load(file)["project_id"]
                         # Handle empty or null project names
@@ -798,6 +814,8 @@ class GcpProvider(Provider):
                             labels={},
                             lifecycle_state="ACTIVE",
                         )
+        except GCPBaseException as gcp_error:
+            raise gcp_error
         except Exception as error:
             logger.critical(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
diff --git a/tests/providers/gcp/gcp_provider_test.py b/tests/providers/gcp/gcp_provider_test.py
index 7d2bea9f88..7b30b828da 100644
--- a/tests/providers/gcp/gcp_provider_test.py
+++ b/tests/providers/gcp/gcp_provider_test.py
@@ -13,6 +13,7 @@ from prowler.config.config import (
 )
 from prowler.providers.common.models import Connection
 from prowler.providers.gcp.exceptions.exceptions import (
+    GCPGetOrganizationProjectsError,
     GCPInvalidProviderIdError,
     GCPNoAccesibleProjectsError,
     GCPTestConnectionError,
@@ -1077,3 +1078,66 @@ class TestGCPProvider:
 
             assert gcp_provider.skip_api_check is True
             mocked_is_api_active.assert_not_called()
+
+    def test_get_projects_organization_id_permission_denied_raises(self):
+        """When --organization-id is set and the Cloud Asset API returns a 403,
+        get_projects must raise GCPGetOrganizationProjectsError instead of
+        silently falling back to the service account's home project.
+
+        Regression test for https://github.com/prowler-cloud/prowler/issues/11250.
+        """
+        from googleapiclient.errors import HttpError
+
+        forbidden_response = MagicMock(status=403, reason="Forbidden")
+        http_error = HttpError(
+            resp=forbidden_response,
+            content=b'{"error": {"code": 403, "message": "Permission denied on resource organization"}}',
+            uri="https://cloudasset.googleapis.com/v1/organizations/123:listAssets",
+        )
+
+        asset_service = MagicMock()
+        asset_service.assets.return_value.list.return_value.execute.side_effect = (
+            http_error
+        )
+
+        with patch(
+            "prowler.providers.gcp.gcp_provider.discovery.build",
+            return_value=asset_service,
+        ):
+            with pytest.raises(GCPGetOrganizationProjectsError):
+                GcpProvider.get_projects(
+                    credentials=MagicMock(),
+                    organization_id="test-organization-id",
+                    credentials_file="test_credentials_file",
+                )
+
+    def test_get_projects_organization_id_cloud_asset_api_disabled_raises(self):
+        """When --organization-id is set and the Cloud Asset API is disabled,
+        get_projects must raise GCPGetOrganizationProjectsError with the
+        enable-API remediation rather than swallowing the error."""
+        from googleapiclient.errors import HttpError
+
+        disabled_response = MagicMock(status=403, reason="Forbidden")
+        http_error = HttpError(
+            resp=disabled_response,
+            content=b'{"error": {"message": "Cloud Asset API has not been used in project 123 before or it is disabled."}}',
+            uri="https://cloudasset.googleapis.com/v1/organizations/123:listAssets",
+        )
+
+        asset_service = MagicMock()
+        asset_service.assets.return_value.list.return_value.execute.side_effect = (
+            http_error
+        )
+
+        with patch(
+            "prowler.providers.gcp.gcp_provider.discovery.build",
+            return_value=asset_service,
+        ):
+            with pytest.raises(GCPGetOrganizationProjectsError) as exc_info:
+                GcpProvider.get_projects(
+                    credentials=MagicMock(),
+                    organization_id="test-organization-id",
+                    credentials_file="test_credentials_file",
+                )
+
+        assert "Cloud Asset API" in str(exc_info.value)

From f21304c6a83feeb2db9f49d74ed121f8155de648 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:17:55 +0200
Subject: [PATCH 057/126] chore(sdk): update dependency pytest to v9 [security]
 (#11291)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
Co-authored-by: Daniel Barranquero <74871504+danibarranqueroo@users.noreply.github.com>
---
 prowler/CHANGELOG.md |  1 +
 pyproject.toml       |  4 ++--
 uv.lock              | 11 ++++++-----
 3 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index ef030c5a71..135cced4a7 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -24,6 +24,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ### 🔐 Security
 
+- `pytest` from 8.3.5 to 9.0.3, patching a known vulnerability in the SDK test dependency [(#11291)](https://github.com/prowler-cloud/prowler/pull/11291)
 - `black` from 25.1.0 to 26.3.1, patching a known vulnerability in the SDK formatter dependency [(#11290)](https://github.com/prowler-cloud/prowler/pull/11290)
 - `microsoft-kiota-*` to 1.9.9 and `aiohttp` to 3.14.0, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
 - Container base image bumped to `python:3.12.13-slim-bookworm` (patches `libgnutls30` CVE-2026-33845 and CVE-2026-42010) and `trivy` bumped to 0.71.0 (patches embedded `golang.org/x/crypto` and Go stdlib CVEs); `.trivyignore` documents remaining bookworm criticals with no-fix or not-affected rationale [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
diff --git a/pyproject.toml b/pyproject.toml
index 5b8f87c218..f3cec52678 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,7 +17,7 @@ dev = [
   "openapi-spec-validator==0.7.1",
   "prek==0.3.9",
   "pylint==3.3.4",
-  "pytest==8.3.5",
+  "pytest==9.0.3",
   "pytest-cov==6.0.0",
   "pytest-env==1.1.5",
   "pytest-randomly==3.16.0",
@@ -320,7 +320,7 @@ constraint-dependencies = [
   "pynacl==1.6.2",
   "pyopenssl==26.2.0",
   "pyparsing==3.3.2",
-  "pytest==8.3.5",
+  "pytest==9.0.3",
   "pytest-cov==6.0.0",
   "pytest-env==1.1.5",
   "pytest-randomly==3.16.0",
diff --git a/uv.lock b/uv.lock
index e2d82196f7..b221255e33 100644
--- a/uv.lock
+++ b/uv.lock
@@ -172,7 +172,7 @@ constraints = [
     { name = "pynacl", specifier = "==1.6.2" },
     { name = "pyopenssl", specifier = "==26.2.0" },
     { name = "pyparsing", specifier = "==3.3.2" },
-    { name = "pytest", specifier = "==8.3.5" },
+    { name = "pytest", specifier = "==9.0.3" },
     { name = "pytest-cov", specifier = "==6.0.0" },
     { name = "pytest-env", specifier = "==1.1.5" },
     { name = "pytest-randomly", specifier = "==3.16.0" },
@@ -3728,7 +3728,7 @@ dev = [
     { name = "openapi-spec-validator", specifier = "==0.7.1" },
     { name = "prek", specifier = "==0.3.9" },
     { name = "pylint", specifier = "==3.3.4" },
-    { name = "pytest", specifier = "==8.3.5" },
+    { name = "pytest", specifier = "==9.0.3" },
     { name = "pytest-cov", specifier = "==6.0.0" },
     { name = "pytest-env", specifier = "==1.1.5" },
     { name = "pytest-randomly", specifier = "==3.16.0" },
@@ -4101,7 +4101,7 @@ wheels = [
 
 [[package]]
 name = "pytest"
-version = "8.3.5"
+version = "9.0.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -4109,11 +4109,12 @@ dependencies = [
     { name = "iniconfig" },
     { name = "packaging" },
     { name = "pluggy" },
+    { name = "pygments" },
     { name = "tomli", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ae/3c/c9d525a414d506893f0cd8a8d0de7706446213181570cdbd766691164e40/pytest-8.3.5.tar.gz", hash = "sha256:f4efe70cc14e511565ac476b57c279e12a855b11f48f212af1080ef2263d3845", size = 1450891, upload-time = "2025-03-02T12:54:54.503Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/30/3d/64ad57c803f1fa1e963a7946b6e0fea4a70df53c1a7fed304586539c2bac/pytest-8.3.5-py3-none-any.whl", hash = "sha256:c69214aa47deac29fad6c2a4f590b9c4a9fdb16a403176fe154b79c0b4d4d820", size = 343634, upload-time = "2025-03-02T12:54:52.069Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
 ]
 
 [[package]]

From 181197177cdfd4500daa0451a9de3fc0c1ecf5d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Pe=C3=B1a?= <adrianjpr@gmail.com>
Date: Tue, 16 Jun 2026 14:18:16 +0200
Subject: [PATCH 058/126] feat(api): only remap SAML user roles when the IdP
 sends userType (#11520)

---
 api/CHANGELOG.md                              |   1 +
 api/src/backend/api/tests/test_views.py       | 175 ++++++++++++++++--
 api/src/backend/api/v1/views.py               | 112 ++++++-----
 .../prowler-app-sso-google-workspace.mdx      |  12 +-
 docs/user-guide/tutorials/prowler-app-sso.mdx |  14 +-
 5 files changed, 234 insertions(+), 80 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index b2084c1969..1aaa3a65ab 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -46,6 +46,7 @@ All notable changes to the **Prowler API** are documented in this file.
 ### 🔄 Changed
 
 - Allowlisted idempotent background tasks are no longer lost when a worker is stopped or crashes mid-task; tasks with external side effects are marked terminal instead of blindly re-running [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
+- SAML logins no longer wipe a user's roles when the IdP does not send the `userType` attribute; existing roles are kept, and when `userType` names a role that does not exist it is now created with read-only access (visibility over all providers, no management permissions) instead of no permissions at all [(#11520)](https://github.com/prowler-cloud/prowler/pull/11520)
 
 ### 🐞 Fixed
 
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index 410bd23e19..67fb6c0663 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -12840,7 +12840,7 @@ class TestTenantFinishACSView:
                 "firstName": ["John"],
                 "lastName": ["Doe"],
                 "organization": ["testing_company"],
-                "userType": ["no_permissions"],
+                "userType": ["platform_team"],
             },
         )
 
@@ -12895,12 +12895,21 @@ class TestTenantFinishACSView:
         assert user.name == "John Doe"
         assert user.company_name == "testing_company"
 
-        role = Role.objects.using(MainRouter.admin_db).get(name="no_permissions")
+        role = Role.objects.using(MainRouter.admin_db).get(
+            name="platform_team", tenant=tenants_fixture[0]
+        )
         assert role.tenant == tenants_fixture[0]
+        assert not role.manage_users
+        assert not role.manage_account
+        assert not role.manage_billing
+        assert not role.manage_providers
+        assert not role.manage_integrations
+        assert not role.manage_scans
+        assert role.unlimited_visibility
 
         assert (
             UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(user=user, tenant_id=tenants_fixture[0].id)
+            .filter(user=user, role=role, tenant_id=tenants_fixture[0].id)
             .exists()
         )
 
@@ -12953,7 +12962,7 @@ class TestTenantFinishACSView:
             assert response.status_code == 302
             assert "sso_saml_failed=true" in response.url
 
-    def test_dispatch_skips_role_mapping_when_single_manage_account_user(
+    def test_dispatch_keeps_existing_roles_when_usertype_missing(
         self,
         create_test_user,
         tenants_fixture,
@@ -12962,7 +12971,7 @@ class TestTenantFinishACSView:
         settings,
         monkeypatch,
     ):
-        """Test that role mapping is skipped when tenant has only one user with MANAGE_ACCOUNT role"""
+        """Test that roles are left untouched when the IdP does not send userType"""
         monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
         user = create_test_user
         tenant = tenants_fixture[0]
@@ -12971,6 +12980,7 @@ class TestTenantFinishACSView:
         UserRoleRelationship.objects.using(MainRouter.admin_db).create(
             user=user, role=admin_role, tenant_id=tenant.id
         )
+        roles_before = Role.objects.using(MainRouter.admin_db).count()
 
         social_account = SocialAccount(
             user=user,
@@ -12979,7 +12989,6 @@ class TestTenantFinishACSView:
                 "firstName": ["John"],
                 "lastName": ["Doe"],
                 "organization": ["testing_company"],
-                "userType": ["no_permissions"],  # This should be ignored
             },
         )
 
@@ -13017,24 +13026,162 @@ class TestTenantFinishACSView:
 
         assert response.status_code == 302
 
-        # Verify the admin role is still assigned (not changed to no_permissions)
+        # Verify the existing role assignment was not modified
         assert (
             UserRoleRelationship.objects.using(MainRouter.admin_db)
             .filter(user=user, role=admin_role, tenant_id=tenant.id)
             .exists()
         )
 
-        # Verify no_permissions role was NOT created in the database
-        assert (
-            not Role.objects.using(MainRouter.admin_db)
-            .filter(name="no_permissions", tenant=tenant)
+        # Verify no new role was created
+        assert Role.objects.using(MainRouter.admin_db).count() == roles_before
+
+    def test_dispatch_assigns_no_role_to_new_user_when_usertype_missing(
+        self,
+        create_test_user,
+        tenants_fixture,
+        saml_setup,
+        settings,
+        monkeypatch,
+    ):
+        """Test that a user without roles gets none assigned when userType is missing"""
+        monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
+        user = create_test_user
+        tenant = tenants_fixture[0]
+        roles_before = Role.objects.using(MainRouter.admin_db).count()
+
+        social_account = SocialAccount(
+            user=user,
+            provider="saml",
+            extra_data={
+                "firstName": ["John"],
+                "lastName": ["Doe"],
+                "organization": ["testing_company"],
+            },
+        )
+
+        request = RequestFactory().get(
+            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+        )
+        request.user = user
+        request.session = {}
+
+        with (
+            patch(
+                "allauth.socialaccount.providers.saml.views.get_app_or_404"
+            ) as mock_get_app_or_404,
+            patch(
+                "allauth.socialaccount.models.SocialApp.objects.get"
+            ) as mock_socialapp_get,
+            patch(
+                "allauth.socialaccount.models.SocialAccount.objects.get"
+            ) as mock_sa_get,
+            patch("api.models.SAMLDomainIndex.objects.get") as mock_saml_domain_get,
+            patch("api.models.SAMLConfiguration.objects.get") as mock_saml_config_get,
+            patch("api.models.User.objects.get") as mock_user_get,
+        ):
+            mock_get_app_or_404.return_value = MagicMock(
+                provider="saml", client_id="testtenant", name="Test App", settings={}
+            )
+            mock_sa_get.return_value = social_account
+            mock_socialapp_get.return_value = MagicMock(provider_id="saml")
+            mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
+            mock_saml_config_get.return_value = MagicMock()
+            mock_user_get.return_value = user
+
+            view = TenantFinishACSView.as_view()
+            response = view(request, organization_slug="testtenant")
+
+        assert response.status_code == 302
+
+        # Verify no role was created or assigned
+        assert Role.objects.using(MainRouter.admin_db).count() == roles_before
+        assert not (
+            UserRoleRelationship.objects.using(MainRouter.admin_db)
+            .filter(user=user, tenant_id=tenant.id)
             .exists()
         )
 
-        # Verify no_permissions role was NOT assigned to the user
-        assert not (
+        # Membership is still created so the user belongs to the tenant
+        assert (
+            Membership.objects.using(MainRouter.admin_db)
+            .filter(user=user, tenant=tenant)
+            .exists()
+        )
+
+    def test_dispatch_skips_role_mapping_when_last_manage_account_user_maps_to_new_role(
+        self,
+        create_test_user,
+        tenants_fixture,
+        admin_role_fixture,
+        saml_setup,
+        settings,
+        monkeypatch,
+    ):
+        """Test that a new read-only role is neither created nor assigned if it would remove the last MANAGE_ACCOUNT user"""
+        monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
+        user = create_test_user
+        tenant = tenants_fixture[0]
+
+        admin_role = admin_role_fixture
+        UserRoleRelationship.objects.using(MainRouter.admin_db).create(
+            user=user, role=admin_role, tenant_id=tenant.id
+        )
+
+        social_account = SocialAccount(
+            user=user,
+            provider="saml",
+            extra_data={
+                "firstName": ["John"],
+                "lastName": ["Doe"],
+                "organization": ["testing_company"],
+                "userType": ["brand_new_role"],
+            },
+        )
+
+        request = RequestFactory().get(
+            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+        )
+        request.user = user
+        request.session = {}
+
+        with (
+            patch(
+                "allauth.socialaccount.providers.saml.views.get_app_or_404"
+            ) as mock_get_app_or_404,
+            patch(
+                "allauth.socialaccount.models.SocialApp.objects.get"
+            ) as mock_socialapp_get,
+            patch(
+                "allauth.socialaccount.models.SocialAccount.objects.get"
+            ) as mock_sa_get,
+            patch("api.models.SAMLDomainIndex.objects.get") as mock_saml_domain_get,
+            patch("api.models.SAMLConfiguration.objects.get") as mock_saml_config_get,
+            patch("api.models.User.objects.get") as mock_user_get,
+        ):
+            mock_get_app_or_404.return_value = MagicMock(
+                provider="saml", client_id="testtenant", name="Test App", settings={}
+            )
+            mock_sa_get.return_value = social_account
+            mock_socialapp_get.return_value = MagicMock(provider_id="saml")
+            mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
+            mock_saml_config_get.return_value = MagicMock()
+            mock_user_get.return_value = user
+
+            view = TenantFinishACSView.as_view()
+            response = view(request, organization_slug="testtenant")
+
+        assert response.status_code == 302
+
+        # The admin role is still assigned and the new role was not created
+        assert (
             UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(user=user, role__name="no_permissions", tenant_id=tenant.id)
+            .filter(user=user, role=admin_role, tenant_id=tenant.id)
+            .exists()
+        )
+        assert (
+            not Role.objects.using(MainRouter.admin_db)
+            .filter(name="brand_new_role", tenant=tenant)
             .exists()
         )
 
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 0942adc8e1..7bcf9a9e69 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -801,60 +801,70 @@ class TenantFinishACSView(FinishACSView):
             .tenant
         )
 
+        # Only remap roles when the IdP provides a userType attribute.
+        # Without it, the user's current roles are left untouched.
         role_name = (
-            extra.get("userType", ["no_permissions"])[0].strip()
-            if extra.get("userType")
-            else "no_permissions"
+            extra.get("userType", [""])[0].strip() if extra.get("userType") else ""
         )
-        role = (
-            Role.objects.using(MainRouter.admin_db)
-            .filter(name=role_name, tenant=tenant)
-            .first()
-        )
-
-        # Only skip mapping if it would remove the last MANAGE_ACCOUNT user
-        remaining_manage_account_users = (
-            UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(role__manage_account=True, tenant_id=tenant.id)
-            .exclude(user_id=user_id)
-            .values("user")
-            .distinct()
-            .count()
-        )
-        user_has_manage_account = (
-            UserRoleRelationship.objects.using(MainRouter.admin_db)
-            .filter(role__manage_account=True, tenant_id=tenant.id, user_id=user_id)
-            .exists()
-        )
-        role_manage_account = role.manage_account if role else False
-        would_remove_last_manage_account = (
-            user_has_manage_account
-            and remaining_manage_account_users == 0
-            and not role_manage_account
-        )
-
-        if not would_remove_last_manage_account:
-            if role is None:
-                role = Role.objects.using(MainRouter.admin_db).create(
-                    name=role_name,
-                    tenant=tenant,
-                    manage_users=False,
-                    manage_account=False,
-                    manage_billing=False,
-                    manage_providers=False,
-                    manage_integrations=False,
-                    manage_scans=False,
-                    unlimited_visibility=False,
+        if role_name:
+            with transaction.atomic(using=MainRouter.admin_db):
+                role = (
+                    Role.objects.using(MainRouter.admin_db)
+                    .filter(name=role_name, tenant=tenant)
+                    .first()
                 )
-            UserRoleRelationship.objects.using(MainRouter.admin_db).filter(
-                user=user,
-                tenant_id=tenant.id,
-            ).delete()
-            UserRoleRelationship.objects.using(MainRouter.admin_db).create(
-                user=user,
-                role=role,
-                tenant_id=tenant.id,
-            )
+
+                # Only skip mapping if it would remove the last MANAGE_ACCOUNT user
+                remaining_manage_account_users = (
+                    UserRoleRelationship.objects.using(MainRouter.admin_db)
+                    .filter(role__manage_account=True, tenant_id=tenant.id)
+                    .exclude(user_id=user_id)
+                    .values("user")
+                    .distinct()
+                    .count()
+                )
+                user_has_manage_account = (
+                    UserRoleRelationship.objects.using(MainRouter.admin_db)
+                    .filter(
+                        role__manage_account=True,
+                        tenant_id=tenant.id,
+                        user_id=user_id,
+                    )
+                    .exists()
+                )
+                role_manage_account = role.manage_account if role else False
+                would_remove_last_manage_account = (
+                    user_has_manage_account
+                    and remaining_manage_account_users == 0
+                    and not role_manage_account
+                )
+
+                if not would_remove_last_manage_account:
+                    if role is None:
+                        # Roles auto-created from userType get read-only access:
+                        # visibility over all providers, no management permissions
+                        role, _ = Role.objects.using(MainRouter.admin_db).get_or_create(
+                            name=role_name,
+                            tenant=tenant,
+                            defaults={
+                                "manage_users": False,
+                                "manage_account": False,
+                                "manage_billing": False,
+                                "manage_providers": False,
+                                "manage_integrations": False,
+                                "manage_scans": False,
+                                "unlimited_visibility": True,
+                            },
+                        )
+                    UserRoleRelationship.objects.using(MainRouter.admin_db).filter(
+                        user=user,
+                        tenant_id=tenant.id,
+                    ).delete()
+                    UserRoleRelationship.objects.using(MainRouter.admin_db).create(
+                        user=user,
+                        role=role,
+                        tenant_id=tenant.id,
+                    )
         membership, _ = Membership.objects.using(MainRouter.admin_db).get_or_create(
             user=user,
             tenant=tenant,
diff --git a/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx b/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx
index 2a349c0204..2f10d443ae 100644
--- a/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx
+++ b/docs/user-guide/tutorials/prowler-app-sso-google-workspace.mdx
@@ -108,10 +108,10 @@ Prowler App updates user attributes each time a user logs in. Any changes made i
 The `userType` attribute controls which Prowler role is assigned to the user:
 
 - If `userType` matches an existing Prowler role name, the user receives that role automatically.
-- If `userType` does not match any existing role, Prowler App creates a new role with that name **without permissions**.
-- If `userType` is not set, the user receives the `no_permissions` role.
+- If `userType` does not match any existing role, Prowler App creates a new role with that name **with read-only access** (visibility over all providers, no management permissions). A Prowler administrator can adjust its permissions afterward through the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab.
+- If `userType` is not set, the user's existing roles are left unchanged.
 
-In all cases where the resulting role has no permissions, a Prowler administrator must configure the appropriate permissions through the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab. The `userType` value is **case-sensitive** - for example, `Backend` and `backend` are treated as different roles.
+The `userType` value is **case-sensitive** - for example, `Backend` and `backend` are treated as different roles.
 
 </Warning>
 
@@ -223,9 +223,9 @@ To test the `userType` → role mapping, set the **Department** attribute in the
 After a successful SSO login, the user profile in Prowler App reflects the attributes sent by Google Workspace:
 
 - **Name**: Populated from the `firstName` and `lastName` attributes.
-- **Role**: Created automatically from the `userType` attribute (e.g., `Backend`). If the role did not exist previously, it is created with no permissions by default.
-- **Permissions**: In the screenshot below, the user has no permissions because the `Backend` role did not exist prior to login and was created automatically without any permissions. To resolve this, a Prowler administrator can either:
-  - Assign the appropriate permissions to the new role via the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab.
+- **Role**: Created automatically from the `userType` attribute (e.g., `Backend`). If the role did not exist previously, it is created with read-only access by default.
+- **Permissions**: If the assigned permissions need to be adjusted, a Prowler administrator can either:
+  - Edit the permissions of the new role via the [RBAC Management](/user-guide/tutorials/prowler-app-rbac) tab.
   - Set the `userType` attribute in the IdP to match an existing Prowler role that already has the desired permissions. The updated role is applied on the next SAML login.
 
 For more details on role assignment behavior and attribute mapping, refer to the [SAML SSO Configuration](/user-guide/tutorials/prowler-app-sso#configure-attribute-mapping-in-the-idp) page.
diff --git a/docs/user-guide/tutorials/prowler-app-sso.mdx b/docs/user-guide/tutorials/prowler-app-sso.mdx
index d4d2c18d11..1e61ec1060 100644
--- a/docs/user-guide/tutorials/prowler-app-sso.mdx
+++ b/docs/user-guide/tutorials/prowler-app-sso.mdx
@@ -87,7 +87,7 @@ Choose a Method:
         |----------------|---------------------------------------------------------------------------------------------------------|----------|
         | `firstName`    | The user's first name.                                                                                  | Yes      |
         | `lastName`     | The user's last name.                                                                                   | Yes      |
-        | `userType`     | Determines which Prowler role the user receives (e.g., `admin`, `auditor`). If a role with that name already exists, the user receives it automatically; if it does not exist, Prowler App creates a new role with that name without permissions. If `userType` is not defined, the user is assigned the `no_permissions` role. Role permissions can be edited in the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac). | No       |
+        | `userType`     | Determines which Prowler role the user receives (e.g., `admin`, `auditor`). If a role with that name already exists, the user receives it automatically; if it does not exist, Prowler App creates a new role with that name with read-only access (visibility over all providers, no management permissions). If `userType` is not defined, the user's existing roles are left unchanged. Role permissions can be edited in the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac). | No       |
         | `organization` | The user's company name.                                                                                | No       |
 
         <Info>
@@ -140,7 +140,7 @@ Choose a Method:
             ![Okta User Profile — First Name and Last Name](/images/prowler-app/saml/okta-user-profile-name.png)
 
             * **Organization** (`organization`): Maps to the company name displayed in Prowler App. This attribute is optional.
-            * **User type** (`userType`): Determines the Prowler role assigned to the user. This attribute is **case-sensitive** and must match the exact name of an existing role in Prowler App.
+            * **User type** (`userType`): Determines the Prowler role assigned to the user. This attribute is **case-sensitive**: if it matches the exact name of an existing role in Prowler App the user receives that role; if no role with that name exists, a new one is created with read-only access.
 
             ![Okta User Profile — User Type and Organization](/images/prowler-app/saml/okta-user-profile-attributes.png)
 
@@ -152,14 +152,10 @@ Choose a Method:
             The `userType` attribute controls which Prowler role is assigned to the user:
 
             * If a role with the specified name already exists in Prowler App, the user automatically receives that role.
-            * If the role does not exist, Prowler App creates a new role with that exact name but without any permissions, preventing the user from performing any actions.
-            * If `userType` is not defined in the user's Okta profile, the user is assigned the `no_permissions` role.
+            * If the role does not exist, Prowler App creates a new role with that exact name with read-only access: the user can see all providers and their findings but cannot manage anything. A Prowler administrator (a user whose role includes the "Manage Account" permission) can adjust its permissions afterward through the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac).
+            * If `userType` is not defined in the user's Okta profile, the user's existing roles in Prowler App are left unchanged.
 
-            In all cases where the resulting role has no permissions, a Prowler administrator (a user whose role includes the "Manage Account" permission) must configure the appropriate permissions through the [RBAC Management tab](/user-guide/tutorials/prowler-app-rbac).
-
-            This behavior is intentional: by defaulting to no permissions, Prowler App ensures that a misconfiguration in Okta cannot inadvertently grant elevated access.
-
-            **Example:** To assign the `IT` role to a user, set the `userType` value to `IT` in Okta. If a role named `IT` already exists in Prowler App, the user receives it automatically upon login. If it does not exist, Prowler App creates a new role called `IT` without permissions, and a Prowler administrator must configure the desired permissions for it.
+            **Example:** To assign the `IT` role to a user, set the `userType` value to `IT` in Okta. If a role named `IT` already exists in Prowler App, the user receives it automatically upon login. If it does not exist, Prowler App creates a new role called `IT` with read-only access, and a Prowler administrator can adjust its permissions as needed.
 
             </Warning>
 

From e4d5ca11b3b68967cea555644ee73cc31962418d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Pe=C3=B1a?= <adrianjpr@gmail.com>
Date: Tue, 16 Jun 2026 14:18:34 +0200
Subject: [PATCH 059/126] feat(api): add provider group filters (#11573)

---
 api/CHANGELOG.md                        |   2 +
 api/src/backend/api/filters.py          | 123 +++-
 api/src/backend/api/tests/test_views.py | 828 +++++++++++++++++++++++-
 api/src/backend/api/v1/mixins.py        | 162 ++++-
 api/src/backend/api/v1/views.py         | 386 ++++++-----
 5 files changed, 1338 insertions(+), 163 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 1aaa3a65ab..f969bb7ffe 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -6,6 +6,8 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ### 🚀 Added
 
+- Provider group filters for API endpoints that support cloud provider filtering, including exact and `__in` variants [(#11573)](https://github.com/prowler-cloud/prowler/pull/11573)
+- Provider filters for `GET /api/v1/compliance-overviews`, `/metadata`, and `/requirements`, using latest completed scans per matching provider [(#11587)](https://github.com/prowler-cloud/prowler/pull/11587)
 - Server-Sent Events (SSE) infrastructure for the API: a base viewset, a tenant-aware channel manager, and channel-name helpers backed by `django-eventstream` over Valkey Pub/Sub and served through the Gunicorn ASGI worker, so feature endpoints can stream events to clients over a single long-lived connection [(#11556)](https://github.com/prowler-cloud/prowler/pull/11556)
 
 ### 🔐 Security
diff --git a/api/src/backend/api/filters.py b/api/src/backend/api/filters.py
index c787d714b1..195982011d 100644
--- a/api/src/backend/api/filters.py
+++ b/api/src/backend/api/filters.py
@@ -102,7 +102,7 @@ class BaseProviderFilter(FilterSet):
     """
     Abstract base filter for models with direct FK to Provider.
 
-    Provides standard provider_id and provider_type filters.
+    Provides standard provider_id, provider_type, and provider_groups filters.
     Subclasses must define Meta.model.
     """
 
@@ -116,6 +116,16 @@ class BaseProviderFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
 
     class Meta:
         abstract = True
@@ -126,7 +136,7 @@ class BaseScanProviderFilter(FilterSet):
     """
     Abstract base filter for models with FK to Scan (and Scan has FK to Provider).
 
-    Provides standard provider_id and provider_type filters via scan relationship.
+    Provides standard provider_id, provider_type, and provider_groups filters via scan relationship.
     Subclasses must define Meta.model.
     """
 
@@ -140,6 +150,16 @@ class BaseScanProviderFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
 
     class Meta:
         abstract = True
@@ -160,6 +180,16 @@ class CommonFindingFilters(FilterSet):
     provider_type__in = ChoiceInFilter(
         choices=Provider.ProviderChoices.choices, field_name="scan__provider__provider"
     )
+    provider_groups = UUIDFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     provider_uid = CharFilter(field_name="scan__provider__uid", lookup_expr="exact")
     provider_uid__in = CharInFilter(field_name="scan__provider__uid", lookup_expr="in")
     provider_uid__icontains = CharFilter(
@@ -370,6 +400,12 @@ class ProviderFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="provider_groups__id", lookup_expr="exact", distinct=True
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider_groups__id", lookup_expr="in", distinct=True
+    )
 
     class Meta:
         model = Provider
@@ -395,6 +431,16 @@ class ProviderRelationshipFilterSet(FilterSet):
     provider_type__in = ChoiceInFilter(
         choices=Provider.ProviderChoices.choices, field_name="provider__provider"
     )
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     provider_uid = CharFilter(field_name="provider__uid", lookup_expr="exact")
     provider_uid__in = CharInFilter(field_name="provider__uid", lookup_expr="in")
     provider_uid__icontains = CharFilter(
@@ -1001,6 +1047,16 @@ class FindingGroupSummaryFilter(_CheckTitleToCheckIdMixin, FilterSet):
         field_name="provider__provider", choices=Provider.ProviderChoices.choices
     )
     provider_type__in = CharInFilter(field_name="provider__provider", lookup_expr="in")
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
 
     class Meta:
         model = FindingGroupDailySummary
@@ -1101,6 +1157,16 @@ class LatestFindingGroupSummaryFilter(_CheckTitleToCheckIdMixin, FilterSet):
         field_name="provider__provider", choices=Provider.ProviderChoices.choices
     )
     provider_type__in = CharInFilter(field_name="provider__provider", lookup_expr="in")
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
 
     class Meta:
         model = FindingGroupDailySummary
@@ -1280,12 +1346,19 @@ class RoleFilter(FilterSet):
         }
 
 
-class ComplianceOverviewFilter(FilterSet):
+class ComplianceOverviewFilter(BaseScanProviderFilter):
+    """
+    Keep provider filters in the schema while runtime filtering resolves scans first.
+
+    Compliance overview provider filters are applied to the latest completed scans
+    in the viewset, then this filterset handles the remaining compliance fields.
+    """
+
     inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date")
-    scan_id = UUIDFilter(field_name="scan_id", required=True)
+    scan_id = UUIDFilter(field_name="scan_id")
     region = CharFilter(field_name="region")
 
-    class Meta:
+    class Meta(BaseScanProviderFilter.Meta):
         model = ComplianceRequirementOverview
         fields = {
             "inserted_at": ["date", "gte", "lte"],
@@ -1306,6 +1379,16 @@ class ScanSummaryFilter(FilterSet):
     provider_type__in = ChoiceInFilter(
         field_name="scan__provider__provider", choices=Provider.ProviderChoices.choices
     )
+    provider_groups = UUIDFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     region = CharFilter(field_name="region")
 
     class Meta:
@@ -1329,6 +1412,16 @@ class DailySeveritySummaryFilter(FilterSet):
     provider_type__in = ChoiceInFilter(
         field_name="provider__provider", choices=Provider.ProviderChoices.choices
     )
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     date_from = DateFilter(method="filter_noop")
     date_to = DateFilter(method="filter_noop")
 
@@ -1585,6 +1678,16 @@ class ThreatScoreSnapshotFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     compliance_id = CharFilter(field_name="compliance_id", lookup_expr="exact")
     compliance_id__in = CharInFilter(field_name="compliance_id", lookup_expr="in")
 
@@ -1628,6 +1731,16 @@ class ResourceGroupOverviewFilter(FilterSet):
         choices=Provider.ProviderChoices.choices,
         lookup_expr="in",
     )
+    provider_groups = UUIDFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="exact",
+        distinct=True,
+    )
+    provider_groups__in = UUIDInFilter(
+        field_name="scan__provider__provider_groups__id",
+        lookup_expr="in",
+        distinct=True,
+    )
     resource_group = CharFilter(field_name="resource_group", lookup_expr="exact")
     resource_group__in = CharInFilter(field_name="resource_group", lookup_expr="in")
 
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index 67fb6c0663..35098c1907 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -1411,6 +1411,42 @@ class TestProviderViewSet:
         )
         assert response.status_code == status.HTTP_400_BAD_REQUEST
 
+    def test_providers_filter_provider_groups(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("provider-list"), {"filter[provider_groups]": str(group1.id)}
+        )
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        assert [item["id"] for item in data] == [str(provider1.id)]
+
+        response = authenticated_client.get(
+            reverse("provider-list"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        provider_ids = {item["id"] for item in response.json()["data"]}
+        assert provider_ids == {str(provider1.id), str(provider2.id)}
+        assert len(response.json()["data"]) == 2
+
     def test_providers_disable_pagination(
         self, authenticated_client, providers_fixture, tenants_fixture
     ):
@@ -3715,6 +3751,41 @@ class TestScanViewSet:
         assert response.status_code == status.HTTP_200_OK
         assert len(response.json()["data"]) == expected_count
 
+    def test_scans_filter_provider_groups(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        scans_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        scan1, scan2, *_ = scans_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=scan1.provider, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=scan1.provider, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=scan2.provider, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("scan-list"), {"filter[provider_groups]": str(group1.id)}
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert {item["id"] for item in response.json()["data"]} == {str(scan1.id)}
+
+        response = authenticated_client.get(
+            reverse("scan-list"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        scan_ids = {item["id"] for item in response.json()["data"]}
+        assert scan_ids == {str(scan1.id), str(scan2.id), str(scans_fixture[2].id)}
+        assert len(response.json()["data"]) == 3
+
     @pytest.mark.parametrize(
         "filter_name",
         [
@@ -5996,6 +6067,49 @@ class TestResourceViewSet:
         assert response.status_code == status.HTTP_200_OK
         assert len(response.json()["data"]) == expected_count
 
+    def test_resource_filter_provider_groups(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        resources_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        resource1, resource2, resource3, *_ = resources_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=resource1.provider, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=resource1.provider, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=resource3.provider, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("resource-list"),
+            {"filter[updated_at]": TODAY, "filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 2
+        assert {item["id"] for item in response.json()["data"]} == {
+            str(resource1.id),
+            str(resource2.id),
+        }
+
+        response = authenticated_client.get(
+            reverse("resource-list"),
+            {
+                "filter[updated_at]": TODAY,
+                "filter[provider_groups__in]": f"{group1.id},{group2.id}",
+            },
+        )
+        assert response.status_code == status.HTTP_200_OK
+        resource_ids = {item["id"] for item in response.json()["data"]}
+        assert resource_ids == {str(resource1.id), str(resource2.id), str(resource3.id)}
+        assert len(response.json()["data"]) == 3
+
     def test_resource_filter_by_scan_id(
         self, authenticated_client, resources_fixture, scans_fixture
     ):
@@ -7308,6 +7422,40 @@ class TestFindingViewSet:
         assert response.status_code == status.HTTP_200_OK
         assert len(response.json()["data"]) == 2
 
+    def test_finding_filter_provider_groups(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        findings_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        finding1, finding2, *_ = findings_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=finding1.scan.provider, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=finding1.scan.provider, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("finding-list"),
+            {"filter[inserted_at]": TODAY, "filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 2
+
+        response = authenticated_client.get(
+            reverse("finding-list"),
+            {
+                "filter[inserted_at]": TODAY,
+                "filter[provider_groups__in]": f"{group1.id},{group2.id}",
+            },
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 2
+
     @pytest.mark.parametrize(
         "filter_name",
         (
@@ -9278,6 +9426,118 @@ class TestComplianceOverviewViewSet:
         with patch("api.v1.views.backfill_compliance_summaries_task.delay") as mock:
             yield mock
 
+    def _create_completed_scan(self, provider, name):
+        return Scan.objects.create(
+            name=name,
+            provider=provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=provider.tenant_id,
+            started_at=datetime.now(timezone.utc),
+            completed_at=datetime.now(timezone.utc),
+        )
+
+    def _create_requirement(
+        self,
+        scan,
+        requirement_id,
+        status_choice,
+        region="eu-west-1",
+        compliance_id="cis_1.4_aws",
+    ):
+        passed = 1 if status_choice == StatusChoices.PASS else 0
+        total = 1 if status_choice != StatusChoices.MANUAL else 0
+        return ComplianceRequirementOverview.objects.create(
+            tenant_id=scan.tenant_id,
+            scan=scan,
+            compliance_id=compliance_id,
+            framework="CIS-1.4-AWS",
+            version="1.4",
+            description="CIS AWS Foundations Benchmark v1.4.0",
+            region=region,
+            requirement_id=requirement_id,
+            requirement_status=status_choice,
+            passed_checks=passed,
+            failed_checks=0
+            if status_choice in (StatusChoices.PASS, StatusChoices.MANUAL)
+            else 1,
+            total_checks=total,
+            passed_findings=passed,
+            total_findings=total,
+        )
+
+    def _create_compliance_summary(
+        self,
+        scan,
+        *,
+        passed,
+        failed,
+        manual=0,
+        compliance_id="cis_1.4_aws",
+    ):
+        return ComplianceOverviewSummary.objects.create(
+            tenant_id=scan.tenant_id,
+            scan=scan,
+            compliance_id=compliance_id,
+            requirements_passed=passed,
+            requirements_failed=failed,
+            requirements_manual=manual,
+            total_requirements=passed + failed + manual,
+        )
+
+    def _overview_attrs_by_id(self, response):
+        assert response.status_code == status.HTTP_200_OK
+        return {item["id"]: item["attributes"] for item in response.json()["data"]}
+
+    def _prepare_latest_compliance_data(self, providers_fixture):
+        provider1, provider2, provider3, *_ = providers_fixture
+        old_scan = self._create_completed_scan(provider1, "old aws compliance scan")
+        latest_scan1 = self._create_completed_scan(
+            provider1, "latest aws compliance scan 1"
+        )
+        latest_scan2 = self._create_completed_scan(
+            provider2, "latest aws compliance scan 2"
+        )
+        latest_gcp_scan = self._create_completed_scan(
+            provider3, "latest gcp compliance scan"
+        )
+
+        self._create_requirement(old_scan, "1.1", StatusChoices.FAIL)
+        self._create_requirement(old_scan, "1.2", StatusChoices.FAIL)
+        self._create_compliance_summary(old_scan, passed=0, failed=2)
+
+        self._create_requirement(
+            latest_scan1, "1.1", StatusChoices.PASS, region="eu-west-1"
+        )
+        self._create_requirement(
+            latest_scan1, "1.2", StatusChoices.PASS, region="eu-west-1"
+        )
+        self._create_compliance_summary(latest_scan1, passed=2, failed=0)
+
+        self._create_requirement(
+            latest_scan2, "1.1", StatusChoices.FAIL, region="us-east-1"
+        )
+        self._create_requirement(
+            latest_scan2, "1.2", StatusChoices.PASS, region="us-east-1"
+        )
+        self._create_compliance_summary(latest_scan2, passed=1, failed=1)
+
+        self._create_requirement(
+            latest_gcp_scan,
+            "gcp-1.1",
+            StatusChoices.FAIL,
+            region="europe-west1",
+            compliance_id="cis_1.3_gcp",
+        )
+        self._create_compliance_summary(
+            latest_gcp_scan,
+            passed=0,
+            failed=1,
+            compliance_id="cis_1.3_gcp",
+        )
+
+        return old_scan, latest_scan1, latest_scan2, latest_gcp_scan
+
     def test_compliance_overview_list_none(
         self,
         authenticated_client,
@@ -9425,6 +9685,283 @@ class TestComplianceOverviewViewSet:
         assert len(response.json()["data"]) >= 1
         mock_backfill_task.assert_not_called()
 
+    def test_compliance_overview_provider_id_filter_uses_latest_scan(
+        self,
+        authenticated_client,
+        providers_fixture,
+        mock_backfill_task,
+    ):
+        _, latest_scan, *_ = self._prepare_latest_compliance_data(providers_fixture)
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {"filter[provider_id]": str(latest_scan.provider_id)},
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 2
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 0
+        assert "cis_1.3_gcp" not in attrs_by_id
+        mock_backfill_task.assert_not_called()
+
+    def test_compliance_overview_provider_id_in_filter_aggregates_latest_scans(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        _, latest_scan1, latest_scan2, *_ = self._prepare_latest_compliance_data(
+            providers_fixture
+        )
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {
+                "filter[provider_id__in]": (
+                    f"{latest_scan1.provider_id},{latest_scan2.provider_id}"
+                )
+            },
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["total_requirements"] == 2
+        assert "cis_1.3_gcp" not in attrs_by_id
+
+    def test_compliance_overview_provider_type_filter_uses_latest_scans(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        self._prepare_latest_compliance_data(providers_fixture)
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {"filter[provider_type]": Provider.ProviderChoices.AWS.value},
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["total_requirements"] == 2
+        assert "cis_1.3_gcp" not in attrs_by_id
+
+    def test_compliance_overview_provider_groups_filters_use_latest_scans(
+        self,
+        authenticated_client,
+        providers_fixture,
+        provider_groups_fixture,
+        tenants_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        _, latest_scan1, latest_scan2, *_ = self._prepare_latest_compliance_data(
+            providers_fixture
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id,
+            provider=provider1,
+            provider_group=group1,
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id,
+            provider=provider2,
+            provider_group=group2,
+        )
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {"filter[provider_groups]": str(group1.id)},
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 2
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 0
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-list"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+
+        attrs_by_id = self._overview_attrs_by_id(response)
+        assert attrs_by_id["cis_1.4_aws"]["requirements_passed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["requirements_failed"] == 1
+        assert attrs_by_id["cis_1.4_aws"]["total_requirements"] == 2
+
+    def _assert_latest_provider_scan_task_response(
+        self,
+        authenticated_client,
+        endpoint,
+        scan,
+        query_params=None,
+    ):
+        query_params = {**(query_params or {})}
+        if not any(key.startswith("filter[provider_") for key in query_params):
+            query_params = {
+                "filter[provider_id]": str(scan.provider_id),
+                **query_params,
+            }
+
+        with patch.object(
+            ComplianceOverviewViewSet, "get_task_response_if_running"
+        ) as mock_task_response:
+            mock_task_response.return_value = Response(
+                {"detail": "Task is running"}, status=status.HTTP_202_ACCEPTED
+            )
+
+            response = authenticated_client.get(reverse(endpoint), query_params)
+
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        mock_task_response.assert_called_once()
+        _, kwargs = mock_task_response.call_args
+        assert kwargs["task_name"] == "scan-compliance-overviews"
+        assert str(kwargs["task_kwargs"]["tenant_id"]) == str(scan.tenant_id)
+        assert str(kwargs["task_kwargs"]["scan_id"]) == str(scan.id)
+        assert kwargs["raise_on_not_found"] is False
+
+    def test_compliance_overview_provider_filter_returns_running_task_without_data(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        scan = self._create_completed_scan(
+            providers_fixture[0], "latest scan without compliance data"
+        )
+
+        self._assert_latest_provider_scan_task_response(
+            authenticated_client,
+            "complianceoverview-list",
+            scan,
+        )
+
+    def test_compliance_overview_provider_filter_returns_running_task_for_partial_data(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        provider_with_data, provider_without_data, *_ = providers_fixture
+        scan_with_data = self._create_completed_scan(
+            provider_with_data, "latest scan with compliance data"
+        )
+        scan_without_data = self._create_completed_scan(
+            provider_without_data, "latest scan without partial compliance data"
+        )
+        self._create_requirement(scan_with_data, "1.1", StatusChoices.PASS)
+
+        self._assert_latest_provider_scan_task_response(
+            authenticated_client,
+            "complianceoverview-list",
+            scan_without_data,
+            {
+                "filter[provider_id__in]": (
+                    f"{provider_with_data.id},{provider_without_data.id}"
+                )
+            },
+        )
+
+    def test_compliance_overview_provider_filter_empty_response_uses_scan_data_presence(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        scan = self._create_completed_scan(
+            providers_fixture[0], "latest scan with filtered compliance data"
+        )
+        self._create_requirement(scan, "1.1", StatusChoices.PASS, region="eu-west-1")
+
+        with patch.object(
+            ComplianceOverviewViewSet, "get_task_response_if_running"
+        ) as mock_task_response:
+            mock_task_response.return_value = Response(
+                {"detail": "Task is running"}, status=status.HTTP_202_ACCEPTED
+            )
+
+            response = authenticated_client.get(
+                reverse("complianceoverview-list"),
+                {
+                    "filter[provider_id]": str(scan.provider_id),
+                    "filter[region]": "us-east-1",
+                },
+            )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json()["data"] == []
+        mock_task_response.assert_not_called()
+
+    def test_compliance_overview_metadata_provider_filter_returns_running_task_without_data(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        scan = self._create_completed_scan(
+            providers_fixture[0], "latest scan without compliance metadata"
+        )
+
+        self._assert_latest_provider_scan_task_response(
+            authenticated_client,
+            "complianceoverview-metadata",
+            scan,
+        )
+
+    def test_compliance_overview_requirements_provider_filter_returns_running_task_without_data(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        scan = self._create_completed_scan(
+            providers_fixture[0], "latest scan without compliance requirements"
+        )
+
+        self._assert_latest_provider_scan_task_response(
+            authenticated_client,
+            "complianceoverview-requirements",
+            scan,
+            {"filter[compliance_id]": "cis_1.4_aws"},
+        )
+
+    def test_compliance_overview_metadata_accepts_provider_filters(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        _, latest_scan, *_ = self._prepare_latest_compliance_data(providers_fixture)
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-metadata"),
+            {"filter[provider_id]": str(latest_scan.provider_id)},
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        regions = response.json()["data"]["attributes"]["regions"]
+        assert regions == ["eu-west-1"]
+
+    def test_compliance_overview_requirements_accepts_provider_filters(
+        self,
+        authenticated_client,
+        providers_fixture,
+    ):
+        _, latest_scan1, latest_scan2, *_ = self._prepare_latest_compliance_data(
+            providers_fixture
+        )
+
+        response = authenticated_client.get(
+            reverse("complianceoverview-requirements"),
+            {
+                "filter[provider_id__in]": (
+                    f"{latest_scan1.provider_id},{latest_scan2.provider_id}"
+                ),
+                "filter[compliance_id]": "cis_1.4_aws",
+            },
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        requirements_by_id = {
+            item["id"]: item["attributes"] for item in response.json()["data"]
+        }
+        assert requirements_by_id["1.1"]["status"] == "FAIL"
+        assert requirements_by_id["1.2"]["status"] == "PASS"
+
     def test_compliance_overview_metadata(
         self, authenticated_client, compliance_requirements_overviews_fixture
     ):
@@ -10031,6 +10568,40 @@ class TestOverviewViewSet:
         for entry in grouped_data:
             assert "findings" not in entry["attributes"]
 
+    def test_overview_providers_count_applies_limited_visibility(
+        self,
+        authenticated_client_no_permissions_rbac,
+        providers_fixture,
+        provider_groups_fixture,
+        tenants_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        client = authenticated_client_no_permissions_rbac
+        allowed_provider = providers_fixture[2]
+        denied_provider = providers_fixture[4]
+        provider_group = provider_groups_fixture[0]
+
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id,
+            provider_group=provider_group,
+            provider=allowed_provider,
+        )
+        RoleProviderGroupRelationship.objects.create(
+            tenant_id=tenant.id,
+            role=client.user.roles.first(),
+            provider_group=provider_group,
+        )
+
+        response = client.get(reverse("overview-providers-count"))
+
+        assert response.status_code == status.HTTP_200_OK
+        aggregated = {
+            entry["id"]: entry["attributes"]["count"]
+            for entry in response.json()["data"]
+        }
+        assert aggregated == {allowed_provider.provider: 1}
+        assert denied_provider.provider not in aggregated
+
     def _create_scan(self, tenant, provider, name, started_at=None):
         scan_started = started_at or datetime.now(timezone.utc) - timedelta(hours=1)
         return Scan.objects.create(
@@ -10578,6 +11149,87 @@ class TestOverviewViewSet:
         assert combined_attributes["muted"] == 3
         assert combined_attributes["total"] == 14
 
+    def test_overview_findings_provider_groups_filter(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        scan1 = Scan.objects.create(
+            name="scan-provider-group-one",
+            provider=provider1,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant=tenant,
+        )
+        scan2 = Scan.objects.create(
+            name="scan-provider-group-two",
+            provider=provider2,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant=tenant,
+        )
+        ScanSummary.objects.create(
+            tenant=tenant,
+            scan=scan1,
+            check_id="check-provider-group-one",
+            service="service-a",
+            severity="high",
+            region="region-a",
+            _pass=5,
+            fail=1,
+            muted=2,
+            total=8,
+        )
+        ScanSummary.objects.create(
+            tenant=tenant,
+            scan=scan2,
+            check_id="check-provider-group-two",
+            service="service-b",
+            severity="medium",
+            region="region-b",
+            _pass=2,
+            fail=3,
+            muted=1,
+            total=6,
+        )
+
+        response = authenticated_client.get(
+            reverse("overview-findings"),
+            {"filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        attributes = response.json()["data"]["attributes"]
+        assert attributes["pass"] == 5
+        assert attributes["fail"] == 1
+        assert attributes["muted"] == 2
+        assert attributes["total"] == 8
+
+        response = authenticated_client.get(
+            reverse("overview-findings"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        attributes = response.json()["data"]["attributes"]
+        assert attributes["pass"] == 7
+        assert attributes["fail"] == 4
+        assert attributes["muted"] == 3
+        assert attributes["total"] == 14
+
     def test_overview_findings_severity_provider_id_in_filter(
         self, authenticated_client, tenants_fixture, providers_fixture
     ):
@@ -11346,9 +11998,21 @@ class TestOverviewViewSet:
     @pytest.mark.parametrize(
         "filter_key,filter_value_fn,expected_total,expected_failed",
         [
-            ("filter[provider_id]", lambda p1, _: str(p1.id), 10, 5),
+            ("filter[provider_id]", lambda p1, *_: str(p1.id), 10, 5),
             ("filter[provider_type]", lambda *_: "aws", 10, 5),
             ("filter[provider_type__in]", lambda *_: "aws,gcp", 30, 20),
+            (
+                "filter[provider_groups]",
+                lambda p1, _, group1, __: str(group1.id),
+                10,
+                5,
+            ),
+            (
+                "filter[provider_groups__in]",
+                lambda p1, _, group1, group2: f"{group1.id},{group2.id}",
+                30,
+                20,
+            ),
         ],
     )
     def test_overview_categories_filters(
@@ -11356,6 +12020,7 @@ class TestOverviewViewSet:
         authenticated_client,
         tenants_fixture,
         providers_fixture,
+        provider_groups_fixture,
         create_scan_category_summary,
         filter_key,
         filter_value_fn,
@@ -11364,6 +12029,16 @@ class TestOverviewViewSet:
     ):
         tenant = tenants_fixture[0]
         provider1, _, gcp_provider, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=gcp_provider, provider_group=group2
+        )
 
         scan1 = Scan.objects.create(
             name="categories-scan-1",
@@ -11389,7 +12064,7 @@ class TestOverviewViewSet:
 
         response = authenticated_client.get(
             reverse("overview-categories"),
-            {filter_key: filter_value_fn(provider1, gcp_provider)},
+            {filter_key: filter_value_fn(provider1, gcp_provider, group1, group2)},
         )
         assert response.status_code == status.HTTP_200_OK
         data = response.json()["data"]
@@ -11563,10 +12238,22 @@ class TestOverviewViewSet:
     @pytest.mark.parametrize(
         "filter_key,filter_value_fn,expected_total,expected_failed",
         [
-            ("filter[provider_id]", lambda p1, p2: str(p1.id), 10, 5),
-            ("filter[provider_id__in]", lambda p1, p2: f"{p1.id},{p2.id}", 25, 12),
-            ("filter[provider_type]", lambda p1, p2: "aws", 10, 5),
-            ("filter[provider_type__in]", lambda p1, p2: "aws,gcp", 25, 12),
+            ("filter[provider_id]", lambda p1, *_: str(p1.id), 10, 5),
+            ("filter[provider_id__in]", lambda p1, p2, *_: f"{p1.id},{p2.id}", 25, 12),
+            ("filter[provider_type]", lambda *_: "aws", 10, 5),
+            ("filter[provider_type__in]", lambda *_: "aws,gcp", 25, 12),
+            (
+                "filter[provider_groups]",
+                lambda p1, p2, group1, group2: str(group1.id),
+                10,
+                5,
+            ),
+            (
+                "filter[provider_groups__in]",
+                lambda p1, p2, group1, group2: f"{group1.id},{group2.id}",
+                25,
+                12,
+            ),
         ],
     )
     def test_overview_groups_provider_filters(
@@ -11574,6 +12261,7 @@ class TestOverviewViewSet:
         authenticated_client,
         tenants_fixture,
         providers_fixture,
+        provider_groups_fixture,
         create_scan_resource_group_summary,
         filter_key,
         filter_value_fn,
@@ -11583,6 +12271,16 @@ class TestOverviewViewSet:
         tenant = tenants_fixture[0]
         provider1 = providers_fixture[0]  # AWS
         gcp_provider = providers_fixture[2]  # GCP
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=gcp_provider, provider_group=group2
+        )
 
         scan1 = Scan.objects.create(
             name="aws-rg-scan",
@@ -11608,7 +12306,7 @@ class TestOverviewViewSet:
 
         response = authenticated_client.get(
             reverse("overview-resource-groups"),
-            {filter_key: filter_value_fn(provider1, gcp_provider)},
+            {filter_key: filter_value_fn(provider1, gcp_provider, group1, group2)},
         )
         assert response.status_code == status.HTTP_200_OK
         data = response.json()["data"]
@@ -11783,6 +12481,49 @@ class TestOverviewViewSet:
         data = response.json()["data"]
         assert len(data) >= 1
 
+    def test_compliance_watchlist_provider_groups_filter(
+        self,
+        authenticated_client,
+        provider_compliance_scores_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+        tenants_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("overview-compliance-watchlist"),
+            {"filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        by_id = {item["id"]: item["attributes"] for item in data}
+        assert by_id["aws_cis_2.0"]["requirements_passed"] == 1
+        assert by_id["aws_cis_2.0"]["requirements_failed"] == 1
+        assert by_id["aws_cis_2.0"]["requirements_manual"] == 1
+
+        response = authenticated_client.get(
+            reverse("overview-compliance-watchlist"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        by_id = {item["id"]: item["attributes"] for item in data}
+        assert by_id["aws_cis_2.0"]["requirements_passed"] == 0
+        assert by_id["aws_cis_2.0"]["requirements_failed"] == 2
+        assert by_id["aws_cis_2.0"]["requirements_manual"] == 1
+
     def test_compliance_watchlist_empty_result(self, authenticated_client):
         response = authenticated_client.get(reverse("overview-compliance-watchlist"))
         assert response.status_code == status.HTTP_200_OK
@@ -17082,6 +17823,44 @@ class TestFindingGroupViewSet:
         # All fixture findings are from AWS provider
         assert len(response.json()["data"]) == 5
 
+    def test_finding_groups_provider_groups_filter(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        finding_groups_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("finding-group-list"),
+            {"filter[inserted_at]": TODAY, "filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 4
+
+        response = authenticated_client.get(
+            reverse("finding-group-list"),
+            {
+                "filter[inserted_at]": TODAY,
+                "filter[provider_groups__in]": f"{group1.id},{group2.id}",
+            },
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 5
+
     def test_finding_groups_check_id_filter(
         self, authenticated_client, finding_groups_fixture
     ):
@@ -17992,6 +18771,41 @@ class TestFindingGroupViewSet:
         # All providers in fixture are AWS
         assert len(data) == 5
 
+    def test_finding_groups_latest_provider_groups_filter(
+        self,
+        authenticated_client,
+        tenants_fixture,
+        finding_groups_fixture,
+        providers_fixture,
+        provider_groups_fixture,
+    ):
+        tenant = tenants_fixture[0]
+        provider1, provider2, *_ = providers_fixture
+        group1, group2, *_ = provider_groups_fixture
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group1
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider1, provider_group=group2
+        )
+        ProviderGroupMembership.objects.create(
+            tenant=tenant, provider=provider2, provider_group=group2
+        )
+
+        response = authenticated_client.get(
+            reverse("finding-group-latest"),
+            {"filter[provider_groups]": str(group1.id)},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 4
+
+        response = authenticated_client.get(
+            reverse("finding-group-latest"),
+            {"filter[provider_groups__in]": f"{group1.id},{group2.id}"},
+        )
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == 5
+
     def test_finding_groups_latest_check_id_filter(
         self, authenticated_client, finding_groups_fixture
     ):
diff --git a/api/src/backend/api/v1/mixins.py b/api/src/backend/api/v1/mixins.py
index e1a5d3470f..849c788366 100644
--- a/api/src/backend/api/v1/mixins.py
+++ b/api/src/backend/api/v1/mixins.py
@@ -1,6 +1,10 @@
+import uuid
+
+from django.http import QueryDict
 from django.urls import reverse
 from django_celery_results.models import TaskResult
 from rest_framework import status
+from rest_framework.exceptions import ValidationError
 from rest_framework.response import Response
 
 from api.exceptions import (
@@ -8,7 +12,7 @@ from api.exceptions import (
     TaskInProgressException,
     TaskNotFoundException,
 )
-from api.models import StateChoices, Task
+from api.models import Provider, StateChoices, Task
 from api.v1.serializers import TaskSerializer
 
 
@@ -74,6 +78,162 @@ class PaginateByPkMixin:
         return self.get_paginated_response(serialized)
 
 
+class JsonApiFilterMixin:
+    """Shared helpers for manually applying django-filter to JSON:API params."""
+
+    jsonapi_filter_replace_dots = False
+
+    def _normalize_jsonapi_params(
+        self,
+        query_params,
+        exclude_keys=None,
+        replace_dots=None,
+    ):
+        exclude_keys = exclude_keys or set()
+        if replace_dots is None:
+            replace_dots = self.jsonapi_filter_replace_dots
+
+        normalized = QueryDict(mutable=True)
+        for key, values in query_params.lists():
+            normalized_key = (
+                key[7:-1] if key.startswith("filter[") and key.endswith("]") else key
+            )
+            if replace_dots:
+                normalized_key = normalized_key.replace(".", "__")
+            if normalized_key not in exclude_keys:
+                normalized.setlist(normalized_key, values)
+        return normalized
+
+    def _apply_filterset(
+        self,
+        queryset,
+        filterset_class,
+        exclude_keys=None,
+        replace_dots=None,
+    ):
+        normalized_params = self._normalize_jsonapi_params(
+            self.request.query_params,
+            exclude_keys=set(exclude_keys or []),
+            replace_dots=replace_dots,
+        )
+        filterset = filterset_class(normalized_params, queryset=queryset)
+        if not filterset.is_valid():
+            raise ValidationError(filterset.errors)
+        return filterset.qs
+
+
+class ProviderFilterParamsMixin(JsonApiFilterMixin):
+    """Shared extraction of provider filters from JSON:API query params."""
+
+    PROVIDER_FILTER_KEYS = frozenset(
+        {
+            "provider_id",
+            "provider_id__in",
+            "provider_type",
+            "provider_type__in",
+            "provider_groups",
+            "provider_groups__in",
+        }
+    )
+    PROVIDER_FILTER_DOT_ALIAS_KEYS = frozenset(
+        {
+            "provider_id.in",
+            "provider_type.in",
+            "provider_groups.in",
+        }
+    )
+    PROVIDER_FILTER_QUERY_KEYS = PROVIDER_FILTER_KEYS | PROVIDER_FILTER_DOT_ALIAS_KEYS
+
+    def _csv_filter_values(self, value):
+        return [item.strip() for item in value.split(",") if item.strip()]
+
+    def _validate_uuid_filter_values(self, field_name, values):
+        try:
+            for value in values:
+                uuid.UUID(str(value))
+        except (TypeError, ValueError, AttributeError):
+            raise ValidationError({field_name: ["Enter a valid UUID."]})
+
+    def _has_provider_filters(self, include_dot_aliases=False):
+        provider_filter_keys = (
+            self.PROVIDER_FILTER_QUERY_KEYS
+            if include_dot_aliases
+            else self.PROVIDER_FILTER_KEYS
+        )
+        return any(
+            self.request.query_params.get(f"filter[{key}]")
+            for key in provider_filter_keys
+        )
+
+    def _extract_provider_filters_from_params(
+        self,
+        *,
+        validate_uuids=False,
+        include_dot_aliases=False,
+    ):
+        params = self.request.query_params
+        filters = {}
+        valid_provider_types = {
+            choice[0] for choice in Provider.ProviderChoices.choices
+        }
+
+        provider_id = params.get("filter[provider_id]")
+        if provider_id:
+            if validate_uuids:
+                self._validate_uuid_filter_values("provider_id", [provider_id])
+            filters["provider_id"] = provider_id
+
+        provider_id_in = params.get("filter[provider_id__in]")
+        if include_dot_aliases:
+            provider_id_in = provider_id_in or params.get("filter[provider_id.in]")
+        if provider_id_in:
+            values = self._csv_filter_values(provider_id_in)
+            if validate_uuids:
+                self._validate_uuid_filter_values("provider_id__in", values)
+            filters["provider_id__in"] = values
+
+        provider_type = params.get("filter[provider_type]")
+        if provider_type:
+            if provider_type not in valid_provider_types:
+                raise ValidationError(
+                    {"provider_type": f"Invalid choice: {provider_type}"}
+                )
+            filters["provider__provider"] = provider_type
+
+        provider_type_in = params.get("filter[provider_type__in]")
+        if include_dot_aliases:
+            provider_type_in = provider_type_in or params.get(
+                "filter[provider_type.in]"
+            )
+        if provider_type_in:
+            values = self._csv_filter_values(provider_type_in)
+            invalid = [value for value in values if value not in valid_provider_types]
+            if invalid:
+                raise ValidationError(
+                    {"provider_type__in": f"Invalid choices: {', '.join(invalid)}"}
+                )
+            filters["provider__provider__in"] = values
+
+        provider_groups = params.get("filter[provider_groups]")
+        if provider_groups:
+            if validate_uuids:
+                self._validate_uuid_filter_values("provider_groups", [provider_groups])
+            filters["provider__provider_groups__id"] = provider_groups
+
+        provider_groups_in = params.get("filter[provider_groups__in]")
+        if include_dot_aliases:
+            provider_groups_in = provider_groups_in or params.get(
+                "filter[provider_groups.in]"
+            )
+        if provider_groups_in:
+            values = self._csv_filter_values(provider_groups_in)
+            if validate_uuids:
+                self._validate_uuid_filter_values("provider_groups__in", values)
+            filters["provider__provider_groups__id__in"] = values
+
+        return filters
+
+
 class TaskManagementMixin:
     """
     Mixin to manage task status checking.
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 7bcf9a9e69..7e9aae5b94 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -228,7 +228,13 @@ from api.utils import (
     validate_invitation,
 )
 from api.uuid_utils import datetime_to_uuid7, uuid7_start
-from api.v1.mixins import DisablePaginationMixin, PaginateByPkMixin, TaskManagementMixin
+from api.v1.mixins import (
+    DisablePaginationMixin,
+    JsonApiFilterMixin,
+    PaginateByPkMixin,
+    ProviderFilterParamsMixin,
+    TaskManagementMixin,
+)
 from api.v1.serializers import (
     AttackPathsCartographySchemaSerializer,
     AttackPathsCustomQueryRunRequestSerializer,
@@ -4556,15 +4562,19 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
 @extend_schema_view(
     list=extend_schema(
         tags=["Compliance Overview"],
-        summary="List compliance overviews for a scan",
-        description="Retrieve an overview of all the compliance in a given scan.",
+        summary="List compliance overviews",
+        description=(
+            "Retrieve compliance overview data for a scan. When provider filters "
+            "are provided, the endpoint uses the latest completed scan for each "
+            "matching provider."
+        ),
         parameters=[
             OpenApiParameter(
                 name="filter[scan_id]",
-                required=True,
+                required=False,
                 type=OpenApiTypes.UUID,
                 location=OpenApiParameter.QUERY,
-                description="Related scan ID.",
+                description="Related scan ID. Required unless a provider filter is provided.",
             ),
         ],
         responses={
@@ -4579,19 +4589,23 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
                 description="Compliance overviews generation task failed"
             ),
         },
+        filters=True,
     ),
     metadata=extend_schema(
         tags=["Compliance Overview"],
         summary="Retrieve metadata values from compliance overviews",
-        description="Fetch unique metadata values from a set of compliance overviews. This is useful for dynamic "
-        "filtering.",
+        description=(
+            "Fetch unique metadata values from compliance overviews. This is useful "
+            "for dynamic filtering. When provider filters are provided, metadata is "
+            "computed from the latest completed scan for each matching provider."
+        ),
         parameters=[
             OpenApiParameter(
                 name="filter[scan_id]",
-                required=True,
+                required=False,
                 type=OpenApiTypes.UUID,
                 location=OpenApiParameter.QUERY,
-                description="Related scan ID.",
+                description="Related scan ID. Required unless a provider filter is provided.",
             ),
         ],
         responses={
@@ -4606,19 +4620,24 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
                 description="Compliance overviews generation task failed"
             ),
         },
+        filters=True,
     ),
     requirements=extend_schema(
         tags=["Compliance Overview"],
-        summary="List compliance requirements overview for a scan",
-        description="Retrieve a detailed overview of compliance requirements in a given scan, grouped by compliance "
-        "framework. This endpoint provides requirement-level details and aggregates status across regions.",
+        summary="List compliance requirements overview",
+        description=(
+            "Retrieve a detailed overview of compliance requirements, grouped by "
+            "compliance framework. This endpoint provides requirement-level details "
+            "and aggregates status across regions. When provider filters are provided, "
+            "the endpoint uses the latest completed scan for each matching provider."
+        ),
         parameters=[
             OpenApiParameter(
                 name="filter[scan_id]",
-                required=True,
+                required=False,
                 type=OpenApiTypes.UUID,
                 location=OpenApiParameter.QUERY,
-                description="Related scan ID.",
+                description="Related scan ID. Required unless a provider filter is provided.",
             ),
             OpenApiParameter(
                 name="filter[compliance_id]",
@@ -4677,7 +4696,10 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
 @method_decorator(CACHE_DECORATOR, name="list")
 @method_decorator(CACHE_DECORATOR, name="requirements")
 @method_decorator(CACHE_DECORATOR, name="attributes")
-class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
+class ComplianceOverviewViewSet(
+    ProviderFilterParamsMixin, BaseRLSViewSet, TaskManagementMixin
+):
+    jsonapi_filter_replace_dots = True
     pagination_class = ComplianceOverviewPagination
     queryset = ComplianceRequirementOverview.objects.all()
     serializer_class = ComplianceOverviewSerializer
@@ -4691,28 +4713,22 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
     required_permissions = []
 
     def get_queryset(self):
+        if getattr(self, "swagger_fake_view", False):
+            return ComplianceRequirementOverview.objects.none()
+
         role = get_role(self.request.user, self.request.tenant_id)
         unlimited_visibility = getattr(
             role, Permissions.UNLIMITED_VISIBILITY.value, False
         )
 
-        if unlimited_visibility:
-            base_queryset = self.filter_queryset(
-                ComplianceRequirementOverview.objects.filter(
-                    tenant_id=self.request.tenant_id
-                )
-            )
-        else:
-            providers = Provider.objects.filter(
-                provider_groups__in=role.provider_groups.all()
-            ).distinct()
-            base_queryset = self.filter_queryset(
-                ComplianceRequirementOverview.objects.filter(
-                    tenant_id=self.request.tenant_id, scan__provider__in=providers
-                )
-            )
+        base_queryset = ComplianceRequirementOverview.objects.filter(
+            tenant_id=self.request.tenant_id
+        )
 
-        return base_queryset
+        if unlimited_visibility:
+            return base_queryset
+
+        return base_queryset.filter(scan__provider__in=get_providers(role))
 
     def get_serializer_class(self):
         if hasattr(self, "response_serializer_class"):
@@ -4750,6 +4766,72 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
         return summaries
 
+    def _validate_scan_selection(self, scan_id, has_provider_filters):
+        if scan_id and has_provider_filters:
+            raise ValidationError(
+                [
+                    {
+                        "detail": "Use either filter[scan_id] or provider filters.",
+                        "status": 400,
+                        "source": {"pointer": "filter[scan_id]"},
+                        "code": "invalid",
+                    }
+                ]
+            )
+
+        if scan_id:
+            self._validate_uuid_filter_values("scan_id", [scan_id])
+            return
+
+        if has_provider_filters:
+            return
+
+        raise ValidationError(
+            [
+                {
+                    "detail": "This query parameter is required unless a provider filter is provided.",
+                    "status": 400,
+                    "source": {"pointer": "filter[scan_id]"},
+                    "code": "required",
+                }
+            ]
+        )
+
+    def _latest_scan_ids_for_provider_filters(self):
+        role = get_role(self.request.user, self.request.tenant_id)
+        scans = Scan.all_objects.filter(
+            tenant_id=self.request.tenant_id,
+            state=StateChoices.COMPLETED,
+        )
+
+        if not getattr(role, Permissions.UNLIMITED_VISIBILITY.value, False):
+            scans = scans.filter(provider__in=get_providers(role))
+
+        provider_filters = self._extract_provider_filters_from_params(
+            validate_uuids=True,
+            include_dot_aliases=True,
+        )
+        if provider_filters:
+            scans = scans.filter(**provider_filters)
+
+        return list(
+            scans.order_by("provider_id", "-inserted_at")
+            .distinct("provider_id")
+            .values_list("id", flat=True)
+        )
+
+    def _filtered_queryset_for_latest_provider_scans(self, latest_scan_ids=None):
+        if latest_scan_ids is None:
+            latest_scan_ids = self._latest_scan_ids_for_provider_filters()
+        queryset = self.get_queryset().filter(scan_id__in=latest_scan_ids)
+        # Provider filters stay on the filterset for OpenAPI docs, but runtime
+        # filtering happens on Scan first so compliance queries use scan IDs.
+        return self._apply_filterset(
+            queryset,
+            self.filterset_class,
+            exclude_keys=self.PROVIDER_FILTER_KEYS | {"scan_id"},
+        )
+
     def _get_compliance_template(self, *, provider=None, scan_id=None):
         """Return the compliance template for the given provider or scan."""
         if provider is None and scan_id is not None:
@@ -4865,6 +4947,36 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
                 status=status.HTTP_500_INTERNAL_SERVER_ERROR,
             )
 
+    def _task_response_for_latest_provider_scans(self, latest_scan_ids):
+        for scan_id in latest_scan_ids:
+            task_response = self._task_response_if_running(str(scan_id))
+            if task_response:
+                return task_response
+        return None
+
+    def _latest_provider_scan_ids_without_data(self, latest_scan_ids):
+        data_presence_queryset = self.get_queryset().filter(scan_id__in=latest_scan_ids)
+        scan_ids_with_data = {
+            str(scan_id)
+            for scan_id in data_presence_queryset.values_list(
+                "scan_id", flat=True
+            ).distinct()
+        }
+        return [
+            scan_id
+            for scan_id in latest_scan_ids
+            if str(scan_id) not in scan_ids_with_data
+        ]
+
+    def _task_response_for_latest_provider_scans_without_data(
+        self,
+        latest_scan_ids,
+    ):
+        scan_ids_to_check = self._latest_provider_scan_ids_without_data(
+            latest_scan_ids,
+        )
+        return self._task_response_for_latest_provider_scans(scan_ids_to_check)
+
     def _list_with_region_filter(self, scan_id, region_filter):
         """
         Fall back to detailed ComplianceRequirementOverview query when region filter is applied.
@@ -4905,8 +5017,25 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
         return Response(data)
 
+    def _list_with_latest_provider_filters(self):
+        latest_scan_ids = self._latest_scan_ids_for_provider_filters()
+        queryset = self._filtered_queryset_for_latest_provider_scans(latest_scan_ids)
+        data = self._aggregate_compliance_overview(queryset)
+        task_response = self._task_response_for_latest_provider_scans_without_data(
+            latest_scan_ids,
+        )
+        if task_response:
+            return task_response
+
+        return Response(data)
+
     def list(self, request, *args, **kwargs):
         scan_id = request.query_params.get("filter[scan_id]")
+        has_provider_filters = self._has_provider_filters(include_dot_aliases=True)
+        self._validate_scan_selection(scan_id, has_provider_filters)
+
+        if has_provider_filters:
+            return self._list_with_latest_provider_filters()
 
         # Specific scan requested - use optimized summaries with region support
         region_filter = request.query_params.get(
@@ -4952,33 +5081,34 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
     @action(detail=False, methods=["get"], url_name="metadata")
     def metadata(self, request):
         scan_id = request.query_params.get("filter[scan_id]")
-        if not scan_id:
-            raise ValidationError(
-                [
-                    {
-                        "detail": "This query parameter is required.",
-                        "status": 400,
-                        "source": {"pointer": "filter[scan_id]"},
-                        "code": "required",
-                    }
-                ]
+        has_provider_filters = self._has_provider_filters(include_dot_aliases=True)
+        self._validate_scan_selection(scan_id, has_provider_filters)
+
+        latest_scan_ids = None
+        if has_provider_filters:
+            latest_scan_ids = self._latest_scan_ids_for_provider_filters()
+            queryset = self._filtered_queryset_for_latest_provider_scans(
+                latest_scan_ids
             )
+        else:
+            queryset = self._apply_filterset(self.get_queryset(), self.filterset_class)
+
         regions = list(
-            self.get_queryset()
-            .filter(scan_id=scan_id)
-            .values_list("region", flat=True)
-            .order_by("region")
-            .distinct()
+            queryset.values_list("region", flat=True).order_by("region").distinct()
         )
         result = {"regions": regions}
 
-        if regions:
-            serializer = self.get_serializer(data=result)
-            serializer.is_valid(raise_exception=True)
-            return Response(serializer.data, status=status.HTTP_200_OK)
+        task_response = None
+        if has_provider_filters:
+            task_response = self._task_response_for_latest_provider_scans_without_data(
+                latest_scan_ids,
+            )
+        elif not regions:
+            task_response = self._task_response_if_running(scan_id)
+            if task_response:
+                return task_response
 
-        task_response = self._task_response_if_running(scan_id)
-        if task_response:
+        if has_provider_filters and task_response:
             return task_response
 
         serializer = self.get_serializer(data=result)
@@ -4988,19 +5118,10 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
     @action(detail=False, methods=["get"], url_name="requirements")
     def requirements(self, request):
         scan_id = request.query_params.get("filter[scan_id]")
+        has_provider_filters = self._has_provider_filters(include_dot_aliases=True)
         compliance_id = request.query_params.get("filter[compliance_id]")
 
-        if not scan_id:
-            raise ValidationError(
-                [
-                    {
-                        "detail": "This query parameter is required.",
-                        "status": 400,
-                        "source": {"pointer": "filter[scan_id]"},
-                        "code": "required",
-                    }
-                ]
-            )
+        self._validate_scan_selection(scan_id, has_provider_filters)
 
         if not compliance_id:
             raise ValidationError(
@@ -5013,7 +5134,16 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
                     }
                 ]
             )
-        filtered_queryset = self.filter_queryset(self.get_queryset())
+        latest_scan_ids = None
+        if has_provider_filters:
+            latest_scan_ids = self._latest_scan_ids_for_provider_filters()
+            filtered_queryset = self._filtered_queryset_for_latest_provider_scans(
+                latest_scan_ids
+            )
+        else:
+            filtered_queryset = self._apply_filterset(
+                self.get_queryset(), self.filterset_class
+            )
 
         all_requirements = filtered_queryset.values(
             "requirement_id",
@@ -5072,13 +5202,22 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
                 requirements_summary, many=True
             )
 
+        task_response = None
+        if has_provider_filters:
+            task_response = self._task_response_for_latest_provider_scans_without_data(
+                latest_scan_ids,
+            )
+        elif not requirements_summary:
+            task_response = self._task_response_if_running(scan_id)
+            if task_response:
+                return task_response
+
+        if has_provider_filters and task_response:
+            return task_response
+
         if requirements_summary:
             return Response(serializer.data, status=status.HTTP_200_OK)
 
-        task_response = self._task_response_if_running(scan_id)
-        if task_response:
-            return task_response
-
         return Response(serializer.data, status=status.HTTP_200_OK)
 
     @action(detail=False, methods=["get"], url_name="attributes")
@@ -5317,7 +5456,7 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
     ),
 )
 @method_decorator(CACHE_DECORATOR, name="list")
-class OverviewViewSet(BaseRLSViewSet):
+class OverviewViewSet(ProviderFilterParamsMixin, BaseRLSViewSet):
     queryset = ScanSummary.objects.all()
     http_method_names = ["get"]
     ordering = ["-inserted_at"]
@@ -5434,18 +5573,6 @@ class OverviewViewSet(BaseRLSViewSet):
             tenant_id=tenant_id, scan_id__in=latest_scan_ids
         )
 
-    def _normalize_jsonapi_params(self, query_params, exclude_keys=None):
-        """Convert JSON:API filter params (filter[X]) to flat params (X)."""
-        exclude_keys = exclude_keys or set()
-        normalized = QueryDict(mutable=True)
-        for key, values in query_params.lists():
-            normalized_key = (
-                key[7:-1] if key.startswith("filter[") and key.endswith("]") else key
-            )
-            if normalized_key not in exclude_keys:
-                normalized.setlist(normalized_key, values)
-        return normalized
-
     def _ensure_allowed_providers(self):
         """Populate allowed providers for RBAC-aware queries once per request."""
         if getattr(self, "_providers_initialized", False):
@@ -5465,15 +5592,6 @@ class OverviewViewSet(BaseRLSViewSet):
             return queryset.filter(**provider_filter)
         return queryset
 
-    def _apply_filterset(self, queryset, filterset_class, exclude_keys=None):
-        normalized_params = self._normalize_jsonapi_params(
-            self.request.query_params, exclude_keys=set(exclude_keys or [])
-        )
-        filterset = filterset_class(normalized_params, queryset=queryset)
-        if not filterset.is_valid():
-            raise ValidationError(filterset.errors)
-        return filterset.qs
-
     def _latest_scan_ids_for_allowed_providers(self, tenant_id, provider_filters=None):
         provider_filter = self._get_provider_filter()
         queryset = Scan.all_objects.filter(
@@ -5487,40 +5605,6 @@ class OverviewViewSet(BaseRLSViewSet):
             .values_list("id", flat=True)
         )
 
-    def _extract_provider_filters_from_params(self):
-        """Extract and validate provider filters from query params."""
-        params = self.request.query_params
-        filters = {}
-        valid_provider_types = {c[0] for c in Provider.ProviderChoices.choices}
-
-        provider_id = params.get("filter[provider_id]")
-        if provider_id:
-            filters["provider_id"] = provider_id
-
-        provider_id_in = params.get("filter[provider_id__in]")
-        if provider_id_in:
-            filters["provider_id__in"] = provider_id_in.split(",")
-
-        provider_type = params.get("filter[provider_type]")
-        if provider_type:
-            if provider_type not in valid_provider_types:
-                raise ValidationError(
-                    {"provider_type": f"Invalid choice: {provider_type}"}
-                )
-            filters["provider__provider"] = provider_type
-
-        provider_type_in = params.get("filter[provider_type__in]")
-        if provider_type_in:
-            types = provider_type_in.split(",")
-            invalid = [t for t in types if t not in valid_provider_types]
-            if invalid:
-                raise ValidationError(
-                    {"provider_type__in": f"Invalid choices: {', '.join(invalid)}"}
-                )
-            filters["provider__provider__in"] = types
-
-        return filters
-
     @action(detail=False, methods=["get"], url_name="providers")
     def providers(self, request):
         tenant_id = self.request.tenant_id
@@ -5591,15 +5675,11 @@ class OverviewViewSet(BaseRLSViewSet):
         tenant_id = self.request.tenant_id
         providers_qs = Provider.objects.filter(tenant_id=tenant_id)
 
+        self._ensure_allowed_providers()
         if hasattr(self, "allowed_providers"):
-            allowed_ids = list(self.allowed_providers.values_list("id", flat=True))
-            if not allowed_ids:
-                overview = []
-                return Response(
-                    self.get_serializer(overview, many=True).data,
-                    status=status.HTTP_200_OK,
-                )
-            providers_qs = providers_qs.filter(id__in=allowed_ids)
+            providers_qs = providers_qs.filter(
+                id__in=self.allowed_providers.values("id")
+            )
 
         overview = (
             providers_qs.values("provider")
@@ -5815,29 +5895,41 @@ class OverviewViewSet(BaseRLSViewSet):
                 description="Retrieve a specific snapshot by ID. If not provided, returns latest snapshots.",
             ),
             OpenApiParameter(
-                name="provider_id",
+                name="filter[provider_id]",
                 type=OpenApiTypes.UUID,
                 location=OpenApiParameter.QUERY,
                 description="Filter by specific provider ID",
             ),
             OpenApiParameter(
-                name="provider_id__in",
+                name="filter[provider_id__in]",
                 type=OpenApiTypes.STR,
                 location=OpenApiParameter.QUERY,
                 description="Filter by multiple provider IDs (comma-separated UUIDs)",
             ),
             OpenApiParameter(
-                name="provider_type",
+                name="filter[provider_type]",
                 type=OpenApiTypes.STR,
                 location=OpenApiParameter.QUERY,
                 description="Filter by provider type (aws, azure, gcp, etc.)",
             ),
             OpenApiParameter(
-                name="provider_type__in",
+                name="filter[provider_type__in]",
                 type=OpenApiTypes.STR,
                 location=OpenApiParameter.QUERY,
                 description="Filter by multiple provider types (comma-separated)",
             ),
+            OpenApiParameter(
+                name="filter[provider_groups]",
+                type=OpenApiTypes.UUID,
+                location=OpenApiParameter.QUERY,
+                description="Filter by provider group ID",
+            ),
+            OpenApiParameter(
+                name="filter[provider_groups__in]",
+                type=OpenApiTypes.STR,
+                location=OpenApiParameter.QUERY,
+                description="Filter by multiple provider group IDs (comma-separated UUIDs)",
+            ),
         ],
     )
     @action(detail=False, methods=["get"], url_name="threatscore")
@@ -6179,6 +6271,8 @@ class OverviewViewSet(BaseRLSViewSet):
             "provider_id__in",
             "provider_type",
             "provider_type__in",
+            "provider_groups",
+            "provider_groups__in",
         }
         filtered_queryset = self._apply_filterset(
             base_queryset, CategoryOverviewFilter, exclude_keys=provider_filter_keys
@@ -6248,6 +6342,8 @@ class OverviewViewSet(BaseRLSViewSet):
             "provider_id__in",
             "provider_type",
             "provider_type__in",
+            "provider_groups",
+            "provider_groups__in",
         }
         filtered_queryset = self._apply_filterset(
             base_queryset,
@@ -7298,7 +7394,7 @@ SEVERITY_ORDER_REVERSE = {v: k for k, v in SEVERITY_ORDER.items()}
     ),
     retrieve=extend_schema(exclude=True),
 )
-class FindingGroupViewSet(BaseRLSViewSet):
+class FindingGroupViewSet(JsonApiFilterMixin, BaseRLSViewSet):
     """
     ViewSet for Finding Groups - aggregates findings by check_id.
 
@@ -7314,6 +7410,7 @@ class FindingGroupViewSet(BaseRLSViewSet):
     queryset = FindingGroupDailySummary.objects.all()
     serializer_class = FindingGroupSerializer
     filterset_class = FindingGroupFilter
+    jsonapi_filter_replace_dots = True
     filter_backends = [
         jsonapi_filters.QueryParameterValidationFilter,
         jsonapi_filters.OrderingFilter,
@@ -7364,18 +7461,6 @@ class FindingGroupViewSet(BaseRLSViewSet):
 
         return queryset
 
-    def _normalize_jsonapi_params(self, query_params):
-        """Convert JSON:API filter params (filter[X]) to flat params (X)."""
-        normalized = QueryDict(mutable=True)
-        for key, values in query_params.lists():
-            normalized_key = (
-                key[7:-1] if key.startswith("filter[") and key.endswith("]") else key
-            )
-            # Convert JSON:API dot notation to Django double underscore
-            normalized_key = normalized_key.replace(".", "__")
-            normalized.setlist(normalized_key, values)
-        return normalized
-
     @extend_schema(exclude=True)
     def retrieve(self, request, *args, **kwargs):
         raise MethodNotAllowed(method="GET")
@@ -8494,9 +8579,10 @@ class FindingGroupViewSet(BaseRLSViewSet):
 
         This endpoint returns finding groups without requiring date filters,
         automatically using the latest available data per check_id.
-        All other filters (provider_id, provider_type, check_id) are still supported.
+        Provider, provider group, check, and computed filters are still supported.
         """,
         tags=["Finding Groups"],
+        filters=True,
     )
     @action(detail=False, methods=["get"], url_name="latest")
     def latest(self, request):

From e690e5e86b29614ac23bdf875e1b83b39c090fe2 Mon Sep 17 00:00:00 2001
From: lydiavilchez <114735608+lydiavilchez@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:25:07 +0200
Subject: [PATCH 060/126] fix(cli): prevent unrelated built-in provider
 failures from aborting the CLI (#11618)

---
 prowler/CHANGELOG.md                          |   1 +
 prowler/lib/cli/parser.py                     |  16 +-
 prowler/providers/common/arguments.py         |  98 ++++--
 .../external/test_dynamic_provider_loading.py | 308 +++++++++++++++++-
 4 files changed, 386 insertions(+), 37 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 135cced4a7..69f3f743ce 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -36,6 +36,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 ### 🐞 Fixed
 
 - GCP `logging_log_metric_filter_and_alert_*` checks now credit org-level aggregated sinks filtered to the Admin Activity audit stream [(#11575)](https://github.com/prowler-cloud/prowler/pull/11575)
+- A broken built-in provider no longer aborts the CLI when a different provider was invoked [(#11618)](https://github.com/prowler-cloud/prowler/pull/11618)
 - GCP organization scans with `--organization-id` no longer silently fall back to the credentials' host project when the Cloud Asset API call fails; the new `GCPGetOrganizationProjectsError` (3011) is raised instead, naming the required `roles/cloudasset.viewer` binding and Cloud Asset API enablement [(#11280)](https://github.com/prowler-cloud/prowler/pull/11280)
 
 ---
diff --git a/prowler/lib/cli/parser.py b/prowler/lib/cli/parser.py
index 8f05fc30cb..2848e9c788 100644
--- a/prowler/lib/cli/parser.py
+++ b/prowler/lib/cli/parser.py
@@ -15,6 +15,8 @@ from prowler.lib.check.models import Severity
 from prowler.lib.cli.redact import warn_sensitive_argument_values
 from prowler.lib.outputs.common import Status
 from prowler.providers.common.arguments import (
+    PROVIDER_ALIASES,
+    enforce_invoked_provider_loaded,
     init_providers_parser,
     validate_asff_usage,
     validate_provider_arguments,
@@ -166,13 +168,13 @@ Detailed documentation at https://docs.prowler.com
             if sys.argv[1].startswith("-"):
                 sys.argv = self.__set_default_provider__(sys.argv)
 
-            # Provider aliases mapping
-            # Microsoft 365
-            elif sys.argv[1] == "microsoft365":
-                sys.argv[1] = "m365"
-            # Oracle Cloud Infrastructure
-            elif sys.argv[1] == "oci":
-                sys.argv[1] = "oraclecloud"
+            # Provider aliases mapping (single source: arguments.PROVIDER_ALIASES)
+            elif sys.argv[1] in PROVIDER_ALIASES:
+                sys.argv[1] = PROVIDER_ALIASES[sys.argv[1]]
+
+        # Selective fail-loud here (post argv-normalisation, pre parse_args)
+        # so the invoked-provider check stays correct under parse(args=...).
+        enforce_invoked_provider_loaded(self)
 
         # Warn about sensitive flags passed with explicit values
         # Snapshot argv before parse_args() which may exit on errors
diff --git a/prowler/providers/common/arguments.py b/prowler/providers/common/arguments.py
index 9e23274a90..2e4d9c8896 100644
--- a/prowler/providers/common/arguments.py
+++ b/prowler/providers/common/arguments.py
@@ -10,16 +10,43 @@ provider_arguments_lib_path = "lib.arguments.arguments"
 validate_provider_arguments_function = "validate_arguments"
 init_provider_arguments_function = "init_parser"
 
+# Kept in sync with parser.py's argv normalisation; both consumers import this.
+PROVIDER_ALIASES = {
+    "microsoft365": "m365",
+    "oci": "oraclecloud",
+}
+
+
+def _invoked_provider_from_argv(available_providers: Sequence[str]) -> Optional[str]:
+    """Return the provider name the user invoked, or None.
+
+    Mirrors `ProwlerArgumentParser.parse()` resolution: only inspects
+    `sys.argv[1]`. Scanning the whole argv would misclassify
+    `prowler --output-directory stackit` as `stackit`.
+    """
+    available = set(available_providers)
+    if len(sys.argv) < 2:
+        return "aws" if "aws" in available else None
+    first = sys.argv[1]
+    if first in ("-h", "--help", "-v", "--version"):
+        return None
+    if first.startswith("-"):
+        return "aws" if "aws" in available else None
+    normalized = PROVIDER_ALIASES.get(first, first)
+    return normalized if normalized in available else None
+
 
 def init_providers_parser(self):
-    """init_providers_parser calls the provider init_parser function to load all the arguments and flags. Receives a ProwlerArgumentParser object"""
-    # We need to call the arguments parser for each provider
+    """Build the subparser of each available provider.
+
+    Built-in load failures are captured silently on
+    `self._builtin_load_failures`; the warn/exit decision is deferred to
+    `enforce_invoked_provider_loaded()` because `parse(args=...)` can
+    override `sys.argv` after this function ran.
+    """
+    self._builtin_load_failures = {}
     providers = Provider.get_available_providers()
     for provider in providers:
-        # Discriminate built-in vs external upfront via find_spec, so an
-        # ImportError from a transitive dependency missing inside a built-in
-        # arguments module surfaces clearly instead of being silently
-        # re-routed to the entry-point path (which only has external providers).
         if Provider.is_builtin(provider):
             try:
                 getattr(
@@ -28,21 +55,9 @@ def init_providers_parser(self):
                     ),
                     init_provider_arguments_function,
                 )(self)
-            except ImportError as e:
-                logger.critical(
-                    f"Failed to load arguments for built-in provider '{provider}'. "
-                    f"Missing dependency: {e}. "
-                    f"Ensure all required dependencies are installed."
-                )
-                logger.debug("Full traceback:", exc_info=True)
-                sys.exit(1)
             except Exception as error:
-                logger.critical(
-                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
-                )
-                sys.exit(1)
+                self._builtin_load_failures[provider] = error
         else:
-            # External provider — init_parser classmethod via entry point
             cls = Provider._load_ep_provider(provider)
             if cls and hasattr(cls, "init_parser"):
                 try:
@@ -53,6 +68,51 @@ def init_providers_parser(self):
                     )
 
 
+def enforce_invoked_provider_loaded(self):
+    """Apply selective fail-loud over the failures captured at init time.
+
+    Called by `ProwlerArgumentParser.parse()` AFTER argv normalisation so
+    the invoked provider matches what argparse will dispatch to — including
+    the case where `parse(args=...)` overrode the ambient `sys.argv`.
+
+    Invoked + failed → critical + `sys.exit(1)`. Others → warning.
+    """
+    failures = getattr(self, "_builtin_load_failures", {})
+    if not failures:
+        return
+    invoked = _invoked_provider_from_argv(Provider.get_available_providers())
+    for provider, error in failures.items():
+        if provider == invoked:
+            continue
+        if isinstance(error, ImportError):
+            logger.warning(
+                f"Skipping built-in provider '{provider}' due to missing "
+                f"dependency: {error}. It will be unavailable in this "
+                f"invocation, but the CLI continues because you invoked a "
+                f"different provider."
+            )
+        else:
+            logger.warning(
+                f"Skipping built-in provider '{provider}': "
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+    if invoked is None or invoked not in failures:
+        return
+    error = failures[invoked]
+    if isinstance(error, ImportError):
+        logger.critical(
+            f"Failed to load arguments for built-in provider '{invoked}'. "
+            f"Missing dependency: {error}. "
+            f"Ensure all required dependencies are installed."
+        )
+        logger.debug("Full traceback:", exc_info=True)
+    else:
+        logger.critical(
+            f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+        )
+    sys.exit(1)
+
+
 def validate_provider_arguments(arguments: Namespace) -> tuple[bool, str]:
     """validate_provider_arguments returns {True, "} if the provider arguments passed are valid and can be used together"""
     try:
diff --git a/tests/providers/external/test_dynamic_provider_loading.py b/tests/providers/external/test_dynamic_provider_loading.py
index eefde19545..6bd1e6a2ce 100644
--- a/tests/providers/external/test_dynamic_provider_loading.py
+++ b/tests/providers/external/test_dynamic_provider_loading.py
@@ -417,17 +417,19 @@ class TestIsBuiltinProvider:
 
 
 class TestInitProvidersParserBuiltinDependencyFailure:
-    """Tests the critical behavior fix: when a built-in provider's arguments
-    module exists but its imports fail (e.g. boto3 not installed), we must
-    fail loudly with a clear message — not silently fall through to entry
-    points as if the provider were external."""
+    """Selective fail-loud: init captures failures silently, enforce emits
+    warning for non-invoked and exits for the invoked broken provider."""
 
+    @patch("sys.argv", ["prowler", "aws"])
     @patch("prowler.providers.common.arguments.Provider.is_builtin")
     @patch("prowler.providers.common.arguments.import_module")
     def test_builtin_with_missing_transitive_dep_fails_loudly(
         self, mock_import, mock_is_builtin
     ):
-        from prowler.providers.common.arguments import init_providers_parser
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
 
         mock_is_builtin.return_value = True
         mock_import.side_effect = ImportError("No module named 'boto3'")
@@ -435,14 +437,14 @@ class TestInitProvidersParserBuiltinDependencyFailure:
         parser = MagicMock()
         parser._providers = ["aws"]
 
-        with (
-            patch(
-                "prowler.providers.common.arguments.Provider.get_available_providers",
-                return_value=["aws"],
-            ),
-            pytest.raises(SystemExit),
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws"],
         ):
             init_providers_parser(parser)
+            assert "aws" in parser._builtin_load_failures
+            with pytest.raises(SystemExit):
+                enforce_invoked_provider_loaded(parser)
 
     @patch("prowler.providers.common.arguments.Provider.is_builtin")
     @patch("prowler.providers.common.arguments.Provider._load_ep_provider")
@@ -466,6 +468,290 @@ class TestInitProvidersParserBuiltinDependencyFailure:
 
         ext_cls.init_parser.assert_called_once_with(parser)
 
+    @patch("sys.argv", ["prowler", "aws"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_unrelated_builtin_failure_does_not_abort_when_other_provider_invoked(
+        self, mock_import, mock_is_builtin
+    ):
+        """Broken stackit + invoked aws → warning, no abort."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        aws_module = MagicMock()
+
+        def import_side_effect(module_path):
+            if "stackit" in module_path:
+                raise ImportError("No module named 'stackit.objectstorage'")
+            return aws_module
+
+        mock_import.side_effect = import_side_effect
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws", "stackit"],
+        ):
+            init_providers_parser(parser)
+            assert "stackit" in parser._builtin_load_failures
+            enforce_invoked_provider_loaded(parser)
+
+        aws_module.init_parser.assert_called_once_with(parser)
+
+    @patch("sys.argv", ["prowler", "-h"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_no_provider_invoked_failure_does_not_abort(
+        self, mock_import, mock_is_builtin
+    ):
+        """`prowler -h` + broken built-in → warning, help still renders."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = ImportError("No module named 'stackit.objectstorage'")
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["stackit"],
+        ):
+            init_providers_parser(parser)
+            enforce_invoked_provider_loaded(parser)
+
+    @patch("sys.argv", ["prowler", "microsoft365"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_invoked_microsoft365_alias_still_triggers_fail_loud(
+        self, mock_import, mock_is_builtin
+    ):
+        """Alias `microsoft365 → m365` must be normalised before matching."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = ImportError("No module named 'msgraph'")
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["m365"],
+        ):
+            init_providers_parser(parser)
+            with pytest.raises(SystemExit):
+                enforce_invoked_provider_loaded(parser)
+
+    @patch("sys.argv", ["prowler", "oci"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_invoked_oci_alias_still_triggers_fail_loud(
+        self, mock_import, mock_is_builtin
+    ):
+        """Alias `oci → oraclecloud` must be normalised before matching."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = ImportError("No module named 'oci'")
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["oraclecloud"],
+        ):
+            init_providers_parser(parser)
+            with pytest.raises(SystemExit):
+                enforce_invoked_provider_loaded(parser)
+
+    @patch("sys.argv", ["prowler", "--output-directory", "stackit"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_flag_value_matching_provider_name_not_treated_as_invoked(
+        self, mock_import, mock_is_builtin
+    ):
+        """Flag-first invocation → invoked is 'aws' (default), not the flag's value."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        aws_module = MagicMock()
+
+        def import_side_effect(module_path):
+            if "stackit" in module_path:
+                raise ImportError("No module named 'stackit.objectstorage'")
+            return aws_module
+
+        mock_import.side_effect = import_side_effect
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws", "stackit"],
+        ):
+            init_providers_parser(parser)
+            enforce_invoked_provider_loaded(parser)
+
+        aws_module.init_parser.assert_called_once_with(parser)
+
+    @patch("sys.argv", ["prowler", "aws"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_invoked_builtin_non_import_error_fails_loudly(
+        self, mock_import, mock_is_builtin
+    ):
+        """Non-ImportError in invoked provider → still fail-loud."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        mock_import.side_effect = RuntimeError("Unexpected error in aws init_parser")
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws"],
+        ):
+            init_providers_parser(parser)
+            with pytest.raises(SystemExit):
+                enforce_invoked_provider_loaded(parser)
+
+    @patch("sys.argv", ["prowler", "aws"])
+    @patch("prowler.providers.common.arguments.Provider.is_builtin")
+    @patch("prowler.providers.common.arguments.import_module")
+    def test_unrelated_builtin_non_import_error_does_not_abort(
+        self, mock_import, mock_is_builtin
+    ):
+        """Non-ImportError in unrelated provider → warning, no abort."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        mock_is_builtin.return_value = True
+        aws_module = MagicMock()
+
+        def import_side_effect(module_path):
+            if "stackit" in module_path:
+                raise RuntimeError("Unexpected error in stackit init_parser")
+            return aws_module
+
+        mock_import.side_effect = import_side_effect
+
+        parser = MagicMock()
+
+        with patch(
+            "prowler.providers.common.arguments.Provider.get_available_providers",
+            return_value=["aws", "stackit"],
+        ):
+            init_providers_parser(parser)
+            enforce_invoked_provider_loaded(parser)
+
+        aws_module.init_parser.assert_called_once_with(parser)
+
+
+class TestParseArgsOverrideAlignment:
+    """Regression: `parse(args=...)` overrides sys.argv AFTER __init__ ran;
+    the selective fail-loud must read argv at enforce time, not init time."""
+
+    def test_enforce_reads_current_sys_argv_not_init_time_sys_argv(self):
+        """Init with argv=['prowler','-h'] (no provider) captures stackit
+        failure silently. Enforce with argv=['prowler','stackit'] must
+        fail-loud — proving alignment under parse(args=...)."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        def import_side_effect(path):
+            if "stackit" in path:
+                raise ImportError("No module named 'stackit.objectstorage'")
+            return MagicMock()
+
+        parser = MagicMock()
+
+        with (
+            patch(
+                "prowler.providers.common.arguments.Provider.is_builtin",
+                return_value=True,
+            ),
+            patch(
+                "prowler.providers.common.arguments.Provider.get_available_providers",
+                return_value=["aws", "stackit"],
+            ),
+            patch(
+                "prowler.providers.common.arguments.import_module",
+                side_effect=import_side_effect,
+            ),
+        ):
+            # Phase 1: __init__ with ambient argv = ['prowler', '-h']
+            with patch("sys.argv", ["prowler", "-h"]):
+                init_providers_parser(parser)
+            # Failure captured silently — no SystemExit during init
+            assert "stackit" in parser._builtin_load_failures
+
+            # Phase 2: parse(args=...) overrode sys.argv → stackit invoked
+            with patch("sys.argv", ["prowler", "stackit"]):
+                with pytest.raises(SystemExit):
+                    enforce_invoked_provider_loaded(parser)
+
+    def test_enforce_reads_current_sys_argv_for_no_invocation(self):
+        """Inverse: init's argv invokes stackit, but parse(args=['prowler',
+        '-h']) overrides. Enforce must NOT fail-loud."""
+        from prowler.providers.common.arguments import (
+            enforce_invoked_provider_loaded,
+            init_providers_parser,
+        )
+
+        def import_side_effect(path):
+            if "stackit" in path:
+                raise ImportError("No module named 'stackit.objectstorage'")
+            return MagicMock()
+
+        parser = MagicMock()
+
+        with (
+            patch(
+                "prowler.providers.common.arguments.Provider.is_builtin",
+                return_value=True,
+            ),
+            patch(
+                "prowler.providers.common.arguments.Provider.get_available_providers",
+                return_value=["aws", "stackit"],
+            ),
+            patch(
+                "prowler.providers.common.arguments.import_module",
+                side_effect=import_side_effect,
+            ),
+        ):
+            # Phase 1: __init__ with ambient argv pretending stackit invoked
+            with patch("sys.argv", ["prowler", "stackit"]):
+                init_providers_parser(parser)
+            assert "stackit" in parser._builtin_load_failures
+
+            # Phase 2: parse(args=['prowler', '-h']) overrode sys.argv →
+            # no provider invoked anymore → enforce must NOT exit
+            with patch("sys.argv", ["prowler", "-h"]):
+                enforce_invoked_provider_loaded(parser)
+
 
 class TestInitGlobalProviderBuiltinDependencyFailure:
     """Same contract as TestInitProvidersParserBuiltinDependencyFailure but

From c2d7187a0bf8ada6b67c635f91c7d1b9d303ac50 Mon Sep 17 00:00:00 2001
From: "Pablo Fernandez Guerra (PFE)"
 <148432447+pfe-nazaries@users.noreply.github.com>
Date: Tue, 16 Jun 2026 14:40:41 +0200
Subject: [PATCH 061/126] test(ui): add Vercel provider E2E tests (#11598)

Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
---
 .github/workflows/ui-e2e-tests-v2.yml |  2 +
 ui/tests/providers/providers-page.ts  | 66 +++++++++++++++++++++
 ui/tests/providers/providers.md       | 59 +++++++++++++++++++
 ui/tests/providers/providers.spec.ts  | 82 +++++++++++++++++++++++++++
 ui/types/env.d.ts                     |  4 ++
 5 files changed, 213 insertions(+)

diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml
index 1a3653f8c9..d537084c5c 100644
--- a/.github/workflows/ui-e2e-tests-v2.yml
+++ b/.github/workflows/ui-e2e-tests-v2.yml
@@ -77,6 +77,8 @@ jobs:
       E2E_ALIBABACLOUD_ACCESS_KEY_ID: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_ID }}
       E2E_ALIBABACLOUD_ACCESS_KEY_SECRET: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_SECRET }}
       E2E_ALIBABACLOUD_ROLE_ARN: ${{ secrets.E2E_ALIBABACLOUD_ROLE_ARN }}
+      E2E_VERCEL_TEAM_ID: ${{ secrets.E2E_VERCEL_TEAM_ID }}
+      E2E_VERCEL_API_TOKEN: ${{ secrets.E2E_VERCEL_API_TOKEN }}
       # Pass E2E paths from impact analysis
       E2E_TEST_PATHS: ${{ needs.impact-analysis.outputs.ui-e2e }}
       RUN_ALL_TESTS: ${{ needs.impact-analysis.outputs.run-all }}
diff --git a/ui/tests/providers/providers-page.ts b/ui/tests/providers/providers-page.ts
index 54545f965d..2196cd4fae 100644
--- a/ui/tests/providers/providers-page.ts
+++ b/ui/tests/providers/providers-page.ts
@@ -224,6 +224,27 @@ export interface AlibabaCloudProviderCredential {
   roleSessionName?: string;
 }
 
+// Vercel provider data
+export interface VercelProviderData {
+  teamId: string;
+  alias?: string;
+}
+
+// Vercel credential options
+export const VERCEL_CREDENTIAL_OPTIONS = {
+  VERCEL_API_TOKEN: "api_token",
+} as const;
+
+// Vercel credential type
+type VercelCredentialType =
+  (typeof VERCEL_CREDENTIAL_OPTIONS)[keyof typeof VERCEL_CREDENTIAL_OPTIONS];
+
+// Vercel provider credential
+export interface VercelProviderCredential {
+  type: VercelCredentialType;
+  apiToken: string;
+}
+
 // Providers page
 export class ProvidersPage extends BasePage {
   readonly wizardModal: Locator;
@@ -252,6 +273,11 @@ export class ProvidersPage extends BasePage {
   readonly googleworkspaceServiceAccountJsonInput: Locator;
   readonly googleworkspaceDelegatedUserInput: Locator;
 
+  // Vercel provider form elements
+  readonly vercelProviderRadio: Locator;
+  readonly vercelTeamIdInput: Locator;
+  readonly vercelApiTokenInput: Locator;
+
   // AWS provider form elements
   readonly accountIdInput: Locator;
   readonly nextButton: Locator;
@@ -496,6 +522,14 @@ export class ProvidersPage extends BasePage {
       name: /Delegated User Email/i,
     });
 
+    // Vercel
+    this.vercelProviderRadio = page.getByRole("option", {
+      name: /Vercel/i,
+    });
+    this.vercelTeamIdInput = page.getByRole("textbox", { name: "Team ID" });
+    // API Token is a type="password" field (no textbox role); target by label.
+    this.vercelApiTokenInput = page.getByLabel(/API Token/i);
+
     // Alias input
     this.aliasInput = page.getByRole("textbox", {
       name: "Provider alias (optional)",
@@ -1288,6 +1322,37 @@ export class ProvidersPage extends BasePage {
     await expect(this.googleworkspaceDelegatedUserInput).toBeVisible();
   }
 
+  async selectVercelProvider(): Promise<void> {
+    await this.selectProviderRadio(this.vercelProviderRadio);
+  }
+
+  async fillVercelProviderDetails(data: VercelProviderData): Promise<void> {
+    // Fill the Vercel provider details (Team ID is the provider UID)
+
+    await this.vercelTeamIdInput.fill(data.teamId);
+
+    if (data.alias) {
+      await this.aliasInput.fill(data.alias);
+    }
+  }
+
+  async fillVercelCredentials(
+    credentials: VercelProviderCredential,
+  ): Promise<void> {
+    // Fill the Vercel credentials form
+
+    if (credentials.apiToken) {
+      await this.vercelApiTokenInput.fill(credentials.apiToken);
+    }
+  }
+
+  async verifyVercelCredentialsPageLoaded(): Promise<void> {
+    // Verify the Vercel credentials page is loaded
+
+    await this.verifyPageHasProwlerTitle();
+    await expect(this.vercelApiTokenInput).toBeVisible();
+  }
+
   async verifyPageLoaded(): Promise<void> {
     // Verify the providers page is loaded
 
@@ -1309,6 +1374,7 @@ export class ProvidersPage extends BasePage {
     await expect(this.githubProviderRadio).toBeVisible();
     await expect(this.alibabacloudProviderRadio).toBeVisible();
     await expect(this.googleworkspaceProviderRadio).toBeVisible();
+    await expect(this.vercelProviderRadio).toBeVisible();
   }
 
   async verifyCredentialsPageLoaded(): Promise<void> {
diff --git a/ui/tests/providers/providers.md b/ui/tests/providers/providers.md
index 4d04adaeca..dcdbccb75f 100644
--- a/ui/tests/providers/providers.md
+++ b/ui/tests/providers/providers.md
@@ -1012,3 +1012,62 @@
 - Provider cleanup performed before each test to ensure clean state
 - Requires valid Google Workspace account with Service Account having domain-wide delegation enabled
 - Service Account must have appropriate Google Workspace API scopes for security scanning
+
+---
+
+## Test Case: `PROVIDER-E2E-018` - Add Vercel Provider with API Token
+
+**Priority:** `critical`
+
+**Tags:**
+
+- type → @e2e, @serial
+- feature → @providers
+- provider → @vercel
+
+**Description/Objective:** Validates the complete flow of adding a new Vercel provider using API Token authentication, with a Team ID as the provider UID.
+
+**Preconditions:**
+
+- Admin user authentication required (admin.auth.setup setup)
+- Environment variables configured: E2E_VERCEL_TEAM_ID, E2E_VERCEL_API_TOKEN
+- Remove any existing provider with the same Team ID before starting the test
+- This test must be run serially and never in parallel with other tests, as it requires the Team ID not to be already registered beforehand.
+
+### Flow Steps
+
+1. Navigate to providers page
+2. Click "Add Provider" button
+3. Select Vercel provider type
+4. Fill provider details (team ID and alias)
+5. Verify Vercel credentials page is loaded
+6. Fill Vercel credentials (API token)
+7. Launch initial scan
+8. Verify redirect to Scans page
+9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+
+### Expected Result
+
+- Vercel provider successfully added with API Token credentials
+- Initial scan launched successfully
+- User redirected to Scans page
+- Scheduled scan appears in Scans table with correct provider and scan name
+
+### Key verification points
+
+- Provider page loads correctly
+- Connect account page displays Vercel option
+- Provider details form accepts team ID and alias
+- Credentials page loads with the API Token field
+- API Token is properly filled in the correct (masked) field
+- Launch scan page appears
+- Successful redirect to Scans page after scan launch
+- Provider exists in Scans table (verified by team ID)
+- Scan name field contains "scheduled scan"
+
+### Notes
+
+- Test uses environment variables for the Vercel Team ID and API Token
+- API Token is a masked (password) field; the only credential required for Vercel
+- Provider cleanup performed before each test to ensure clean state
+- Requires a valid Vercel API Token with read permissions to the resources to assess
diff --git a/ui/tests/providers/providers.spec.ts b/ui/tests/providers/providers.spec.ts
index 7d2a5dd2a0..819b85bfe2 100644
--- a/ui/tests/providers/providers.spec.ts
+++ b/ui/tests/providers/providers.spec.ts
@@ -30,6 +30,9 @@ import {
   GoogleWorkspaceProviderData,
   GoogleWorkspaceProviderCredential,
   GOOGLEWORKSPACE_CREDENTIAL_OPTIONS,
+  VercelProviderData,
+  VercelProviderCredential,
+  VERCEL_CREDENTIAL_OPTIONS,
 } from "./providers-page";
 import { ScansPage } from "../scans/scans-page";
 import fs from "fs";
@@ -1435,6 +1438,85 @@ test.describe("Add Provider", () => {
       },
     );
   });
+
+  test.describe.serial("Add Vercel Provider", () => {
+    let providersPage: ProvidersPage;
+    let scansPage: ScansPage;
+
+    // Test data from environment variables
+    const teamId = process.env.E2E_VERCEL_TEAM_ID ?? "";
+    const apiToken = process.env.E2E_VERCEL_API_TOKEN ?? "";
+
+    // Setup before each test
+    test.beforeEach(async ({ page }) => {
+      test.skip(!teamId || !apiToken, "Vercel E2E env vars are not set");
+      providersPage = new ProvidersPage(page);
+      await deleteProviderIfExists(providersPage, teamId!);
+    });
+
+    // Use admin authentication for provider management
+    test.use({ storageState: "playwright/.auth/admin_user.json" });
+
+    test(
+      "should add a new Vercel provider with API token",
+      {
+        tag: [
+          "@critical",
+          "@e2e",
+          "@providers",
+          "@vercel",
+          "@serial",
+          "@PROVIDER-E2E-018",
+        ],
+      },
+      async ({ page }) => {
+        // Prepare test data for Vercel provider (Team ID is the provider UID)
+        const vercelProviderData: VercelProviderData = {
+          teamId: teamId,
+          alias: "Test E2E Vercel Account - API Token",
+        };
+
+        // Prepare API token credentials
+        const vercelCredentials: VercelProviderCredential = {
+          type: VERCEL_CREDENTIAL_OPTIONS.VERCEL_API_TOKEN,
+          apiToken: apiToken,
+        };
+
+        // Navigate to providers page
+        await providersPage.goto();
+        await providersPage.verifyPageLoaded();
+
+        // Start adding new provider
+        await providersPage.clickAddProvider();
+        await providersPage.verifyConnectAccountPageLoaded();
+
+        // Select Vercel provider
+        await providersPage.selectVercelProvider();
+
+        // Fill provider details (team ID and alias)
+        await providersPage.fillVercelProviderDetails(vercelProviderData);
+        await providersPage.clickNext();
+
+        // Verify credentials page is loaded
+        await providersPage.verifyVercelCredentialsPageLoaded();
+
+        // Fill credentials (API token)
+        await providersPage.fillVercelCredentials(vercelCredentials);
+        await providersPage.clickNext();
+
+        // Launch scan
+        await providersPage.verifyLaunchScanPageLoaded();
+        await providersPage.clickNext();
+
+        // Wait for redirect to scan page
+        scansPage = new ScansPage(page);
+        await scansPage.verifyPageLoaded();
+
+        // Verify scan status is "Scheduled scan"
+        await scansPage.verifyScheduledScanStatus(teamId);
+      },
+    );
+  });
 });
 
 test.describe("Update Provider Credentials", () => {
diff --git a/ui/types/env.d.ts b/ui/types/env.d.ts
index c0b5b10a66..6f74d366dd 100644
--- a/ui/types/env.d.ts
+++ b/ui/types/env.d.ts
@@ -118,6 +118,10 @@ declare global {
       E2E_GOOGLEWORKSPACE_CUSTOMER_ID?: string;
       E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON?: string;
       E2E_GOOGLEWORKSPACE_DELEGATED_USER?: string;
+
+      // E2E Vercel
+      E2E_VERCEL_TEAM_ID?: string;
+      E2E_VERCEL_API_TOKEN?: string;
     }
   }
 }

From 406712ffa3e7a0658932207ea519fc9b648286d6 Mon Sep 17 00:00:00 2001
From: "Pablo Fernandez Guerra (PFE)"
 <148432447+pfe-nazaries@users.noreply.github.com>
Date: Tue, 16 Jun 2026 15:09:24 +0200
Subject: [PATCH 062/126] chore: scope prek pre-push hook to TruffleHog only
 (#11609)

Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .pre-commit-config.yaml    | 8 ++++++++
 ui/.pre-commit-config.yaml | 5 +++++
 2 files changed, 13 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4e79141bb7..1e9d74c973 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -7,6 +7,10 @@
 #   P50 — dependency validation
 
 default_install_hook_types: [pre-commit]
+# Hooks run on commit only by default;
+# NOTE: default_stages does NOT override a hook's manifest stages, so fixers shipping pre-push in their
+# manifest need an explicit stages: ["pre-commit"] below to stay off push.
+default_stages: [pre-commit]
 
 repos:
   ## GENERAL (prek built-in — no external repo needed)
@@ -21,13 +25,16 @@ repos:
       - id: check-json
         priority: 10
       - id: end-of-file-fixer
+        stages: ["pre-commit"]
         priority: 0
       - id: trailing-whitespace
+        stages: ["pre-commit"]
         priority: 0
       - id: no-commit-to-branch
         priority: 10
       - id: pretty-format-json
         args: ["--autofix", --no-sort-keys, --no-ensure-ascii]
+        stages: ["pre-commit"]
         priority: 10
 
   ## TOML
@@ -82,6 +89,7 @@ repos:
         name: "SDK - isort"
         files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         args: ["--profile", "black"]
+        stages: ["pre-commit"]
         priority: 20
 
   - repo: https://github.com/psf/black
diff --git a/ui/.pre-commit-config.yaml b/ui/.pre-commit-config.yaml
index eab333ceea..3bc0c3b5e6 100644
--- a/ui/.pre-commit-config.yaml
+++ b/ui/.pre-commit-config.yaml
@@ -1,5 +1,10 @@
 orphan: true
 
+# Hooks run on commit only by default;
+# NOTE: default_stages does NOT override a hook's manifest stages, so fixers shipping pre-push in their
+# manifest need an explicit stages: ["pre-commit"] below to stay off push.
+default_stages: [pre-commit]
+
 repos:
   - repo: local
     hooks:

From 8bc42a5ded5d6153ad1064205c6d4982864fc875 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Tue, 16 Jun 2026 23:42:51 +0900
Subject: [PATCH 063/126] feat(azure): add cosmosdb_account_minimum_tls_version
 check (#11033)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   1 +
 .../__init__.py                               |   0
 ..._account_minimum_tls_version.metadata.json |  38 ++++
 .../cosmosdb_account_minimum_tls_version.py   |  30 +++
 ...smosdb_account_minimum_tls_version_test.py | 209 ++++++++++++++++++
 6 files changed, 279 insertions(+)
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/__init__.py
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.metadata.json
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.py
 create mode 100644 tests/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 69f3f743ce..01ec551873 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -14,6 +14,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 - `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
+- `cosmosdb_account_minimum_tls_version` check for Azure provider, verifying Cosmos DB accounts enforce TLS 1.2 or higher for client connections [(#11033)](https://github.com/prowler-cloud/prowler/pull/11033)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 635d55a854..ef9dc6ec23 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1503,6 +1503,7 @@
       ],
       "Checks": [
         "app_minimum_tls_version_12",
+        "cosmosdb_account_minimum_tls_version",
         "monitor_storage_account_with_activity_logs_cmk_encrypted",
         "sqlserver_tde_encrypted_with_cmk",
         "sqlserver_tde_encryption_enabled",
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/__init__.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.metadata.json b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.metadata.json
new file mode 100644
index 0000000000..f9ddb2baa0
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "cosmosdb_account_minimum_tls_version",
+  "CheckTitle": "Cosmos DB account enforces TLS 1.2 or higher",
+  "CheckType": [],
+  "ServiceName": "cosmosdb",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.documentdb/databaseaccounts",
+  "ResourceGroup": "database",
+  "Description": "**Azure Cosmos DB accounts** are evaluated for **minimum TLS version**. TLS 1.0 and 1.1 are deprecated and contain known weaknesses. Enforcing **TLS 1.2** ensures all client connections negotiate modern, secure encryption protocols.",
+  "Risk": "Allowing **TLS 1.0/1.1** exposes client connections to **POODLE**, **BEAST**, and other protocol downgrade attacks that can compromise the **confidentiality** and **integrity** of data in transit, and may enable credential interception via weakened cipher suites.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/security",
+    "https://learn.microsoft.com/en-us/cli/azure/cosmosdb",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.documentdb/databaseaccounts"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --minimal-tls-version Tls12",
+      "NativeIaC": "```bicep\n// Bicep: Enforce minimum TLS 1.2 on a Cosmos DB account\nresource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  kind: 'GlobalDocumentDB'\n  properties: {\n    databaseAccountOfferType: 'Standard'\n    locations: [{ locationName: resourceGroup().location }]\n    minimalTlsVersion: 'Tls12' // Critical: Rejects client connections negotiating TLS 1.0 or 1.1\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Cosmos DB account\n2. In the left menu, select Networking\n3. Locate the Minimum TLS version setting\n4. Select TLS 1.2\n5. Click Save\n6. Validate that all client applications support TLS 1.2 before enforcing the change",
+      "Terraform": "```hcl\n# Terraform: Enforce minimum TLS 1.2 on a Cosmos DB account\nresource \"azurerm_cosmosdb_account\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<example_location>\"\n  offer_type          = \"Standard\"\n  kind                = \"GlobalDocumentDB\"\n\n  geo_location {\n    location          = \"<example_location>\"\n    failover_priority = 0\n  }\n\n  minimal_tls_version = \"Tls12\" # Critical: Rejects client connections negotiating TLS 1.0 or 1.1\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Set the Cosmos DB account **minimum TLS version** to at least **1.2** to block legacy protocols (`TLS 1.0`/`1.1`) vulnerable to known downgrade and cipher attacks. Inventory and update **client SDKs** and **drivers** to support TLS 1.2 prior to enforcement, and pair this control with **private endpoints**, **AAD/RBAC authentication**, and **handshake failure monitoring** to identify outdated clients.",
+      "Url": "https://hub.prowler.com/check/cosmosdb_account_minimum_tls_version"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.py
new file mode 100644
index 0000000000..5d85072367
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version.py
@@ -0,0 +1,30 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client
+
+
+class cosmosdb_account_minimum_tls_version(Check):
+    """Ensure that Cosmos DB accounts enforce TLS 1.2 or higher."""
+
+    def execute(self) -> Check_Report_Azure:
+        """Execute the Cosmos DB minimum TLS version check.
+
+        Iterates over every Cosmos DB account fetched by the service and reports
+        PASS when `minimalTlsVersion` is `Tls12` or higher, FAIL otherwise
+        (including when the property is missing or set to a legacy value).
+
+        Returns:
+            A list of Check_Report_Azure with one report per Cosmos DB account.
+        """
+        findings = []
+        for subscription, accounts in cosmosdb_client.accounts.items():
+            for account in accounts:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
+                report.subscription = subscription
+                report.status = "FAIL"
+                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not enforce TLS 1.2 or higher."
+                if account.minimal_tls_version in {"Tls12", "Tls13"}:
+                    report.status = "PASS"
+                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} enforces TLS 1.2 or higher."
+                findings.append(report)
+
+        return findings
diff --git a/tests/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version_test.py b/tests/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version_test.py
new file mode 100644
index 0000000000..b14c08f697
--- /dev/null
+++ b/tests/providers/azure/services/cosmosdb/cosmosdb_account_minimum_tls_version/cosmosdb_account_minimum_tls_version_test.py
@@ -0,0 +1,209 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+class Test_cosmosdb_account_minimum_tls_version:
+    def test_no_subscriptions(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+
+            cosmosdb_client.accounts = {}
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass_tls12(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        minimal_tls_version="Tls12",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                f"CosmosDB account test-account from subscription "
+                f"{AZURE_SUBSCRIPTION_ID} enforces TLS 1.2 or higher."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+
+    def test_pass_tls13(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        minimal_tls_version="Tls13",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_fail_tls11(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        minimal_tls_version="Tls11",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                f"CosmosDB account test-account from subscription "
+                f"{AZURE_SUBSCRIPTION_ID} does not enforce TLS 1.2 or higher."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+
+    def test_fail_no_tls_version(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_minimum_tls_version.cosmosdb_account_minimum_tls_version import (
+                cosmosdb_account_minimum_tls_version,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        minimal_tls_version=None,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_minimum_tls_version()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"

From 262dfda0aab191d13cb125cda5c94188635c0565 Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Tue, 16 Jun 2026 17:44:48 +0200
Subject: [PATCH 064/126] fix(ui): handle alert form errors (#11623)

---
 .../__tests__/alert-form-modal.test.tsx       | 25 +++++++
 .../__tests__/alerts-manager.test.tsx         | 73 ++++++++++++++++++-
 .../alerts/_components/alert-form-modal.tsx   |  1 +
 .../alerts/_components/alerts-manager.tsx     |  9 ++-
 4 files changed, 103 insertions(+), 5 deletions(-)

diff --git a/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
index be336be2a7..f23fafb948 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
@@ -701,6 +701,31 @@ describe("AlertFormModal", () => {
     expect(errorMessage).toHaveClass("text-text-error-primary");
   });
 
+  it("should clear the preview error when save shows the form error", async () => {
+    // Given
+    const user = userEvent.setup();
+    alertsActionMocks.seedAlertRule.mockResolvedValue({
+      error: "No alert-compatible filters",
+    });
+    mockRecipientsList();
+    renderCreateModal({ editingAlert: createEditingAlert() });
+
+    // When
+    await user.click(screen.getByRole("button", { name: /^test$/i }));
+    expect(await screen.findByText("Test result")).toBeVisible();
+    await user.click(screen.getByRole("button", { name: /^save$/i }));
+
+    // Then
+    await waitFor(() =>
+      expect(screen.queryByText("Test result")).not.toBeInTheDocument(),
+    );
+    expect(
+      screen.getAllByText(
+        "Apply at least one alert-compatible Findings filter.",
+      ),
+    ).toHaveLength(1);
+  });
+
   it("should hydrate advanced edit mode filters and normalize them on save", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
index 1ee2c67302..0230dccfa3 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
@@ -1,6 +1,6 @@
 import { render, screen, waitFor } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { isValidElement, type ReactNode } from "react";
+import { isValidElement, type ReactNode, useState } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import {
@@ -8,6 +8,10 @@ import {
   ALERT_TRIGGER_KINDS,
   type AlertRule,
 } from "@/app/(prowler)/alerts/_types";
+import type {
+  AlertFormSubmitResult,
+  AlertFormValues,
+} from "@/app/(prowler)/alerts/_types/alert-form";
 
 import { AlertsManager } from "../alerts-manager";
 
@@ -96,12 +100,32 @@ vi.mock("../alert-form-modal", () => ({
     open,
     editingAlert,
     onOpenChange,
+    onSubmit,
   }: {
     open: boolean;
     editingAlert?: AlertRule | null;
     onOpenChange: (open: boolean) => void;
-  }) =>
-    open ? (
+    onSubmit: (values: AlertFormValues) => Promise<AlertFormSubmitResult>;
+  }) => {
+    const [error, setError] = useState<string | null>(null);
+
+    const submit = async () => {
+      const result = await onSubmit({
+        name: "Updated alert",
+        description: "",
+        method: "email",
+        frequency: ALERT_TRIGGER_KINDS.AFTER_SCAN,
+        condition: {
+          op: ALERT_AGGREGATE_OPS.ANY,
+          filter: { severity: ["critical"] },
+        },
+        recipientEmails: [],
+        enabled: true,
+      });
+      setError(result.ok ? null : (result.error ?? null));
+    };
+
+    return open ? (
       <div
         role="dialog"
         aria-label={editingAlert ? "Edit Alert" : "Create Alert"}
@@ -109,9 +133,14 @@ vi.mock("../alert-form-modal", () => ({
         <button type="button" onClick={() => onOpenChange(false)}>
           Close modal
         </button>
+        <button type="button" onClick={submit}>
+          Submit alert
+        </button>
         {editingAlert?.attributes.name}
+        {error && <p>{error}</p>}
       </div>
-    ) : null,
+    ) : null;
+  },
 }));
 
 vi.mock("../alerts-empty-state", () => ({
@@ -259,6 +288,42 @@ describe("AlertsManager", () => {
     });
   });
 
+  it("shows a manage alerts permission message for edit 403 errors", async () => {
+    // Given
+    const user = userEvent.setup();
+    const alert = makeAlert(true);
+    actionMocks.updateAlert.mockResolvedValue({
+      error: "You do not have permission to perform this action.",
+      status: 403,
+    });
+    render(
+      <AlertsManager
+        alerts={[alert]}
+        loadError={null}
+        providers={[]}
+        completedScanIds={[]}
+        scanDetails={[]}
+        uniqueRegions={[]}
+        uniqueServices={[]}
+        uniqueResourceTypes={[]}
+        uniqueCategories={[]}
+        uniqueGroups={[]}
+        initialEditingAlert={alert}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button", { name: /submit alert/i }));
+
+    // Then
+    expect(
+      await screen.findByText(
+        "You don't have permission to manage alerts. Ask an administrator to update your role.",
+      ),
+    ).toBeVisible();
+    expect(toastMock).not.toHaveBeenCalled();
+  });
+
   it("shows a success toast after disabling an alert", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx b/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
index e3529d4056..12d7a85df9 100644
--- a/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
+++ b/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
@@ -451,6 +451,7 @@ const AlertFormModalContent = ({
       ? await seedAlertRule(pendingFilters)
       : null;
     if (seedResult?.error) {
+      setPreview(null);
       setErrors({ root: ALERT_SEED_ERROR });
       return;
     }
diff --git a/ui/app/(prowler)/alerts/_components/alerts-manager.tsx b/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
index 0c69225b5e..e438727c6f 100644
--- a/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
+++ b/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
@@ -49,6 +49,8 @@ interface AlertsManagerProps {
 
 const ALERTS_FINDINGS_HREF =
   "/findings?filter[muted]=false&filter[status__in]=FAIL";
+const ALERTS_PERMISSION_ERROR =
+  "You don't have permission to manage alerts. Ask an administrator to update your role.";
 
 export const AlertsManager = ({
   alerts,
@@ -108,7 +110,12 @@ export const AlertsManager = ({
     }
     const payload = toAlertPayload(values);
     const result = await updateAlert(editingAlert.id, payload);
-    if (result?.error) return { ok: false, error: result.error };
+    if (result?.error) {
+      return {
+        ok: false,
+        error: result.status === 403 ? ALERTS_PERMISSION_ERROR : result.error,
+      };
+    }
     toast({
       title: "Alert updated",
       description: result.data.attributes.name,

From 7b8ce51263597642189c61878c70bee9d4d048ad Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Wed, 17 Jun 2026 09:27:14 +0200
Subject: [PATCH 065/126] chore(changelog): v5.30.2 (#11624)

---
 api/CHANGELOG.md     | 4 ++--
 prowler/CHANGELOG.md | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index f969bb7ffe..930cf8f45f 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -18,11 +18,11 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ---
 
-## [1.31.2] (Prowler UNRELEASED)
+## [1.31.2] (Prowler v5.30.2)
 
 ### 🔄 Changed
 
-- `scan-compliance-overviews` task now streams the findings aggregation and the requirement-row writes (reading the denormalized `resource_regions` instead of prefetching resources, and batching rows into COPY instead of building the full list first), so it runs faster and its peak memory no longer grows with the number of regions and frameworks — a previous worker OOM risk on large scans — with no change to the compliance overview output [(#11591)](https://github.com/prowler-cloud/prowler/pull/11591)
+- `scan-compliance-overviews` task now streams the findings aggregation and the requirement-row writes so it runs faster and its peak memory no longer grows with the number of regions and frameworks [(#11591)](https://github.com/prowler-cloud/prowler/pull/11591)
 
 ---
 
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 01ec551873..d4ed312987 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -32,13 +32,13 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ---
 
-## [5.30.2] (Prowler UNRELEASED)
+## [5.30.2] (Prowler v5.30.2)
 
 ### 🐞 Fixed
 
 - GCP `logging_log_metric_filter_and_alert_*` checks now credit org-level aggregated sinks filtered to the Admin Activity audit stream [(#11575)](https://github.com/prowler-cloud/prowler/pull/11575)
 - A broken built-in provider no longer aborts the CLI when a different provider was invoked [(#11618)](https://github.com/prowler-cloud/prowler/pull/11618)
-- GCP organization scans with `--organization-id` no longer silently fall back to the credentials' host project when the Cloud Asset API call fails; the new `GCPGetOrganizationProjectsError` (3011) is raised instead, naming the required `roles/cloudasset.viewer` binding and Cloud Asset API enablement [(#11280)](https://github.com/prowler-cloud/prowler/pull/11280)
+- GCP organization scans with `--organization-id` no longer silently fall back to the credentials' host project when the Cloud Asset API call fails [(#11280)](https://github.com/prowler-cloud/prowler/pull/11280)
 
 ---
 

From ca97d7d9831398152c2d68ffc577ef4571ff5493 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Wed, 17 Jun 2026 18:05:09 +0900
Subject: [PATCH 066/126] feat(azure): add
 cosmosdb_account_public_network_access_disabled check (#11034)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   1 +
 .../__init__.py                               |   0
 ...blic_network_access_disabled.metadata.json |  38 ++++
 ..._account_public_network_access_disabled.py |  31 +++
 ...unt_public_network_access_disabled_test.py | 210 ++++++++++++++++++
 6 files changed, 281 insertions(+)
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/__init__.py
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.metadata.json
 create mode 100644 prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.py
 create mode 100644 tests/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index d4ed312987..a380b07115 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -15,6 +15,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 - `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
 - `cosmosdb_account_minimum_tls_version` check for Azure provider, verifying Cosmos DB accounts enforce TLS 1.2 or higher for client connections [(#11033)](https://github.com/prowler-cloud/prowler/pull/11033)
+- `cosmosdb_account_public_network_access_disabled` check for Azure provider, verifying Cosmos DB accounts have public network access disabled so connectivity is restricted to private endpoints or VNet service endpoints [(#11034)](https://github.com/prowler-cloud/prowler/pull/11034)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index ef9dc6ec23..d137938fd7 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1410,6 +1410,7 @@
         "aks_network_policy_enabled",
         "containerregistry_not_publicly_accessible",
         "cosmosdb_account_firewall_use_selected_networks",
+        "cosmosdb_account_public_network_access_disabled",
         "network_bastion_host_exists",
         "network_flow_log_captured_sent",
         "network_flow_log_more_than_90_days",
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/__init__.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.metadata.json b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.metadata.json
new file mode 100644
index 0000000000..2d8a61a54e
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "cosmosdb_account_public_network_access_disabled",
+  "CheckTitle": "Cosmos DB account has public network access disabled",
+  "CheckType": [],
+  "ServiceName": "cosmosdb",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.documentdb/databaseaccounts",
+  "ResourceGroup": "database",
+  "Description": "**Azure Cosmos DB accounts** are evaluated for **public network access**. Disabling public network access ensures the account is only reachable through **private endpoints** or **VNet service endpoints**, reducing the attack surface and preventing direct exposure of the data plane to the internet.",
+  "Risk": "Allowing **public network access** exposes the Cosmos DB data plane to the internet. Combined with leaked **connection strings**, weak **firewall rules**, or compromised **AAD tokens**, this enables **unauthorized data access**, **enumeration**, **brute force**, and **data exfiltration** from any source on the internet.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-private-endpoints",
+    "https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-configure-firewall",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.documentdb/databaseaccounts"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az cosmosdb update --name <COSMOS_ACCOUNT_NAME> --resource-group <RESOURCE_GROUP> --public-network-access Disabled",
+      "NativeIaC": "```bicep\n// Bicep: Disable public network access on a Cosmos DB account\nresource account 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  kind: 'GlobalDocumentDB'\n  properties: {\n    databaseAccountOfferType: 'Standard'\n    locations: [{ locationName: resourceGroup().location }]\n    publicNetworkAccess: 'Disabled' // Critical: Blocks all public-internet traffic to the data plane\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Cosmos DB account\n2. In the left menu, select Networking\n3. Under Public network access, select Disabled\n4. Configure private endpoints or VNet service endpoints before saving so clients retain connectivity\n5. Click Save",
+      "Terraform": "```hcl\n# Terraform: Disable public network access on a Cosmos DB account\nresource \"azurerm_cosmosdb_account\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<example_location>\"\n  offer_type          = \"Standard\"\n  kind                = \"GlobalDocumentDB\"\n\n  geo_location {\n    location          = \"<example_location>\"\n    failover_priority = 0\n  }\n\n  public_network_access_enabled = false # Critical: Blocks all public-internet traffic to the data plane\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Disable **public network access** on Cosmos DB accounts and require connectivity via **private endpoints** or **VNet service endpoints**. Before enforcement, validate that all application workloads have private-network connectivity, and pair this control with **AAD/RBAC authentication**, **TLS 1.2+**, and **firewall rules** restricted to the minimum trusted ranges to uphold **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/cosmosdb_account_public_network_access_disabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.py b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.py
new file mode 100644
index 0000000000..ec2d29728d
--- /dev/null
+++ b/prowler/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled.py
@@ -0,0 +1,31 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.cosmosdb.cosmosdb_client import cosmosdb_client
+
+
+class cosmosdb_account_public_network_access_disabled(Check):
+    """Ensure that Cosmos DB accounts have public network access disabled."""
+
+    def execute(self) -> Check_Report_Azure:
+        """Execute the Cosmos DB public network access check.
+
+        Iterates over every Cosmos DB account fetched by the service and reports
+        PASS when `publicNetworkAccess` is `Disabled` or `SecuredByPerimeter`
+        (Microsoft Network Security Perimeter), FAIL otherwise (including when
+        the property is missing or set to `Enabled`).
+
+        Returns:
+            A list of Check_Report_Azure with one report per Cosmos DB account.
+        """
+        findings = []
+        for subscription, accounts in cosmosdb_client.accounts.items():
+            for account in accounts:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=account)
+                report.subscription = subscription
+                report.status = "FAIL"
+                report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} does not have public network access disabled (current value: {account.public_network_access!r})."
+                if account.public_network_access in {"Disabled", "SecuredByPerimeter"}:
+                    report.status = "PASS"
+                    report.status_extended = f"CosmosDB account {account.name} from subscription {subscription} has public network access disabled."
+                findings.append(report)
+
+        return findings
diff --git a/tests/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled_test.py b/tests/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled_test.py
new file mode 100644
index 0000000000..60297d6138
--- /dev/null
+++ b/tests/providers/azure/services/cosmosdb/cosmosdb_account_public_network_access_disabled/cosmosdb_account_public_network_access_disabled_test.py
@@ -0,0 +1,210 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+
+class Test_cosmosdb_account_public_network_access_disabled:
+    def test_no_subscriptions(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+
+            cosmosdb_client.accounts = {}
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass_disabled(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        public_network_access="Disabled",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                f"CosmosDB account test-account from subscription "
+                f"{AZURE_SUBSCRIPTION_ID} has public network access disabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+
+    def test_pass_secured_by_perimeter(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        public_network_access="SecuredByPerimeter",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_fail_enabled(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        public_network_access="Enabled",
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                f"CosmosDB account test-account from subscription "
+                f"{AZURE_SUBSCRIPTION_ID} does not have public network access "
+                f"disabled (current value: 'Enabled')."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+
+    def test_fail_no_public_network_access(self):
+        cosmosdb_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled.cosmosdb_client",
+                new=cosmosdb_client,
+            ),
+        ):
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_account_public_network_access_disabled.cosmosdb_account_public_network_access_disabled import (
+                cosmosdb_account_public_network_access_disabled,
+            )
+            from prowler.providers.azure.services.cosmosdb.cosmosdb_service import (
+                Account,
+            )
+
+            cosmosdb_client.accounts = {
+                AZURE_SUBSCRIPTION_ID: [
+                    Account(
+                        id="/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.DocumentDB/databaseAccounts/test-account",
+                        name="test-account",
+                        kind="GlobalDocumentDB",
+                        type="Microsoft.DocumentDB/databaseAccounts",
+                        tags={},
+                        is_virtual_network_filter_enabled=False,
+                        location="eastus",
+                        private_endpoint_connections=[],
+                        disable_local_auth=False,
+                        public_network_access=None,
+                    )
+                ]
+            }
+
+            check = cosmosdb_account_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"

From 0463cd1559b03ed2c9db2df7162bd11dc7451c6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Rub=C3=A9n=20De=20la=20Torre=20Vico?= <ruben@prowler.com>
Date: Wed, 17 Jun 2026 11:16:58 +0200
Subject: [PATCH 067/126] fix(api): disable ASGI lifespan probe and tune SSE
 worker loop/connections (#11626)

---
 api/pyproject.toml                 |  2 ++
 api/src/backend/config/guniconf.py | 18 ++++++++++++++++++
 api/uv.lock                        | 23 +++++++++++++++++++++++
 3 files changed, 43 insertions(+)

diff --git a/api/pyproject.toml b/api/pyproject.toml
index 2bda12b993..41014d3382 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -43,6 +43,7 @@ dependencies = [
   "defusedxml==0.7.1",
   "django-eventstream==5.3.3",
   "gunicorn==26.0.0",
+  "uvloop==0.22.1",
   "lxml==6.1.0",
   "prowler @ git+https://github.com/prowler-cloud/prowler.git@master",
   "psycopg2-binary==2.9.9",
@@ -421,6 +422,7 @@ constraint-dependencies = [
   "uritemplate==4.2.0",
   "urllib3==2.7.0",
   "uuid6==2024.7.10",
+  "uvloop==0.22.1",
   "vine==5.1.0",
   "vulture==2.14",
   "wcwidth==0.5.3",
diff --git a/api/src/backend/config/guniconf.py b/api/src/backend/config/guniconf.py
index 6f07913e81..b4caca5e5c 100644
--- a/api/src/backend/config/guniconf.py
+++ b/api/src/backend/config/guniconf.py
@@ -29,6 +29,24 @@ reload = DEBUG
 # event loop alive while waiting for events.
 worker_class = env("DJANGO_WORKER_CLASS", default="asgi")
 
+# Lifespan protocol. Django's ASGIHandler (config.asgi:application) serves only
+# HTTP scopes and raises "Django can only handle ASGI/HTTP connections, not
+# lifespan." gunicorn's default ("auto") probes the app with a lifespan scope
+# to detect support, which triggers that error. We use no lifespan startup or
+# shutdown hooks, so disable the protocol entirely.
+asgi_lifespan = env("DJANGO_ASGI_LIFESPAN", default="off")
+
+# Event loop for the ASGI worker. "auto" uses uvloop when it is installed and
+# falls back to the stdlib asyncio loop otherwise; uvloop gives the SSE event
+# loop more headroom under many concurrent open streams.
+asgi_loop = env("DJANGO_ASGI_LOOP", default="uvloop")
+
+# Max concurrent connections per ASGI worker. Each open SSE stream holds one
+# connection for its whole lifetime, so this caps simultaneous SSE clients per
+# worker (gunicorn's default is 1000). The sync-only `threads` option has no
+# effect on ASGI workers.
+worker_connections = env.int("DJANGO_WORKER_CONNECTIONS", default=1000)
+
 # Preload the application before forking workers in production: the app is
 # imported once in the master and workers fork from it. In development, disable
 # preload so the server restarts on code changes.
diff --git a/api/uv.lock b/api/uv.lock
index 541a98e208..f96318c1f4 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -357,6 +357,7 @@ constraints = [
     { name = "uritemplate", specifier = "==4.2.0" },
     { name = "urllib3", specifier = "==2.7.0" },
     { name = "uuid6", specifier = "==2024.7.10" },
+    { name = "uvloop", specifier = "==0.22.1" },
     { name = "vine", specifier = "==5.1.0" },
     { name = "vulture", specifier = "==2.14" },
     { name = "wcwidth", specifier = "==0.5.3" },
@@ -4574,6 +4575,7 @@ dependencies = [
     { name = "sentry-sdk", extra = ["django"] },
     { name = "sqlparse" },
     { name = "uuid6" },
+    { name = "uvloop" },
     { name = "werkzeug" },
     { name = "xmlsec" },
 ]
@@ -4639,6 +4641,7 @@ requires-dist = [
     { name = "sentry-sdk", extras = ["django"], specifier = "==2.56.0" },
     { name = "sqlparse", specifier = "==0.5.5" },
     { name = "uuid6", specifier = "==2024.7.10" },
+    { name = "uvloop", specifier = "==0.22.1" },
     { name = "werkzeug", specifier = "==3.1.7" },
     { name = "xmlsec", specifier = "==1.3.17" },
 ]
@@ -5843,6 +5846,26 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d3/3e/4ae6af487ce5781ed71d5fe10aca72e7cbc4d4f45afc31b120287082a8dd/uuid6-2024.7.10-py3-none-any.whl", hash = "sha256:93432c00ba403751f722829ad21759ff9db051dea140bf81493271e8e4dd18b7", size = 6376, upload-time = "2024-07-10T16:39:36.148Z" },
 ]
 
+[[package]]
+name = "uvloop"
+version = "0.22.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/06/f0/18d39dbd1971d6d62c4629cc7fa67f74821b0dc1f5a77af43719de7936a7/uvloop-0.22.1.tar.gz", hash = "sha256:6c84bae345b9147082b17371e3dd5d42775bddce91f885499017f4607fdaf39f", size = 2443250, upload-time = "2025-10-16T22:17:19.342Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c7/d5/69900f7883235562f1f50d8184bb7dd84a2fb61e9ec63f3782546fdbd057/uvloop-0.22.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:c60ebcd36f7b240b30788554b6f0782454826a0ed765d8430652621b5de674b9", size = 1352420, upload-time = "2025-10-16T22:16:21.187Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/73/c4e271b3bce59724e291465cc936c37758886a4868787da0278b3b56b905/uvloop-0.22.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:3b7f102bf3cb1995cfeaee9321105e8f5da76fdb104cdad8986f85461a1b7b77", size = 748677, upload-time = "2025-10-16T22:16:22.558Z" },
+    { url = "https://files.pythonhosted.org/packages/86/94/9fb7fad2f824d25f8ecac0d70b94d0d48107ad5ece03769a9c543444f78a/uvloop-0.22.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:53c85520781d84a4b8b230e24a5af5b0778efdb39142b424990ff1ef7c48ba21", size = 3753819, upload-time = "2025-10-16T22:16:23.903Z" },
+    { url = "https://files.pythonhosted.org/packages/74/4f/256aca690709e9b008b7108bc85fba619a2bc37c6d80743d18abad16ee09/uvloop-0.22.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:56a2d1fae65fd82197cb8c53c367310b3eabe1bbb9fb5a04d28e3e3520e4f702", size = 3804529, upload-time = "2025-10-16T22:16:25.246Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/74/03c05ae4737e871923d21a76fe28b6aad57f5c03b6e6bfcfa5ad616013e4/uvloop-0.22.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:40631b049d5972c6755b06d0bfe8233b1bd9a8a6392d9d1c45c10b6f9e9b2733", size = 3621267, upload-time = "2025-10-16T22:16:26.819Z" },
+    { url = "https://files.pythonhosted.org/packages/75/be/f8e590fe61d18b4a92070905497aec4c0e64ae1761498cad09023f3f4b3e/uvloop-0.22.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:535cc37b3a04f6cd2c1ef65fa1d370c9a35b6695df735fcff5427323f2cd5473", size = 3723105, upload-time = "2025-10-16T22:16:28.252Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/ff/7f72e8170be527b4977b033239a83a68d5c881cc4775fca255c677f7ac5d/uvloop-0.22.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:fe94b4564e865d968414598eea1a6de60adba0c040ba4ed05ac1300de402cd42", size = 1359936, upload-time = "2025-10-16T22:16:29.436Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/c6/e5d433f88fd54d81ef4be58b2b7b0cea13c442454a1db703a1eea0db1a59/uvloop-0.22.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:51eb9bd88391483410daad430813d982010f9c9c89512321f5b60e2cddbdddd6", size = 752769, upload-time = "2025-10-16T22:16:30.493Z" },
+    { url = "https://files.pythonhosted.org/packages/24/68/a6ac446820273e71aa762fa21cdcc09861edd3536ff47c5cd3b7afb10eeb/uvloop-0.22.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:700e674a166ca5778255e0e1dc4e9d79ab2acc57b9171b79e65feba7184b3370", size = 4317413, upload-time = "2025-10-16T22:16:31.644Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/6f/e62b4dfc7ad6518e7eff2516f680d02a0f6eb62c0c212e152ca708a0085e/uvloop-0.22.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7b5b1ac819a3f946d3b2ee07f09149578ae76066d70b44df3fa990add49a82e4", size = 4426307, upload-time = "2025-10-16T22:16:32.917Z" },
+    { url = "https://files.pythonhosted.org/packages/90/60/97362554ac21e20e81bcef1150cb2a7e4ffdaf8ea1e5b2e8bf7a053caa18/uvloop-0.22.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:e047cc068570bac9866237739607d1313b9253c3051ad84738cbb095be0537b2", size = 4131970, upload-time = "2025-10-16T22:16:34.015Z" },
+    { url = "https://files.pythonhosted.org/packages/99/39/6b3f7d234ba3964c428a6e40006340f53ba37993f46ed6e111c6e9141d18/uvloop-0.22.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:512fec6815e2dd45161054592441ef76c830eddaad55c8aa30952e6fe1ed07c0", size = 4296343, upload-time = "2025-10-16T22:16:35.149Z" },
+]
+
 [[package]]
 name = "vine"
 version = "5.1.0"

From 8d4ec561c26265f7f1fd656c01be002bff168089 Mon Sep 17 00:00:00 2001
From: PrettyFox0 <github@twink.energy>
Date: Wed, 17 Jun 2026 12:15:14 +0200
Subject: [PATCH 068/126] feat(m365): add check for directory sync object
 takeover protection (#11098)

Co-authored-by: shadyfox <git@twink.energy>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
Co-authored-by: omobolaji adeyan <omobolaji.adeyan@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../__init__.py                               |   0
 ...sync_object_takeover_blocked.metadata.json |  42 +++
 ..._directory_sync_object_takeover_blocked.py | 118 ++++++
 .../m365/services/entra/entra_service.py      |  12 +
 ...ctory_sync_object_takeover_blocked_test.py | 339 ++++++++++++++++++
 6 files changed, 512 insertions(+)
 create mode 100644 prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/__init__.py
 create mode 100644 prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.metadata.json
 create mode 100644 prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.py
 create mode 100644 tests/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index a380b07115..b1327a7024 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -19,6 +19,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
+- `entra_directory_sync_object_takeover_blocked` check for the M365 provider, verifying that hybrid Entra tenants block cloud object takeover through both soft-match and hard-match directory synchronization [(#11098)](https://github.com/prowler-cloud/prowler/pull/11098)
 
 ### 🔄 Changed
 
diff --git a/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/__init__.py b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.metadata.json b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.metadata.json
new file mode 100644
index 0000000000..0cc14e2965
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.metadata.json
@@ -0,0 +1,42 @@
+{
+  "Provider": "m365",
+  "CheckID": "entra_directory_sync_object_takeover_blocked",
+  "CheckTitle": "Microsoft Entra directory sync must block object takeover (soft- and hard-matching)",
+  "CheckType": [],
+  "ServiceName": "entra",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "When on-premises directory synchronization is enabled, both blockSoftMatchEnabled and blockCloudObjectTakeoverThroughHardMatchEnabled must be true. Without these blocks, an attacker who can write to on-premises AD can craft an object that matches a privileged cloud account and take it over.",
+  "Risk": "An attacker with write access to on-premises Active Directory can create an object whose UPN, SMTP address, or ImmutableID matches an existing cloud-only account (e.g. Global Administrator). When the sync engine processes this object, it merges the on-premises identity into the cloud account, effectively granting the attacker full control of that privileged account.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/graph/api/resources/onpremisesdirectorysynchronization?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/resources/onpremisesdirectorysynchronizationfeature?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-syncservice-features"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Open Microsoft Entra admin center\n2. Navigate to Identity > Hybrid management > Microsoft Entra Connect > Connect Sync\n3. Enable 'Block soft match' and 'Block cloud object takeover through hard match'\n4. Alternatively, use Microsoft Graph API to set both features to true on the onPremisesDirectorySynchronization resource",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable both blockSoftMatchEnabled and blockCloudObjectTakeoverThroughHardMatchEnabled on the on-premises directory synchronization configuration. These should remain enabled permanently except during time-boxed migration windows.",
+      "Url": "https://hub.prowler.com/check/entra_directory_sync_object_takeover_blocked"
+    }
+  },
+  "Categories": [
+    "identity-access",
+    "e3"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "entra_password_hash_sync_enabled",
+    "entra_seamless_sso_disabled"
+  ],
+  "Notes": "This check only applies to hybrid tenants with on-premises directory synchronization enabled. Cloud-only tenants receive a PASS since the attack path does not exist."
+}
diff --git a/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.py b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.py
new file mode 100644
index 0000000000..d1f00a70ff
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked.py
@@ -0,0 +1,118 @@
+from typing import List
+
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.entra.entra_client import entra_client
+
+
+class entra_directory_sync_object_takeover_blocked(Check):
+    """Check that directory sync blocks object takeover via soft-match and hard-match.
+
+    When on-premises directory synchronization is enabled, an attacker who can
+    write to on-premises AD can craft an object that matches a privileged cloud
+    account and take it over. Both blockSoftMatchEnabled and
+    blockCloudObjectTakeoverThroughHardMatchEnabled must be true to prevent this.
+
+    The attack path only exists on hybrid tenants, so the tenant's
+    organization.onPremisesSyncEnabled is evaluated first. Microsoft Graph
+    returns an onPremisesSynchronization object (with all features disabled) even
+    for cloud-only tenants, so the directory sync features must not be evaluated
+    unless on-premises synchronization is actually enabled.
+
+    - PASS: The tenant is cloud-only, or both block flags are enabled.
+    - FAIL: On-premises sync is enabled and either block flag is disabled.
+    - MANUAL: On-premises sync is enabled but the settings cannot be read
+      (insufficient permissions) or were not returned by Microsoft Graph.
+    """
+
+    def execute(self) -> List[CheckReportM365]:
+        findings = []
+
+        organizations = entra_client.organizations or []
+        on_premises_sync_enabled = any(
+            organization.on_premises_sync_enabled for organization in organizations
+        )
+
+        # Cloud-only tenant: the object takeover attack path does not exist, so
+        # the directory sync features are not evaluated even if Microsoft Graph
+        # returns an (all-disabled) onPremisesSynchronization object.
+        if organizations and not on_premises_sync_enabled:
+            for organization in organizations:
+                report = CheckReportM365(
+                    self.metadata(),
+                    resource=organization,
+                    resource_id=organization.id,
+                    resource_name=organization.name,
+                )
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Entra organization {organization.name} is cloud-only "
+                    "(no on-premises sync), object takeover protection is not "
+                    "applicable."
+                )
+                findings.append(report)
+            return findings
+
+        # Hybrid tenant but the directory sync settings could not be read.
+        if entra_client.directory_sync_error:
+            for organization in organizations:
+                report = CheckReportM365(
+                    self.metadata(),
+                    resource=organization,
+                    resource_id=organization.id,
+                    resource_name=organization.name,
+                )
+                report.status = "MANUAL"
+                report.status_extended = (
+                    f"Cannot verify object takeover protection for "
+                    f"{organization.name}: {entra_client.directory_sync_error}."
+                )
+                findings.append(report)
+            return findings
+
+        for sync_settings in entra_client.directory_sync_settings:
+            report = CheckReportM365(
+                self.metadata(),
+                resource=sync_settings,
+                resource_id=sync_settings.id,
+                resource_name=f"Directory Sync {sync_settings.id}",
+            )
+
+            disabled_flags = []
+            if not sync_settings.block_soft_match_enabled:
+                disabled_flags.append("blockSoftMatchEnabled")
+            if not sync_settings.block_cloud_object_takeover_through_hard_match_enabled:
+                disabled_flags.append("blockCloudObjectTakeoverThroughHardMatchEnabled")
+
+            if not disabled_flags:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Entra directory sync {sync_settings.id} blocks both soft-match "
+                    "and hard-match object takeover."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Entra directory sync {sync_settings.id} does not block object "
+                    f"takeover: {', '.join(disabled_flags)} disabled."
+                )
+
+            findings.append(report)
+
+        # Hybrid tenant that reported on-premises sync but returned no settings.
+        if not entra_client.directory_sync_settings:
+            for organization in organizations:
+                report = CheckReportM365(
+                    self.metadata(),
+                    resource=organization,
+                    resource_id=organization.id,
+                    resource_name=organization.name,
+                )
+                report.status = "MANUAL"
+                report.status_extended = (
+                    f"Entra organization {organization.name} has on-premises sync "
+                    "enabled, but no directory sync settings were returned. Review "
+                    "the tenant configuration manually."
+                )
+                findings.append(report)
+
+        return findings
diff --git a/prowler/providers/m365/services/entra/entra_service.py b/prowler/providers/m365/services/entra/entra_service.py
index 20f2dbf3a3..39d958b44b 100644
--- a/prowler/providers/m365/services/entra/entra_service.py
+++ b/prowler/providers/m365/services/entra/entra_service.py
@@ -791,6 +791,16 @@ class Entra(M365Service):
                             features, "seamless_sso_enabled", False
                         )
                         or False,
+                        block_soft_match_enabled=getattr(
+                            features, "block_soft_match_enabled", False
+                        )
+                        or False,
+                        block_cloud_object_takeover_through_hard_match_enabled=getattr(
+                            features,
+                            "block_cloud_object_takeover_through_hard_match_enabled",
+                            False,
+                        )
+                        or False,
                     )
                 )
         except ODataError as error:
@@ -1637,6 +1647,8 @@ class DirectorySyncSettings(BaseModel):
     id: str
     password_sync_enabled: bool = False
     seamless_sso_enabled: bool = False
+    block_soft_match_enabled: bool = False
+    block_cloud_object_takeover_through_hard_match_enabled: bool = False
 
 
 class AuthenticationMethodConfiguration(BaseModel):
diff --git a/tests/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked_test.py b/tests/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked_test.py
new file mode 100644
index 0000000000..6c8696da55
--- /dev/null
+++ b/tests/providers/m365/services/entra/entra_directory_sync_object_takeover_blocked/entra_directory_sync_object_takeover_blocked_test.py
@@ -0,0 +1,339 @@
+from unittest import mock
+
+from prowler.providers.m365.services.entra.entra_service import (
+    DirectorySyncSettings,
+    Organization,
+)
+from tests.providers.m365.m365_fixtures import set_mocked_m365_provider
+
+CHECK_MODULE = (
+    "prowler.providers.m365.services.entra."
+    "entra_directory_sync_object_takeover_blocked."
+    "entra_directory_sync_object_takeover_blocked"
+)
+
+
+def _hybrid_org():
+    return Organization(
+        id="org-001",
+        name="Hybrid Org",
+        on_premises_sync_enabled=True,
+    )
+
+
+def _cloud_only_org():
+    return Organization(
+        id="org-001",
+        name="Cloud Only Org",
+        on_premises_sync_enabled=False,
+    )
+
+
+class Test_entra_directory_sync_object_takeover_blocked:
+    def test_both_blocks_enabled(self):
+        """PASS when both soft-match and hard-match blocks are enabled."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="sync-001",
+                    block_soft_match_enabled=True,
+                    block_cloud_object_takeover_through_hard_match_enabled=True,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "blocks both soft-match and hard-match" in result[0].status_extended
+
+    def test_soft_match_disabled(self):
+        """FAIL when soft-match block is disabled on a hybrid tenant."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="sync-001",
+                    block_soft_match_enabled=False,
+                    block_cloud_object_takeover_through_hard_match_enabled=True,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "blockSoftMatchEnabled" in result[0].status_extended
+
+    def test_hard_match_disabled(self):
+        """FAIL when hard-match block is disabled on a hybrid tenant."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="sync-001",
+                    block_soft_match_enabled=True,
+                    block_cloud_object_takeover_through_hard_match_enabled=False,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                "blockCloudObjectTakeoverThroughHardMatchEnabled"
+                in result[0].status_extended
+            )
+
+    def test_both_blocks_disabled(self):
+        """FAIL when both blocks are disabled on a hybrid tenant."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="sync-001",
+                    block_soft_match_enabled=False,
+                    block_cloud_object_takeover_through_hard_match_enabled=False,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "blockSoftMatchEnabled" in result[0].status_extended
+            assert (
+                "blockCloudObjectTakeoverThroughHardMatchEnabled"
+                in result[0].status_extended
+            )
+
+    def test_cloud_only_tenant(self):
+        """PASS when tenant is cloud-only and no sync object is returned."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = []
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_cloud_only_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "cloud-only" in result[0].status_extended
+
+    def test_cloud_only_tenant_with_sync_object_returned(self):
+        """PASS for cloud-only tenants even when Graph returns a sync object.
+
+        Microsoft Graph returns an onPremisesSynchronization object (with all
+        features disabled) for cloud-only tenants. The check must not treat the
+        disabled flags as a FAIL when on-premises sync is not enabled.
+        """
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = [
+                DirectorySyncSettings(
+                    id="tenant-id",
+                    password_sync_enabled=False,
+                    seamless_sso_enabled=False,
+                    block_soft_match_enabled=False,
+                    block_cloud_object_takeover_through_hard_match_enabled=False,
+                )
+            ]
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_cloud_only_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "cloud-only" in result[0].status_extended
+
+    def test_permission_error_hybrid(self):
+        """MANUAL when permissions are insufficient for a hybrid tenant."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = []
+            entra_client.directory_sync_error = "Insufficient privileges"
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "MANUAL"
+            assert "Cannot verify" in result[0].status_extended
+            assert "Insufficient privileges" in result[0].status_extended
+
+    def test_permission_error_cloud_only(self):
+        """PASS when settings cannot be read but the tenant is cloud-only."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = []
+            entra_client.directory_sync_error = "Insufficient privileges"
+            entra_client.organizations = [_cloud_only_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "cloud-only" in result[0].status_extended
+
+    def test_hybrid_no_settings_returned(self):
+        """MANUAL when a hybrid tenant returns no directory sync settings."""
+        entra_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(
+                f"{CHECK_MODULE}.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.m365.services.entra.entra_directory_sync_object_takeover_blocked.entra_directory_sync_object_takeover_blocked import (
+                entra_directory_sync_object_takeover_blocked,
+            )
+
+            entra_client.directory_sync_settings = []
+            entra_client.directory_sync_error = None
+            entra_client.organizations = [_hybrid_org()]
+
+            check = entra_directory_sync_object_takeover_blocked()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "MANUAL"
+            assert (
+                "no directory sync settings were returned" in result[0].status_extended
+            )

From 54518bd12769a36efe953b5f16a7c343d1a2de2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Wed, 17 Jun 2026 13:02:20 +0200
Subject: [PATCH 069/126] fix(ui): raise node heap to fix arm64 docker build
 OOM (#11628)

---
 ui/Dockerfile | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/Dockerfile b/ui/Dockerfile
index f7ec32c55e..6cf930ee5e 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -16,6 +16,7 @@ WORKDIR /app
 # Install dependencies based on the preferred package manager
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 COPY scripts ./scripts
+ENV NODE_OPTIONS=--max-old-space-size=4096
 RUN corepack install && pnpm install --frozen-lockfile
 
 

From aa60dc3e178885771338b17e715af9cb10477889 Mon Sep 17 00:00:00 2001
From: "Pablo Fernandez Guerra (PFE)"
 <148432447+pfe-nazaries@users.noreply.github.com>
Date: Wed, 17 Jun 2026 13:18:39 +0200
Subject: [PATCH 070/126] ci(ui): add missing Google Workspace env vars to E2E
 workflow (#11599)

Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
---
 .github/workflows/ui-e2e-tests-v2.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml
index d537084c5c..cc3953274a 100644
--- a/.github/workflows/ui-e2e-tests-v2.yml
+++ b/.github/workflows/ui-e2e-tests-v2.yml
@@ -77,6 +77,9 @@ jobs:
       E2E_ALIBABACLOUD_ACCESS_KEY_ID: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_ID }}
       E2E_ALIBABACLOUD_ACCESS_KEY_SECRET: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_SECRET }}
       E2E_ALIBABACLOUD_ROLE_ARN: ${{ secrets.E2E_ALIBABACLOUD_ROLE_ARN }}
+      E2E_GOOGLEWORKSPACE_CUSTOMER_ID: ${{ secrets.E2E_GOOGLEWORKSPACE_CUSTOMER_ID }}
+      E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON: ${{ secrets.E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON }}
+      E2E_GOOGLEWORKSPACE_DELEGATED_USER: ${{ secrets.E2E_GOOGLEWORKSPACE_DELEGATED_USER }}
       E2E_VERCEL_TEAM_ID: ${{ secrets.E2E_VERCEL_TEAM_ID }}
       E2E_VERCEL_API_TOKEN: ${{ secrets.E2E_VERCEL_API_TOKEN }}
       # Pass E2E paths from impact analysis

From f1a30f706a21b269250b3b11acf9d9659e5ad64a Mon Sep 17 00:00:00 2001
From: Josema Camacho <josema@prowler.com>
Date: Wed, 17 Jun 2026 14:04:36 +0200
Subject: [PATCH 071/126] fix(api): raise Gunicorn worker timeout to 120s via
 GUNICORN_TIMEOUT (#11631)

---
 api/CHANGELOG.md                   | 4 ++++
 api/src/backend/config/guniconf.py | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 930cf8f45f..0ddb8ae3f2 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -10,6 +10,10 @@ All notable changes to the **Prowler API** are documented in this file.
 - Provider filters for `GET /api/v1/compliance-overviews`, `/metadata`, and `/requirements`, using latest completed scans per matching provider [(#11587)](https://github.com/prowler-cloud/prowler/pull/11587)
 - Server-Sent Events (SSE) infrastructure for the API: a base viewset, a tenant-aware channel manager, and channel-name helpers backed by `django-eventstream` over Valkey Pub/Sub and served through the Gunicorn ASGI worker, so feature endpoints can stream events to clients over a single long-lived connection [(#11556)](https://github.com/prowler-cloud/prowler/pull/11556)
 
+### 🔄 Changed
+
+- Gunicorn worker timeout raised from the 30s default to 120s, so long-running requests are no longer killed prematurely [(#11631)](https://github.com/prowler-cloud/prowler/pull/11631)
+
 ### 🔐 Security
 
 - `aiohttp` to 3.14.0 and `idna` to 3.15, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
diff --git a/api/src/backend/config/guniconf.py b/api/src/backend/config/guniconf.py
index b4caca5e5c..63472feec8 100644
--- a/api/src/backend/config/guniconf.py
+++ b/api/src/backend/config/guniconf.py
@@ -52,6 +52,10 @@ worker_connections = env.int("DJANGO_WORKER_CONNECTIONS", default=1000)
 # preload so the server restarts on code changes.
 preload_app = not DEBUG
 
+# Worker timeout in seconds. Increased from the default 30s to handle requests
+# that may take longer, such as complex API operations.
+timeout = env.int("GUNICORN_TIMEOUT", default=120)
+
 # Logging
 logconfig_dict = DJANGO_LOGGERS
 gunicorn_logger = logging.getLogger(BackendLogger.GUNICORN)

From 73059ffc7e96dff71cbc6fe0aa38df6f9c4a63be Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Wed, 17 Jun 2026 21:12:18 +0900
Subject: [PATCH 072/126] feat(azure): add
 databricks_workspace_public_network_access_disabled check (#11035)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
Co-authored-by: Hugo P.Brito <hugopbrito@Hugos-MacBook-Pro.local>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   1 +
 .../services/databricks/databricks_service.py |   5 +
 .../__init__.py                               |   0
 ...blic_network_access_disabled.metadata.json |  38 ++++
 ...orkspace_public_network_access_disabled.py |  35 ++++
 .../databricks/databricks_service_test.py     |   2 +
 ...ace_public_network_access_disabled_test.py | 170 ++++++++++++++++++
 8 files changed, 252 insertions(+)
 create mode 100644 prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/__init__.py
 create mode 100644 prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.metadata.json
 create mode 100644 prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.py
 create mode 100644 tests/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index b1327a7024..1b499c34e9 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -16,6 +16,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
 - `cosmosdb_account_minimum_tls_version` check for Azure provider, verifying Cosmos DB accounts enforce TLS 1.2 or higher for client connections [(#11033)](https://github.com/prowler-cloud/prowler/pull/11033)
 - `cosmosdb_account_public_network_access_disabled` check for Azure provider, verifying Cosmos DB accounts have public network access disabled so connectivity is restricted to private endpoints or VNet service endpoints [(#11034)](https://github.com/prowler-cloud/prowler/pull/11034)
+- `databricks_workspace_public_network_access_disabled` check for Azure provider, verifying Databricks workspaces have public network access disabled so connectivity is restricted to Azure Private Link private endpoints [(#11035)](https://github.com/prowler-cloud/prowler/pull/11035)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index d137938fd7..1eb0f75792 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1411,6 +1411,7 @@
         "containerregistry_not_publicly_accessible",
         "cosmosdb_account_firewall_use_selected_networks",
         "cosmosdb_account_public_network_access_disabled",
+        "databricks_workspace_public_network_access_disabled",
         "network_bastion_host_exists",
         "network_flow_log_captured_sent",
         "network_flow_log_more_than_90_days",
diff --git a/prowler/providers/azure/services/databricks/databricks_service.py b/prowler/providers/azure/services/databricks/databricks_service.py
index 7920500d88..1e30452294 100644
--- a/prowler/providers/azure/services/databricks/databricks_service.py
+++ b/prowler/providers/azure/services/databricks/databricks_service.py
@@ -66,6 +66,9 @@ class Databricks(AzureService):
                         id=workspace.id,
                         name=workspace.name,
                         location=workspace.location,
+                        public_network_access=getattr(
+                            workspace, "public_network_access", None
+                        ),
                         custom_managed_vnet_id=(
                             getattr(
                                 workspace_parameters, "custom_virtual_network_id", None
@@ -107,6 +110,7 @@ class DatabricksWorkspace(BaseModel):
         id: The unique identifier of the workspace.
         name: The name of the workspace.
         location: The Azure region where the workspace is deployed.
+        public_network_access: Whether public network access is "Enabled" or "Disabled", if configured.
         custom_managed_vnet_id: The ID of the custom managed virtual network, if configured.
         managed_disk_encryption: The encryption settings for the workspace's managed disks.
     """
@@ -114,5 +118,6 @@ class DatabricksWorkspace(BaseModel):
     id: str
     name: str
     location: str
+    public_network_access: Optional[str] = None
     custom_managed_vnet_id: Optional[str] = None
     managed_disk_encryption: Optional[ManagedDiskEncryption] = None
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/__init__.py b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.metadata.json b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.metadata.json
new file mode 100644
index 0000000000..cb92d6df0f
--- /dev/null
+++ b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "databricks_workspace_public_network_access_disabled",
+  "CheckTitle": "Databricks workspace has public network access disabled",
+  "CheckType": [],
+  "ServiceName": "databricks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "microsoft.databricks/workspaces",
+  "ResourceGroup": "ai_ml",
+  "Description": "**Azure Databricks workspaces** are evaluated for **public network access**. Disabling public network access ensures the workspace is only reachable through **private endpoints**, reducing the attack surface and preventing direct exposure of the control plane and data plane to the internet.",
+  "Risk": "Allowing **public network access** exposes the Databricks workspace control plane and data plane to the internet. Combined with leaked **credentials**, **personal access tokens**, or unpatched vulnerabilities, this enables **unauthorized access**, **brute force**, and **data exfiltration** from any source on the internet.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/private-link",
+    "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/private-link#step-4-disable-public-network-access",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.databricks/workspaces"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az databricks workspace update --name <workspace_name> --resource-group <resource_group_name> --public-network-access Disabled",
+      "NativeIaC": "```bicep\n// Bicep: Disable public network access on a Databricks workspace\nresource workspace 'Microsoft.Databricks/workspaces@2023-02-01' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  sku: {\n    name: 'premium'\n  }\n  properties: {\n    managedResourceGroupId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>'\n    publicNetworkAccess: 'Disabled' // CRITICAL: Blocks all public-internet traffic to the workspace\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your Databricks workspace\n2. In the left menu, select Networking\n3. Under Public network access, select Disabled\n4. Configure Azure Private Link private endpoints before saving so clients retain connectivity\n5. Click Save",
+      "Terraform": "```hcl\n# Terraform: Disable public network access on a Databricks workspace\nresource \"azurerm_databricks_workspace\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<region>\"\n  sku                 = \"premium\"\n\n  public_network_access_enabled = false # CRITICAL: Blocks all public-internet traffic to the workspace\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Disable **public network access** on Databricks workspaces and require connectivity via **Azure Private Link** private endpoints. Before enforcement, validate that all application workloads have private-network connectivity, and pair this control with **VNet injection**, **secure cluster connectivity (no public IP)**, and least-privilege access to uphold **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/databricks_workspace_public_network_access_disabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.py b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.py
new file mode 100644
index 0000000000..e8193cedb6
--- /dev/null
+++ b/prowler/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled.py
@@ -0,0 +1,35 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.databricks.databricks_client import (
+    databricks_client,
+)
+
+
+class databricks_workspace_public_network_access_disabled(Check):
+    """
+    Ensure Azure Databricks workspaces have public network access disabled.
+
+    This check evaluates whether each Azure Databricks workspace in the subscription restricts connectivity to private endpoints by disabling public network access.
+
+    - PASS: The workspace has public network access disabled (public_network_access is "Disabled").
+    - FAIL: The workspace has public network access enabled (or the value is not set).
+    """
+
+    def execute(self):
+        findings = []
+        for subscription, workspaces in databricks_client.workspaces.items():
+            subscription_name = databricks_client.subscriptions.get(
+                subscription, subscription
+            )
+            for workspace in workspaces.values():
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource=workspace
+                )
+                report.subscription = subscription
+                if workspace.public_network_access == "Disabled":
+                    report.status = "PASS"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has public network access disabled."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has public network access enabled."
+                findings.append(report)
+        return findings
diff --git a/tests/providers/azure/services/databricks/databricks_service_test.py b/tests/providers/azure/services/databricks/databricks_service_test.py
index 69651f2235..5c743d1891 100644
--- a/tests/providers/azure/services/databricks/databricks_service_test.py
+++ b/tests/providers/azure/services/databricks/databricks_service_test.py
@@ -18,6 +18,7 @@ def mock_databricks_get_workspaces(_):
                 id="test-workspace-id",
                 name="test-workspace",
                 location="eastus",
+                public_network_access="Disabled",
                 custom_managed_vnet_id="test-vnet-id",
                 managed_disk_encryption=ManagedDiskEncryption(
                     key_name="test-key",
@@ -53,6 +54,7 @@ class Test_Databricks_Service:
         assert workspace.id == "test-workspace-id"
         assert workspace.name == "test-workspace"
         assert workspace.location == "eastus"
+        assert workspace.public_network_access == "Disabled"
         assert workspace.custom_managed_vnet_id == "test-vnet-id"
         assert (
             workspace.managed_disk_encryption.__class__.__name__
diff --git a/tests/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled_test.py b/tests/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled_test.py
new file mode 100644
index 0000000000..7d39d38760
--- /dev/null
+++ b/tests/providers/azure/services/databricks/databricks_workspace_public_network_access_disabled/databricks_workspace_public_network_access_disabled_test.py
@@ -0,0 +1,170 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.databricks.databricks_service import (
+    DatabricksWorkspace,
+)
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_databricks_workspace_public_network_access_disabled:
+    def test_databricks_no_workspaces(self):
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled import (
+                databricks_workspace_public_network_access_disabled,
+            )
+
+            check = databricks_workspace_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_databricks_workspace_public_network_access_enabled(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    public_network_access="Enabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled import (
+                databricks_workspace_public_network_access_disabled,
+            )
+
+            check = databricks_workspace_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"
+
+    def test_databricks_workspace_public_network_access_not_set(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    public_network_access=None,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled import (
+                databricks_workspace_public_network_access_disabled,
+            )
+
+            check = databricks_workspace_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access enabled."
+            )
+
+    def test_databricks_workspace_public_network_access_disabled(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    public_network_access="Disabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_public_network_access_disabled.databricks_workspace_public_network_access_disabled import (
+                databricks_workspace_public_network_access_disabled,
+            )
+
+            check = databricks_workspace_public_network_access_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has public network access disabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"

From 6546d51a6c3ef18be14b03d815dd80d3999743ff Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:44:52 +0200
Subject: [PATCH 073/126] fix(ui): show alert permission errors (#11629)

---
 ui/CHANGELOG.md                               |  4 ++
 .../__tests__/alert-form-modal.test.tsx       | 23 ++++++
 .../__tests__/alerts-manager.test.tsx         | 33 +++++++--
 .../alerts/_components/alert-form-modal.tsx   |  7 +-
 .../alerts/_components/alerts-manager.tsx     |  9 ++-
 ui/app/(prowler)/alerts/_lib/alert-errors.ts  | 25 +++++++
 ui/lib/action-errors.test.ts                  | 72 +++++++++++++++++++
 ui/lib/action-errors.ts                       | 43 +++++++++++
 8 files changed, 204 insertions(+), 12 deletions(-)
 create mode 100644 ui/app/(prowler)/alerts/_lib/alert-errors.ts
 create mode 100644 ui/lib/action-errors.test.ts
 create mode 100644 ui/lib/action-errors.ts

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 8e44db2eb2..1baddf169a 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 ## [1.31.0] (Prowler UNRELEASED)
 
+### 🚀 Added
+
+- Controlled `402` and `403` Server Action error messages for alert seed and mutation flows [(#11629)](https://github.com/prowler-cloud/prowler/pull/11629)
+
 ### 🐞 Fixed
 
 - Radio button no longer shifts vertically when selected [(#11608)](https://github.com/prowler-cloud/prowler/pull/11608)
diff --git a/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
index f23fafb948..026ba439f1 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx
@@ -14,6 +14,7 @@ import {
 } from "@/app/(prowler)/alerts/_types";
 import type { ProviderProps } from "@/types/providers";
 
+import { ALERTS_PERMISSION_ERROR } from "../../_lib/alert-errors";
 import { AlertFormModal } from "../alert-form-modal";
 
 const recipientsActionMocks = vi.hoisted(() => ({
@@ -726,6 +727,28 @@ describe("AlertFormModal", () => {
     ).toHaveLength(1);
   });
 
+  it("should show the manage alerts permission error when save seed is forbidden", async () => {
+    // Given
+    const user = userEvent.setup();
+    alertsActionMocks.seedAlertRule.mockResolvedValue({
+      error: "You do not have permission to perform this action.",
+      status: 403,
+    });
+    mockRecipientsList();
+    renderCreateModal({ editingAlert: createEditingAlert() });
+
+    // When
+    await user.click(screen.getByRole("button", { name: /^save$/i }));
+
+    // Then
+    expect(await screen.findByText(ALERTS_PERMISSION_ERROR)).toBeVisible();
+    expect(
+      screen.queryByText(
+        "Apply at least one alert-compatible Findings filter.",
+      ),
+    ).not.toBeInTheDocument();
+  });
+
   it("should hydrate advanced edit mode filters and normalize them on save", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx b/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
index 0230dccfa3..c8a6c9fb61 100644
--- a/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
+++ b/ui/app/(prowler)/alerts/_components/__tests__/alerts-manager.test.tsx
@@ -13,6 +13,7 @@ import type {
   AlertFormValues,
 } from "@/app/(prowler)/alerts/_types/alert-form";
 
+import { ALERTS_PERMISSION_ERROR } from "../../_lib/alert-errors";
 import { AlertsManager } from "../alerts-manager";
 
 const actionMocks = vi.hoisted(() => ({
@@ -316,11 +317,7 @@ describe("AlertsManager", () => {
     await user.click(screen.getByRole("button", { name: /submit alert/i }));
 
     // Then
-    expect(
-      await screen.findByText(
-        "You don't have permission to manage alerts. Ask an administrator to update your role.",
-      ),
-    ).toBeVisible();
+    expect(await screen.findByText(ALERTS_PERMISSION_ERROR)).toBeVisible();
     expect(toastMock).not.toHaveBeenCalled();
   });
 
@@ -346,6 +343,32 @@ describe("AlertsManager", () => {
     );
   });
 
+  it("shows a manage alerts permission toast for disable 403 errors", async () => {
+    // Given
+    const user = userEvent.setup();
+    const alert = makeAlert(true);
+    actionMocks.disableAlert.mockResolvedValue({
+      error: "You do not have permission to perform this action.",
+      status: 403,
+    });
+    renderManager([alert]);
+
+    // When
+    await user.click(
+      screen.getByRole("button", { name: /actions for enabled alert/i }),
+    );
+    await user.click(screen.getByRole("menuitem", { name: /disable/i }));
+
+    // Then
+    await waitFor(() =>
+      expect(toastMock).toHaveBeenCalledWith({
+        variant: "destructive",
+        title: "Alert update failed",
+        description: ALERTS_PERMISSION_ERROR,
+      }),
+    );
+  });
+
   it("shows a success toast after enabling an alert", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx b/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
index 12d7a85df9..8a9effd890 100644
--- a/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
+++ b/ui/app/(prowler)/alerts/_components/alert-form-modal.tsx
@@ -54,6 +54,7 @@ import {
   getEmptyAlertFormDefaults,
   getFindingsFiltersFromAlertCondition,
 } from "../_lib/alert-adapter";
+import { getAlertMutationError } from "../_lib/alert-errors";
 import { alertFormSchema } from "../_lib/alert-form-schema";
 import type {
   AlertFormSubmitResult,
@@ -408,7 +409,7 @@ const AlertFormModalContent = ({
     if (seedResult?.error) {
       setPreview({
         status: "error",
-        error: ALERT_SEED_ERROR,
+        error: getAlertMutationError(seedResult, ALERT_SEED_ERROR),
       });
       return;
     }
@@ -452,7 +453,9 @@ const AlertFormModalContent = ({
       : null;
     if (seedResult?.error) {
       setPreview(null);
-      setErrors({ root: ALERT_SEED_ERROR });
+      setErrors({
+        root: getAlertMutationError(seedResult, ALERT_SEED_ERROR),
+      });
       return;
     }
 
diff --git a/ui/app/(prowler)/alerts/_components/alerts-manager.tsx b/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
index e438727c6f..e29a0651c2 100644
--- a/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
+++ b/ui/app/(prowler)/alerts/_components/alerts-manager.tsx
@@ -24,6 +24,7 @@ import type { ScanEntity } from "@/types";
 import type { ProviderProps } from "@/types/providers";
 
 import { toAlertPayload } from "../_lib/alert-adapter";
+import { getAlertMutationError } from "../_lib/alert-errors";
 import type {
   AlertFormSubmitResult,
   AlertFormValues,
@@ -49,8 +50,6 @@ interface AlertsManagerProps {
 
 const ALERTS_FINDINGS_HREF =
   "/findings?filter[muted]=false&filter[status__in]=FAIL";
-const ALERTS_PERMISSION_ERROR =
-  "You don't have permission to manage alerts. Ask an administrator to update your role.";
 
 export const AlertsManager = ({
   alerts,
@@ -113,7 +112,7 @@ export const AlertsManager = ({
     if (result?.error) {
       return {
         ok: false,
-        error: result.status === 403 ? ALERTS_PERMISSION_ERROR : result.error,
+        error: getAlertMutationError(result),
       };
     }
     toast({
@@ -134,7 +133,7 @@ export const AlertsManager = ({
       toast({
         variant: "destructive",
         title: "Alert update failed",
-        description: result.error,
+        description: getAlertMutationError(result),
       });
       return;
     }
@@ -154,7 +153,7 @@ export const AlertsManager = ({
       toast({
         variant: "destructive",
         title: "Alert delete failed",
-        description: result.error,
+        description: getAlertMutationError(result),
       });
       return;
     }
diff --git a/ui/app/(prowler)/alerts/_lib/alert-errors.ts b/ui/app/(prowler)/alerts/_lib/alert-errors.ts
new file mode 100644
index 0000000000..a921338066
--- /dev/null
+++ b/ui/app/(prowler)/alerts/_lib/alert-errors.ts
@@ -0,0 +1,25 @@
+import {
+  ACTION_ERROR_STATUS,
+  getActionErrorMessage,
+} from "@/lib/action-errors";
+
+export const ALERTS_PERMISSION_ERROR =
+  "You don't have permission to manage alerts. Ask an administrator to update your role.";
+
+interface AlertActionErrorResult {
+  error: string;
+  status?: number;
+}
+
+export const getAlertMutationError = (
+  result: AlertActionErrorResult,
+  fallback = result.error,
+): string =>
+  getActionErrorMessage(
+    { ...result, error: fallback },
+    {
+      messages: {
+        [ACTION_ERROR_STATUS.FORBIDDEN]: ALERTS_PERMISSION_ERROR,
+      },
+    },
+  );
diff --git a/ui/lib/action-errors.test.ts b/ui/lib/action-errors.test.ts
new file mode 100644
index 0000000000..5731d90a4c
--- /dev/null
+++ b/ui/lib/action-errors.test.ts
@@ -0,0 +1,72 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  ACTION_ERROR_MESSAGES,
+  ACTION_ERROR_STATUS,
+  getActionErrorMessage,
+} from "./action-errors";
+
+describe("getActionErrorMessage", () => {
+  it("should use the default permission error for forbidden responses", () => {
+    // Given
+    const result = {
+      error: "You do not have permission to perform this action.",
+      status: ACTION_ERROR_STATUS.FORBIDDEN,
+    };
+
+    // When
+    const message = getActionErrorMessage(result);
+
+    // Then
+    expect(message).toBe(ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.FORBIDDEN]);
+  });
+
+  it("should use the default subscription error for payment-required responses", () => {
+    // Given
+    const result = {
+      error: "Payment required.",
+      status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED,
+    };
+
+    // When
+    const message = getActionErrorMessage(result);
+
+    // Then
+    expect(message).toBe(
+      ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+    );
+  });
+
+  it("should use a feature override for handled statuses", () => {
+    // Given
+    const result = {
+      error: "You do not have permission to perform this action.",
+      status: ACTION_ERROR_STATUS.FORBIDDEN,
+    };
+    const override = "You don't have permission to manage alerts.";
+
+    // When
+    const message = getActionErrorMessage(result, {
+      messages: {
+        [ACTION_ERROR_STATUS.FORBIDDEN]: override,
+      },
+    });
+
+    // Then
+    expect(message).toBe(override);
+  });
+
+  it("should keep the API error for unhandled statuses", () => {
+    // Given
+    const result = {
+      error: "Apply at least one alert-compatible Findings filter.",
+      status: 400,
+    };
+
+    // When
+    const message = getActionErrorMessage(result);
+
+    // Then
+    expect(message).toBe(result.error);
+  });
+});
diff --git a/ui/lib/action-errors.ts b/ui/lib/action-errors.ts
new file mode 100644
index 0000000000..74ae4803fa
--- /dev/null
+++ b/ui/lib/action-errors.ts
@@ -0,0 +1,43 @@
+export const ACTION_ERROR_STATUS = {
+  PAYMENT_REQUIRED: 402,
+  FORBIDDEN: 403,
+} as const;
+
+export type ActionErrorStatus =
+  (typeof ACTION_ERROR_STATUS)[keyof typeof ACTION_ERROR_STATUS];
+
+export const ACTION_ERROR_MESSAGES = {
+  [ACTION_ERROR_STATUS.PAYMENT_REQUIRED]:
+    "Your subscription doesn't allow this action. Upgrade your plan or contact an administrator.",
+  [ACTION_ERROR_STATUS.FORBIDDEN]:
+    "You don't have permission to perform this action. Ask an administrator to update your role.",
+} as const satisfies Record<ActionErrorStatus, string>;
+
+interface ActionErrorResult {
+  error?: string;
+  status?: number;
+}
+
+interface GetActionErrorMessageOptions {
+  messages?: Partial<Record<ActionErrorStatus, string>>;
+  fallback?: string;
+}
+
+const isActionErrorStatus = (
+  status: number | undefined,
+): status is ActionErrorStatus =>
+  status === ACTION_ERROR_STATUS.PAYMENT_REQUIRED ||
+  status === ACTION_ERROR_STATUS.FORBIDDEN;
+
+export const getActionErrorMessage = (
+  result: ActionErrorResult,
+  options: GetActionErrorMessageOptions = {},
+): string => {
+  if (isActionErrorStatus(result.status)) {
+    return (
+      options.messages?.[result.status] ?? ACTION_ERROR_MESSAGES[result.status]
+    );
+  }
+
+  return result.error ?? options.fallback ?? "Oops! Something went wrong.";
+};

From e2ce41a49281217bad0a321ed1e590bc293f84c4 Mon Sep 17 00:00:00 2001
From: StylusFrost <43682773+StylusFrost@users.noreply.github.com>
Date: Wed, 17 Jun 2026 15:55:21 +0200
Subject: [PATCH 074/126] feat(sdk): add Provider.get_class dynamic provider
 resolver (#11398)

---
 prowler/CHANGELOG.md                          |   1 +
 prowler/providers/common/provider.py          | 150 ++++----
 .../external/test_dynamic_provider_loading.py | 347 +++++++++++++++++-
 3 files changed, 431 insertions(+), 67 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 1b499c34e9..d187019a5b 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -18,6 +18,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `cosmosdb_account_public_network_access_disabled` check for Azure provider, verifying Cosmos DB accounts have public network access disabled so connectivity is restricted to private endpoints or VNet service endpoints [(#11034)](https://github.com/prowler-cloud/prowler/pull/11034)
 - `databricks_workspace_public_network_access_disabled` check for Azure provider, verifying Databricks workspaces have public network access disabled so connectivity is restricted to Azure Private Link private endpoints [(#11035)](https://github.com/prowler-cloud/prowler/pull/11035)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
+- Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
 - `entra_directory_sync_object_takeover_blocked` check for the M365 provider, verifying that hybrid Entra tenants block cloud object takeover through both soft-match and hard-match directory synchronization [(#11098)](https://github.com/prowler-cloud/prowler/pull/11098)
diff --git a/prowler/providers/common/provider.py b/prowler/providers/common/provider.py
index 8bc7567795..77ae9180a3 100644
--- a/prowler/providers/common/provider.py
+++ b/prowler/providers/common/provider.py
@@ -261,36 +261,16 @@ class Provider(ABC):
     @staticmethod
     def init_global_provider(arguments: Namespace) -> None:
         try:
-            # Discriminate built-in vs external upfront via find_spec, so an
-            # ImportError from a transitive dependency missing inside a
-            # built-in's own import chain surfaces clearly instead of being
-            # silently re-routed to the entry-point path.
-            provider_class = None
-            if Provider.is_builtin(arguments.provider):
-                # Built-in wins on provider-name collision. Plug-ins are
-                # first-class extenders (they can register new provider
-                # names) but cannot override existing built-ins — a security
-                # tool prefers fail-loud predictability over silent
-                # overrides. Surface the override so the user knows their
-                # plug-in is being ignored and can rename it.
-                # Match by name only — never ep.load() a shadowing plug-in.
-                if any(
-                    ep.name == arguments.provider
-                    for ep in importlib.metadata.entry_points(group="prowler.providers")
-                ):
-                    logger.warning(
-                        f"Plug-in provider '{arguments.provider}' registered "
-                        f"via entry points is being IGNORED — a built-in with "
-                        f"the same name exists. To use your plug-in, register "
-                        f"it under a different name."
-                    )
-                provider_class_path = f"{providers_path}.{arguments.provider}.{arguments.provider}_provider"
-                provider_class_name = f"{arguments.provider.capitalize()}Provider"
-                try:
-                    provider_class = getattr(
-                        import_module(provider_class_path), provider_class_name
-                    )
-                except ImportError as e:
+            # Delegate class resolution to the public, side-effect-free
+            # resolver.  init_global_provider owns the CLI-specific error
+            # handling: a missing transitive dep in a built-in becomes a
+            # logger.critical + sys.exit(1); a completely unknown provider
+            # re-raises so the outer try/except can sys.exit too.
+            try:
+                provider_class = Provider.get_class(arguments.provider)
+            except ImportError as e:
+                if Provider.is_builtin(arguments.provider):
+                    # Built-in's transitive dependency is missing — loud CLI error.
                     logger.critical(
                         f"Failed to load built-in provider '{arguments.provider}'. "
                         f"Missing dependency: {e}. "
@@ -298,25 +278,28 @@ class Provider(ABC):
                     )
                     logger.debug("Full traceback:", exc_info=True)
                     sys.exit(1)
-                except AttributeError:
-                    # Module exists but doesn't define the expected class —
-                    # treat as external and try entry points.
-                    provider_class = Provider._load_ep_provider(arguments.provider)
-            else:
-                provider_class = Provider._load_ep_provider(arguments.provider)
+                # Unknown or missing external provider — propagate so the
+                # outer try/except can handle it (sys.exit(1) via generic
+                # exception handler).
+                raise
 
-            if provider_class is None:
-                raise ImportError(
-                    f"Provider '{arguments.provider}' not found as built-in or entry point"
+            # Built-in wins on name collision — warn that a same-named
+            # plug-in is ignored.  This lives here (not in get_class) so
+            # that `prowler --help` and API callers that resolve a class
+            # without initialising a global provider do not see spurious
+            # warnings. Match by name only — never ep.load() a shadowing
+            # plug-in, or its module code would run during a built-in run.
+            if Provider.is_builtin(arguments.provider) and any(
+                ep.name == arguments.provider
+                for ep in importlib.metadata.entry_points(group="prowler.providers")
+            ):
+                logger.warning(
+                    f"Plug-in provider '{arguments.provider}' registered "
+                    f"via entry points is being IGNORED — a built-in with "
+                    f"the same name exists. To use your plug-in, register "
+                    f"it under a different name."
                 )
 
-            # Kept for downstream forks that may extend the dispatch below
-            # with their own custom built-in branches and reference this name.
-            # The upstream chain dispatches by `arguments.provider` directly.
-            provider_class_name = (
-                f"{arguments.provider.capitalize()}Provider"  # noqa: F841
-            )
-
             fixer_config = load_and_validate_config_file(
                 arguments.provider, arguments.fixer_config
             )
@@ -693,30 +676,69 @@ class Provider(ABC):
         Provider._ep_providers[name] = None
         return None
 
+    @staticmethod
+    def get_class(provider: str) -> type:
+        """Resolve the provider class for a name (built-in or entry-point).
+
+        Does not call ``sys.exit`` and does not initialize the global
+        provider (it may populate the ``_ep_providers`` memoization cache).
+        Collision warnings are emitted by ``init_global_provider``, not here.
+        The caller handles errors (CLI exits; the API can return HTTP 400).
+
+        Args:
+            provider: Provider name, e.g. ``"aws"`` or an external plug-in.
+
+        Returns:
+            The provider class (a subclass of :class:`Provider`).
+
+        Raises:
+            ImportError: If not found as built-in or entry point, a built-in's
+                transitive dependency is missing, or an entry point resolves to
+                an object that is not a subclass of :class:`Provider`.
+        """
+        if Provider.is_builtin(provider):
+            provider_class_path = f"{providers_path}.{provider}.{provider}_provider"
+            provider_class_name = f"{provider.capitalize()}Provider"
+            # Let ImportError propagate — the caller decides whether to
+            # sys.exit (CLI) or return HTTP 400 (API).
+            module = import_module(provider_class_path)
+            try:
+                return getattr(module, provider_class_name)
+            except AttributeError as error:
+                # is_builtin already confirmed this is a built-in, so the
+                # module MUST define the expected class. A missing class is a
+                # broken built-in contract — raise rather than fall back to a
+                # same-named external plug-in, which would contradict
+                # is_builtin and silently return a foreign class.
+                raise ImportError(
+                    f"Built-in provider '{provider}' module "
+                    f"'{provider_class_path}' does not define expected class "
+                    f"'{provider_class_name}'"
+                ) from error
+
+        cls = Provider._load_ep_provider(provider)
+        if cls is None:
+            raise ImportError(
+                f"Provider '{provider}' not found as built-in or entry point"
+            )
+        # ep.load() can return any object; enforce the public contract that
+        # get_class returns a Provider subclass. isinstance(cls, type) guards
+        # issubclass against a TypeError when cls is not a class at all.
+        if not (isinstance(cls, type) and issubclass(cls, Provider)):
+            raise ImportError(
+                f"Entry-point provider '{provider}' resolved to {cls!r}, "
+                f"which is not a subclass of Provider"
+            )
+        return cls
+
     @staticmethod
     def get_providers_help_text() -> dict:
         """Returns a dict of {provider_name: cli_help_text} for all available providers."""
         help_text = {}
         for name in Provider.get_available_providers():
             try:
-                # Try built-in first
-                module_path = f"{providers_path}.{name}.{name}_provider"
-                module = import_module(module_path)
-                cls = None
-                for attr_name in dir(module):
-                    attr = getattr(module, attr_name)
-                    if (
-                        isinstance(attr, type)
-                        and issubclass(attr, Provider)
-                        and attr is not Provider
-                    ):
-                        cls = attr
-                        break
-                help_text[name] = getattr(cls, "_cli_help_text", "") if cls else ""
-            except ImportError:
-                # External provider — load via entry point
-                cls = Provider._load_ep_provider(name)
-                help_text[name] = getattr(cls, "_cli_help_text", "") if cls else ""
+                cls = Provider.get_class(name)
+                help_text[name] = getattr(cls, "_cli_help_text", "")
             except Exception as error:
                 logger.warning(
                     f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
diff --git a/tests/providers/external/test_dynamic_provider_loading.py b/tests/providers/external/test_dynamic_provider_loading.py
index 6bd1e6a2ce..78e308597d 100644
--- a/tests/providers/external/test_dynamic_provider_loading.py
+++ b/tests/providers/external/test_dynamic_provider_loading.py
@@ -788,18 +788,22 @@ class TestInitGlobalProviderBuiltinDependencyFailure:
         assert cls is None
 
     @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
     @patch("prowler.providers.common.provider.Provider.get_available_providers")
-    def test_get_providers_help_text_builtin_path(self, mock_providers, mock_import):
+    def test_get_providers_help_text_builtin_path(
+        self, mock_providers, mock_is_builtin, mock_import
+    ):
         """get_providers_help_text reads _cli_help_text from a built-in provider module."""
         import types
 
         mock_providers.return_value = ["fakebuiltin"]
+        mock_is_builtin.return_value = True
 
         mock_cls = type(
-            "FakeBuiltinProvider", (Provider,), {"_cli_help_text": "Built-in Help"}
+            "FakebuiltinProvider", (Provider,), {"_cli_help_text": "Built-in Help"}
         )
         mock_module = types.ModuleType("fake_module")
-        mock_module.FakeBuiltinProvider = mock_cls
+        mock_module.FakebuiltinProvider = mock_cls
         mock_import.return_value = mock_module
 
         help_text = Provider.get_providers_help_text()
@@ -2423,3 +2427,340 @@ class TestComplianceTableDispatch:
 
         mock_generic.assert_called_once()
         Provider._global = None
+
+
+# ===========================================================================
+# 12. Provider.get_class — Public side-effect-free class resolver
+# ===========================================================================
+
+
+class TestGetClass:
+    """Tests for Provider.get_class(provider) — the public, side-effect-free
+    class resolver that unblocks the Django API and other callers that need
+    a provider class without triggering CLI side-effects (sys.exit, global
+    provider mutation)."""
+
+    # -----------------------------------------------------------------------
+    # T1: Built-in provider resolves to correct class
+    # -----------------------------------------------------------------------
+
+    def test_get_class_builtin_returns_correct_class(self):
+        """get_class('aws') returns AwsProvider — identity check."""
+        from prowler.providers.aws.aws_provider import AwsProvider
+
+        cls = Provider.get_class("aws")
+
+        assert cls is AwsProvider
+
+    # -----------------------------------------------------------------------
+    # T2: External entry-point provider resolves
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_external_ep_returns_class(self, mock_is_builtin, mock_ep):
+        """get_class resolves an external entry-point provider and returns that class."""
+        mock_is_builtin.return_value = False
+        mock_ep.return_value = [
+            _make_entry_point(
+                "fakeexternal", "pkg:FakeExternalProvider", "prowler.providers"
+            ),
+        ]
+        mock_ep.return_value[0].load.return_value = FakeExternalProvider
+
+        cls = Provider.get_class("fakeexternal")
+
+        assert cls is FakeExternalProvider
+
+    # -----------------------------------------------------------------------
+    # T3: Unknown provider raises, does NOT call sys.exit
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_unknown_raises_and_does_not_sys_exit(
+        self, mock_is_builtin, mock_ep
+    ):
+        """get_class raises for an unknown provider and never calls sys.exit."""
+        mock_is_builtin.return_value = False
+        mock_ep.return_value = []
+
+        # Assert ImportError specifically to enforce the public API contract
+        # (not a broad Exception). SystemExit belongs in init_global_provider's
+        # wrapper, not in the pure resolver.
+        with pytest.raises(ImportError):
+            Provider.get_class("totally_unknown_xyz_provider")
+
+    # -----------------------------------------------------------------------
+    # T4: get_class is PURE for built-ins — no collision warning, no EP call
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.logger")
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_builtin_with_ep_shadow_is_pure(
+        self, mock_is_builtin, mock_import, mock_load_ep, mock_logger
+    ):
+        """get_class for a built-in with a same-named EP is PURE:
+        - returns the built-in class
+        - does NOT emit a collision warning
+        - does NOT call _load_ep_provider (so _ep_providers cache stays empty for
+          this key, proving no side-effect)
+        """
+        import types
+
+        mock_is_builtin.return_value = True
+        mock_load_ep.return_value = FakeExternalProvider  # plug-in shadow present
+
+        fake_module = types.ModuleType("fake_builtin_module")
+        fake_builtin_cls = type("AwsProvider", (Provider,), {"_type": "aws"})
+        fake_module.AwsProvider = fake_builtin_cls
+        mock_import.return_value = fake_module
+
+        cls = Provider.get_class("aws")
+
+        # Built-in class returned
+        assert cls is fake_builtin_cls
+        # No collision warning emitted — that is now init_global_provider's job
+        warning_msgs = [
+            call.args[0]
+            for call in mock_logger.warning.call_args_list
+            if call.args and "IGNORED" in call.args[0]
+        ]
+        assert not warning_msgs, (
+            "get_class must NOT emit a collision warning; "
+            "init_global_provider owns that responsibility"
+        )
+        # _load_ep_provider must NOT have been called for the built-in path
+        mock_load_ep.assert_not_called()
+        # _ep_providers cache must not contain 'aws' (no side-effect)
+        assert "aws" not in Provider._ep_providers
+
+    # -----------------------------------------------------------------------
+    # T4b: Built-in module missing its expected class raises ImportError
+    #      and does NOT fall back to a same-named entry point
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_builtin_missing_class_raises_importerror(
+        self, mock_is_builtin, mock_import, mock_load_ep
+    ):
+        """When is_builtin is True but the module does not define the expected
+        provider class, get_class raises ImportError and does NOT fall back to a
+        same-named entry point — falling back would contradict is_builtin and
+        silently return a foreign class."""
+        import types
+
+        mock_is_builtin.return_value = True
+        # Module imports fine but lacks the expected `<Name>Provider` attribute.
+        empty_module = types.ModuleType("empty_builtin_module")
+        mock_import.return_value = empty_module
+
+        with pytest.raises(ImportError):
+            Provider.get_class("aws")
+
+        # Must NOT fall back to entry points for a (broken) built-in.
+        mock_load_ep.assert_not_called()
+
+    # -----------------------------------------------------------------------
+    # T4c: Entry point resolving to a non-Provider class raises ImportError
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_get_class_external_ep_not_provider_subclass_raises_importerror(
+        self, mock_is_builtin, mock_ep
+    ):
+        """When an entry point resolves to an object that is not a Provider
+        subclass, get_class raises ImportError instead of returning it, so the
+        public contract (a Provider subclass) is enforced rather than trusted."""
+
+        class NotAProvider:
+            pass
+
+        mock_is_builtin.return_value = False
+        mock_ep.return_value = [
+            _make_entry_point("rogue", "pkg:NotAProvider", "prowler.providers"),
+        ]
+        mock_ep.return_value[0].load.return_value = NotAProvider
+
+        with pytest.raises(ImportError):
+            Provider.get_class("rogue")
+
+    # -----------------------------------------------------------------------
+    # T4d: Contract — every built-in provider stays resolvable via get_class
+    # -----------------------------------------------------------------------
+
+    @pytest.mark.parametrize(
+        "provider",
+        [
+            name
+            for name in Provider.get_available_providers()
+            if Provider.is_builtin(name)
+        ],
+    )
+    def test_get_class_resolves_every_builtin_provider(self, provider):
+        """Contract test over all built-in providers: each one must remain
+        resolvable through get_class and return a Provider subclass whose name
+        follows the `{Capitalized}Provider` convention. This pins the naming
+        convention as the built-in resolution contract, so a future provider
+        that breaks it fails here instead of silently at runtime in a caller
+        (e.g. the API)."""
+        cls = Provider.get_class(provider)
+
+        assert isinstance(cls, type) and issubclass(cls, Provider)
+        assert cls.__name__ == f"{provider.capitalize()}Provider"
+
+    # -----------------------------------------------------------------------
+    # T5: Regression — init_global_provider still resolves external correctly
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.load_and_validate_config_file")
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    def test_init_global_provider_still_resolves_external_via_get_class(
+        self, mock_load_ep, mock_config
+    ):
+        """Regression: init_global_provider continues to work for external providers
+        after the class-resolution block is delegated to get_class.
+
+        'fakepure' is not a built-in, so is_builtin() returns False and get_class
+        takes the entry-point path. This verifies the FakePureContractProvider path
+        (pure from_cli_args returning an instance) still works — i.e.,
+        init_global_provider correctly wires the returned instance as global provider.
+        """
+        mock_load_ep.return_value = FakePureContractProvider
+        mock_config.return_value = {}
+
+        args = Namespace(
+            provider="fakepure",
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+        )
+
+        Provider._global = None
+        Provider.init_global_provider(args)
+
+        assert isinstance(Provider._global, FakePureContractProvider)
+        Provider._global = None
+
+    # -----------------------------------------------------------------------
+    # T6: Regression — get_providers_help_text returns same text after refactor
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.Provider._load_ep_provider")
+    @patch("prowler.providers.common.provider.Provider.get_available_providers")
+    def test_get_providers_help_text_identical_after_refactor_external(
+        self, mock_providers, mock_load_ep
+    ):
+        """get_providers_help_text returns identical _cli_help_text for an external
+        provider both before and after the refactor to use get_class internally."""
+        mock_providers.return_value = ["fakeexternal"]
+        mock_load_ep.return_value = FakeExternalProvider
+
+        help_text = Provider.get_providers_help_text()
+
+        # Must match the known _cli_help_text on FakeExternalProvider
+        assert help_text["fakeexternal"] == "Fake External Provider"
+
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    @patch("prowler.providers.common.provider.Provider.get_available_providers")
+    def test_get_providers_help_text_identical_after_refactor_builtin(
+        self, mock_providers, mock_is_builtin, mock_import
+    ):
+        """get_providers_help_text returns identical _cli_help_text for a built-in
+        provider both before and after the refactor to use get_class internally.
+        is_builtin is mocked to True so get_class takes the built-in import path."""
+        import types
+
+        mock_providers.return_value = ["fakebuiltin"]
+        mock_is_builtin.return_value = True
+        mock_cls = type(
+            "FakebuiltinProvider", (Provider,), {"_cli_help_text": "Built-in Help"}
+        )
+        mock_module = types.ModuleType("fake_module")
+        mock_module.FakebuiltinProvider = mock_cls
+        mock_import.return_value = mock_module
+
+        help_text = Provider.get_providers_help_text()
+
+        assert help_text["fakebuiltin"] == "Built-in Help"
+
+    # -----------------------------------------------------------------------
+    # T7: init_global_provider emits collision warning (not get_class)
+    # -----------------------------------------------------------------------
+
+    @patch("prowler.providers.common.provider.load_and_validate_config_file")
+    @patch("prowler.providers.common.provider.importlib.metadata.entry_points")
+    @patch("prowler.providers.common.provider.import_module")
+    @patch("prowler.providers.common.provider.Provider.is_builtin")
+    def test_init_global_provider_emits_collision_warning_for_builtin_ep_shadow(
+        self, mock_is_builtin, mock_import, mock_entry_points, mock_config, caplog
+    ):
+        """init_global_provider (not get_class) emits the collision warning
+        when a built-in provider has a same-named entry-point plug-in registered.
+
+        This is the counterpart to test_get_class_builtin_with_ep_shadow_is_pure:
+        the warning responsibility moved OUT of get_class and INTO
+        init_global_provider, so users still see the message on CLI invocation
+        but prowler --help and API calls (which never hit init_global_provider)
+        do not spuriously emit it. The shadow is detected by entry-point name
+        only — the plug-in is never loaded to warn.
+        """
+        import logging
+        import types
+
+        mock_is_builtin.return_value = True
+        shadow_ep = MagicMock()
+        shadow_ep.name = "aws"  # plug-in shadowing the built-in name
+        mock_entry_points.return_value = [shadow_ep]
+
+        fake_module = types.ModuleType("fake_builtin_module")
+        fake_module.AwsProvider = MagicMock(side_effect=lambda **_kw: None)
+        mock_import.return_value = fake_module
+        mock_config.return_value = {}
+
+        args = Namespace(
+            provider="aws",
+            fixer_config="config.yaml",
+            config_file="config.yaml",
+            aws_retries_max_attempts=3,
+            role=None,
+            session_duration=None,
+            external_id=None,
+            role_session_name=None,
+            mfa=None,
+            profile=None,
+            region=None,
+            excluded_region=None,
+            organizations_role=None,
+            scan_unused_services=False,
+            resource_tag=None,
+            resource_arn=None,
+            mutelist_file=None,
+        )
+
+        Provider._global = None
+        with caplog.at_level(logging.WARNING, logger="prowler"):
+            try:
+                Provider.init_global_provider(args)
+            except BaseException:
+                # AwsProvider mock is fake; dispatch may fail — only the
+                # warning emitted BEFORE dispatch matters here.
+                pass
+        Provider._global = None
+
+        collision_warnings = [
+            r.message
+            for r in caplog.records
+            if "Plug-in provider 'aws'" in r.message and "IGNORED" in r.message
+        ]
+        assert collision_warnings, (
+            "init_global_provider must emit the collision warning when a "
+            "same-named EP plug-in exists for a built-in provider"
+        )
+        # Shadow detected by name only — the plug-in is never loaded to warn.
+        shadow_ep.load.assert_not_called()

From e8ffe59ce23f3ea4a3a441d11f50549d5904a9fe Mon Sep 17 00:00:00 2001
From: Zeus Almightee <53497290+ernestprovo23@users.noreply.github.com>
Date: Wed, 17 Jun 2026 10:16:49 -0400
Subject: [PATCH 075/126] feat(m365/entra): add
 entra_conditional_access_policy_no_deleted_object_references check (#11236)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../__init__.py                               |   0
 ...no_deleted_object_references.metadata.json |  44 ++
 ...ess_policy_no_deleted_object_references.py | 157 ++++++
 .../m365/services/entra/entra_service.py      | 149 +++++-
 ...olicy_no_deleted_object_references_test.py | 466 ++++++++++++++++++
 .../entra/microsoft365_entra_service_test.py  | 186 +++++++
 7 files changed, 1002 insertions(+), 1 deletion(-)
 create mode 100644 prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/__init__.py
 create mode 100644 prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.metadata.json
 create mode 100644 prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.py
 create mode 100644 tests/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index d187019a5b..14fa976490 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -22,6 +22,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
 - `entra_directory_sync_object_takeover_blocked` check for the M365 provider, verifying that hybrid Entra tenants block cloud object takeover through both soft-match and hard-match directory synchronization [(#11098)](https://github.com/prowler-cloud/prowler/pull/11098)
+- `entra_conditional_access_policy_no_deleted_object_references` check for M365 provider [(#11236)](https://github.com/prowler-cloud/prowler/pull/11236)
 
 ### 🔄 Changed
 
diff --git a/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/__init__.py b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.metadata.json b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.metadata.json
new file mode 100644
index 0000000000..42b3acaeb6
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.metadata.json
@@ -0,0 +1,44 @@
+{
+  "Provider": "m365",
+  "CheckID": "entra_conditional_access_policy_no_deleted_object_references",
+  "CheckTitle": "Conditional Access policies must not reference deleted users, groups, or roles",
+  "CheckType": [],
+  "ServiceName": "entra",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "Every object identifier referenced by any Conditional Access policy under conditions.users (includeUsers, excludeUsers, includeGroups, excludeGroups, includeRoles, excludeRoles) must resolve to an existing Microsoft Entra object. This check audits all Conditional Access policies regardless of state and reports any whose user, group, or role references no longer resolve in the directory.",
+  "Risk": "When a user, group, or directory role referenced by a Conditional Access policy stops resolving (account or group deleted, role template removed), the reference becomes orphaned. include* references silently shrink the policy's enforcement scope; exclude* references can cause the policy to evaluate unexpectedly. This is a common root cause of MFA-not-applied incidents.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccesspolicy?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/resources/conditionalaccessusers?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/user-get?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/group-get?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/graph/api/unifiedroledefinition-get?view=graph-rest-1.0",
+    "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-users-groups"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com)\n2. Navigate to Protection > Conditional Access > Policies\n3. Open each policy reported by this check\n4. Under Assignments > Users, remove every user, group, or role identifier reported as deleted\n5. Save the policy and re-run the audit\n6. For ongoing hygiene, audit Conditional Access policies after any bulk user/group/role cleanup",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Audit each Conditional Access policy quarterly and remove references to deleted users, groups, or directory roles. Stale references in include collections silently shrink enforcement scope; stale references in exclude collections can cause policies to behave unexpectedly. Treat both as misconfigurations regardless of policy state.",
+      "Url": "https://hub.prowler.com/check/entra_conditional_access_policy_no_deleted_object_references"
+    }
+  },
+  "Categories": [
+    "identity-access",
+    "e3"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "entra_conditional_access_policy_directory_sync_account_excluded"
+  ],
+  "Notes": "The check runs against all Conditional Access policies regardless of state (enabled, disabled, enabledForReportingButNotEnforced) — stale references in disabled policies are a misconfiguration that becomes live the moment the policy is re-enabled. Only HTTP 404 responses flag an identifier as deleted (FAIL). Transient Graph errors (5xx, throttling, insufficient permissions) are not treated as deletions; a policy whose references could not be resolved for those reasons is reported as MANUAL so it is not silently considered clean."
+}
diff --git a/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.py b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.py
new file mode 100644
index 0000000000..e5c5eff389
--- /dev/null
+++ b/prowler/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references.py
@@ -0,0 +1,157 @@
+from prowler.lib.check.models import Check, CheckReportM365
+from prowler.providers.m365.services.entra.entra_client import entra_client
+from prowler.providers.m365.services.entra.entra_service import (
+    CONDITIONAL_ACCESS_SENTINEL_IDS,
+    ConditionalAccessPolicyState,
+)
+
+
+class entra_conditional_access_policy_no_deleted_object_references(Check):
+    """
+    Ensure Conditional Access policies do not reference deleted directory objects.
+
+    Stale references to deleted users, groups, or directory roles silently change
+    the runtime behavior of a Conditional Access policy: include* references
+    shrink enforcement scope, exclude* references can change exemption logic.
+    Either way, the policy stops behaving the way the operator believes it does.
+
+    The directory-object existence check runs once at service init time and is
+    cached on the entra client. This check reads from that cache and reports any
+    policy whose users/groups/roles inclusion or exclusion collections name an
+    identifier that no longer resolves in Microsoft Entra ID.
+
+    Identifiers whose Graph lookup failed with a non-404 error (5xx, throttling,
+    insufficient permissions) are cached separately: they could not be verified
+    as present or deleted, so the policy is reported as MANUAL rather than being
+    silently treated as clean.
+
+    - PASS: The policy references no deleted users, groups, or roles.
+    - FAIL: The policy references at least one deleted user, group, or role.
+    - MANUAL: At least one referenced identifier could not be resolved due to a
+      transient Graph error, so the policy could not be fully evaluated.
+    """
+
+    def execute(self) -> list[CheckReportM365]:
+        findings = []
+        unresolved = entra_client.unresolved_directory_object_references
+        errored = entra_client.errored_directory_object_references
+
+        for policy_id, policy in entra_client.conditional_access_policies.items():
+            report = CheckReportM365(
+                metadata=self.metadata(),
+                resource=policy,
+                resource_name=policy.display_name,
+                resource_id=policy_id,
+            )
+
+            orphans = self._collect_references_in(policy, unresolved)
+            unverified = self._collect_references_in(policy, errored)
+
+            if orphans:
+                # A confirmed deletion takes precedence over unverified ones.
+                report.status = "FAIL"
+                report.status_extended = self._format_failure(
+                    policy.display_name, orphans, unverified, policy.state
+                )
+            elif unverified:
+                # Nothing confirmed deleted, but we could not verify every
+                # reference — do not claim the policy is clean.
+                report.status = "MANUAL"
+                report.status_extended = self._format_manual(
+                    policy.display_name, unverified
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Conditional Access policy {policy.display_name} references no "
+                    f"deleted directory objects."
+                )
+
+            findings.append(report)
+
+        return findings
+
+    @staticmethod
+    def _collect_references_in(policy, id_set):
+        """Walk the six identifier collections and return references in ``id_set``.
+
+        Args:
+            policy: The Conditional Access policy to inspect.
+            id_set: Set of ``(type, id)`` pairs to match references against.
+
+        Returns:
+            list[tuple[str, str, str]]: ``(type, id, side)`` tuples where
+                ``type`` is one of ``user|group|role``, ``id`` is the Graph
+                identifier, and ``side`` is one of ``include|exclude``.
+        """
+        if not policy.conditions or not policy.conditions.user_conditions:
+            return []
+
+        uc = policy.conditions.user_conditions
+        collections = (
+            ("user", "include", uc.included_users),
+            ("user", "exclude", uc.excluded_users),
+            ("group", "include", uc.included_groups),
+            ("group", "exclude", uc.excluded_groups),
+            ("role", "include", uc.included_roles),
+            ("role", "exclude", uc.excluded_roles),
+        )
+
+        matches = []
+        for type_, side, identifiers in collections:
+            for identifier in identifiers:
+                if identifier in CONDITIONAL_ACCESS_SENTINEL_IDS:
+                    continue
+                if (type_, identifier) in id_set:
+                    matches.append((type_, identifier, side))
+        return matches
+
+    @staticmethod
+    def _group_by_type(references):
+        """Group ``(type, id, side)`` references into a deterministic message part."""
+        by_type = {"user": [], "group": [], "role": []}
+        for type_, identifier, side in references:
+            by_type[type_].append(f"{identifier} ({side})")
+
+        parts = []
+        for type_ in ("user", "group", "role"):
+            if by_type[type_]:
+                joined = ", ".join(sorted(by_type[type_]))
+                parts.append(f"{type_}s: {joined}")
+        return "; ".join(parts)
+
+    @classmethod
+    def _format_failure(cls, display_name, orphans, unverified, state=None):
+        # Surface report-only mode explicitly: the stale references are not yet
+        # enforced, but become live the moment the policy is turned on.
+        report_only = (
+            " The policy is in report-only mode, so these references are not "
+            "enforced yet but will take effect once it is enabled."
+            if state == ConditionalAccessPolicyState.ENABLED_FOR_REPORTING
+            else ""
+        )
+
+        # If some references also could not be resolved, say so rather than
+        # implying the rest of the policy is fully clean.
+        unverified_note = (
+            f" Additionally, {len(unverified)} reference(s) could not be verified "
+            f"due to transient Microsoft Graph errors."
+            if unverified
+            else ""
+        )
+
+        return (
+            f"Conditional Access policy {display_name} references "
+            f"{len(orphans)} deleted directory object(s) — "
+            f"{cls._group_by_type(orphans)}.{report_only}{unverified_note}"
+        )
+
+    @classmethod
+    def _format_manual(cls, display_name, unverified):
+        return (
+            f"Conditional Access policy {display_name} could not be fully evaluated: "
+            f"{len(unverified)} reference(s) could not be resolved due to transient "
+            f"Microsoft Graph errors (5xx, throttling, or insufficient permissions) — "
+            f"{cls._group_by_type(unverified)}. Re-run the scan or review the policy "
+            f"manually."
+        )
diff --git a/prowler/providers/m365/services/entra/entra_service.py b/prowler/providers/m365/services/entra/entra_service.py
index 39d958b44b..bbaa80edcc 100644
--- a/prowler/providers/m365/services/entra/entra_service.py
+++ b/prowler/providers/m365/services/entra/entra_service.py
@@ -3,7 +3,7 @@ import json
 from asyncio import gather
 from datetime import datetime, timezone
 from enum import Enum
-from typing import Any, Dict, List, Optional, Tuple
+from typing import Any, Dict, List, Optional, Set, Tuple
 from uuid import UUID
 
 from kiota_abstractions.base_request_configuration import RequestConfiguration
@@ -18,6 +18,12 @@ from prowler.lib.logger import logger
 from prowler.providers.m365.lib.service.service import M365Service
 from prowler.providers.m365.m365_provider import M365Provider
 
+# Sentinel identifiers used in Conditional Access ``conditions.users``
+# collections that do not correspond to real directory objects and must not be
+# resolved against Graph. Shared by the resolver below and the check that reads
+# its result.
+CONDITIONAL_ACCESS_SENTINEL_IDS = {"All", "None", "GuestsOrExternalUsers"}
+
 
 class Entra(M365Service):
     """
@@ -110,6 +116,23 @@ class Entra(M365Service):
         self.app_registrations: Dict[str, "AppRegistration"] = attributes[11]
         self.user_accounts_status = {}
 
+        # Resolve directory-object identifiers referenced by Conditional Access
+        # policies. This runs as a separate phase because it depends on the
+        # main gather having populated ``conditional_access_policies`` first.
+        # The result is cached on the instance so sync checks can read it
+        # without issuing Graph calls of their own. ``unresolved`` holds ids
+        # confirmed deleted (HTTP 404); ``errored`` holds ids whose lookup
+        # failed for any other reason (5xx, throttling, permission) and could
+        # therefore be neither confirmed present nor confirmed deleted.
+        self.unresolved_directory_object_references: Set[Tuple[str, str]]
+        self.errored_directory_object_references: Set[Tuple[str, str]]
+        (
+            self.unresolved_directory_object_references,
+            self.errored_directory_object_references,
+        ) = loop.run_until_complete(
+            self._resolve_directory_object_references(self.conditional_access_policies)
+        )
+
         if created_loop:
             asyncio.set_event_loop(None)
             loop.close()
@@ -1379,6 +1402,130 @@ OAuthAppInfo
             )
         return app_registrations
 
+    async def _resolve_directory_object_references(
+        self,
+        policies: Dict[str, "ConditionalAccessPolicy"],
+    ) -> Tuple[Set[Tuple[str, str]], Set[Tuple[str, str]]]:
+        """Resolve every user/group/role identifier referenced by CA policies.
+
+        Walks the inclusion/exclusion collections of every loaded Conditional
+        Access policy, deduplicates the resulting identifiers per type, and
+        queries Microsoft Graph for each one. Identifiers that return HTTP 404
+        are reported as deleted. Non-404 errors (5xx, throttling, permission,
+        transient network failures) are reported as unresolvable: they must not
+        be flagged as deletions, but they must also not be silently treated as
+        clean resolutions, so the downstream check surfaces them as MANUAL.
+
+        The sentinel values ``All``, ``None``, and ``GuestsOrExternalUsers``
+        are not directory identifiers and are excluded before any Graph call.
+
+        Args:
+            policies: Conditional Access policies keyed by policy ID.
+
+        Returns:
+            Tuple[Set[Tuple[str, str]], Set[Tuple[str, str]]]: A pair of
+                ``(type, identifier)`` sets. The first holds identifiers that
+                failed to resolve via Graph with HTTP 404 (deleted); the second
+                holds identifiers whose lookup failed for any other reason and
+                could be neither confirmed present nor confirmed deleted.
+        """
+        logger.info(
+            "Entra - Resolving directory-object references in Conditional "
+            "Access policies..."
+        )
+
+        ids_by_type: Dict[str, Set[str]] = {
+            "user": set(),
+            "group": set(),
+            "role": set(),
+        }
+
+        for policy in policies.values():
+            if not getattr(policy, "conditions", None):
+                continue
+            user_conditions = getattr(policy.conditions, "user_conditions", None)
+            if user_conditions is None:
+                continue
+            for ident in (user_conditions.included_users or []) + (
+                user_conditions.excluded_users or []
+            ):
+                if ident and ident not in CONDITIONAL_ACCESS_SENTINEL_IDS:
+                    ids_by_type["user"].add(ident)
+            for ident in (user_conditions.included_groups or []) + (
+                user_conditions.excluded_groups or []
+            ):
+                if ident and ident not in CONDITIONAL_ACCESS_SENTINEL_IDS:
+                    ids_by_type["group"].add(ident)
+            for ident in (user_conditions.included_roles or []) + (
+                user_conditions.excluded_roles or []
+            ):
+                if ident and ident not in CONDITIONAL_ACCESS_SENTINEL_IDS:
+                    ids_by_type["role"].add(ident)
+
+        unresolved: Set[Tuple[str, str]] = set()
+        errored: Set[Tuple[str, str]] = set()
+
+        # Resolve types in parallel; within a type, walk identifiers serially
+        # to keep concurrent Graph calls bounded and avoid throttling.
+        await gather(
+            self._resolve_identifiers_for_type(
+                "user", ids_by_type["user"], unresolved, errored
+            ),
+            self._resolve_identifiers_for_type(
+                "group", ids_by_type["group"], unresolved, errored
+            ),
+            self._resolve_identifiers_for_type(
+                "role", ids_by_type["role"], unresolved, errored
+            ),
+        )
+        return unresolved, errored
+
+    async def _resolve_identifiers_for_type(
+        self,
+        type_: str,
+        identifiers: Set[str],
+        unresolved: Set[Tuple[str, str]],
+        errored: Set[Tuple[str, str]],
+    ) -> None:
+        """Resolve a set of identifiers of a given type, mutating the result sets.
+
+        Only HTTP 404 (or ``Request_ResourceNotFound``) responses add to
+        ``unresolved``. Every other error (5xx, throttling, permission, or an
+        unexpected exception) is logged and added to ``errored`` so the check
+        can report it as unverified instead of silently treating it as clean.
+        """
+        for identifier in identifiers:
+            try:
+                if type_ == "user":
+                    await self.client.users.by_user_id(identifier).get()
+                elif type_ == "group":
+                    await self.client.groups.by_group_id(identifier).get()
+                elif type_ == "role":
+                    await self.client.role_management.directory.role_definitions.by_unified_role_definition_id(
+                        identifier
+                    ).get()
+                else:
+                    continue
+            except ODataError as error:
+                status_code = getattr(error, "response_status_code", None)
+                error_code = getattr(error.error, "code", None) if error.error else None
+                if status_code == 404 or error_code == "Request_ResourceNotFound":
+                    unresolved.add((type_, identifier))
+                else:
+                    errored.add((type_, identifier))
+                    logger.warning(
+                        f"Entra - Could not resolve {type_} '{identifier}' for "
+                        f"Conditional Access reference check: "
+                        f"{error.__class__.__name__}: {error}"
+                    )
+            except Exception as error:
+                errored.add((type_, identifier))
+                logger.warning(
+                    f"Entra - Unexpected error resolving {type_} '{identifier}' "
+                    f"for Conditional Access reference check: "
+                    f"{error.__class__.__name__}: {error}"
+                )
+
 
 class ConditionalAccessPolicyState(Enum):
     ENABLED = "enabled"
diff --git a/tests/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references_test.py b/tests/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references_test.py
new file mode 100644
index 0000000000..6d3e7786cf
--- /dev/null
+++ b/tests/providers/m365/services/entra/entra_conditional_access_policy_no_deleted_object_references/entra_conditional_access_policy_no_deleted_object_references_test.py
@@ -0,0 +1,466 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.m365.services.entra.entra_service import (
+    ApplicationsConditions,
+    ConditionalAccessPolicy,
+    ConditionalAccessPolicyState,
+    Conditions,
+    GrantControlOperator,
+    GrantControls,
+    PersistentBrowser,
+    SessionControls,
+    SignInFrequency,
+    UsersConditions,
+)
+from tests.providers.m365.m365_fixtures import DOMAIN, set_mocked_m365_provider
+
+
+def _make_policy(
+    *,
+    display_name="Test Policy",
+    state=ConditionalAccessPolicyState.ENABLED,
+    included_users=None,
+    excluded_users=None,
+    included_groups=None,
+    excluded_groups=None,
+    included_roles=None,
+    excluded_roles=None,
+):
+    """Build a ConditionalAccessPolicy with the minimum fields required by the model."""
+    policy_id = str(uuid4())
+    policy = ConditionalAccessPolicy(
+        id=policy_id,
+        display_name=display_name,
+        conditions=Conditions(
+            application_conditions=ApplicationsConditions(
+                included_applications=[],
+                excluded_applications=[],
+                included_user_actions=[],
+            ),
+            user_conditions=UsersConditions(
+                included_users=included_users or [],
+                excluded_users=excluded_users or [],
+                included_groups=included_groups or [],
+                excluded_groups=excluded_groups or [],
+                included_roles=included_roles or [],
+                excluded_roles=excluded_roles or [],
+            ),
+            client_app_types=[],
+        ),
+        grant_controls=GrantControls(
+            built_in_controls=[],
+            operator=GrantControlOperator.OR,
+            authentication_strength=None,
+        ),
+        session_controls=SessionControls(
+            persistent_browser=PersistentBrowser(is_enabled=False, mode=""),
+            sign_in_frequency=SignInFrequency(
+                is_enabled=False, frequency=None, type=None, interval=None
+            ),
+        ),
+        state=state,
+    )
+    return policy_id, policy
+
+
+def _entra_client_mock():
+    client = mock.MagicMock()
+    client.audited_tenant = "audited_tenant"
+    client.audited_domain = DOMAIN
+    # Default to clean resolution; individual tests override as needed.
+    client.unresolved_directory_object_references = set()
+    client.errored_directory_object_references = set()
+    return client
+
+
+CHECK_MODULE = (
+    "prowler.providers.m365.services.entra."
+    "entra_conditional_access_policy_no_deleted_object_references."
+    "entra_conditional_access_policy_no_deleted_object_references.entra_client"
+)
+
+
+class Test_entra_conditional_access_policy_no_deleted_object_references:
+    def test_no_policies(self):
+        """No Conditional Access policies in tenant: no findings."""
+        entra_client = _entra_client_mock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {}
+            entra_client.unresolved_directory_object_references = set()
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_sentinel_only_references_pass(self):
+        """Policy with only sentinel values ('All', 'GuestsOrExternalUsers') passes."""
+        entra_client = _entra_client_mock()
+        policy_id, policy = _make_policy(
+            display_name="MFA For All",
+            included_users=["All"],
+            excluded_users=["GuestsOrExternalUsers"],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = set()
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                "references no deleted directory objects" in result[0].status_extended
+            )
+            assert result[0].resource_id == policy_id
+            assert result[0].resource_name == "MFA For All"
+
+    def test_all_references_resolve_pass(self):
+        """Policy with real identifiers, none in the unresolved set: PASS."""
+        entra_client = _entra_client_mock()
+        live_user = str(uuid4())
+        live_group = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Targeted Policy",
+            included_users=[live_user],
+            included_groups=[live_group],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = set()
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_deleted_user_in_include_fails(self):
+        """Policy referencing a deleted user in includeUsers fails with type+side reported."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Require MFA",
+            included_users=[deleted_user],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "1 deleted directory object(s)" in result[0].status_extended
+            assert "users:" in result[0].status_extended
+            assert deleted_user in result[0].status_extended
+            assert "(include)" in result[0].status_extended
+
+    def test_deleted_group_in_exclude_fails(self):
+        """Policy referencing a deleted group in excludeGroups fails with exclude side reported."""
+        entra_client = _entra_client_mock()
+        deleted_group = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Block Legacy Auth",
+            included_users=["All"],
+            excluded_groups=[deleted_group],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("group", deleted_group)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "groups:" in result[0].status_extended
+            assert "(exclude)" in result[0].status_extended
+
+    def test_deleted_role_in_disabled_policy_still_fails(self):
+        """Disabled policy with a stale role reference still FAILs (per spec)."""
+        entra_client = _entra_client_mock()
+        deleted_role = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Legacy Admin Policy",
+            state=ConditionalAccessPolicyState.DISABLED,
+            included_roles=[deleted_role],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("role", deleted_role)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "roles:" in result[0].status_extended
+            assert deleted_role in result[0].status_extended
+
+    def test_orphans_grouped_by_type_across_collections(self):
+        """A single policy with orphans of every type aggregates them grouped by type."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+        deleted_group = str(uuid4())
+        deleted_role = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Composite Policy",
+            included_users=[deleted_user],
+            excluded_groups=[deleted_group],
+            included_roles=[deleted_role],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user),
+                ("group", deleted_group),
+                ("role", deleted_role),
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "3 deleted directory object(s)" in result[0].status_extended
+            assert "users:" in result[0].status_extended
+            assert "groups:" in result[0].status_extended
+            assert "roles:" in result[0].status_extended
+
+    def test_report_only_policy_failure_notes_mode(self):
+        """A report-only policy with an orphan FAILs and flags the not-yet-enforced state."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Report Only MFA",
+            state=ConditionalAccessPolicyState.ENABLED_FOR_REPORTING,
+            included_users=[deleted_user],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "report-only mode" in result[0].status_extended
+
+    def test_unverified_reference_is_manual(self):
+        """A reference that errored (non-404) yields MANUAL, not PASS."""
+        entra_client = _entra_client_mock()
+        errored_group = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Throttled Lookup Policy",
+            included_users=["All"],
+            excluded_groups=[errored_group],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = set()
+            entra_client.errored_directory_object_references = {
+                ("group", errored_group)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "MANUAL"
+            assert "could not be fully evaluated" in result[0].status_extended
+            assert errored_group in result[0].status_extended
+
+    def test_orphan_takes_precedence_over_unverified(self):
+        """A confirmed deletion FAILs even when another reference is unverified."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+        errored_group = str(uuid4())
+        policy_id, policy = _make_policy(
+            display_name="Mixed Policy",
+            included_users=[deleted_user],
+            excluded_groups=[errored_group],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {policy_id: policy}
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user)
+            }
+            entra_client.errored_directory_object_references = {
+                ("group", errored_group)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "1 deleted directory object(s)" in result[0].status_extended
+            assert "could not be verified" in result[0].status_extended
+
+    def test_multiple_policies_mixed(self):
+        """Two policies: one clean, one with an orphan. Distinct PASS/FAIL findings."""
+        entra_client = _entra_client_mock()
+        deleted_user = str(uuid4())
+
+        clean_id, clean_policy = _make_policy(
+            display_name="Clean Policy",
+            included_users=["All"],
+        )
+        dirty_id, dirty_policy = _make_policy(
+            display_name="Stale Reference Policy",
+            excluded_users=[deleted_user],
+        )
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_m365_provider(),
+            ),
+            mock.patch(CHECK_MODULE, new=entra_client),
+        ):
+            from prowler.providers.m365.services.entra.entra_conditional_access_policy_no_deleted_object_references.entra_conditional_access_policy_no_deleted_object_references import (
+                entra_conditional_access_policy_no_deleted_object_references,
+            )
+
+            entra_client.conditional_access_policies = {
+                clean_id: clean_policy,
+                dirty_id: dirty_policy,
+            }
+            entra_client.unresolved_directory_object_references = {
+                ("user", deleted_user)
+            }
+
+            check = entra_conditional_access_policy_no_deleted_object_references()
+            result = check.execute()
+
+            assert len(result) == 2
+
+            clean_result = next(r for r in result if r.resource_id == clean_id)
+            dirty_result = next(r for r in result if r.resource_id == dirty_id)
+
+            assert clean_result.status == "PASS"
+            assert dirty_result.status == "FAIL"
+            assert "(exclude)" in dirty_result.status_extended
diff --git a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py
index 4643ea93cc..ba6247c7bd 100644
--- a/tests/providers/m365/services/entra/microsoft365_entra_service_test.py
+++ b/tests/providers/m365/services/entra/microsoft365_entra_service_test.py
@@ -878,3 +878,189 @@ class Test_Entra_Service:
         assert merged.password_credentials[0].key_id == "cred-app"
         assert merged.password_credentials[0].display_name == "app-level-secret"
         assert merged.password_credentials[0].is_active()
+
+    def test__resolve_identifiers_for_type_flags_only_404(self):
+        """Only HTTP 404 / Request_ResourceNotFound mark an id as deleted.
+
+        Transient errors (5xx, throttling) and successful resolutions must
+        never be added to the unresolved set — that is the contract the check
+        relies on to avoid false positives during Graph outages.
+        """
+        from msgraph.generated.models.o_data_errors.main_error import MainError
+        from msgraph.generated.models.o_data_errors.o_data_error import ODataError
+
+        deleted_by_status = "deleted-status-404"
+        deleted_by_code = "deleted-code-rnf"
+        transient = "transient-503"
+        live = "live-user"
+
+        error_404 = ODataError()
+        error_404.response_status_code = 404
+        error_404.error = None  # status code alone is enough
+
+        error_rnf = ODataError()
+        error_rnf.response_status_code = None
+        error_rnf.error = MainError()
+        error_rnf.error.code = "Request_ResourceNotFound"
+
+        error_503 = ODataError()
+        error_503.response_status_code = 503
+        error_503.error = MainError()
+        error_503.error.code = "ServiceUnavailable"
+
+        user_builders = {
+            deleted_by_status: SimpleNamespace(get=AsyncMock(side_effect=error_404)),
+            deleted_by_code: SimpleNamespace(get=AsyncMock(side_effect=error_rnf)),
+            transient: SimpleNamespace(get=AsyncMock(side_effect=error_503)),
+            live: SimpleNamespace(get=AsyncMock(return_value=SimpleNamespace(id=live))),
+        }
+
+        entra_service = Entra.__new__(Entra)
+        entra_service.client = SimpleNamespace(
+            users=SimpleNamespace(
+                by_user_id=MagicMock(side_effect=lambda uid: user_builders[uid])
+            )
+        )
+
+        unresolved = set()
+        errored = set()
+        asyncio.run(
+            entra_service._resolve_identifiers_for_type(
+                "user", set(user_builders), unresolved, errored
+            )
+        )
+
+        assert unresolved == {
+            ("user", deleted_by_status),
+            ("user", deleted_by_code),
+        }
+        # The transient 503 must be recorded as errored (unverified), never as
+        # deleted and never silently dropped.
+        assert errored == {("user", transient)}
+
+    def test__resolve_identifiers_for_type_role_uses_role_definitions_endpoint(self):
+        """A deleted role is resolved against the roleDefinitions endpoint."""
+        from msgraph.generated.models.o_data_errors.o_data_error import ODataError
+
+        deleted_role = "deleted-role-id"
+
+        error_404 = ODataError()
+        error_404.response_status_code = 404
+        error_404.error = None
+
+        by_role_id = MagicMock(
+            return_value=SimpleNamespace(get=AsyncMock(side_effect=error_404))
+        )
+
+        entra_service = Entra.__new__(Entra)
+        entra_service.client = SimpleNamespace(
+            role_management=SimpleNamespace(
+                directory=SimpleNamespace(
+                    role_definitions=SimpleNamespace(
+                        by_unified_role_definition_id=by_role_id
+                    )
+                )
+            )
+        )
+
+        unresolved = set()
+        errored = set()
+        asyncio.run(
+            entra_service._resolve_identifiers_for_type(
+                "role", {deleted_role}, unresolved, errored
+            )
+        )
+
+        assert unresolved == {("role", deleted_role)}
+        assert errored == set()
+        by_role_id.assert_called_once_with(deleted_role)
+
+    def test__resolve_directory_object_references_skips_sentinels_and_dedups(self):
+        """End-to-end resolver: sentinels are never queried, ids are deduped
+        across policies, and only deleted ids land in the unresolved set."""
+        from msgraph.generated.models.o_data_errors.o_data_error import ODataError
+
+        deleted_user = "deleted-user-id"
+        live_user = "live-user-id"
+        deleted_group = "deleted-group-id"
+        errored_group = "errored-group-id"
+
+        def _user_conditions(**kwargs):
+            base = {
+                "included_users": [],
+                "excluded_users": [],
+                "included_groups": [],
+                "excluded_groups": [],
+                "included_roles": [],
+                "excluded_roles": [],
+            }
+            base.update(kwargs)
+            return SimpleNamespace(**base)
+
+        def _policy(user_conditions):
+            return SimpleNamespace(
+                conditions=SimpleNamespace(user_conditions=user_conditions)
+            )
+
+        policies = {
+            "policy-a": _policy(
+                _user_conditions(
+                    included_users=["All", deleted_user, live_user],
+                    excluded_groups=[deleted_group, errored_group],
+                )
+            ),
+            # Same deleted_user referenced again — must be resolved only once.
+            "policy-b": _policy(
+                _user_conditions(
+                    included_users=[deleted_user],
+                    excluded_users=["GuestsOrExternalUsers"],
+                )
+            ),
+            # Policy without user conditions must be skipped without error.
+            "policy-c": SimpleNamespace(
+                conditions=SimpleNamespace(user_conditions=None)
+            ),
+        }
+
+        error_404 = ODataError()
+        error_404.response_status_code = 404
+        error_404.error = None
+
+        error_503 = ODataError()
+        error_503.response_status_code = 503
+        error_503.error = None
+
+        user_builders = {
+            deleted_user: SimpleNamespace(get=AsyncMock(side_effect=error_404)),
+            live_user: SimpleNamespace(
+                get=AsyncMock(return_value=SimpleNamespace(id=live_user))
+            ),
+        }
+        group_builders = {
+            deleted_group: SimpleNamespace(get=AsyncMock(side_effect=error_404)),
+            errored_group: SimpleNamespace(get=AsyncMock(side_effect=error_503)),
+        }
+        by_user_id = MagicMock(side_effect=lambda uid: user_builders[uid])
+        by_group_id = MagicMock(side_effect=lambda gid: group_builders[gid])
+
+        entra_service = Entra.__new__(Entra)
+        entra_service.client = SimpleNamespace(
+            users=SimpleNamespace(by_user_id=by_user_id),
+            groups=SimpleNamespace(by_group_id=by_group_id),
+        )
+
+        unresolved, errored = asyncio.run(
+            entra_service._resolve_directory_object_references(policies)
+        )
+
+        assert unresolved == {
+            ("user", deleted_user),
+            ("group", deleted_group),
+        }
+        # The 503 group is unverified, not deleted — it lands in errored.
+        assert errored == {("group", errored_group)}
+        # Sentinels are filtered before any Graph call; only the two real user
+        # ids are queried, and the deduped deleted_user is queried exactly once.
+        queried_users = {call.args[0] for call in by_user_id.call_args_list}
+        assert queried_users == {deleted_user, live_user}
+        assert user_builders[deleted_user].get.await_count == 1

From 5ecfd6ea205497d1827ae737b236fa180d1a0e78 Mon Sep 17 00:00:00 2001
From: "Pablo Fernandez Guerra (PFE)"
 <148432447+pfe-nazaries@users.noreply.github.com>
Date: Wed, 17 Jun 2026 16:17:35 +0200
Subject: [PATCH 076/126] test(ui): add Okta provider form E2E test (#11600)

Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
---
 .github/workflows/ui-e2e-tests-v2.yml |  3 +
 ui/tests/providers/providers-page.ts  | 76 +++++++++++++++++++++
 ui/tests/providers/providers.md       | 60 +++++++++++++++++
 ui/tests/providers/providers.spec.ts  | 95 +++++++++++++++++++++++++++
 ui/types/env.d.ts                     |  5 ++
 5 files changed, 239 insertions(+)

diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml
index cc3953274a..ed407e890d 100644
--- a/.github/workflows/ui-e2e-tests-v2.yml
+++ b/.github/workflows/ui-e2e-tests-v2.yml
@@ -77,6 +77,9 @@ jobs:
       E2E_ALIBABACLOUD_ACCESS_KEY_ID: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_ID }}
       E2E_ALIBABACLOUD_ACCESS_KEY_SECRET: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_SECRET }}
       E2E_ALIBABACLOUD_ROLE_ARN: ${{ secrets.E2E_ALIBABACLOUD_ROLE_ARN }}
+      E2E_OKTA_DOMAIN: ${{ secrets.E2E_OKTA_DOMAIN }}
+      E2E_OKTA_CLIENT_ID: ${{ secrets.E2E_OKTA_CLIENT_ID }}
+      E2E_OKTA_BASE64_PRIVATE_KEY: ${{ secrets.E2E_OKTA_BASE64_PRIVATE_KEY }}
       E2E_GOOGLEWORKSPACE_CUSTOMER_ID: ${{ secrets.E2E_GOOGLEWORKSPACE_CUSTOMER_ID }}
       E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON: ${{ secrets.E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON }}
       E2E_GOOGLEWORKSPACE_DELEGATED_USER: ${{ secrets.E2E_GOOGLEWORKSPACE_DELEGATED_USER }}
diff --git a/ui/tests/providers/providers-page.ts b/ui/tests/providers/providers-page.ts
index 2196cd4fae..5aeb3723a6 100644
--- a/ui/tests/providers/providers-page.ts
+++ b/ui/tests/providers/providers-page.ts
@@ -81,6 +81,28 @@ export interface GoogleWorkspaceProviderCredential {
   delegatedUser: string;
 }
 
+// Okta provider data
+export interface OktaProviderData {
+  orgDomain: string;
+  alias?: string;
+}
+
+// Okta credential options
+export const OKTA_CREDENTIAL_OPTIONS = {
+  OKTA_PRIVATE_KEY_JWT: "private_key_jwt",
+} as const;
+
+// Okta credential type
+type OktaCredentialType =
+  (typeof OKTA_CREDENTIAL_OPTIONS)[keyof typeof OKTA_CREDENTIAL_OPTIONS];
+
+// Okta provider credential (OAuth 2.0 Private Key JWT)
+export interface OktaProviderCredential {
+  type: OktaCredentialType;
+  clientId: string;
+  privateKey: string;
+}
+
 // AWS credential options
 export const AWS_CREDENTIAL_OPTIONS = {
   AWS_ROLE_ARN: "role",
@@ -267,12 +289,18 @@ export class ProvidersPage extends BasePage {
   readonly ociProviderRadio: Locator;
   readonly alibabacloudProviderRadio: Locator;
   readonly googleworkspaceProviderRadio: Locator;
+  readonly oktaProviderRadio: Locator;
 
   // Google Workspace provider form elements
   readonly googleworkspaceCustomerIdInput: Locator;
   readonly googleworkspaceServiceAccountJsonInput: Locator;
   readonly googleworkspaceDelegatedUserInput: Locator;
 
+  // Okta provider form elements
+  readonly oktaOrgDomainInput: Locator;
+  readonly oktaClientIdInput: Locator;
+  readonly oktaPrivateKeyInput: Locator;
+
   // Vercel provider form elements
   readonly vercelProviderRadio: Locator;
   readonly vercelTeamIdInput: Locator;
@@ -522,6 +550,18 @@ export class ProvidersPage extends BasePage {
       name: /Delegated User Email/i,
     });
 
+    // Okta
+    this.oktaProviderRadio = page.getByRole("option", {
+      name: /Okta/i,
+    });
+    this.oktaOrgDomainInput = page.getByRole("textbox", {
+      name: "Org Domain",
+    });
+    this.oktaClientIdInput = page.getByRole("textbox", { name: "Client ID" });
+    this.oktaPrivateKeyInput = page.getByRole("textbox", {
+      name: "Private Key",
+    });
+
     // Vercel
     this.vercelProviderRadio = page.getByRole("option", {
       name: /Vercel/i,
@@ -1322,6 +1362,41 @@ export class ProvidersPage extends BasePage {
     await expect(this.googleworkspaceDelegatedUserInput).toBeVisible();
   }
 
+  async selectOktaProvider(): Promise<void> {
+    await this.selectProviderRadio(this.oktaProviderRadio);
+  }
+
+  async fillOktaProviderDetails(data: OktaProviderData): Promise<void> {
+    // Fill the Okta provider details (org domain is lowercased by the form)
+
+    await this.oktaOrgDomainInput.fill(data.orgDomain);
+
+    if (data.alias) {
+      await this.aliasInput.fill(data.alias);
+    }
+  }
+
+  async fillOktaCredentials(
+    credentials: OktaProviderCredential,
+  ): Promise<void> {
+    // Fill the Okta OAuth 2.0 Private Key JWT credentials form
+
+    if (credentials.clientId) {
+      await this.oktaClientIdInput.fill(credentials.clientId);
+    }
+    if (credentials.privateKey) {
+      await this.oktaPrivateKeyInput.fill(credentials.privateKey);
+    }
+  }
+
+  async verifyOktaCredentialsPageLoaded(): Promise<void> {
+    // Verify the Okta credentials page is loaded
+
+    await this.verifyPageHasProwlerTitle();
+    await expect(this.oktaClientIdInput).toBeVisible();
+    await expect(this.oktaPrivateKeyInput).toBeVisible();
+  }
+
   async selectVercelProvider(): Promise<void> {
     await this.selectProviderRadio(this.vercelProviderRadio);
   }
@@ -1374,6 +1449,7 @@ export class ProvidersPage extends BasePage {
     await expect(this.githubProviderRadio).toBeVisible();
     await expect(this.alibabacloudProviderRadio).toBeVisible();
     await expect(this.googleworkspaceProviderRadio).toBeVisible();
+    await expect(this.oktaProviderRadio).toBeVisible();
     await expect(this.vercelProviderRadio).toBeVisible();
   }
 
diff --git a/ui/tests/providers/providers.md b/ui/tests/providers/providers.md
index dcdbccb75f..944638a75a 100644
--- a/ui/tests/providers/providers.md
+++ b/ui/tests/providers/providers.md
@@ -1071,3 +1071,63 @@
 - API Token is a masked (password) field; the only credential required for Vercel
 - Provider cleanup performed before each test to ensure clean state
 - Requires a valid Vercel API Token with read permissions to the resources to assess
+
+---
+
+## Test Case: `PROVIDER-E2E-019` - Add Okta Provider with OAuth 2.0 Private Key JWT Credentials
+
+**Priority:** `critical`
+
+**Tags:**
+
+- type → @e2e, @serial
+- feature → @providers
+- provider → @okta
+
+**Description/Objective:** Validates the complete flow of adding a new Okta provider using OAuth 2.0 Private Key JWT authentication (Client ID and PEM-encoded private key) tied to an Okta Org Domain.
+
+**Preconditions:**
+
+- Admin user authentication required (admin.auth.setup setup)
+- Environment variables configured: E2E_OKTA_DOMAIN, E2E_OKTA_CLIENT_ID, E2E_OKTA_BASE64_PRIVATE_KEY
+- Remove any existing provider with the same Org Domain before starting the test
+- This test must be run serially and never in parallel with other tests, as it requires the Org Domain not to be already registered beforehand.
+
+### Flow Steps
+
+1. Navigate to providers page
+2. Click "Add Provider" button
+3. Select Okta provider type
+4. Fill provider details (org domain and alias)
+5. Verify Okta credentials page is loaded
+6. Fill Okta credentials (client ID and PEM-encoded private key)
+7. Launch initial scan
+8. Verify redirect to Scans page
+9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+
+### Expected Result
+
+- Okta provider successfully added with OAuth 2.0 Private Key JWT credentials
+- Initial scan launched successfully
+- User redirected to Scans page
+- Scheduled scan appears in Scans table with correct provider and scan name
+
+### Key verification points
+
+- Provider page loads correctly
+- Connect account page displays Okta option
+- Provider details form accepts org domain (Okta-managed domain, e.g. acme.okta.com) and alias
+- Credentials page loads with Client ID input and Private Key textarea
+- Credentials are properly filled in the correct fields
+- Launch scan page appears
+- Successful redirect to Scans page after scan launch
+- Provider exists in Scans table (verified by org domain)
+- Scan name field contains "scheduled scan"
+
+### Notes
+
+- Test uses environment variables for Okta credentials
+- Org Domain is lowercased by the form; cleanup and scan verification use the normalized value
+- Private Key is provided as base64-encoded PEM content and decoded before use (multi-line content)
+- Provider cleanup performed before each test to ensure clean state
+- Requires a valid Okta API Services app with a registered public key (JWK) matching the provided private key
diff --git a/ui/tests/providers/providers.spec.ts b/ui/tests/providers/providers.spec.ts
index 819b85bfe2..b5c9e53df9 100644
--- a/ui/tests/providers/providers.spec.ts
+++ b/ui/tests/providers/providers.spec.ts
@@ -30,6 +30,9 @@ import {
   GoogleWorkspaceProviderData,
   GoogleWorkspaceProviderCredential,
   GOOGLEWORKSPACE_CREDENTIAL_OPTIONS,
+  OktaProviderData,
+  OktaProviderCredential,
+  OKTA_CREDENTIAL_OPTIONS,
   VercelProviderData,
   VercelProviderCredential,
   VERCEL_CREDENTIAL_OPTIONS,
@@ -1517,6 +1520,98 @@ test.describe("Add Provider", () => {
       },
     );
   });
+
+  test.describe.serial("Add Okta Provider", () => {
+    let providersPage: ProvidersPage;
+    let scansPage: ScansPage;
+
+    // Test data from environment variables
+    // Org Domain is lowercased by the form, so normalize here to match the
+    // stored provider UID used for cleanup and scan verification.
+    const orgDomain = (process.env.E2E_OKTA_DOMAIN ?? "").toLowerCase();
+    const clientId = process.env.E2E_OKTA_CLIENT_ID ?? "";
+    const privateKeyB64 = process.env.E2E_OKTA_BASE64_PRIVATE_KEY ?? "";
+
+    // Setup before each test
+    test.beforeEach(async ({ page }) => {
+      test.skip(
+        !orgDomain || !clientId || !privateKeyB64,
+        "Okta E2E env vars are not set",
+      );
+      providersPage = new ProvidersPage(page);
+      await deleteProviderIfExists(providersPage, orgDomain!);
+    });
+
+    // Use admin authentication for provider management
+    test.use({ storageState: "playwright/.auth/admin_user.json" });
+
+    test(
+      "should add a new Okta provider with OAuth 2.0 Private Key JWT credentials",
+      {
+        tag: [
+          "@critical",
+          "@e2e",
+          "@providers",
+          "@okta",
+          "@serial",
+          "@PROVIDER-E2E-019",
+        ],
+      },
+      async ({ page }) => {
+        // The Okta app private key is PEM-encoded (multi-line), so it is passed
+        // base64-encoded via the environment variable and decoded here.
+        const privateKey = Buffer.from(privateKeyB64, "base64").toString(
+          "utf8",
+        );
+
+        // Prepare test data for Okta provider
+        const oktaProviderData: OktaProviderData = {
+          orgDomain: orgDomain,
+          alias: "Test E2E Okta Account - Private Key JWT",
+        };
+
+        // Prepare OAuth 2.0 Private Key JWT credentials
+        const oktaCredentials: OktaProviderCredential = {
+          type: OKTA_CREDENTIAL_OPTIONS.OKTA_PRIVATE_KEY_JWT,
+          clientId: clientId,
+          privateKey: privateKey,
+        };
+
+        // Navigate to providers page
+        await providersPage.goto();
+        await providersPage.verifyPageLoaded();
+
+        // Start adding new provider
+        await providersPage.clickAddProvider();
+        await providersPage.verifyConnectAccountPageLoaded();
+
+        // Select Okta provider
+        await providersPage.selectOktaProvider();
+
+        // Fill provider details (org domain and alias)
+        await providersPage.fillOktaProviderDetails(oktaProviderData);
+        await providersPage.clickNext();
+
+        // Verify Okta credentials page is loaded
+        await providersPage.verifyOktaCredentialsPageLoaded();
+
+        // Fill OAuth 2.0 Private Key JWT credentials
+        await providersPage.fillOktaCredentials(oktaCredentials);
+        await providersPage.clickNext();
+
+        // Launch scan
+        await providersPage.verifyLaunchScanPageLoaded();
+        await providersPage.clickNext();
+
+        // Wait for redirect to scan page
+        scansPage = new ScansPage(page);
+        await scansPage.verifyPageLoaded();
+
+        // Verify scan status is "Scheduled scan"
+        await scansPage.verifyScheduledScanStatus(orgDomain);
+      },
+    );
+  });
 });
 
 test.describe("Update Provider Credentials", () => {
diff --git a/ui/types/env.d.ts b/ui/types/env.d.ts
index 6f74d366dd..3daedd9706 100644
--- a/ui/types/env.d.ts
+++ b/ui/types/env.d.ts
@@ -119,6 +119,11 @@ declare global {
       E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON?: string;
       E2E_GOOGLEWORKSPACE_DELEGATED_USER?: string;
 
+      // E2E Okta
+      E2E_OKTA_DOMAIN?: string;
+      E2E_OKTA_CLIENT_ID?: string;
+      E2E_OKTA_BASE64_PRIVATE_KEY?: string;
+
       // E2E Vercel
       E2E_VERCEL_TEAM_ID?: string;
       E2E_VERCEL_API_TOKEN?: string;

From bae74b8181bb3678627fafc136fa79fe3bee13b6 Mon Sep 17 00:00:00 2001
From: Josema Camacho <josema@prowler.com>
Date: Wed, 17 Jun 2026 16:20:17 +0200
Subject: [PATCH 077/126] fix(api): ignore RequestAborted from health-check
 probe disconnects in Sentry (#11632)

---
 api/CHANGELOG.md                          | 1 +
 api/src/backend/config/settings/sentry.py | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 0ddb8ae3f2..db5cc69b03 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -13,6 +13,7 @@ All notable changes to the **Prowler API** are documented in this file.
 ### 🔄 Changed
 
 - Gunicorn worker timeout raised from the 30s default to 120s, so long-running requests are no longer killed prematurely [(#11631)](https://github.com/prowler-cloud/prowler/pull/11631)
+- Sentry now drops ASGI's `RequestAborted` errors from health-check probe disconnects on `/health/live` [(#11632)](https://github.com/prowler-cloud/prowler/pull/11632)
 
 ### 🔐 Security
 
diff --git a/api/src/backend/config/settings/sentry.py b/api/src/backend/config/settings/sentry.py
index 580821f7b2..1f449f782e 100644
--- a/api/src/backend/config/settings/sentry.py
+++ b/api/src/backend/config/settings/sentry.py
@@ -76,6 +76,8 @@ IGNORED_EXCEPTIONS = [
     # PowerShell Errors in User Authentication
     "Microsoft Teams User Auth connection failed: Please check your permissions and try again.",
     "Exchange Online User Auth connection failed: Please check your permissions and try again.",
+    # ASGI: Client disconnected before the response finished (health-check probes on /health/live)
+    "RequestAborted",
 ]
 
 

From 5ec4a1cbbab56fe1c0ab7ddf3e3047d2c26cede7 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Thu, 18 Jun 2026 00:35:32 +0900
Subject: [PATCH 078/126] feat(gcp): add cloudfunction_function_inside_vpc
 check (#11021)

Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../gcp/services/cloudfunction/__init__.py    |   0
 .../cloudfunction/cloudfunction_client.py     |   6 +
 .../__init__.py                               |   0
 ...function_function_inside_vpc.metadata.json |  40 ++++
 .../cloudfunction_function_inside_vpc.py      |  39 ++++
 .../cloudfunction/cloudfunction_service.py    |  84 ++++++++
 .../gcp/services/cloudfunction/__init__.py    |   0
 .../__init__.py                               |   0
 .../cloudfunction_function_inside_vpc_test.py | 197 ++++++++++++++++++
 .../cloudfunction_service_test.py             | 102 +++++++++
 11 files changed, 469 insertions(+)
 create mode 100644 prowler/providers/gcp/services/cloudfunction/__init__.py
 create mode 100644 prowler/providers/gcp/services/cloudfunction/cloudfunction_client.py
 create mode 100644 prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py
 create mode 100644 prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.metadata.json
 create mode 100644 prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py
 create mode 100644 prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
 create mode 100644 tests/providers/gcp/services/cloudfunction/__init__.py
 create mode 100644 tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py
 create mode 100644 tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py
 create mode 100644 tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 14fa976490..ada7536290 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -11,6 +11,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `config_delegated_admin_and_org_aggregator_all_regions` check for AWS provider, verifying that AWS Config has a delegated administrator and an organization aggregator covering all AWS regions [(#11259)](https://github.com/prowler-cloud/prowler/pull/11259)
 - `sagemaker_clarify_exists` check for AWS provider [(#11211)](https://github.com/prowler-cloud/prowler/pull/11211)
 - `cloudsql_instance_high_availability_enabled` check for GCP provider, verifying Cloud SQL primary instances use `REGIONAL` availability for automatic zone failover [(#11024)](https://github.com/prowler-cloud/prowler/pull/11024)
+- `cloudfunction_function_inside_vpc` check for GCP provider, verifying Cloud Functions have a Serverless VPC Access connector for private egress [(#11021)](https://github.com/prowler-cloud/prowler/pull/11021)
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 - `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
diff --git a/prowler/providers/gcp/services/cloudfunction/__init__.py b/prowler/providers/gcp/services/cloudfunction/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_client.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_client.py
new file mode 100644
index 0000000000..a252da1be7
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+    CloudFunction,
+)
+
+cloudfunction_client = CloudFunction(Provider.get_global_provider())
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.metadata.json b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.metadata.json
new file mode 100644
index 0000000000..72c908bf80
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.metadata.json
@@ -0,0 +1,40 @@
+{
+  "Provider": "gcp",
+  "CheckID": "cloudfunction_function_inside_vpc",
+  "CheckTitle": "Cloud Function is connected to a VPC network",
+  "CheckType": [],
+  "ServiceName": "cloudfunction",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "cloudfunctions.googleapis.com/Function",
+  "Description": "Cloud Functions are attached to a **Serverless VPC Access connector** so egress traffic is routed through a private VPC network instead of the public internet.\n\nThe evaluation reviews each function's network configuration to confirm that a connector is configured.",
+  "Risk": "Without a VPC connector, Cloud Functions cannot privately reach internal resources such as `Cloud SQL`, `Memorystore`, or `GKE`, forcing those services to be exposed over public IPs. This expands the **attack surface**, weakens **confidentiality** of internal traffic, and breaks network segmentation controls required by most security frameworks.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://cloud.google.com/functions/docs/networking/connecting-vpc",
+    "https://cloud.google.com/vpc/docs/serverless-vpc-access"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "gcloud functions deploy <FUNCTION_NAME> --region=<REGION> --vpc-connector=projects/<PROJECT_ID>/locations/<REGION>/connectors/<CONNECTOR_NAME> --egress-settings=all-traffic",
+      "NativeIaC": "",
+      "Other": "1. In Google Cloud Console, go to Cloud Functions\n2. Select the function and click Edit\n3. Under Connections, select the VPC connector for your network\n4. Set Egress settings to route all traffic through the VPC connector\n5. Save and redeploy the function",
+      "Terraform": "```hcl\nresource \"google_cloudfunctions2_function\" \"<example_resource_name>\" {\n  name     = \"<example_resource_name>\"\n  location = \"us-central1\"\n\n  service_config {\n    vpc_connector                 = \"<example_resource_id>\" # Critical: routes egress through the VPC\n    vpc_connector_egress_settings = \"ALL_TRAFFIC\"\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Apply **defense in depth** by routing Cloud Function egress through a **Serverless VPC Access connector** when the function must reach internal resources.\n\nScope each connector to **least privilege** subnets so functions cannot reach unintended endpoints.",
+      "Url": "https://hub.prowler.com/check/cloudfunction_function_inside_vpc"
+    }
+  },
+  "Categories": [
+    "trust-boundaries"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "cloudfunction_function_not_publicly_accessible",
+    "cloudsql_instance_public_ip",
+    "compute_instance_public_ip"
+  ],
+  "Notes": "A VPC connector must be created in the same region as the Cloud Function. This check only verifies that a connector is attached; it does not validate egress settings or connector configuration."
+}
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py
new file mode 100644
index 0000000000..46866b350d
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py
@@ -0,0 +1,39 @@
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.cloudfunction.cloudfunction_client import (
+    cloudfunction_client,
+)
+
+
+class cloudfunction_function_inside_vpc(Check):
+    """Check that Cloud Functions are attached to a Serverless VPC Access connector.
+
+    Verifies that each active Cloud Function has a `vpcConnector` configured so
+    egress traffic flows through a private VPC network instead of the public
+    internet. Functions in non-`ACTIVE` states are skipped because their network
+    configuration is transient.
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        """Execute the VPC-connector check across all Cloud Functions.
+
+        Returns:
+            A list of `Check_Report_GCP` findings, one per active Cloud
+            Function. Status is `PASS` when a `vpc_connector` is set and `FAIL`
+            otherwise.
+        """
+        findings = []
+        for function in cloudfunction_client.functions:
+            if function.state != "ACTIVE":
+                continue
+            report = Check_Report_GCP(metadata=self.metadata(), resource=function)
+            if function.vpc_connector:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Cloud Function {function.name} is connected to a VPC via "
+                    f"connector: {function.vpc_connector}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Cloud Function {function.name} is not connected to any VPC network."
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
new file mode 100644
index 0000000000..d1043151b7
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
@@ -0,0 +1,84 @@
+from typing import Optional
+
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.gcp.config import DEFAULT_RETRY_ATTEMPTS
+from prowler.providers.gcp.gcp_provider import GcpProvider
+from prowler.providers.gcp.lib.service.service import GCPService
+
+
+class CloudFunction(GCPService):
+    """Cloud Functions v2 service client.
+
+    Enumerates Cloud Functions across every accessible project and region
+    using the `cloudfunctions.googleapis.com` v2 API and exposes them through
+    the `functions` attribute.
+    """
+
+    def __init__(self, provider: GcpProvider) -> None:
+        """Initialize the service and preload Cloud Functions."""
+        super().__init__("cloudfunctions", provider, api_version="v2")
+        self.functions = []
+        self._get_functions()
+
+    def _get_functions(self) -> None:
+        """Fetch Cloud Functions for every project and location."""
+        for project_id in self.project_ids:
+            try:
+                locations = self.client.projects().locations()
+                locations_request = locations.list(name=f"projects/{project_id}")
+                while locations_request is not None:
+                    locations_response = locations_request.execute(
+                        num_retries=DEFAULT_RETRY_ATTEMPTS
+                    )
+                    for location in locations_response.get("locations", []):
+                        location_id = location["locationId"]
+                        try:
+                            functions = locations.functions()
+                            request = functions.list(
+                                parent=f"projects/{project_id}/locations/{location_id}"
+                            )
+                            while request is not None:
+                                response = request.execute(
+                                    num_retries=DEFAULT_RETRY_ATTEMPTS
+                                )
+                                for fn in response.get("functions", []):
+                                    service_config = fn.get("serviceConfig", {})
+                                    self.functions.append(
+                                        Function(
+                                            name=fn["name"].split("/")[-1],
+                                            project_id=project_id,
+                                            location=location_id,
+                                            state=fn.get("state", "UNKNOWN"),
+                                            vpc_connector=service_config.get(
+                                                "vpcConnector"
+                                            ),
+                                        )
+                                    )
+                                request = functions.list_next(
+                                    previous_request=request,
+                                    previous_response=response,
+                                )
+                        except Exception as error:
+                            logger.error(
+                                f"{location_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                            )
+                    locations_request = locations.list_next(
+                        previous_request=locations_request,
+                        previous_response=locations_response,
+                    )
+            except Exception as error:
+                logger.error(
+                    f"{project_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+
+class Function(BaseModel):
+    """Cloud Function resource consumed by GCP checks."""
+
+    name: str
+    project_id: str
+    location: str
+    state: str
+    vpc_connector: Optional[str] = None
diff --git a/tests/providers/gcp/services/cloudfunction/__init__.py b/tests/providers/gcp/services/cloudfunction/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py
new file mode 100644
index 0000000000..b764760538
--- /dev/null
+++ b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py
@@ -0,0 +1,197 @@
+from unittest import mock
+
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_PROJECT_ID,
+    GCP_US_CENTER1_LOCATION,
+    set_mocked_gcp_provider,
+)
+
+_CHECK_PATH = (
+    "prowler.providers.gcp.services.cloudfunction."
+    "cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc"
+)
+_CLIENT_PATH = f"{_CHECK_PATH}.cloudfunction_client"
+
+
+class Test_cloudfunction_function_inside_vpc:
+    def test_no_functions(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+
+            cloudfunction_client.functions = []
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_function_with_vpc_connector(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            connector = (
+                f"projects/{GCP_PROJECT_ID}/locations/{GCP_US_CENTER1_LOCATION}"
+                f"/connectors/my-connector"
+            )
+            cloudfunction_client.functions = [
+                Function(
+                    name="fn-vpc",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    vpc_connector=connector,
+                )
+            ]
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Cloud Function fn-vpc is connected to a VPC via connector: {connector}."
+            )
+            assert result[0].resource_id == "fn-vpc"
+            assert result[0].resource_name == "fn-vpc"
+            assert result[0].location == GCP_US_CENTER1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_function_without_vpc_connector(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    name="fn-public",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    vpc_connector=None,
+                )
+            ]
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Cloud Function fn-public is not connected to any VPC network."
+            )
+            assert result[0].resource_id == "fn-public"
+            assert result[0].resource_name == "fn-public"
+            assert result[0].location == GCP_US_CENTER1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_function_with_empty_vpc_connector(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    name="fn-empty",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    vpc_connector="",
+                )
+            ]
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+
+    def test_inactive_function_skipped(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_inside_vpc.cloudfunction_function_inside_vpc import (
+                cloudfunction_function_inside_vpc,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    name="fn-deploy",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="DEPLOYING",
+                    vpc_connector=None,
+                )
+            ]
+
+            check = cloudfunction_function_inside_vpc()
+            result = check.execute()
+            assert len(result) == 0
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
new file mode 100644
index 0000000000..82f77a939f
--- /dev/null
+++ b/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
@@ -0,0 +1,102 @@
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+    CloudFunction,
+)
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_PROJECT_ID,
+    mock_is_api_active,
+    set_mocked_gcp_provider,
+)
+
+_LOCATION_ID = "us-central1"
+_FUNCTION_NAME = "my-function"
+_CONNECTOR = (
+    f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/connectors/my-connector"
+)
+
+
+def _make_cloudfunction_client(functions_list):
+    """Return a mock GCP API client for the Cloud Functions v2 service."""
+    client = MagicMock()
+
+    client.projects().locations().list().execute.return_value = {
+        "locations": [{"locationId": _LOCATION_ID}]
+    }
+    client.projects().locations().list_next.return_value = None
+
+    client.projects().locations().functions().list().execute.return_value = {
+        "functions": functions_list
+    }
+    client.projects().locations().functions().list_next.return_value = None
+
+    return client
+
+
+class TestCloudFunctionService:
+    def test_get_functions_with_vpc_connector(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_cloudfunction_client(
+                functions_list=[
+                    {
+                        "name": f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/functions/{_FUNCTION_NAME}",
+                        "state": "ACTIVE",
+                        "serviceConfig": {
+                            "vpcConnector": _CONNECTOR,
+                        },
+                    }
+                ]
+            )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+        ):
+            cf_client = CloudFunction(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(cf_client.functions) == 1
+            fn = cf_client.functions[0]
+            assert fn.name == _FUNCTION_NAME
+            assert fn.project_id == GCP_PROJECT_ID
+            assert fn.location == _LOCATION_ID
+            assert fn.state == "ACTIVE"
+            assert fn.vpc_connector == _CONNECTOR
+
+    def test_get_functions_without_vpc_connector(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_cloudfunction_client(
+                functions_list=[
+                    {
+                        "name": f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/functions/no-vpc-func",
+                        "state": "ACTIVE",
+                        "serviceConfig": {},
+                    }
+                ]
+            )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+        ):
+            cf_client = CloudFunction(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(cf_client.functions) == 1
+            fn = cf_client.functions[0]
+            assert fn.name == "no-vpc-func"
+            assert fn.vpc_connector is None

From c0ae8b9739da2d7eaad5ed1385a166aeb6d34023 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Thu, 18 Jun 2026 08:56:04 +0200
Subject: [PATCH 079/126] feat(compliance): add DORA compliance framework for
 Azure (#11551)

---
 api/src/backend/api/compliance.py             |   4 +-
 api/src/backend/api/v1/views.py               |   4 +-
 api/src/backend/tasks/tasks.py                |   4 +-
 .../security-compliance-framework.mdx         |  12 +-
 prowler/CHANGELOG.md                          |   2 +
 .../{dora.json => dora_2022_2554.json}        | 245 ++++++++++++++++++
 ui/.prettierignore                            |   1 +
 ui/CHANGELOG.md                               |   1 +
 .../compliance-download-container.test.tsx    |   4 +-
 .../icons/compliance/IconCompliance.tsx       |   5 +-
 ui/dependency-log.json                        |  12 +-
 ui/lib/compliance/compliance-mapper.ts        |   2 +-
 .../compliance-report-types.test.ts           |   2 +-
 ui/lib/compliance/compliance-report-types.ts  |   2 +-
 ui/types/compliance.ts                        |   2 +-
 15 files changed, 276 insertions(+), 26 deletions(-)
 rename prowler/compliance/{dora.json => dora_2022_2554.json} (69%)

diff --git a/api/src/backend/api/compliance.py b/api/src/backend/api/compliance.py
index 202825185b..77c45cbffd 100644
--- a/api/src/backend/api/compliance.py
+++ b/api/src/backend/api/compliance.py
@@ -112,14 +112,14 @@ def get_compliance_frameworks(provider_type: Provider.ProviderChoices) -> list[s
     """List compliance framework identifiers available for `provider_type`.
 
     Includes both per-provider frameworks and universal top-level frameworks
-    (e.g. ``dora``, ``csa_ccm_4.0``).
+    (e.g. ``dora_2022_2554``, ``csa_ccm_4.0``).
 
     Args:
         provider_type (Provider.ProviderChoices): The cloud provider type
             (e.g., "aws", "azure", "gcp", "m365").
 
     Returns:
-        list[str]: Framework identifiers (e.g., "cis_1.4_aws", "dora").
+        list[str]: Framework identifiers (e.g., "cis_1.4_aws", "dora_2022_2554").
     """
     global AVAILABLE_COMPLIANCE_FRAMEWORKS
     if provider_type not in AVAILABLE_COMPLIANCE_FRAMEWORKS:
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 7e9aae5b94..4cf39cdce1 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -1884,7 +1884,7 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
         description=(
             "Download a specific compliance report as an OCSF JSON file. "
             "Only universal frameworks that declare an output configuration "
-            "produce this artifact (currently 'dora' and 'csa_ccm_4.0'); any "
+            "produce this artifact (currently 'dora_2022_2554' and 'csa_ccm_4.0'); any "
             "other framework returns 404."
         ),
         parameters=[
@@ -1893,7 +1893,7 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
                 type=str,
                 location=OpenApiParameter.PATH,
                 required=True,
-                description="The compliance report name, like 'dora'",
+                description="The compliance report name, like 'dora_2022_2554'",
             ),
         ],
         responses={
diff --git a/api/src/backend/tasks/tasks.py b/api/src/backend/tasks/tasks.py
index e617339973..e1e7100ae6 100644
--- a/api/src/backend/tasks/tasks.py
+++ b/api/src/backend/tasks/tasks.py
@@ -560,7 +560,7 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
 
     # Per-framework exporters in `COMPLIANCE_CLASS_MAP` consume the legacy bulk.
     frameworks_bulk = Compliance.get_bulk(provider_type)
-    # Universal-only frameworks (top-level JSONs like `dora.json`) are emitted
+    # Universal-only frameworks (top-level JSONs like `dora_2022_2554.json`) are emitted
     # via `process_universal_compliance_frameworks` below.
     universal_bulk = get_prowler_provider_compliance(provider_type)
     universal_only_names = {
@@ -650,7 +650,7 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
                 writer.batch_write_data_to_file(**extra)
                 writer._data.clear()
 
-            # Universal-only frameworks (e.g. `dora.json`).
+            # Universal-only frameworks (e.g. `dora_2022_2554.json`).
             if universal_only_names:
                 process_universal_compliance_frameworks(
                     input_compliance_frameworks=universal_only_names,
diff --git a/docs/developer-guide/security-compliance-framework.mdx b/docs/developer-guide/security-compliance-framework.mdx
index 030d876aab..cf756c4da0 100644
--- a/docs/developer-guide/security-compliance-framework.mdx
+++ b/docs/developer-guide/security-compliance-framework.mdx
@@ -38,7 +38,7 @@ Before adding a new framework, complete the following checks:
 - **Verify the framework is not already supported.** Inspect `prowler/compliance/` and every `prowler/compliance/<provider>/` for an existing JSON file matching the name and version.
 - **Confirm the required checks exist.** Every requirement that can be automated must point to one or more existing Prowler checks. For each missing check, implement it first by following the [Prowler Checks](/developer-guide/checks) guide.
 - **Review a reference framework.** Use an existing framework with a similar structure as your template:
-  - Universal: `prowler/compliance/dora.json`, `prowler/compliance/csa_ccm_4.0.json`.
+  - Universal: `prowler/compliance/dora_2022_2554.json`, `prowler/compliance/csa_ccm_4.0.json`.
   - Legacy: `prowler/compliance/aws/cis_2.0_aws.json` (canonical CIS shape), `prowler/compliance/aws/ccc_aws.json`, `prowler/compliance/aws/ens_rd2022_aws.json`, `prowler/compliance/aws/nist_800_53_revision_5_aws.json`.
 
 ## Universal Compliance Framework
@@ -51,9 +51,9 @@ Place the file at the top level of the compliance directory:
 prowler/compliance/<framework_name>.json
 ```
 
-Examples in the repository: `prowler/compliance/csa_ccm_4.0.json`, `prowler/compliance/dora.json`.
+Examples in the repository: `prowler/compliance/csa_ccm_4.0.json`, `prowler/compliance/dora_2022_2554.json`.
 
-The file is auto-discovered — there is **no** need to register it in any `__init__.py`, modify `prowler/lib/outputs/`, or update any other Python module. The framework key Prowler CLI accepts via `--compliance` is the basename of the JSON file without `.json` (`dora.json` → `dora`).
+The file is auto-discovered — there is **no** need to register it in any `__init__.py`, modify `prowler/lib/outputs/`, or update any other Python module. The framework key Prowler CLI accepts via `--compliance` is the basename of the JSON file without `.json` (`dora_2022_2554.json` → `dora_2022_2554`).
 
 ### Top-level structure
 
@@ -70,7 +70,7 @@ The file is auto-discovered — there is **no** need to register it in any `__in
 }
 ```
 
-A `provider` field at the top level is **optional**. The framework's effective provider list is derived by `ComplianceFramework.get_providers()` (`compliance_models.py:739`) from the union of all keys appearing in `requirement.checks` across all requirements; the explicit `provider` field is used **only as a fallback** when no requirement carries any `checks` key. This is what enables a single file (e.g. `dora.json`) to cover AWS today and add Azure / GCP / etc. tomorrow without restructuring.
+A `provider` field at the top level is **optional**. The framework's effective provider list is derived by `ComplianceFramework.get_providers()` (`compliance_models.py:739`) from the union of all keys appearing in `requirement.checks` across all requirements; the explicit `provider` field is used **only as a fallback** when no requirement carries any `checks` key. This is what enables a single file (e.g. `dora_2022_2554.json`) to cover AWS today and add Azure / GCP / etc. tomorrow without restructuring.
 
 Provider keys inside `requirement.checks` must match the directory names under `prowler/providers/`. The valid keys at present are: `aws`, `azure`, `gcp`, `m365`, `kubernetes`, `iac`, `github`, `googleworkspace`, `alibabacloud`, `cloudflare`, `mongodbatlas`, `nhn`, `openstack`, `oraclecloud`, `llm`. Comparison in `supports_provider()` is case-insensitive, but lowercase is the convention used everywhere in the repository.
 
@@ -493,7 +493,7 @@ Before opening a PR, validate the JSON loads cleanly against the model and that
 
 ### 1. Schema validation
 
-For **universal** frameworks, load the file and inspect what was parsed. The framework key inside `bulk` is the **basename of the JSON file** (without `.json`); for `prowler/compliance/dora.json` that key is `dora`, for `prowler/compliance/aws/cis_5.0_aws.json` it is `cis_5.0_aws`.
+For **universal** frameworks, load the file and inspect what was parsed. The framework key inside `bulk` is the **basename of the JSON file** (without `.json`); for `prowler/compliance/dora_2022_2554.json` that key is `dora_2022_2554`, for `prowler/compliance/aws/cis_5.0_aws.json` it is `cis_5.0_aws`.
 
 ```python
 from prowler.lib.check.compliance_models import (
@@ -619,7 +619,7 @@ The following issues are the most common when contributing a compliance framewor
 
 Use the following files as templates when modeling a new contribution.
 
-- `prowler/compliance/dora.json` — universal schema, single-provider populated (AWS), ready to extend with more providers.
+- `prowler/compliance/dora_2022_2554.json` — universal schema, single-provider populated (AWS), ready to extend with more providers.
 - `prowler/compliance/csa_ccm_4.0.json` — universal schema, multi-provider populated (AWS, Azure, GCP, AlibabaCloud, OracleCloud).
 - `prowler/compliance/aws/cis_2.0_aws.json` — legacy CIS attribute shape.
 - `prowler/compliance/aws/nist_800_53_revision_5_aws.json` — legacy generic attribute shape.
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index ada7536290..13203e2fde 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -22,6 +22,8 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
+- DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Azure provider, mapping existing Azure checks across the five DORA pillars [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
+- Rename DORA to DORA_2022_2554 to follow the naming <name>_<version> in compliance frameworks [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
 - `entra_directory_sync_object_takeover_blocked` check for the M365 provider, verifying that hybrid Entra tenants block cloud object takeover through both soft-match and hard-match directory synchronization [(#11098)](https://github.com/prowler-cloud/prowler/pull/11098)
 - `entra_conditional_access_policy_no_deleted_object_references` check for M365 provider [(#11236)](https://github.com/prowler-cloud/prowler/pull/11236)
 
diff --git a/prowler/compliance/dora.json b/prowler/compliance/dora_2022_2554.json
similarity index 69%
rename from prowler/compliance/dora.json
rename to prowler/compliance/dora_2022_2554.json
index 2378a307c6..1bc4ed41da 100644
--- a/prowler/compliance/dora.json
+++ b/prowler/compliance/dora_2022_2554.json
@@ -114,6 +114,22 @@
           "organizations_account_part_of_organizations",
           "iam_user_mfa_enabled_console_access",
           "iam_user_hardware_mfa_enabled"
+        ],
+        "azure": [
+          "entra_global_admin_in_less_than_five_users",
+          "entra_privileged_user_has_mfa",
+          "entra_non_privileged_user_has_mfa",
+          "entra_user_with_vm_access_has_mfa",
+          "entra_security_defaults_enabled",
+          "entra_conditional_access_policy_require_mfa_for_admin_portals",
+          "entra_conditional_access_policy_require_mfa_for_management_api",
+          "entra_policy_default_users_cannot_create_security_groups",
+          "entra_policy_ensure_default_user_cannot_create_apps",
+          "entra_policy_ensure_default_user_cannot_create_tenants",
+          "entra_users_cannot_create_microsoft_365_groups",
+          "iam_subscription_roles_owner_custom_not_created",
+          "iam_role_user_access_admin_restricted",
+          "iam_custom_role_has_permissions_to_administer_resource_locks"
         ]
       }
     },
@@ -136,6 +152,24 @@
           "organizations_delegated_administrators",
           "guardduty_centrally_managed",
           "guardduty_delegated_admin_enabled_all_regions"
+        ],
+        "azure": [
+          "defender_ensure_defender_for_server_is_on",
+          "defender_ensure_defender_for_containers_is_on",
+          "defender_ensure_defender_for_storage_is_on",
+          "defender_ensure_defender_for_app_services_is_on",
+          "defender_ensure_defender_for_azure_sql_databases_is_on",
+          "defender_ensure_defender_for_sql_servers_is_on",
+          "defender_ensure_defender_for_databases_is_on",
+          "defender_ensure_defender_for_os_relational_databases_is_on",
+          "defender_ensure_defender_for_keyvault_is_on",
+          "defender_ensure_defender_for_arm_is_on",
+          "defender_ensure_defender_for_dns_is_on",
+          "defender_ensure_defender_for_cosmosdb_is_on",
+          "defender_ensure_mcas_is_enabled",
+          "defender_ensure_wdatp_is_enabled",
+          "defender_auto_provisioning_log_analytics_agent_vms_on",
+          "policy_ensure_asc_enforcement_enabled"
         ]
       }
     },
@@ -167,6 +201,22 @@
           "cloudfront_distributions_using_deprecated_ssl_protocols",
           "cloudfront_distributions_https_enabled",
           "rds_instance_transport_encrypted"
+        ],
+        "azure": [
+          "storage_ensure_minimum_tls_version_12",
+          "storage_secure_transfer_required_is_enabled",
+          "storage_smb_channel_encryption_with_secure_algorithm",
+          "storage_smb_protocol_version_is_latest",
+          "app_minimum_tls_version_12",
+          "app_ensure_http_is_redirected_to_https",
+          "app_ensure_using_http20",
+          "sqlserver_recommended_minimal_tls_version",
+          "mysql_flexible_server_minimum_tls_version_12",
+          "mysql_flexible_server_ssl_connection_enabled",
+          "postgresql_flexible_server_enforce_ssl_enabled",
+          "keyvault_key_rotation_enabled",
+          "storage_key_rotation_90_days",
+          "aks_network_policy_enabled"
         ]
       }
     },
@@ -189,6 +239,12 @@
           "ec2_elastic_ip_unassigned",
           "ec2_networkacl_unused",
           "secretsmanager_secret_unused"
+        ],
+        "azure": [
+          "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
+          "network_watcher_enabled",
+          "network_public_ip_shodan",
+          "vm_scaleset_not_empty"
         ]
       }
     },
@@ -236,6 +292,43 @@
           "ec2_instance_account_imdsv2_enabled",
           "efs_encryption_at_rest_enabled",
           "awslambda_function_not_publicly_accessible"
+        ],
+        "azure": [
+          "storage_account_public_network_access_disabled",
+          "storage_blob_public_access_level_is_disabled",
+          "storage_default_network_access_rule_is_denied",
+          "storage_ensure_private_endpoints_in_storage_accounts",
+          "storage_ensure_encryption_with_customer_managed_keys",
+          "storage_infrastructure_encryption_is_enabled",
+          "storage_account_key_access_disabled",
+          "storage_default_to_entra_authorization_enabled",
+          "containerregistry_not_publicly_accessible",
+          "containerregistry_uses_private_link",
+          "cosmosdb_account_use_private_endpoints",
+          "cosmosdb_account_firewall_use_selected_networks",
+          "keyvault_private_endpoints",
+          "keyvault_access_only_through_private_endpoints",
+          "keyvault_rbac_enabled",
+          "app_function_not_publicly_accessible",
+          "aisearch_service_not_publicly_accessible",
+          "aks_clusters_public_access_disabled",
+          "aks_clusters_created_with_private_nodes",
+          "sqlserver_unrestricted_inbound_access",
+          "postgresql_flexible_server_allow_access_services_disabled",
+          "vm_ensure_attached_disks_encrypted_with_cmk",
+          "vm_ensure_unattached_disks_encrypted_with_cmk",
+          "vm_ensure_using_managed_disks",
+          "vm_trusted_launch_enabled",
+          "vm_linux_enforce_ssh_authentication",
+          "vm_jit_access_enabled",
+          "sqlserver_tde_encryption_enabled",
+          "sqlserver_tde_encrypted_with_cmk",
+          "databricks_workspace_cmk_encryption_enabled",
+          "network_ssh_internet_access_restricted",
+          "network_rdp_internet_access_restricted",
+          "network_http_internet_access_restricted",
+          "network_udp_internet_access_restricted",
+          "network_bastion_host_exists"
         ]
       }
     },
@@ -266,6 +359,22 @@
           "inspector2_is_enabled",
           "inspector2_active_findings_exist",
           "ec2_elastic_ip_shodan"
+        ],
+        "azure": [
+          "defender_ensure_defender_for_server_is_on",
+          "defender_ensure_defender_for_containers_is_on",
+          "defender_ensure_defender_for_storage_is_on",
+          "defender_ensure_defender_for_keyvault_is_on",
+          "defender_ensure_defender_for_arm_is_on",
+          "defender_ensure_defender_for_dns_is_on",
+          "defender_ensure_defender_for_azure_sql_databases_is_on",
+          "defender_ensure_defender_for_sql_servers_is_on",
+          "defender_ensure_wdatp_is_enabled",
+          "defender_ensure_mcas_is_enabled",
+          "defender_container_images_scan_enabled",
+          "defender_container_images_resolved_vulnerabilities",
+          "sqlserver_microsoft_defender_enabled",
+          "apim_threat_detection_llm_jacking"
         ]
       }
     },
@@ -288,6 +397,17 @@
           "backup_vaults_exist",
           "rds_instance_critical_event_subscription",
           "rds_cluster_critical_event_subscription"
+        ],
+        "azure": [
+          "monitor_alert_service_health_exists",
+          "monitor_alert_create_update_security_solution",
+          "monitor_alert_delete_security_solution",
+          "defender_additional_email_configured_with_a_security_contact",
+          "defender_ensure_notify_alerts_severity_is_high",
+          "defender_ensure_notify_emails_to_owners",
+          "defender_attack_path_notifications_properly_configured",
+          "vm_backup_enabled",
+          "vm_sufficient_daily_backup_retention_period"
         ]
       }
     },
@@ -329,6 +449,16 @@
           "elbv2_is_in_multiple_az",
           "cloudfront_distributions_multiple_origin_failover_configured",
           "dynamodb_table_protected_by_backup_plan"
+        ],
+        "azure": [
+          "vm_backup_enabled",
+          "vm_sufficient_daily_backup_retention_period",
+          "vm_ensure_using_managed_disks",
+          "storage_ensure_soft_delete_is_enabled",
+          "storage_ensure_file_shares_soft_delete_is_enabled",
+          "storage_blob_versioning_is_enabled",
+          "storage_geo_redundant_enabled",
+          "keyvault_recoverable"
         ]
       }
     },
@@ -348,6 +478,16 @@
           "inspector2_active_findings_exist",
           "accessanalyzer_enabled_without_findings",
           "cloudtrail_insights_exist"
+        ],
+        "azure": [
+          "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
+          "defender_assessments_vm_endpoint_protection_installed",
+          "defender_container_images_resolved_vulnerabilities",
+          "defender_container_images_scan_enabled",
+          "defender_ensure_system_updates_are_applied",
+          "sqlserver_vulnerability_assessment_enabled",
+          "sqlserver_va_periodic_recurring_scans_enabled",
+          "sqlserver_va_scan_reports_configured"
         ]
       }
     },
@@ -370,6 +510,13 @@
           "eventbridge_schema_registry_cross_account_access",
           "cloudwatch_alarm_actions_enabled",
           "cloudwatch_alarm_actions_alarm_state_configured"
+        ],
+        "azure": [
+          "defender_additional_email_configured_with_a_security_contact",
+          "defender_ensure_notify_emails_to_owners",
+          "defender_ensure_notify_alerts_severity_is_high",
+          "defender_attack_path_notifications_properly_configured",
+          "monitor_alert_service_health_exists"
         ]
       }
     },
@@ -406,6 +553,26 @@
           "elbv2_logging_enabled",
           "cloudfront_distributions_logging_enabled",
           "s3_bucket_server_access_logging_enabled"
+        ],
+        "azure": [
+          "monitor_diagnostic_settings_exists",
+          "monitor_diagnostic_setting_with_appropriate_categories",
+          "monitor_storage_account_with_activity_logs_is_private",
+          "monitor_storage_account_with_activity_logs_cmk_encrypted",
+          "network_flow_log_captured_sent",
+          "network_flow_log_more_than_90_days",
+          "keyvault_logging_enabled",
+          "sqlserver_auditing_enabled",
+          "sqlserver_auditing_retention_90_days",
+          "mysql_flexible_server_audit_log_enabled",
+          "mysql_flexible_server_audit_log_connection_activated",
+          "postgresql_flexible_server_log_checkpoints_on",
+          "postgresql_flexible_server_log_connections_on",
+          "postgresql_flexible_server_log_disconnections_on",
+          "postgresql_flexible_server_log_retention_days_greater_3",
+          "app_http_logs_enabled",
+          "app_function_application_insights_enabled",
+          "appinsights_ensure_is_configured"
         ]
       }
     },
@@ -429,6 +596,15 @@
           "cloudtrail_threat_detection_enumeration",
           "cloudtrail_threat_detection_llm_jacking",
           "cloudtrail_threat_detection_privilege_escalation"
+        ],
+        "azure": [
+          "defender_ensure_notify_alerts_severity_is_high",
+          "defender_attack_path_notifications_properly_configured",
+          "defender_ensure_defender_for_server_is_on",
+          "defender_ensure_wdatp_is_enabled",
+          "defender_ensure_mcas_is_enabled",
+          "sqlserver_microsoft_defender_enabled",
+          "apim_threat_detection_llm_jacking"
         ]
       }
     },
@@ -459,6 +635,20 @@
           "cloudwatch_changes_to_network_route_tables_alarm_configured",
           "cloudwatch_changes_to_vpcs_alarm_configured",
           "sns_subscription_not_using_http_endpoints"
+        ],
+        "azure": [
+          "monitor_alert_create_policy_assignment",
+          "monitor_alert_delete_policy_assignment",
+          "monitor_alert_create_update_nsg",
+          "monitor_alert_delete_nsg",
+          "monitor_alert_create_update_security_solution",
+          "monitor_alert_delete_security_solution",
+          "monitor_alert_create_update_sqlserver_fr",
+          "monitor_alert_delete_sqlserver_fr",
+          "monitor_alert_create_update_public_ip_address_rule",
+          "monitor_alert_delete_public_ip_address_rule",
+          "monitor_alert_service_health_exists",
+          "defender_additional_email_configured_with_a_security_contact"
         ]
       }
     },
@@ -479,6 +669,16 @@
           "ec2_instance_managed_by_ssm",
           "ec2_instance_with_outdated_ami",
           "ssm_managed_compliant_patching"
+        ],
+        "azure": [
+          "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
+          "defender_ensure_system_updates_are_applied",
+          "defender_container_images_scan_enabled",
+          "defender_assessments_vm_endpoint_protection_installed",
+          "sqlserver_vulnerability_assessment_enabled",
+          "sqlserver_va_periodic_recurring_scans_enabled",
+          "vm_ensure_using_approved_images",
+          "vm_desired_sku_size"
         ]
       }
     },
@@ -506,6 +706,23 @@
           "rds_instance_certificate_expiration",
           "iam_no_expired_server_certificates_stored",
           "ssm_managed_compliant_patching"
+        ],
+        "azure": [
+          "defender_auto_provisioning_vulnerabilty_assessments_machines_on",
+          "defender_container_images_resolved_vulnerabilities",
+          "sqlserver_vulnerability_assessment_enabled",
+          "sqlserver_va_periodic_recurring_scans_enabled",
+          "sqlserver_va_scan_reports_configured",
+          "sqlserver_va_emails_notifications_admins_enabled",
+          "keyvault_key_expiration_set_in_non_rbac",
+          "keyvault_rbac_key_expiration_set",
+          "keyvault_non_rbac_secret_expiration_set",
+          "keyvault_rbac_secret_expiration_set",
+          "app_ensure_java_version_is_latest",
+          "app_ensure_php_version_is_latest",
+          "app_ensure_python_version_is_latest",
+          "app_function_latest_runtime_version",
+          "storage_smb_protocol_version_is_latest"
         ]
       }
     },
@@ -537,6 +754,17 @@
           "vpc_endpoint_services_allowed_principals_trust_boundaries",
           "vpc_peering_routing_tables_with_least_privilege",
           "awslambda_function_using_cross_account_layers"
+        ],
+        "azure": [
+          "entra_policy_guest_users_access_restrictions",
+          "entra_policy_guest_invite_only_for_admin_roles",
+          "entra_policy_restricts_user_consent_for_apps",
+          "entra_policy_user_consent_for_verified_apps",
+          "storage_cross_tenant_replication_disabled",
+          "containerregistry_uses_private_link",
+          "cosmosdb_account_use_private_endpoints",
+          "keyvault_access_only_through_private_endpoints",
+          "aks_clusters_created_with_private_nodes"
         ]
       }
     },
@@ -567,6 +795,15 @@
           "iam_administrator_access_with_mfa",
           "iam_policy_attached_only_to_group_or_roles",
           "accessanalyzer_enabled"
+        ],
+        "azure": [
+          "iam_subscription_roles_owner_custom_not_created",
+          "iam_role_user_access_admin_restricted",
+          "iam_custom_role_has_permissions_to_administer_resource_locks",
+          "entra_global_admin_in_less_than_five_users",
+          "app_function_identity_without_admin_privileges",
+          "entra_policy_default_users_cannot_create_security_groups",
+          "entra_policy_ensure_default_user_cannot_create_apps"
         ]
       }
     },
@@ -590,6 +827,14 @@
           "cloudtrail_threat_detection_llm_jacking",
           "cloudtrail_threat_detection_privilege_escalation",
           "accessanalyzer_enabled_without_findings"
+        ],
+        "azure": [
+          "defender_ensure_mcas_is_enabled",
+          "defender_ensure_wdatp_is_enabled",
+          "defender_ensure_defender_for_server_is_on",
+          "defender_attack_path_notifications_properly_configured",
+          "sqlserver_microsoft_defender_enabled",
+          "apim_threat_detection_llm_jacking"
         ]
       }
     }
diff --git a/ui/.prettierignore b/ui/.prettierignore
index 5377d96f2d..8b679ff005 100644
--- a/ui/.prettierignore
+++ b/ui/.prettierignore
@@ -8,6 +8,7 @@ build/
 coverage/
 dist/
 esm/
+CHANGELOG.md
 
 # Generated files
 next-env.d.ts
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 1baddf169a..a5b56ab23c 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -11,6 +11,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 ### 🐞 Fixed
 
 - Radio button no longer shifts vertically when selected [(#11608)](https://github.com/prowler-cloud/prowler/pull/11608)
+- Handle rename DORA to DORA_2022_2554 to follow the naming <name>_<version> in compliance frameworks [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
 
 ### 🔐 Security
 
diff --git a/ui/components/compliance/compliance-download-container.test.tsx b/ui/components/compliance/compliance-download-container.test.tsx
index 70ff11c1c2..31c68fb1fc 100644
--- a/ui/components/compliance/compliance-download-container.test.tsx
+++ b/ui/components/compliance/compliance-download-container.test.tsx
@@ -163,7 +163,7 @@ describe("ComplianceDownloadContainer", () => {
         compact
         presentation="dropdown"
         scanId="scan-1"
-        complianceId="dora"
+        complianceId="dora_2022_2554"
       />,
     );
 
@@ -178,7 +178,7 @@ describe("ComplianceDownloadContainer", () => {
 
     expect(downloadComplianceOcsfMock).toHaveBeenCalledWith(
       "scan-1",
-      "dora",
+      "dora_2022_2554",
       {},
     );
   });
diff --git a/ui/components/icons/compliance/IconCompliance.tsx b/ui/components/icons/compliance/IconCompliance.tsx
index ab0fb9a36a..6723fe8a95 100644
--- a/ui/components/icons/compliance/IconCompliance.tsx
+++ b/ui/components/icons/compliance/IconCompliance.tsx
@@ -69,8 +69,9 @@ const COMPLIANCE_LOGOS = [
   ["c5", C5Logo],
   ["ccc", CCCLogo],
   ["csa", CSALogo],
-  // DORA — universal framework (`prowler/compliance/dora.json`). The
-  // compliance_id is just `dora`, no provider suffix.
+  // DORA — universal framework (`prowler/compliance/dora_2022_2554.json`).
+  // The compliance_id is `dora_2022_2554`; the `dora` keyword still matches
+  // it via `includes`, with no provider suffix.
   ["dora", DORALogo],
   ["secnumcloud", ANSSILogo],
   ["okta", OktaLogo],
diff --git a/ui/dependency-log.json b/ui/dependency-log.json
index c851552b08..b200139313 100644
--- a/ui/dependency-log.json
+++ b/ui/dependency-log.json
@@ -2,10 +2,10 @@
   {
     "section": "dependencies",
     "name": "@ai-sdk/react",
-    "from": "2.0.111",
-    "to": "3.0.207",
+    "from": "3.0.207",
+    "to": "3.0.205",
     "strategy": "installed",
-    "generatedAt": "2026-06-15T07:44:51.977Z"
+    "generatedAt": "2026-06-17T11:28:12.866Z"
   },
   {
     "section": "dependencies",
@@ -362,10 +362,10 @@
   {
     "section": "dependencies",
     "name": "ai",
-    "from": "5.0.109",
-    "to": "6.0.205",
+    "from": "6.0.205",
+    "to": "6.0.203",
     "strategy": "installed",
-    "generatedAt": "2026-06-15T07:44:51.977Z"
+    "generatedAt": "2026-06-17T11:28:12.866Z"
   },
   {
     "section": "dependencies",
diff --git a/ui/lib/compliance/compliance-mapper.ts b/ui/lib/compliance/compliance-mapper.ts
index 2e44958c73..bc0995ad87 100644
--- a/ui/lib/compliance/compliance-mapper.ts
+++ b/ui/lib/compliance/compliance-mapper.ts
@@ -228,7 +228,7 @@ const getComplianceMappers = (): Record<string, ComplianceMapper> => ({
       createElement(OktaIDaaSStigCustomDetails, { requirement }),
   },
   // DORA (Regulation (EU) 2022/2554) — universal framework keyed by the
-  // `framework` field of `prowler/compliance/dora.json` ("DORA"). Groups by
+  // `framework` field of `prowler/compliance/dora_2022_2554.json` ("DORA"). Groups by
   // Pillar (5 enum values) and surfaces Pillar / Article / ArticleTitle in
   // the requirement detail drawer.
   DORA: {
diff --git a/ui/lib/compliance/compliance-report-types.test.ts b/ui/lib/compliance/compliance-report-types.test.ts
index 82c6cd49f9..d8d41f08ec 100644
--- a/ui/lib/compliance/compliance-report-types.test.ts
+++ b/ui/lib/compliance/compliance-report-types.test.ts
@@ -37,7 +37,7 @@ describe("getReportTypeForFramework", () => {
 
 describe("isOcsfSupported", () => {
   it("returns true for universal frameworks shipping an OCSF artifact", () => {
-    expect(isOcsfSupported("dora")).toBe(true);
+    expect(isOcsfSupported("dora_2022_2554")).toBe(true);
     expect(isOcsfSupported("csa_ccm_4.0")).toBe(true);
   });
 
diff --git a/ui/lib/compliance/compliance-report-types.ts b/ui/lib/compliance/compliance-report-types.ts
index a9a160e09c..f8f23a67e1 100644
--- a/ui/lib/compliance/compliance-report-types.ts
+++ b/ui/lib/compliance/compliance-report-types.ts
@@ -178,7 +178,7 @@ export const pickLatestCisPerProvider = (
  * ``isOcsfSupported``.
  */
 const OCSF_SUPPORTED_COMPLIANCE_IDS: ReadonlySet<string> = new Set([
-  "dora",
+  "dora_2022_2554",
   "csa_ccm_4.0",
 ]);
 
diff --git a/ui/types/compliance.ts b/ui/types/compliance.ts
index fde9d260e9..3a46375a75 100644
--- a/ui/types/compliance.ts
+++ b/ui/types/compliance.ts
@@ -373,7 +373,7 @@ export interface OktaIDaaSStigRequirement extends Requirement {
 // DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554).
 // Universal framework — flat attributes dict with Pillar/Article/ArticleTitle.
 // `Pillar` is the canonical grouping key for tables and PDF; the enum mirrors
-// the five DORA pillars declared in `prowler/compliance/dora.json`.
+// the five DORA pillars declared in `prowler/compliance/dora_2022_2554.json`.
 export const DORA_PILLAR = {
   ICT_RISK_MANAGEMENT: "ICT Risk Management",
   INCIDENT_REPORTING: "ICT-Related Incident Reporting",

From 3c68a121e54cc94dc3974a5accdd719957b71961 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Thu, 18 Jun 2026 16:06:25 +0900
Subject: [PATCH 080/126] feat(azure): add
 databricks_workspace_no_public_ip_enabled check (#11036)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   1 +
 .../services/databricks/databricks_service.py |  10 +
 .../__init__.py                               |   0
 ...rkspace_no_public_ip_enabled.metadata.json |  38 ++++
 ...tabricks_workspace_no_public_ip_enabled.py |  41 +++++
 .../databricks/databricks_service_test.py     |   2 +
 ...cks_workspace_no_public_ip_enabled_test.py | 174 ++++++++++++++++++
 8 files changed, 267 insertions(+)
 create mode 100644 prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.py
 create mode 100644 tests/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 13203e2fde..7ba3afbe3d 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -18,6 +18,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `cosmosdb_account_minimum_tls_version` check for Azure provider, verifying Cosmos DB accounts enforce TLS 1.2 or higher for client connections [(#11033)](https://github.com/prowler-cloud/prowler/pull/11033)
 - `cosmosdb_account_public_network_access_disabled` check for Azure provider, verifying Cosmos DB accounts have public network access disabled so connectivity is restricted to private endpoints or VNet service endpoints [(#11034)](https://github.com/prowler-cloud/prowler/pull/11034)
 - `databricks_workspace_public_network_access_disabled` check for Azure provider, verifying Databricks workspaces have public network access disabled so connectivity is restricted to Azure Private Link private endpoints [(#11035)](https://github.com/prowler-cloud/prowler/pull/11035)
+- `databricks_workspace_no_public_ip_enabled` check for Azure provider, verifying Databricks workspaces use secure cluster connectivity (no public IP) so compute nodes are not assigned public IP addresses [(#11036)](https://github.com/prowler-cloud/prowler/pull/11036)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 1eb0f75792..4172a9449a 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1411,6 +1411,7 @@
         "containerregistry_not_publicly_accessible",
         "cosmosdb_account_firewall_use_selected_networks",
         "cosmosdb_account_public_network_access_disabled",
+        "databricks_workspace_no_public_ip_enabled",
         "databricks_workspace_public_network_access_disabled",
         "network_bastion_host_exists",
         "network_flow_log_captured_sent",
diff --git a/prowler/providers/azure/services/databricks/databricks_service.py b/prowler/providers/azure/services/databricks/databricks_service.py
index 1e30452294..b7367d3cbb 100644
--- a/prowler/providers/azure/services/databricks/databricks_service.py
+++ b/prowler/providers/azure/services/databricks/databricks_service.py
@@ -62,6 +62,9 @@ class Databricks(AzureService):
                     else:
                         managed_disk_encryption = None
 
+                    enable_no_public_ip = getattr(
+                        workspace_parameters, "enable_no_public_ip", None
+                    )
                     workspaces[subscription][workspace.id] = DatabricksWorkspace(
                         id=workspace.id,
                         name=workspace.name,
@@ -69,6 +72,11 @@ class Databricks(AzureService):
                         public_network_access=getattr(
                             workspace, "public_network_access", None
                         ),
+                        no_public_ip_enabled=(
+                            getattr(enable_no_public_ip, "value", None)
+                            if enable_no_public_ip
+                            else None
+                        ),
                         custom_managed_vnet_id=(
                             getattr(
                                 workspace_parameters, "custom_virtual_network_id", None
@@ -111,6 +119,7 @@ class DatabricksWorkspace(BaseModel):
         name: The name of the workspace.
         location: The Azure region where the workspace is deployed.
         public_network_access: Whether public network access is "Enabled" or "Disabled", if configured.
+        no_public_ip_enabled: Whether secure cluster connectivity (no public IP) is enabled. None when the workspace does not expose this classic-compute setting (e.g. serverless workspaces).
         custom_managed_vnet_id: The ID of the custom managed virtual network, if configured.
         managed_disk_encryption: The encryption settings for the workspace's managed disks.
     """
@@ -119,5 +128,6 @@ class DatabricksWorkspace(BaseModel):
     name: str
     location: str
     public_network_access: Optional[str] = None
+    no_public_ip_enabled: Optional[bool] = None
     custom_managed_vnet_id: Optional[str] = None
     managed_disk_encryption: Optional[ManagedDiskEncryption] = None
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/__init__.py b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.metadata.json b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.metadata.json
new file mode 100644
index 0000000000..4062199474
--- /dev/null
+++ b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "databricks_workspace_no_public_ip_enabled",
+  "CheckTitle": "Databricks workspace has secure cluster connectivity (no public IP)",
+  "CheckType": [],
+  "ServiceName": "databricks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.databricks/workspaces",
+  "ResourceGroup": "ai_ml",
+  "Description": "**Azure Databricks workspaces** are evaluated for **secure cluster connectivity** (No Public IP / NPIP). When enabled, compute (cluster) nodes are deployed without public IP addresses and communicate with the control plane through a secure relay, reducing the workspace's exposure to the internet.",
+  "Risk": "Without **secure cluster connectivity**, Databricks compute nodes are assigned **public IP addresses** and are directly reachable from the internet. This enables **port scanning**, **lateral movement** from a compromised node, and **data exfiltration** that bypasses private-network controls.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/secure-cluster-connectivity",
+    "https://learn.microsoft.com/en-us/azure/databricks/security/network/classic/vnet-inject",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.databricks/workspaces"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az databricks workspace create --name <workspace_name> --resource-group <resource_group_name> --location <region> --sku premium --enable-no-public-ip",
+      "NativeIaC": "```bicep\n// Bicep: Deploy a Databricks workspace with secure cluster connectivity (No Public IP)\nresource workspace 'Microsoft.Databricks/workspaces@2023-02-01' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  sku: {\n    name: 'premium'\n  }\n  properties: {\n    managedResourceGroupId: '/subscriptions/<example_resource_id>/resourceGroups/<example_resource_name>'\n    parameters: {\n      enableNoPublicIp: {\n        value: true // CRITICAL: Deploys cluster nodes without public IP addresses\n      }\n    }\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and start creating a new Azure Databricks workspace (No Public IP must be set at creation; it cannot be enabled on an existing workspace)\n2. On the Networking tab, set Deploy Azure Databricks workspace with Secure Cluster Connectivity (No Public IP) to Yes\n3. Complete the VNet injection configuration if required\n4. Review + create the workspace\n5. Migrate workloads to the new workspace and decommission the old one",
+      "Terraform": "```hcl\n# Terraform: Databricks workspace with secure cluster connectivity (No Public IP)\nresource \"azurerm_databricks_workspace\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<region>\"\n  sku                 = \"premium\"\n\n  custom_parameters {\n    no_public_ip = true # CRITICAL: Deploys cluster nodes without public IP addresses\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Deploy Databricks workspaces with **secure cluster connectivity (No Public IP)** so compute nodes have no public IP addresses. Because this is set at creation, plan a migration for existing workspaces, and pair it with **VNet injection**, **private endpoints / disabled public network access**, and least-privilege NSG rules to uphold **defense in depth**.",
+      "Url": "https://hub.prowler.com/check/databricks_workspace_no_public_ip_enabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Secure cluster connectivity (No Public IP) applies to classic compute and is set at workspace creation. Serverless workspaces do not expose this setting (they have no customer-managed cluster nodes with public IPs) and are reported as MANUAL for verification."
+}
diff --git a/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.py b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.py
new file mode 100644
index 0000000000..13b7742ffa
--- /dev/null
+++ b/prowler/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled.py
@@ -0,0 +1,41 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.databricks.databricks_client import (
+    databricks_client,
+)
+
+
+class databricks_workspace_no_public_ip_enabled(Check):
+    """
+    Ensure Azure Databricks workspaces have secure cluster connectivity (no public IP) enabled.
+
+    This check evaluates whether each Azure Databricks workspace in the subscription is deployed with secure cluster connectivity (No Public IP / NPIP), so cluster nodes are not assigned public IP addresses.
+
+    Secure cluster connectivity is a classic-compute setting. Serverless workspaces do not expose it (they have no customer-managed cluster nodes with public IPs), so the workspace is reported as MANUAL for verification rather than failed.
+
+    - PASS: The workspace has secure cluster connectivity enabled (no_public_ip_enabled is True).
+    - FAIL: The workspace has secure cluster connectivity disabled (no_public_ip_enabled is False).
+    - MANUAL: The workspace does not expose the setting (no_public_ip_enabled is None, e.g. serverless workspaces).
+    """
+
+    def execute(self):
+        findings = []
+        for subscription, workspaces in databricks_client.workspaces.items():
+            subscription_name = databricks_client.subscriptions.get(
+                subscription, subscription
+            )
+            for workspace in workspaces.values():
+                report = Check_Report_Azure(
+                    metadata=self.metadata(), resource=workspace
+                )
+                report.subscription = subscription
+                if workspace.no_public_ip_enabled is None:
+                    report.status = "MANUAL"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) does not expose secure cluster connectivity (no public IP) settings (for example, serverless workspaces have no public-IP cluster nodes); verify the network configuration manually."
+                elif workspace.no_public_ip_enabled:
+                    report.status = "PASS"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) has secure cluster connectivity (no public IP) enabled."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Databricks workspace {workspace.name} in subscription {subscription_name} ({subscription}) does not have secure cluster connectivity (no public IP) enabled."
+                findings.append(report)
+        return findings
diff --git a/tests/providers/azure/services/databricks/databricks_service_test.py b/tests/providers/azure/services/databricks/databricks_service_test.py
index 5c743d1891..f663d81fe2 100644
--- a/tests/providers/azure/services/databricks/databricks_service_test.py
+++ b/tests/providers/azure/services/databricks/databricks_service_test.py
@@ -19,6 +19,7 @@ def mock_databricks_get_workspaces(_):
                 name="test-workspace",
                 location="eastus",
                 public_network_access="Disabled",
+                no_public_ip_enabled=True,
                 custom_managed_vnet_id="test-vnet-id",
                 managed_disk_encryption=ManagedDiskEncryption(
                     key_name="test-key",
@@ -55,6 +56,7 @@ class Test_Databricks_Service:
         assert workspace.name == "test-workspace"
         assert workspace.location == "eastus"
         assert workspace.public_network_access == "Disabled"
+        assert workspace.no_public_ip_enabled is True
         assert workspace.custom_managed_vnet_id == "test-vnet-id"
         assert (
             workspace.managed_disk_encryption.__class__.__name__
diff --git a/tests/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled_test.py b/tests/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled_test.py
new file mode 100644
index 0000000000..a7903770c6
--- /dev/null
+++ b/tests/providers/azure/services/databricks/databricks_workspace_no_public_ip_enabled/databricks_workspace_no_public_ip_enabled_test.py
@@ -0,0 +1,174 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.databricks.databricks_service import (
+    DatabricksWorkspace,
+)
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_databricks_workspace_no_public_ip_enabled:
+    def test_databricks_no_workspaces(self):
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled import (
+                databricks_workspace_no_public_ip_enabled,
+            )
+
+            check = databricks_workspace_no_public_ip_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_databricks_workspace_no_public_ip_disabled(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    no_public_ip_enabled=False,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled import (
+                databricks_workspace_no_public_ip_enabled,
+            )
+
+            check = databricks_workspace_no_public_ip_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have secure cluster connectivity (no public IP) enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"
+
+    def test_databricks_workspace_no_public_ip_enabled(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    no_public_ip_enabled=True,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled import (
+                databricks_workspace_no_public_ip_enabled,
+            )
+
+            check = databricks_workspace_no_public_ip_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} has secure cluster connectivity (no public IP) enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"
+
+    def test_databricks_workspace_no_public_ip_not_reported(self):
+        workspace_id = str(uuid4())
+        workspace_name = "test-workspace"
+        databricks_client = mock.MagicMock
+        databricks_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        databricks_client.workspaces = {
+            AZURE_SUBSCRIPTION_ID: {
+                workspace_id: DatabricksWorkspace(
+                    id=workspace_id,
+                    name=workspace_name,
+                    location="eastus",
+                    no_public_ip_enabled=None,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled.databricks_client",
+                new=databricks_client,
+            ),
+        ):
+            from prowler.providers.azure.services.databricks.databricks_workspace_no_public_ip_enabled.databricks_workspace_no_public_ip_enabled import (
+                databricks_workspace_no_public_ip_enabled,
+            )
+
+            check = databricks_workspace_no_public_ip_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "MANUAL"
+            assert (
+                result[0].status_extended
+                == f"Databricks workspace {workspace_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY} does not expose secure cluster connectivity (no public IP) settings (for example, serverless workspaces have no public-IP cluster nodes); verify the network configuration manually."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == workspace_name
+            assert result[0].resource_id == workspace_id
+            assert result[0].location == "eastus"

From 5a761f341b681c682f797defcc5fe78a756ea521 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Thu, 18 Jun 2026 09:07:43 +0200
Subject: [PATCH 081/126] ci: remove redundant compliance CODEOWNERS rule
 (#11634)

---
 .github/CODEOWNERS | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index 3300394d83..ed97ff5a1a 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -1,7 +1,6 @@
 # SDK
 /* @prowler-cloud/detection-remediation
 /prowler/ @prowler-cloud/detection-remediation
-/prowler/compliance/ @prowler-cloud/compliance
 /tests/ @prowler-cloud/detection-remediation
 /dashboard/ @prowler-cloud/detection-remediation
 /docs/ @prowler-cloud/detection-remediation

From 2293cab72c10f0e0d973cc373a69836a6f8df367 Mon Sep 17 00:00:00 2001
From: "Pablo Fernandez Guerra (PFE)"
 <148432447+pfe-nazaries@users.noreply.github.com>
Date: Thu, 18 Jun 2026 10:03:35 +0200
Subject: [PATCH 082/126] fix(ui): adaptive Attack Paths messages for waiting
 states (#11512)

Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 ui/CHANGELOG.md                               |   1 +
 .../attack-paths-status-panel.test.tsx        |  64 ++++++++
 .../_components/attack-paths-status-panel.tsx |  87 ++++++++++
 .../_components/query-execution-error.tsx     |  28 ++--
 .../_hooks/use-attack-path-scans.ts           |  61 ++++---
 .../_lib/get-attack-paths-view-state.test.ts  | 152 ++++++++++++++++++
 .../_lib/get-attack-paths-view-state.ts       |  65 ++++++++
 .../attack-paths-page.browser.test.tsx        |  25 +++
 .../attack-paths-page.fixtures.ts             |  49 ++++++
 .../query-builder/attack-paths-page.tsx       | 101 ++++++------
 ui/components/shared/status-alert.test.tsx    |  45 ++++++
 ui/components/shared/status-alert.tsx         |  41 +++++
 12 files changed, 636 insertions(+), 83 deletions(-)
 create mode 100644 ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.test.tsx
 create mode 100644 ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.tsx
 create mode 100644 ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.test.ts
 create mode 100644 ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.ts
 create mode 100644 ui/components/shared/status-alert.test.tsx
 create mode 100644 ui/components/shared/status-alert.tsx

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index a5b56ab23c..3de8c46d56 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -10,6 +10,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 ### 🐞 Fixed
 
+- Attack Paths now shows distinct messages while a scan is queued, running, or building its graph — plus a separate "couldn't load scans" error — instead of always showing "No scans available" [(#11512)](https://github.com/prowler-cloud/prowler/pull/11512)
 - Radio button no longer shifts vertically when selected [(#11608)](https://github.com/prowler-cloud/prowler/pull/11608)
 - Handle rename DORA to DORA_2022_2554 to follow the naming <name>_<version> in compliance frameworks [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
 
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.test.tsx
new file mode 100644
index 0000000000..20210a3126
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.test.tsx
@@ -0,0 +1,64 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+
+import { ATTACK_PATHS_VIEW_STATES } from "../_lib/get-attack-paths-view-state";
+import { AttackPathsStatusPanel } from "./attack-paths-status-panel";
+
+describe("AttackPathsStatusPanel", () => {
+  it("renders the no-scans message with a link to Scan Jobs", () => {
+    render(
+      <AttackPathsStatusPanel state={ATTACK_PATHS_VIEW_STATES.NO_SCANS} />,
+    );
+    expect(screen.getByText(/no scans available/i)).toBeInTheDocument();
+    expect(
+      screen.getByRole("link", { name: /go to scan jobs/i }),
+    ).toHaveAttribute("href", "/scans");
+  });
+
+  it("renders the scan-pending message", () => {
+    render(
+      <AttackPathsStatusPanel state={ATTACK_PATHS_VIEW_STATES.SCAN_PENDING} />,
+    );
+    expect(screen.getByText(/scan in progress/i)).toBeInTheDocument();
+  });
+
+  it("renders the graph-building message with progress", () => {
+    render(
+      <AttackPathsStatusPanel
+        state={ATTACK_PATHS_VIEW_STATES.GRAPH_BUILDING}
+        progress={45}
+      />,
+    );
+    expect(
+      screen.getByText(/preparing attack paths data/i),
+    ).toBeInTheDocument();
+    expect(screen.getByText(/45%/)).toBeInTheDocument();
+  });
+
+  it("renders the no-graph-data message", () => {
+    render(
+      <AttackPathsStatusPanel state={ATTACK_PATHS_VIEW_STATES.NO_GRAPH_DATA} />,
+    );
+    expect(screen.getByText(/no attack paths data/i)).toBeInTheDocument();
+  });
+
+  it("renders the error message and calls onRetry when Retry is clicked", () => {
+    const onRetry = vi.fn();
+    render(
+      <AttackPathsStatusPanel
+        state={ATTACK_PATHS_VIEW_STATES.ERROR}
+        onRetry={onRetry}
+      />,
+    );
+    expect(screen.getByText(/couldn.t load scans/i)).toBeInTheDocument();
+    fireEvent.click(screen.getByRole("button", { name: /retry/i }));
+    expect(onRetry).toHaveBeenCalledOnce();
+  });
+
+  it("renders nothing for the ready state", () => {
+    const { container } = render(
+      <AttackPathsStatusPanel state={ATTACK_PATHS_VIEW_STATES.READY} />,
+    );
+    expect(container).toBeEmptyDOMElement();
+  });
+});
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.tsx
new file mode 100644
index 0000000000..89db0dbfd2
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/attack-paths-status-panel.tsx
@@ -0,0 +1,87 @@
+import Link from "next/link";
+
+import { Button } from "@/components/shadcn";
+import { StatusAlert } from "@/components/shared/status-alert";
+
+import {
+  ATTACK_PATHS_VIEW_STATES,
+  type AttackPathsViewState,
+} from "../_lib/get-attack-paths-view-state";
+
+interface AttackPathsStatusPanelProps {
+  state: AttackPathsViewState;
+  progress?: number;
+  onRetry?: () => void;
+}
+
+/**
+ * Full-page status message shown whenever the Attack Paths graph is not yet
+ * queryable. The page renders the normal workflow instead once `state` is
+ * `READY` (this component renders nothing for `READY`/`LOADING`).
+ */
+export const AttackPathsStatusPanel = ({
+  state,
+  progress = 0,
+  onRetry,
+}: AttackPathsStatusPanelProps) => {
+  if (state === ATTACK_PATHS_VIEW_STATES.ERROR) {
+    return (
+      <StatusAlert
+        variant="error"
+        title="Couldn't load scans"
+        descriptionClassName="flex flex-col items-start gap-3"
+      >
+        <span>Something went wrong loading your scans.</span>
+        {onRetry ? (
+          <Button variant="outline" size="sm" onClick={onRetry}>
+            Retry
+          </Button>
+        ) : null}
+      </StatusAlert>
+    );
+  }
+
+  if (state === ATTACK_PATHS_VIEW_STATES.NO_SCANS) {
+    return (
+      <StatusAlert variant="info" title="No scans available">
+        <span>
+          You need to run a scan before you can analyze attack paths.{" "}
+          <Link href="/scans" className="font-medium underline">
+            Go to Scan Jobs
+          </Link>
+        </span>
+      </StatusAlert>
+    );
+  }
+
+  if (state === ATTACK_PATHS_VIEW_STATES.SCAN_PENDING) {
+    return (
+      <StatusAlert variant="info" title="Scan in progress">
+        <span>
+          Your scan is queued. Attack Paths will be available once it completes.
+        </span>
+      </StatusAlert>
+    );
+  }
+
+  if (state === ATTACK_PATHS_VIEW_STATES.GRAPH_BUILDING) {
+    return (
+      <StatusAlert variant="info" title="Preparing Attack Paths data">
+        <span>
+          We&apos;re building the graph from your latest scan ({progress}%).
+          This will be ready shortly.
+        </span>
+      </StatusAlert>
+    );
+  }
+
+  if (state === ATTACK_PATHS_VIEW_STATES.NO_GRAPH_DATA) {
+    return (
+      <StatusAlert variant="info" title="No Attack Paths data">
+        <span>This scan didn&apos;t produce Attack Paths data.</span>
+      </StatusAlert>
+    );
+  }
+
+  return null;
+};
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-execution-error.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-execution-error.tsx
index 084bcf6e16..b451cf58f6 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-execution-error.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_components/query-execution-error.tsx
@@ -1,6 +1,4 @@
-import { CircleAlert } from "lucide-react";
-
-import { Alert, AlertDescription, AlertTitle } from "@/components/shadcn";
+import { StatusAlert } from "@/components/shared/status-alert";
 
 interface QueryExecutionErrorProps {
   error: string;
@@ -14,17 +12,17 @@ export const QueryExecutionError = ({
   description,
 }: QueryExecutionErrorProps) => {
   return (
-    <Alert variant="error">
-      <CircleAlert className="size-4" />
-      <AlertTitle>{title}</AlertTitle>
-      <AlertDescription className="w-full gap-3">
-        {description ? <p>{description}</p> : null}
-        <div className="bg-bg-neutral-primary/70 border-border-neutral-secondary w-full rounded-md border px-3 py-2">
-          <pre className="text-text-error-primary font-mono text-xs break-words whitespace-pre-wrap">
-            {error}
-          </pre>
-        </div>
-      </AlertDescription>
-    </Alert>
+    <StatusAlert
+      variant="error"
+      title={title}
+      descriptionClassName="w-full gap-3"
+    >
+      {description ? <p>{description}</p> : null}
+      <div className="bg-bg-neutral-primary/70 border-border-neutral-secondary w-full rounded-md border px-3 py-2">
+        <pre className="text-text-error-primary font-mono text-xs break-words whitespace-pre-wrap">
+          {error}
+        </pre>
+      </div>
+    </StatusAlert>
   );
 };
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts
index 39515698a1..5957e175d7 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_hooks/use-attack-path-scans.ts
@@ -1,6 +1,6 @@
 "use client";
 
-import { useState } from "react";
+import { useRef, useState } from "react";
 
 import { getAttackPathScans } from "@/actions/attack-paths";
 import { useMountEffect } from "@/hooks/use-mount-effect";
@@ -19,7 +19,9 @@ export interface UseAttackPathScansOptions {
 export interface UseAttackPathScansResult {
   scans: AttackPathScan[];
   scansLoading: boolean;
+  loadError: boolean;
   refreshScans: () => Promise<void>;
+  retryLoadScans: () => Promise<void>;
 }
 
 /**
@@ -35,7 +37,11 @@ export function useAttackPathScans(
 
   const [scans, setScans] = useState<AttackPathScan[]>([]);
   const [scansLoading, setScansLoading] = useState(true);
+  const [loadError, setLoadError] = useState(false);
+  const mountedRef = useRef(true);
 
+  // Silent background refresh for auto-refresh: never flips loading/error, so it
+  // can't disrupt the visible view if it fails.
   const refreshScans = async () => {
     try {
       const scansData = await getAttackPathScans();
@@ -47,35 +53,50 @@ export function useAttackPathScans(
     }
   };
 
-  useMountEffect(() => {
-    let active = true;
-
-    const loadScans = async () => {
-      setScansLoading(true);
-      try {
-        const scansData = await getAttackPathScans();
-        const nextScans = scansData?.data ?? [];
-        if (!active) return;
-        setScans(nextScans);
-        if (!nextScans.some((scan) => scan.attributes.graph_data_ready)) {
+  // Full (re)load: drives loading + error state. Runs on mount and is reused by
+  // the error view's Retry action. A successful empty result (`{ data: [] }`) is
+  // not an error; only a missing payload or a thrown request is.
+  const loadScans = async () => {
+    setScansLoading(true);
+    setLoadError(false);
+    try {
+      const scansData = await getAttackPathScans();
+      if (!mountedRef.current) return;
+      if (scansData?.data) {
+        setScans(scansData.data);
+        if (!scansData.data.some((scan) => scan.attributes.graph_data_ready)) {
           onNoReadyScan?.();
         }
-      } catch (error) {
-        if (!active) return;
-        console.error("Failed to load scans:", error);
+      } else {
         setScans([]);
+        setLoadError(true);
         onNoReadyScan?.();
-      } finally {
-        if (active) setScansLoading(false);
       }
-    };
+    } catch (error) {
+      if (!mountedRef.current) return;
+      console.error("Failed to load scans:", error);
+      setScans([]);
+      setLoadError(true);
+      onNoReadyScan?.();
+    } finally {
+      if (mountedRef.current) setScansLoading(false);
+    }
+  };
 
+  useMountEffect(() => {
+    mountedRef.current = true;
     void loadScans();
 
     return () => {
-      active = false;
+      mountedRef.current = false;
     };
   });
 
-  return { scans, scansLoading, refreshScans };
+  return {
+    scans,
+    scansLoading,
+    loadError,
+    refreshScans,
+    retryLoadScans: loadScans,
+  };
 }
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.test.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.test.ts
new file mode 100644
index 0000000000..c6722021ed
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.test.ts
@@ -0,0 +1,152 @@
+import { describe, expect, it } from "vitest";
+
+import type { AttackPathScan, ScanState } from "@/types/attack-paths";
+
+import {
+  ATTACK_PATHS_VIEW_STATES,
+  getAttackPathsViewState,
+  getGraphBuildingProgress,
+  isScanInFlight,
+} from "./get-attack-paths-view-state";
+
+const scan = (
+  state: ScanState,
+  graph_data_ready: boolean,
+  progress = 0,
+): AttackPathScan => ({
+  type: "attack-paths-scans",
+  id: `${state}-${String(graph_data_ready)}-${progress}`,
+  attributes: {
+    state,
+    progress,
+    graph_data_ready,
+    provider_alias: "Provider",
+    provider_type: "aws",
+    provider_uid: "123456789012",
+    inserted_at: "2026-04-21T10:00:00Z",
+    started_at: "2026-04-21T10:00:00Z",
+    completed_at: null,
+    duration: null,
+  },
+  relationships: {
+    provider: { data: { type: "providers", id: "p" } },
+    scan: { data: { type: "scans", id: "s" } },
+    task: { data: { type: "tasks", id: "t" } },
+  },
+});
+
+describe("getAttackPathsViewState", () => {
+  it("returns loading while scans are loading, regardless of other inputs", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: true,
+        loadError: true,
+        scans: [],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.LOADING);
+  });
+
+  it("returns error on load failure (error wins over empty scans)", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: true,
+        scans: [],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.ERROR);
+  });
+
+  it("returns no-scans for an empty list", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.NO_SCANS);
+  });
+
+  it("returns ready when any provider has a queryable graph", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("executing", false, 50), scan("completed", true, 100)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.READY);
+  });
+
+  it("returns graph-building when none ready and some scan is executing (wins over scheduled)", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("scheduled", false), scan("executing", false, 30)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.GRAPH_BUILDING);
+  });
+
+  it("returns scan-pending when none ready and some scan is scheduled/available", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("scheduled", false)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.SCAN_PENDING);
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("available", false)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.SCAN_PENDING);
+  });
+
+  it("returns no-graph-data when none ready and all scans are terminal", () => {
+    expect(
+      getAttackPathsViewState({
+        scansLoading: false,
+        loadError: false,
+        scans: [scan("completed", false), scan("failed", false)],
+      }),
+    ).toBe(ATTACK_PATHS_VIEW_STATES.NO_GRAPH_DATA);
+  });
+});
+
+describe("isScanInFlight", () => {
+  it("is true for an available scan (created, not yet scheduled)", () => {
+    expect(isScanInFlight([scan("available", false)])).toBe(true);
+  });
+
+  it("is true for scheduled and executing scans", () => {
+    expect(isScanInFlight([scan("scheduled", false)])).toBe(true);
+    expect(isScanInFlight([scan("executing", false, 40)])).toBe(true);
+  });
+
+  it("is false when every scan is in a terminal state", () => {
+    expect(
+      isScanInFlight([scan("completed", true), scan("failed", false)]),
+    ).toBe(false);
+  });
+
+  it("is false for an empty list", () => {
+    expect(isScanInFlight([])).toBe(false);
+  });
+});
+
+describe("getGraphBuildingProgress", () => {
+  it("returns the max progress among executing scans", () => {
+    expect(
+      getGraphBuildingProgress([
+        scan("executing", false, 30),
+        scan("executing", false, 70),
+        scan("scheduled", false, 99),
+      ]),
+    ).toBe(70);
+  });
+
+  it("returns 0 when no scan is executing", () => {
+    expect(getGraphBuildingProgress([scan("scheduled", false, 50)])).toBe(0);
+  });
+});
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.ts
new file mode 100644
index 0000000000..0e734304f8
--- /dev/null
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/_lib/get-attack-paths-view-state.ts
@@ -0,0 +1,65 @@
+import type { AttackPathScan, ScanState } from "@/types/attack-paths";
+import { SCAN_STATES } from "@/types/attack-paths";
+
+// In-flight = scan still progressing toward a graph. AVAILABLE is the default
+// state of a new scan. Shared by the deriver and polling so they can't diverge.
+const IN_FLIGHT_SCAN_STATES: ScanState[] = [
+  SCAN_STATES.AVAILABLE,
+  SCAN_STATES.SCHEDULED,
+  SCAN_STATES.EXECUTING,
+];
+
+export const isScanInFlight = (scans: AttackPathScan[]): boolean =>
+  scans.some((s) => IN_FLIGHT_SCAN_STATES.includes(s.attributes.state));
+
+export const ATTACK_PATHS_VIEW_STATES = {
+  LOADING: "loading",
+  ERROR: "error",
+  NO_SCANS: "no-scans",
+  SCAN_PENDING: "scan-pending",
+  GRAPH_BUILDING: "graph-building",
+  NO_GRAPH_DATA: "no-graph-data",
+  READY: "ready",
+} as const;
+
+export type AttackPathsViewState =
+  (typeof ATTACK_PATHS_VIEW_STATES)[keyof typeof ATTACK_PATHS_VIEW_STATES];
+
+interface GetAttackPathsViewStateInput {
+  scansLoading: boolean;
+  loadError: boolean;
+  scans: AttackPathScan[];
+}
+
+/**
+ * Single source of truth for what the Attack Paths page shows. The full-page
+ * message owns every "not queryable yet" state; the workflow renders only once
+ * at least one provider's graph is ready.
+ */
+export const getAttackPathsViewState = ({
+  scansLoading,
+  loadError,
+  scans,
+}: GetAttackPathsViewStateInput): AttackPathsViewState => {
+  if (scansLoading) return ATTACK_PATHS_VIEW_STATES.LOADING;
+  if (loadError) return ATTACK_PATHS_VIEW_STATES.ERROR;
+  if (scans.length === 0) return ATTACK_PATHS_VIEW_STATES.NO_SCANS;
+
+  if (scans.some((s) => s.attributes.graph_data_ready)) {
+    return ATTACK_PATHS_VIEW_STATES.READY;
+  }
+  if (scans.some((s) => s.attributes.state === SCAN_STATES.EXECUTING)) {
+    return ATTACK_PATHS_VIEW_STATES.GRAPH_BUILDING;
+  }
+  // EXECUTING returned above; an in-flight scan here is AVAILABLE/SCHEDULED.
+  if (isScanInFlight(scans)) {
+    return ATTACK_PATHS_VIEW_STATES.SCAN_PENDING;
+  }
+  return ATTACK_PATHS_VIEW_STATES.NO_GRAPH_DATA;
+};
+
+/** Highest progress among scans whose graph is actively building. */
+export const getGraphBuildingProgress = (scans: AttackPathScan[]): number =>
+  scans
+    .filter((s) => s.attributes.state === SCAN_STATES.EXECUTING)
+    .reduce((max, s) => Math.max(max, s.attributes.progress), 0);
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx
index 9e455a4b6d..bc2cf36331 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.browser.test.tsx
@@ -75,6 +75,31 @@ describe("loading the page", () => {
   });
 });
 
+describe("waiting states", () => {
+  test("a pending scan shows the scan-in-progress message", async ({
+    mountWith,
+  }) => {
+    const graph = await mountWith(fixtures.scanPending());
+    expect(await graph.emptyStateMessage()).toMatch(/scan in progress/i);
+  });
+
+  test("a building graph shows the preparing message with progress", async ({
+    mountWith,
+  }) => {
+    const graph = await mountWith(fixtures.graphBuilding());
+    const message = await graph.emptyStateMessage();
+    expect(message).toMatch(/preparing attack paths data/i);
+    expect(message).toMatch(/45%/);
+  });
+
+  test("a completed scan with no graph shows the no-data message", async ({
+    mountWith,
+  }) => {
+    const graph = await mountWith(fixtures.noGraphData());
+    expect(await graph.emptyStateMessage()).toMatch(/no attack paths data/i);
+  });
+});
+
 describe("running a query", () => {
   test("the graph renders with a background, a minimap, and a viewport", async ({
     mountWith,
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts
index 37e2170355..41089af527 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.fixtures.ts
@@ -143,6 +143,52 @@ export const emptyScans = (): PageFixture => ({
   queryResult: null,
 });
 
+export const scanPending = (): PageFixture => ({
+  scans: [
+    buildScan(TYPICAL_SCAN_ID, {
+      state: "scheduled",
+      progress: 0,
+      graph_data_ready: false,
+      completed_at: null,
+      duration: null,
+    }),
+  ],
+  scanId: TYPICAL_SCAN_ID,
+  queries: [],
+  queryId: DEFAULT_QUERY_ID,
+  queryResult: null,
+});
+
+export const graphBuilding = (): PageFixture => ({
+  scans: [
+    buildScan(TYPICAL_SCAN_ID, {
+      state: "executing",
+      progress: 45,
+      graph_data_ready: false,
+      completed_at: null,
+      duration: null,
+    }),
+  ],
+  scanId: TYPICAL_SCAN_ID,
+  queries: [],
+  queryId: DEFAULT_QUERY_ID,
+  queryResult: null,
+});
+
+export const noGraphData = (): PageFixture => ({
+  scans: [
+    buildScan(TYPICAL_SCAN_ID, {
+      state: "completed",
+      progress: 100,
+      graph_data_ready: false,
+    }),
+  ],
+  scanId: TYPICAL_SCAN_ID,
+  queries: [],
+  queryId: DEFAULT_QUERY_ID,
+  queryResult: null,
+});
+
 export const emptyGraph = (): PageFixture => ({
   scans: [buildScan(TYPICAL_SCAN_ID)],
   scanId: TYPICAL_SCAN_ID,
@@ -269,6 +315,9 @@ export const edgeCases = (): PageFixture => {
 export const fixtures = {
   typical,
   emptyScans,
+  scanPending,
+  graphBuilding,
+  noGraphData,
   emptyGraph,
   singleNode,
   findingsOnly,
diff --git a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
index 07f36912e4..6bcf03d082 100644
--- a/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
+++ b/ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.tsx
@@ -1,7 +1,6 @@
 "use client";
 
-import { ArrowLeft, Info, Maximize2 } from "lucide-react";
-import Link from "next/link";
+import { ArrowLeft, Maximize2 } from "lucide-react";
 import { usePathname, useRouter, useSearchParams } from "next/navigation";
 import { Suspense, useEffect, useRef, useState } from "react";
 import { FormProvider } from "react-hook-form";
@@ -17,12 +16,7 @@ import { FindingDetailDrawer } from "@/components/findings/table";
 import { PageReady } from "@/components/onboarding";
 import { useFindingDetails } from "@/components/resources/table/use-finding-details";
 import { AutoRefresh } from "@/components/scans";
-import {
-  Alert,
-  AlertDescription,
-  AlertTitle,
-  Button,
-} from "@/components/shadcn";
+import { Button } from "@/components/shadcn";
 import {
   Dialog,
   DialogContent,
@@ -31,6 +25,7 @@ import {
   DialogTitle,
   DialogTrigger,
 } from "@/components/shadcn/dialog";
+import { StatusAlert } from "@/components/shared/status-alert";
 import { useToast } from "@/components/ui";
 import { useMountEffect } from "@/hooks/use-mount-effect";
 import { isCloud } from "@/lib/shared/env";
@@ -61,11 +56,21 @@ import {
   QuerySelector,
   ScanListTable,
 } from "./_components";
+import { AttackPathsStatusPanel } from "./_components/attack-paths-status-panel";
 import type { GraphHandle } from "./_components/graph/attack-path-graph";
 import { useAttackPathScans } from "./_hooks/use-attack-path-scans";
 import { useGraphState } from "./_hooks/use-graph-state";
 import { useQueryBuilder } from "./_hooks/use-query-builder";
 import { exportGraphAsPNG } from "./_lib";
+import {
+  ATTACK_PATHS_VIEW_STATES,
+  getAttackPathsViewState,
+  getGraphBuildingProgress,
+  isScanInFlight,
+} from "./_lib/get-attack-paths-view-state";
+
+const SCROLL_CONTAINER_CLASS =
+  "minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4";
 
 export default function AttackPathsPage() {
   const searchParams = useSearchParams();
@@ -80,11 +85,12 @@ export default function AttackPathsPage() {
   const finding = useFindingDetails();
   const { toast } = useToast();
 
-  const { scans, scansLoading, refreshScans } = useAttackPathScans({
-    onNoReadyScan: isAttackPathsReplay
-      ? () => router.push("/scans?onboarding=view-first-scan")
-      : undefined,
-  });
+  const { scans, scansLoading, loadError, refreshScans, retryLoadScans } =
+    useAttackPathScans({
+      onNoReadyScan: isAttackPathsReplay
+        ? () => router.push("/scans?onboarding=view-first-scan")
+        : undefined,
+    });
 
   const [queriesLoading, setQueriesLoading] = useState(true);
   const [queriesError, setQueriesError] = useState<string | null>(null);
@@ -103,7 +109,9 @@ export default function AttackPathsPage() {
   const hasNoScans = scans.length === 0;
 
   useDriverTour(attackPathsEmptyTour, {
-    enabled: onboardingEnabled && !scansLoading && hasNoScans,
+    // Gate on !loadError: the empty-scans CTA anchor only renders in the
+    // NO_SCANS view-state, not in the ERROR state (which also has scans === []).
+    enabled: onboardingEnabled && !scansLoading && !loadError && hasNoScans,
   });
 
   const { start: startAttackPathsTour } = useDriverTour<AttackPathsTourTarget>(
@@ -164,12 +172,12 @@ export default function AttackPathsPage() {
     graphState.resetGraph();
   }, [scanId]); // eslint-disable-line react-hooks/exhaustive-deps -- reset on scanId change only
 
-  const hasExecutingScan = scans.some(
-    (scan) =>
-      scan.attributes.state === SCAN_STATES.EXECUTING ||
-      scan.attributes.state === SCAN_STATES.SCHEDULED,
-  );
+  // Poll while a scan is in flight so the page auto-advances when the graph is ready.
+  const hasScanInFlight = isScanInFlight(scans);
 
+  const viewState = getAttackPathsViewState({ scansLoading, loadError, scans });
+
+  // Detect if the selected scan is showing data from a previous cycle
   const selectedScan = scans.find((scan) => scan.id === scanId);
   const isViewingPreviousCycleData =
     selectedScan &&
@@ -396,7 +404,7 @@ export default function AttackPathsPage() {
   return (
     <div className="flex flex-col gap-6">
       <AutoRefresh
-        hasExecutingScan={hasExecutingScan}
+        hasExecutingScan={hasScanInFlight}
         onRefresh={refreshScans}
       />
 
@@ -418,25 +426,23 @@ export default function AttackPathsPage() {
         </p>
       </div>
 
-      {scansLoading ? (
-        <div className="minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4">
+      {viewState === ATTACK_PATHS_VIEW_STATES.LOADING ? (
+        <div className={SCROLL_CONTAINER_CLASS}>
           <p className="text-sm">Loading scans...</p>
         </div>
-      ) : hasNoScans ? (
+      ) : viewState === ATTACK_PATHS_VIEW_STATES.NO_SCANS ? (
+        // Keep the empty-scans tour anchor: attackPathsEmptyTour targets
+        // data-tour-id="attack-paths-empty-scans-cta". The panel's NO_SCANS
+        // render is the same "No scans available" + Go to Scan Jobs CTA.
         <div data-tour-id="attack-paths-empty-scans-cta">
-          <Alert variant="info">
-            <Info className="size-4" />
-            <AlertTitle>No scans available</AlertTitle>
-            <AlertDescription>
-              <span>
-                You need to run a scan before you can analyze attack paths.{" "}
-                <Link href="/scans" className="font-medium underline">
-                  Go to Scan Jobs
-                </Link>
-              </span>
-            </AlertDescription>
-          </Alert>
+          <AttackPathsStatusPanel state={viewState} />
         </div>
+      ) : viewState !== ATTACK_PATHS_VIEW_STATES.READY ? (
+        <AttackPathsStatusPanel
+          state={viewState}
+          progress={getGraphBuildingProgress(scans)}
+          onRetry={retryLoadScans}
+        />
       ) : (
         <>
           <Suspense fallback={<div>Loading scans...</div>}>
@@ -444,21 +450,20 @@ export default function AttackPathsPage() {
           </Suspense>
 
           {isViewingPreviousCycleData && (
-            <Alert variant="info">
-              <Info className="size-4" />
-              <AlertTitle>Viewing data from a previous scan</AlertTitle>
-              <AlertDescription>
-                This scan is currently{" "}
-                {selectedScan.attributes.state === SCAN_STATES.EXECUTING
-                  ? `running (${selectedScan.attributes.progress}%)`
-                  : selectedScan.attributes.state}
-                . The graph data shown is from the last completed cycle.
-              </AlertDescription>
-            </Alert>
+            <StatusAlert
+              variant="info"
+              title="Viewing data from a previous scan"
+            >
+              This scan is currently{" "}
+              {selectedScan.attributes.state === SCAN_STATES.EXECUTING
+                ? `running (${selectedScan.attributes.progress}%)`
+                : selectedScan.attributes.state}
+              . The graph data shown is from the last completed cycle.
+            </StatusAlert>
           )}
 
           {scanId && (
-            <div className="minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4">
+            <div className={SCROLL_CONTAINER_CLASS}>
               {queriesLoading ? (
                 <p className="text-sm">Loading queries...</p>
               ) : queriesError ? (
@@ -516,7 +521,7 @@ export default function AttackPathsPage() {
             (graphState.data &&
               graphState.data.nodes &&
               graphState.data.nodes.length > 0)) && (
-            <div className="minimal-scrollbar rounded-large shadow-small border-border-neutral-secondary bg-bg-neutral-secondary relative z-0 flex w-full flex-col gap-4 overflow-auto border p-4">
+            <div className={SCROLL_CONTAINER_CLASS}>
               {graphState.loading ? (
                 <GraphLoading />
               ) : graphState.data &&
diff --git a/ui/components/shared/status-alert.test.tsx b/ui/components/shared/status-alert.test.tsx
new file mode 100644
index 0000000000..c99500e57e
--- /dev/null
+++ b/ui/components/shared/status-alert.test.tsx
@@ -0,0 +1,45 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { StatusAlert } from "./status-alert";
+
+describe("StatusAlert", () => {
+  it("renders the info variant with title and children", () => {
+    render(
+      <StatusAlert variant="info" title="Heads up">
+        <span>Something to know.</span>
+      </StatusAlert>,
+    );
+
+    expect(screen.getByText("Heads up")).toBeInTheDocument();
+    expect(screen.getByText("Something to know.")).toBeInTheDocument();
+  });
+
+  it("renders the error variant with title and children", () => {
+    render(
+      <StatusAlert variant="error" title="It broke">
+        <span>Try again.</span>
+      </StatusAlert>,
+    );
+
+    expect(screen.getByText("It broke")).toBeInTheDocument();
+    expect(screen.getByText("Try again.")).toBeInTheDocument();
+  });
+
+  it("applies descriptionClassName to the description element", () => {
+    render(
+      <StatusAlert
+        variant="info"
+        title="Styled"
+        descriptionClassName="w-full gap-3"
+      >
+        <span>Body</span>
+      </StatusAlert>,
+    );
+
+    const description = screen
+      .getByText("Body")
+      .closest("[data-slot='alert-description']");
+    expect(description).toHaveClass("w-full", "gap-3");
+  });
+});
diff --git a/ui/components/shared/status-alert.tsx b/ui/components/shared/status-alert.tsx
new file mode 100644
index 0000000000..286e7e6b9a
--- /dev/null
+++ b/ui/components/shared/status-alert.tsx
@@ -0,0 +1,41 @@
+import { CircleAlert, Info } from "lucide-react";
+import type { ReactNode } from "react";
+
+import { Alert, AlertDescription, AlertTitle } from "@/components/shadcn/alert";
+
+const STATUS_ALERT_ICONS = {
+  info: Info,
+  error: CircleAlert,
+} as const;
+
+type StatusAlertVariant = keyof typeof STATUS_ALERT_ICONS;
+
+interface StatusAlertProps {
+  variant: StatusAlertVariant;
+  title: string;
+  descriptionClassName?: string;
+  children: ReactNode;
+}
+
+/**
+ * Shared status banner: a shadcn `Alert` with a variant-driven icon, title, and
+ * description. Use for full-width info/error messages (waiting states, load
+ * failures, inline notices).
+ */
+export const StatusAlert = ({
+  variant,
+  title,
+  descriptionClassName,
+  children,
+}: StatusAlertProps) => {
+  const Icon = STATUS_ALERT_ICONS[variant];
+  return (
+    <Alert variant={variant}>
+      <Icon className="size-4" />
+      <AlertTitle>{title}</AlertTitle>
+      <AlertDescription className={descriptionClassName}>
+        {children}
+      </AlertDescription>
+    </Alert>
+  );
+};

From ddbf3405a03316be862540c97a8721a389de3aee Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Thu, 18 Jun 2026 17:05:02 +0900
Subject: [PATCH 083/126] feat(azure): add defender_ensure_defender_cspm_is_on
 check (#11037)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 prowler/compliance/azure/cis_5.0_azure.json   |   4 +-
 .../compliance/azure/iso27001_2022_azure.json |   1 +
 .../__init__.py                               |   0
 ...r_ensure_defender_cspm_is_on.metadata.json |  37 ++++++
 .../defender_ensure_defender_cspm_is_on.py    |  35 ++++++
 ...efender_ensure_defender_cspm_is_on_test.py | 117 ++++++++++++++++++
 7 files changed, 194 insertions(+), 1 deletion(-)
 create mode 100644 prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/__init__.py
 create mode 100644 prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.metadata.json
 create mode 100644 prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.py
 create mode 100644 tests/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 7ba3afbe3d..db0987dea6 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -19,6 +19,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `cosmosdb_account_public_network_access_disabled` check for Azure provider, verifying Cosmos DB accounts have public network access disabled so connectivity is restricted to private endpoints or VNet service endpoints [(#11034)](https://github.com/prowler-cloud/prowler/pull/11034)
 - `databricks_workspace_public_network_access_disabled` check for Azure provider, verifying Databricks workspaces have public network access disabled so connectivity is restricted to Azure Private Link private endpoints [(#11035)](https://github.com/prowler-cloud/prowler/pull/11035)
 - `databricks_workspace_no_public_ip_enabled` check for Azure provider, verifying Databricks workspaces use secure cluster connectivity (no public IP) so compute nodes are not assigned public IP addresses [(#11036)](https://github.com/prowler-cloud/prowler/pull/11036)
+- `defender_ensure_defender_cspm_is_on` check for Azure provider, verifying Microsoft Defender Cloud Security Posture Management (CSPM) is enabled on the Standard tier [(#11037)](https://github.com/prowler-cloud/prowler/pull/11037)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/cis_5.0_azure.json b/prowler/compliance/azure/cis_5.0_azure.json
index 21785d92b6..086320fecd 100644
--- a/prowler/compliance/azure/cis_5.0_azure.json
+++ b/prowler/compliance/azure/cis_5.0_azure.json
@@ -2094,7 +2094,9 @@
     {
       "Id": "8.1.1.1",
       "Description": "Ensure Microsoft Defender CSPM is set to 'On'",
-      "Checks": [],
+      "Checks": [
+        "defender_ensure_defender_cspm_is_on"
+      ],
       "Attributes": [
         {
           "Section": "8 Security Services",
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 4172a9449a..719f358de5 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1340,6 +1340,7 @@
         }
       ],
       "Checks": [
+        "defender_ensure_defender_cspm_is_on",
         "monitor_alert_create_policy_assignment",
         "monitor_alert_create_update_nsg",
         "monitor_alert_create_update_public_ip_address_rule",
diff --git a/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/__init__.py b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.metadata.json b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.metadata.json
new file mode 100644
index 0000000000..cae92490af
--- /dev/null
+++ b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "defender_ensure_defender_cspm_is_on",
+  "CheckTitle": "Microsoft Defender CSPM is set to On",
+  "CheckType": [],
+  "ServiceName": "defender",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.security/pricings",
+  "ResourceGroup": "security",
+  "Description": "**Microsoft Defender for Cloud** Cloud Security Posture Management (CSPM) plan is evaluated for **standard tier** activation. Defender CSPM provides advanced posture management capabilities including attack path analysis, cloud security explorer, agentless scanning, and governance rules.",
+  "Risk": "Without Defender CSPM, the subscription relies on **foundational CSPM** (free tier) which lacks attack path analysis, agentless vulnerability scanning, and security governance. Advanced threats exploiting misconfiguration chains go undetected.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-cloud-security-posture-management",
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-enhanced-security"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az security pricing create -n CloudPosture --tier Standard",
+      "NativeIaC": "```bicep\ntargetScope = 'subscription'\n\nresource defenderCSPM 'Microsoft.Security/pricings@2024-01-01' = {\n  name: 'CloudPosture'\n  properties: {\n    pricingTier: 'Standard' // Critical: enables Defender CSPM\n  }\n}\n```",
+      "Other": "1. Sign in to Azure portal\n2. Go to Microsoft Defender for Cloud\n3. Select Environment Settings\n4. Click on the subscription\n5. Set Cloud Security Posture Management (CSPM) to On\n6. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_security_center_subscription_pricing\" \"<example_resource_name>\" {\n  tier          = \"Standard\"  # Critical: enables Defender CSPM\n  resource_type = \"CloudPosture\"\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **Defender CSPM** standard tier for advanced cloud security posture management. Evaluate the cost against the security benefits \u2014 CSPM provides attack path analysis and agentless scanning.",
+      "Url": "https://hub.prowler.com/check/defender_ensure_defender_cspm_is_on"
+    }
+  },
+  "Categories": [
+    "threat-detection"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.py b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.py
new file mode 100644
index 0000000000..cf7957400c
--- /dev/null
+++ b/prowler/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on.py
@@ -0,0 +1,35 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.defender.defender_client import defender_client
+
+
+class defender_ensure_defender_cspm_is_on(Check):
+    """
+    Ensure Microsoft Defender Cloud Security Posture Management (CSPM) is set to On.
+
+    This check evaluates whether the Defender CSPM plan (CloudPosture pricing) is enabled with the Standard tier for each subscription.
+
+    - PASS: The CloudPosture pricing tier is "Standard" (Defender CSPM is on).
+    - FAIL: The CloudPosture pricing tier is not "Standard" (Defender CSPM is off).
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for subscription, pricings in defender_client.pricings.items():
+            subscription_name = defender_client.subscriptions.get(
+                subscription, subscription
+            )
+            if "CloudPosture" in pricings:
+                report = Check_Report_Azure(
+                    metadata=self.metadata(),
+                    resource=pricings["CloudPosture"],
+                )
+                report.subscription = subscription
+                report.resource_name = "Defender plan CSPM"
+                report.status = "PASS"
+                report.status_extended = f"Defender plan CSPM from subscription {subscription_name} ({subscription}) is set to ON (pricing tier standard)."
+                if pricings["CloudPosture"].pricing_tier != "Standard":
+                    report.status = "FAIL"
+                    report.status_extended = f"Defender plan CSPM from subscription {subscription_name} ({subscription}) is set to OFF (pricing tier not standard)."
+
+                findings.append(report)
+        return findings
diff --git a/tests/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on_test.py b/tests/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on_test.py
new file mode 100644
index 0000000000..b81d10d31d
--- /dev/null
+++ b/tests/providers/azure/services/defender/defender_ensure_defender_cspm_is_on/defender_ensure_defender_cspm_is_on_test.py
@@ -0,0 +1,117 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.defender.defender_service import Pricing
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_defender_ensure_defender_cspm_is_on:
+    def test_defender_no_cspm(self):
+        defender_client = mock.MagicMock
+        defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        defender_client.pricings = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on import (
+                defender_ensure_defender_cspm_is_on,
+            )
+
+            check = defender_ensure_defender_cspm_is_on()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_defender_cspm_pricing_tier_not_standard(self):
+        resource_id = str(uuid4())
+        defender_client = mock.MagicMock
+        defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        defender_client.pricings = {
+            AZURE_SUBSCRIPTION_ID: {
+                "CloudPosture": Pricing(
+                    resource_id=resource_id,
+                    resource_name="Defender plan CSPM",
+                    pricing_tier="Free",
+                    free_trial_remaining_time=0,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on import (
+                defender_ensure_defender_cspm_is_on,
+            )
+
+            check = defender_ensure_defender_cspm_is_on()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Defender plan CSPM from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to OFF (pricing tier not standard)."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == "Defender plan CSPM"
+            assert result[0].resource_id == resource_id
+
+    def test_defender_cspm_pricing_tier_standard(self):
+        resource_id = str(uuid4())
+        defender_client = mock.MagicMock
+        defender_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        defender_client.pricings = {
+            AZURE_SUBSCRIPTION_ID: {
+                "CloudPosture": Pricing(
+                    resource_id=resource_id,
+                    resource_name="Defender plan CSPM",
+                    pricing_tier="Standard",
+                    free_trial_remaining_time=0,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on.defender_client",
+                new=defender_client,
+            ),
+        ):
+            from prowler.providers.azure.services.defender.defender_ensure_defender_cspm_is_on.defender_ensure_defender_cspm_is_on import (
+                defender_ensure_defender_cspm_is_on,
+            )
+
+            check = defender_ensure_defender_cspm_is_on()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Defender plan CSPM from subscription {AZURE_SUBSCRIPTION_DISPLAY} is set to ON (pricing tier standard)."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == "Defender plan CSPM"
+            assert result[0].resource_id == resource_id

From aee3b392a7caf5347c2c4eb4f79dd3c989d1eb9a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Thu, 18 Jun 2026 10:30:27 +0200
Subject: [PATCH 084/126] fix(compliance): multi-section undercount & leaked
 provider tab (#11567)

---
 prowler/CHANGELOG.md                          |   8 +
 .../asd_essential_eight.py                    |  27 +-
 prowler/lib/outputs/compliance/c5/c5.py       |  26 +-
 prowler/lib/outputs/compliance/ccc/ccc.py     |  26 +-
 prowler/lib/outputs/compliance/cis/cis.py     |  28 +-
 prowler/lib/outputs/compliance/ens/ens.py     |  21 +-
 .../compliance/kisa_ismsp/kisa_ismsp.py       |  27 +-
 .../compliance/mitre_attack/mitre_attack.py   |  31 +-
 .../okta_idaas_stig/okta_idaas_stig.py        |  26 +-
 .../prowler_threatscore.py                    |  45 ++-
 .../compliance/universal/universal_table.py   |  56 ++-
 .../asd_essential_eight_table_test.py         | 132 +++++++
 tests/lib/outputs/compliance/c5/__init__.py   |   0
 .../outputs/compliance/c5/c5_table_test.py    | 130 +++++++
 .../outputs/compliance/ccc/ccc_table_test.py  | 130 +++++++
 .../outputs/compliance/cis/cis_table_test.py  | 162 +++++++++
 .../outputs/compliance/ens/ens_table_test.py  | 235 +++++++++++++
 .../outputs/compliance/kisa_ismsp/__init__.py |   0
 .../kisa_ismsp/kisa_ismsp_table_test.py       | 137 ++++++++
 .../compliance/mitre_attack/__init__.py       |   0
 .../mitre_attack/mitre_attack_table_test.py   | 140 ++++++++
 .../compliance/okta_idaas_stig/__init__.py    |   0
 .../okta_idaas_stig_table_test.py             | 136 ++++++++
 .../prowler_threatscore/__init__.py           |   0
 .../prowler_threatscore_table_test.py         | 147 ++++++++
 .../universal/universal_table_test.py         | 321 +++++++++++++++++-
 26 files changed, 1904 insertions(+), 87 deletions(-)
 create mode 100644 tests/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_table_test.py
 create mode 100644 tests/lib/outputs/compliance/c5/__init__.py
 create mode 100644 tests/lib/outputs/compliance/c5/c5_table_test.py
 create mode 100644 tests/lib/outputs/compliance/ccc/ccc_table_test.py
 create mode 100644 tests/lib/outputs/compliance/cis/cis_table_test.py
 create mode 100644 tests/lib/outputs/compliance/ens/ens_table_test.py
 create mode 100644 tests/lib/outputs/compliance/kisa_ismsp/__init__.py
 create mode 100644 tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_table_test.py
 create mode 100644 tests/lib/outputs/compliance/mitre_attack/__init__.py
 create mode 100644 tests/lib/outputs/compliance/mitre_attack/mitre_attack_table_test.py
 create mode 100644 tests/lib/outputs/compliance/okta_idaas_stig/__init__.py
 create mode 100644 tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py
 create mode 100644 tests/lib/outputs/compliance/prowler_threatscore/__init__.py
 create mode 100644 tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_table_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index db0987dea6..08d892155c 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -42,6 +42,14 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ---
 
+## [5.30.3] (Prowler UNRELEASED)
+
+### 🐞 Fixed
+
+- CLI compliance summary tables no longer undercount findings mapped to multiple sections nor double-count a single finding mapped to several requirements within the same group/split, and the Provider column no longer leaks a value from another framework [(#11567)](https://github.com/prowler-cloud/prowler/pull/11567)
+
+---
+
 ## [5.30.2] (Prowler v5.30.2)
 
 ### 🐞 Fixed
diff --git a/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py b/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py
index 75481fb6aa..df23aeb1d1 100644
--- a/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py
+++ b/prowler/lib/outputs/compliance/asd_essential_eight/asd_essential_eight.py
@@ -22,11 +22,14 @@ def get_asd_essential_eight_table(
     pass_count = []
     fail_count = []
     muted_count = []
+    section_seen = {}
+    provider = ""
     for index, finding in enumerate(findings):
         check = bulk_checks_metadata[finding.check_metadata.CheckID]
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "ASD-Essential-Eight":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
@@ -36,21 +39,33 @@ def get_asd_essential_eight_table(
                                 "PASS": 0,
                                 "Muted": 0,
                             }
+                            section_seen[section] = set()
+
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["PASS"] += 1
 
     sections = dict(sorted(sections.items()))
     for section in sections:
-        asd_essential_eight_compliance_table["Provider"].append(compliance.Provider)
+        asd_essential_eight_compliance_table["Provider"].append(provider)
         asd_essential_eight_compliance_table["Section"].append(section)
         if sections[section]["FAIL"] > 0:
             asd_essential_eight_compliance_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/c5/c5.py b/prowler/lib/outputs/compliance/c5/c5.py
index 32eb7e0f5a..b48260b5a2 100644
--- a/prowler/lib/outputs/compliance/c5/c5.py
+++ b/prowler/lib/outputs/compliance/c5/c5.py
@@ -22,33 +22,47 @@ def get_c5_table(
     fail_count = []
     muted_count = []
     sections = {}
+    section_seen = {}
+    provider = ""
     for index, finding in enumerate(findings):
         check = bulk_checks_metadata[finding.check_metadata.CheckID]
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "C5":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
 
                         if section not in sections:
                             sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            section_seen[section] = set()
 
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["PASS"] += 1
 
     sections = dict(sorted(sections.items()))
     for section in sections:
-        section_table["Provider"].append(compliance.Provider)
+        section_table["Provider"].append(provider)
         section_table["Section"].append(section)
         if sections[section]["FAIL"] > 0:
             section_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/ccc/ccc.py b/prowler/lib/outputs/compliance/ccc/ccc.py
index 99a6c91cd9..d8d76ad2d9 100644
--- a/prowler/lib/outputs/compliance/ccc/ccc.py
+++ b/prowler/lib/outputs/compliance/ccc/ccc.py
@@ -22,33 +22,47 @@ def get_ccc_table(
     fail_count = []
     muted_count = []
     sections = {}
+    section_seen = {}
+    provider = ""
     for index, finding in enumerate(findings):
         check = bulk_checks_metadata[finding.check_metadata.CheckID]
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "CCC":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
 
                         if section not in sections:
                             sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            section_seen[section] = set()
 
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["PASS"] += 1
 
     sections = dict(sorted(sections.items()))
     for section in sections:
-        section_table["Provider"].append(compliance.Provider)
+        section_table["Provider"].append(provider)
         section_table["Section"].append(section)
         if sections[section]["FAIL"] > 0:
             section_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/cis/cis.py b/prowler/lib/outputs/compliance/cis/cis.py
index 7f161f34c2..4acbd7fe58 100644
--- a/prowler/lib/outputs/compliance/cis/cis.py
+++ b/prowler/lib/outputs/compliance/cis/cis.py
@@ -13,6 +13,9 @@ def get_cis_table(
     compliance_overview: bool,
 ):
     sections = {}
+    section_muted_seen = {}
+    section_split_seen = {}
+    provider = ""
     cis_compliance_table = {
         "Provider": [],
         "Section": [],
@@ -29,6 +32,7 @@ def get_cis_table(
         for compliance in check_compliances:
             version_in_name = compliance_framework.split("_")[1]
             if compliance.Framework == "CIS" and version_in_name in compliance.Version:
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
@@ -40,9 +44,19 @@ def get_cis_table(
                                 "Level 2": {"FAIL": 0, "PASS": 0},
                                 "Muted": 0,
                             }
+                            section_muted_seen[section] = set()
+                            section_split_seen[section] = {
+                                "Level 1": set(),
+                                "Level 2": set(),
+                            }
                         if finding.muted:
+                            # Overview total: count each finding once per framework
                             if index not in muted_count:
                                 muted_count.append(index)
+                            # Per-section Muted: count each finding once per section
+                            # it belongs to (a finding can map to several sections).
+                            if index not in section_muted_seen[section]:
+                                section_muted_seen[section].add(index)
                                 sections[section]["Muted"] += 1
                         else:
                             if finding.status == "FAIL" and index not in fail_count:
@@ -50,13 +64,21 @@ def get_cis_table(
                             elif finding.status == "PASS" and index not in pass_count:
                                 pass_count.append(index)
                         if "Level 1" in attribute.Profile:
-                            if not finding.muted:
+                            if (
+                                not finding.muted
+                                and index not in section_split_seen[section]["Level 1"]
+                            ):
+                                section_split_seen[section]["Level 1"].add(index)
                                 if finding.status == "FAIL":
                                     sections[section]["Level 1"]["FAIL"] += 1
                                 else:
                                     sections[section]["Level 1"]["PASS"] += 1
                         elif "Level 2" in attribute.Profile:
-                            if not finding.muted:
+                            if (
+                                not finding.muted
+                                and index not in section_split_seen[section]["Level 2"]
+                            ):
+                                section_split_seen[section]["Level 2"].add(index)
                                 if finding.status == "FAIL":
                                     sections[section]["Level 2"]["FAIL"] += 1
                                 else:
@@ -65,7 +87,7 @@ def get_cis_table(
     # Add results to table
     sections = dict(sorted(sections.items()))
     for section in sections:
-        cis_compliance_table["Provider"].append(compliance.Provider)
+        cis_compliance_table["Provider"].append(provider)
         cis_compliance_table["Section"].append(section)
         if sections[section]["Level 1"]["FAIL"] > 0:
             cis_compliance_table["Level 1"].append(
diff --git a/prowler/lib/outputs/compliance/ens/ens.py b/prowler/lib/outputs/compliance/ens/ens.py
index a414a0206d..c39abe0a6a 100644
--- a/prowler/lib/outputs/compliance/ens/ens.py
+++ b/prowler/lib/outputs/compliance/ens/ens.py
@@ -13,6 +13,8 @@ def get_ens_table(
     compliance_overview: bool,
 ):
     marcos = {}
+    marco_muted_seen = {}
+    provider = ""
     ens_compliance_table = {
         "Proveedor": [],
         "Marco/Categoria": [],
@@ -31,6 +33,7 @@ def get_ens_table(
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "ENS":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         marco_categoria = f"{attribute.Marco}/{attribute.Categoria}"
@@ -44,17 +47,23 @@ def get_ens_table(
                                 "Bajo": 0,
                                 "Muted": 0,
                             }
+                            marco_muted_seen[marco_categoria] = set()
                         if finding.muted:
+                            # Overview total: count each finding once per framework
                             if index not in muted_count:
                                 muted_count.append(index)
+                            # Per-marco Muted: count each finding once per marco
+                            # it belongs to (a finding can map to several marcos).
+                            if index not in marco_muted_seen[marco_categoria]:
+                                marco_muted_seen[marco_categoria].add(index)
                                 marcos[marco_categoria]["Muted"] += 1
                         else:
                             if finding.status == "FAIL":
-                                if (
-                                    attribute.Tipo != "recomendacion"
-                                    and index not in fail_count
-                                ):
-                                    fail_count.append(index)
+                                if attribute.Tipo != "recomendacion":
+                                    if index not in fail_count:
+                                        fail_count.append(index)
+                                    # Mark every marco the finding belongs to as
+                                    # NO CUMPLE, not just the first one seen.
                                     marcos[marco_categoria][
                                         "Estado"
                                     ] = f"{Fore.RED}NO CUMPLE{Style.RESET_ALL}"
@@ -71,7 +80,7 @@ def get_ens_table(
 
     # Add results to table
     for marco in sorted(marcos):
-        ens_compliance_table["Proveedor"].append(compliance.Provider)
+        ens_compliance_table["Proveedor"].append(provider)
         ens_compliance_table["Marco/Categoria"].append(marco)
         ens_compliance_table["Estado"].append(marcos[marco]["Estado"])
         ens_compliance_table["Opcional"].append(
diff --git a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py
index 93b925a5ff..e7c00b188d 100644
--- a/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py
+++ b/prowler/lib/outputs/compliance/kisa_ismsp/kisa_ismsp.py
@@ -13,7 +13,9 @@ def get_kisa_ismsp_table(
     compliance_overview: bool,
 ):
     sections = {}
+    section_seen = {}
     sections_status = {}
+    provider = ""
     kisa_ismsp_compliance_table = {
         "Provider": [],
         "Section": [],
@@ -31,6 +33,7 @@ def get_kisa_ismsp_table(
                 compliance.Framework.startswith("KISA")
                 and compliance.Version in compliance_framework
             ):
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
@@ -43,16 +46,28 @@ def get_kisa_ismsp_table(
                                 },
                                 "Muted": 0,
                             }
+                            section_seen[section] = set()
+
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["Status"]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["Status"]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["Status"]["PASS"] += 1
 
     # Add results to table
@@ -70,7 +85,7 @@ def get_kisa_ismsp_table(
             else:
                 sections_status[section] = f"{Fore.GREEN}PASS{Style.RESET_ALL}"
     for section in sections:
-        kisa_ismsp_compliance_table["Provider"].append(compliance.Provider)
+        kisa_ismsp_compliance_table["Provider"].append(provider)
         kisa_ismsp_compliance_table["Section"].append(section)
         kisa_ismsp_compliance_table["Status"].append(sections_status[section])
         kisa_ismsp_compliance_table["Muted"].append(
diff --git a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py
index bab3e4e31a..7492624aff 100644
--- a/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py
+++ b/prowler/lib/outputs/compliance/mitre_attack/mitre_attack.py
@@ -13,6 +13,8 @@ def get_mitre_attack_table(
     compliance_overview: bool,
 ):
     tactics = {}
+    tactic_seen = {}
+    provider = ""
     mitre_compliance_table = {
         "Provider": [],
         "Tactic": [],
@@ -30,27 +32,38 @@ def get_mitre_attack_table(
                 "MITRE-ATTACK" in compliance.Framework
                 and compliance.Version in compliance_framework
             ):
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for tactic in requirement.Tactics:
                         if tactic not in tactics:
                             tactics[tactic] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            tactic_seen[tactic] = set()
+
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
+                                fail_count.append(index)
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
+                                pass_count.append(index)
+
+                        # Per-tactic counts: count each finding once per tactic
+                        # it belongs to (a finding can map to several tactics).
+                        if index not in tactic_seen[tactic]:
+                            tactic_seen[tactic].add(index)
+                            if finding.muted:
                                 tactics[tactic]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL":
-                                if index not in fail_count:
-                                    fail_count.append(index)
-                                    tactics[tactic]["FAIL"] += 1
+                            elif finding.status == "FAIL":
+                                tactics[tactic]["FAIL"] += 1
                             elif finding.status == "PASS":
-                                if index not in pass_count:
-                                    pass_count.append(index)
-                                    tactics[tactic]["PASS"] += 1
+                                tactics[tactic]["PASS"] += 1
     # Add results to table
     tactics = dict(sorted(tactics.items()))
     for tactic in tactics:
-        mitre_compliance_table["Provider"].append(compliance.Provider)
+        mitre_compliance_table["Provider"].append(provider)
         mitre_compliance_table["Tactic"].append(tactic)
         if tactics[tactic]["FAIL"] > 0:
             mitre_compliance_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
index 5c76055a06..1febe02f60 100644
--- a/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
+++ b/prowler/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig.py
@@ -22,33 +22,47 @@ def get_okta_idaas_stig_table(
     fail_count = []
     muted_count = []
     sections = {}
+    section_seen = {}
+    provider = ""
     for index, finding in enumerate(findings):
         check = bulk_checks_metadata[finding.check_metadata.CheckID]
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "Okta-IDaaS-STIG":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         section = attribute.Section
 
                         if section not in sections:
                             sections[section] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            section_seen[section] = set()
 
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                sections[section]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                sections[section]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-section counts: count each finding once per section
+                        # it belongs to (a finding can map to several sections).
+                        if index not in section_seen[section]:
+                            section_seen[section].add(index)
+                            if finding.muted:
+                                sections[section]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                sections[section]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 sections[section]["PASS"] += 1
 
     sections = dict(sorted(sections.items()))
     for section in sections:
-        section_table["Provider"].append(compliance.Provider)
+        section_table["Provider"].append(provider)
         section_table["Section"].append(section)
         if sections[section]["FAIL"] > 0:
             section_table["Status"].append(
diff --git a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py
index cfcd4a006e..b17307f04a 100644
--- a/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py
+++ b/prowler/lib/outputs/compliance/prowler_threatscore/prowler_threatscore.py
@@ -24,6 +24,8 @@ def get_prowler_threatscore_table(
     fail_count = []
     muted_count = []
     pillars = {}
+    pillar_seen = {}
+    provider = ""
     generic_score = 0
     max_generic_score = 0
     counted_findings_generic = []
@@ -35,6 +37,7 @@ def get_prowler_threatscore_table(
         check_compliances = check.Compliance
         for compliance in check_compliances:
             if compliance.Framework == "ProwlerThreatScore":
+                provider = compliance.Provider
                 for requirement in compliance.Requirements:
                     for attribute in requirement.Attributes:
                         pillar = attribute.Section
@@ -65,17 +68,28 @@ def get_prowler_threatscore_table(
 
                         if pillar not in pillars:
                             pillars[pillar] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                            pillar_seen[pillar] = set()
 
+                        # Overview totals: count each finding once per framework
                         if finding.muted:
                             if index not in muted_count:
                                 muted_count.append(index)
-                                pillars[pillar]["Muted"] += 1
-                        else:
-                            if finding.status == "FAIL" and index not in fail_count:
+                        elif finding.status == "FAIL":
+                            if index not in fail_count:
                                 fail_count.append(index)
-                                pillars[pillar]["FAIL"] += 1
-                            elif finding.status == "PASS" and index not in pass_count:
+                        elif finding.status == "PASS":
+                            if index not in pass_count:
                                 pass_count.append(index)
+
+                        # Per-pillar counts: count each finding once per pillar
+                        # it belongs to (a finding can map to several pillars).
+                        if index not in pillar_seen[pillar]:
+                            pillar_seen[pillar].add(index)
+                            if finding.muted:
+                                pillars[pillar]["Muted"] += 1
+                            elif finding.status == "FAIL":
+                                pillars[pillar]["FAIL"] += 1
+                            elif finding.status == "PASS":
                                 pillars[pillar]["PASS"] += 1
 
                         # Generic score
@@ -90,18 +104,21 @@ def get_prowler_threatscore_table(
                             counted_findings_generic.append(index)
 
     no_findings_pillars = []
-    bulk_compliance = Compliance.get_bulk(provider=compliance.Provider.lower()).get(
-        compliance_framework
+    bulk_compliance = (
+        Compliance.get_bulk(provider=provider.lower()).get(compliance_framework)
+        if provider
+        else None
     )
-    for requirement in bulk_compliance.Requirements:
-        for attribute in requirement.Attributes:
-            pillar = attribute.Section
-            if pillar not in pillars.keys() and pillar not in no_findings_pillars:
-                no_findings_pillars.append(pillar)
+    if bulk_compliance:
+        for requirement in bulk_compliance.Requirements:
+            for attribute in requirement.Attributes:
+                pillar = attribute.Section
+                if pillar not in pillars.keys() and pillar not in no_findings_pillars:
+                    no_findings_pillars.append(pillar)
 
     pillars = dict(sorted(pillars.items()))
     for pillar in pillars:
-        pillar_table["Provider"].append(compliance.Provider)
+        pillar_table["Provider"].append(provider)
         pillar_table["Pillar"].append(pillar)
         if max_score_per_pillar[pillar] == 0:
             pillar_score = 100.0
@@ -127,7 +144,7 @@ def get_prowler_threatscore_table(
         )
 
     for pillar in no_findings_pillars:
-        pillar_table["Provider"].append(compliance.Provider)
+        pillar_table["Provider"].append(provider)
         pillar_table["Pillar"].append(pillar)
         pillar_table["Score"].append(f"{Style.BRIGHT}{Fore.GREEN}100%{Style.RESET_ALL}")
         pillar_table["Status"].append(f"{Fore.GREEN}PASS{Style.RESET_ALL}")
diff --git a/prowler/lib/outputs/compliance/universal/universal_table.py b/prowler/lib/outputs/compliance/universal/universal_table.py
index e838c5e9cf..e54ad5155c 100644
--- a/prowler/lib/outputs/compliance/universal/universal_table.py
+++ b/prowler/lib/outputs/compliance/universal/universal_table.py
@@ -163,6 +163,7 @@ def _render_grouped(
     """Grouped mode: one row per group with pass/fail counts."""
     check_map = _build_requirement_check_map(framework, provider)
     groups = {}
+    group_seen = {}
     pass_count = []
     fail_count = []
     muted_count = []
@@ -176,17 +177,28 @@ def _render_grouped(
             for group_key in _get_group_key(req, group_by):
                 if group_key not in groups:
                     groups[group_key] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                    group_seen[group_key] = set()
 
+                # Overview totals: count each finding once per framework
                 if finding.muted:
                     if index not in muted_count:
                         muted_count.append(index)
-                        groups[group_key]["Muted"] += 1
-                else:
-                    if finding.status == "FAIL" and index not in fail_count:
+                elif finding.status == "FAIL":
+                    if index not in fail_count:
                         fail_count.append(index)
-                        groups[group_key]["FAIL"] += 1
-                    elif finding.status == "PASS" and index not in pass_count:
+                elif finding.status == "PASS":
+                    if index not in pass_count:
                         pass_count.append(index)
+
+                # Per-group counts: count each finding once per group it belongs
+                # to (a finding can map to several groups via several requirements).
+                if index not in group_seen[group_key]:
+                    group_seen[group_key].add(index)
+                    if finding.muted:
+                        groups[group_key]["Muted"] += 1
+                    elif finding.status == "FAIL":
+                        groups[group_key]["FAIL"] += 1
+                    elif finding.status == "PASS":
                         groups[group_key]["PASS"] += 1
 
     if not _print_overview(
@@ -258,6 +270,8 @@ def _render_split(
     split_field = split_by.field
     split_values = split_by.values
     groups = {}
+    group_muted_seen = {}
+    group_split_seen = {}
     pass_count = []
     fail_count = []
     muted_count = []
@@ -274,12 +288,19 @@ def _render_split(
                         sv: {"FAIL": 0, "PASS": 0} for sv in split_values
                     }
                     groups[group_key]["Muted"] = 0
+                    group_muted_seen[group_key] = set()
+                    group_split_seen[group_key] = {sv: set() for sv in split_values}
 
                 split_val = req.attributes.get(split_field, "")
 
                 if finding.muted:
+                    # Overview total: count each finding once per framework
                     if index not in muted_count:
                         muted_count.append(index)
+                    # Per-group Muted: count each finding once per group it
+                    # belongs to (a finding can map to several groups).
+                    if index not in group_muted_seen[group_key]:
+                        group_muted_seen[group_key].add(index)
                         groups[group_key]["Muted"] += 1
                 else:
                     if finding.status == "FAIL" and index not in fail_count:
@@ -289,7 +310,8 @@ def _render_split(
 
                     for sv in split_values:
                         if sv in str(split_val):
-                            if not finding.muted:
+                            if index not in group_split_seen[group_key][sv]:
+                                group_split_seen[group_key][sv].add(index)
                                 if finding.status == "FAIL":
                                     groups[group_key][sv]["FAIL"] += 1
                                 else:
@@ -364,6 +386,7 @@ def _render_scored(
     risk_field = scoring.risk_field
     weight_field = scoring.weight_field
     groups = {}
+    group_seen = {}
     pass_count = []
     fail_count = []
     muted_count = []
@@ -388,6 +411,7 @@ def _render_scored(
 
                 if group_key not in groups:
                     groups[group_key] = {"FAIL": 0, "PASS": 0, "Muted": 0}
+                    group_seen[group_key] = set()
                     score_per_group[group_key] = 0
                     max_score_per_group[group_key] = 0
                     counted_per_group[group_key] = []
@@ -398,16 +422,26 @@ def _render_scored(
                     max_score_per_group[group_key] += risk * weight
                     counted_per_group[group_key].append(index)
 
+                # Overview totals: count each finding once per framework
                 if finding.muted:
                     if index not in muted_count:
                         muted_count.append(index)
-                        groups[group_key]["Muted"] += 1
-                else:
-                    if finding.status == "FAIL" and index not in fail_count:
+                elif finding.status == "FAIL":
+                    if index not in fail_count:
                         fail_count.append(index)
-                        groups[group_key]["FAIL"] += 1
-                    elif finding.status == "PASS" and index not in pass_count:
+                elif finding.status == "PASS":
+                    if index not in pass_count:
                         pass_count.append(index)
+
+                # Per-group counts: count each finding once per group it belongs
+                # to (a finding can map to several groups via several requirements).
+                if index not in group_seen[group_key]:
+                    group_seen[group_key].add(index)
+                    if finding.muted:
+                        groups[group_key]["Muted"] += 1
+                    elif finding.status == "FAIL":
+                        groups[group_key]["FAIL"] += 1
+                    elif finding.status == "PASS":
                         groups[group_key]["PASS"] += 1
 
                 if index not in counted_generic and not finding.muted:
diff --git a/tests/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_table_test.py b/tests/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_table_test.py
new file mode 100644
index 0000000000..6382dc1d2c
--- /dev/null
+++ b/tests/lib/outputs/compliance/asd_essential_eight/asd_essential_eight_table_test.py
@@ -0,0 +1,132 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.asd_essential_eight.asd_essential_eight import (
+    get_asd_essential_eight_table,
+)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, sections, framework="ASD-Essential-Eight"):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestASDEssentialEightTable:
+    """Test cases verifying multi-section counting and provider-column attribution for the ASD Essential Eight compliance table."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_asd_essential_eight_table(
+            findings,
+            bulk_metadata,
+            "asd_essential_eight_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging was
+        # undercounted because the per-section count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_asd_essential_eight_table(
+            findings,
+            bulk_metadata,
+            "asd_essential_eight_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched ASD-Essential-Eight
+        compliance, never from a different framework that happens to be the last
+        entry in the check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_asd_essential_eight_table(
+            findings,
+            bulk_metadata,
+            "asd_essential_eight_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/c5/__init__.py b/tests/lib/outputs/compliance/c5/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/c5/c5_table_test.py b/tests/lib/outputs/compliance/c5/c5_table_test.py
new file mode 100644
index 0000000000..c423f5af0b
--- /dev/null
+++ b/tests/lib/outputs/compliance/c5/c5_table_test.py
@@ -0,0 +1,130 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.c5.c5 import get_c5_table
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, sections, framework="C5"):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestC5Table:
+    """Verify multi-section counting and provider-column attribution for the compliance table."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_c5_table(
+            findings,
+            bulk_metadata,
+            "c5_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging was
+        # undercounted because the per-section count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_c5_table(
+            findings,
+            bulk_metadata,
+            "c5_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched C5 compliance, never
+        from a different framework that happens to be the last entry in the
+        check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_c5_table(
+            findings,
+            bulk_metadata,
+            "c5_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/ccc/ccc_table_test.py b/tests/lib/outputs/compliance/ccc/ccc_table_test.py
new file mode 100644
index 0000000000..f647aff3d0
--- /dev/null
+++ b/tests/lib/outputs/compliance/ccc/ccc_table_test.py
@@ -0,0 +1,130 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.ccc.ccc import get_ccc_table
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, sections, framework="CCC"):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestCCCTable:
+    """Test cases verifying multi-section counting and provider-column attribution for the compliance table."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_ccc_table(
+            findings,
+            bulk_metadata,
+            "ccc_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging was
+        # undercounted because the per-section count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_ccc_table(
+            findings,
+            bulk_metadata,
+            "ccc_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched CCC compliance, never
+        from a different framework that happens to be the last entry in the
+        check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_ccc_table(
+            findings,
+            bulk_metadata,
+            "ccc_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/cis/cis_table_test.py b/tests/lib/outputs/compliance/cis/cis_table_test.py
new file mode 100644
index 0000000000..c47e1387a0
--- /dev/null
+++ b/tests/lib/outputs/compliance/cis/cis_table_test.py
@@ -0,0 +1,162 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.cis.cis import get_cis_table
+
+
+def _strip_ansi(text):
+    return re.sub(r"\x1b\[[0-9;]*m", "", text)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _attr(section, profile="Level 1"):
+    return SimpleNamespace(Section=section, Profile=profile)
+
+
+def _make_compliance(provider, attributes, version="1.4", framework="CIS"):
+    """Build a per-check CIS compliance with the given (section, profile) attrs."""
+    return SimpleNamespace(
+        Framework=framework,
+        Version=version,
+        Provider=provider,
+        Requirements=[SimpleNamespace(Attributes=attributes)],
+    )
+
+
+def _make_compliance_multi_req(provider, attributes, version="1.4", framework="CIS"):
+    """Build a per-check CIS compliance where each attr is its own requirement,
+    simulating a check that appears in several requirements."""
+    return SimpleNamespace(
+        Framework=framework,
+        Version=version,
+        Provider=provider,
+        Requirements=[SimpleNamespace(Attributes=[attr]) for attr in attributes],
+    )
+
+
+class TestCISTable:
+    """Verify multi-section counting and provider-column attribution for the CIS compliance table."""
+
+    def test_muted_multi_section_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED finding mapped to several sections must increment the
+        per-section Muted column for every section, not only the first seen.
+
+        CIS counts FAIL/PASS through Level 1/Level 2 buckets, so only the Muted
+        per-section count was affected by the undercount bug.
+        """
+        bulk_metadata = {
+            # check_a is muted and belongs to two sections at once.
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("1 IAM"), _attr("2 Logging")])
+                ]
+            ),
+            # A real (non-muted) finding so the table is rendered.
+            "check_b": SimpleNamespace(
+                Compliance=[_make_compliance("aws", [_attr("1 IAM")])]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_cis_table(
+            findings,
+            bulk_metadata,
+            "cis_1.4_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both section rows must carry a Muted count of 1 in their last cell.
+        # Before the fix only the first section seen got incremented.
+        muted_one_rows = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_one_rows) == 2
+
+    def test_same_section_level_not_double_counted(self, capsys, tmp_path):
+        """A single finding whose check maps to several requirements that share
+        the same section and profile must count once for that section/level,
+        not once per requirement (FAIL(1), never FAIL(2))."""
+        bulk_metadata = {
+            # check_a is a single FAIL mapped to two requirements, both in the
+            # same section "1 IAM" and the same profile "Level 1".
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance_multi_req("aws", [_attr("1 IAM"), _attr("1 IAM")])
+                ]
+            ),
+            # A second finding in another section so the table renders.
+            "check_b": SimpleNamespace(
+                Compliance=[_make_compliance("aws", [_attr("2 Logging")])]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_cis_table(
+            findings,
+            bulk_metadata,
+            "cis_1.4_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # The "1 IAM" row must show FAIL(1) for Level 1, never FAIL(2).
+        assert "FAIL(1)" in plain
+        assert "FAIL(2)" not in plain
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched CIS compliance, not
+        from a different framework that trails it in the compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("1 IAM")]),
+                    _make_compliance(
+                        "gcp", [_attr("Other")], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("1 IAM")]),
+                    _make_compliance(
+                        "gcp", [_attr("Other")], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_cis_table(
+            findings,
+            bulk_metadata,
+            "cis_1.4_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The trailing unrelated framework's provider must not leak in.
+        assert "gcp" not in captured.out
diff --git a/tests/lib/outputs/compliance/ens/ens_table_test.py b/tests/lib/outputs/compliance/ens/ens_table_test.py
new file mode 100644
index 0000000000..2373885dbc
--- /dev/null
+++ b/tests/lib/outputs/compliance/ens/ens_table_test.py
@@ -0,0 +1,235 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.ens.ens import get_ens_table
+
+
+def _strip_ansi(text):
+    return re.sub(r"\x1b\[[0-9;]*m", "", text)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _attr(marco, categoria, tipo="requisito", nivel="alto"):
+    return SimpleNamespace(Marco=marco, Categoria=categoria, Tipo=tipo, Nivel=nivel)
+
+
+def _make_compliance(provider, attributes, framework="ENS"):
+    """Build a per-check ENS compliance with the given marco/categoria attrs."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[SimpleNamespace(Attributes=attributes)],
+    )
+
+
+class TestENSTable:
+    """Test cases for ENS compliance table rendering.
+
+    Verify multi-marco counting and provider-column attribution for the
+    compliance table.
+    """
+
+    def test_no_cumple_marked_in_every_marco(self, capsys, tmp_path):
+        """A single failing finding mapped to several marcos must mark every
+        one of them as NO CUMPLE, not only the first marco seen."""
+        bulk_metadata = {
+            # check_a fails and belongs to two distinct marcos/categorias.
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws",
+                        [
+                            _attr("operacional", "control de acceso"),
+                            _attr("organizativo", "politica de seguridad"),
+                        ],
+                    )
+                ]
+            ),
+            # A passing finding so the overview total reaches 2.
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("operacional", "control de acceso")])
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_ens_table(
+            findings,
+            bulk_metadata,
+            "ens_rd2022_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both marco rows the failing finding maps to must read NO CUMPLE.
+        # Before the fix only the first marco was marked, the second stayed
+        # CUMPLE. Anchor the assertion to the actual marco rows (not the
+        # overview header line which also mentions NO CUMPLE).
+        op_row = [
+            line
+            for line in plain.splitlines()
+            if "operacional/control de acceso" in line
+        ]
+        org_row = [
+            line
+            for line in plain.splitlines()
+            if "organizativo/politica de seguridad" in line
+        ]
+        assert len(op_row) == 1 and "NO CUMPLE" in op_row[0]
+        assert len(org_row) == 1 and "NO CUMPLE" in org_row[0]
+
+    def test_recomendacion_does_not_set_no_cumple(self, capsys, tmp_path):
+        """A FAIL on a 'recomendacion' attribute must not flip a marco to
+        NO CUMPLE (this path is intentionally excluded from the fix)."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws",
+                        [
+                            _attr(
+                                "operacional", "control de acceso", tipo="recomendacion"
+                            )
+                        ],
+                    )
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("organizativo", "politica")])
+                ]
+            ),
+            # A regular (non-recomendacion) check so the results table renders
+            # at least one marco row and the assertion below is not vacuous.
+            "check_c": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("operacional", "continuidad")])
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+            _make_finding("check_c", "PASS"),
+        ]
+
+        get_ens_table(
+            findings,
+            bulk_metadata,
+            "ens_rd2022_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # The recomendacion FAIL must not appear as a NO CUMPLE marco row in the
+        # results table (the overview header line is allowed to mention it).
+        marco_rows = [
+            line
+            for line in plain.splitlines()
+            if "operacional" in line or "organizativo" in line
+        ]
+        # Guard against a vacuous pass: the table must actually render rows.
+        assert marco_rows
+        assert all("NO CUMPLE" not in line for line in marco_rows)
+
+    def test_muted_multi_marco_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED finding mapped to several marcos must increment the
+        per-marco Muted column for every marco, not only the first seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws",
+                        [
+                            _attr("operacional", "control de acceso"),
+                            _attr("organizativo", "politica de seguridad"),
+                        ],
+                    )
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", [_attr("operacional", "control de acceso")])
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_ens_table(
+            findings,
+            bulk_metadata,
+            "ens_rd2022_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both marco rows the muted finding maps to must report a Muted count of
+        # 1 in their last cell.
+        muted_one_rows = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_one_rows) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Proveedor column must come from the matched ENS compliance, not
+        from a different framework that trails it in the compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws", [_attr("operacional", "control de acceso")]
+                    ),
+                    _make_compliance(
+                        "gcp", [_attr("x", "y")], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance(
+                        "aws", [_attr("operacional", "control de acceso")]
+                    ),
+                    _make_compliance(
+                        "gcp", [_attr("x", "y")], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_ens_table(
+            findings,
+            bulk_metadata,
+            "ens_rd2022_aws",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        assert "gcp" not in captured.out
diff --git a/tests/lib/outputs/compliance/kisa_ismsp/__init__.py b/tests/lib/outputs/compliance/kisa_ismsp/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_table_test.py b/tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_table_test.py
new file mode 100644
index 0000000000..be0fe25ad5
--- /dev/null
+++ b/tests/lib/outputs/compliance/kisa_ismsp/kisa_ismsp_table_test.py
@@ -0,0 +1,137 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.kisa_ismsp.kisa_ismsp import get_kisa_ismsp_table
+
+# The generator matches a compliance when its Framework starts with "KISA" and
+# its Version is contained in the compliance_framework argument.
+COMPLIANCE_FRAMEWORK = "kisa-isms-p-2023_aws"
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(
+    provider, sections, framework="KISA-ISMS-P", version="kisa-isms-p-2023"
+):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Version=version,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestKISAISMSPTable:
+    """Verify multi-section counting and provider-column attribution for the KISA ISMS-P compliance table."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_kisa_ismsp_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging was
+        # undercounted because the per-section count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_kisa_ismsp_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched KISA compliance, never
+        from a different framework that happens to be the last entry in the
+        check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_kisa_ismsp_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/mitre_attack/__init__.py b/tests/lib/outputs/compliance/mitre_attack/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/mitre_attack/mitre_attack_table_test.py b/tests/lib/outputs/compliance/mitre_attack/mitre_attack_table_test.py
new file mode 100644
index 0000000000..3bd69b44e8
--- /dev/null
+++ b/tests/lib/outputs/compliance/mitre_attack/mitre_attack_table_test.py
@@ -0,0 +1,140 @@
+import re
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.mitre_attack.mitre_attack import (
+    get_mitre_attack_table,
+)
+
+# The generator matches a compliance when "MITRE-ATTACK" is in its Framework and
+# its Version is contained in the compliance_framework argument.
+COMPLIANCE_FRAMEWORK = "mitre_attack_aws"
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(
+    provider, tactics, framework="MITRE-ATTACK", version="mitre_attack"
+):
+    """Build a per-check compliance covering the given tactics."""
+    return SimpleNamespace(
+        Framework=framework,
+        Version=version,
+        Provider=provider,
+        Requirements=[SimpleNamespace(Tactics=tactics)],
+    )
+
+
+class TestMitreAttackTable:
+    """Test multi-section counting and provider-column attribution for the compliance table."""
+
+    def test_multi_tactic_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several tactics must show FAIL(1) in
+        every tactic, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["Persistence", "Execution"])]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["Persistence"])]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_mitre_attack_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both Persistence and Execution must report FAIL(1); before the fix
+        # Execution was undercounted because the per-tactic count was gated by
+        # the global dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_tactic_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several tactics must increase the
+        per-tactic Muted count in every tactic, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["Persistence", "Execution"])]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["Persistence"])]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A second finding is needed so the table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_mitre_attack_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both Persistence and Execution, so the
+        # Muted column must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched MITRE-ATTACK
+        compliance, never from a different framework that happens to be the last
+        entry in the check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["Persistence"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["Persistence"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_mitre_attack_table(
+            findings,
+            bulk_metadata,
+            COMPLIANCE_FRAMEWORK,
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/okta_idaas_stig/__init__.py b/tests/lib/outputs/compliance/okta_idaas_stig/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py
new file mode 100644
index 0000000000..3017ea4f92
--- /dev/null
+++ b/tests/lib/outputs/compliance/okta_idaas_stig/okta_idaas_stig_table_test.py
@@ -0,0 +1,136 @@
+from types import SimpleNamespace
+
+from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig import (
+    get_okta_idaas_stig_table,
+)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, sections, framework="Okta-IDaaS-STIG"):
+    """Build a per-check compliance covering the given sections."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(Attributes=[SimpleNamespace(Section=section)])
+            for section in sections
+        ],
+    )
+
+
+class TestOktaIDaaSSTIGTable:
+    """Test cases for Okta IDaaS STIG compliance table rendering."""
+
+    def test_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several sections must show FAIL(1) in
+        every section, not just the first one seen."""
+        bulk_metadata = {
+            # check_a belongs to two sections at once.
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("okta", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("okta", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_okta_idaas_stig_table(
+            findings,
+            bulk_metadata,
+            "okta_idaas_stig_1r2",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # Both IAM and Logging must report FAIL(1); before the fix Logging
+        # was undercounted and rendered as plain PASS.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several sections must increase the
+        per-section Muted count in every section, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("okta", ["IAM", "Logging"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("okta", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        get_okta_idaas_stig_table(
+            findings,
+            bulk_metadata,
+            "okta_idaas_stig_1r2",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        # The muted check belongs to both IAM and Logging, so the Muted column
+        # must read 1 in both rows. Before the fix only the first section seen
+        # was incremented, leaving the second at 0.
+        # Strip ANSI color codes before counting the bare values per row.
+        import re
+
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # Each section row ends with its Muted value in its own cell; both rows
+        # must carry a Muted count of 1.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched Okta-IDaaS-STIG
+        compliance, never from a different framework that happens to be the
+        last entry in the check's compliance list."""
+        # check_a maps to Okta-IDaaS-STIG (provider "okta") but its compliance
+        # list ends with a *different* framework whose provider is "aws". With
+        # the bug the leaked loop variable made the table render "aws".
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("okta", ["IAM"]),
+                    _make_compliance("aws", ["Other"], framework="OtherFramework"),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("okta", ["IAM"]),
+                    _make_compliance("aws", ["Other"], framework="OtherFramework"),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        get_okta_idaas_stig_table(
+            findings,
+            bulk_metadata,
+            "okta_idaas_stig_1r2",
+            "output",
+            str(tmp_path),
+            False,
+        )
+
+        captured = capsys.readouterr()
+        assert "okta" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "aws" not in captured.out
diff --git a/tests/lib/outputs/compliance/prowler_threatscore/__init__.py b/tests/lib/outputs/compliance/prowler_threatscore/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_table_test.py b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_table_test.py
new file mode 100644
index 0000000000..d754395dc3
--- /dev/null
+++ b/tests/lib/outputs/compliance/prowler_threatscore/prowler_threatscore_table_test.py
@@ -0,0 +1,147 @@
+import re
+from types import SimpleNamespace
+from unittest import mock
+
+from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore import (
+    get_prowler_threatscore_table,
+)
+
+# Patch target for the Compliance.get_bulk lookup used to render pillars without
+# findings; the tests don't exercise that path so it returns nothing.
+COMPLIANCE_PATH = (
+    "prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore.Compliance"
+)
+
+
+def _make_finding(check_id, status="PASS", muted=False):
+    return SimpleNamespace(
+        check_metadata=SimpleNamespace(CheckID=check_id),
+        status=status,
+        muted=muted,
+    )
+
+
+def _make_compliance(provider, pillars, framework="ProwlerThreatScore"):
+    """Build a per-check compliance covering the given pillars (Section)."""
+    return SimpleNamespace(
+        Framework=framework,
+        Provider=provider,
+        Requirements=[
+            SimpleNamespace(
+                Attributes=[SimpleNamespace(Section=pillar, LevelOfRisk=5, Weight=100)]
+            )
+            for pillar in pillars
+        ],
+    )
+
+
+class TestProwlerThreatScoreTable:
+    """Verify multi-section counting and provider-column attribution for the compliance table."""
+
+    def test_multi_pillar_fail_not_undercounted(self, capsys, tmp_path):
+        """A single FAIL check mapped to several pillars must show FAIL(1) in
+        every pillar, not just the first one seen."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Encryption"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        with mock.patch(COMPLIANCE_PATH) as compliance_mock:
+            compliance_mock.get_bulk.return_value = {}
+            get_prowler_threatscore_table(
+                findings,
+                bulk_metadata,
+                "prowler_threatscore_aws",
+                "output",
+                str(tmp_path),
+                False,
+            )
+
+        captured = capsys.readouterr()
+        # Both IAM and Encryption must report FAIL(1); before the fix Encryption
+        # was undercounted because the per-pillar count was gated by the global
+        # dedup list.
+        assert captured.out.count("FAIL(1)") == 2
+
+    def test_multi_pillar_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED check mapped to several pillars must increase the
+        per-pillar Muted count in every pillar, not only the first one."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[_make_compliance("aws", ["IAM", "Encryption"])]
+            ),
+            "check_b": SimpleNamespace(Compliance=[_make_compliance("aws", ["IAM"])]),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            # A real FAIL is needed so the results table is rendered at all.
+            _make_finding("check_b", "FAIL"),
+        ]
+
+        with mock.patch(COMPLIANCE_PATH) as compliance_mock:
+            compliance_mock.get_bulk.return_value = {}
+            get_prowler_threatscore_table(
+                findings,
+                bulk_metadata,
+                "prowler_threatscore_aws",
+                "output",
+                str(tmp_path),
+                False,
+            )
+
+        captured = capsys.readouterr()
+        plain = re.sub(r"\x1b\[[0-9;]*m", "", captured.out)
+        # The muted check belongs to both IAM and Encryption, so the Muted
+        # column must read 1 in both rows.
+        muted_cells = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_cells) == 2
+
+    def test_provider_column_not_leaked_from_other_framework(self, capsys, tmp_path):
+        """The Provider column must come from the matched ProwlerThreatScore
+        compliance, never from a different framework that happens to be the last
+        entry in the check's compliance list."""
+        bulk_metadata = {
+            "check_a": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+            "check_b": SimpleNamespace(
+                Compliance=[
+                    _make_compliance("aws", ["IAM"]),
+                    _make_compliance(
+                        "leaked_provider", ["Other"], framework="OtherFramework"
+                    ),
+                ]
+            ),
+        }
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+
+        with mock.patch(COMPLIANCE_PATH) as compliance_mock:
+            compliance_mock.get_bulk.return_value = {}
+            get_prowler_threatscore_table(
+                findings,
+                bulk_metadata,
+                "prowler_threatscore_aws",
+                "output",
+                str(tmp_path),
+                False,
+            )
+
+        captured = capsys.readouterr()
+        assert "aws" in captured.out
+        # The provider of the unrelated trailing framework must NOT leak into
+        # the rendered table.
+        assert "leaked_provider" not in captured.out
diff --git a/tests/lib/outputs/compliance/universal/universal_table_test.py b/tests/lib/outputs/compliance/universal/universal_table_test.py
index 7598c43c8b..abe3d0c3d0 100644
--- a/tests/lib/outputs/compliance/universal/universal_table_test.py
+++ b/tests/lib/outputs/compliance/universal/universal_table_test.py
@@ -1,3 +1,4 @@
+import re
 from types import SimpleNamespace
 from unittest.mock import MagicMock
 
@@ -26,6 +27,10 @@ def _make_finding(check_id, status="PASS", muted=False):
     return finding
 
 
+def _strip_ansi(text):
+    return re.sub(r"\x1b\[[0-9;]*m", "", text)
+
+
 def _make_framework(requirements, table_config, provider="AWS"):
     return ComplianceFramework(
         framework="TestFW",
@@ -39,6 +44,8 @@ def _make_framework(requirements, table_config, provider="AWS"):
 
 
 class TestBuildRequirementCheckMap:
+    """Test cases for building the requirement-to-check map of a framework."""
+
     def test_basic(self):
         reqs = [
             UniversalComplianceRequirement(
@@ -103,6 +110,8 @@ class TestBuildRequirementCheckMap:
 
 
 class TestGetGroupKey:
+    """Test cases for resolving the group key of a requirement."""
+
     def test_normal_field(self):
         req = UniversalComplianceRequirement(
             id="1.1",
@@ -124,7 +133,9 @@ class TestGetGroupKey:
 
 
 class TestGroupedMode:
-    def test_grouped_rendering(self, capsys):
+    """Test cases for grouped-mode universal compliance table rendering."""
+
+    def test_grouped_rendering(self, capsys, tmp_path):
         reqs = [
             UniversalComplianceRequirement(
                 id="1.1",
@@ -156,7 +167,7 @@ class TestGroupedMode:
             bulk_metadata,
             "test_fw",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
         )
@@ -167,9 +178,118 @@ class TestGroupedMode:
         assert "PASS" in captured.out
         assert "FAIL" in captured.out
 
+    def test_grouped_multi_section_no_undercount(self, capsys, tmp_path):
+        """A single check mapped to several sections must be counted in
+        every section it belongs to, not only the first one seen."""
+        reqs = [
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "IAM"},
+                checks={"aws": ["check_a", "check_b"]},
+            ),
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test2",
+                attributes={"Section": "Logging"},
+                checks={"aws": ["check_a"]},
+            ),
+        ]
+        tc = TableConfig(group_by="Section")
+        fw = _make_framework(reqs, tc)
+
+        # check_a (FAIL) belongs to both IAM and Logging sections; check_b
+        # (PASS, IAM only) is added so the overview total reaches 2 and the
+        # results table is rendered.
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both the IAM and Logging rows must report FAIL(1). Before the fix the
+        # second section seen (Logging) was undercounted to FAIL(0) and rendered
+        # as PASS. Anchor each occurrence to its own table row so an unrelated
+        # "FAIL(1)" elsewhere cannot mask an undercount.
+        iam_row = [
+            line for line in plain.splitlines() if "IAM" in line and "FAIL(1)" in line
+        ]
+        logging_row = [
+            line
+            for line in plain.splitlines()
+            if "Logging" in line and "FAIL(1)" in line
+        ]
+        assert len(iam_row) == 1
+        assert len(logging_row) == 1
+
+    def test_grouped_multi_section_muted_not_undercounted(self, capsys, tmp_path):
+        """A single MUTED finding mapped to several groups must be counted in
+        the per-group Muted column of every group it belongs to."""
+        reqs = [
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "IAM"},
+                checks={"aws": ["check_a", "check_b"]},
+            ),
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test2",
+                attributes={"Section": "Logging"},
+                checks={"aws": ["check_a"]},
+            ),
+        ]
+        tc = TableConfig(group_by="Section")
+        fw = _make_framework(reqs, tc)
+
+        # check_a is MUTED and belongs to both IAM and Logging; check_b is a
+        # plain FAIL so the overview total reaches 2 and the table is rendered.
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            _make_finding("check_b", "FAIL"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # The muted finding belongs to both sections, so both the IAM row and
+        # the Logging row must carry a Muted count of 1 in their last cell.
+        muted_one_rows = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_one_rows) == 2
+
 
 class TestSplitMode:
-    def test_split_rendering(self, capsys):
+    """Test cases for split-mode universal compliance table rendering."""
+
+    def test_split_rendering(self, capsys, tmp_path):
         reqs = [
             UniversalComplianceRequirement(
                 id="1.1",
@@ -204,7 +324,7 @@ class TestSplitMode:
             bulk_metadata,
             "test_fw",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
         )
@@ -214,9 +334,119 @@ class TestSplitMode:
         assert "Level 1" in captured.out
         assert "Level 2" in captured.out
 
+    def test_split_muted_multi_section_not_undercounted(self, capsys, tmp_path):
+        """In split mode a single MUTED finding mapped to several groups must
+        be counted in the Muted column of every group it belongs to."""
+        reqs = [
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "Storage", "Profile": "Level 1"},
+                checks={"aws": ["check_a", "check_b"]},
+            ),
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test2",
+                attributes={"Section": "Logging", "Profile": "Level 1"},
+                checks={"aws": ["check_a"]},
+            ),
+        ]
+        tc = TableConfig(
+            group_by="Section",
+            split_by=SplitByConfig(field="Profile", values=["Level 1", "Level 2"]),
+        )
+        fw = _make_framework(reqs, tc)
+
+        # check_a is MUTED and belongs to both Storage and Logging; check_b is a
+        # plain FAIL so the table is rendered.
+        findings = [
+            _make_finding("check_a", "FAIL", muted=True),
+            _make_finding("check_b", "FAIL"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # Both section rows must carry a Muted count of 1 (last cell). Before the
+        # fix only the first group seen incremented Muted, leaving the other 0.
+        muted_one_rows = re.findall(r"│\s*1\s*│\s*$", plain, flags=re.MULTILINE)
+        assert len(muted_one_rows) == 2
+
+    def test_split_same_group_value_not_double_counted(self, capsys, tmp_path):
+        """A single finding whose check maps to several requirements that share
+        the same group and split value must count once for that group/split,
+        not once per requirement (FAIL(1), never FAIL(2))."""
+        reqs = [
+            # check_a appears in two requirements, both Storage / Level 1.
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "Storage", "Profile": "Level 1"},
+                checks={"aws": ["check_a"]},
+            ),
+            UniversalComplianceRequirement(
+                id="1.2",
+                description="test2",
+                attributes={"Section": "Storage", "Profile": "Level 1"},
+                checks={"aws": ["check_a"]},
+            ),
+            # A second group so the table renders with more than one finding.
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test3",
+                attributes={"Section": "Logging", "Profile": "Level 1"},
+                checks={"aws": ["check_b"]},
+            ),
+        ]
+        tc = TableConfig(
+            group_by="Section",
+            split_by=SplitByConfig(field="Profile", values=["Level 1", "Level 2"]),
+        )
+        fw = _make_framework(reqs, tc)
+
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        # The Storage row must show FAIL(1) for Level 1, never FAIL(2).
+        assert "FAIL(1)" in plain
+        assert "FAIL(2)" not in plain
+
 
 class TestScoredMode:
-    def test_scored_rendering(self, capsys):
+    """Test cases for scored-mode universal compliance table rendering."""
+
+    def test_scored_rendering(self, capsys, tmp_path):
         reqs = [
             UniversalComplianceRequirement(
                 id="1.1",
@@ -251,7 +481,7 @@ class TestScoredMode:
             bulk_metadata,
             "test_fw",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
         )
@@ -261,9 +491,68 @@ class TestScoredMode:
         assert "Score" in captured.out
         assert "Threat Score" in captured.out
 
+    def test_scored_multi_section_fail_not_undercounted(self, capsys, tmp_path):
+        """In scored mode a single FAIL finding mapped to several groups must
+        show FAIL(1) in every group it belongs to, not only the first one."""
+        reqs = [
+            UniversalComplianceRequirement(
+                id="1.1",
+                description="test",
+                attributes={"Section": "IAM", "LevelOfRisk": 5, "Weight": 100},
+                checks={"aws": ["check_a", "check_b"]},
+            ),
+            UniversalComplianceRequirement(
+                id="2.1",
+                description="test2",
+                attributes={"Section": "Logging", "LevelOfRisk": 3, "Weight": 50},
+                checks={"aws": ["check_a"]},
+            ),
+        ]
+        tc = TableConfig(
+            group_by="Section",
+            scoring=ScoringConfig(risk_field="LevelOfRisk", weight_field="Weight"),
+        )
+        fw = _make_framework(reqs, tc)
+
+        # check_a (FAIL) belongs to both IAM and Logging; check_b (PASS, IAM
+        # only) raises the overview total to 2 so the table is rendered.
+        findings = [
+            _make_finding("check_a", "FAIL"),
+            _make_finding("check_b", "PASS"),
+        ]
+        bulk_metadata = {
+            "check_a": MagicMock(Compliance=[]),
+            "check_b": MagicMock(Compliance=[]),
+        }
+
+        get_universal_table(
+            findings,
+            bulk_metadata,
+            "test_fw",
+            "output",
+            str(tmp_path),
+            False,
+            framework=fw,
+        )
+
+        captured = capsys.readouterr()
+        plain = _strip_ansi(captured.out)
+        iam_row = [
+            line for line in plain.splitlines() if "IAM" in line and "FAIL(1)" in line
+        ]
+        logging_row = [
+            line
+            for line in plain.splitlines()
+            if "Logging" in line and "FAIL(1)" in line
+        ]
+        assert len(iam_row) == 1
+        assert len(logging_row) == 1
+
 
 class TestCustomLabels:
-    def test_ens_spanish_labels(self, capsys):
+    """Test cases for custom-label universal compliance table rendering."""
+
+    def test_ens_spanish_labels(self, capsys, tmp_path):
         reqs = [
             UniversalComplianceRequirement(
                 id="1.1",
@@ -300,7 +589,7 @@ class TestCustomLabels:
             bulk_metadata,
             "test_fw",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
         )
@@ -311,7 +600,9 @@ class TestCustomLabels:
 
 
 class TestMultiProviderDictChecks:
-    def test_only_aws_checks_matched(self, capsys):
+    """Test cases for multi-provider dict checks in the universal table."""
+
+    def test_only_aws_checks_matched(self, capsys, tmp_path):
         """With dict checks and provider='aws', only AWS checks match findings."""
         reqs = [
             UniversalComplianceRequirement(
@@ -352,7 +643,7 @@ class TestMultiProviderDictChecks:
             bulk_metadata,
             "multi_cloud",
             "output",
-            "/tmp",
+            str(tmp_path),
             False,
             framework=fw,
             provider="aws",
@@ -366,7 +657,9 @@ class TestMultiProviderDictChecks:
 
 
 class TestNoTableConfig:
-    def test_returns_early_without_table_config(self, capsys):
+    """Test cases for the universal table when no table config is present."""
+
+    def test_returns_early_without_table_config(self, capsys, tmp_path):
         fw = ComplianceFramework(
             framework="TestFW",
             name="Test",
@@ -374,11 +667,11 @@ class TestNoTableConfig:
             description="Test",
             requirements=[],
         )
-        get_universal_table([], {}, "test", "out", "/tmp", False, framework=fw)
+        get_universal_table([], {}, "test", "out", str(tmp_path), False, framework=fw)
         captured = capsys.readouterr()
         assert captured.out == ""
 
-    def test_returns_early_without_framework(self, capsys):
-        get_universal_table([], {}, "test", "out", "/tmp", False, framework=None)
+    def test_returns_early_without_framework(self, capsys, tmp_path):
+        get_universal_table([], {}, "test", "out", str(tmp_path), False, framework=None)
         captured = capsys.readouterr()
         assert captured.out == ""

From 82d37c4978be9882626711076b08e4d0a3547ad6 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Thu, 18 Jun 2026 18:22:51 +0900
Subject: [PATCH 085/126] feat(azure): add aks_cluster_defender_enabled check
 (#11028)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../aks_cluster_defender_enabled/__init__.py  |   0
 ...aks_cluster_defender_enabled.metadata.json |  39 ++++++
 .../aks_cluster_defender_enabled.py           |  29 +++++
 .../aks_cluster_defender_enabled_test.py      | 122 ++++++++++++++++++
 5 files changed, 191 insertions(+)
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_defender_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.py
 create mode 100644 tests/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 08d892155c..bd0d0bb956 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -28,6 +28,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Rename DORA to DORA_2022_2554 to follow the naming <name>_<version> in compliance frameworks [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
 - `entra_directory_sync_object_takeover_blocked` check for the M365 provider, verifying that hybrid Entra tenants block cloud object takeover through both soft-match and hard-match directory synchronization [(#11098)](https://github.com/prowler-cloud/prowler/pull/11098)
 - `entra_conditional_access_policy_no_deleted_object_references` check for M365 provider [(#11236)](https://github.com/prowler-cloud/prowler/pull/11236)
+- `aks_cluster_defender_enabled` check for Azure provider, verifying that AKS clusters have Microsoft Defender security monitoring enabled [(#11028)](https://github.com/prowler-cloud/prowler/pull/11028)
 
 ### 🔄 Changed
 
diff --git a/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/__init__.py b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.metadata.json b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.metadata.json
new file mode 100644
index 0000000000..90bbd45f3b
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.metadata.json
@@ -0,0 +1,39 @@
+{
+  "Provider": "azure",
+  "CheckID": "aks_cluster_defender_enabled",
+  "CheckTitle": "AKS cluster has Microsoft Defender security profile enabled",
+  "CheckType": [],
+  "ServiceName": "aks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "microsoft.containerservice/managedclusters",
+  "ResourceGroup": "container",
+  "Description": "**AKS clusters** are evaluated for the **Microsoft Defender security profile** (`securityProfile.defender.securityMonitoring.enabled=true`). Defender for Containers extends security monitoring, threat detection, vulnerability assessment, and security posture insights to Azure Kubernetes Service workloads.",
+  "Risk": "Without the Microsoft Defender security profile, AKS runtime threats such as **cryptomining**, suspicious Kubernetes API activity, vulnerable container images, and malicious workload behavior may go undetected. Compromised containers can pivot to cluster resources and cloud APIs, impacting **confidentiality**, **integrity**, and **availability**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-deployment-overview",
+    "https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest#az-aks-update",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/managedclusters"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --enable-defender",
+      "NativeIaC": "```bicep\n// AKS cluster with Microsoft Defender security monitoring enabled\nresource aks 'Microsoft.ContainerService/managedClusters@2024-05-01' = {\n  name: '<CLUSTER_NAME>'\n  location: '<LOCATION>'\n  identity: {\n    type: 'SystemAssigned'\n  }\n  properties: {\n    dnsPrefix: '<DNS_PREFIX>'\n    securityProfile: {\n      defender: {\n        logAnalyticsWorkspaceResourceId: '<LOG_ANALYTICS_WORKSPACE_RESOURCE_ID>'\n        securityMonitoring: {\n          enabled: true // Critical: enables Defender security monitoring for AKS\n        }\n      }\n    }\n    agentPoolProfiles: [\n      {\n        name: 'system'\n        count: 1\n        vmSize: 'Standard_DS2_v2'\n        mode: 'System'\n      }\n    ]\n  }\n}\n```",
+      "Other": "1. In Microsoft Defender for Cloud, enable the Containers plan for the subscription that contains the AKS cluster\n2. In the AKS cluster configuration, enable the Microsoft Defender security profile\n3. Verify that Defender security monitoring is enabled for the managed cluster",
+      "Terraform": "```hcl\nresource \"azurerm_log_analytics_workspace\" \"example\" {\n  name                = \"<workspace-name>\"\n  location            = \"<location>\"\n  resource_group_name = \"<resource-group>\"\n  sku                 = \"PerGB2018\"\n}\n\nresource \"azurerm_kubernetes_cluster\" \"example\" {\n  name                = \"<cluster-name>\"\n  location            = \"<location>\"\n  resource_group_name = \"<resource-group>\"\n  dns_prefix          = \"<dns-prefix>\"\n\n  default_node_pool {\n    name       = \"system\"\n    node_count = 1\n    vm_size    = \"Standard_DS2_v2\"\n  }\n\n  identity {\n    type = \"SystemAssigned\"\n  }\n\n  microsoft_defender {\n    log_analytics_workspace_id = azurerm_log_analytics_workspace.example.id\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable the Microsoft Defender security profile for AKS clusters and ensure the subscription has Defender for Containers enabled. Route security monitoring data to the appropriate workspace and review Defender alerts and recommendations as part of the cluster operations process.",
+      "Url": "https://hub.prowler.com/check/aks_cluster_defender_enabled"
+    }
+  },
+  "Categories": [
+    "threat-detection",
+    "cluster-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check evaluates the AKS managed cluster Defender security monitoring flag. Defender for Containers plan availability, billing, workspace routing, and alert response processes should be validated separately at the subscription and security operations levels."
+}
diff --git a/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.py b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.py
new file mode 100644
index 0000000000..08074754a6
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled.py
@@ -0,0 +1,29 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.aks.aks_client import aks_client
+
+
+class aks_cluster_defender_enabled(Check):
+    def execute(self) -> list[Check_Report_Azure]:
+        findings = []
+
+        for subscription_name, clusters in aks_client.clusters.items():
+            for cluster in clusters.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
+                report.subscription = subscription_name
+
+                if cluster.defender_enabled is True:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Cluster '{cluster.name}' has Defender for Containers "
+                        "enabled."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"Cluster '{cluster.name}' does not have Defender for "
+                        "Containers enabled."
+                    )
+
+                findings.append(report)
+
+        return findings
diff --git a/tests/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled_test.py b/tests/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled_test.py
new file mode 100644
index 0000000000..0575b67a4a
--- /dev/null
+++ b/tests/providers/azure/services/aks/aks_cluster_defender_enabled/aks_cluster_defender_enabled_test.py
@@ -0,0 +1,122 @@
+from importlib import import_module
+from unittest import mock
+from uuid import uuid4
+
+import pytest
+
+from prowler.providers.azure.services.aks.aks_service import Cluster
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+CHECK_MODULE = (
+    "prowler.providers.azure.services.aks.aks_cluster_defender_enabled."
+    "aks_cluster_defender_enabled"
+)
+CHECK_CLIENT_PATCH = f"{CHECK_MODULE}.aks_client"
+
+
+def get_check_class():
+    return import_module(CHECK_MODULE).aks_cluster_defender_enabled
+
+
+def build_cluster(defender_enabled):
+    return Cluster(
+        id=str(uuid4()),
+        name="test-cluster",
+        public_fqdn="test.azmk8s.io",
+        private_fqdn=None,
+        network_policy=None,
+        agent_pool_profiles=[],
+        rbac_enabled=True,
+        location="eastus",
+        defender_enabled=defender_enabled,
+    )
+
+
+class Test_aks_cluster_defender_enabled:
+    def test_no_subscriptions(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_defender_enabled = get_check_class()
+
+            aks_client.clusters = {}
+
+            check = aks_cluster_defender_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_defender_enabled = get_check_class()
+
+            cluster = build_cluster(defender_enabled=True)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_defender_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Cluster 'test-cluster' has Defender for Containers enabled."
+            )
+            assert result[0].resource_name == "test-cluster"
+            assert result[0].resource_id == cluster.id
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "eastus"
+
+    @pytest.mark.parametrize("defender_enabled", [False, None, "true"])
+    def test_fail(self, defender_enabled):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_defender_enabled = get_check_class()
+
+            cluster = build_cluster(defender_enabled=defender_enabled)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_defender_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Cluster 'test-cluster' does not have Defender for "
+                "Containers enabled."
+            )
+            assert result[0].resource_name == "test-cluster"
+            assert result[0].resource_id == cluster.id
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "eastus"

From 2111d083df8ee55c38fc47c0a37a63f402d4c54d Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Thu, 18 Jun 2026 12:00:58 +0200
Subject: [PATCH 086/126] fix(ui): bump transitive dompurify to 3.4.10 to patch
 XSS advisories (#11636)

---
 ui/CHANGELOG.md        | 1 +
 ui/pnpm-lock.yaml      | 9 +++++----
 ui/pnpm-workspace.yaml | 4 ++++
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 3de8c46d56..2cb9f92fcb 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -17,6 +17,7 @@ All notable changes to the **Prowler UI** are documented in this file.
 ### 🔐 Security
 
 - Bump vulnerable `Next.js`, React, AI SDK, `postcss`, `hono`, `qs`, `esbuild`, and Alpine OpenSSL packages (`libcrypto3` and `libssl3`) [(#11581)](https://github.com/prowler-cloud/prowler/pull/11581)
+- Bump transitive `dompurify` from 3.4.2 to 3.4.10, patching XSS sanitization bypass advisories [(#11636)](https://github.com/prowler-cloud/prowler/pull/11636)
 
 ---
 
diff --git a/ui/pnpm-lock.yaml b/ui/pnpm-lock.yaml
index 6a5e7bb464..6ca6ac4003 100644
--- a/ui/pnpm-lock.yaml
+++ b/ui/pnpm-lock.yaml
@@ -29,6 +29,7 @@ overrides:
   qs: 6.15.2
   express-rate-limit: 8.5.1
   uuid: 11.1.1
+  dompurify: 3.4.10
 
 importers:
 
@@ -5593,8 +5594,8 @@ packages:
   dom-helpers@5.2.1:
     resolution: {integrity: sha512-nRCa7CK3VTrM2NmGkIy4cbK7IZlgBE/PYMn55rrXefr5xXDP0LdtfPnblFDoVdcAfslJ7or6iqAUnx0CCGIWQA==}
 
-  dompurify@3.4.2:
-    resolution: {integrity: sha512-lHeS9SA/IKeIFFyYciHBr2n0v1VMPlSj843HdLOwjb2OxNwdq9Xykxqhk+FE42MzAdHvInbAolSE4mhahPpjXA==}
+  dompurify@3.4.10:
+    resolution: {integrity: sha512-0xzNv0e7oYC6yyuOGZIABPM4qtg3QxLFniDNPP4ZP90wR8Yq3zgwpRbrNiT4N3IKqDbbYFEJLV+JWEs19aZ//w==}
 
   dotenv-expand@12.0.3:
     resolution: {integrity: sha512-uc47g4b+4k/M/SeaW1y4OApx+mtLWl92l5LMPP0GNXctZqELk+YGgOPIIC5elYmUH4OuoK3JLhuRUYegeySiFA==}
@@ -15168,7 +15169,7 @@ snapshots:
       '@babel/runtime': 7.28.6
       csstype: 3.2.3
 
-  dompurify@3.4.2:
+  dompurify@3.4.10:
     optionalDependencies:
       '@types/trusted-types': 2.0.7
 
@@ -16682,7 +16683,7 @@ snapshots:
       d3-sankey: 0.12.3
       dagre-d3-es: 7.0.14
       dayjs: 1.11.19
-      dompurify: 3.4.2
+      dompurify: 3.4.10
       es-toolkit: 1.46.1
       katex: 0.16.27
       khroma: 2.1.0
diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml
index f3e525fc03..3db3cc19e3 100644
--- a/ui/pnpm-workspace.yaml
+++ b/ui/pnpm-workspace.yaml
@@ -45,6 +45,10 @@ overrides:
   # use the random v4 generator only, so the bug isn't reachable in practice,
   # but the override unifies the tree on a patched version.
   "uuid": "11.1.1"
+  # GHSA-vxr8-fq34-vvx9 (+ several related XSS sanitization bypasses): DOMPurify < 3.4.9,
+  # pulled in transitively via streamdown > mermaid (which wants ^3.3.1). Pinned to 3.4.10
+  # (fixes all open advisories; 3.4.11 is < 24h old and blocked by minimumReleaseAge).
+  "dompurify": "3.4.10"
 
 # --- Level 1: Minimum Release Age ---
 # Packages must be published for at least 1 day before they can be installed.

From 7dd08bc6bf585a1876fb15f97ca806e5aaef2c09 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Thu, 18 Jun 2026 19:41:04 +0900
Subject: [PATCH 087/126] feat(azure): add
 mysql_flexible_server_geo_redundant_backup_enabled check (#11041)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 prowler/compliance/azure/hipaa_azure.json     |   3 +-
 .../compliance/azure/iso27001_2022_azure.json |   6 +-
 .../__init__.py                               |   0
 ...geo_redundant_backup_enabled.metadata.json |  37 ++++++
 ...ble_server_geo_redundant_backup_enabled.py |  31 +++++
 .../azure/services/mysql/mysql_service.py     |   6 +
 ...erver_geo_redundant_backup_enabled_test.py | 125 ++++++++++++++++++
 8 files changed, 206 insertions(+), 3 deletions(-)
 create mode 100644 prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.py
 create mode 100644 tests/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index bd0d0bb956..196d2a467e 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -20,6 +20,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `databricks_workspace_public_network_access_disabled` check for Azure provider, verifying Databricks workspaces have public network access disabled so connectivity is restricted to Azure Private Link private endpoints [(#11035)](https://github.com/prowler-cloud/prowler/pull/11035)
 - `databricks_workspace_no_public_ip_enabled` check for Azure provider, verifying Databricks workspaces use secure cluster connectivity (no public IP) so compute nodes are not assigned public IP addresses [(#11036)](https://github.com/prowler-cloud/prowler/pull/11036)
 - `defender_ensure_defender_cspm_is_on` check for Azure provider, verifying Microsoft Defender Cloud Security Posture Management (CSPM) is enabled on the Standard tier [(#11037)](https://github.com/prowler-cloud/prowler/pull/11037)
+- `mysql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying MySQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11041)](https://github.com/prowler-cloud/prowler/pull/11041)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/hipaa_azure.json b/prowler/compliance/azure/hipaa_azure.json
index 3b1184e0e5..70f1e7e13f 100644
--- a/prowler/compliance/azure/hipaa_azure.json
+++ b/prowler/compliance/azure/hipaa_azure.json
@@ -439,7 +439,8 @@
         "keyvault_recoverable",
         "sqlserver_auditing_retention_90_days",
         "postgresql_flexible_server_log_retention_days_greater_3",
-        "cosmosdb_account_backup_policy_continuous"
+        "cosmosdb_account_backup_policy_continuous",
+        "mysql_flexible_server_geo_redundant_backup_enabled"
       ]
     },
     {
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 719f358de5..6f686d24f0 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1267,7 +1267,8 @@
         }
       ],
       "Checks": [
-        "cosmosdb_account_backup_policy_continuous"
+        "cosmosdb_account_backup_policy_continuous",
+        "mysql_flexible_server_geo_redundant_backup_enabled"
       ]
     },
     {
@@ -1296,7 +1297,8 @@
         "storage_secure_transfer_required_is_enabled",
         "vm_ensure_using_managed_disks",
         "vm_trusted_launch_enabled",
-        "cosmosdb_account_automatic_failover_enabled"
+        "cosmosdb_account_automatic_failover_enabled",
+        "mysql_flexible_server_geo_redundant_backup_enabled"
       ]
     },
     {
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/__init__.py b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.metadata.json b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.metadata.json
new file mode 100644
index 0000000000..1dac541283
--- /dev/null
+++ b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "mysql_flexible_server_geo_redundant_backup_enabled",
+  "CheckTitle": "MySQL flexible server has geo-redundant backup enabled",
+  "CheckType": [],
+  "ServiceName": "mysql",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.dbformysql/flexibleservers",
+  "ResourceGroup": "database",
+  "Description": "**Azure MySQL Flexible Server** is evaluated for **geo-redundant backup**. Geo-redundant backup stores backup copies in a paired Azure region, enabling restore and recovery from a full regional outage.",
+  "Risk": "Without **geo-redundant backup**, a regional disaster can cause **permanent data loss**. Locally redundant backups only protect against storage hardware failures within the same region and cannot be restored if the primary region becomes unavailable.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-backup-restore",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformysql/flexibleservers"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az mysql flexible-server create --name <server_name> --resource-group <resource_group_name> --location <region> --geo-redundant-backup Enabled",
+      "NativeIaC": "```bicep\n// Bicep: MySQL Flexible Server with geo-redundant backup (set at creation)\nresource mysql 'Microsoft.DBforMySQL/flexibleServers@2023-12-30' = {\n  name: '<example_resource_name>'\n  location: '<region>'\n  properties: {\n    backup: {\n      geoRedundantBackup: 'Enabled' // CRITICAL: stores backups in the paired region\n    }\n  }\n}\n```",
+      "Other": "1. Geo-redundant backup must be configured when the server is created; it cannot be enabled on an existing server\n2. In the Azure portal, start creating a new Azure Database for MySQL flexible server\n3. On the Basics tab, under Compute + storage, open Configure server\n4. Set Geographically redundant backup to Enabled and save\n5. Finish creating the server and migrate workloads to it",
+      "Terraform": "```hcl\n# Terraform: MySQL Flexible Server with geo-redundant backup (set at creation)\nresource \"azurerm_mysql_flexible_server\" \"<example_resource_name>\" {\n  name                         = \"<example_resource_name>\"\n  resource_group_name          = \"<example_resource_name>\"\n  location                     = \"<region>\"\n  geo_redundant_backup_enabled = true # CRITICAL: stores backups in the paired region\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **geo-redundant backup** on MySQL Flexible Servers so backups are replicated to the paired Azure region and can be restored during a regional outage. Because this is set at server creation, plan a migration for existing servers, and pair it with an appropriate backup retention period and periodic restore testing.",
+      "Url": "https://hub.prowler.com/check/mysql_flexible_server_geo_redundant_backup_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Geo-redundant backup for Azure MySQL Flexible Server can only be configured at server creation time and cannot be changed afterwards."
+}
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.py b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.py
new file mode 100644
index 0000000000..5b1685354c
--- /dev/null
+++ b/prowler/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled.py
@@ -0,0 +1,31 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.mysql.mysql_client import mysql_client
+
+
+class mysql_flexible_server_geo_redundant_backup_enabled(Check):
+    """
+    Ensure Azure MySQL Flexible Servers have geo-redundant backup enabled.
+
+    This check evaluates whether each Azure MySQL Flexible Server stores backups in a paired Azure region, enabling recovery from a full regional outage.
+
+    - PASS: The server has geo-redundant backup enabled (geo_redundant_backup is "Enabled").
+    - FAIL: The server does not have geo-redundant backup enabled.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for subscription_id, servers in mysql_client.flexible_servers.items():
+            subscription_name = mysql_client.subscriptions.get(
+                subscription_id, subscription_id
+            )
+            for server in servers.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
+                report.subscription = subscription_id
+                if server.geo_redundant_backup == "Enabled":
+                    report.status = "PASS"
+                    report.status_extended = f"Geo-redundant backup is enabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Geo-redundant backup is disabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                findings.append(report)
+        return findings
diff --git a/prowler/providers/azure/services/mysql/mysql_service.py b/prowler/providers/azure/services/mysql/mysql_service.py
index 565e14da01..c626661f98 100644
--- a/prowler/providers/azure/services/mysql/mysql_service.py
+++ b/prowler/providers/azure/services/mysql/mysql_service.py
@@ -1,4 +1,5 @@
 from dataclasses import dataclass
+from typing import Optional
 
 from azure.mgmt.rdbms.mysql_flexibleservers import MySQLManagementClient
 
@@ -21,6 +22,7 @@ class MySQL(AzureService):
                 servers_list = client.servers.list()
                 servers.update({subscription_id: {}})
                 for server in servers_list:
+                    backup = getattr(server, "backup", None)
                     servers[subscription_id].update(
                         {
                             server.id: FlexibleServer(
@@ -31,6 +33,9 @@ class MySQL(AzureService):
                                 configurations=self._get_configurations(
                                     client, server.id.split("/")[4], server.name
                                 ),
+                                geo_redundant_backup=getattr(
+                                    backup, "geo_redundant_backup", None
+                                ),
                             )
                         }
                     )
@@ -78,3 +83,4 @@ class FlexibleServer:
     location: str
     version: str
     configurations: dict[Configuration]
+    geo_redundant_backup: Optional[str] = None
diff --git a/tests/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled_test.py b/tests/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled_test.py
new file mode 100644
index 0000000000..c5e1f27de2
--- /dev/null
+++ b/tests/providers/azure/services/mysql/mysql_flexible_server_geo_redundant_backup_enabled/mysql_flexible_server_geo_redundant_backup_enabled_test.py
@@ -0,0 +1,125 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.mysql.mysql_service import FlexibleServer
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_mysql_flexible_server_geo_redundant_backup_enabled:
+    def test_mysql_no_subscriptions(self):
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled import (
+                mysql_flexible_server_geo_redundant_backup_enabled,
+            )
+
+            check = mysql_flexible_server_geo_redundant_backup_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_mysql_geo_redundant_backup_disabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    geo_redundant_backup="Disabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled import (
+                mysql_flexible_server_geo_redundant_backup_enabled,
+            )
+
+            check = mysql_flexible_server_geo_redundant_backup_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Geo-redundant backup is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
+
+    def test_mysql_geo_redundant_backup_enabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    geo_redundant_backup="Enabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_geo_redundant_backup_enabled.mysql_flexible_server_geo_redundant_backup_enabled import (
+                mysql_flexible_server_geo_redundant_backup_enabled,
+            )
+
+            check = mysql_flexible_server_geo_redundant_backup_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Geo-redundant backup is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"

From 751c7fc29ff0305169a3350bb9585f176a23579b Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Thu, 18 Jun 2026 13:03:19 +0200
Subject: [PATCH 088/126] chore(jira): timeout to 90 seconds (#11638)

---
 prowler/lib/outputs/jira/jira.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/prowler/lib/outputs/jira/jira.py b/prowler/lib/outputs/jira/jira.py
index f826d09026..9005b5274e 100644
--- a/prowler/lib/outputs/jira/jira.py
+++ b/prowler/lib/outputs/jira/jira.py
@@ -341,7 +341,7 @@ class Jira:
     }
     TOKEN_URL = "https://auth.atlassian.com/oauth/token"
     API_TOKEN_URL = "https://api.atlassian.com/oauth/token/accessible-resources"
-    REQUEST_TIMEOUT = 30
+    REQUEST_TIMEOUT = 90
     HEADER_TEMPLATE = {
         "Content-Type": "application/json",
         "X-Force-Accept-Language": "true",

From 853610bbbf8846931d9884e9e4b215a341aedda0 Mon Sep 17 00:00:00 2001
From: "Pablo Fernandez Guerra (PFE)"
 <148432447+pfe-nazaries@users.noreply.github.com>
Date: Thu, 18 Jun 2026 15:12:18 +0200
Subject: [PATCH 089/126] feat(ui): resolve public SaaS config at container
 runtime (#11500)

Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 .env                                          |  20 ++-
 .github/workflows/ui-container-build-push.yml |   4 -
 .github/workflows/ui-e2e-tests-v2.yml         |   5 +-
 .../prowler-app/templates/ui/configmap.yaml   |   5 +-
 contrib/k8s/helm/prowler-ui/values.yaml       |   4 +-
 docs/developer-guide/end2end-testing.mdx      |   4 +-
 .../developer-guide/environment-variables.mdx |  53 +++++++
 docs/docs.json                                |   1 +
 docs/troubleshooting.mdx                      |  34 ++---
 ui/CHANGELOG.md                               |   8 ++
 ui/Dockerfile                                 |  14 +-
 ui/__tests__/msw/handlers/attack-paths.ts     |   2 +-
 .../confirm/confirm-alert-recipient.test.ts   |  20 ++-
 .../alerts/confirm/confirm-alert-recipient.ts |   4 +-
 .../unsubscribe-alert-recipient.test.ts       |  35 ++++-
 .../unsubscribe-alert-recipient.ts            |   4 +-
 ui/app/(auth)/layout.tsx                      |  28 +++-
 ui/app/(prowler)/layout.tsx                   |   5 +-
 ui/app/instrumentation.client.ts              | 121 ----------------
 ui/app/providers.tsx                          |   3 -
 .../integrations/saml/saml-config-form.tsx    |  10 +-
 .../runtime-config/runtime-public-config.tsx  |  17 +++
 ui/components/ui/sidebar/menu.tsx             |   3 +
 ui/hooks/use-runtime-config.test.ts           |  52 +++++++
 ui/hooks/use-runtime-config.ts                |  25 ++++
 ui/instrumentation-client.test.ts             |  97 +++++++++++++
 ui/instrumentation-client.ts                  | 136 +++++++++++++++++-
 ui/instrumentation.ts                         |  13 +-
 ui/lib/env.test.ts                            |  46 ++++++
 ui/lib/env.ts                                 |  21 +++
 ui/lib/get-runtime-config.client.test.ts      | 115 +++++++++++++++
 ui/lib/get-runtime-config.client.ts           |  43 ++++++
 ui/lib/helper.ts                              |   8 +-
 ui/lib/menu-list.test.ts                      |  41 ++++++
 ui/lib/menu-list.ts                           |  15 +-
 ui/lib/runtime-config.shared.ts               |  26 ++++
 ui/lib/runtime-config.ts                      |  30 ++++
 ui/lib/runtime-env.test.ts                    |  75 ++++++++++
 ui/lib/runtime-env.ts                         |  21 +++
 ui/lib/safe-json.test.ts                      |  83 +++++++++++
 ui/lib/safe-json.ts                           |  16 +++
 ui/next.config.js                             |  38 ++---
 ui/package.json                               |   8 +-
 ui/playwright.config.ts                       |  12 +-
 ui/sentry/README.md                           |  21 ++-
 ui/sentry/sentry.edge.config.test.ts          |  60 ++++++++
 ui/sentry/sentry.edge.config.ts               |  22 ++-
 ui/sentry/sentry.server.config.test.ts        |  63 ++++++++
 ui/sentry/sentry.server.config.ts             |  25 +++-
 .../runtime-config/runtime-config-page.ts     | 124 ++++++++++++++++
 ui/tests/runtime-config/runtime-config.md     |  87 +++++++++++
 .../runtime-config/runtime-config.spec.ts     |  82 +++++++++++
 ui/types/env.d.ts                             |  35 ++++-
 ui/vitest.config.ts                           |   5 +-
 54 files changed, 1590 insertions(+), 259 deletions(-)
 create mode 100644 docs/developer-guide/environment-variables.mdx
 delete mode 100644 ui/app/instrumentation.client.ts
 create mode 100644 ui/components/runtime-config/runtime-public-config.tsx
 create mode 100644 ui/hooks/use-runtime-config.test.ts
 create mode 100644 ui/hooks/use-runtime-config.ts
 create mode 100644 ui/instrumentation-client.test.ts
 create mode 100644 ui/lib/env.test.ts
 create mode 100644 ui/lib/env.ts
 create mode 100644 ui/lib/get-runtime-config.client.test.ts
 create mode 100644 ui/lib/get-runtime-config.client.ts
 create mode 100644 ui/lib/runtime-config.shared.ts
 create mode 100644 ui/lib/runtime-config.ts
 create mode 100644 ui/lib/runtime-env.test.ts
 create mode 100644 ui/lib/runtime-env.ts
 create mode 100644 ui/lib/safe-json.test.ts
 create mode 100644 ui/lib/safe-json.ts
 create mode 100644 ui/sentry/sentry.edge.config.test.ts
 create mode 100644 ui/sentry/sentry.server.config.test.ts
 create mode 100644 ui/tests/runtime-config/runtime-config-page.ts
 create mode 100644 ui/tests/runtime-config/runtime-config.md
 create mode 100644 ui/tests/runtime-config/runtime-config.spec.ts

diff --git a/.env b/.env
index c0364e29ae..35417637da 100644
--- a/.env
+++ b/.env
@@ -6,14 +6,20 @@
 PROWLER_UI_VERSION="stable"
 AUTH_URL=http://localhost:3000
 API_BASE_URL=http://prowler-api:8080/api/v1
+# deprecated, use UI_API_BASE_URL
 NEXT_PUBLIC_API_BASE_URL=${API_BASE_URL}
+UI_API_BASE_URL=${API_BASE_URL}
+# deprecated, use UI_API_DOCS_URL
 NEXT_PUBLIC_API_DOCS_URL=http://prowler-api:8080/api/v1/docs
+UI_API_DOCS_URL=http://prowler-api:8080/api/v1/docs
 AUTH_TRUST_HOST=true
 UI_PORT=3000
 # openssl rand -base64 32
 AUTH_SECRET="N/c6mnaS5+SWq81+819OrzQZlmx1Vxtp/orjttJSmw8="
-# Google Tag Manager ID
+# Google Tag Manager ID (empty/unset ⇒ GTM not loaded, zero egress)
+# deprecated, use UI_GOOGLE_TAG_MANAGER_ID
 NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID=""
+UI_GOOGLE_TAG_MANAGER_ID=""
 
 #### MCP Server ####
 PROWLER_MCP_VERSION=stable
@@ -139,10 +145,16 @@ DJANGO_BROKER_VISIBILITY_TIMEOUT=86400
 DJANGO_SENTRY_DSN=
 DJANGO_THROTTLE_TOKEN_OBTAIN=50/minute
 
-# Sentry settings
-SENTRY_ENVIRONMENT=local
+# Sentry for the web app (server + browser). Empty/unset UI_SENTRY_DSN ⇒
+# Sentry disabled, zero egress. SENTRY_RELEASE (unprefixed) feeds the web app's
+# server/edge SDKs.
+UI_SENTRY_DSN=
+UI_SENTRY_ENVIRONMENT=local
 SENTRY_RELEASE=local
-NEXT_PUBLIC_SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
+# Reserved runtime public config (registered now; no UI consumer yet)
+# POSTHOG_KEY=
+# POSTHOG_HOST=
+# REO_DEV_CLIENT_ID=
 
 #### Prowler release version ####
 NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.31.0
diff --git a/.github/workflows/ui-container-build-push.yml b/.github/workflows/ui-container-build-push.yml
index 984256af7f..3210f6e998 100644
--- a/.github/workflows/ui-container-build-push.yml
+++ b/.github/workflows/ui-container-build-push.yml
@@ -32,9 +32,6 @@ env:
   PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud
   PROWLERCLOUD_DOCKERHUB_IMAGE: prowler-ui
 
-  # Build args
-  NEXT_PUBLIC_API_BASE_URL: http://prowler-api:8080/api/v1
-
 permissions: {}
 
 jobs:
@@ -146,7 +143,6 @@ jobs:
           context: ${{ env.WORKING_DIRECTORY }}
           build-args: |
             NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('v{0}', env.RELEASE_TAG) || needs.setup.outputs.short-sha }}
-            NEXT_PUBLIC_API_BASE_URL=${{ env.NEXT_PUBLIC_API_BASE_URL }}
           push: true
           platforms: ${{ matrix.platform }}
           tags: |
diff --git a/.github/workflows/ui-e2e-tests-v2.yml b/.github/workflows/ui-e2e-tests-v2.yml
index ed407e890d..7165882d62 100644
--- a/.github/workflows/ui-e2e-tests-v2.yml
+++ b/.github/workflows/ui-e2e-tests-v2.yml
@@ -40,7 +40,8 @@ jobs:
       AUTH_SECRET: 'fallback-ci-secret-for-testing'
       AUTH_TRUST_HOST: true
       NEXTAUTH_URL: 'http://localhost:3000'
-      NEXT_PUBLIC_API_BASE_URL: 'http://localhost:8080/api/v1'
+      AUTH_URL: 'http://localhost:3000'
+      UI_API_BASE_URL: 'http://localhost:8080/api/v1'
       E2E_ADMIN_USER: ${{ secrets.E2E_ADMIN_USER }}
       E2E_ADMIN_PASSWORD: ${{ secrets.E2E_ADMIN_PASSWORD }}
       E2E_AWS_PROVIDER_ACCOUNT_ID: ${{ secrets.E2E_AWS_PROVIDER_ACCOUNT_ID }}
@@ -165,7 +166,7 @@ jobs:
           timeout=150
           elapsed=0
           while [ $elapsed -lt $timeout ]; do
-            if curl -s ${NEXT_PUBLIC_API_BASE_URL}/docs >/dev/null 2>&1; then
+            if curl -s ${UI_API_BASE_URL}/docs >/dev/null 2>&1; then
               echo "Prowler API is ready!"
               exit 0
             fi
diff --git a/contrib/k8s/helm/prowler-app/templates/ui/configmap.yaml b/contrib/k8s/helm/prowler-app/templates/ui/configmap.yaml
index 38d6e65ee3..856770722a 100644
--- a/contrib/k8s/helm/prowler-app/templates/ui/configmap.yaml
+++ b/contrib/k8s/helm/prowler-app/templates/ui/configmap.yaml
@@ -11,8 +11,7 @@ data:
   {{- else }}
   AUTH_URL: {{ .Values.ui.authUrl | quote }}
   {{- end }}
-  API_BASE_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1"
-  NEXT_PUBLIC_API_BASE_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1"
-  NEXT_PUBLIC_API_DOCS_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1/docs"
+  UI_API_BASE_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1"
+  UI_API_DOCS_URL: "http://{{ include "prowler.fullname" . }}-api:{{ .Values.api.service.port }}/api/v1/docs"
   AUTH_TRUST_HOST: "true"
   UI_PORT: {{ .Values.ui.service.port | quote }}
diff --git a/contrib/k8s/helm/prowler-ui/values.yaml b/contrib/k8s/helm/prowler-ui/values.yaml
index d4f2dbe137..aca0178b3a 100644
--- a/contrib/k8s/helm/prowler-ui/values.yaml
+++ b/contrib/k8s/helm/prowler-ui/values.yaml
@@ -21,8 +21,8 @@ fullnameOverride: ""
 
 secrets:
   SITE_URL: http://localhost:3000
-  API_BASE_URL: http://prowler-api:8080/api/v1
-  NEXT_PUBLIC_API_DOCS_URL: http://prowler-api:8080/api/v1/docs
+  UI_API_BASE_URL: http://prowler-api:8080/api/v1
+  UI_API_DOCS_URL: http://prowler-api:8080/api/v1/docs
   AUTH_TRUST_HOST: True
   UI_PORT: 3000
   # openssl rand -base64 32
diff --git a/docs/developer-guide/end2end-testing.mdx b/docs/developer-guide/end2end-testing.mdx
index 0a62251531..9013a32245 100644
--- a/docs/developer-guide/end2end-testing.mdx
+++ b/docs/developer-guide/end2end-testing.mdx
@@ -221,9 +221,9 @@ Before running E2E tests:
     ```
 
 - **Ensure Prowler API is available**
-  - By default, Playwright uses `NEXT_PUBLIC_API_BASE_URL=http://localhost:8080/api/v1` (configured in `playwright.config.ts`).
+  - By default, Playwright uses `UI_API_BASE_URL=http://localhost:8080/api/v1` (configured in `playwright.config.ts`).
   - Start Prowler API so it is reachable on that URL (for example, via `docker-compose-dev.yml` or the development orchestration used locally).
-  - If a different API URL is required, set `NEXT_PUBLIC_API_BASE_URL` accordingly before running the tests.
+  - If a different API URL is required, set `UI_API_BASE_URL` accordingly before running the tests.
 
 - **Ensure Prowler App UI is available**
   - Playwright automatically starts the Next.js server through the `webServer` block in `playwright.config.ts` (`pnpm run dev` by default).
diff --git a/docs/developer-guide/environment-variables.mdx b/docs/developer-guide/environment-variables.mdx
new file mode 100644
index 0000000000..1f4d17ee2e
--- /dev/null
+++ b/docs/developer-guide/environment-variables.mdx
@@ -0,0 +1,53 @@
+---
+title: 'Environment Variable Naming Convention'
+---
+
+Prowler is a monorepo composed of several runtime components — Prowler App (the web user interface), Prowler API (the backend), Prowler SDK, and Prowler MCP Server (Model Context Protocol) — that frequently share a single `.env` file. To keep that shared configuration unambiguous, each component namespaces its environment variables with a component-specific prefix.
+
+## Component Prefixes
+
+Each component owns a dedicated prefix for the environment variables it reads:
+
+| Component | Prefix | Status |
+|-----------|--------|--------|
+| Prowler App (web UI) | `UI_` | Adopted |
+| Prowler API (backend) | `API_` | Planned |
+| Prowler SDK | `SDK_` | Planned |
+| Prowler MCP Server | `MCP_` | Planned |
+
+## Why Component Prefixes Matter
+
+Component prefixes solve three concrete problems in a shared configuration file:
+
+- **Collisions in a shared `.env`:** Several components historically read identically named variables. The API base URL, for example, is consumed by more than one component, so a single unprefixed name is ambiguous. A component prefix removes that ambiguity.
+- **Explicit ownership:** A prefix states, at a glance, which component consumes a variable.
+- **Reduced accidental exposure:** For Prowler App, scoping browser-facing configuration under one intentional prefix prevents server-only values from leaking into the client bundle.
+
+## Prowler App
+
+Prowler App has adopted the `UI_` prefix. Its public configuration is resolved from the container environment at runtime rather than inlined at build time, so a single pre-built image serves any deployment. For the operational details on changing these values without rebuilding the image, see [Troubleshooting](/troubleshooting).
+
+The former build-time variables map to the new runtime variables as follows:
+
+| Former variable | New variable |
+|-----------------|--------------|
+| `NEXT_PUBLIC_API_BASE_URL` | `UI_API_BASE_URL` |
+| `NEXT_PUBLIC_API_DOCS_URL` | `UI_API_DOCS_URL` |
+| `NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID` | `UI_GOOGLE_TAG_MANAGER_ID` |
+| `NEXT_PUBLIC_SENTRY_DSN`, `SENTRY_DSN` | `UI_SENTRY_DSN` |
+| `NEXT_PUBLIC_SENTRY_ENVIRONMENT`, `SENTRY_ENVIRONMENT` | `UI_SENTRY_ENVIRONMENT` |
+
+The build-time-only Sentry variables used for source-map upload — `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_AUTH_TOKEN`, and `SENTRY_RELEASE` — keep their names, as they are not part of the App's runtime configuration.
+
+## Upcoming Breaking Change
+
+<Warning>
+Adopting the `API_`, `SDK_`, and `MCP_` prefixes for Prowler API, Prowler SDK, and Prowler MCP Server is a planned breaking change in a future release. Migrate environment configuration to the new names when upgrading.
+</Warning>
+
+Prowler API, Prowler SDK, and Prowler MCP Server have not yet adopted the convention. In a future release, the variables each of these components reads will be namespaced under `API_`, `SDK_`, and `MCP_` respectively. The per-component mapping from current to prefixed names will be documented when each change is released.
+
+## Deprecated Names
+
+- **Prowler App:** The bare server-side `SENTRY_DSN` and `SENTRY_ENVIRONMENT` are no longer read; the server and edge runtimes now read `UI_SENTRY_DSN` and `UI_SENTRY_ENVIRONMENT`. The former `NEXT_PUBLIC_*` build-time variables are deprecated but still read at runtime as a fallback when the matching `UI_*` variable is unset. This fallback will be removed in a future release, so set the `UI_*` runtime variables on the running container.
+- **Prowler API, Prowler SDK, and Prowler MCP Server:** The current, unprefixed variable names are deprecated. They continue to work today and will be removed once the prefixed convention is adopted for each component, as described in [Upcoming Breaking Change](#upcoming-breaking-change).
diff --git a/docs/docs.json b/docs/docs.json
index 51c7e739b0..a74aa7e91d 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -417,6 +417,7 @@
             "group": "Miscellaneous",
             "pages": [
               "developer-guide/documentation",
+              "developer-guide/environment-variables",
               {
                 "group": "Testing",
                 "pages": [
diff --git a/docs/troubleshooting.mdx b/docs/troubleshooting.mdx
index 9d60c57321..50cc43a3c0 100644
--- a/docs/troubleshooting.mdx
+++ b/docs/troubleshooting.mdx
@@ -201,35 +201,29 @@ When running Prowler behind a reverse proxy (nginx, Traefik, etc.) or load balan
 
 **Root Cause:**
 
-Next.js environment variables prefixed with `NEXT_PUBLIC_` are **bundled at build time**, not runtime. The pre-built Docker images from Docker Hub (`prowlercloud/prowler-ui:stable`) are built with default internal URLs. Simply setting `NEXT_PUBLIC_API_BASE_URL` in your `.env` file or environment variables and restarting the container will **NOT** work because these values are already compiled into the JavaScript bundle.
+The API base and docs URLs are resolved from the container environment **at runtime**. A single pre-built Docker image (`prowlercloud/prowler-ui:stable`) therefore serves any environment: point the URLs at your external domain and restart the container — no rebuild is required.
 
 **Solution:**
 
-You must **rebuild** the UI Docker image with your external URL:
-
-```bash
-# Clone the repository (if you haven't already)
-git clone https://github.com/prowler-cloud/prowler.git
-cd prowler/ui
-
-# Build with your external URL as a build argument
-docker build \
-  --build-arg NEXT_PUBLIC_API_BASE_URL=https://prowler.example.com/api/v1 \
-  --build-arg NEXT_PUBLIC_API_DOCS_URL=https://prowler.example.com/api/v1/docs \
-  -t prowler-ui-custom:latest \
-  --target prod \
-  .
-```
-
-Then update your `docker-compose.yml` to use your custom image instead of the pre-built one:
+Set the runtime environment variables to your external URL and restart the UI container:
 
 ```yaml
 services:
   ui:
-    image: prowler-ui-custom:latest  # Use your custom-built image
+    image: prowlercloud/prowler-ui:stable
+    environment:
+      UI_API_BASE_URL: https://prowler.example.com/api/v1
+      UI_API_DOCS_URL: https://prowler.example.com/api/v1/docs
     # ... rest of configuration
 ```
 
+The same values can be supplied through your `.env` file:
+
+```bash
+UI_API_BASE_URL=https://prowler.example.com/api/v1
+UI_API_DOCS_URL=https://prowler.example.com/api/v1/docs
+```
+
 <Note>
-The `NEXT_PUBLIC_` prefix is a Next.js convention that exposes environment variables to the browser. Since the browser bundle is compiled during `docker build`, these variables must be provided as build arguments, not runtime environment variables.
+Earlier releases inlined these values into the JavaScript bundle at build time (via the `NEXT_PUBLIC_` prefix) and required a rebuild with `--build-arg`. That is no longer necessary: `UI_API_BASE_URL` and `UI_API_DOCS_URL` are read at container start, so updating them and restarting is sufficient.
 </Note>
diff --git a/ui/CHANGELOG.md b/ui/CHANGELOG.md
index 2cb9f92fcb..97f0dc9830 100644
--- a/ui/CHANGELOG.md
+++ b/ui/CHANGELOG.md
@@ -28,6 +28,14 @@ All notable changes to the **Prowler UI** are documented in this file.
 - Threat Map no longer shows an empty map for accounts that only have Okta or Google Workspace scans [(#11542)](https://github.com/prowler-cloud/prowler/pull/11542)
 - Compliance attributes requests now pass the selected scan, so multi-provider universal frameworks (e.g. CSA CCM) load the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
 
+### 🔄 Changed
+
+- Public SaaS config (Sentry, Google Tag Manager, API base/docs URL) now resolves at container runtime instead of build time; self-hosted deployments set the UI config through the new `UI_`-prefixed env vars (`UI_API_BASE_URL`, `UI_API_DOCS_URL`, `UI_GOOGLE_TAG_MANAGER_ID`, `UI_SENTRY_DSN`, `UI_SENTRY_ENVIRONMENT`), with the previous `NEXT_PUBLIC_*` names still honored as a deprecated fallback [(#11500)](https://github.com/prowler-cloud/prowler/pull/11500)
+
+### 🐞 Fixed
+
+- `ui/.env` template now lists only the canonical `UI_SENTRY_DSN` and `UI_SENTRY_ENVIRONMENT` names; the deprecated `NEXT_PUBLIC_SENTRY_DSN` and `NEXT_PUBLIC_SENTRY_ENVIRONMENT` entries have been removed [(#11500)](https://github.com/prowler-cloud/prowler/pull/11500)
+
 ---
 
 ## [1.30.0] (Prowler v5.30.0)
diff --git a/ui/Dockerfile b/ui/Dockerfile
index 6cf930ee5e..86673ba046 100644
--- a/ui/Dockerfile
+++ b/ui/Dockerfile
@@ -36,12 +36,8 @@ RUN corepack install
 ENV NEXT_TELEMETRY_DISABLED=1
 ARG NEXT_PUBLIC_PROWLER_RELEASE_VERSION
 ENV NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${NEXT_PUBLIC_PROWLER_RELEASE_VERSION}
-ARG NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID
-ENV NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID=${NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID}
-ARG NEXT_PUBLIC_API_BASE_URL
-ENV NEXT_PUBLIC_API_BASE_URL=${NEXT_PUBLIC_API_BASE_URL}
-ARG NEXT_PUBLIC_API_DOCS_URL
-ENV NEXT_PUBLIC_API_DOCS_URL=${NEXT_PUBLIC_API_DOCS_URL}
+
+# GTM / API base+docs URLs are runtime container env (prod stage), not build ARGs.
 
 RUN pnpm run build
 
@@ -78,6 +74,12 @@ EXPOSE 3000
 
 ENV PORT=3000
 ENV HOSTNAME="0.0.0.0"
+# Runtime configuration is read by `node server.js` at container start and is
+# NOT baked into the image. Supply it via your orchestrator (docker-compose,
+# Helm/K8s):
+#   - required: UI_API_BASE_URL, AUTH_URL, AUTH_SECRET (missing ⇒ fail fast at boot)
+#   - optional: UI_API_DOCS_URL, UI_GOOGLE_TAG_MANAGER_ID, UI_SENTRY_DSN, UI_SENTRY_ENVIRONMENT
+#   - reserved: POSTHOG_KEY, POSTHOG_HOST, REO_DEV_CLIENT_ID (no consumer yet)
 # server.js is created by next build from the standalone output
 # https://nextjs.org/docs/pages/api-reference/next-config-js/output
 CMD ["node", "server.js"]
diff --git a/ui/__tests__/msw/handlers/attack-paths.ts b/ui/__tests__/msw/handlers/attack-paths.ts
index 39076666dd..7c76fa574b 100644
--- a/ui/__tests__/msw/handlers/attack-paths.ts
+++ b/ui/__tests__/msw/handlers/attack-paths.ts
@@ -10,7 +10,7 @@ import type {
   QueryResultAttributes,
 } from "@/types/attack-paths";
 
-const API = process.env.NEXT_PUBLIC_API_BASE_URL;
+const API = process.env.UI_API_BASE_URL;
 
 type JsonApiErrorBody = {
   errors: Array<{ detail: string; status: string }>;
diff --git a/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.test.ts b/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.test.ts
index d95966e680..41118bd6e2 100644
--- a/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.test.ts
+++ b/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.test.ts
@@ -14,7 +14,7 @@ const lastFetchCall = (): { url: string; init: RequestInit } => {
 describe("confirmAlertRecipient", () => {
   beforeEach(() => {
     vi.stubGlobal("fetch", fetchMock);
-    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://api.example.com/api/v1");
+    vi.stubEnv("UI_API_BASE_URL", "https://api.example.com/api/v1");
     fetchMock.mockResolvedValue(
       new Response(
         JSON.stringify({
@@ -104,7 +104,8 @@ describe("confirmAlertRecipient", () => {
   });
 
   it("returns the fallback message when the API base URL is missing", async () => {
-    // Given
+    // Given - neither the new name nor its legacy fallback is set
+    vi.stubEnv("UI_API_BASE_URL", "");
     vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "");
 
     // When
@@ -120,6 +121,21 @@ describe("confirmAlertRecipient", () => {
     expect(fetchMock).not.toHaveBeenCalled();
   });
 
+  it("falls back to the deprecated NEXT_PUBLIC_API_BASE_URL when UI_API_BASE_URL is unset", async () => {
+    // Given - only the legacy name is configured
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com/api/v1");
+
+    // When
+    const result = await confirmAlertRecipient("token-1");
+
+    // Then
+    expect(result.ok).toBe(true);
+    expect(lastFetchCall().url).toBe(
+      "https://legacy.example.com/api/v1/alerts/recipients/confirm?token=token-1",
+    );
+  });
+
   it("returns the fallback message when the request fails", async () => {
     // Given
     fetchMock.mockRejectedValueOnce(new Error("network down"));
diff --git a/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.ts b/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.ts
index b567bb4124..19e9216339 100644
--- a/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.ts
+++ b/ui/app/(auth)/alerts/confirm/confirm-alert-recipient.ts
@@ -1,3 +1,5 @@
+import { readEnv } from "@/lib/runtime-env";
+
 interface AlertConfirmApiResponse {
   state?: string;
   message?: string;
@@ -41,7 +43,7 @@ const toState = (payload: unknown): string => {
 export const confirmAlertRecipient = async (
   token?: string,
 ): Promise<AlertConfirmResult> => {
-  const apiBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL;
+  const apiBaseUrl = readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL");
   if (!apiBaseUrl) {
     return {
       ok: false,
diff --git a/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.test.ts b/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.test.ts
index 8a595fa63e..508625b4be 100644
--- a/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.test.ts
+++ b/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.test.ts
@@ -14,7 +14,7 @@ const lastFetchCall = (): { url: string; init: RequestInit } => {
 describe("unsubscribeAlertRecipient", () => {
   beforeEach(() => {
     vi.stubGlobal("fetch", fetchMock);
-    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://api.example.com/api/v1");
+    vi.stubEnv("UI_API_BASE_URL", "https://api.example.com/api/v1");
     fetchMock.mockResolvedValue(
       new Response(
         JSON.stringify({
@@ -102,4 +102,37 @@ describe("unsubscribeAlertRecipient", () => {
       "https://api.example.com/api/v1/alerts/recipients/unsubscribe",
     );
   });
+
+  it("returns the fallback message when the API base URL is missing", async () => {
+    // Given - neither the new name nor its legacy fallback is set
+    vi.stubEnv("UI_API_BASE_URL", "");
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "");
+
+    // When
+    const result = await unsubscribeAlertRecipient("token-1");
+
+    // Then
+    expect(result).toEqual({
+      ok: false,
+      state: "missing_api_base_url",
+      message:
+        "We could not process this unsubscribe link. Please try again later.",
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("falls back to the deprecated NEXT_PUBLIC_API_BASE_URL when UI_API_BASE_URL is unset", async () => {
+    // Given - only the legacy name is configured
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com/api/v1");
+
+    // When
+    const result = await unsubscribeAlertRecipient("token-1");
+
+    // Then
+    expect(result.ok).toBe(true);
+    expect(lastFetchCall().url).toBe(
+      "https://legacy.example.com/api/v1/alerts/recipients/unsubscribe?token=token-1",
+    );
+  });
 });
diff --git a/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.ts b/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.ts
index af64165a1e..8c3a4e2a79 100644
--- a/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.ts
+++ b/ui/app/(auth)/alerts/unsubscribe/unsubscribe-alert-recipient.ts
@@ -1,3 +1,5 @@
+import { readEnv } from "@/lib/runtime-env";
+
 interface AlertUnsubscribeApiResponse {
   state?: string;
   message?: string;
@@ -41,7 +43,7 @@ const toState = (payload: unknown): string => {
 export const unsubscribeAlertRecipient = async (
   token?: string,
 ): Promise<AlertUnsubscribeResult> => {
-  const apiBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL;
+  const apiBaseUrl = readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL");
   if (!apiBaseUrl) {
     return {
       ok: false,
diff --git a/ui/app/(auth)/layout.tsx b/ui/app/(auth)/layout.tsx
index 07fe3a60c3..79a4ce4e89 100644
--- a/ui/app/(auth)/layout.tsx
+++ b/ui/app/(auth)/layout.tsx
@@ -2,12 +2,15 @@ import "@/styles/globals.css";
 
 import { GoogleTagManager } from "@next/third-parties/google";
 import { Metadata, Viewport } from "next";
+import { connection } from "next/server";
 import { ReactNode, Suspense } from "react";
 
+import { RuntimePublicConfig } from "@/components/runtime-config/runtime-public-config";
 import { NavigationProgress, Toaster } from "@/components/ui";
 import { fontSans } from "@/config/fonts";
 import { siteConfig } from "@/config/site";
 import { cn } from "@/lib";
+import { readEnv } from "@/lib/runtime-env";
 
 import { Providers } from "../providers";
 
@@ -29,10 +32,27 @@ export const viewport: Viewport = {
   ],
 };
 
-export default function AuthLayout({ children }: { children: ReactNode }) {
+export default async function AuthLayout({
+  children,
+}: {
+  children: ReactNode;
+}) {
+  // Force dynamic rendering so the read below resolves from the container env
+  // at request time rather than being snapshotted at build (independent of the
+  // <RuntimePublicConfig/> island's own connection() call).
+  await connection();
+
+  // Server-side runtime read. Empty/unset id ⇒ GoogleTagManager is not mounted
+  const gtmId = readEnv(
+    "UI_GOOGLE_TAG_MANAGER_ID",
+    "NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID",
+  );
+
   return (
     <html suppressHydrationWarning lang="en">
-      <head />
+      <head>
+        <RuntimePublicConfig />
+      </head>
       <body
         suppressHydrationWarning
         className={cn(
@@ -46,9 +66,7 @@ export default function AuthLayout({ children }: { children: ReactNode }) {
           </Suspense>
           {children}
           <Toaster />
-          <GoogleTagManager
-            gtmId={process.env.NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID || ""}
-          />
+          {gtmId && <GoogleTagManager gtmId={gtmId} />}
         </Providers>
       </body>
     </html>
diff --git a/ui/app/(prowler)/layout.tsx b/ui/app/(prowler)/layout.tsx
index a093232e1c..2554ab02b9 100644
--- a/ui/app/(prowler)/layout.tsx
+++ b/ui/app/(prowler)/layout.tsx
@@ -11,6 +11,7 @@ import {
   OnboardingGate,
   OnboardingSequenceBanner,
 } from "@/components/onboarding";
+import { RuntimePublicConfig } from "@/components/runtime-config/runtime-public-config";
 import MainLayout from "@/components/ui/main-layout/main-layout";
 import { NavigationProgress } from "@/components/ui/navigation-progress";
 import { Toaster } from "@/components/ui/toast";
@@ -76,7 +77,9 @@ export default async function RootLayout({
 
   return (
     <html suppressHydrationWarning lang="en">
-      <head />
+      <head>
+        <RuntimePublicConfig />
+      </head>
       <body
         suppressHydrationWarning
         className={cn(
diff --git a/ui/app/instrumentation.client.ts b/ui/app/instrumentation.client.ts
deleted file mode 100644
index a9abf3f345..0000000000
--- a/ui/app/instrumentation.client.ts
+++ /dev/null
@@ -1,121 +0,0 @@
-"use client";
-
-/**
- * Client-side Sentry instrumentation
- *
- * This file is automatically loaded by Next.js in the browser via the instrumentation hook.
- * It configures Sentry for client-side error tracking and performance monitoring.
- *
- * For server-side configuration, see: instrumentation.ts
- * For runtime-specific configs, see: sentry/sentry.server.config.ts and sentry/sentry.edge.config.ts
- */
-
-import * as Sentry from "@sentry/nextjs";
-
-const SENTRY_DSN = process.env.NEXT_PUBLIC_SENTRY_DSN;
-
-// Only initialize Sentry in the browser (not during SSR)
-if (typeof window !== "undefined" && SENTRY_DSN) {
-  const isDevelopment = process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT === "local";
-
-  /**
-   * Initialize Sentry error tracking and performance monitoring
-   *
-   * This setup includes:
-   * - Performance monitoring with Web Vitals tracking (LCP, FID, CLS, INP)
-   * - Long task detection for UI-blocking operations
-   * - beforeSend hook to filter noise
-   */
-  Sentry.init({
-    // 📍 DSN - Data Source Name (identifies your Sentry project)
-    dsn: SENTRY_DSN,
-
-    // 🌍 Environment - Separate dev errors from production
-    environment: process.env.NEXT_PUBLIC_SENTRY_ENVIRONMENT || "local",
-
-    // 📦 Release - Track which version has the error
-    release: process.env.NEXT_PUBLIC_PROWLER_RELEASE_VERSION,
-
-    // 🐛 Debug - Detailed logs in development console
-    debug: isDevelopment,
-
-    // 📊 Sample Rates - Performance monitoring
-    // 100% in dev (test everything), 50% in production (balance visibility with costs)
-    tracesSampleRate: isDevelopment ? 1.0 : 0.5,
-    profilesSampleRate: isDevelopment ? 1.0 : 0.5,
-
-    // 🔌 Integrations - browserTracingIntegration is client-only
-    integrations: [
-      // 📊 Performance Monitoring: Core Web Vitals + RUM
-      // Tracks LCP, FID, CLS, INP
-      // Real User Monitoring captures actual user experience, not synthetic tests
-      Sentry.browserTracingIntegration({
-        enableLongTask: true, // Detect tasks that block UI (>50ms)
-        enableInp: true, // Interaction to Next Paint (Core Web Vital)
-      }),
-    ],
-
-    // 🎣 beforeSend Hook - Filter or modify events before sending to Sentry
-    ignoreErrors: [
-      // Browser extensions
-      "top.GLOBALS",
-      // Random network errors
-      "Network request failed",
-      "NetworkError",
-      "Failed to fetch",
-      // User canceled actions
-      "AbortError",
-      "Non-Error promise rejection captured",
-      // NextAuth expected errors
-      "NEXT_REDIRECT",
-      // ResizeObserver errors (common browser quirk, not real bugs)
-      "ResizeObserver",
-    ],
-
-    beforeSend(event, hint) {
-      // Filter out noise: ResizeObserver errors (common browser quirk, not real bugs)
-      if (event.message?.includes("ResizeObserver")) {
-        return null; // Don't send to Sentry
-      }
-
-      // Filter out non-actionable errors
-      if (event.exception) {
-        const error = hint.originalException;
-
-        // Don't send cancelled requests
-        if (
-          error &&
-          typeof error === "object" &&
-          "name" in error &&
-          error.name === "AbortError"
-        ) {
-          return null;
-        }
-
-        // Add additional context for API errors
-        if (
-          error &&
-          typeof error === "object" &&
-          "message" in error &&
-          typeof error.message === "string" &&
-          error.message.includes("Request failed")
-        ) {
-          event.tags = {
-            ...event.tags,
-            error_type: "api_error",
-          };
-        }
-      }
-
-      return event; // Send to Sentry
-    },
-  });
-
-  // 👤 Set user context (identifies who experienced the error)
-  // In production, this will be updated after authentication
-  if (isDevelopment) {
-    Sentry.setUser({
-      id: "dev-user",
-    });
-  }
-}
diff --git a/ui/app/providers.tsx b/ui/app/providers.tsx
index 7bda5d45fe..41157df06c 100644
--- a/ui/app/providers.tsx
+++ b/ui/app/providers.tsx
@@ -1,8 +1,5 @@
 "use client";
 
-// Import Sentry client-side initialization
-import "@/app/instrumentation.client";
-
 import { HeroUIProvider } from "@heroui/system";
 import { useRouter } from "next/navigation";
 import { SessionProvider } from "next-auth/react";
diff --git a/ui/components/integrations/saml/saml-config-form.tsx b/ui/components/integrations/saml/saml-config-form.tsx
index a995fffceb..935f5412e9 100644
--- a/ui/components/integrations/saml/saml-config-form.tsx
+++ b/ui/components/integrations/saml/saml-config-form.tsx
@@ -18,7 +18,7 @@ import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
 import { CustomServerInput } from "@/components/ui/custom";
 import { CustomLink } from "@/components/ui/custom/custom-link";
 import { FormButtons } from "@/components/ui/form";
-import { apiBaseUrl } from "@/lib";
+import { useRuntimeConfig } from "@/hooks/use-runtime-config";
 
 const validateXMLContent = (
   xmlContent: string,
@@ -253,10 +253,12 @@ export const SamlConfigForm = ({
     reader.readAsText(file);
   };
 
+  const { apiBaseUrl } = useRuntimeConfig();
   const trimmedEmailDomain = emailDomain.trim();
-  const acsUrl = trimmedEmailDomain
-    ? `${apiBaseUrl}/accounts/saml/${trimmedEmailDomain}/acs/`
-    : "";
+  const acsUrl =
+    trimmedEmailDomain && apiBaseUrl
+      ? `${apiBaseUrl}/accounts/saml/${trimmedEmailDomain}/acs/`
+      : "";
 
   return (
     <form
diff --git a/ui/components/runtime-config/runtime-public-config.tsx b/ui/components/runtime-config/runtime-public-config.tsx
new file mode 100644
index 0000000000..1069ac58d2
--- /dev/null
+++ b/ui/components/runtime-config/runtime-public-config.tsx
@@ -0,0 +1,17 @@
+import { getRuntimePublicConfig } from "@/lib/runtime-config";
+import { RUNTIME_CONFIG_SCRIPT_ID } from "@/lib/runtime-config.shared";
+import { serializeForScript } from "@/lib/safe-json";
+
+// Inert JSON config island (type="application/json") rendered in <head> before
+// the client bundle, so module-load consumers (Sentry init) read it race-free.
+export async function RuntimePublicConfig() {
+  const config = await getRuntimePublicConfig();
+
+  return (
+    <script
+      id={RUNTIME_CONFIG_SCRIPT_ID}
+      type="application/json"
+      dangerouslySetInnerHTML={{ __html: serializeForScript(config) }}
+    />
+  );
+}
diff --git a/ui/components/ui/sidebar/menu.tsx b/ui/components/ui/sidebar/menu.tsx
index a36da25934..c2ba5d6c28 100644
--- a/ui/components/ui/sidebar/menu.tsx
+++ b/ui/components/ui/sidebar/menu.tsx
@@ -15,6 +15,7 @@ import { ScrollArea } from "@/components/ui/scroll-area/scroll-area";
 import { CollapsibleMenu } from "@/components/ui/sidebar/collapsible-menu";
 import { MenuItem } from "@/components/ui/sidebar/menu-item";
 import { useAuth } from "@/hooks";
+import { useRuntimeConfig } from "@/hooks/use-runtime-config";
 import { getMenuList } from "@/lib/menu-list";
 import { LAUNCH_SCAN_HREF } from "@/lib/scans-navigation";
 import { cn } from "@/lib/utils";
@@ -61,9 +62,11 @@ export const Menu = ({ isOpen }: { isOpen: boolean }) => {
     (state) => state.openLaunchScanModal,
   );
   const isScansPage = pathname.startsWith("/scans");
+  const { apiDocsUrl } = useRuntimeConfig();
 
   const menuList = getMenuList({
     pathname,
+    apiDocsUrl,
   });
 
   const labelsToHide = MENU_HIDE_RULES.filter((rule) =>
diff --git a/ui/hooks/use-runtime-config.test.ts b/ui/hooks/use-runtime-config.test.ts
new file mode 100644
index 0000000000..60cac41295
--- /dev/null
+++ b/ui/hooks/use-runtime-config.test.ts
@@ -0,0 +1,52 @@
+import { renderHook } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { RUNTIME_CONFIG_SCRIPT_ID } from "@/lib/runtime-config.shared";
+
+const writeIsland = (content: string) => {
+  const el = document.createElement("script");
+  el.id = RUNTIME_CONFIG_SCRIPT_ID;
+  el.type = "application/json";
+  el.textContent = content;
+  document.head.appendChild(el);
+};
+
+describe("useRuntimeConfig", () => {
+  beforeEach(() => {
+    // Reset modules so the underlying reader's memoization cache starts empty.
+    vi.resetModules();
+    document.head.innerHTML = "";
+  });
+
+  afterEach(() => {
+    document.head.innerHTML = "";
+  });
+
+  it("should expose the runtime config island to client components", async () => {
+    // Given
+    writeIsland(
+      JSON.stringify({ apiDocsUrl: "https://self-hosted.example/api/v1/docs" }),
+    );
+    const { useRuntimeConfig } = await import("./use-runtime-config");
+
+    // When
+    const { result } = renderHook(() => useRuntimeConfig());
+
+    // Then
+    expect(result.current.apiDocsUrl).toBe(
+      "https://self-hosted.example/api/v1/docs",
+    );
+  });
+
+  it("should return an all-null config when the island is absent", async () => {
+    // Given no island in the document
+    const { useRuntimeConfig } = await import("./use-runtime-config");
+
+    // When
+    const { result } = renderHook(() => useRuntimeConfig());
+
+    // Then
+    expect(result.current.apiDocsUrl).toBeNull();
+    expect(result.current.apiBaseUrl).toBeNull();
+  });
+});
diff --git a/ui/hooks/use-runtime-config.ts b/ui/hooks/use-runtime-config.ts
new file mode 100644
index 0000000000..86118a0a91
--- /dev/null
+++ b/ui/hooks/use-runtime-config.ts
@@ -0,0 +1,25 @@
+"use client";
+
+import { useSyncExternalStore } from "react";
+
+import { getRuntimeConfigClient } from "@/lib/get-runtime-config.client";
+import {
+  EMPTY_RUNTIME_PUBLIC_CONFIG,
+  type RuntimePublicConfig,
+} from "@/lib/runtime-config.shared";
+
+// The island is browser-only, so SSR and the first hydration render must see
+// the empty config to avoid a mismatch; useSyncExternalStore swaps to the
+// island value afterwards. Both snapshots must be referentially stable.
+const subscribe = () => () => {}; // config is immutable after load — never notifies
+
+const getServerSnapshot = (): RuntimePublicConfig =>
+  EMPTY_RUNTIME_PUBLIC_CONFIG;
+
+export function useRuntimeConfig(): RuntimePublicConfig {
+  return useSyncExternalStore(
+    subscribe,
+    getRuntimeConfigClient,
+    getServerSnapshot,
+  );
+}
diff --git a/ui/instrumentation-client.test.ts b/ui/instrumentation-client.test.ts
new file mode 100644
index 0000000000..69728d5426
--- /dev/null
+++ b/ui/instrumentation-client.test.ts
@@ -0,0 +1,97 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { EMPTY_RUNTIME_PUBLIC_CONFIG } from "@/lib/runtime-config.shared";
+
+// Stable mock fns shared across module re-evaluations (resetModules clears the
+// module registry but these hoisted fns survive, so assertions stay reliable).
+const { initMock, setUserMock, captureMock, getConfigMock } = vi.hoisted(
+  () => ({
+    initMock: vi.fn(),
+    setUserMock: vi.fn(),
+    captureMock: vi.fn(),
+    getConfigMock: vi.fn(),
+  }),
+);
+
+vi.mock("@sentry/nextjs", () => ({
+  init: initMock,
+  setUser: setUserMock,
+  captureRouterTransitionStart: captureMock,
+  browserTracingIntegration: vi.fn(() => ({})),
+}));
+
+vi.mock("@/lib/get-runtime-config.client", () => ({
+  getRuntimeConfigClient: getConfigMock,
+}));
+
+vi.mock("@/components/ui/navigation-progress/use-navigation-progress", () => ({
+  startProgress: vi.fn(),
+  cancelProgress: vi.fn(),
+}));
+
+describe("instrumentation-client Sentry init", () => {
+  beforeEach(() => {
+    // Re-evaluate the module per case so its top-level init guard re-runs.
+    vi.resetModules();
+    initMock.mockClear();
+    setUserMock.mockClear();
+    captureMock.mockClear();
+    getConfigMock.mockReset();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("initializes Sentry with the runtime DSN and the build-time release when a DSN is present", async () => {
+    // Given
+    getConfigMock.mockReturnValue({
+      ...EMPTY_RUNTIME_PUBLIC_CONFIG,
+      sentryDsn: "https://key@o0.ingest.sentry.io/1",
+      sentryEnvironment: "pro",
+    });
+    // The browser release comes from the build-time public version (D10);
+    // SENTRY_RELEASE is non-public and never reaches the client.
+    vi.stubEnv("NEXT_PUBLIC_PROWLER_RELEASE_VERSION", "1.30.0");
+
+    // When
+    await import("@/instrumentation-client");
+
+    // Then
+    expect(initMock).toHaveBeenCalledTimes(1);
+    expect(initMock.mock.calls[0][0]).toMatchObject({
+      dsn: "https://key@o0.ingest.sentry.io/1",
+      environment: "pro",
+      release: "1.30.0",
+    });
+  });
+
+  it("does not initialize Sentry when the DSN is absent", async () => {
+    // Given
+    getConfigMock.mockReturnValue({ ...EMPTY_RUNTIME_PUBLIC_CONFIG });
+
+    // When
+    await import("@/instrumentation-client");
+
+    // Then
+    expect(initMock).not.toHaveBeenCalled();
+  });
+
+  it("defaults to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT does not enable dev mode", async () => {
+    // Given - DSN set but environment unset
+    getConfigMock.mockReturnValue({
+      ...EMPTY_RUNTIME_PUBLIC_CONFIG,
+      sentryDsn: "https://key@o0.ingest.sentry.io/1",
+    });
+
+    // When
+    await import("@/instrumentation-client");
+
+    // Then
+    const options = initMock.mock.calls[0][0];
+    expect(options.environment).toBe("production");
+    expect(options.debug).toBe(false);
+    expect(options.tracesSampleRate).toBe(0.5);
+    expect(setUserMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/instrumentation-client.ts b/ui/instrumentation-client.ts
index 379acea50d..abced8232e 100644
--- a/ui/instrumentation-client.ts
+++ b/ui/instrumentation-client.ts
@@ -1,16 +1,26 @@
 /**
  * Next.js Client Instrumentation
  *
- * This file runs on the client before React hydration.
- * Used to set up navigation progress tracking.
+ * This file runs on the client BEFORE React hydration. It is responsible for:
+ * - Initializing browser Sentry from the runtime data island, so a single
+ *   prebuilt image enables/disables Sentry per deployment via `UI_SENTRY_DSN`
+ *   (unset DSN ⇒ `Sentry.init` is never called ⇒ zero egress).
+ * - Driving the navigation progress bar on router transitions.
+ *
+ * Running here (rather than in a React effect) means Sentry is configured
+ * before hydration, so browserTracing's performance observers attach early and
+ * the error boundary in `global-error.tsx` is covered.
  *
  * @see https://nextjs.org/docs/app/api-reference/file-conventions/instrumentation-client
  */
 
+import * as Sentry from "@sentry/nextjs";
+
 import {
   cancelProgress,
   startProgress,
 } from "@/components/ui/navigation-progress/use-navigation-progress";
+import { getRuntimeConfigClient } from "@/lib/get-runtime-config.client";
 
 export const NAVIGATION_TYPE = {
   PUSH: "push",
@@ -20,17 +30,133 @@ export const NAVIGATION_TYPE = {
 
 type NavigationType = (typeof NAVIGATION_TYPE)[keyof typeof NAVIGATION_TYPE];
 
+const { sentryDsn, sentryEnvironment } = getRuntimeConfigClient();
+
+// Only initialize Sentry in the browser when a runtime DSN is configured.
+if (typeof window !== "undefined" && sentryDsn) {
+  // Default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT never
+  // runs the browser SDK in dev mode (debug logging, 100% sampling, synthetic
+  // dev user); only an explicit "local" enables it.
+  const environment = sentryEnvironment ?? "production";
+  const isDevelopment = environment === "local";
+
+  /**
+   * Initialize Sentry error tracking and performance monitoring.
+   *
+   * This setup includes:
+   * - Performance monitoring with Web Vitals tracking (LCP, FID, CLS, INP)
+   * - Long task detection for UI-blocking operations
+   * - beforeSend hook to filter noise
+   */
+  Sentry.init({
+    // 📍 DSN - resolved at runtime from the data island
+    dsn: sentryDsn,
+
+    // 🌍 Environment - separate dev errors from production
+    environment,
+
+    // 📦 Release - the browser can only read the build-time public release
+    // version; SENTRY_RELEASE is non-public and never reaches the client. The
+    // server/edge SDKs read SENTRY_RELEASE for parity (D10). No new release var.
+    release: process.env.NEXT_PUBLIC_PROWLER_RELEASE_VERSION,
+
+    // 🐛 Debug - detailed logs in development console
+    debug: isDevelopment,
+
+    // 📊 Sample Rates - Performance monitoring
+    // 100% in dev (test everything), 50% in production (balance visibility with costs)
+    tracesSampleRate: isDevelopment ? 1.0 : 0.5,
+    profilesSampleRate: isDevelopment ? 1.0 : 0.5,
+
+    // 🔌 Integrations - browserTracingIntegration is client-only
+    integrations: [
+      // 📊 Performance Monitoring: Core Web Vitals + RUM
+      // Tracks LCP, FID, CLS, INP
+      Sentry.browserTracingIntegration({
+        enableLongTask: true, // Detect tasks that block UI (>50ms)
+        enableInp: true, // Interaction to Next Paint (Core Web Vital)
+      }),
+    ],
+
+    // 🎣 Filter expected errors / noise before sending to Sentry
+    ignoreErrors: [
+      // Browser extensions
+      "top.GLOBALS",
+      // Random network errors
+      "Network request failed",
+      "NetworkError",
+      "Failed to fetch",
+      // User canceled actions
+      "AbortError",
+      "Non-Error promise rejection captured",
+      // NextAuth expected errors
+      "NEXT_REDIRECT",
+      // ResizeObserver errors (common browser quirk, not real bugs)
+      "ResizeObserver",
+    ],
+
+    beforeSend(event, hint) {
+      // Filter out noise: ResizeObserver errors (common browser quirk, not real bugs)
+      if (event.message?.includes("ResizeObserver")) {
+        return null; // Don't send to Sentry
+      }
+
+      // Filter out non-actionable errors
+      if (event.exception) {
+        const error = hint.originalException;
+
+        // Don't send cancelled requests
+        if (
+          error &&
+          typeof error === "object" &&
+          "name" in error &&
+          error.name === "AbortError"
+        ) {
+          return null;
+        }
+
+        // Add additional context for API errors
+        if (
+          error &&
+          typeof error === "object" &&
+          "message" in error &&
+          typeof error.message === "string" &&
+          error.message.includes("Request failed")
+        ) {
+          event.tags = {
+            ...event.tags,
+            error_type: "api_error",
+          };
+        }
+      }
+
+      return event; // Send to Sentry
+    },
+  });
+
+  // 👤 Set user context (identifies who experienced the error)
+  // In production, this will be updated after authentication
+  if (isDevelopment) {
+    Sentry.setUser({
+      id: "dev-user",
+    });
+  }
+}
+
 function getCurrentUrl(): string {
   return window.location.pathname + window.location.search;
 }
 
 /**
  * Called by Next.js when router navigation begins.
- * Triggers the navigation progress bar.
+ *
+ * Triggers the navigation progress bar AND forwards the transition to Sentry
+ * (`captureRouterTransitionStart` is a safe no-op when Sentry is
+ * uninitialized).
  */
 export function onRouterTransitionStart(
   url: string,
-  _navigationType: NavigationType,
+  navigationType: NavigationType,
 ) {
   const currentUrl = getCurrentUrl();
 
@@ -41,4 +167,6 @@ export function onRouterTransitionStart(
     // Different URL - start progress
     startProgress();
   }
+
+  Sentry.captureRouterTransitionStart(url, navigationType);
 }
diff --git a/ui/instrumentation.ts b/ui/instrumentation.ts
index 0092bd29b5..6716ffeb4e 100644
--- a/ui/instrumentation.ts
+++ b/ui/instrumentation.ts
@@ -9,18 +9,23 @@
  *    - sentry/sentry.server.config.ts (Node.js runtime)
  *    - sentry/sentry.edge.config.ts (Edge runtime)
  * 3. Client-side init:
- *    - app/instrumentation.client.ts (Browser/Client)
+ *    - instrumentation-client.ts (Browser/Client; reads the runtime data island)
  *
  * @see https://nextjs.org/docs/app/building-your-application/optimizing/instrumentation
  */
 
+// Fail fast at server boot if required runtime env is missing.
+import "@/lib/env";
+
 import * as Sentry from "@sentry/nextjs";
 
-const SENTRY_DSN = process.env.SENTRY_DSN;
+import { readEnv } from "@/lib/runtime-env";
+
+const sentryDsn = readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN");
 
 export async function register() {
   // Skip Sentry initialization if DSN is not configured
-  if (!SENTRY_DSN) {
+  if (!sentryDsn) {
     return;
   }
 
@@ -35,6 +40,6 @@ export async function register() {
 }
 
 // Only capture request errors if Sentry is configured
-export const onRequestError = SENTRY_DSN
+export const onRequestError = sentryDsn
   ? Sentry.captureRequestError
   : undefined;
diff --git a/ui/lib/env.test.ts b/ui/lib/env.test.ts
new file mode 100644
index 0000000000..5824bbeab0
--- /dev/null
+++ b/ui/lib/env.test.ts
@@ -0,0 +1,46 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+describe("lib/env boot assertion", () => {
+  beforeEach(() => {
+    // Re-evaluate the module per case so its top-level assertion re-runs.
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("throws a clear error when a required env var is missing", async () => {
+    // Given - UI_API_BASE_URL and its legacy empty, the others present
+    vi.stubEnv("UI_API_BASE_URL", "");
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "");
+    vi.stubEnv("AUTH_URL", "http://localhost:3000");
+    vi.stubEnv("AUTH_SECRET", "secret");
+
+    // When / Then
+    await expect(import("@/lib/env")).rejects.toThrow(
+      "Missing required env: UI_API_BASE_URL",
+    );
+  });
+
+  it("does not throw when every required env var is present", async () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "https://api.example.com/api/v1");
+    vi.stubEnv("AUTH_URL", "http://localhost:3000");
+    vi.stubEnv("AUTH_SECRET", "secret");
+
+    // When / Then
+    await expect(import("@/lib/env")).resolves.toBeDefined();
+  });
+
+  it("accepts the deprecated NEXT_PUBLIC_API_BASE_URL as a fallback", async () => {
+    // Given - the new name is unset but the legacy name is configured
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://api.example.com/api/v1");
+    vi.stubEnv("AUTH_URL", "http://localhost:3000");
+    vi.stubEnv("AUTH_SECRET", "secret");
+
+    // When / Then
+    await expect(import("@/lib/env")).resolves.toBeDefined();
+  });
+});
diff --git a/ui/lib/env.ts b/ui/lib/env.ts
new file mode 100644
index 0000000000..33057e60d4
--- /dev/null
+++ b/ui/lib/env.ts
@@ -0,0 +1,21 @@
+import { readEnv } from "@/lib/runtime-env";
+
+// Boot-time required-env assertion so a misconfigured container fails fast
+// with a clear message. A key with a deprecated legacy name is satisfied by
+// either name (see readEnv).
+const REQUIRED: ReadonlyArray<{
+  key: keyof NodeJS.ProcessEnv;
+  legacy?: keyof NodeJS.ProcessEnv;
+}> = [
+  { key: "UI_API_BASE_URL", legacy: "NEXT_PUBLIC_API_BASE_URL" },
+  { key: "AUTH_URL" },
+  { key: "AUTH_SECRET" },
+];
+
+for (const { key, legacy } of REQUIRED) {
+  if (!readEnv(key, legacy)) {
+    throw new Error(`Missing required env: ${key}`);
+  }
+}
+
+export {};
diff --git a/ui/lib/get-runtime-config.client.test.ts b/ui/lib/get-runtime-config.client.test.ts
new file mode 100644
index 0000000000..553c3be421
--- /dev/null
+++ b/ui/lib/get-runtime-config.client.test.ts
@@ -0,0 +1,115 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import { RUNTIME_CONFIG_SCRIPT_ID } from "./runtime-config.shared";
+
+const writeIsland = (content: string) => {
+  const el = document.createElement("script");
+  el.id = RUNTIME_CONFIG_SCRIPT_ID;
+  el.type = "application/json";
+  // textContent (not innerHTML) mirrors how the browser parses an
+  // application/json island: the escaped < sequences are already decoded.
+  el.textContent = content;
+  document.head.appendChild(el);
+};
+
+describe("getRuntimeConfigClient", () => {
+  beforeEach(() => {
+    // Reset modules so each dynamic import re-evaluates the file and its
+    // module-level memoization cache starts empty.
+    vi.resetModules();
+    document.head.innerHTML = "";
+  });
+
+  afterEach(() => {
+    document.head.innerHTML = "";
+  });
+
+  it("parses the data island when present", async () => {
+    // Given
+    writeIsland(
+      JSON.stringify({
+        sentryDsn: "https://key@o0.ingest.sentry.io/1",
+        apiBaseUrl: "https://api.example.com/api/v1",
+      }),
+    );
+    const { getRuntimeConfigClient } = await import(
+      "./get-runtime-config.client"
+    );
+
+    // When
+    const config = getRuntimeConfigClient();
+
+    // Then
+    expect(config.sentryDsn).toBe("https://key@o0.ingest.sentry.io/1");
+    expect(config.apiBaseUrl).toBe("https://api.example.com/api/v1");
+    // Keys not present in the island fall back to null.
+    expect(config.googleTagManagerId).toBeNull();
+    expect(config.posthogKey).toBeNull();
+  });
+
+  it("falls back to an all-null config when the island is absent", async () => {
+    // Given no island in the document
+    const { getRuntimeConfigClient } = await import(
+      "./get-runtime-config.client"
+    );
+
+    // When
+    const config = getRuntimeConfigClient();
+
+    // Then
+    expect(config.sentryDsn).toBeNull();
+    expect(config.apiBaseUrl).toBeNull();
+    expect(config.reoDevClientId).toBeNull();
+  });
+
+  it("falls back to an all-null config when the island is malformed JSON", async () => {
+    // Given
+    writeIsland("{ not valid json");
+    const { getRuntimeConfigClient } = await import(
+      "./get-runtime-config.client"
+    );
+
+    // When
+    const config = getRuntimeConfigClient();
+
+    // Then
+    expect(config.sentryDsn).toBeNull();
+    expect(config.apiBaseUrl).toBeNull();
+  });
+
+  it("exposes only the allowlisted keys and ignores anything extra", async () => {
+    // Given an island carrying an unexpected key and a __proto__ payload
+    writeIsland(
+      JSON.stringify({
+        apiBaseUrl: "https://api.example.com/api/v1",
+        notAllowlisted: "should-not-survive",
+        __proto__: { polluted: true },
+      }),
+    );
+    const { getRuntimeConfigClient } = await import(
+      "./get-runtime-config.client"
+    );
+
+    // When
+    const config = getRuntimeConfigClient();
+
+    // Then - exactly the eight allowlisted keys, nothing else
+    expect(Object.keys(config).sort()).toEqual(
+      [
+        "apiBaseUrl",
+        "apiDocsUrl",
+        "googleTagManagerId",
+        "posthogHost",
+        "posthogKey",
+        "reoDevClientId",
+        "sentryDsn",
+        "sentryEnvironment",
+      ].sort(),
+    );
+    expect(config.apiBaseUrl).toBe("https://api.example.com/api/v1");
+    expect(
+      (config as unknown as Record<string, unknown>).notAllowlisted,
+    ).toBeUndefined();
+    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
+  });
+});
diff --git a/ui/lib/get-runtime-config.client.ts b/ui/lib/get-runtime-config.client.ts
new file mode 100644
index 0000000000..c27378d6f9
--- /dev/null
+++ b/ui/lib/get-runtime-config.client.ts
@@ -0,0 +1,43 @@
+"use client";
+
+import {
+  EMPTY_RUNTIME_PUBLIC_CONFIG,
+  RUNTIME_CONFIG_SCRIPT_ID,
+  type RuntimePublicConfig,
+} from "@/lib/runtime-config.shared";
+
+let cached: RuntimePublicConfig | null = null;
+
+// Explicit per-key copy (not a spread) so unexpected island keys can't leak through.
+const pickConfig = (
+  parsed: Partial<RuntimePublicConfig>,
+): RuntimePublicConfig => ({
+  sentryDsn: parsed.sentryDsn ?? null,
+  sentryEnvironment: parsed.sentryEnvironment ?? null,
+  googleTagManagerId: parsed.googleTagManagerId ?? null,
+  apiBaseUrl: parsed.apiBaseUrl ?? null,
+  apiDocsUrl: parsed.apiDocsUrl ?? null,
+  posthogKey: parsed.posthogKey ?? null,
+  posthogHost: parsed.posthogHost ?? null,
+  reoDevClientId: parsed.reoDevClientId ?? null,
+});
+
+// Reads the <head> island once (memoized); all-null during SSR or if it's
+// missing/malformed, so callers can treat every integration as disabled.
+export function getRuntimeConfigClient(): RuntimePublicConfig {
+  if (cached) return cached;
+  if (typeof document === "undefined") return EMPTY_RUNTIME_PUBLIC_CONFIG;
+
+  const el = document.getElementById(RUNTIME_CONFIG_SCRIPT_ID);
+  let resolved: RuntimePublicConfig;
+  try {
+    resolved = el?.textContent
+      ? pickConfig(JSON.parse(el.textContent) as Partial<RuntimePublicConfig>)
+      : EMPTY_RUNTIME_PUBLIC_CONFIG;
+  } catch {
+    resolved = EMPTY_RUNTIME_PUBLIC_CONFIG;
+  }
+
+  cached = resolved;
+  return resolved;
+}
diff --git a/ui/lib/helper.ts b/ui/lib/helper.ts
index 2618b23a33..95173dfeef 100644
--- a/ui/lib/helper.ts
+++ b/ui/lib/helper.ts
@@ -11,10 +11,14 @@ import {
   COMPLIANCE_REPORT_DISPLAY_NAMES,
   type ComplianceReportType,
 } from "@/lib/compliance/compliance-report-types";
+import { readEnv } from "@/lib/runtime-env";
 import { AuthSocialProvider, MetaDataProps, PermissionInfo } from "@/types";
 
-export const baseUrl = process.env.AUTH_URL || "http://localhost:3000";
-export const apiBaseUrl = process.env.NEXT_PUBLIC_API_BASE_URL;
+export const baseUrl = process.env.AUTH_URL;
+export const apiBaseUrl = readEnv(
+  "UI_API_BASE_URL",
+  "NEXT_PUBLIC_API_BASE_URL",
+);
 
 /**
  * Extracts a form value from a FormData object
diff --git a/ui/lib/menu-list.test.ts b/ui/lib/menu-list.test.ts
index 7b21883d48..b06237a44a 100644
--- a/ui/lib/menu-list.test.ts
+++ b/ui/lib/menu-list.test.ts
@@ -13,11 +13,52 @@ const findSubmenu = (label: string) =>
     .flatMap((menu) => menu.submenus ?? [])
     .find((submenu) => submenu.label === label);
 
+const findApiReference = (options: Parameters<typeof getMenuList>[0]) =>
+  getMenuList(options)
+    .flatMap((group) => group.menus)
+    .flatMap((menu) => menu.submenus ?? [])
+    .find((submenu) => submenu.label === "API reference");
+
 describe("getMenuList", () => {
   afterEach(() => {
     delete process.env.NEXT_PUBLIC_IS_CLOUD_ENV;
   });
 
+  describe("API reference link", () => {
+    it("should use the apiDocsUrl provided by the caller in OSS", () => {
+      // Given / When — the caller resolves the runtime value (hydration-safe)
+      const apiRef = findApiReference({
+        pathname: "/",
+        apiDocsUrl: "https://self-hosted.example/api/v1/docs",
+      });
+
+      // Then
+      expect(apiRef?.href).toBe("https://self-hosted.example/api/v1/docs");
+    });
+
+    it("should default to an empty href when no apiDocsUrl is provided", () => {
+      // Given / When — no island read here, so SSR and client agree
+      const apiRef = findApiReference({ pathname: "/" });
+
+      // Then
+      expect(apiRef?.href).toBe("");
+    });
+
+    it("should use the Cloud docs URL and ignore apiDocsUrl when Cloud is enabled", () => {
+      // Given
+      process.env.NEXT_PUBLIC_IS_CLOUD_ENV = "true";
+
+      // When
+      const apiRef = findApiReference({
+        pathname: "/",
+        apiDocsUrl: "https://ignored.example/docs",
+      });
+
+      // Then
+      expect(apiRef?.href).toBe("https://api.prowler.com/api/v1/docs");
+    });
+  });
+
   it("should show Alerts as disabled Cloud-only in OSS when Cloud is disabled", () => {
     // Given / When
     const alerts = findSubmenu("Alerts");
diff --git a/ui/lib/menu-list.ts b/ui/lib/menu-list.ts
index 6367d33674..56b0e115c2 100644
--- a/ui/lib/menu-list.ts
+++ b/ui/lib/menu-list.ts
@@ -30,9 +30,15 @@ import { GroupProps } from "@/types";
 
 interface MenuListOptions {
   pathname: string;
+  // Passed in (not read here) so the island isn't read during SSR — that would
+  // cause a hydration mismatch. See useRuntimeConfig.
+  apiDocsUrl?: string | null;
 }
 
-export const getMenuList = ({ pathname }: MenuListOptions): GroupProps[] => {
+export const getMenuList = ({
+  pathname,
+  apiDocsUrl = null,
+}: MenuListOptions): GroupProps[] => {
   const isCloudEnv = process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true";
 
   return [
@@ -164,10 +170,9 @@ export const getMenuList = ({ pathname }: MenuListOptions): GroupProps[] => {
               icon: DocIcon,
             },
             {
-              href:
-                process.env.NEXT_PUBLIC_IS_CLOUD_ENV === "true"
-                  ? "https://api.prowler.com/api/v1/docs"
-                  : `${process.env.NEXT_PUBLIC_API_DOCS_URL}`,
+              href: isCloudEnv
+                ? "https://api.prowler.com/api/v1/docs"
+                : (apiDocsUrl ?? ""),
               target: "_blank",
               label: "API reference",
               icon: APIdocIcon,
diff --git a/ui/lib/runtime-config.shared.ts b/ui/lib/runtime-config.shared.ts
new file mode 100644
index 0000000000..98a76f8c3a
--- /dev/null
+++ b/ui/lib/runtime-config.shared.ts
@@ -0,0 +1,26 @@
+// Side-effect-free shape shared by the server and client readers (no
+// server-only code, so it's safe to import from the client bundle).
+export interface RuntimePublicConfig {
+  sentryDsn: string | null;
+  sentryEnvironment: string | null;
+  googleTagManagerId: string | null;
+  apiBaseUrl: string | null;
+  apiDocsUrl: string | null;
+  posthogKey: string | null; // reserved
+  posthogHost: string | null; // reserved
+  reoDevClientId: string | null; // reserved
+}
+
+export const RUNTIME_CONFIG_SCRIPT_ID = "__PROWLER_RUNTIME_CONFIG__";
+
+// All-null fallback (SSR or parse failure).
+export const EMPTY_RUNTIME_PUBLIC_CONFIG: RuntimePublicConfig = {
+  sentryDsn: null,
+  sentryEnvironment: null,
+  googleTagManagerId: null,
+  apiBaseUrl: null,
+  apiDocsUrl: null,
+  posthogKey: null,
+  posthogHost: null,
+  reoDevClientId: null,
+};
diff --git a/ui/lib/runtime-config.ts b/ui/lib/runtime-config.ts
new file mode 100644
index 0000000000..c799a6fced
--- /dev/null
+++ b/ui/lib/runtime-config.ts
@@ -0,0 +1,30 @@
+import "server-only";
+
+import { connection } from "next/server";
+
+import type { RuntimePublicConfig } from "@/lib/runtime-config.shared";
+import { readEnv } from "@/lib/runtime-env";
+
+// `connection()` forces a per-request runtime read (never build-snapshotted);
+// only this allowlist reaches the client. Each migrated key falls back to its
+// deprecated NEXT_PUBLIC_* name during migration (see readEnv).
+export async function getRuntimePublicConfig(): Promise<RuntimePublicConfig> {
+  await connection();
+
+  return {
+    sentryDsn: readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN"),
+    sentryEnvironment: readEnv(
+      "UI_SENTRY_ENVIRONMENT",
+      "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+    ),
+    googleTagManagerId: readEnv(
+      "UI_GOOGLE_TAG_MANAGER_ID",
+      "NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID",
+    ),
+    apiBaseUrl: readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL"),
+    apiDocsUrl: readEnv("UI_API_DOCS_URL", "NEXT_PUBLIC_API_DOCS_URL"),
+    posthogKey: readEnv("POSTHOG_KEY"),
+    posthogHost: readEnv("POSTHOG_HOST"),
+    reoDevClientId: readEnv("REO_DEV_CLIENT_ID"),
+  };
+}
diff --git a/ui/lib/runtime-env.test.ts b/ui/lib/runtime-env.test.ts
new file mode 100644
index 0000000000..b353b0ba11
--- /dev/null
+++ b/ui/lib/runtime-env.test.ts
@@ -0,0 +1,75 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { readEnv } from "./runtime-env";
+
+describe("readEnv", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("returns the primary value when it is set", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "https://primary.example.com");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL")).toBe("https://primary.example.com");
+  });
+
+  it("returns null when the primary is unset and no legacy is given", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL")).toBeNull();
+  });
+
+  it("treats an empty or whitespace-only primary as unset", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "   ");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL")).toBeNull();
+  });
+
+  it("falls back to the legacy var when the primary is unset", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL")).toBe(
+      "https://legacy.example.com",
+    );
+  });
+
+  it("falls back to the legacy var when the primary is empty", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "");
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL")).toBe(
+      "https://legacy.example.com",
+    );
+  });
+
+  it("prefers the primary over the legacy when both are set", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", "https://primary.example.com");
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", "https://legacy.example.com");
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL")).toBe(
+      "https://primary.example.com",
+    );
+  });
+
+  it("returns null when neither the primary nor the legacy is set", () => {
+    // Given
+    vi.stubEnv("UI_API_BASE_URL", undefined);
+    vi.stubEnv("NEXT_PUBLIC_API_BASE_URL", undefined);
+
+    // When / Then
+    expect(readEnv("UI_API_BASE_URL", "NEXT_PUBLIC_API_BASE_URL")).toBeNull();
+  });
+});
diff --git a/ui/lib/runtime-env.ts b/ui/lib/runtime-env.ts
new file mode 100644
index 0000000000..7426a2e357
--- /dev/null
+++ b/ui/lib/runtime-env.ts
@@ -0,0 +1,21 @@
+// Reads a runtime env var, with an optional deprecated-name fallback.
+//
+// Both names are read through a computed key (never a literal `process.env.X`
+// member access) so Next.js/Turbopack does NOT inline them at build time. This
+// is essential for the legacy `NEXT_PUBLIC_*` names: a literal read would be
+// replaced with the build-time snapshot, defeating the runtime fallback. The
+// new `UI_*` names are not `NEXT_PUBLIC_`-prefixed, so they are runtime reads
+// regardless. Empty/whitespace values are treated as unset so a leftover empty
+// `UI_*` still falls through to a configured legacy var.
+const clean = (value?: string): string | null =>
+  value && value.trim() !== "" ? value : null;
+
+export function readEnv(
+  primary: keyof NodeJS.ProcessEnv,
+  legacy?: keyof NodeJS.ProcessEnv,
+): string | null {
+  const env = typeof process === "undefined" ? undefined : process.env;
+  if (!env) return null;
+
+  return clean(env[primary]) ?? (legacy ? clean(env[legacy]) : null);
+}
diff --git a/ui/lib/safe-json.test.ts b/ui/lib/safe-json.test.ts
new file mode 100644
index 0000000000..a1c154813f
--- /dev/null
+++ b/ui/lib/safe-json.test.ts
@@ -0,0 +1,83 @@
+import { describe, expect, it } from "vitest";
+
+import { serializeForScript } from "./safe-json";
+
+const LINE_SEPARATOR = String.fromCharCode(0x2028); // U+2028
+const PARAGRAPH_SEPARATOR = String.fromCharCode(0x2029); // U+2029
+
+describe("serializeForScript", () => {
+  it("neutralizes a </script> breakout so the script tag is not terminated early", () => {
+    // Given
+    const value = { sentryDsn: "</script><script>alert(1)</script>" };
+
+    // When
+    const serialized = serializeForScript(value);
+
+    // Then
+    expect(serialized).not.toContain("</script>");
+    expect(serialized).not.toContain("<");
+    expect(serialized).not.toContain(">");
+  });
+
+  it("neutralizes the HTML comment opener <!--", () => {
+    // Given
+    const value = { sentryDsn: "<!-- not a comment -->" };
+
+    // When
+    const serialized = serializeForScript(value);
+
+    // Then
+    expect(serialized).not.toContain("<!--");
+    expect(serialized).not.toContain("<");
+  });
+
+  it("escapes ampersands", () => {
+    // When
+    const serialized = serializeForScript({ apiBaseUrl: "https://x?a=1&b=2" });
+
+    // Then
+    expect(serialized).not.toContain("&");
+    expect(serialized).toContain("\\u0026");
+  });
+
+  it("escapes U+2028 and U+2029 so output stays safe in an executed-JS context", () => {
+    // Given - JSON.stringify leaves these line terminators raw, which would
+    // break a JS string literal if the island were ever inlined as executed JS.
+    const value = { sentryDsn: `a${LINE_SEPARATOR}b${PARAGRAPH_SEPARATOR}c` };
+
+    // When
+    const serialized = serializeForScript(value);
+
+    // Then
+    expect(serialized).not.toContain(LINE_SEPARATOR);
+    expect(serialized).not.toContain(PARAGRAPH_SEPARATOR);
+    expect(serialized).toContain("\\u2028");
+    expect(serialized).toContain("\\u2029");
+  });
+
+  it("round-trips back to the original value via JSON.parse", () => {
+    // Given
+    const value = {
+      sentryDsn: "</script>",
+      apiBaseUrl: "https://api.example.com?a=1&b=2",
+      googleTagManagerId: null,
+    };
+
+    // When
+    const parsed = JSON.parse(serializeForScript(value));
+
+    // Then
+    expect(parsed).toEqual(value);
+  });
+
+  it("round-trips line terminators back to their original characters", () => {
+    // Given
+    const value = { sentryDsn: `a${LINE_SEPARATOR}b${PARAGRAPH_SEPARATOR}c` };
+
+    // When
+    const parsed = JSON.parse(serializeForScript(value));
+
+    // Then
+    expect(parsed).toEqual(value);
+  });
+});
diff --git a/ui/lib/safe-json.ts b/ui/lib/safe-json.ts
new file mode 100644
index 0000000000..1437de2f50
--- /dev/null
+++ b/ui/lib/safe-json.ts
@@ -0,0 +1,16 @@
+// Escape a value for an inline <script>. Neutralizes < > & to block the
+// </script>/<!-- breakout (the only vector when read as inert JSON), plus the
+// U+2028/U+2029 line terminators that JSON.stringify leaves raw, so the output
+// is also safe if ever inlined into an executed-JS context. JSON.parse decodes
+// all of these back to the original characters.
+const LINE_SEPARATOR = new RegExp(String.fromCharCode(0x2028), "g");
+const PARAGRAPH_SEPARATOR = new RegExp(String.fromCharCode(0x2029), "g");
+
+export function serializeForScript(value: unknown): string {
+  return JSON.stringify(value)
+    .replace(/</g, "\\u003c")
+    .replace(/>/g, "\\u003e")
+    .replace(/&/g, "\\u0026")
+    .replace(LINE_SEPARATOR, "\\u2028")
+    .replace(PARAGRAPH_SEPARATOR, "\\u2029");
+}
diff --git a/ui/next.config.js b/ui/next.config.js
index d5987c3603..dc6811b53c 100644
--- a/ui/next.config.js
+++ b/ui/next.config.js
@@ -6,7 +6,11 @@ const { withSentryConfig } = require("@sentry/nextjs");
 /** @type {import('next').NextConfig} */
 
 // HTTP Security Headers
-// 'unsafe-eval' is configured under `script-src` because it is required by NextJS for development mode
+// 'unsafe-eval' is configured under `script-src` because it is required by NextJS for development mode.
+//
+// CSP is static; the JSON config island is inert (no nonce needed). A runtime
+// Sentry DSN must be in `connect-src` below — `*.sentry.io` covers Sentry Cloud,
+// but a self-hosted/region host is blocked until per-request CSP (middleware) lands.
 const cspHeader = `
   default-src 'self';
   script-src 'self' 'unsafe-inline' 'unsafe-eval' https://js.stripe.com https://www.googletagmanager.com https://browser.sentry-cdn.com;
@@ -16,23 +20,8 @@ const cspHeader = `
   style-src 'self' 'unsafe-inline';
   frame-src 'self' https://js.stripe.com https://www.googletagmanager.com;
   frame-ancestors 'none';
-  report-to csp-endpoint;
 `;
 
-// Get Sentry CSP report endpoint if DSN is configured
-const getSentryReportEndpoint = () => {
-  if (!process.env.NEXT_PUBLIC_SENTRY_DSN) return null;
-  try {
-    const sentryKey =
-      process.env.NEXT_PUBLIC_SENTRY_DSN.split("@")[0]?.split("//")[1];
-    return sentryKey
-      ? `https://o0.ingest.sentry.io/api/0/security/?sentry_key=${sentryKey}`
-      : null;
-  } catch {
-    return null;
-  }
-};
-
 const nextConfig = {
   poweredByHeader: false,
   // Use standalone only in production deployments, not for CI/testing
@@ -47,7 +36,6 @@ const nextConfig = {
     root: __dirname,
   },
   async headers() {
-    const sentryEndpoint = getSentryReportEndpoint();
     const headers = [
       {
         key: "Content-Security-Policy",
@@ -63,14 +51,6 @@ const nextConfig = {
       },
     ];
 
-    // Add Reporting-Endpoints header if Sentry is configured
-    if (sentryEndpoint) {
-      headers.push({
-        key: "Reporting-Endpoints",
-        value: `csp-endpoint="${sentryEndpoint}"`,
-      });
-    }
-
     return [
       {
         source: "/(.*)",
@@ -92,6 +72,12 @@ const sentryWebpackPluginOptions = {
 };
 
 // Export with Sentry only if configuration is available
-module.exports = process.env.SENTRY_DSN
+const hasSentryBuildCredentials = Boolean(
+  process.env.SENTRY_AUTH_TOKEN &&
+    process.env.SENTRY_ORG &&
+    process.env.SENTRY_PROJECT,
+);
+
+module.exports = hasSentryBuildCredentials
   ? withSentryConfig(nextConfig, sentryWebpackPluginOptions)
   : nextConfig;
diff --git a/ui/package.json b/ui/package.json
index 2b6a20bf14..576b0bb723 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -23,12 +23,12 @@
     "test:browser": "vitest run --project browser",
     "test:browser:watch": "vitest --project browser",
     "test:coverage": "vitest run --coverage",
-    "test:e2e": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans",
-    "test:e2e:debug": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --debug",
-    "test:e2e:headed": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --headed",
+    "test:e2e": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config",
+    "test:e2e:debug": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --debug",
+    "test:e2e:headed": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --headed",
     "test:e2e:install": "playwright install",
     "test:e2e:report": "playwright show-report",
-    "test:e2e:ui": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --ui",
+    "test:e2e:ui": "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --ui",
     "test:unit": "vitest run --project unit",
     "test:watch": "vitest",
     "tour:check": "node scripts/check-tour-alignment.mjs",
diff --git a/ui/playwright.config.ts b/ui/playwright.config.ts
index 922fa0b125..b9730e0de6 100644
--- a/ui/playwright.config.ts
+++ b/ui/playwright.config.ts
@@ -120,6 +120,13 @@ export default defineConfig({
       use: { ...devices["Desktop Chrome"] },
       testMatch: /invitation-accept\/.*\.spec\.ts/,
     },
+    // This project runs the runtime public-config data island test suite
+    // Tests run unauthenticated (no auth setup dependency)
+    {
+      name: "runtime-config",
+      use: { ...devices["Desktop Chrome"] },
+      testMatch: /runtime-config\/.*\.spec\.ts/,
+    },
     // This project runs the scans test suite
     {
       name: "scans",
@@ -146,8 +153,9 @@ export default defineConfig({
     reuseExistingServer: !process.env.CI,
     timeout: 120 * 1000,
     env: {
-      NEXT_PUBLIC_API_BASE_URL:
-        process.env.NEXT_PUBLIC_API_BASE_URL || "http://localhost:8080/api/v1",
+      UI_API_BASE_URL:
+        process.env.UI_API_BASE_URL || "http://localhost:8080/api/v1",
+      AUTH_URL: process.env.AUTH_URL || "http://localhost:3000",
       AUTH_SECRET: process.env.AUTH_SECRET || "fallback-ci-secret-for-testing",
       AUTH_TRUST_HOST: process.env.AUTH_TRUST_HOST || "true",
       NEXTAUTH_URL: process.env.NEXTAUTH_URL || "http://localhost:3000",
diff --git a/ui/sentry/README.md b/ui/sentry/README.md
index f33f9f2a8f..babaf1b7fb 100644
--- a/ui/sentry/README.md
+++ b/ui/sentry/README.md
@@ -11,7 +11,11 @@ This folder contains all Sentry-related configuration and utilities for the Prow
 
 ## Client Configuration
 
-The client-side configuration is located in `app/instrumentation.client.ts` following Next.js conventions.
+The client-side configuration lives in the Next.js convention file
+`instrumentation-client.ts` (repo root). It runs before hydration and reads the
+DSN/environment from the runtime data island injected into `<head>` (see
+`lib/runtime-config.ts`), so the browser SDK is configured per deployment from
+the container environment rather than from build-time `NEXT_PUBLIC_*` vars.
 
 ## Usage
 
@@ -30,16 +34,21 @@ Sentry.captureException(error, {
 
 ## Environment Variables
 
-Required environment variables (add to `.env`):
+Runtime environment variables (supplied to the running container; a single
+`UI_SENTRY_DSN` / `UI_SENTRY_ENVIRONMENT` now serves both server and
+browser):
+
+```env
+UI_SENTRY_DSN=https://YOUR_KEY@o0.ingest.sentry.io/0
+UI_SENTRY_ENVIRONMENT=production
+```
+
+Build-time only (for source-map upload via `withSentryConfig`):
 
 ```env
-SENTRY_DSN=https://YOUR_KEY@o0.ingest.sentry.io/0
-NEXT_PUBLIC_SENTRY_DSN=https://YOUR_KEY@o0.ingest.sentry.io/0
 SENTRY_ORG=your-org-slug
 SENTRY_PROJECT=your-project-slug
 SENTRY_AUTH_TOKEN=sntrys_YOUR_AUTH_TOKEN
-SENTRY_ENVIRONMENT=development
-NEXT_PUBLIC_SENTRY_ENVIRONMENT=development
 ```
 
 ## Ignored Errors
diff --git a/ui/sentry/sentry.edge.config.test.ts b/ui/sentry/sentry.edge.config.test.ts
new file mode 100644
index 0000000000..918e686eb0
--- /dev/null
+++ b/ui/sentry/sentry.edge.config.test.ts
@@ -0,0 +1,60 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// Stable mock that survives resetModules (which clears the module registry).
+const { initMock } = vi.hoisted(() => ({ initMock: vi.fn() }));
+
+vi.mock("@sentry/nextjs", () => ({
+  init: initMock,
+}));
+
+describe("sentry.edge.config", () => {
+  beforeEach(() => {
+    // Re-evaluate the module per case so its top-level init guard re-runs.
+    vi.resetModules();
+    initMock.mockClear();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("should initialize with the resolved environment and reduced edge sampling", async () => {
+    // Given
+    vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+    vi.stubEnv("UI_SENTRY_ENVIRONMENT", "pro");
+
+    // When
+    await import("./sentry.edge.config");
+
+    // Then
+    expect(initMock).toHaveBeenCalledTimes(1);
+    expect(initMock.mock.calls[0][0]).toMatchObject({
+      dsn: "https://key@o0.ingest.sentry.io/1",
+      environment: "pro",
+      tracesSampleRate: 0.25,
+    });
+  });
+
+  it("should not initialize when the DSN is absent", async () => {
+    // Given no DSN
+
+    // When
+    await import("./sentry.edge.config");
+
+    // Then
+    expect(initMock).not.toHaveBeenCalled();
+  });
+
+  it("should default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT does not enable dev sampling", async () => {
+    // Given - DSN set but environment unset
+    vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+
+    // When
+    await import("./sentry.edge.config");
+
+    // Then
+    const options = initMock.mock.calls[0][0];
+    expect(options.environment).toBe("production");
+    expect(options.tracesSampleRate).toBe(0.25);
+  });
+});
diff --git a/ui/sentry/sentry.edge.config.ts b/ui/sentry/sentry.edge.config.ts
index 0666d6b856..933c97822a 100644
--- a/ui/sentry/sentry.edge.config.ts
+++ b/ui/sentry/sentry.edge.config.ts
@@ -1,10 +1,20 @@
 import * as Sentry from "@sentry/nextjs";
 
-const SENTRY_DSN = process.env.SENTRY_DSN;
+import { readEnv } from "@/lib/runtime-env";
+
+const sentryDsn = readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN");
+const sentryEnvironment = readEnv(
+  "UI_SENTRY_ENVIRONMENT",
+  "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+);
 
 // Only initialize Sentry if DSN is configured
-if (SENTRY_DSN) {
-  const isProduction = process.env.SENTRY_ENVIRONMENT === "pro";
+if (sentryDsn) {
+  // Default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT never
+  // runs in dev mode; only an explicit "local" enables it. Mirrors the browser
+  // SDK (instrumentation-client.ts) so all runtimes resolve the env identically.
+  const environment = sentryEnvironment ?? "production";
+  const isDevelopment = environment === "local";
 
   /**
    * Edge runtime Sentry configuration
@@ -17,17 +27,17 @@ if (SENTRY_DSN) {
    */
   Sentry.init({
     // 📍 DSN - Data Source Name (identifies your Sentry project)
-    dsn: SENTRY_DSN,
+    dsn: sentryDsn,
 
     // 🌍 Environment configuration
-    environment: process.env.SENTRY_ENVIRONMENT || "local",
+    environment,
 
     // 📦 Release tracking
     release: process.env.SENTRY_RELEASE,
 
     // 📊 Sample Rates - Reduced for edge runtime constraints
     // 50% in dev, 25% in production (edge has lower overhead limits than server)
-    tracesSampleRate: isProduction ? 0.25 : 0.5,
+    tracesSampleRate: isDevelopment ? 0.5 : 0.25,
 
     // 🔌 Integrations - Edge runtime doesn't support all integrations
     integrations: [],
diff --git a/ui/sentry/sentry.server.config.test.ts b/ui/sentry/sentry.server.config.test.ts
new file mode 100644
index 0000000000..a3d75cc856
--- /dev/null
+++ b/ui/sentry/sentry.server.config.test.ts
@@ -0,0 +1,63 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// Stable mock that survives resetModules (which clears the module registry).
+const { initMock } = vi.hoisted(() => ({ initMock: vi.fn() }));
+
+vi.mock("@sentry/nextjs", () => ({
+  init: initMock,
+  extraErrorDataIntegration: vi.fn(() => ({})),
+}));
+
+describe("sentry.server.config", () => {
+  beforeEach(() => {
+    // Re-evaluate the module per case so its top-level init guard re-runs.
+    vi.resetModules();
+    initMock.mockClear();
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("should initialize with the resolved environment and production sampling", async () => {
+    // Given
+    vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+    vi.stubEnv("UI_SENTRY_ENVIRONMENT", "pro");
+
+    // When
+    await import("./sentry.server.config");
+
+    // Then
+    expect(initMock).toHaveBeenCalledTimes(1);
+    expect(initMock.mock.calls[0][0]).toMatchObject({
+      dsn: "https://key@o0.ingest.sentry.io/1",
+      environment: "pro",
+      tracesSampleRate: 0.5,
+      profilesSampleRate: 0.5,
+    });
+  });
+
+  it("should not initialize when the DSN is absent", async () => {
+    // Given no DSN
+
+    // When
+    await import("./sentry.server.config");
+
+    // Then
+    expect(initMock).not.toHaveBeenCalled();
+  });
+
+  it("should default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT does not enable dev sampling", async () => {
+    // Given - DSN set but environment unset
+    vi.stubEnv("UI_SENTRY_DSN", "https://key@o0.ingest.sentry.io/1");
+
+    // When
+    await import("./sentry.server.config");
+
+    // Then
+    const options = initMock.mock.calls[0][0];
+    expect(options.environment).toBe("production");
+    expect(options.tracesSampleRate).toBe(0.5);
+    expect(options.profilesSampleRate).toBe(0.5);
+  });
+});
diff --git a/ui/sentry/sentry.server.config.ts b/ui/sentry/sentry.server.config.ts
index 5922a8ae30..361365f2ec 100644
--- a/ui/sentry/sentry.server.config.ts
+++ b/ui/sentry/sentry.server.config.ts
@@ -1,10 +1,21 @@
 import * as Sentry from "@sentry/nextjs";
 
-const SENTRY_DSN = process.env.SENTRY_DSN;
+import { readEnv } from "@/lib/runtime-env";
+
+const sentryDsn = readEnv("UI_SENTRY_DSN", "NEXT_PUBLIC_SENTRY_DSN");
+const sentryEnvironment = readEnv(
+  "UI_SENTRY_ENVIRONMENT",
+  "NEXT_PUBLIC_SENTRY_ENVIRONMENT",
+);
 
 // Only initialize Sentry if DSN is configured
-if (SENTRY_DSN) {
-  const isProduction = process.env.SENTRY_ENVIRONMENT === "pro";
+if (sentryDsn) {
+  // Default to a non-dev environment so an unset UI_SENTRY_ENVIRONMENT never
+  // runs in dev mode (100% sampling); only an explicit "local" enables it.
+  // Mirrors the browser SDK (instrumentation-client.ts) so all runtimes resolve
+  // the env identically.
+  const environment = sentryEnvironment ?? "production";
+  const isDevelopment = environment === "local";
 
   /**
    * Server-side Sentry configuration
@@ -16,18 +27,18 @@ if (SENTRY_DSN) {
    */
   Sentry.init({
     // 📍 DSN - Data Source Name (identifies your Sentry project)
-    dsn: SENTRY_DSN,
+    dsn: sentryDsn,
 
     // 🌍 Environment configuration
-    environment: process.env.SENTRY_ENVIRONMENT || "local",
+    environment,
 
     // 📦 Release tracking
     release: process.env.SENTRY_RELEASE,
 
     // 📊 Sample Rates - Performance monitoring
     // 100% in dev (test everything), 50% in production (balance visibility with costs)
-    tracesSampleRate: isProduction ? 0.5 : 1.0,
-    profilesSampleRate: isProduction ? 0.5 : 1.0,
+    tracesSampleRate: isDevelopment ? 1.0 : 0.5,
+    profilesSampleRate: isDevelopment ? 1.0 : 0.5,
 
     // 🔌 Integrations
     integrations: [
diff --git a/ui/tests/runtime-config/runtime-config-page.ts b/ui/tests/runtime-config/runtime-config-page.ts
new file mode 100644
index 0000000000..28c9ad6065
--- /dev/null
+++ b/ui/tests/runtime-config/runtime-config-page.ts
@@ -0,0 +1,124 @@
+import { expect, Locator, Page, Request } from "@playwright/test";
+
+import {
+  RUNTIME_CONFIG_SCRIPT_ID,
+  type RuntimePublicConfig,
+} from "@/lib/runtime-config.shared";
+
+import { BasePage } from "../base-page";
+
+export { RUNTIME_CONFIG_SCRIPT_ID };
+
+/** Keys the runtime data island is expected to expose (the allowlist). */
+export const RUNTIME_CONFIG_KEYS = [
+  "sentryDsn",
+  "sentryEnvironment",
+  "googleTagManagerId",
+  "apiBaseUrl",
+  "apiDocsUrl",
+  "posthogKey",
+  "posthogHost",
+  "reoDevClientId",
+] as const satisfies ReadonlyArray<keyof RuntimePublicConfig>;
+
+/**
+ * Page object for the runtime public-config data island. The island is rendered
+ * into `<head>` by both root layouts, so any unauthenticated route works; the
+ * sign-in page is used because it needs no session.
+ */
+export class RuntimeConfigPage extends BasePage {
+  readonly island: Locator;
+
+  constructor(page: Page) {
+    super(page);
+    this.island = page.locator(`script#${RUNTIME_CONFIG_SCRIPT_ID}`);
+  }
+
+  async goto(): Promise<void> {
+    await super.goto("/sign-in");
+  }
+
+  /** Parsed island JSON, or null when the island is missing/malformed. */
+  async readConfig(): Promise<Record<string, unknown> | null> {
+    return this.page.evaluate((id) => {
+      const el = document.getElementById(id);
+      if (!el?.textContent) return null;
+      try {
+        return JSON.parse(el.textContent) as Record<string, unknown>;
+      } catch {
+        return null;
+      }
+    }, RUNTIME_CONFIG_SCRIPT_ID);
+  }
+
+  /** DSN the browser Sentry client initialized with, or null if uninitialized. */
+  async sentryInitializedDsn(): Promise<string | null> {
+    return this.page.evaluate(() => {
+      const sentry = (window as unknown as { __SENTRY__?: unknown }).__SENTRY__;
+      if (!sentry || typeof sentry !== "object") return null;
+      const hub = sentry as {
+        getClient?: () => unknown;
+        hub?: { getClient?: () => unknown };
+      };
+      const client = (hub.getClient?.() ?? hub.hub?.getClient?.()) as
+        | { getOptions?: () => { dsn?: string } }
+        | undefined;
+      return client?.getOptions?.().dsn ?? null;
+    });
+  }
+
+  async verifyIslandInHead(): Promise<void> {
+    // type="application/json" ⇒ inert, not governed by CSP script-src.
+    await expect(this.island).toHaveAttribute("type", "application/json");
+    const parentTag = await this.island.evaluate(
+      (el) => el.parentElement?.tagName.toLowerCase() ?? "",
+    );
+    expect(parentTag).toBe("head");
+  }
+
+  /**
+   * The island must precede the first ordered (non-`async`) bundle
+   * `<script src>` — that bundle is the client entry calling
+   * getRuntimeConfigClient(), so the island must exist before it runs. Next.js's
+   * `async` chunk-preloads load out of order and don't read the config, so they
+   * are excluded.
+   */
+  async verifyIslandPrecedesClientBundle(): Promise<void> {
+    const precedes = await this.page.evaluate((id) => {
+      const scripts = Array.from(document.querySelectorAll("script"));
+      const islandIndex = scripts.findIndex((s) => s.id === id);
+      if (islandIndex === -1) return false;
+      const firstOrderedBundleIndex = scripts.findIndex(
+        (s) => s.src && !s.async,
+      );
+      return (
+        firstOrderedBundleIndex === -1 || islandIndex < firstOrderedBundleIndex
+      );
+    }, RUNTIME_CONFIG_SCRIPT_ID);
+    expect(precedes).toBe(true);
+  }
+
+  /**
+   * Reload the page while recording any request whose URL contains one of the
+   * given host fragments. Returns the matching URLs (empty ⇒ zero egress).
+   */
+  async thirdPartyRequestsOnReload(hostFragments: string[]): Promise<string[]> {
+    const hits: string[] = [];
+    const listener = (req: Request) => {
+      const url = req.url();
+      if (hostFragments.some((fragment) => url.includes(fragment))) {
+        hits.push(url);
+      }
+    };
+    this.page.on("request", listener);
+    await this.page.reload({ waitUntil: "load" });
+    this.page.off("request", listener);
+    return hits;
+  }
+
+  async verifyGoogleTagManagerNotRendered(): Promise<void> {
+    await expect(
+      this.page.locator('script[src*="googletagmanager.com"]'),
+    ).toHaveCount(0);
+  }
+}
diff --git a/ui/tests/runtime-config/runtime-config.md b/ui/tests/runtime-config/runtime-config.md
new file mode 100644
index 0000000000..18aedaa1b3
--- /dev/null
+++ b/ui/tests/runtime-config/runtime-config.md
@@ -0,0 +1,87 @@
+### E2E Tests: Runtime Public-Config Data Island
+
+**Suite ID:** `RUNTIME-CONFIG-E2E`
+**Feature:** Runtime resolution of public client config via an inert JSON data
+island injected into `<head>` (Sentry, GTM, API base/docs URL, reserved keys).
+
+---
+
+## Test Case: `RUNTIME-CONFIG-E2E-001` - Island rendered in `<head>` before the client bundle
+
+**Priority:** `critical`
+**Tags:** @e2e, @runtime-config
+
+**Preconditions:**
+
+- UI server running with `UI_API_BASE_URL` set (the playwright `webServer` provides it).
+
+### Flow Steps
+
+1. Navigate to `/sign-in` (unauthenticated; the island renders on every route).
+2. Locate `script#__PROWLER_RUNTIME_CONFIG__`.
+
+### Expected Result
+
+- The island exists, is `type="application/json"` (inert), and lives in `<head>`.
+- The island appears before the first ordered (non-`async`) bundle `<script src>` — Next.js's `async` chunk-preloads in `<head>` don't execute in order and are excluded.
+- It parses as JSON exposing exactly the allowlisted keys and a truthy `apiBaseUrl`.
+
+### Key Verification Points
+
+- In-`<head>`-before-bundle ordering guarantee (not provable in jsdom).
+- Only the allowlisted shape is exposed (no other env leaks).
+
+---
+
+## Test Case: `RUNTIME-CONFIG-E2E-002` - Browser Sentry init matches the island DSN
+
+**Priority:** `high`
+**Tags:** @e2e, @runtime-config
+
+**Preconditions:**
+
+- UI server running. `UI_SENTRY_DSN` may be set or unset.
+
+### Flow Steps
+
+1. Navigate to `/sign-in`.
+2. Read `sentryDsn` from the island.
+3. Read the DSN the browser Sentry client initialized with.
+
+### Expected Result
+
+- If the island carries a DSN, the browser Sentry client initialized with that
+  exact runtime DSN (proving the island feeds `Sentry.init` race-free).
+- If the island has no DSN, Sentry is not initialized (zero egress — the default).
+
+### Key Verification Points
+
+- The runtime DSN reaches module-load Sentry init via the island.
+- Unset DSN ⇒ no Sentry initialization (privacy guarantee).
+
+---
+
+## Test Case: `RUNTIME-CONFIG-E2E-003` - Zero third-party telemetry when Sentry and GTM are unset
+
+**Priority:** `critical`
+**Tags:** @e2e, @runtime-config
+
+**Preconditions:**
+
+- UI server running with `UI_SENTRY_DSN` and `UI_GOOGLE_TAG_MANAGER_ID` unset (the Enterprise default; the test skips when either is configured).
+
+### Flow Steps
+
+1. Navigate to `/sign-in` and read the island config.
+2. Reload while recording requests to `googletagmanager.com`, `google-analytics.com`, and `sentry.io`.
+3. Inspect the DOM for a Google Tag Manager script.
+
+### Expected Result
+
+- No request is sent to any Google or Sentry host.
+- The `GoogleTagManager` component is not rendered (no `gtm.js` script).
+
+### Key Verification Points
+
+- Enterprise default sends zero error/analytics telemetry to any third party.
+- Empty/unset GTM id ⇒ component not mounted (an empty id is NOT inert).
diff --git a/ui/tests/runtime-config/runtime-config.spec.ts b/ui/tests/runtime-config/runtime-config.spec.ts
new file mode 100644
index 0000000000..8e94e0527f
--- /dev/null
+++ b/ui/tests/runtime-config/runtime-config.spec.ts
@@ -0,0 +1,82 @@
+import { expect, test } from "@playwright/test";
+
+import { RUNTIME_CONFIG_KEYS, RuntimeConfigPage } from "./runtime-config-page";
+
+test.describe("Runtime public-config data island", () => {
+  let runtimeConfigPage: RuntimeConfigPage;
+
+  test.beforeEach(async ({ page }) => {
+    runtimeConfigPage = new RuntimeConfigPage(page);
+    await runtimeConfigPage.goto();
+  });
+
+  test(
+    "renders an inert JSON island in <head> before the client bundle",
+    {
+      tag: ["@critical", "@e2e", "@runtime-config", "@RUNTIME-CONFIG-E2E-001"],
+    },
+    async () => {
+      // The island exists, is inert (application/json), lives in <head>, and
+      // precedes the first ordered (non-async) bundle script (the ordering
+      // guarantee a jsdom unit test cannot prove).
+      await expect(runtimeConfigPage.island).toBeAttached();
+      await runtimeConfigPage.verifyIslandInHead();
+      await runtimeConfigPage.verifyIslandPrecedesClientBundle();
+
+      // It carries exactly the allowlisted shape and parses as JSON.
+      const config = await runtimeConfigPage.readConfig();
+      expect(config).not.toBeNull();
+      expect(Object.keys(config ?? {}).sort()).toEqual(
+        [...RUNTIME_CONFIG_KEYS].sort(),
+      );
+      // API base URL is the required runtime value supplied to the server.
+      expect(config?.apiBaseUrl).toBeTruthy();
+    },
+  );
+
+  test(
+    "browser Sentry init is consistent with the island DSN",
+    { tag: ["@high", "@e2e", "@runtime-config", "@RUNTIME-CONFIG-E2E-002"] },
+    async () => {
+      // The island feeds instrumentation-client's Sentry.init race-free. Assert
+      // the wiring regardless of whether this deployment configures a DSN:
+      //  - DSN set   ⇒ Sentry initialized with that exact runtime DSN
+      //  - DSN unset ⇒ Sentry not initialized (zero egress, the default)
+      const config = await runtimeConfigPage.readConfig();
+      const islandDsn = (config?.sentryDsn as string | null) ?? null;
+      const initializedDsn = await runtimeConfigPage.sentryInitializedDsn();
+
+      if (islandDsn) {
+        expect(initializedDsn).toBe(islandDsn);
+      } else {
+        expect(initializedDsn).toBeNull();
+      }
+    },
+  );
+
+  test(
+    "sends zero third-party telemetry when Sentry and GTM are unset",
+    {
+      tag: ["@critical", "@e2e", "@runtime-config", "@RUNTIME-CONFIG-E2E-003"],
+    },
+    async () => {
+      // The Enterprise default: with neither integration configured, the page
+      // must not contact Sentry or Google. Only meaningful when this deployment
+      // actually leaves them unset.
+      const config = await runtimeConfigPage.readConfig();
+      test.skip(
+        Boolean(config?.sentryDsn) || Boolean(config?.googleTagManagerId),
+        "Sentry or GTM is configured in this environment",
+      );
+
+      const hits = await runtimeConfigPage.thirdPartyRequestsOnReload([
+        "googletagmanager.com",
+        "google-analytics.com",
+        "sentry.io",
+      ]);
+
+      expect(hits).toEqual([]);
+      await runtimeConfigPage.verifyGoogleTagManagerNotRendered();
+    },
+  );
+});
diff --git a/ui/types/env.d.ts b/ui/types/env.d.ts
index 3daedd9706..bfb995d5d1 100644
--- a/ui/types/env.d.ts
+++ b/ui/types/env.d.ts
@@ -5,14 +5,32 @@ declare global {
       NODE_ENV: "development" | "production" | "test";
       NEXT_RUNTIME?: "nodejs" | "edge";
 
-      // Public client config
-      NEXT_PUBLIC_API_BASE_URL: string;
+      // UI prefix — runtime public config, read server-side per request and
+      // exposed to the browser via the runtime data island. Each var keeps its
+      // deprecated NEXT_PUBLIC_* name as a runtime fallback (see readEnv).
+      /** @deprecated use UI_API_BASE_URL */
+      NEXT_PUBLIC_API_BASE_URL?: string;
+      UI_API_BASE_URL: string;
+      /** @deprecated use UI_API_DOCS_URL */
       NEXT_PUBLIC_API_DOCS_URL?: string;
+      UI_API_DOCS_URL?: string;
+
+      // GTM
+      /** @deprecated use UI_GOOGLE_TAG_MANAGER_ID */
+      NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID?: string;
+      UI_GOOGLE_TAG_MANAGER_ID?: string;
+
+      // SENTRY
+      /** @deprecated use UI_SENTRY_DSN */
+      NEXT_PUBLIC_SENTRY_DSN?: string;
+      UI_SENTRY_DSN?: string;
+      /** @deprecated use UI_SENTRY_ENVIRONMENT */
+      NEXT_PUBLIC_SENTRY_ENVIRONMENT?: string;
+      UI_SENTRY_ENVIRONMENT?: string;
+
+      // Build-time public config
       NEXT_PUBLIC_IS_CLOUD_ENV?: "true" | "false";
       NEXT_PUBLIC_PROWLER_RELEASE_VERSION?: string;
-      NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID?: string;
-      NEXT_PUBLIC_SENTRY_DSN?: string;
-      NEXT_PUBLIC_SENTRY_ENVIRONMENT?: string;
 
       // Auth (NextAuth)
       AUTH_URL: string;
@@ -21,13 +39,16 @@ declare global {
       NEXTAUTH_URL?: string;
 
       // Sentry (server / build)
-      SENTRY_DSN?: string;
-      SENTRY_ENVIRONMENT?: string;
       SENTRY_RELEASE?: string;
       SENTRY_ORG?: string;
       SENTRY_PROJECT?: string;
       SENTRY_AUTH_TOKEN?: string;
 
+      // TODO Reserved runtime public config (registered now; no UI consumer yet)
+      POSTHOG_KEY?: string;
+      POSTHOG_HOST?: string;
+      REO_DEV_CLIENT_ID?: string;
+
       // Social OAuth
       SOCIAL_GOOGLE_OAUTH_CLIENT_ID?: string;
       SOCIAL_GOOGLE_OAUTH_CLIENT_SECRET?: string;
diff --git a/ui/vitest.config.ts b/ui/vitest.config.ts
index bb976e11b1..89d17ba692 100644
--- a/ui/vitest.config.ts
+++ b/ui/vitest.config.ts
@@ -5,8 +5,7 @@ import type { TestProjectConfiguration } from "vitest/config";
 import { defineConfig } from "vitest/config";
 
 export default defineConfig(() => {
-  const apiBaseUrl =
-    process.env.NEXT_PUBLIC_API_BASE_URL ?? "http://localhost/api/v1";
+  const apiBaseUrl = process.env.UI_API_BASE_URL ?? "http://localhost/api/v1";
 
   return {
     plugins: [react()],
@@ -75,7 +74,7 @@ export default defineConfig(() => {
       ] as TestProjectConfiguration[],
     },
     define: {
-      "process.env.NEXT_PUBLIC_API_BASE_URL": JSON.stringify(apiBaseUrl),
+      "process.env.UI_API_BASE_URL": JSON.stringify(apiBaseUrl),
       // `next/dist/server/web/spec-extension/user-agent.js` references
       // `__dirname` directly and is pulled in transitively via `next-auth`.
       // Vite serves it to the browser where that global doesn't exist, so we

From 908d2ce766700ec1c636a3c4648dd70daa26679b Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Thu, 18 Jun 2026 15:47:03 +0200
Subject: [PATCH 090/126] feat(ui): per-provider scan schedule management gated
 by capability (#11521)

---
 ui/actions/resources/resources.test.ts        |  27 +
 ui/actions/resources/resources.ts             |  29 +-
 ui/actions/scans/scans.test.ts                |  35 +-
 ui/actions/scans/scans.ts                     |  57 +-
 ui/actions/schedules/index.ts                 |   1 +
 ui/actions/schedules/schedules.test.ts        | 103 ++++
 ui/actions/schedules/schedules.ts             | 128 +++++
 .../providers/providers-page.utils.test.ts    | 131 +++++
 .../providers/providers-page.utils.ts         |  72 ++-
 ui/app/(prowler)/scans/page.tsx               | 170 +++++-
 ui/components/providers/link-to-scans.tsx     |  34 +-
 .../organizations/org-launch-scan.test.tsx    |  71 ++-
 .../organizations/org-launch-scan.tsx         | 102 +++-
 .../providers/providers-accounts-view.tsx     |   8 +
 .../providers/table/column-providers.tsx      |  32 +-
 .../table/data-table-row-actions.test.tsx     | 140 ++++-
 .../table/data-table-row-actions.tsx          | 109 +++-
 .../wizard/provider-wizard-modal.tsx          | 451 ++++++++--------
 .../wizard/steps/launch-step.test.tsx         | 374 +++++++++++--
 .../providers/wizard/steps/launch-step.tsx    | 292 ++++++++---
 .../scans/launch-scan-modal.test.tsx          | 161 +++++-
 ui/components/scans/launch-scan-modal.tsx     | 273 +++++++++-
 ui/components/scans/scans-page-shell.tsx      |   8 +
 ui/components/scans/scans.utils.test.ts       | 238 ++++++++-
 ui/components/scans/scans.utils.ts            | 147 +++++-
 .../edit-scan-schedule-modal.test.tsx         | 165 ++++++
 .../schedule/edit-scan-schedule-modal.tsx     | 227 ++++++++
 .../scans/schedule/save-schedule.test.ts      | 115 ++++
 ui/components/scans/schedule/save-schedule.ts |  70 +++
 .../schedule/scan-schedule-fields.test.tsx    |  76 +++
 .../scans/schedule/scan-schedule-fields.tsx   | 301 +++++++++++
 .../scans/table/cells/scan-info-cell.tsx      |  21 +
 .../scans/table/cells/schedule-cell.tsx       |  23 +-
 .../scans/table/scan-jobs-columns.test.tsx    |  19 +-
 .../scans/table/scan-jobs-columns.tsx         |  83 ++-
 .../table/scan-jobs-row-actions.test.tsx      | 107 ++--
 .../scans/table/scan-jobs-row-actions.tsx     | 103 +++-
 ui/components/shadcn/index.ts                 |   1 +
 .../shadcn/select/multiselect.test.tsx        |   8 +-
 ui/components/shadcn/select/multiselect.tsx   |   6 +-
 .../shadcn/stacked-cell/stacked-cell.test.tsx |  20 +
 .../shadcn/stacked-cell/stacked-cell.tsx      |  36 ++
 ui/components/ui/entities/date-with-time.tsx  |  21 +-
 .../ui/table/data-table-expand-toggle.tsx     |   4 +-
 .../ui/table/data-table-expandable-cell.tsx   |   5 +-
 ui/components/ui/table/data-table.test.tsx    |  69 +++
 ui/components/ui/table/data-table.tsx         |  29 +-
 ui/lib/date-utils.ts                          |  35 ++
 ui/lib/helper.test.ts                         |  19 +-
 ui/lib/helper.ts                              |  25 +-
 ui/lib/schedules.test.ts                      | 490 ++++++++++++++++++
 ui/lib/schedules.ts                           | 290 +++++++++++
 ui/lib/server-actions-helper.test.ts          |  54 ++
 ui/lib/server-actions-helper.ts               |  29 +-
 ui/tests/helpers.ts                           |  20 +-
 ui/tests/providers/providers-page.ts          | 118 ++++-
 ui/tests/providers/providers.md               | 328 ++++++------
 ui/tests/providers/providers.spec.ts          | 265 +++-------
 ui/tests/scans/scans.md                       |   3 +-
 ui/types/index.ts                             |   1 +
 ui/types/providers-table.ts                   |   3 +
 ui/types/scans.ts                             |  13 +
 ui/types/schedules.ts                         |  97 ++++
 63 files changed, 5539 insertions(+), 953 deletions(-)
 create mode 100644 ui/actions/schedules/index.ts
 create mode 100644 ui/actions/schedules/schedules.test.ts
 create mode 100644 ui/actions/schedules/schedules.ts
 create mode 100644 ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
 create mode 100644 ui/components/scans/schedule/edit-scan-schedule-modal.tsx
 create mode 100644 ui/components/scans/schedule/save-schedule.test.ts
 create mode 100644 ui/components/scans/schedule/save-schedule.ts
 create mode 100644 ui/components/scans/schedule/scan-schedule-fields.test.tsx
 create mode 100644 ui/components/scans/schedule/scan-schedule-fields.tsx
 create mode 100644 ui/components/shadcn/stacked-cell/stacked-cell.test.tsx
 create mode 100644 ui/components/shadcn/stacked-cell/stacked-cell.tsx
 create mode 100644 ui/lib/schedules.test.ts
 create mode 100644 ui/lib/schedules.ts
 create mode 100644 ui/lib/server-actions-helper.test.ts
 create mode 100644 ui/types/schedules.ts

diff --git a/ui/actions/resources/resources.test.ts b/ui/actions/resources/resources.test.ts
index cbdb0b1296..d8c5d75456 100644
--- a/ui/actions/resources/resources.test.ts
+++ b/ui/actions/resources/resources.test.ts
@@ -28,6 +28,10 @@ import {
 vi.mock("@/lib", () => ({
   apiBaseUrl: "https://api.example.com/api/v1",
   getAuthHeaders: getAuthHeadersMock,
+  GENERIC_SERVER_ERROR_MESSAGE:
+    "Server is temporarily unavailable. Please try again in a few minutes.",
+  sanitizeErrorMessage: (message: string, fallback: string) =>
+    /<html\b|<\/?body\b|<\/?h1\b/i.test(message) ? fallback : message.trim(),
   composeSort,
   FG_FAIL_FIRST,
   FG_RECENT_LAST_SEEN,
@@ -167,6 +171,29 @@ describe("getResourceEvents", () => {
     });
   });
 
+  it("returns a generic error when a gateway returns HTML", async () => {
+    // Given
+    const mockResponse = new Response(
+      "<html><head><title>502 Bad Gateway</title></head><body><h1>502 Bad Gateway</h1></body></html>",
+      {
+        status: 502,
+        statusText: "Bad Gateway",
+        headers: { "content-type": "text/html" },
+      },
+    );
+    fetchMock.mockResolvedValue(mockResponse);
+
+    // When
+    const result = await getResourceEvents("resource-123");
+
+    // Then
+    expect(result).toEqual({
+      error:
+        "Server is temporarily unavailable. Please try again in a few minutes.",
+      status: 502,
+    });
+  });
+
   it("returns generic error when fetch throws", async () => {
     // Given
     fetchMock.mockRejectedValue(new Error("Network failure"));
diff --git a/ui/actions/resources/resources.ts b/ui/actions/resources/resources.ts
index 8af2576852..3ab84efa4f 100644
--- a/ui/actions/resources/resources.ts
+++ b/ui/actions/resources/resources.ts
@@ -4,7 +4,13 @@ import { redirect } from "next/navigation";
 
 import { getLatestFindings } from "@/actions/findings";
 import { listOrganizationsSafe } from "@/actions/organizations/organizations";
-import { apiBaseUrl, FINDINGS_FILTERED_SORT, getAuthHeaders } from "@/lib";
+import {
+  apiBaseUrl,
+  FINDINGS_FILTERED_SORT,
+  GENERIC_SERVER_ERROR_MESSAGE,
+  getAuthHeaders,
+  sanitizeErrorMessage,
+} from "@/lib";
 import { appendSanitizedProviderTypeFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 import { OrganizationResource } from "@/types/organizations";
@@ -193,22 +199,27 @@ export const getResourceEvents = async (
 
     if (!response.ok) {
       const rawText = await response.text().catch(() => "");
+      const contentType =
+        response.headers.get("content-type")?.toLowerCase() || "";
       const defaultError = "An error occurred while fetching events.";
+      const fallbackError = contentType.includes("text/html")
+        ? GENERIC_SERVER_ERROR_MESSAGE
+        : response.statusText || defaultError;
       try {
         const errorData = rawText ? JSON.parse(rawText) : null;
+        const errorMessage =
+          errorData?.errors?.[0]?.detail ||
+          errorData?.error ||
+          errorData?.message ||
+          rawText ||
+          fallbackError;
         return {
-          error:
-            errorData?.errors?.[0]?.detail ||
-            errorData?.error ||
-            errorData?.message ||
-            rawText ||
-            response.statusText ||
-            defaultError,
+          error: sanitizeErrorMessage(String(errorMessage), fallbackError),
           status: response.status,
         };
       } catch {
         return {
-          error: rawText || response.statusText || defaultError,
+          error: sanitizeErrorMessage(rawText || fallbackError, fallbackError),
           status: response.status,
         };
       }
diff --git a/ui/actions/scans/scans.test.ts b/ui/actions/scans/scans.test.ts
index ae82ba860d..a7f7fd0c7e 100644
--- a/ui/actions/scans/scans.test.ts
+++ b/ui/actions/scans/scans.test.ts
@@ -14,6 +14,8 @@ const {
 
 vi.mock("@/lib", () => ({
   apiBaseUrl: "https://api.example.com/api/v1",
+  GENERIC_SERVER_ERROR_MESSAGE:
+    "Server is temporarily unavailable. Please try again in a few minutes.",
   getAuthHeaders: getAuthHeadersMock,
   getErrorMessage: (error: unknown) =>
     error instanceof Error ? error.message : String(error),
@@ -28,7 +30,7 @@ vi.mock("@/lib/sentry-breadcrumbs", () => ({
   addScanOperation: vi.fn(),
 }));
 
-import { launchOrganizationScans } from "./scans";
+import { getExportsZip, launchOrganizationScans } from "./scans";
 
 describe("launchOrganizationScans", () => {
   beforeEach(() => {
@@ -69,3 +71,34 @@ describe("launchOrganizationScans", () => {
     expect(result.failureCount).toBe(0);
   });
 });
+
+describe("getExportsZip", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.stubGlobal("fetch", fetchMock);
+    getAuthHeadersMock.mockResolvedValue({ Authorization: "Bearer token" });
+  });
+
+  it("returns a generic server error when the report endpoint returns HTML", async () => {
+    // Given
+    fetchMock.mockResolvedValue(
+      new Response(
+        "<html><head><title>502 Bad Gateway</title></head><body><h1>502 Bad Gateway</h1></body></html>",
+        {
+          status: 502,
+          statusText: "Bad Gateway",
+          headers: { "content-type": "text/html" },
+        },
+      ),
+    );
+
+    // When
+    const result = await getExportsZip("scan-123");
+
+    // Then
+    expect(result).toEqual({
+      error:
+        "Server is temporarily unavailable. Please try again in a few minutes.",
+    });
+  });
+});
diff --git a/ui/actions/scans/scans.ts b/ui/actions/scans/scans.ts
index fb32a6286e..5a6ddb7a29 100644
--- a/ui/actions/scans/scans.ts
+++ b/ui/actions/scans/scans.ts
@@ -3,7 +3,12 @@
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 
-import { apiBaseUrl, getAuthHeaders, getErrorMessage } from "@/lib";
+import {
+  apiBaseUrl,
+  GENERIC_SERVER_ERROR_MESSAGE,
+  getAuthHeaders,
+  getErrorMessage,
+} from "@/lib";
 import {
   COMPLIANCE_REPORT_DISPLAY_NAMES,
   type ComplianceReportType,
@@ -162,18 +167,20 @@ export const scheduleDaily = async (formData: FormData) => {
 
   const url = new URL(`${apiBaseUrl}/schedules/daily`);
 
+  const body = {
+    data: {
+      type: "daily-schedules",
+      attributes: {
+        provider_id: providerId,
+      },
+    },
+  };
+
   try {
     const response = await fetch(url.toString(), {
       method: "POST",
       headers,
-      body: JSON.stringify({
-        data: {
-          type: "daily-schedules",
-          attributes: {
-            provider_id: providerId,
-          },
-        },
-      }),
+      body: JSON.stringify(body),
     });
 
     return handleApiResponse(response, "/scans");
@@ -249,6 +256,27 @@ export const launchOrganizationScans = async (
   return summary;
 };
 
+async function getScanReportErrorMessage(
+  response: Response,
+  fallbackMessage: string,
+): Promise<string> {
+  const contentType = response.headers.get("content-type")?.toLowerCase() || "";
+
+  if (contentType.includes("text/html")) {
+    return GENERIC_SERVER_ERROR_MESSAGE;
+  }
+
+  const errorData = await response.json().catch(() => null);
+
+  return (
+    errorData?.errors?.[0]?.detail ||
+    errorData?.errors?.detail ||
+    errorData?.error ||
+    errorData?.message ||
+    (response.status >= 500 ? GENERIC_SERVER_ERROR_MESSAGE : fallbackMessage)
+  );
+}
+
 export const updateScan = async (formData: FormData) => {
   const headers = await getAuthHeaders({ contentType: true });
 
@@ -300,11 +328,11 @@ export const getExportsZip = async (scanId: string) => {
     }
 
     if (!response.ok) {
-      const errorData = await response.json();
-
       throw new Error(
-        errorData?.errors?.detail ||
+        await getScanReportErrorMessage(
+          response,
           "Unable to fetch scan report. Contact support if the issue continues.",
+        ),
       );
     }
 
@@ -375,10 +403,11 @@ const _fetchScanBinary = async (
     }
 
     if (!response.ok) {
-      const errorData = await response.json().catch(() => ({}));
       throw new Error(
-        errorData?.errors?.detail ||
+        await getScanReportErrorMessage(
+          response,
           `Unable to retrieve ${errorLabel}. Contact support if the issue continues.`,
+        ),
       );
     }
 
diff --git a/ui/actions/schedules/index.ts b/ui/actions/schedules/index.ts
new file mode 100644
index 0000000000..7e6e7b459a
--- /dev/null
+++ b/ui/actions/schedules/index.ts
@@ -0,0 +1 @@
+export * from "./schedules";
diff --git a/ui/actions/schedules/schedules.test.ts b/ui/actions/schedules/schedules.test.ts
new file mode 100644
index 0000000000..9e05799116
--- /dev/null
+++ b/ui/actions/schedules/schedules.test.ts
@@ -0,0 +1,103 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { SCHEDULE_FREQUENCY } from "@/types/schedules";
+
+const {
+  fetchMock,
+  getAuthHeadersMock,
+  handleApiErrorMock,
+  handleApiResponseMock,
+  revalidatePathMock,
+} = vi.hoisted(() => ({
+  fetchMock: vi.fn(),
+  getAuthHeadersMock: vi.fn(),
+  handleApiErrorMock: vi.fn(),
+  handleApiResponseMock: vi.fn(),
+  revalidatePathMock: vi.fn(),
+}));
+
+vi.mock("next/cache", () => ({
+  revalidatePath: revalidatePathMock,
+}));
+
+vi.mock("@/lib", () => ({
+  apiBaseUrl: "https://api.example.com/api/v1",
+  getAuthHeaders: getAuthHeadersMock,
+}));
+
+vi.mock("@/lib/server-actions-helper", () => ({
+  handleApiError: handleApiErrorMock,
+  handleApiResponse: handleApiResponseMock,
+}));
+
+import { getSchedule, removeSchedule, updateSchedule } from "./schedules";
+
+const PROVIDER_ID = "1795f636-37e6-42f6-b158-d4faaa64e0fc";
+
+const payload = {
+  scan_enabled: true,
+  scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+  scan_hour: 12,
+  scan_timezone: "Europe/Madrid",
+  scan_interval_hours: null,
+  scan_day_of_week: null,
+  scan_day_of_month: null,
+};
+
+describe("schedule write actions revalidate only on success", () => {
+  beforeEach(() => {
+    vi.stubGlobal("fetch", fetchMock);
+    getAuthHeadersMock.mockResolvedValue({ Authorization: "Bearer token" });
+    fetchMock.mockResolvedValue(new Response(null, { status: 204 }));
+    handleApiErrorMock.mockReturnValue({ error: "Failed" });
+  });
+
+  it("revalidates /scans and /providers after a successful update", async () => {
+    handleApiResponseMock.mockResolvedValue({ success: true });
+
+    await updateSchedule(PROVIDER_ID, payload);
+
+    expect(revalidatePathMock).toHaveBeenCalledWith("/scans");
+    expect(revalidatePathMock).toHaveBeenCalledWith("/providers");
+  });
+
+  it("does not revalidate when the update returns an error result", async () => {
+    handleApiResponseMock.mockResolvedValue({ error: "Schedule rejected" });
+
+    await updateSchedule(PROVIDER_ID, payload);
+
+    expect(revalidatePathMock).not.toHaveBeenCalled();
+  });
+
+  it("revalidates /scans and /providers after a successful delete", async () => {
+    handleApiResponseMock.mockResolvedValue({ success: true });
+
+    await removeSchedule(PROVIDER_ID);
+
+    expect(revalidatePathMock).toHaveBeenCalledWith("/scans");
+    expect(revalidatePathMock).toHaveBeenCalledWith("/providers");
+  });
+
+  it("does not revalidate when the delete returns an error result", async () => {
+    handleApiResponseMock.mockResolvedValue({ error: "Not allowed" });
+
+    await removeSchedule(PROVIDER_ID);
+
+    expect(revalidatePathMock).not.toHaveBeenCalled();
+  });
+
+  it("rejects non-UUID provider ids without issuing a request", async () => {
+    const malicious = "../users/me";
+
+    expect(await getSchedule(malicious)).toEqual({
+      error: "Invalid provider id.",
+    });
+    expect(await updateSchedule(malicious, payload)).toEqual({
+      error: "Invalid provider id.",
+    });
+    expect(await removeSchedule(malicious)).toEqual({
+      error: "Invalid provider id.",
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/actions/schedules/schedules.ts b/ui/actions/schedules/schedules.ts
new file mode 100644
index 0000000000..c8e0d9993f
--- /dev/null
+++ b/ui/actions/schedules/schedules.ts
@@ -0,0 +1,128 @@
+"use server";
+
+import { revalidatePath } from "next/cache";
+import { z } from "zod";
+
+import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
+import type { ScheduleProps, ScheduleUpdatePayload } from "@/types/schedules";
+
+// SSRF guard: the id is interpolated into the request URL, so only UUIDs pass.
+const providerIdSchema = z.uuid();
+
+function parseProviderId(providerId: string): string | null {
+  const parsed = providerIdSchema.safeParse(providerId);
+  return parsed.success ? parsed.data : null;
+}
+
+function revalidateScheduleViews() {
+  revalidatePath("/scans");
+  revalidatePath("/providers");
+}
+
+export const getSchedule = async (providerId: string) => {
+  const id = parseProviderId(providerId);
+  if (!id) return { error: "Invalid provider id." };
+
+  const headers = await getAuthHeaders({ contentType: false });
+  const url = new URL(`${apiBaseUrl}/schedules/${id}`);
+  url.searchParams.set("include", "provider");
+
+  try {
+    const response = await fetch(url.toString(), { headers });
+
+    return handleApiResponse(response);
+  } catch (error) {
+    return handleApiError(error);
+  }
+};
+
+/**
+ * Lists every schedule (one per provider), following pagination — the backend
+ * has no multi-provider filter.
+ */
+export const getSchedules = async () => {
+  const headers = await getAuthHeaders({ contentType: false });
+  const schedules: ScheduleProps[] = [];
+  const MAX_PAGES = 20;
+
+  try {
+    for (let page = 1; page <= MAX_PAGES; page++) {
+      const url = new URL(`${apiBaseUrl}/schedules`);
+      url.searchParams.set("page[number]", String(page));
+      url.searchParams.set("page[size]", "100");
+
+      const response = await fetch(url.toString(), { headers });
+
+      const result = await handleApiResponse(response);
+      if (result?.error) return result;
+
+      schedules.push(...(result?.data ?? []));
+
+      const totalPages = result?.meta?.pagination?.pages ?? 1;
+      if (page >= totalPages) break;
+    }
+
+    return { data: schedules };
+  } catch (error) {
+    return handleApiError(error);
+  }
+};
+
+export const updateSchedule = async (
+  providerId: string,
+  payload: ScheduleUpdatePayload,
+) => {
+  const id = parseProviderId(providerId);
+  if (!id) return { error: "Invalid provider id." };
+
+  const headers = await getAuthHeaders({ contentType: true });
+  const url = new URL(`${apiBaseUrl}/schedules/${id}`);
+
+  const body = {
+    data: {
+      type: "schedules",
+      id,
+      attributes: payload,
+    },
+  };
+
+  try {
+    const response = await fetch(url.toString(), {
+      method: "PATCH",
+      headers,
+      body: JSON.stringify(body),
+    });
+
+    const result = await handleApiResponse(response);
+    if (!result?.error) {
+      revalidateScheduleViews();
+    }
+    return result;
+  } catch (error) {
+    return handleApiError(error);
+  }
+};
+
+export const removeSchedule = async (providerId: string) => {
+  const id = parseProviderId(providerId);
+  if (!id) return { error: "Invalid provider id." };
+
+  const headers = await getAuthHeaders({ contentType: true });
+  const url = new URL(`${apiBaseUrl}/schedules/${id}`);
+
+  try {
+    const response = await fetch(url.toString(), {
+      method: "DELETE",
+      headers,
+    });
+
+    const result = await handleApiResponse(response);
+    if (!result?.error) {
+      revalidateScheduleViews();
+    }
+    return result;
+  } catch (error) {
+    return handleApiError(error);
+  }
+};
diff --git a/ui/app/(prowler)/providers/providers-page.utils.test.ts b/ui/app/(prowler)/providers/providers-page.utils.test.ts
index 335b672af2..b5dcd6d844 100644
--- a/ui/app/(prowler)/providers/providers-page.utils.test.ts
+++ b/ui/app/(prowler)/providers/providers-page.utils.test.ts
@@ -14,16 +14,26 @@ const scansActionsMock = vi.hoisted(() => ({
   getScans: vi.fn(),
 }));
 
+const schedulesActionsMock = vi.hoisted(() => ({
+  getSchedules: vi.fn(),
+}));
+
 vi.mock("@/actions/providers", () => providersActionsMock);
 vi.mock(
   "@/actions/organizations/organizations",
   () => organizationsActionsMock,
 );
 vi.mock("@/actions/scans", () => scansActionsMock);
+vi.mock("@/actions/schedules", () => schedulesActionsMock);
 
 import { SearchParamsProps } from "@/types";
 import { ProvidersApiResponse } from "@/types/providers";
 import { ProvidersProviderRow } from "@/types/providers-table";
+import {
+  SCHEDULE_FREQUENCY,
+  type ScheduleAttributes,
+  type ScheduleProps,
+} from "@/types/schedules";
 
 import {
   buildProvidersTableRows,
@@ -156,6 +166,33 @@ const toProviderRow = (
   },
 });
 
+const buildSchedule = (
+  providerId: string,
+  overrides: Partial<ScheduleAttributes> = {},
+): ScheduleProps => ({
+  type: "schedules",
+  id: providerId,
+  attributes: {
+    scan_enabled: true,
+    scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+    scan_hour: 9,
+    scan_timezone: "Europe/Madrid",
+    scan_interval_hours: null,
+    scan_day_of_week: null,
+    scan_day_of_month: null,
+    ...overrides,
+  },
+  relationships: {
+    provider: { data: { type: "providers", id: providerId } },
+  },
+});
+
+const findProviderRow = (
+  rows: { id: string }[],
+  providerId: string,
+): ProvidersProviderRow | undefined =>
+  rows.find((row) => row.id === providerId) as ProvidersProviderRow | undefined;
+
 describe("buildProvidersTableRows", () => {
   it("returns a flat providers table for OSS", () => {
     // Given
@@ -751,4 +788,98 @@ describe("loadProvidersAccountsViewData", () => {
       viewData.rows.every((row) => row.rowType === PROVIDERS_ROW_TYPE.PROVIDER),
     ).toBe(true);
   });
+
+  it("surfaces the real cadence (not a hardcoded label) from a configured schedule with no materialized scan yet", async () => {
+    // Given — provider-1 has a WEEKLY schedule but the backend has not yet
+    // created a Scan row (the gap between configuring and the first fire).
+    providersActionsMock.getProviders.mockResolvedValue(providersResponse);
+    providersActionsMock.getAllProviders.mockResolvedValue(providersResponse);
+    scansActionsMock.getScans.mockResolvedValue({ data: [] });
+    schedulesActionsMock.getSchedules.mockResolvedValue({
+      data: [
+        buildSchedule("provider-1", {
+          scan_frequency: SCHEDULE_FREQUENCY.WEEKLY,
+          scan_hour: 9,
+          scan_day_of_week: 1,
+        }),
+      ],
+    });
+
+    // When
+    const viewData = await loadProvidersAccountsViewData({
+      searchParams: {} satisfies SearchParamsProps,
+      isCloud: false,
+    });
+
+    // Then — the row carries the Weekly cadence, not "Daily".
+    const providerRow = findProviderRow(viewData.rows, "provider-1");
+    expect(providerRow?.hasSchedule).toBe(true);
+    expect(providerRow?.scheduleSummary?.cadence).toBe("Weekly on Monday");
+    expect(findProviderRow(viewData.rows, "provider-2")?.hasSchedule).toBe(
+      false,
+    );
+    expect(
+      findProviderRow(viewData.rows, "provider-2")?.scheduleSummary,
+    ).toBeUndefined();
+  });
+
+  it("ignores paused or unconfigured schedules", async () => {
+    // Given — provider-1 paused (disabled), provider-2 never configured.
+    providersActionsMock.getProviders.mockResolvedValue(providersResponse);
+    providersActionsMock.getAllProviders.mockResolvedValue(providersResponse);
+    scansActionsMock.getScans.mockResolvedValue({ data: [] });
+    schedulesActionsMock.getSchedules.mockResolvedValue({
+      data: [
+        buildSchedule("provider-1", { scan_enabled: false, scan_hour: 9 }),
+        buildSchedule("provider-2", { scan_enabled: true, scan_hour: null }),
+      ],
+    });
+
+    // When
+    const viewData = await loadProvidersAccountsViewData({
+      searchParams: {} satisfies SearchParamsProps,
+      isCloud: false,
+    });
+
+    // Then
+    expect(findProviderRow(viewData.rows, "provider-1")?.hasSchedule).toBe(
+      false,
+    );
+    expect(findProviderRow(viewData.rows, "provider-2")?.hasSchedule).toBe(
+      false,
+    );
+  });
+
+  it("falls back to scan-based detection when /schedules is unavailable (OSS)", async () => {
+    // Given — /schedules errors, but provider-1 has a materialized scheduled scan.
+    providersActionsMock.getProviders.mockResolvedValue(providersResponse);
+    providersActionsMock.getAllProviders.mockResolvedValue(providersResponse);
+    scansActionsMock.getScans.mockResolvedValue({
+      data: [
+        {
+          type: "scans",
+          id: "scan-1",
+          attributes: { trigger: "scheduled", state: "scheduled" },
+          relationships: {
+            provider: { data: { type: "providers", id: "provider-1" } },
+          },
+        },
+      ],
+    });
+    schedulesActionsMock.getSchedules.mockResolvedValue({ error: "Not found" });
+
+    // When
+    const viewData = await loadProvidersAccountsViewData({
+      searchParams: {} satisfies SearchParamsProps,
+      isCloud: false,
+    });
+
+    // Then — scan-based path still flags the provider; no throw from the error.
+    expect(findProviderRow(viewData.rows, "provider-1")?.hasSchedule).toBe(
+      true,
+    );
+    expect(findProviderRow(viewData.rows, "provider-2")?.hasSchedule).toBe(
+      false,
+    );
+  });
 });
diff --git a/ui/app/(prowler)/providers/providers-page.utils.ts b/ui/app/(prowler)/providers/providers-page.utils.ts
index db79452709..a37d6eb510 100644
--- a/ui/app/(prowler)/providers/providers-page.utils.ts
+++ b/ui/app/(prowler)/providers/providers-page.utils.ts
@@ -4,10 +4,16 @@ import {
 } from "@/actions/organizations/organizations";
 import { getAllProviders, getProviders } from "@/actions/providers";
 import { getScans } from "@/actions/scans";
+import { getSchedules } from "@/actions/schedules";
 import {
   extractFiltersAndQuery,
   extractSortAndKey,
 } from "@/lib/helper-filters";
+import {
+  buildProviderScheduleSummary,
+  buildSchedulesByProviderId,
+  isScheduleConfigured,
+} from "@/lib/schedules";
 import {
   FilterEntity,
   FilterOption,
@@ -27,7 +33,8 @@ import {
   ProvidersTableRow,
   ProvidersTableRowsInput,
 } from "@/types/providers-table";
-import { SCAN_TRIGGER, ScanProps } from "@/types/scans";
+import { SCAN_TRIGGER, ScanProps, ScanScheduleSummary } from "@/types/scans";
+import { ScheduleAttributes } from "@/types/schedules";
 
 const PROVIDERS_STATUS_MAPPING = [
   {
@@ -127,22 +134,46 @@ const buildScheduledProviderIds = (scans: ScanProps[]): Set<string> => {
   return scheduled;
 };
 
+// A schedule is backed by the Provider row itself, so its `/schedules` entry
+// exists before the first scheduled Scan is materialized — only enabled,
+// configured ones carry a displayable cadence summary.
+const buildProviderScheduleSummaryFor = (
+  attributes: ScheduleAttributes | undefined,
+  now: Date,
+): ScanScheduleSummary | undefined =>
+  attributes && attributes.scan_enabled && isScheduleConfigured(attributes)
+    ? buildProviderScheduleSummary(attributes, now)
+    : undefined;
+
 const enrichProviders = (
-  providersResponse?: ProvidersApiResponse,
-  scheduledProviderIds?: Set<string>,
+  providersResponse: ProvidersApiResponse | undefined,
+  scanScheduledProviderIds: Set<string>,
+  schedulesByProviderId: Record<string, ScheduleAttributes>,
 ): ProvidersProviderRow[] => {
   const providerGroupLookup = createProviderGroupLookup(providersResponse);
+  const now = new Date();
 
-  return (providersResponse?.data ?? []).map((provider) => ({
-    ...provider,
-    rowType: PROVIDERS_ROW_TYPE.PROVIDER,
-    groupNames:
-      provider.relationships.provider_groups.data.map(
-        (providerGroup: { id: string }) =>
-          providerGroupLookup.get(providerGroup.id) ?? "Unknown Group",
-      ) ?? [],
-    hasSchedule: scheduledProviderIds?.has(provider.id) ?? false,
-  }));
+  return (providersResponse?.data ?? []).map((provider) => {
+    const scheduleSummary = buildProviderScheduleSummaryFor(
+      schedulesByProviderId[provider.id],
+      now,
+    );
+
+    return {
+      ...provider,
+      rowType: PROVIDERS_ROW_TYPE.PROVIDER,
+      groupNames:
+        provider.relationships.provider_groups.data.map(
+          (providerGroup: { id: string }) =>
+            providerGroupLookup.get(providerGroup.id) ?? "Unknown Group",
+        ) ?? [],
+      // A fired scheduled scan OR a configured schedule that hasn't fired yet.
+      hasSchedule:
+        scanScheduledProviderIds.has(provider.id) ||
+        scheduleSummary !== undefined,
+      scheduleSummary,
+    };
+  });
 };
 
 const createOrganizationRow = ({
@@ -453,6 +484,7 @@ export async function loadProvidersAccountsViewData({
     providersResponse,
     allProvidersResponse,
     scansResponse,
+    schedulesResponse,
     organizationsResponse,
     organizationUnitsResponse,
   ] = await Promise.all([
@@ -468,7 +500,7 @@ export async function loadProvidersAccountsViewData({
     // Unfiltered fetch for ProviderTypeSelector — only needs distinct types;
     // TODO: Replace with a dedicated lightweight endpoint when available.
     resolveActionResult(getAllProviders()),
-    // Fetch active scheduled scans to determine daily schedule per provider
+    // Fetch active scheduled scans to flag providers whose schedule has fired.
     resolveActionResult(
       getScans({
         pageSize: 500,
@@ -478,6 +510,9 @@ export async function loadProvidersAccountsViewData({
         },
       }),
     ),
+    // Fetch configured schedules to also flag providers whose schedule has not
+    // fired yet (best-effort: absent in OSS, where the helper yields no ids).
+    resolveActionResult(getSchedules()),
     isCloud
       ? listOrganizationsSafe()
       : Promise.resolve(emptyOrganizationsResponse),
@@ -486,13 +521,18 @@ export async function loadProvidersAccountsViewData({
       : Promise.resolve(emptyOrganizationUnitsResponse),
   ]);
 
-  const scheduledProviderIds = buildScheduledProviderIds(
+  const scanScheduledProviderIds = buildScheduledProviderIds(
     scansResponse?.data ?? [],
   );
+  const schedulesByProviderId = buildSchedulesByProviderId(schedulesResponse);
 
   const orgs = organizationsResponse?.data ?? [];
   const ous = organizationUnitsResponse?.data ?? [];
-  const providers = enrichProviders(providersResponse, scheduledProviderIds);
+  const providers = enrichProviders(
+    providersResponse,
+    scanScheduledProviderIds,
+    schedulesByProviderId,
+  );
 
   const rows = buildProvidersTableRows({
     isCloud,
diff --git a/ui/app/(prowler)/scans/page.tsx b/ui/app/(prowler)/scans/page.tsx
index 4bde757224..d945380f93 100644
--- a/ui/app/(prowler)/scans/page.tsx
+++ b/ui/app/(prowler)/scans/page.tsx
@@ -3,9 +3,12 @@ import { Suspense } from "react";
 
 import { getAllProviders } from "@/actions/providers";
 import { getScans } from "@/actions/scans";
+import { getSchedules } from "@/actions/schedules";
 import { auth } from "@/auth.config";
 import { PageReady } from "@/components/onboarding";
 import {
+  appendPendingScheduleRowsToPage,
+  getProviderIdsFromScans,
   getScanJobsTab,
   getScanJobsTabFilters,
   getScanJobsUserFilters,
@@ -15,14 +18,43 @@ import { ScansProvidersEmptyState } from "@/components/scans/scans-providers-emp
 import { SkeletonTableScans } from "@/components/scans/table";
 import { ScanJobsTable } from "@/components/scans/table/scan-jobs-table";
 import { ContentLayout } from "@/components/ui";
+import {
+  buildProviderScheduleSummary,
+  buildSchedulesByProviderId,
+  isScheduleConfigured,
+} from "@/lib/schedules";
 import {
   ProviderProps,
   SCAN_JOBS_TAB,
+  SCAN_TRIGGER,
   ScanProps,
   SearchParamsProps,
 } from "@/types";
 
 const ACTIVE_SCAN_COUNT_PAGE_SIZE = 1;
+// Pending schedule rows are derived from provider schedules, but must honor the
+// same provider filters as real scan rows. Keep these filter keys typed locally
+// without narrowing the global SearchParamsProps shape used by Next pages.
+const PENDING_ROW_PROVIDER_FILTER = {
+  PROVIDER_UID_IN: "provider_uid__in",
+  PROVIDER_UID: "provider_uid",
+  PROVIDER_TYPE_IN: "provider_type__in",
+  PROVIDER_TYPE: "provider_type",
+} as const;
+
+type PendingRowProviderFilter =
+  (typeof PENDING_ROW_PROVIDER_FILTER)[keyof typeof PENDING_ROW_PROVIDER_FILTER];
+type PendingRowProviderFilterParam = `filter[${PendingRowProviderFilter}]`;
+
+const PROVIDER_UID_FILTER_KEYS = [
+  `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_UID_IN}]`,
+  `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_UID}]`,
+] as const satisfies ReadonlyArray<PendingRowProviderFilterParam>;
+
+const PROVIDER_TYPE_FILTER_KEYS = [
+  `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_TYPE_IN}]`,
+  `filter[${PENDING_ROW_PROVIDER_FILTER.PROVIDER_TYPE}]`,
+] as const satisfies ReadonlyArray<PendingRowProviderFilterParam>;
 
 const getFilterSearchQuery = (
   filters: Record<string, string | string[]>,
@@ -33,6 +65,47 @@ const getFilterSearchQuery = (
   return value ?? "";
 };
 
+const parseCsvParam = (value?: string | string[]): string[] => {
+  const rawValue = Array.isArray(value) ? value.join(",") : value;
+  if (!rawValue) return [];
+
+  return rawValue
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+};
+
+const getFirstSearchParam = (
+  searchParams: SearchParamsProps,
+  keys: ReadonlyArray<PendingRowProviderFilterParam>,
+): string | string[] | undefined => {
+  for (const key of keys) {
+    const value = searchParams[key];
+    if (value !== undefined) return value;
+  }
+
+  return undefined;
+};
+
+/** Applies the table's provider filters to synthetic pending-schedule rows. */
+const filterProvidersForPendingRows = (
+  providers: ProviderProps[],
+  searchParams: SearchParamsProps,
+): ProviderProps[] => {
+  const uids = parseCsvParam(
+    getFirstSearchParam(searchParams, PROVIDER_UID_FILTER_KEYS),
+  );
+  const types = parseCsvParam(
+    getFirstSearchParam(searchParams, PROVIDER_TYPE_FILTER_KEYS),
+  );
+
+  return providers.filter(
+    (provider) =>
+      (uids.length === 0 || uids.includes(provider.attributes.uid)) &&
+      (types.length === 0 || types.includes(provider.attributes.provider)),
+  );
+};
+
 const getActiveScanCount = async (
   searchParams: SearchParamsProps,
 ): Promise<number> => {
@@ -53,6 +126,40 @@ const getActiveScanCount = async (
   return scansData && "meta" in scansData ? scansData.meta.pagination.count : 0;
 };
 
+/**
+ * A provider can already have a real scheduled scan on a different page.
+ * Current-page rows are not enough to decide whether a schedule needs a
+ * synthetic Pending row, so fetch all scheduled scan provider ids when the
+ * backend paginated result is larger than the current slice.
+ */
+const getCoveredScheduledProviderIds = async ({
+  currentScans,
+  realScanCount,
+  query,
+  filters,
+}: {
+  currentScans: ScanProps[];
+  realScanCount: number;
+  query: string;
+  filters: Record<string, string | string[]>;
+}): Promise<Set<string>> => {
+  if (realScanCount === 0 || currentScans.length === realScanCount) {
+    return getProviderIdsFromScans(currentScans);
+  }
+
+  const allScheduledScansData = await getScans({
+    query,
+    page: 1,
+    pageSize: realScanCount,
+    filters,
+    include: "provider",
+  });
+
+  return getProviderIdsFromScans(
+    (allScheduledScansData?.data ?? []) as ScanProps[],
+  );
+};
+
 export default async function Scans({
   searchParams,
 }: {
@@ -123,7 +230,10 @@ export default async function Scans({
               />
             }
           >
-            <SSRDataTableScans searchParams={resolvedSearchParams} />
+            <SSRDataTableScans
+              searchParams={resolvedSearchParams}
+              providers={providers}
+            />
           </Suspense>
         </ScansPageShell>
       )}
@@ -133,8 +243,10 @@ export default async function Scans({
 
 const SSRDataTableScans = async ({
   searchParams,
+  providers,
 }: {
   searchParams: SearchParamsProps;
+  providers: ProviderProps[];
 }) => {
   const tab = getScanJobsTab(searchParams.tab);
 
@@ -170,7 +282,7 @@ const SSRDataTableScans = async ({
   const included = scansData?.included;
   const meta = scansData && "meta" in scansData ? scansData.meta : undefined;
 
-  const expandedScansData =
+  const expandedScansData: ScanProps[] =
     scans?.map((scan: ScanProps) => {
       const providerId = scan.relationships?.provider?.data?.id;
 
@@ -191,10 +303,60 @@ const SSRDataTableScans = async ({
       };
     }) || [];
 
+  const needsSchedules =
+    tab === SCAN_JOBS_TAB.SCHEDULED ||
+    expandedScansData.some(
+      (scan) => scan.attributes.trigger === SCAN_TRIGGER.SCHEDULED,
+    );
+  const schedulesResult = needsSchedules ? await getSchedules() : null;
+
+  // Schedules are keyed by provider id so real scheduled scan rows can display
+  // cadence/next-run info, and schedule-only providers can become Pending rows.
+  const schedulesByProviderId = buildSchedulesByProviderId(schedulesResult);
+
+  const scansWithSchedule = expandedScansData.map((scan) => {
+    if (scan.attributes.trigger !== SCAN_TRIGGER.SCHEDULED) return scan;
+
+    const providerId = scan.relationships?.provider?.data?.id;
+    const schedule = providerId ? schedulesByProviderId[providerId] : undefined;
+    if (!schedule || !isScheduleConfigured(schedule)) return scan;
+
+    return {
+      ...scan,
+      providerSchedule: buildProviderScheduleSummary(schedule, new Date()),
+    };
+  });
+
+  let tableData = scansWithSchedule;
+  let tableMeta = meta;
+  if (tab === SCAN_JOBS_TAB.SCHEDULED) {
+    // The backend paginates real scans only. Pending schedule rows are generated
+    // client-side, so reconcile both sources before passing data/meta to the table.
+    const coveredProviderIds = await getCoveredScheduledProviderIds({
+      currentScans: scansWithSchedule,
+      realScanCount: meta?.pagination?.count ?? scansWithSchedule.length,
+      query,
+      filters,
+    });
+    const scheduledTable = appendPendingScheduleRowsToPage({
+      scans: scansWithSchedule,
+      meta,
+      page,
+      pageSize,
+      providers: filterProvidersForPendingRows(providers, searchParams),
+      schedulesByProviderId,
+      coveredProviderIds,
+      now: new Date(),
+    });
+
+    tableData = scheduledTable.data;
+    tableMeta = scheduledTable.meta;
+  }
+
   return (
     <ScanJobsTable
-      data={expandedScansData}
-      meta={meta}
+      data={tableData}
+      meta={tableMeta}
       tab={tab}
       hasFilters={hasUserFilters}
     />
diff --git a/ui/components/providers/link-to-scans.tsx b/ui/components/providers/link-to-scans.tsx
index 09f06a7fd8..fee1ec407d 100644
--- a/ui/components/providers/link-to-scans.tsx
+++ b/ui/components/providers/link-to-scans.tsx
@@ -1,25 +1,29 @@
 "use client";
 
-import Link from "next/link";
-
-import { Button } from "@/components/shadcn";
+import { StackedCell } from "@/components/shadcn";
+import { formatLocalTimeWithZone } from "@/lib/date-utils";
+import type { ScanScheduleSummary } from "@/types/scans";
 
 interface LinkToScansProps {
   hasSchedule: boolean;
-  providerUid?: string;
+  schedule?: ScanScheduleSummary;
 }
 
-export const LinkToScans = ({ hasSchedule, providerUid }: LinkToScansProps) => {
+// Matches the scans table Schedule column: cadence on top, next-run local time
+// underneath. Falls back to a plain label when the cadence is unknown.
+export const LinkToScans = ({ hasSchedule, schedule }: LinkToScansProps) => {
+  if (schedule) {
+    return (
+      <StackedCell
+        primary={schedule.cadence ?? schedule.summary}
+        secondary={formatLocalTimeWithZone(schedule.nextScanAt ?? null)}
+      />
+    );
+  }
+
   return (
-    <div className="flex items-center gap-1">
-      <span className="text-text-neutral-secondary text-sm">
-        {hasSchedule ? "Daily" : "None"}
-      </span>
-      <Button asChild variant="link" size="sm" className="text-xs">
-        <Link href={`/scans?filter[provider_uid]=${providerUid}`}>
-          View Jobs
-        </Link>
-      </Button>
-    </div>
+    <span className="text-text-neutral-secondary text-sm">
+      {hasSchedule ? "Daily" : "None"}
+    </span>
   );
 };
diff --git a/ui/components/providers/organizations/org-launch-scan.test.tsx b/ui/components/providers/organizations/org-launch-scan.test.tsx
index 75949c2ae9..f7ef851a0c 100644
--- a/ui/components/providers/organizations/org-launch-scan.test.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.test.tsx
@@ -1,8 +1,9 @@
-import { act, render, waitFor } from "@testing-library/react";
+import { act, render, screen, waitFor } from "@testing-library/react";
 import type { ComponentProps } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { useOrgSetupStore } from "@/store/organizations/store";
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
 
 import { OrgLaunchScan } from "./org-launch-scan";
 
@@ -76,4 +77,72 @@ describe("OrgLaunchScan", () => {
     expect(toastPayload.action).toBeDefined();
     expect(toastPayload.action.props.children.props.href).toBe("/scans");
   });
+
+  it("uses a single manual scan when schedules are unavailable", async () => {
+    // Given
+    launchOrganizationScansMock.mockResolvedValue({ successCount: 1 });
+    const onFooterChange = vi.fn();
+
+    render(
+      <OrgLaunchScan
+        onClose={vi.fn()}
+        onBack={vi.fn()}
+        onFooterChange={onFooterChange}
+        capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+      />,
+    );
+
+    // Then
+    expect(
+      screen.getByText(/scheduled scans are not available for trial accounts/i),
+    ).toBeInTheDocument();
+    expect(screen.queryByRole("combobox")).not.toBeInTheDocument();
+
+    // When
+    await waitFor(() => {
+      expect(onFooterChange).toHaveBeenCalled();
+    });
+    const footerConfig = onFooterChange.mock.calls.at(-1)?.[0];
+    await act(async () => {
+      footerConfig.onAction?.();
+    });
+
+    // Then
+    await waitFor(() => {
+      expect(launchOrganizationScansMock).toHaveBeenCalledTimes(1);
+    });
+    expect(launchOrganizationScansMock).toHaveBeenCalledWith(
+      ["provider-1"],
+      "single",
+    );
+  });
+
+  it("blocks manual scans when the trial scan limit is reached", async () => {
+    // Given
+    const onFooterChange = vi.fn();
+
+    render(
+      <OrgLaunchScan
+        onClose={vi.fn()}
+        onBack={vi.fn()}
+        onFooterChange={onFooterChange}
+        capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+        isScanLimitReached
+      />,
+    );
+
+    // When
+    await waitFor(() => {
+      expect(onFooterChange).toHaveBeenCalled();
+    });
+    const footerConfig = onFooterChange.mock.calls.at(-1)?.[0];
+    await act(async () => {
+      footerConfig.onAction?.();
+    });
+
+    // Then
+    expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+    expect(footerConfig.actionDisabled).toBe(true);
+    expect(launchOrganizationScansMock).not.toHaveBeenCalled();
+  });
 });
diff --git a/ui/components/providers/organizations/org-launch-scan.tsx b/ui/components/providers/organizations/org-launch-scan.tsx
index 535d4186ba..6aede38b81 100644
--- a/ui/components/providers/organizations/org-launch-scan.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.tsx
@@ -21,12 +21,23 @@ import { Spinner } from "@/components/shadcn/spinner/spinner";
 import { TreeStatusIcon } from "@/components/shadcn/tree-view/tree-status-icon";
 import { ToastAction, useToast } from "@/components/ui";
 import { useOrgSetupStore } from "@/store/organizations/store";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+} from "@/types/schedules";
 import { TREE_ITEM_STATUS } from "@/types/tree";
 
 interface OrgLaunchScanProps {
   onClose: () => void;
   onBack: () => void;
   onFooterChange: (config: WizardFooterConfig) => void;
+  /**
+   * Schedule capability override. Prowler Cloud passes MANUAL_ONLY for trial
+   * tenants so organization onboarding cannot create recurring schedules.
+   */
+  capability?: ScanScheduleCapability;
+  /** Cloud-only manual scan quota signal. */
+  isScanLimitReached?: boolean;
 }
 
 const SCAN_SCHEDULE = {
@@ -40,6 +51,8 @@ export function OrgLaunchScan({
   onClose,
   onBack,
   onFooterChange,
+  capability,
+  isScanLimitReached = false,
 }: OrgLaunchScanProps) {
   const router = useRouter();
   const { toast } = useToast();
@@ -51,13 +64,21 @@ export function OrgLaunchScan({
     SCAN_SCHEDULE.DAILY,
   );
   const launchActionRef = useRef<() => void>(() => {});
+  const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
+  const effectiveScheduleOption = isManualOnly
+    ? SCAN_SCHEDULE.SINGLE
+    : scheduleOption;
 
   const handleLaunchScan = async () => {
+    if (isManualOnly && isScanLimitReached) {
+      return;
+    }
+
     setIsLaunching(true);
 
     const result = await launchOrganizationScans(
       createdProviderIds,
-      scheduleOption,
+      effectiveScheduleOption,
     );
     const successCount = result.successCount;
 
@@ -69,7 +90,7 @@ export function OrgLaunchScan({
     toast({
       title: "Scan Launched",
       description:
-        scheduleOption === SCAN_SCHEDULE.DAILY
+        effectiveScheduleOption === SCAN_SCHEDULE.DAILY
           ? `Daily scan scheduled for ${successCount} account${successCount !== 1 ? "s" : ""}.`
           : `Single scan launched for ${successCount} account${successCount !== 1 ? "s" : ""}.`,
       action: (
@@ -92,13 +113,23 @@ export function OrgLaunchScan({
       onBack,
       showAction: true,
       actionLabel: "Launch scan",
-      actionDisabled: isLaunching || createdProviderIds.length === 0,
+      actionDisabled:
+        isLaunching ||
+        createdProviderIds.length === 0 ||
+        (isManualOnly && isScanLimitReached),
       actionType: WIZARD_FOOTER_ACTION_TYPE.BUTTON,
       onAction: () => {
         launchActionRef.current();
       },
     });
-  }, [createdProviderIds.length, isLaunching, onBack, onFooterChange]);
+  }, [
+    createdProviderIds.length,
+    isLaunching,
+    isManualOnly,
+    isScanLimitReached,
+    onBack,
+    onFooterChange,
+  ]);
 
   return (
     <div className="flex min-h-0 flex-1 flex-col gap-8">
@@ -146,30 +177,45 @@ export function OrgLaunchScan({
             </p>
           )}
 
-          <div className="flex flex-col gap-4">
-            <p className="text-text-neutral-secondary text-sm">
-              Select a Prowler scan schedule for these accounts.
-            </p>
-            <Select
-              value={scheduleOption}
-              onValueChange={(value) =>
-                setScheduleOption(value as ScanScheduleOption)
-              }
-              disabled={isLaunching}
-            >
-              <SelectTrigger className="w-full max-w-[376px]">
-                <SelectValue />
-              </SelectTrigger>
-              <SelectContent>
-                <SelectItem value={SCAN_SCHEDULE.DAILY}>
-                  Scan Daily (every 24 hours)
-                </SelectItem>
-                <SelectItem value={SCAN_SCHEDULE.SINGLE}>
-                  Run a single scan (no recurring schedule)
-                </SelectItem>
-              </SelectContent>
-            </Select>
-          </div>
+          {isManualOnly ? (
+            <div className="flex flex-col gap-3">
+              <p className="text-text-neutral-secondary text-sm">
+                Scheduled scans are not available for trial accounts. These
+                accounts will run a one-time manual scan now.
+              </p>
+              {isScanLimitReached && (
+                <p className="text-text-error-primary text-sm">
+                  You have reached your scan limit, so additional scans are not
+                  available right now.
+                </p>
+              )}
+            </div>
+          ) : (
+            <div className="flex flex-col gap-4">
+              <p className="text-text-neutral-secondary text-sm">
+                Select a Prowler scan schedule for these accounts.
+              </p>
+              <Select
+                value={scheduleOption}
+                onValueChange={(value) =>
+                  setScheduleOption(value as ScanScheduleOption)
+                }
+                disabled={isLaunching}
+              >
+                <SelectTrigger className="w-full max-w-[376px]">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value={SCAN_SCHEDULE.DAILY}>
+                    Scan Daily (every 24 hours)
+                  </SelectItem>
+                  <SelectItem value={SCAN_SCHEDULE.SINGLE}>
+                    Run a single scan (no recurring schedule)
+                  </SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+          )}
         </div>
       )}
     </div>
diff --git a/ui/components/providers/providers-accounts-view.tsx b/ui/components/providers/providers-accounts-view.tsx
index a7b7702f0e..d1ff22a958 100644
--- a/ui/components/providers/providers-accounts-view.tsx
+++ b/ui/components/providers/providers-accounts-view.tsx
@@ -29,6 +29,7 @@ import {
 } from "@/lib/tours/use-driver-tour";
 import type { FilterOption, MetaDataProps, ProviderProps } from "@/types";
 import type { ProvidersTableRow } from "@/types/providers-table";
+import type { ScanScheduleCapability } from "@/types/schedules";
 
 const addProviderFlow = getFlowById("add-provider")!;
 
@@ -51,6 +52,9 @@ interface ProvidersAccountsViewProps {
   metadata?: MetaDataProps;
   providers: ProviderProps[];
   rows: ProvidersTableRow[];
+  /** Cloud overlay seam for provider-creation scan launch. */
+  scanScheduleCapability?: ScanScheduleCapability;
+  isScanLimitReached?: boolean;
 }
 
 export function ProvidersAccountsView({
@@ -59,6 +63,8 @@ export function ProvidersAccountsView({
   metadata,
   providers,
   rows,
+  scanScheduleCapability,
+  isScanLimitReached,
 }: ProvidersAccountsViewProps) {
   const pathname = usePathname();
   const searchParams = useSearchParams();
@@ -157,6 +163,8 @@ export function ProvidersAccountsView({
         initialData={providerWizardInitialData}
         orgInitialData={orgWizardInitialData}
         refreshOnClose={false}
+        scanScheduleCapability={scanScheduleCapability}
+        isScanLimitReached={isScanLimitReached}
       />
     </>
   );
diff --git a/ui/components/providers/table/column-providers.tsx b/ui/components/providers/table/column-providers.tsx
index ec5766f491..7a0daf9b40 100644
--- a/ui/components/providers/table/column-providers.tsx
+++ b/ui/components/providers/table/column-providers.tsx
@@ -1,18 +1,13 @@
 "use client";
 
 import { ColumnDef, Row, RowSelectionState } from "@tanstack/react-table";
-import {
-  Building2,
-  FolderTree,
-  ShieldAlert,
-  ShieldCheck,
-  ShieldOff,
-} from "lucide-react";
+import { Building2, FolderTree } from "lucide-react";
 
 import type {
   OrgWizardInitialData,
   ProviderWizardInitialData,
 } from "@/components/providers/wizard/types";
+import { Badge } from "@/components/shadcn";
 import { Checkbox } from "@/components/shadcn/checkbox/checkbox";
 import { CodeSnippet } from "@/components/ui/code-snippet/code-snippet";
 import { DateWithTime, EntityInfo } from "@/components/ui/entities";
@@ -47,27 +42,24 @@ const OrganizationIcon = ({ groupKind }: { groupKind: string }) => {
 const ProviderStatusCell = ({ connected }: { connected: boolean | null }) => {
   if (connected === true) {
     return (
-      <div className="text-system-success flex items-center gap-2 text-sm whitespace-nowrap">
-        <ShieldCheck className="size-4 shrink-0" />
-        <span>Connected</span>
-      </div>
+      <Badge variant="success" className="text-sm">
+        Connected
+      </Badge>
     );
   }
 
   if (connected === false) {
     return (
-      <div className="text-text-error-primary flex items-center gap-2 text-sm whitespace-nowrap">
-        <ShieldAlert className="size-4 shrink-0" />
-        <span>Connection failed</span>
-      </div>
+      <Badge variant="error" className="text-sm">
+        Connection failed
+      </Badge>
     );
   }
 
   return (
-    <div className="text-text-neutral-secondary flex items-center gap-2 text-sm whitespace-nowrap">
-      <ShieldOff className="size-4 shrink-0" />
-      <span>Not connected</span>
-    </div>
+    <Badge variant="tag" className="text-text-neutral-secondary text-sm">
+      Not connected
+    </Badge>
   );
 };
 
@@ -259,7 +251,7 @@ export function getColumnProviders(
         return (
           <LinkToScans
             hasSchedule={row.original.hasSchedule}
-            providerUid={row.original.attributes.uid}
+            schedule={row.original.scheduleSummary}
           />
         );
       },
diff --git a/ui/components/providers/table/data-table-row-actions.test.tsx b/ui/components/providers/table/data-table-row-actions.test.tsx
index d72874af31..dc0aeadf47 100644
--- a/ui/components/providers/table/data-table-row-actions.test.tsx
+++ b/ui/components/providers/table/data-table-row-actions.test.tsx
@@ -1,7 +1,7 @@
 import { Row } from "@tanstack/react-table";
 import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { ORG_SETUP_PHASE, ORG_WIZARD_STEP } from "@/types/organizations";
 import {
@@ -10,7 +10,17 @@ import {
   ProvidersTableRow,
 } from "@/types/providers-table";
 
-const checkConnectionProviderMock = vi.hoisted(() => vi.fn());
+const { checkConnectionProviderMock, getScheduleMock, pushMock } = vi.hoisted(
+  () => ({
+    checkConnectionProviderMock: vi.fn(),
+    getScheduleMock: vi.fn(),
+    pushMock: vi.fn(),
+  }),
+);
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ push: pushMock }),
+}));
 
 vi.mock("@/actions/organizations/organizations", () => ({
   updateOrganizationName: vi.fn(),
@@ -20,6 +30,10 @@ vi.mock("@/actions/providers/providers", () => ({
   checkConnectionProvider: checkConnectionProviderMock,
 }));
 
+vi.mock("@/actions/schedules", () => ({
+  getSchedule: getScheduleMock,
+}));
+
 vi.mock("../forms/delete-form", () => ({
   DeleteForm: () => null,
 }));
@@ -32,6 +46,26 @@ vi.mock("../forms/edit-name-form", () => ({
   EditNameForm: () => null,
 }));
 
+vi.mock("@/components/scans/schedule/edit-scan-schedule-modal", () => ({
+  EDIT_SCAN_SCHEDULE_STATE: {
+    LOADING: "loading",
+    LOADED: "loaded",
+    ERROR: "error",
+  },
+  EditScanScheduleModal: ({
+    open,
+    provider,
+  }: {
+    open: boolean;
+    provider?: { providerId: string };
+  }) =>
+    open ? (
+      <div role="dialog" aria-label="Edit Scan Schedule">
+        Editing schedule for {provider?.providerId}
+      </div>
+    ) : null,
+}));
+
 vi.mock("@/components/ui", () => ({
   useToast: () => ({ toast: vi.fn() }),
 }));
@@ -143,6 +177,23 @@ const createOuRow = () =>
   }) as unknown as Row<ProvidersTableRow>;
 
 describe("DataTableRowActions", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  beforeEach(() => {
+    getScheduleMock.mockResolvedValue({
+      data: {
+        type: "schedules",
+        id: "provider-1",
+        attributes: { scan_hour: null },
+        relationships: {
+          provider: { data: { type: "providers", id: "provider-1" } },
+        },
+      },
+    });
+  });
+
   it("renders Add Credentials for provider rows without credentials", async () => {
     // Given
     const user = userEvent.setup();
@@ -163,12 +214,97 @@ describe("DataTableRowActions", () => {
 
     // Then
     expect(screen.getByText("Edit Provider Alias")).toBeInTheDocument();
+    // Advanced schedule editing is gated to Prowler Cloud subscribed accounts.
+    expect(screen.queryByText("Edit Scan Schedule")).not.toBeInTheDocument();
     expect(screen.getByText("Add Credentials")).toBeInTheDocument();
     expect(screen.getByText("Test Connection")).toBeInTheDocument();
     expect(screen.getByText("Delete Provider")).toBeInTheDocument();
     expect(screen.queryByText("Update Credentials")).not.toBeInTheDocument();
   });
 
+  it("navigates to the provider-filtered scan jobs from View Scan Jobs", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(
+      <DataTableRowActions
+        row={createRow(true)}
+        hasSelection={false}
+        isRowSelected={false}
+        testableProviderIds={[]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button"));
+    await user.click(screen.getByText("View Scan Jobs"));
+
+    // Then: navigates with the key the scans filter bar binds to
+    // (provider_uid__in), URL-encoded, so the provider is pre-selected.
+    expect(pushMock).toHaveBeenCalledWith(
+      "/scans?filter%5Bprovider_uid__in%5D=111111111111",
+    );
+  });
+
+  it("URL-encodes provider UIDs that contain unsafe characters (e.g. GitHub)", async () => {
+    // Given a GitHub provider whose UID is a URL.
+    const user = userEvent.setup();
+    const row = createRow(true);
+    (
+      row.original as unknown as { attributes: { uid: string } }
+    ).attributes.uid = "https://github.com/prowler-cloud/prowler";
+
+    render(
+      <DataTableRowActions
+        row={row}
+        hasSelection={false}
+        isRowSelected={false}
+        testableProviderIds={[]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button"));
+    await user.click(screen.getByText("View Scan Jobs"));
+
+    // Then the ':' and '/' are encoded instead of leaking into the URL raw.
+    expect(pushMock).toHaveBeenCalledWith(
+      "/scans?filter%5Bprovider_uid__in%5D=https%3A%2F%2Fgithub.com%2Fprowler-cloud%2Fprowler",
+    );
+  });
+
+  it("opens Edit Scan Schedule for Prowler Cloud subscribed provider rows", async () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    const user = userEvent.setup();
+
+    render(
+      <DataTableRowActions
+        row={createRow(true)}
+        hasSelection={false}
+        isRowSelected={false}
+        testableProviderIds={[]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button"));
+    await user.click(screen.getByText("Edit Scan Schedule"));
+
+    // Then
+    expect(
+      screen.getByRole("dialog", { name: /edit scan schedule/i }),
+    ).toHaveTextContent("Editing schedule for provider-1");
+  });
+
   it("renders Update Credentials for provider rows with credentials", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/components/providers/table/data-table-row-actions.tsx b/ui/components/providers/table/data-table-row-actions.tsx
index 9b531f272a..44d7198e2e 100644
--- a/ui/components/providers/table/data-table-row-actions.tsx
+++ b/ui/components/providers/table/data-table-row-actions.tsx
@@ -1,16 +1,31 @@
 "use client";
 
 import { Row } from "@tanstack/react-table";
-import { KeyRound, Pencil, Rocket, Trash2 } from "lucide-react";
+import {
+  CalendarClock,
+  KeyRound,
+  Pencil,
+  Rocket,
+  Timer,
+  Trash2,
+} from "lucide-react";
+import { useRouter } from "next/navigation";
 import { useState } from "react";
 
 import { updateOrganizationName } from "@/actions/organizations/organizations";
 import { updateProvider } from "@/actions/providers";
+import { getSchedule } from "@/actions/schedules";
 import {
   ORG_WIZARD_INTENT,
   OrgWizardInitialData,
   ProviderWizardInitialData,
 } from "@/components/providers/wizard/types";
+import {
+  EDIT_SCAN_SCHEDULE_STATE,
+  EditScanScheduleModal,
+  type EditScanScheduleState,
+  type ScanScheduleProvider,
+} from "@/components/scans/schedule/edit-scan-schedule-modal";
 import {
   ActionDropdown,
   ActionDropdownDangerZone,
@@ -20,6 +35,8 @@ import { Modal } from "@/components/shadcn/modal";
 import { useToast } from "@/components/ui";
 import { runWithConcurrencyLimit } from "@/lib/concurrency";
 import { testProviderConnection } from "@/lib/provider-helpers";
+import { getScanScheduleCapability } from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
 import { ORG_SETUP_PHASE, ORG_WIZARD_STEP } from "@/types/organizations";
 import { PROVIDER_WIZARD_MODE } from "@/types/provider-wizard";
 import {
@@ -29,6 +46,11 @@ import {
   ProvidersOrganizationRow,
   ProvidersTableRow,
 } from "@/types/providers-table";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+  type ScheduleApiResponse,
+} from "@/types/schedules";
 
 import { DeleteForm } from "../forms/delete-form";
 import { DeleteOrganizationForm } from "../forms/delete-organization-form";
@@ -46,6 +68,13 @@ interface DataTableRowActionsProps {
   onClearSelection: () => void;
   onOpenProviderWizard: (initialData?: ProviderWizardInitialData) => void;
   onOpenOrganizationWizard: (initialData: OrgWizardInitialData) => void;
+  /**
+   * Schedule capability override. Absent in OSS (defaults to a Cloud-vs-non-Cloud
+   * decision). The prowler-cloud overlay injects a billing-aware capability so
+   * only subscribed Cloud accounts can open the advanced schedule editor (which
+   * talks to the new schedule API).
+   */
+  capability?: ScanScheduleCapability;
 }
 
 function collectTestableChildProviderIds(rows: ProvidersTableRow[]): string[] {
@@ -200,11 +229,20 @@ export function DataTableRowActions({
   onClearSelection,
   onOpenProviderWizard,
   onOpenOrganizationWizard,
+  capability,
 }: DataTableRowActionsProps) {
+  const canEditSchedule =
+    (capability ?? getScanScheduleCapability(isCloud())) ===
+    SCAN_SCHEDULE_CAPABILITY.ADVANCED;
   const [isEditOpen, setIsEditOpen] = useState(false);
+  const [isScheduleOpen, setIsScheduleOpen] = useState(false);
+  const [scheduleState, setScheduleState] = useState<EditScanScheduleState>({
+    kind: EDIT_SCAN_SCHEDULE_STATE.LOADING,
+  });
   const [isDeleteOpen, setIsDeleteOpen] = useState(false);
   const [loading, setLoading] = useState(false);
   const { toast } = useToast();
+  const router = useRouter();
 
   const rowData = row.original;
   const isOrganizationRow = isProvidersOrganizationRow(rowData);
@@ -215,6 +253,14 @@ export function DataTableRowActions({
   const providerAlias = provider?.attributes.alias ?? null;
   const providerSecretId = provider?.relationships.secret.data?.id ?? null;
   const hasSecret = Boolean(provider?.relationships.secret.data);
+  const scheduleProvider: ScanScheduleProvider | undefined = provider
+    ? {
+        providerId,
+        providerType,
+        providerUid,
+        providerAlias,
+      }
+    : undefined;
 
   const orgGroupKind = isOrganizationRow ? rowData.groupKind : null;
   const childTestableIds = isOrganizationRow
@@ -283,6 +329,40 @@ export function DataTableRowActions({
     await handleBulkTest(childTestableIds);
   };
 
+  const openScheduleEditor = async () => {
+    if (!providerId) {
+      setScheduleState({
+        kind: EDIT_SCAN_SCHEDULE_STATE.ERROR,
+        message: "Provider ID is not available.",
+      });
+      setIsScheduleOpen(true);
+      return;
+    }
+
+    setScheduleState({ kind: EDIT_SCAN_SCHEDULE_STATE.LOADING });
+    setIsScheduleOpen(true);
+
+    const response = (await getSchedule(providerId)) as
+      | ScheduleApiResponse
+      | { error?: string };
+
+    if (!response || ("error" in response && response.error)) {
+      setScheduleState({
+        kind: EDIT_SCAN_SCHEDULE_STATE.ERROR,
+        message:
+          response && "error" in response && response.error
+            ? response.error
+            : "Failed to load scan schedule.",
+      });
+      return;
+    }
+
+    setScheduleState({
+      kind: EDIT_SCAN_SCHEDULE_STATE.LOADED,
+      schedule: "data" in response ? response.data : null,
+    });
+  };
+
   // When this row is part of the selection, only show "Test Connection"
   if (hasSelection && isRowSelected) {
     const bulkCount =
@@ -364,6 +444,12 @@ export function DataTableRowActions({
           <DeleteForm providerId={providerId} setIsOpen={setIsDeleteOpen} />
         )}
       </Modal>
+      <EditScanScheduleModal
+        open={isScheduleOpen}
+        onOpenChange={setIsScheduleOpen}
+        provider={scheduleProvider}
+        state={scheduleState}
+      />
       <div className="relative flex items-center justify-end gap-2">
         <ActionDropdown>
           <ActionDropdownItem
@@ -371,6 +457,27 @@ export function DataTableRowActions({
             label="Edit Provider Alias"
             onSelect={() => setIsEditOpen(true)}
           />
+          <ActionDropdownItem
+            icon={<Timer />}
+            label="View Scan Jobs"
+            onSelect={() => {
+              // Use the same key the scans filter bar binds to
+              // (`provider_uid__in`) so the provider is pre-selected in the UI,
+              // and URLSearchParams to encode UIDs that contain URL-unsafe chars
+              // (e.g. GitHub UIDs like https://github.com/org/repo).
+              const params = new URLSearchParams({
+                "filter[provider_uid__in]": providerUid,
+              });
+              router.push(`/scans?${params.toString()}`);
+            }}
+          />
+          {canEditSchedule && (
+            <ActionDropdownItem
+              icon={<CalendarClock />}
+              label="Edit Scan Schedule"
+              onSelect={() => void openScheduleEditor()}
+            />
+          )}
           <ActionDropdownItem
             icon={<KeyRound />}
             label={hasSecret ? "Update Credentials" : "Add Credentials"}
diff --git a/ui/components/providers/wizard/provider-wizard-modal.tsx b/ui/components/providers/wizard/provider-wizard-modal.tsx
index 36c5058120..8904b35e43 100644
--- a/ui/components/providers/wizard/provider-wizard-modal.tsx
+++ b/ui/components/providers/wizard/provider-wizard-modal.tsx
@@ -15,6 +15,7 @@ import {
   PROVIDER_WIZARD_MODE,
   PROVIDER_WIZARD_STEP,
 } from "@/types/provider-wizard";
+import type { ScanScheduleCapability } from "@/types/schedules";
 
 import { useProviderWizardController } from "./hooks/use-provider-wizard-controller";
 import {
@@ -40,6 +41,10 @@ interface ProviderWizardModalProps {
   initialData?: ProviderWizardInitialData;
   orgInitialData?: OrgWizardInitialData;
   refreshOnClose?: boolean;
+  /** Cloud overlay seam; defaults to the environment-resolved capability. */
+  scanScheduleCapability?: ScanScheduleCapability;
+  /** Cloud-only manual scan quota signal. */
+  isScanLimitReached?: boolean;
 }
 
 export function ProviderWizardModal({
@@ -48,6 +53,8 @@ export function ProviderWizardModal({
   initialData,
   orgInitialData,
   refreshOnClose,
+  scanScheduleCapability,
+  isScanLimitReached,
 }: ProviderWizardModalProps) {
   const {
     backToProviderFlow,
@@ -107,234 +114,246 @@ export function ProviderWizardModal({
         </div>
       </DialogHeader>
 
-      <div className="mt-6 flex min-h-0 flex-1 flex-col overflow-hidden lg:mt-8 lg:flex-row">
-        <div className="mb-4 box-border w-full shrink-0 lg:mb-0 lg:w-[328px]">
-          {isProviderFlow ? (
-            <WizardStepper
-              currentStep={currentStep}
-              steps={
-                mode === PROVIDER_WIZARD_MODE.UPDATE
-                  ? UPDATE_MODE_WIZARD_STEPS
-                  : undefined
-              }
-            />
-          ) : (
-            <WizardStepper
-              currentStep={orgCurrentStep}
-              stepOffset={getOrganizationsStepperOffset(
-                orgCurrentStep,
-                orgSetupPhase,
-              )}
-            />
-          )}
-        </div>
-        <div aria-hidden className="hidden w-[100px] min-w-0 shrink lg:block" />
-
-        {/* Anchors the add-provider tour's final step to the whole right section —
-            the form inputs AND the footer — so the spotlight covers the Next button
-            instead of leaving it under the overlay. The popover still pins to the left
-            of this section, beside the inputs. */}
-        <div
-          data-tour-id="add-provider-wizard-body"
-          className="relative flex min-h-0 flex-1 flex-col overflow-hidden"
-        >
-          <div className="relative min-h-0 flex-1 overflow-hidden">
-            <div
-              ref={containerRef}
-              className="minimal-scrollbar h-full w-full overflow-y-scroll [scrollbar-gutter:stable] lg:ml-auto lg:max-w-[620px] xl:max-w-[700px]"
-            >
-              {isProviderFlow &&
-                currentStep === PROVIDER_WIZARD_STEP.CONNECT && (
-                  <ConnectStep
-                    onNext={() => {
-                      setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS);
-                      // Reaching credentials is the tour's handoff point: end it so the
-                      // user continues on their own. No-op off-onboarding.
-                      endActiveTour();
-                    }}
-                    onSelectOrganizations={openOrganizationsFlow}
-                    onFooterChange={setFooterConfig}
-                    onProviderTypeChange={(providerType) => {
-                      // Picking a type reveals the account-detail inputs. Advance the tour
-                      // to its wizard-body step, pinned beside the form. No-op off-onboarding.
-                      if (providerType) advanceActiveTour();
-                      setProviderTypeHint(providerType);
-                    }}
-                  />
+      {/* Anchors the add-provider tour's final step to the wizard content and
+          footer, keeping the real form controls clickable under the overlay. */}
+      <div
+        data-tour-id="add-provider-wizard-body"
+        className="mt-6 flex min-h-0 flex-1 flex-col overflow-hidden lg:mt-8"
+      >
+        <div className="flex min-h-0 flex-1 flex-col overflow-hidden lg:flex-row">
+          <div className="mb-4 box-border w-full shrink-0 lg:mb-0 lg:w-[328px]">
+            {isProviderFlow ? (
+              <WizardStepper
+                currentStep={currentStep}
+                steps={
+                  mode === PROVIDER_WIZARD_MODE.UPDATE
+                    ? UPDATE_MODE_WIZARD_STEPS
+                    : undefined
+                }
+              />
+            ) : (
+              <WizardStepper
+                currentStep={orgCurrentStep}
+                stepOffset={getOrganizationsStepperOffset(
+                  orgCurrentStep,
+                  orgSetupPhase,
                 )}
-
-              {isProviderFlow &&
-                currentStep === PROVIDER_WIZARD_STEP.CREDENTIALS && (
-                  <CredentialsStep
-                    onNext={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
-                    onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.CONNECT)}
-                    onFooterChange={setFooterConfig}
-                  />
-                )}
-
-              {isProviderFlow && currentStep === PROVIDER_WIZARD_STEP.TEST && (
-                <TestConnectionStep
-                  onSuccess={handleTestSuccess}
-                  onResetCredentials={() =>
-                    setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS)
-                  }
-                  onFooterChange={setFooterConfig}
-                />
-              )}
-
-              {isProviderFlow &&
-                currentStep === PROVIDER_WIZARD_STEP.LAUNCH && (
-                  <LaunchStep
-                    onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
-                    onClose={handleClose}
-                    onFooterChange={setFooterConfig}
-                  />
-                )}
-
-              {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.SETUP && (
-                <OrgSetupForm
-                  onBack={isOrgDirectEntry ? handleClose : backToProviderFlow}
-                  onClose={handleClose}
-                  onNext={() => {
-                    setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
-                  }}
-                  onFooterChange={setFooterConfig}
-                  onPhaseChange={setOrgSetupPhase}
-                  initialPhase={orgSetupPhase}
-                  initialValues={
-                    orgInitialData
-                      ? {
-                          organizationName: orgInitialData.organizationName,
-                          awsOrgId: orgInitialData.externalId,
-                        }
-                      : undefined
-                  }
-                  intent={orgInitialData?.intent}
-                />
-              )}
-
-              {!isProviderFlow &&
-                orgCurrentStep === ORG_WIZARD_STEP.VALIDATE && (
-                  <OrgAccountSelection
-                    onBack={() => {
-                      setOrgCurrentStep(ORG_WIZARD_STEP.SETUP);
-                      setOrgSetupPhase(ORG_SETUP_PHASE.ACCESS);
-                    }}
-                    onNext={() => {
-                      setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
-                    }}
-                    onSkip={() => {
-                      setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
-                    }}
-                    onFooterChange={setFooterConfig}
-                  />
-                )}
-
-              {!isProviderFlow && orgCurrentStep === ORG_WIZARD_STEP.LAUNCH && (
-                <OrgLaunchScan
-                  onClose={handleClose}
-                  onBack={() => {
-                    setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
-                  }}
-                  onFooterChange={setFooterConfig}
-                />
-              )}
-
-              {/* Sentinel element for IntersectionObserver scroll detection */}
-              <div ref={sentinelRef} aria-hidden className="h-px shrink-0" />
-            </div>
-
-            {showScrollHint && (
-              <div className="pointer-events-none absolute right-0 bottom-0 left-0 z-10">
-                <div className="from-bg-neutral-secondary h-12 bg-gradient-to-t to-transparent" />
-                <div className="absolute inset-x-0 bottom-2 flex justify-center">
-                  <span className="bg-bg-neutral-secondary/85 text-text-neutral-tertiary rounded-full px-3 py-1 text-xs backdrop-blur-sm">
-                    Scroll to see more
-                  </span>
-                </div>
-              </div>
+              />
             )}
           </div>
-          {/* Inside the highlighted right section so the tour spotlight covers the Next
-            button (no longer dimmed by the overlay). Aligned to the form width so Next
-            stays at the right edge. */}
-          {(resolvedFooterConfig.showBack ||
-            resolvedFooterConfig.showSecondaryAction ||
-            resolvedFooterConfig.showAction) && (
-            <div className="mt-8 w-full pt-6 lg:ml-auto lg:max-w-[620px] xl:max-w-[700px]">
-              <div className="flex items-center justify-between">
-                <div>
-                  {resolvedFooterConfig.showBack && (
-                    <Button
-                      type="button"
-                      variant="outline"
-                      size="xl"
-                      disabled={resolvedFooterConfig.backDisabled}
-                      onClick={resolvedFooterConfig.onBack}
-                    >
-                      {resolvedFooterConfig.backLabel}
-                    </Button>
-                  )}
-                </div>
-                <div className="flex items-center gap-6">
-                  {resolvedFooterConfig.showSecondaryAction && (
-                    <Button
-                      size={
-                        resolvedFooterConfig.secondaryActionVariant === "link"
-                          ? "link-sm"
-                          : "xl"
-                      }
-                      className={
-                        resolvedFooterConfig.secondaryActionVariant === "link"
-                          ? "h-auto p-0"
-                          : undefined
-                      }
-                      variant={resolvedFooterConfig.secondaryActionVariant}
-                      type={
-                        resolvedFooterConfig.secondaryActionType ===
-                        WIZARD_FOOTER_ACTION_TYPE.SUBMIT
-                          ? "submit"
-                          : "button"
-                      }
-                      form={resolvedFooterConfig.secondaryActionFormId}
-                      disabled={resolvedFooterConfig.secondaryActionDisabled}
-                      onClick={
-                        resolvedFooterConfig.secondaryActionType ===
-                        WIZARD_FOOTER_ACTION_TYPE.BUTTON
-                          ? resolvedFooterConfig.onSecondaryAction
-                          : undefined
-                      }
-                    >
-                      {resolvedFooterConfig.secondaryActionLabel}
-                    </Button>
+          <div
+            aria-hidden
+            className="hidden w-[100px] min-w-0 shrink lg:block"
+          />
+
+          <div className="relative flex min-h-0 flex-1 flex-col overflow-hidden">
+            <div className="relative min-h-0 flex-1 overflow-hidden">
+              <div
+                ref={containerRef}
+                className="minimal-scrollbar h-full w-full overflow-y-scroll [scrollbar-gutter:stable] lg:ml-auto lg:max-w-[620px] xl:max-w-[700px]"
+              >
+                {isProviderFlow &&
+                  currentStep === PROVIDER_WIZARD_STEP.CONNECT && (
+                    <ConnectStep
+                      onNext={() => {
+                        setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS);
+                        // Reaching credentials is the tour's handoff point: end it so the
+                        // user continues on their own. No-op off-onboarding.
+                        endActiveTour();
+                      }}
+                      onSelectOrganizations={openOrganizationsFlow}
+                      onFooterChange={setFooterConfig}
+                      onProviderTypeChange={(providerType) => {
+                        // Picking a type reveals the account-detail inputs. Advance the tour
+                        // to its wizard-body step, pinned beside the form. No-op off-onboarding.
+                        if (providerType) advanceActiveTour();
+                        setProviderTypeHint(providerType);
+                      }}
+                    />
                   )}
 
-                  {resolvedFooterConfig.showAction && (
-                    <Button
-                      size="xl"
-                      type={
-                        resolvedFooterConfig.actionType ===
-                        WIZARD_FOOTER_ACTION_TYPE.SUBMIT
-                          ? "submit"
-                          : "button"
+                {isProviderFlow &&
+                  currentStep === PROVIDER_WIZARD_STEP.CREDENTIALS && (
+                    <CredentialsStep
+                      onNext={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
+                      onBack={() =>
+                        setCurrentStep(PROVIDER_WIZARD_STEP.CONNECT)
                       }
-                      form={resolvedFooterConfig.actionFormId}
-                      disabled={resolvedFooterConfig.actionDisabled}
-                      onClick={
-                        resolvedFooterConfig.actionType ===
-                        WIZARD_FOOTER_ACTION_TYPE.BUTTON
-                          ? resolvedFooterConfig.onAction
+                      onFooterChange={setFooterConfig}
+                    />
+                  )}
+
+                {isProviderFlow &&
+                  currentStep === PROVIDER_WIZARD_STEP.TEST && (
+                    <TestConnectionStep
+                      onSuccess={handleTestSuccess}
+                      onResetCredentials={() =>
+                        setCurrentStep(PROVIDER_WIZARD_STEP.CREDENTIALS)
+                      }
+                      onFooterChange={setFooterConfig}
+                    />
+                  )}
+
+                {isProviderFlow &&
+                  currentStep === PROVIDER_WIZARD_STEP.LAUNCH && (
+                    <LaunchStep
+                      onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
+                      onClose={handleClose}
+                      onFooterChange={setFooterConfig}
+                      capability={scanScheduleCapability}
+                      isScanLimitReached={isScanLimitReached}
+                    />
+                  )}
+
+                {!isProviderFlow &&
+                  orgCurrentStep === ORG_WIZARD_STEP.SETUP && (
+                    <OrgSetupForm
+                      onBack={
+                        isOrgDirectEntry ? handleClose : backToProviderFlow
+                      }
+                      onClose={handleClose}
+                      onNext={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
+                      }}
+                      onFooterChange={setFooterConfig}
+                      onPhaseChange={setOrgSetupPhase}
+                      initialPhase={orgSetupPhase}
+                      initialValues={
+                        orgInitialData
+                          ? {
+                              organizationName: orgInitialData.organizationName,
+                              awsOrgId: orgInitialData.externalId,
+                            }
                           : undefined
                       }
-                    >
-                      {resolvedFooterConfig.actionLabel}
-                    </Button>
+                      intent={orgInitialData?.intent}
+                    />
                   )}
+
+                {!isProviderFlow &&
+                  orgCurrentStep === ORG_WIZARD_STEP.VALIDATE && (
+                    <OrgAccountSelection
+                      onBack={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.SETUP);
+                        setOrgSetupPhase(ORG_SETUP_PHASE.ACCESS);
+                      }}
+                      onNext={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
+                      }}
+                      onSkip={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.LAUNCH);
+                      }}
+                      onFooterChange={setFooterConfig}
+                    />
+                  )}
+
+                {!isProviderFlow &&
+                  orgCurrentStep === ORG_WIZARD_STEP.LAUNCH && (
+                    <OrgLaunchScan
+                      onClose={handleClose}
+                      onBack={() => {
+                        setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
+                      }}
+                      onFooterChange={setFooterConfig}
+                      capability={scanScheduleCapability}
+                      isScanLimitReached={isScanLimitReached}
+                    />
+                  )}
+
+                {/* Sentinel element for IntersectionObserver scroll detection */}
+                <div ref={sentinelRef} aria-hidden className="h-px shrink-0" />
+              </div>
+
+              {showScrollHint && (
+                <div className="pointer-events-none absolute right-0 bottom-0 left-0 z-10">
+                  <div className="from-bg-neutral-secondary h-12 bg-gradient-to-t to-transparent" />
+                  <div className="absolute inset-x-0 bottom-2 flex justify-center">
+                    <span className="bg-bg-neutral-secondary/85 text-text-neutral-tertiary rounded-full px-3 py-1 text-xs backdrop-blur-sm">
+                      Scroll to see more
+                    </span>
+                  </div>
                 </div>
+              )}
+            </div>
+          </div>
+        </div>
+
+        {(resolvedFooterConfig.showBack ||
+          resolvedFooterConfig.showSecondaryAction ||
+          resolvedFooterConfig.showAction) && (
+          <div className="mt-8 pt-6">
+            <div className="flex items-center justify-between">
+              <div>
+                {resolvedFooterConfig.showBack && (
+                  <Button
+                    type="button"
+                    variant="outline"
+                    size="xl"
+                    disabled={resolvedFooterConfig.backDisabled}
+                    onClick={resolvedFooterConfig.onBack}
+                  >
+                    {resolvedFooterConfig.backLabel}
+                  </Button>
+                )}
+              </div>
+              <div className="flex items-center gap-6">
+                {resolvedFooterConfig.showSecondaryAction && (
+                  <Button
+                    size={
+                      resolvedFooterConfig.secondaryActionVariant === "link"
+                        ? "link-sm"
+                        : "xl"
+                    }
+                    className={
+                      resolvedFooterConfig.secondaryActionVariant === "link"
+                        ? "h-auto p-0"
+                        : undefined
+                    }
+                    variant={resolvedFooterConfig.secondaryActionVariant}
+                    type={
+                      resolvedFooterConfig.secondaryActionType ===
+                      WIZARD_FOOTER_ACTION_TYPE.SUBMIT
+                        ? "submit"
+                        : "button"
+                    }
+                    form={resolvedFooterConfig.secondaryActionFormId}
+                    disabled={resolvedFooterConfig.secondaryActionDisabled}
+                    onClick={
+                      resolvedFooterConfig.secondaryActionType ===
+                      WIZARD_FOOTER_ACTION_TYPE.BUTTON
+                        ? resolvedFooterConfig.onSecondaryAction
+                        : undefined
+                    }
+                  >
+                    {resolvedFooterConfig.secondaryActionLabel}
+                  </Button>
+                )}
+
+                {resolvedFooterConfig.showAction && (
+                  <Button
+                    size="xl"
+                    type={
+                      resolvedFooterConfig.actionType ===
+                      WIZARD_FOOTER_ACTION_TYPE.SUBMIT
+                        ? "submit"
+                        : "button"
+                    }
+                    form={resolvedFooterConfig.actionFormId}
+                    disabled={resolvedFooterConfig.actionDisabled}
+                    onClick={
+                      resolvedFooterConfig.actionType ===
+                      WIZARD_FOOTER_ACTION_TYPE.BUTTON
+                        ? resolvedFooterConfig.onAction
+                        : undefined
+                    }
+                  >
+                    {resolvedFooterConfig.actionLabel}
+                  </Button>
+                )}
               </div>
             </div>
-          )}
-        </div>
+          </div>
+        )}
       </div>
     </Modal>
   );
diff --git a/ui/components/providers/wizard/steps/launch-step.test.tsx b/ui/components/providers/wizard/steps/launch-step.test.tsx
index 1f33955849..cfa8e2e63d 100644
--- a/ui/components/providers/wizard/steps/launch-step.test.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.test.tsx
@@ -1,21 +1,32 @@
-import { act, render, waitFor } from "@testing-library/react";
+import { act, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import type { ComponentProps } from "react";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import { useProviderWizardStore } from "@/store/provider-wizard/store";
 import { SCAN_JOBS_TAB } from "@/types";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  SCHEDULE_FREQUENCY,
+} from "@/types/schedules";
 
 import { LaunchStep } from "./launch-step";
 
-const { scheduleDailyMock, scanOnDemandMock, toastMock } = vi.hoisted(() => ({
-  scheduleDailyMock: vi.fn(),
-  scanOnDemandMock: vi.fn(),
-  toastMock: vi.fn(),
-}));
+const { scanOnDemandMock, scheduleDailyMock, toastMock, updateScheduleMock } =
+  vi.hoisted(() => ({
+    scanOnDemandMock: vi.fn(),
+    scheduleDailyMock: vi.fn(),
+    toastMock: vi.fn(),
+    updateScheduleMock: vi.fn(),
+  }));
 
 vi.mock("@/actions/scans", () => ({
-  scheduleDaily: scheduleDailyMock,
   scanOnDemand: scanOnDemandMock,
+  scheduleDaily: scheduleDailyMock,
+}));
+
+vi.mock("@/actions/schedules", () => ({
+  updateSchedule: updateScheduleMock,
 }));
 
 vi.mock("@/components/ui", () => ({
@@ -27,64 +38,333 @@ vi.mock("@/components/ui", () => ({
   }),
 }));
 
+const seedConnectedProvider = () => {
+  useProviderWizardStore.setState({
+    providerId: "provider-1",
+    providerType: "gcp",
+    providerUid: "project-123",
+    mode: "add",
+  });
+};
+
+const lastFooterConfig = (onFooterChange: ReturnType<typeof vi.fn>) =>
+  onFooterChange.mock.calls.at(-1)?.[0];
+
 describe("LaunchStep", () => {
   beforeEach(() => {
+    vi.spyOn(Intl, "DateTimeFormat").mockReturnValue({
+      resolvedOptions: () => ({ timeZone: "Europe/Madrid" }),
+    } as Intl.DateTimeFormat);
     sessionStorage.clear();
     localStorage.clear();
+    updateScheduleMock.mockReset();
     scheduleDailyMock.mockReset();
     scanOnDemandMock.mockReset();
     toastMock.mockReset();
     useProviderWizardStore.getState().reset();
   });
 
-  it("launches a daily scan and shows toast", async () => {
-    // Given
-    const onClose = vi.fn();
-    const onFooterChange = vi.fn();
-    useProviderWizardStore.setState({
-      providerId: "provider-1",
-      providerType: "gcp",
-      providerUid: "project-123",
-      mode: "add",
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  describe("Prowler OSS (non-Cloud)", () => {
+    beforeEach(() => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+      scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
     });
 
-    scheduleDailyMock.mockResolvedValue({ data: { id: "scan-1" } });
+    it("defaults to run now and locks schedule mode outside Cloud", async () => {
+      // Given
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
 
-    render(
-      <LaunchStep
-        onBack={vi.fn()}
-        onClose={onClose}
-        onFooterChange={onFooterChange}
-      />,
-    );
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={vi.fn()}
+          onFooterChange={onFooterChange}
+        />,
+      );
 
-    await waitFor(() => {
-      expect(onFooterChange).toHaveBeenCalled();
+      // Then
+      expect(screen.getByText("Account Connected!")).toBeInTheDocument();
+      expect(screen.getByRole("radio", { name: "Run now" })).toBeChecked();
+      expect(
+        screen.getByRole("radio", { name: "On a schedule" }),
+      ).toBeDisabled();
+      expect(
+        screen.queryByRole("combobox", { name: /repeats/i }),
+      ).not.toBeInTheDocument();
+
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+      expect(lastFooterConfig(onFooterChange)?.actionLabel).toBe("Launch scan");
     });
 
-    // When
-    const initialFooterConfig = onFooterChange.mock.calls.at(-1)?.[0];
-    await act(async () => {
-      initialFooterConfig.onAction?.();
+    it("launches only an on-demand scan and never creates a legacy daily schedule", async () => {
+      // Given
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={onClose}
+          onFooterChange={onFooterChange}
+        />,
+      );
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      const sentFormData = scanOnDemandMock.mock.calls[0]?.[0] as FormData;
+      expect(sentFormData.get("providerId")).toBe("provider-1");
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      expect(updateScheduleMock).not.toHaveBeenCalled();
+      expect(onClose).toHaveBeenCalledTimes(1);
+    });
+  });
+
+  describe("Prowler Cloud subscribed", () => {
+    beforeEach(() => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+      updateScheduleMock.mockResolvedValue({ data: { id: "provider-1" } });
     });
 
-    // Then
-    await waitFor(() => {
-      expect(scheduleDailyMock).toHaveBeenCalledTimes(1);
+    it("defaults to schedule mode and saves through the new schedule API", async () => {
+      // Given
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={onClose}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+
+      // Then advanced cadence selector is enabled
+      expect(
+        screen.getByRole("radio", { name: "On a schedule" }),
+      ).toBeChecked();
+      expect(
+        screen.getByRole("combobox", { name: /repeats/i }),
+      ).not.toBeDisabled();
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(updateScheduleMock).toHaveBeenCalledTimes(1));
+      expect(updateScheduleMock).toHaveBeenCalledWith(
+        "provider-1",
+        expect.objectContaining({
+          scan_enabled: true,
+          scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+          scan_hour: expect.any(Number),
+          scan_timezone: "Europe/Madrid",
+          scan_day_of_week: null,
+          scan_day_of_month: null,
+        }),
+      );
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      expect(scanOnDemandMock).not.toHaveBeenCalled();
+      expect(onClose).toHaveBeenCalledTimes(1);
+      const toastPayload = toastMock.mock.calls[0]?.[0];
+      expect(toastPayload.action.props.children.props.href).toBe(
+        `/scans?tab=${SCAN_JOBS_TAB.SCHEDULED}`,
+      );
     });
 
-    const sentFormData = scheduleDailyMock.mock.calls[0]?.[0] as FormData;
-    expect(sentFormData.get("providerId")).toBe("provider-1");
-    expect(onClose).toHaveBeenCalledTimes(1);
-    expect(scanOnDemandMock).not.toHaveBeenCalled();
-    expect(toastMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        title: "Scan Launched",
-      }),
-    );
-    const toastPayload = toastMock.mock.calls[0]?.[0];
-    expect(toastPayload.action.props.children.props.href).toBe(
-      `/scans?tab=${SCAN_JOBS_TAB.ACTIVE}`,
-    );
+    it("also launches an on-demand scan when the checkbox is checked", async () => {
+      // Given
+      const user = userEvent.setup();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+      scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await user.click(
+        screen.getByRole("checkbox", { name: /launch an initial scan now/i }),
+      );
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(updateScheduleMock).toHaveBeenCalledTimes(1));
+      expect(scanOnDemandMock).toHaveBeenCalledTimes(1);
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      const toastPayload = toastMock.mock.calls[0]?.[0];
+      expect(toastPayload.action.props.children.props.href).toBe(
+        `/scans?tab=${SCAN_JOBS_TAB.ACTIVE}`,
+      );
+    });
+
+    it("launches only an on-demand scan when run now is selected", async () => {
+      // Given
+      const user = userEvent.setup();
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+      scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={onClose}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await user.click(
+        screen.getByRole("radio", {
+          name: "Run now",
+        }),
+      );
+      await waitFor(() =>
+        expect(lastFooterConfig(onFooterChange)?.actionLabel).toBe(
+          "Launch scan",
+        ),
+      );
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      expect(updateScheduleMock).not.toHaveBeenCalled();
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      expect(onClose).toHaveBeenCalledTimes(1);
+    });
+
+    it("does not launch an initial scan when the schedule save fails", async () => {
+      // Given
+      const user = userEvent.setup();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+      updateScheduleMock.mockResolvedValue({ error: "Schedule failed" });
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await user.click(
+        screen.getByRole("checkbox", { name: /launch an initial scan now/i }),
+      );
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(updateScheduleMock).toHaveBeenCalledTimes(1));
+      expect(scanOnDemandMock).not.toHaveBeenCalled();
+      expect(toastMock).toHaveBeenCalledWith(
+        expect.objectContaining({ title: "Unable to save scan schedule" }),
+      );
+    });
+  });
+
+  describe("Prowler Cloud trial/onboarding (manual scan only)", () => {
+    beforeEach(() => {
+      vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+      scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
+    });
+
+    it("defaults to run now, locks schedule mode, and only launches a manual scan", async () => {
+      // Given
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={onClose}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+        />,
+      );
+
+      // Then no schedule cadence selector is rendered
+      expect(
+        screen.queryByRole("combobox", { name: /repeats/i }),
+      ).not.toBeInTheDocument();
+      expect(screen.getByRole("radio", { name: "Run now" })).toBeChecked();
+      expect(
+        screen.getByRole("radio", { name: "On a schedule" }),
+      ).toBeDisabled();
+      expect(
+        screen.getByText(/scheduled scans are not available/i),
+      ).toBeInTheDocument();
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+      expect(lastFooterConfig(onFooterChange)?.actionDisabled).toBe(false);
+      // The action launches a scan here, so it must not be labeled "Save".
+      expect(lastFooterConfig(onFooterChange)?.actionLabel).toBe("Launch scan");
+
+      // When
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      expect(updateScheduleMock).not.toHaveBeenCalled();
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+      expect(onClose).toHaveBeenCalledTimes(1);
+    });
+
+    it("disables the action and shows the limit copy when over limit", async () => {
+      // Given
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+          isScanLimitReached
+        />,
+      );
+
+      // Then
+      expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+      expect(lastFooterConfig(onFooterChange)?.actionDisabled).toBe(true);
+    });
   });
 });
diff --git a/ui/components/providers/wizard/steps/launch-step.tsx b/ui/components/providers/wizard/steps/launch-step.tsx
index 1e63f6700d..db42d5be0e 100644
--- a/ui/components/providers/wizard/steps/launch-step.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.tsx
@@ -1,21 +1,42 @@
 "use client";
 
+import { zodResolver } from "@hookform/resolvers/zod";
 import Link from "next/link";
 import { useEffect, useRef, useState } from "react";
+import { useForm, useWatch } from "react-hook-form";
 
-import { scanOnDemand, scheduleDaily } from "@/actions/scans";
+import { scanOnDemand } from "@/actions/scans";
 import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@/components/shadcn/select/select";
+  SAVE_SCHEDULE_STATUS,
+  saveScheduleWithInitialScan,
+} from "@/components/scans/schedule/save-schedule";
+import { ScanScheduleFields } from "@/components/scans/schedule/scan-schedule-fields";
+import { Field, FieldLabel } from "@/components/shadcn";
+import {
+  RadioGroup,
+  RadioGroupItem,
+} from "@/components/shadcn/radio-group/radio-group";
 import { Spinner } from "@/components/shadcn/spinner/spinner";
 import { TreeStatusIcon } from "@/components/shadcn/tree-view/tree-status-icon";
+import {
+  CloudFeatureBadge,
+  CloudFeatureBadgeLink,
+} from "@/components/shared/cloud-feature-badge";
 import { ToastAction, useToast } from "@/components/ui";
+import { EntityInfo } from "@/components/ui/entities";
+import {
+  getScanScheduleCapability,
+  getScheduleFormDefaults,
+  scheduleFormSchema,
+} from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
 import { useProviderWizardStore } from "@/store/provider-wizard/store";
 import { SCAN_JOBS_TAB } from "@/types";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+  type ScheduleFormValues,
+} from "@/types/schedules";
 import { TREE_ITEM_STATUS } from "@/types/tree";
 
 import {
@@ -23,51 +44,94 @@ import {
   WizardFooterConfig,
 } from "./footer-controls";
 
-const SCAN_SCHEDULE = {
-  DAILY: "daily",
-  SINGLE: "single",
+const LAUNCH_MODE = {
+  NOW: "now",
+  SCHEDULE: "schedule",
 } as const;
 
-type ScanScheduleOption = (typeof SCAN_SCHEDULE)[keyof typeof SCAN_SCHEDULE];
+type LaunchMode = (typeof LAUNCH_MODE)[keyof typeof LAUNCH_MODE];
 
 interface LaunchStepProps {
   onBack: () => void;
   onClose: () => void;
   onFooterChange: (config: WizardFooterConfig) => void;
+  /**
+   * Schedule capability override. Absent in Prowler OSS (defaults to a
+   * Cloud-vs-non-Cloud decision). The prowler-cloud overlay computes a
+   * billing-aware capability and injects it here so trial/onboarding accounts
+   * are limited to manual scans.
+   */
+  capability?: ScanScheduleCapability;
+  /**
+   * When true, the manual scan action is disabled (account scan quota reached).
+   * Cloud-only signal; never set in OSS.
+   */
+  isScanLimitReached?: boolean;
 }
 
 export function LaunchStep({
   onBack,
   onClose,
   onFooterChange,
+  capability: capabilityProp,
+  isScanLimitReached = false,
 }: LaunchStepProps) {
   const { toast } = useToast();
-  const { providerId } = useProviderWizardStore();
+  const { providerAlias, providerId, providerType, providerUid } =
+    useProviderWizardStore();
+  const capability = capabilityProp ?? getScanScheduleCapability(isCloud());
+  const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
+  const isAdvanced = capability === SCAN_SCHEDULE_CAPABILITY.ADVANCED;
   const [isLaunching, setIsLaunching] = useState(false);
-  const [scheduleOption, setScheduleOption] = useState<ScanScheduleOption>(
-    SCAN_SCHEDULE.DAILY,
+  const [mode, setMode] = useState<LaunchMode>(
+    isAdvanced ? LAUNCH_MODE.SCHEDULE : LAUNCH_MODE.NOW,
   );
-  const launchActionRef = useRef<() => void>(() => {});
+  const form = useForm<ScheduleFormValues>({
+    resolver: zodResolver(scheduleFormSchema),
+    defaultValues: getScheduleFormDefaults(),
+  });
 
-  const handleLaunchScan = async () => {
-    if (!providerId) {
+  const isScheduleMode = isAdvanced && mode === LAUNCH_MODE.SCHEDULE;
+  const isLimitBlocked = mode === LAUNCH_MODE.NOW && isScanLimitReached;
+  const isActionBlocked = isLaunching || !providerId || isLimitBlocked;
+  const launchInitialScan = useWatch({
+    control: form.control,
+    name: "launchInitialScan",
+  });
+
+  const actionLabel = (() => {
+    if (!isScheduleMode) {
+      return isLaunching ? "Launching scan..." : "Launch scan";
+    }
+
+    if (isLaunching) {
+      return launchInitialScan ? "Saving and launching..." : "Saving...";
+    }
+
+    return launchInitialScan ? "Save and launch scan" : "Save";
+  })();
+
+  const launchOnDemandScan = async (): Promise<{ error?: unknown } | null> => {
+    if (!providerId) return null;
+    const formData = new FormData();
+    formData.set("providerId", providerId);
+    return scanOnDemand(formData);
+  };
+
+  const handleManualScan = async () => {
+    if (isScanLimitReached) {
       return;
     }
 
     setIsLaunching(true);
-    const formData = new FormData();
-    formData.set("providerId", providerId);
-    const result =
-      scheduleOption === SCAN_SCHEDULE.DAILY
-        ? await scheduleDaily(formData)
-        : await scanOnDemand(formData);
+    const scanResult = await launchOnDemandScan();
 
-    if (result?.error) {
+    if (scanResult?.error) {
       setIsLaunching(false);
       toast({
         variant: "destructive",
         title: "Unable to launch scan",
-        description: String(result.error),
+        description: String(scanResult.error),
       });
       return;
     }
@@ -75,11 +139,8 @@ export function LaunchStep({
     setIsLaunching(false);
     onClose();
     toast({
-      title: "Scan Launched",
-      description:
-        scheduleOption === SCAN_SCHEDULE.DAILY
-          ? "Daily scan scheduled successfully."
-          : "Single scan launched successfully.",
+      title: "Scan launched",
+      description: "The scan was launched successfully.",
       action: (
         <ToastAction altText="Go to scans" asChild>
           <Link href={`/scans?tab=${SCAN_JOBS_TAB.ACTIVE}`}>Go to scans</Link>
@@ -88,8 +149,69 @@ export function LaunchStep({
     });
   };
 
-  launchActionRef.current = () => {
-    void handleLaunchScan();
+  const handleSaveSchedule = form.handleSubmit(async (values) => {
+    if (!providerId) {
+      return;
+    }
+
+    setIsLaunching(true);
+
+    const result = await saveScheduleWithInitialScan({
+      providerId,
+      values,
+      useLegacyDaily: !isAdvanced,
+    });
+
+    setIsLaunching(false);
+
+    if (result.status === SAVE_SCHEDULE_STATUS.ERROR) {
+      toast({
+        variant: "destructive",
+        title: "Unable to save scan schedule",
+        description: result.message,
+      });
+      return;
+    }
+
+    onClose();
+
+    const launched = result.status === SAVE_SCHEDULE_STATUS.SAVED_AND_LAUNCHED;
+    const targetTab = launched ? SCAN_JOBS_TAB.ACTIVE : SCAN_JOBS_TAB.SCHEDULED;
+    const goToScans = (
+      <ToastAction altText="Go to scans" asChild>
+        <Link href={`/scans?tab=${targetTab}`}>Go to scans</Link>
+      </ToastAction>
+    );
+
+    if (result.status === SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED) {
+      toast({
+        title: "Scan schedule saved",
+        description: `The schedule was saved, but the initial scan could not be launched: ${result.message}`,
+        action: goToScans,
+      });
+      return;
+    }
+
+    toast({
+      title: launched
+        ? "Scan schedule saved and initial scan launched"
+        : "Scan schedule saved",
+      description: launched
+        ? "The schedule was saved and the initial scan was launched."
+        : "The scan schedule was saved successfully.",
+      action: goToScans,
+    });
+  });
+
+  // Keep the latest action handler in a ref so the footer (synced via effect)
+  // always invokes the current closure without re-running on every render.
+  const actionRef = useRef<() => void>(() => {});
+  actionRef.current = () => {
+    if (!isScheduleMode) {
+      void handleManualScan();
+      return;
+    }
+    void handleSaveSchedule();
   };
 
   useEffect(() => {
@@ -99,21 +221,30 @@ export function LaunchStep({
       backDisabled: isLaunching,
       onBack,
       showAction: true,
-      actionLabel: isLaunching ? "Launching scans..." : "Launch scan",
-      actionDisabled: isLaunching || !providerId,
+      actionLabel,
+      actionDisabled: isActionBlocked,
       actionType: WIZARD_FOOTER_ACTION_TYPE.BUTTON,
-      onAction: () => {
-        launchActionRef.current();
-      },
+      onAction: () => actionRef.current(),
     });
-  }, [isLaunching, onBack, onFooterChange, providerId]);
+  }, [
+    isActionBlocked,
+    isLaunching,
+    actionLabel,
+    isScheduleMode,
+    launchInitialScan,
+    mode,
+    onBack,
+    onFooterChange,
+  ]);
 
   if (isLaunching) {
     return (
       <div className="flex min-h-[320px] items-center justify-center">
         <div className="flex items-center gap-3 py-2">
           <Spinner className="size-6" />
-          <p className="text-sm font-medium">Launching scans...</p>
+          <p className="text-sm font-medium">
+            {!isScheduleMode ? "Launching scan..." : "Saving scan schedule..."}
+          </p>
         </div>
       </div>
     );
@@ -121,13 +252,21 @@ export function LaunchStep({
 
   return (
     <div className="flex min-h-0 flex-1 flex-col gap-6">
+      {(providerId || providerUid) && (
+        <EntityInfo
+          cloudProvider={providerType ?? undefined}
+          entityAlias={providerAlias ?? providerUid ?? providerId ?? undefined}
+          entityId={providerUid ?? providerId ?? undefined}
+        />
+      )}
+
       <div className="flex items-center gap-3">
         <TreeStatusIcon status={TREE_ITEM_STATUS.SUCCESS} className="size-6" />
-        <h3 className="text-sm font-semibold">Connection validated!</h3>
+        <h3 className="text-sm font-semibold">Account Connected!</h3>
       </div>
 
       <p className="text-text-neutral-secondary text-sm">
-        Choose how you want to launch scans for this provider.
+        Your account is connected to Prowler and ready to Scan!
       </p>
 
       {!providerId && (
@@ -136,28 +275,57 @@ export function LaunchStep({
         </p>
       )}
 
-      <div className="flex flex-col gap-4">
-        <p className="text-text-neutral-secondary text-sm">Scan schedule</p>
-        <Select
-          value={scheduleOption}
-          onValueChange={(value) =>
-            setScheduleOption(value as ScanScheduleOption)
-          }
-          disabled={isLaunching || !providerId}
+      <Field>
+        <FieldLabel>Mode</FieldLabel>
+        <RadioGroup
+          value={mode}
+          onValueChange={(value) => setMode(value as LaunchMode)}
+          className="flex flex-row flex-wrap gap-6"
+          aria-label="Scan mode"
         >
-          <SelectTrigger className="w-full max-w-[376px]">
-            <SelectValue />
-          </SelectTrigger>
-          <SelectContent>
-            <SelectItem value={SCAN_SCHEDULE.DAILY}>
-              Scan Daily (every 24 hours)
-            </SelectItem>
-            <SelectItem value={SCAN_SCHEDULE.SINGLE}>
-              Run a single scan (no recurring schedule)
-            </SelectItem>
-          </SelectContent>
-        </Select>
-      </div>
+          <label className="flex items-center gap-2 text-sm">
+            <RadioGroupItem value={LAUNCH_MODE.NOW} aria-label="Run now" />
+            Run now
+          </label>
+          <label className="flex items-center gap-2 text-sm">
+            <RadioGroupItem
+              value={LAUNCH_MODE.SCHEDULE}
+              aria-label="On a schedule"
+              disabled={!isAdvanced}
+            />
+            On a schedule
+            {!isAdvanced &&
+              (isManualOnly ? (
+                <CloudFeatureBadge label="Requires subscription" size="sm" />
+              ) : (
+                <CloudFeatureBadgeLink size="sm" />
+              ))}
+          </label>
+        </RadioGroup>
+      </Field>
+
+      {!isAdvanced && (
+        <p className="text-text-neutral-secondary text-sm">
+          Scheduled scans are not available for this account. Run now to get
+          immediate findings.
+        </p>
+      )}
+
+      {isLimitBlocked && (
+        <p className="text-text-error-primary text-sm">
+          You have reached your scan limit, so additional scans are not
+          available right now.
+        </p>
+      )}
+
+      {isScheduleMode && (
+        <ScanScheduleFields
+          form={form}
+          disabled={isLaunching || !providerId}
+          showLaunchInitialScan
+          showNextScheduledCopy
+        />
+      )}
     </div>
   );
 }
diff --git a/ui/components/scans/launch-scan-modal.test.tsx b/ui/components/scans/launch-scan-modal.test.tsx
index c5ec901631..97e18dbcae 100644
--- a/ui/components/scans/launch-scan-modal.test.tsx
+++ b/ui/components/scans/launch-scan-modal.test.tsx
@@ -3,13 +3,35 @@ import userEvent from "@testing-library/user-event";
 import type { ComponentProps } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const { refreshMock, scanOnDemandMock, searchParamsValue, toastMock } =
-  vi.hoisted(() => ({
-    refreshMock: vi.fn(),
-    scanOnDemandMock: vi.fn(),
-    searchParamsValue: { current: "" },
-    toastMock: vi.fn(),
-  }));
+const {
+  getScheduleMock,
+  refreshMock,
+  scanOnDemandMock,
+  scheduleDailyMock,
+  searchParamsValue,
+  toastMock,
+  updateScheduleMock,
+} = vi.hoisted(() => ({
+  getScheduleMock: vi.fn(),
+  refreshMock: vi.fn(),
+  scanOnDemandMock: vi.fn(),
+  scheduleDailyMock: vi.fn(),
+  searchParamsValue: { current: "" },
+  toastMock: vi.fn(),
+  updateScheduleMock: vi.fn(),
+}));
+
+class ResizeObserverMock {
+  observe() {}
+  unobserve() {}
+  disconnect() {}
+}
+
+Object.defineProperty(globalThis, "ResizeObserver", {
+  writable: true,
+  configurable: true,
+  value: ResizeObserverMock,
+});
 
 vi.mock("next/navigation", () => ({
   useRouter: () => ({
@@ -20,6 +42,12 @@ vi.mock("next/navigation", () => ({
 
 vi.mock("@/actions/scans", () => ({
   scanOnDemand: scanOnDemandMock,
+  scheduleDaily: scheduleDailyMock,
+}));
+
+vi.mock("@/actions/schedules", () => ({
+  getSchedule: getScheduleMock,
+  updateSchedule: updateScheduleMock,
 }));
 
 vi.mock("@/components/ui/toast", () => ({
@@ -95,6 +123,8 @@ vi.mock("@/app/(prowler)/_overview/_components/accounts-selector", () => ({
   ),
 }));
 
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
+
 import { LaunchScanModal } from "./launch-scan-modal";
 
 const provider = {
@@ -303,4 +333,121 @@ describe("LaunchScanModal", () => {
     expect(refreshMock).not.toHaveBeenCalled();
     expect(onOpenChange).not.toHaveBeenCalledWith(false);
   });
+
+  describe("schedule mode", () => {
+    const weeklyScheduleResponse = {
+      data: {
+        type: "schedules",
+        id: provider.id,
+        attributes: {
+          scan_enabled: true,
+          scan_frequency: "WEEKLY",
+          scan_hour: 9,
+          scan_timezone: "Europe/Madrid",
+          scan_interval_hours: null,
+          scan_day_of_week: 1,
+          scan_day_of_month: null,
+        },
+      },
+    };
+
+    beforeEach(() => {
+      getScheduleMock.mockResolvedValue(weeklyScheduleResponse);
+      updateScheduleMock.mockResolvedValue({ data: { id: provider.id } });
+    });
+
+    const renderAdvanced = () =>
+      render(
+        <LaunchScanModal
+          open
+          onOpenChange={vi.fn()}
+          providers={[provider]}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+
+    it("prefills the provider schedule and saves it through the new API", async () => {
+      const user = userEvent.setup();
+      renderAdvanced();
+
+      await user.selectOptions(screen.getByLabelText("Providers"), provider.id);
+      await user.click(screen.getByRole("radio", { name: "On a schedule" }));
+
+      await waitFor(() =>
+        expect(getScheduleMock).toHaveBeenCalledWith(provider.id),
+      );
+
+      await user.click(
+        await screen.findByRole("button", { name: /save schedule/i }),
+      );
+
+      // The payload carries the fetched WEEKLY schedule, proving the prefill.
+      await waitFor(() =>
+        expect(updateScheduleMock).toHaveBeenCalledWith(
+          provider.id,
+          expect.objectContaining({
+            scan_enabled: true,
+            scan_frequency: "WEEKLY",
+            scan_hour: 9,
+            scan_day_of_week: 1,
+          }),
+        ),
+      );
+      expect(scanOnDemandMock).not.toHaveBeenCalled();
+      expect(toastMock).toHaveBeenCalledWith(
+        expect.objectContaining({ title: "Scan schedule saved" }),
+      );
+    });
+
+    it("launches the initial scan when the checkbox is checked", async () => {
+      const user = userEvent.setup();
+      renderAdvanced();
+
+      await user.selectOptions(screen.getByLabelText("Providers"), provider.id);
+      await user.click(screen.getByRole("radio", { name: "On a schedule" }));
+      await user.click(
+        await screen.findByLabelText(
+          "Launch an initial scan now for immediate findings",
+        ),
+      );
+      await user.click(screen.getByRole("button", { name: /save schedule/i }));
+
+      await waitFor(() => expect(updateScheduleMock).toHaveBeenCalled());
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      expect(toastMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          title: "Scan schedule saved and initial scan launched",
+        }),
+      );
+    });
+
+    it("locks schedule mode outside ADVANCED (OSS default)", () => {
+      render(
+        <LaunchScanModal open onOpenChange={vi.fn()} providers={[provider]} />,
+      );
+
+      expect(
+        screen.getByRole("radio", { name: "On a schedule" }),
+      ).toBeDisabled();
+      expect(getScheduleMock).not.toHaveBeenCalled();
+    });
+
+    it("hides the mode selector and blocks over-limit accounts in MANUAL_ONLY", () => {
+      render(
+        <LaunchScanModal
+          open
+          onOpenChange={vi.fn()}
+          providers={[provider]}
+          capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+          isScanLimitReached
+        />,
+      );
+
+      expect(screen.queryByRole("radio")).not.toBeInTheDocument();
+      expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+      expect(
+        screen.getByRole("button", { name: /launch scan/i }),
+      ).toBeDisabled();
+    });
+  });
 });
diff --git a/ui/components/scans/launch-scan-modal.tsx b/ui/components/scans/launch-scan-modal.tsx
index dd4b049c87..387f2a1f9e 100644
--- a/ui/components/scans/launch-scan-modal.tsx
+++ b/ui/components/scans/launch-scan-modal.tsx
@@ -1,23 +1,48 @@
 "use client";
 
 import { zodResolver } from "@hookform/resolvers/zod";
-import { CloudCog, Rocket } from "lucide-react";
+import { CloudCog, Loader2, Rocket } from "lucide-react";
 import Link from "next/link";
 import { useRouter, useSearchParams } from "next/navigation";
-import { useForm } from "react-hook-form";
+import { useRef, useState } from "react";
+import { useForm, useWatch } from "react-hook-form";
 import { z } from "zod";
 
 import { scanOnDemand } from "@/actions/scans";
+import { getSchedule } from "@/actions/schedules";
 import { AccountsSelector } from "@/app/(prowler)/_overview/_components/accounts-selector";
 import { Field, FieldError, FieldLabel, Input } from "@/components/shadcn";
 import { Modal } from "@/components/shadcn/modal";
+import {
+  RadioGroup,
+  RadioGroupItem,
+} from "@/components/shadcn/radio-group/radio-group";
+import { CloudFeatureBadgeLink } from "@/components/shared/cloud-feature-badge";
 import { FormButtons } from "@/components/ui/form";
 import { toast, ToastAction } from "@/components/ui/toast";
+import {
+  getScanScheduleCapability,
+  getScheduleFormDefaults,
+  getScheduleFormValues,
+  scheduleFormSchema,
+} from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
 import { SCAN_JOBS_TAB } from "@/types";
 import type { ProviderProps } from "@/types/providers";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+  type ScheduleApiResponse,
+  type ScheduleFormValues,
+} from "@/types/schedules";
 
 import { scanAliasSchema } from "./scan-alias-validation";
 import { getScanJobsTab } from "./scans.utils";
+import {
+  SAVE_SCHEDULE_STATUS,
+  saveScheduleWithInitialScan,
+} from "./schedule/save-schedule";
+import { ScanScheduleFields } from "./schedule/scan-schedule-fields";
 
 const launchScanSchema = z.object({
   providerId: z.string().min(1, "Select a provider to launch a scan."),
@@ -26,33 +51,112 @@ const launchScanSchema = z.object({
 
 type LaunchScanFormValues = z.infer<typeof launchScanSchema>;
 
+const LAUNCH_MODE = {
+  NOW: "now",
+  SCHEDULE: "schedule",
+} as const;
+
+type LaunchMode = (typeof LAUNCH_MODE)[keyof typeof LAUNCH_MODE];
+
+const SCHEDULE_LOAD_STATE = {
+  IDLE: "idle",
+  LOADING: "loading",
+  LOADED: "loaded",
+  ERROR: "error",
+} as const;
+
+type ScheduleLoadState =
+  (typeof SCHEDULE_LOAD_STATE)[keyof typeof SCHEDULE_LOAD_STATE];
+
 interface LaunchScanModalProps {
   open: boolean;
   onOpenChange: (open: boolean) => void;
   providers: ProviderProps[];
+  /** Cloud overlay seam; defaults to the environment-resolved capability. */
+  capability?: ScanScheduleCapability;
+  isScanLimitReached?: boolean;
 }
 
 interface LaunchScanFormProps {
   providers: ProviderProps[];
   onClose: () => void;
+  capability: ScanScheduleCapability;
+  isScanLimitReached: boolean;
 }
 
-function LaunchScanForm({ providers, onClose }: LaunchScanFormProps) {
+function LaunchScanForm({
+  providers,
+  onClose,
+  capability,
+  isScanLimitReached,
+}: LaunchScanFormProps) {
   const router = useRouter();
   const searchParams = useSearchParams();
   const form = useForm<LaunchScanFormValues>({
     resolver: zodResolver(launchScanSchema),
     defaultValues: { providerId: "", scanAlias: "" },
   });
+  const scheduleForm = useForm<ScheduleFormValues>({
+    resolver: zodResolver(scheduleFormSchema),
+    defaultValues: getScheduleFormDefaults(),
+  });
+  const [mode, setMode] = useState<LaunchMode>(LAUNCH_MODE.NOW);
+  const [scheduleLoad, setScheduleLoad] = useState<ScheduleLoadState>(
+    SCHEDULE_LOAD_STATE.IDLE,
+  );
+  // Guards against out-of-order responses when switching providers quickly.
+  const requestedProviderRef = useRef<string>("");
 
-  const providerId = form.watch("providerId");
+  const isAdvanced = capability === SCAN_SCHEDULE_CAPABILITY.ADVANCED;
+  const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
+  const isScheduleMode = mode === LAUNCH_MODE.SCHEDULE;
+
+  // useWatch, not form.watch: form.watch re-renders are dropped by React Compiler memoization.
+  const providerId = useWatch({ control: form.control, name: "providerId" });
   const activeTab = getScanJobsTab(searchParams.get("tab") ?? undefined);
   const shouldShowActiveTabAction = activeTab !== SCAN_JOBS_TAB.ACTIVE;
   const disconnectedProviderIds = providers
     .filter((provider) => provider.attributes.connection.connected !== true)
     .map((provider) => provider.id);
 
-  const onSubmit = form.handleSubmit(async ({ providerId, scanAlias }) => {
+  const loadSchedule = async (id: string) => {
+    requestedProviderRef.current = id;
+    if (!id) {
+      setScheduleLoad(SCHEDULE_LOAD_STATE.IDLE);
+      return;
+    }
+
+    setScheduleLoad(SCHEDULE_LOAD_STATE.LOADING);
+    const response = (await getSchedule(id)) as
+      | ScheduleApiResponse
+      | { error?: string };
+
+    if (requestedProviderRef.current !== id) return;
+
+    if (!response || ("error" in response && response.error)) {
+      setScheduleLoad(SCHEDULE_LOAD_STATE.ERROR);
+      return;
+    }
+
+    scheduleForm.reset(
+      getScheduleFormValues(
+        "data" in response ? response.data?.attributes : null,
+      ),
+    );
+    setScheduleLoad(SCHEDULE_LOAD_STATE.LOADED);
+  };
+
+  const handleProviderChange = (id: string) => {
+    form.setValue("providerId", id, { shouldValidate: true });
+    if (isScheduleMode) void loadSchedule(id);
+  };
+
+  const handleModeChange = (nextMode: string) => {
+    setMode(nextMode as LaunchMode);
+    if (nextMode === LAUNCH_MODE.SCHEDULE) void loadSchedule(providerId);
+  };
+
+  const launchNow = form.handleSubmit(async ({ providerId, scanAlias }) => {
     const formData = new FormData();
     formData.set("providerId", providerId);
     const trimmedAlias = scanAlias?.trim();
@@ -87,13 +191,66 @@ function LaunchScanForm({ providers, onClose }: LaunchScanFormProps) {
     router.refresh();
   });
 
+  const saveSchedule = async () => {
+    const providerValid = await form.trigger("providerId");
+    if (!providerValid) return;
+
+    await scheduleForm.handleSubmit(async (values) => {
+      const result = await saveScheduleWithInitialScan({
+        providerId: form.getValues("providerId"),
+        values,
+      });
+
+      if (result.status === SAVE_SCHEDULE_STATUS.ERROR) {
+        form.setError("root", { message: result.message });
+        return;
+      }
+
+      const launched =
+        result.status === SAVE_SCHEDULE_STATUS.SAVED_AND_LAUNCHED;
+      toast({
+        title: launched
+          ? "Scan schedule saved and initial scan launched"
+          : "Scan schedule saved",
+        description:
+          result.status === SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED
+            ? `The schedule was saved, but the initial scan could not be launched: ${result.message}`
+            : launched
+              ? "The schedule was saved and the initial scan was launched."
+              : "The scan schedule was saved successfully.",
+        action: (
+          <ToastAction altText="View scheduled scans" asChild>
+            <Link href={`/scans?tab=${SCAN_JOBS_TAB.SCHEDULED}`}>
+              View schedule
+            </Link>
+          </ToastAction>
+        ),
+      });
+      onClose();
+      router.refresh();
+    })();
+  };
+
+  const onSubmit = (event: React.FormEvent<HTMLFormElement>) => {
+    event.preventDefault();
+    if (isScheduleMode) {
+      void saveSchedule();
+      return;
+    }
+    void launchNow();
+  };
+
   const providerError = form.formState.errors.providerId?.message;
   const aliasError = form.formState.errors.scanAlias?.message;
   const rootError = form.formState.errors.root?.message;
-  const isSubmitting = form.formState.isSubmitting;
+  const isSubmitting =
+    form.formState.isSubmitting || scheduleForm.formState.isSubmitting;
+  const isScheduleLoading = scheduleLoad === SCHEDULE_LOAD_STATE.LOADING;
+  const isLimitBlocked = isManualOnly && isScanLimitReached;
 
   return (
-    <form onSubmit={onSubmit} className="flex flex-col gap-8">
+    // min-w-0: let this dialog grid item shrink so a long provider UID truncates instead of widening the modal
+    <form onSubmit={onSubmit} className="flex min-w-0 flex-col gap-8">
       <div className="flex items-center gap-2">
         <CloudCog className="text-text-neutral-secondary size-4" />
         <span className="text-text-neutral-secondary text-sm">
@@ -108,9 +265,7 @@ function LaunchScanForm({ providers, onClose }: LaunchScanFormProps) {
           providers={providers}
           disabledValues={disconnectedProviderIds}
           onBatchChange={(_, values) =>
-            form.setValue("providerId", values.at(-1) ?? "", {
-              shouldValidate: true,
-            })
+            handleProviderChange(values.at(-1) ?? "")
           }
           selectedValues={providerId ? [providerId] : []}
           closeOnSelect
@@ -118,23 +273,93 @@ function LaunchScanForm({ providers, onClose }: LaunchScanFormProps) {
         {providerError && <FieldError>{providerError}</FieldError>}
       </Field>
 
-      <Field>
-        <FieldLabel htmlFor="launch-scan-alias">Alias (optional)</FieldLabel>
-        <Input
-          id="launch-scan-alias"
-          aria-label="Alias"
-          {...form.register("scanAlias")}
+      {!isManualOnly && (
+        <Field>
+          <FieldLabel>Mode</FieldLabel>
+          <RadioGroup
+            value={mode}
+            onValueChange={handleModeChange}
+            className="flex flex-row flex-wrap gap-6"
+            aria-label="Scan mode"
+          >
+            <label className="flex items-center gap-2 text-sm">
+              <RadioGroupItem value={LAUNCH_MODE.NOW} aria-label="Run now" />
+              Run now
+            </label>
+            <label className="flex items-center gap-2 text-sm">
+              <RadioGroupItem
+                value={LAUNCH_MODE.SCHEDULE}
+                aria-label="On a schedule"
+                disabled={!isAdvanced}
+              />
+              On a schedule
+              {!isAdvanced && <CloudFeatureBadgeLink size="sm" />}
+            </label>
+          </RadioGroup>
+        </Field>
+      )}
+
+      {isLimitBlocked && (
+        <p className="text-text-error-primary text-sm">
+          You have reached your scan limit, so additional scans are not
+          available right now.
+        </p>
+      )}
+
+      {!isScheduleMode && (
+        <Field>
+          <FieldLabel htmlFor="launch-scan-alias">Alias (optional)</FieldLabel>
+          <Input
+            id="launch-scan-alias"
+            aria-label="Alias"
+            {...form.register("scanAlias")}
+          />
+          {aliasError && <FieldError>{aliasError}</FieldError>}
+        </Field>
+      )}
+
+      {isScheduleMode && isScheduleLoading && (
+        <div className="flex items-center gap-3 py-2">
+          <Loader2 className="size-5 animate-spin" />
+          <span className="text-sm">Loading scan schedule...</span>
+        </div>
+      )}
+
+      {isScheduleMode && scheduleLoad === SCHEDULE_LOAD_STATE.ERROR && (
+        <FieldError>
+          Failed to load the current scan schedule. Saving will overwrite it.
+        </FieldError>
+      )}
+
+      {isScheduleMode && !isScheduleLoading && (
+        <ScanScheduleFields
+          form={scheduleForm}
+          disabled={isSubmitting || !providerId}
+          showLaunchInitialScan
+          showNextScheduledCopy
         />
-        {aliasError && <FieldError>{aliasError}</FieldError>}
-      </Field>
+      )}
 
       {rootError && <FieldError>{rootError}</FieldError>}
 
       <FormButtons
         onCancel={onClose}
-        submitText={isSubmitting ? "Launching..." : "Launch Scan"}
-        loadingText="Launching..."
-        isDisabled={isSubmitting || !providers.length}
+        submitText={
+          isSubmitting
+            ? isScheduleMode
+              ? "Saving..."
+              : "Launching..."
+            : isScheduleMode
+              ? "Save Schedule"
+              : "Launch Scan"
+        }
+        loadingText={isScheduleMode ? "Saving..." : "Launching..."}
+        isDisabled={
+          isSubmitting ||
+          !providers.length ||
+          isScheduleLoading ||
+          isLimitBlocked
+        }
         rightIcon={<Rocket className="size-4" />}
       />
     </form>
@@ -145,7 +370,11 @@ export function LaunchScanModal({
   open,
   onOpenChange,
   providers,
+  capability,
+  isScanLimitReached = false,
 }: LaunchScanModalProps) {
+  const resolvedCapability = capability ?? getScanScheduleCapability(isCloud());
+
   return (
     <Modal
       open={open}
@@ -157,6 +386,8 @@ export function LaunchScanModal({
       <LaunchScanForm
         providers={providers}
         onClose={() => onOpenChange(false)}
+        capability={resolvedCapability}
+        isScanLimitReached={isScanLimitReached}
       />
     </Modal>
   );
diff --git a/ui/components/scans/scans-page-shell.tsx b/ui/components/scans/scans-page-shell.tsx
index 9994f8d7bc..4682ff6dfb 100644
--- a/ui/components/scans/scans-page-shell.tsx
+++ b/ui/components/scans/scans-page-shell.tsx
@@ -21,6 +21,7 @@ import { buildViewFirstScanTour } from "@/lib/tours/view-first-scan.tour";
 import { useScansStore } from "@/store";
 import { SCAN_JOBS_TAB, SCAN_TAB_LABELS, type ScanJobsTab } from "@/types";
 import type { ProviderProps } from "@/types/providers";
+import type { ScanScheduleCapability } from "@/types/schedules";
 
 const viewFirstScanFlow = getFlowById("view-first-scan")!;
 
@@ -34,6 +35,9 @@ interface ScansPageShellProps {
   hasManageScansPermission: boolean;
   activeScanCount?: number;
   children: ReactNode;
+  /** Cloud overlay seam for the launch-scan modal. */
+  scanScheduleCapability?: ScanScheduleCapability;
+  isScanLimitReached?: boolean;
 }
 
 export function ScansPageShell({
@@ -41,6 +45,8 @@ export function ScansPageShell({
   hasManageScansPermission,
   activeScanCount = 0,
   children,
+  scanScheduleCapability,
+  isScanLimitReached,
 }: ScansPageShellProps) {
   const pathname = usePathname();
   const searchParams = useSearchParams();
@@ -165,6 +171,8 @@ export function ScansPageShell({
         open={launchOpen}
         onOpenChange={handleLaunchOpenChange}
         providers={providers}
+        capability={scanScheduleCapability}
+        isScanLimitReached={isScanLimitReached}
       />
     </div>
   );
diff --git a/ui/components/scans/scans.utils.test.ts b/ui/components/scans/scans.utils.test.ts
index 8568f86a86..1639f8f5a6 100644
--- a/ui/components/scans/scans.utils.test.ts
+++ b/ui/components/scans/scans.utils.test.ts
@@ -1,6 +1,8 @@
 import { describe, expect, it } from "vitest";
 
 import {
+  type MetaDataProps,
+  type ProviderProps,
   SCAN_JOBS_TAB,
   type ScanAttributes,
   type ScanProps,
@@ -8,6 +10,8 @@ import {
 } from "@/types";
 
 import {
+  appendPendingScheduleRowsToPage,
+  buildPendingScheduleRows,
   formatScanDuration,
   getScanAlias,
   getScanFindingsSummary,
@@ -109,9 +113,9 @@ describe("scans.utils", () => {
   it("formats scan labels and durations for table display", () => {
     expect(getScanAlias(makeScan(""))).toBe("-");
     expect(getScanAlias(makeScan("Daily scheduled scan", "scheduled"))).toBe(
-      "scheduled scan",
+      "Scheduled Scan",
     );
-    expect(getScanAlias(makeScan("", "scheduled"))).toBe("scheduled scan");
+    expect(getScanAlias(makeScan("", "scheduled"))).toBe("Scheduled Scan");
     expect(getScanAlias(makeScan("Production scan"))).toBe("Production scan");
     expect(formatScanDuration(73)).toBe("1 min 13 sec");
     expect(formatScanDuration(null)).toBe("-");
@@ -161,3 +165,233 @@ describe("scans.utils", () => {
     expect(getScanFindingsSummary(makeScan("x").attributes)).toBeNull();
   });
 });
+
+describe("buildPendingScheduleRows", () => {
+  const now = new Date("2026-06-10T10:30:00Z");
+
+  const makeProvider = (id: string): ProviderProps => ({
+    id,
+    type: "providers",
+    attributes: {
+      provider: "aws",
+      uid: `uid-${id}`,
+      alias: `alias-${id}`,
+      status: "completed",
+      resources: 0,
+      connection: {
+        connected: true,
+        last_checked_at: "2026-06-10T10:00:00Z",
+      },
+      scanner_args: {
+        only_logs: false,
+        excluded_checks: [],
+        aws_retries_max_attempts: 3,
+      },
+      inserted_at: "2026-06-10T10:00:00Z",
+      updated_at: "2026-06-10T10:00:00Z",
+      created_by: {
+        object: "users",
+        id: "user-1",
+      },
+    },
+    relationships: {
+      secret: { data: null },
+      provider_groups: { meta: { count: 0 }, data: [] },
+    },
+  });
+
+  const makeScheduledScan = (id: string, providerId: string): ScanProps => ({
+    ...makeScan("Scheduled Scan", "scheduled"),
+    id,
+    relationships: {
+      provider: { data: { type: "providers", id: providerId } },
+      task: { data: { type: "tasks", id: `task-${id}` } },
+    },
+  });
+
+  const makeMeta = ({
+    page,
+    pages,
+    count,
+  }: {
+    page: number;
+    pages: number;
+    count: number;
+  }): MetaDataProps => ({
+    pagination: {
+      page,
+      pages,
+      count,
+      itemsPerPage: [1, 2, 10],
+    },
+    version: "v1",
+  });
+
+  const weeklySchedule = {
+    scan_enabled: true,
+    scan_frequency: "WEEKLY",
+    scan_hour: 9,
+    scan_timezone: "Europe/Madrid",
+    scan_interval_hours: null,
+    scan_day_of_week: 1,
+    scan_day_of_month: null,
+  } as const;
+
+  it("synthesizes a pending row for a configured schedule without scan rows", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: { p1: weeklySchedule },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    expect(rows).toHaveLength(1);
+    expect(rows[0].id).toBe("pending-schedule-p1");
+    expect(rows[0].attributes.state).toBe("scheduled");
+    expect(rows[0].attributes.trigger).toBe("scheduled");
+    expect(rows[0].pendingSchedule?.summary).toBe(
+      "Weekly on Monday @ 9:00am (Europe/Madrid)",
+    );
+    expect(rows[0].pendingSchedule?.cadence).toBe("Weekly on Monday");
+    expect(rows[0].providerInfo?.uid).toBe("uid-p1");
+  });
+
+  it("uses global covered providers when appending pending rows", () => {
+    // Given - p1 has a real scheduled scan on a previous page, p2 only has a configured schedule.
+    const result = appendPendingScheduleRowsToPage({
+      scans: [],
+      meta: makeMeta({ page: 2, pages: 1, count: 1 }),
+      page: 2,
+      pageSize: 1,
+      providers: [makeProvider("p1"), makeProvider("p2")],
+      schedulesByProviderId: {
+        p1: weeklySchedule,
+        p2: weeklySchedule,
+      },
+      coveredProviderIds: new Set(["p1"]),
+      now,
+    });
+
+    // Then - p1 is not duplicated as a synthetic pending row.
+    expect(result.data.map((scan) => scan.id)).toEqual(["pending-schedule-p2"]);
+    expect(result.meta?.pagination.count).toBe(2);
+    expect(result.meta?.pagination.pages).toBe(2);
+  });
+
+  it("keeps the last real page within page size and carries pending rows to the next page", () => {
+    // Given - three real scheduled scans and two pending schedules at page size 2.
+    const providers = ["p1", "p2", "p3", "p4", "p5"].map(makeProvider);
+    const schedulesByProviderId = Object.fromEntries(
+      providers.map((provider) => [provider.id, weeklySchedule]),
+    );
+
+    const lastRealPage = appendPendingScheduleRowsToPage({
+      scans: [makeScheduledScan("scan-3", "p3")],
+      meta: makeMeta({ page: 2, pages: 2, count: 3 }),
+      page: 2,
+      pageSize: 2,
+      providers,
+      schedulesByProviderId,
+      coveredProviderIds: new Set(["p1", "p2", "p3"]),
+      now,
+    });
+
+    const firstPendingOnlyPage = appendPendingScheduleRowsToPage({
+      scans: [],
+      meta: makeMeta({ page: 3, pages: 2, count: 3 }),
+      page: 3,
+      pageSize: 2,
+      providers,
+      schedulesByProviderId,
+      coveredProviderIds: new Set(["p1", "p2", "p3"]),
+      now,
+    });
+
+    // Then - page 2 gets one pending row, page 3 gets the remaining pending row.
+    expect(lastRealPage.data.map((scan) => scan.id)).toEqual([
+      "scan-3",
+      "pending-schedule-p4",
+    ]);
+    expect(lastRealPage.meta?.pagination.count).toBe(5);
+    expect(lastRealPage.meta?.pagination.pages).toBe(3);
+    expect(firstPendingOnlyPage.data.map((scan) => scan.id)).toEqual([
+      "pending-schedule-p5",
+    ]);
+  });
+
+  it("shows pending rows on an otherwise empty scheduled tab with coherent metadata", () => {
+    // Given
+    const result = appendPendingScheduleRowsToPage({
+      scans: [],
+      meta: makeMeta({ page: 1, pages: 0, count: 0 }),
+      page: 1,
+      pageSize: 10,
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: { p1: weeklySchedule },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    // Then
+    expect(result.data.map((scan) => scan.id)).toEqual(["pending-schedule-p1"]);
+    expect(result.meta?.pagination.count).toBe(1);
+    expect(result.meta?.pagination.pages).toBe(1);
+    expect(result.meta?.pagination.page).toBe(1);
+  });
+
+  it("prefers the server-computed next_scan_at and carries last_scan_at", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: {
+        p1: {
+          ...weeklySchedule,
+          next_scan_at: "2026-06-15T00:00:00Z",
+          last_scan_at: "2026-06-01T10:00:00Z",
+        },
+      },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    expect(rows[0].attributes.scheduled_at).toBe("2026-06-15T00:00:00Z");
+    expect(rows[0].pendingSchedule?.nextScanAt).toBe("2026-06-15T00:00:00Z");
+    expect(rows[0].pendingSchedule?.lastScanAt).toBe("2026-06-01T10:00:00Z");
+  });
+
+  it("falls back to a client estimate when next_scan_at is absent", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: { p1: weeklySchedule },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    expect(rows[0].attributes.scheduled_at).not.toBeNull();
+    expect(rows[0].pendingSchedule?.lastScanAt).toBeNull();
+  });
+
+  it("skips providers already covered by a real scheduled scan row", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1")],
+      schedulesByProviderId: { p1: weeklySchedule },
+      coveredProviderIds: new Set(["p1"]),
+      now,
+    });
+
+    expect(rows).toHaveLength(0);
+  });
+
+  it("skips unconfigured and disabled schedules", () => {
+    const rows = buildPendingScheduleRows({
+      providers: [makeProvider("p1"), makeProvider("p2"), makeProvider("p3")],
+      schedulesByProviderId: {
+        p1: { ...weeklySchedule, scan_hour: null },
+        p2: { ...weeklySchedule, scan_enabled: false },
+      },
+      coveredProviderIds: new Set(),
+      now,
+    });
+
+    expect(rows).toHaveLength(0);
+  });
+});
diff --git a/ui/components/scans/scans.utils.ts b/ui/components/scans/scans.utils.ts
index f7c8f546f4..4d96046019 100644
--- a/ui/components/scans/scans.utils.ts
+++ b/ui/components/scans/scans.utils.ts
@@ -1,5 +1,13 @@
+import {
+  describeScheduleCadence,
+  getNextScheduledRunInTimezone,
+  getScheduleCadenceParts,
+  isScheduleConfigured,
+} from "@/lib/schedules";
 import {
   DEFAULT_SCAN_JOBS_TAB,
+  type MetaDataProps,
+  type ProviderProps,
   SCAN_JOBS_TAB,
   SCAN_STATE,
   SCAN_TRIGGER,
@@ -9,6 +17,7 @@ import {
   type ScanProps,
   type ScanState,
   type ScanTrigger,
+  type ScheduleAttributes,
   type SearchParamsProps,
 } from "@/types";
 
@@ -136,7 +145,7 @@ export function getScanJobsTabFilters(
 
 export function getScanAlias(scan: ScanProps): string {
   if (scan.attributes.trigger === SCAN_TRIGGER.SCHEDULED)
-    return "scheduled scan";
+    return "Scheduled Scan";
   return scan.attributes.name?.trim() || "-";
 }
 
@@ -179,6 +188,142 @@ export function getScanStatusFilterOptions(
   ];
 }
 
+export interface BuildPendingScheduleRowsParams {
+  providers: ProviderProps[];
+  schedulesByProviderId: Record<string, ScheduleAttributes>;
+  /** Providers that already have a real `state=scheduled` Scan row. */
+  coveredProviderIds: Set<string>;
+  now: Date;
+}
+
+interface AppendPendingScheduleRowsToPageParams
+  extends BuildPendingScheduleRowsParams {
+  scans: ScanProps[];
+  meta?: MetaDataProps;
+  page: number;
+  pageSize: number;
+}
+
+/**
+ * Synthesizes Scheduled-tab rows for configured schedules without a Scan row
+ * yet (the backend only creates one after each run).
+ */
+export function buildPendingScheduleRows({
+  providers,
+  schedulesByProviderId,
+  coveredProviderIds,
+  now,
+}: BuildPendingScheduleRowsParams): ScanProps[] {
+  return providers.flatMap((provider) => {
+    if (coveredProviderIds.has(provider.id)) return [];
+
+    const schedule = schedulesByProviderId[provider.id];
+    if (!schedule || !isScheduleConfigured(schedule) || !schedule.scan_enabled)
+      return [];
+
+    // Prefer the server-computed next fire time; fall back to a client estimate.
+    const nextScanAt =
+      schedule.next_scan_at ??
+      getNextScheduledRunInTimezone(schedule, now)?.toISOString() ??
+      null;
+
+    return [
+      {
+        type: "scans" as const,
+        id: `pending-schedule-${provider.id}`,
+        attributes: {
+          name: "",
+          trigger: SCAN_TRIGGER.SCHEDULED,
+          state: SCAN_STATE.SCHEDULED,
+          unique_resource_count: 0,
+          progress: 0,
+          scanner_args: null,
+          duration: null,
+          started_at: null,
+          inserted_at: now.toISOString(),
+          completed_at: null,
+          scheduled_at: nextScanAt,
+          next_scan_at: null,
+        },
+        relationships: {
+          provider: { data: { type: "providers", id: provider.id } },
+          // No Celery task behind synthetic rows.
+          task: { data: { type: "tasks", id: "" } },
+        },
+        providerInfo: {
+          provider: provider.attributes.provider,
+          uid: provider.attributes.uid,
+          alias: provider.attributes.alias,
+        },
+        pendingSchedule: {
+          summary: describeScheduleCadence(schedule),
+          cadence: getScheduleCadenceParts(schedule).cadence,
+          nextScanAt,
+          lastScanAt: schedule.last_scan_at ?? null,
+        },
+      },
+    ];
+  });
+}
+
+export function getProviderIdsFromScans(scans: ScanProps[]): Set<string> {
+  return new Set(
+    scans
+      .map((scan) => scan.relationships?.provider?.data?.id)
+      .filter((id): id is string => Boolean(id)),
+  );
+}
+
+export function appendPendingScheduleRowsToPage({
+  scans,
+  meta,
+  page,
+  pageSize,
+  providers,
+  schedulesByProviderId,
+  coveredProviderIds,
+  now,
+}: AppendPendingScheduleRowsToPageParams): {
+  data: ScanProps[];
+  meta?: MetaDataProps;
+} {
+  // The API paginates real scheduled scans, while pending rows come from
+  // configured schedules without a scan yet. Reconcile both sources here so the
+  // rendered rows and pagination metadata describe the same combined list.
+  const pendingRows = buildPendingScheduleRows({
+    providers,
+    schedulesByProviderId,
+    coveredProviderIds,
+    now,
+  });
+  const safePageSize = Math.max(1, pageSize);
+  const realCount = meta?.pagination.count ?? scans.length;
+  const pendingStart = Math.max(0, (page - 1) * safePageSize - realCount);
+  const pendingSlots = Math.max(0, safePageSize - scans.length);
+  const pagePendingRows = pendingRows.slice(
+    pendingStart,
+    pendingStart + pendingSlots,
+  );
+  const combinedCount = realCount + pendingRows.length;
+  const combinedPages =
+    combinedCount === 0 ? 0 : Math.ceil(combinedCount / safePageSize);
+
+  return {
+    data: [...scans, ...pagePendingRows],
+    meta: meta
+      ? {
+          ...meta,
+          pagination: {
+            ...meta.pagination,
+            page,
+            count: combinedCount,
+            pages: combinedPages,
+          },
+        }
+      : undefined,
+  };
+}
+
 function getNumericValue(
   source: Record<string, unknown>,
   keys: string[],
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
new file mode 100644
index 0000000000..9d1e96b46a
--- /dev/null
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
@@ -0,0 +1,165 @@
+import { render, screen, waitFor, within } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { refreshMock, removeScheduleMock, toastMock, updateScheduleMock } =
+  vi.hoisted(() => ({
+    refreshMock: vi.fn(),
+    removeScheduleMock: vi.fn(),
+    toastMock: vi.fn(),
+    updateScheduleMock: vi.fn(),
+  }));
+
+vi.mock("next/navigation", () => ({
+  useRouter: () => ({ refresh: refreshMock }),
+}));
+
+vi.mock("@/actions/schedules", () => ({
+  removeSchedule: removeScheduleMock,
+  updateSchedule: updateScheduleMock,
+}));
+
+vi.mock("@/components/ui/toast", () => ({
+  toast: toastMock,
+}));
+
+vi.mock("@/components/ui/entities", () => ({
+  EntityInfo: () => null,
+}));
+
+vi.mock("@/components/shadcn/modal", () => ({
+  Modal: ({
+    children,
+    open,
+    title,
+  }: {
+    children: React.ReactNode;
+    open: boolean;
+    title: string;
+  }) =>
+    open ? (
+      <div role="dialog" aria-label={title}>
+        {children}
+      </div>
+    ) : null,
+}));
+
+import type { ScheduleProps } from "@/types/schedules";
+
+import {
+  EDIT_SCAN_SCHEDULE_STATE,
+  EditScanScheduleModal,
+} from "./edit-scan-schedule-modal";
+
+const provider = {
+  providerId: "p1",
+  providerType: "aws" as const,
+  providerUid: "123456789012",
+  providerAlias: "Production",
+};
+
+const schedule: ScheduleProps = {
+  type: "schedules",
+  id: "p1",
+  attributes: {
+    scan_enabled: true,
+    scan_frequency: "DAILY",
+    scan_hour: 4,
+    scan_timezone: "UTC",
+    scan_interval_hours: null,
+    scan_day_of_week: null,
+    scan_day_of_month: null,
+  },
+  relationships: {
+    provider: { data: { type: "providers", id: "p1" } },
+  },
+};
+
+const renderLoaded = () =>
+  render(
+    <EditScanScheduleModal
+      open
+      onOpenChange={vi.fn()}
+      provider={provider}
+      state={{ kind: EDIT_SCAN_SCHEDULE_STATE.LOADED, schedule }}
+    />,
+  );
+
+describe("EditScanScheduleModal remove flow", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    removeScheduleMock.mockResolvedValue({ success: true });
+  });
+
+  it("asks for confirmation before removing the schedule", async () => {
+    const user = userEvent.setup();
+    renderLoaded();
+
+    await user.click(
+      screen.getByRole("button", { name: /remove scan schedule/i }),
+    );
+
+    expect(removeScheduleMock).not.toHaveBeenCalled();
+    expect(
+      screen.getByRole("dialog", { name: "Are you absolutely sure?" }),
+    ).toBeInTheDocument();
+  });
+
+  it("removes the schedule only after confirming", async () => {
+    const user = userEvent.setup();
+    renderLoaded();
+
+    await user.click(
+      screen.getByRole("button", { name: /remove scan schedule/i }),
+    );
+    const confirmDialog = screen.getByRole("dialog", {
+      name: "Are you absolutely sure?",
+    });
+    await user.click(
+      within(confirmDialog).getByRole("button", { name: "Remove" }),
+    );
+
+    await waitFor(() => expect(removeScheduleMock).toHaveBeenCalledWith("p1"));
+    expect(toastMock).toHaveBeenCalledWith(
+      expect.objectContaining({ title: "Scan schedule removed" }),
+    );
+  });
+
+  it("hides the remove button when the provider has no configured schedule", () => {
+    render(
+      <EditScanScheduleModal
+        open
+        onOpenChange={vi.fn()}
+        provider={provider}
+        state={{
+          kind: EDIT_SCAN_SCHEDULE_STATE.LOADED,
+          schedule: {
+            ...schedule,
+            attributes: { ...schedule.attributes, scan_hour: null },
+          },
+        }}
+      />,
+    );
+
+    expect(
+      screen.queryByRole("button", { name: /remove scan schedule/i }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("keeps the schedule when the confirmation is cancelled", async () => {
+    const user = userEvent.setup();
+    renderLoaded();
+
+    await user.click(
+      screen.getByRole("button", { name: /remove scan schedule/i }),
+    );
+    const confirmDialog = screen.getByRole("dialog", {
+      name: "Are you absolutely sure?",
+    });
+    await user.click(
+      within(confirmDialog).getByRole("button", { name: "Cancel" }),
+    );
+
+    expect(removeScheduleMock).not.toHaveBeenCalled();
+  });
+});
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
new file mode 100644
index 0000000000..c84d79e7f3
--- /dev/null
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
@@ -0,0 +1,227 @@
+"use client";
+
+import { zodResolver } from "@hookform/resolvers/zod";
+import { CircleX, Loader2 } from "lucide-react";
+import { useRouter } from "next/navigation";
+import { useState } from "react";
+import { useForm } from "react-hook-form";
+
+import { removeSchedule, updateSchedule } from "@/actions/schedules";
+import { Button, FieldError } from "@/components/shadcn";
+import { Modal } from "@/components/shadcn/modal";
+import { EntityInfo } from "@/components/ui/entities";
+import { FormButtons } from "@/components/ui/form";
+import { toast } from "@/components/ui/toast";
+import {
+  buildScheduleUpdatePayload,
+  getScheduleFormValues,
+  isScheduleConfigured,
+  scheduleFormSchema,
+} from "@/lib/schedules";
+import type { ProviderType, ScheduleProps } from "@/types";
+import type { ScheduleFormValues } from "@/types/schedules";
+
+import { ScanScheduleFields } from "./scan-schedule-fields";
+
+export interface ScanScheduleProvider {
+  providerId: string;
+  providerType: ProviderType;
+  providerUid: string;
+  providerAlias: string | null;
+}
+
+export const EDIT_SCAN_SCHEDULE_STATE = {
+  LOADING: "loading",
+  LOADED: "loaded",
+  ERROR: "error",
+} as const;
+
+export type EditScanScheduleState =
+  | { kind: typeof EDIT_SCAN_SCHEDULE_STATE.LOADING }
+  | {
+      kind: typeof EDIT_SCAN_SCHEDULE_STATE.LOADED;
+      schedule: ScheduleProps | null;
+    }
+  | { kind: typeof EDIT_SCAN_SCHEDULE_STATE.ERROR; message: string };
+
+interface EditScanScheduleFormProps {
+  provider: ScanScheduleProvider;
+  schedule: ScheduleProps | null;
+  onClose: () => void;
+}
+
+interface EditScanScheduleModalProps {
+  open: boolean;
+  onOpenChange: (open: boolean) => void;
+  provider?: ScanScheduleProvider;
+  state: EditScanScheduleState;
+}
+
+function EditScanScheduleForm({
+  provider,
+  schedule,
+  onClose,
+}: EditScanScheduleFormProps) {
+  const router = useRouter();
+  const [isConfirmRemoveOpen, setIsConfirmRemoveOpen] = useState(false);
+  const [isRemoving, setIsRemoving] = useState(false);
+  const form = useForm<ScheduleFormValues>({
+    resolver: zodResolver(scheduleFormSchema),
+    defaultValues: getScheduleFormValues(schedule?.attributes),
+  });
+  const hasSchedule = schedule
+    ? isScheduleConfigured(schedule.attributes)
+    : false;
+
+  const onSubmit = form.handleSubmit(async (values) => {
+    const result = await updateSchedule(
+      provider.providerId,
+      buildScheduleUpdatePayload(values),
+    );
+
+    if (result?.error) {
+      form.setError("root", { message: String(result.error) });
+      return;
+    }
+
+    toast({
+      title: "Scan schedule saved",
+      description: "The scan schedule was updated successfully.",
+    });
+    onClose();
+    router.refresh();
+  });
+
+  const handleRemove = async () => {
+    setIsRemoving(true);
+    const result = await removeSchedule(provider.providerId);
+    setIsRemoving(false);
+    setIsConfirmRemoveOpen(false);
+
+    if (result?.error) {
+      form.setError("root", { message: String(result.error) });
+      return;
+    }
+
+    toast({
+      title: "Scan schedule removed",
+      description: "The scan schedule was removed successfully.",
+    });
+    onClose();
+    router.refresh();
+  };
+
+  const isSubmitting = form.formState.isSubmitting;
+  const rootError = form.formState.errors.root?.message;
+
+  return (
+    <form onSubmit={onSubmit} className="flex flex-col gap-8">
+      <EntityInfo
+        cloudProvider={provider.providerType}
+        entityAlias={provider.providerAlias ?? provider.providerUid}
+        entityId={provider.providerUid}
+      />
+
+      <ScanScheduleFields
+        form={form}
+        disabled={isSubmitting || isRemoving}
+        headerAction={
+          hasSchedule ? (
+            <Button
+              type="button"
+              variant="ghost"
+              onClick={() => setIsConfirmRemoveOpen(true)}
+              disabled={isSubmitting || isRemoving}
+              className="text-text-error-primary"
+            >
+              <CircleX className="size-4" />
+              Remove Scan Schedule
+            </Button>
+          ) : undefined
+        }
+      />
+
+      {rootError && <FieldError>{rootError}</FieldError>}
+
+      <FormButtons
+        onCancel={onClose}
+        submitText={isSubmitting ? "Saving..." : "Save"}
+        loadingText="Saving..."
+        isDisabled={isSubmitting || isRemoving}
+      />
+
+      <Modal
+        open={isConfirmRemoveOpen}
+        onOpenChange={setIsConfirmRemoveOpen}
+        title="Are you absolutely sure?"
+        description="This action cannot be undone. The scan schedule for this provider will be removed and scans will no longer run automatically."
+      >
+        <div className="flex w-full justify-end gap-4">
+          <Button
+            type="button"
+            variant="ghost"
+            size="lg"
+            onClick={() => setIsConfirmRemoveOpen(false)}
+            disabled={isRemoving}
+          >
+            Cancel
+          </Button>
+          <Button
+            type="button"
+            variant="destructive"
+            size="lg"
+            onClick={() => void handleRemove()}
+            disabled={isRemoving}
+          >
+            <CircleX className="size-4" />
+            {isRemoving ? "Removing..." : "Remove"}
+          </Button>
+        </div>
+      </Modal>
+    </form>
+  );
+}
+
+export function EditScanScheduleModal({
+  open,
+  onOpenChange,
+  provider,
+  state,
+}: EditScanScheduleModalProps) {
+  const close = () => onOpenChange(false);
+
+  return (
+    <Modal
+      open={open}
+      onOpenChange={onOpenChange}
+      title="Edit Scan Schedule"
+      size="2xl"
+      className="gap-8"
+    >
+      {state.kind === EDIT_SCAN_SCHEDULE_STATE.LOADING && (
+        <div className="flex min-h-[240px] items-center justify-center gap-3">
+          <Loader2 className="size-5 animate-spin" />
+          <span className="text-sm">Loading scan schedule...</span>
+        </div>
+      )}
+
+      {state.kind === EDIT_SCAN_SCHEDULE_STATE.ERROR && (
+        <div className="flex flex-col gap-6">
+          <FieldError>{state.message}</FieldError>
+          <Button type="button" variant="outline" onClick={close}>
+            Close
+          </Button>
+        </div>
+      )}
+
+      {state.kind === EDIT_SCAN_SCHEDULE_STATE.LOADED && provider && (
+        <EditScanScheduleForm
+          key={`${provider.providerId}-${state.schedule?.attributes.scan_hour ?? "none"}`}
+          provider={provider}
+          schedule={state.schedule}
+          onClose={close}
+        />
+      )}
+    </Modal>
+  );
+}
diff --git a/ui/components/scans/schedule/save-schedule.test.ts b/ui/components/scans/schedule/save-schedule.test.ts
new file mode 100644
index 0000000000..cf56f1fb18
--- /dev/null
+++ b/ui/components/scans/schedule/save-schedule.test.ts
@@ -0,0 +1,115 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { SCHEDULE_FREQUENCY, type ScheduleFormValues } from "@/types/schedules";
+
+const { scanOnDemandMock, scheduleDailyMock, updateScheduleMock } = vi.hoisted(
+  () => ({
+    scanOnDemandMock: vi.fn(),
+    scheduleDailyMock: vi.fn(),
+    updateScheduleMock: vi.fn(),
+  }),
+);
+
+vi.mock("@/actions/scans", () => ({
+  scanOnDemand: scanOnDemandMock,
+  scheduleDaily: scheduleDailyMock,
+}));
+
+vi.mock("@/actions/schedules", () => ({
+  updateSchedule: updateScheduleMock,
+}));
+
+import {
+  SAVE_SCHEDULE_STATUS,
+  saveScheduleWithInitialScan,
+} from "./save-schedule";
+
+const values: ScheduleFormValues = {
+  frequency: SCHEDULE_FREQUENCY.WEEKLY,
+  hour: 9,
+  dayOfWeek: 1,
+  dayOfMonth: 1,
+  intervalHours: 48,
+  launchInitialScan: false,
+};
+
+describe("saveScheduleWithInitialScan", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    updateScheduleMock.mockResolvedValue({});
+    scheduleDailyMock.mockResolvedValue({});
+    scanOnDemandMock.mockResolvedValue({ data: { id: "scan-1" } });
+  });
+
+  it("saves through the schedules API with the mapped payload", async () => {
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values,
+    });
+
+    expect(result.status).toBe(SAVE_SCHEDULE_STATUS.SAVED);
+    expect(updateScheduleMock).toHaveBeenCalledWith(
+      "p1",
+      expect.objectContaining({
+        scan_enabled: true,
+        scan_frequency: SCHEDULE_FREQUENCY.WEEKLY,
+        scan_hour: 9,
+        scan_day_of_week: 1,
+      }),
+    );
+    expect(scheduleDailyMock).not.toHaveBeenCalled();
+    expect(scanOnDemandMock).not.toHaveBeenCalled();
+  });
+
+  it("uses the legacy daily endpoint when requested", async () => {
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values,
+      useLegacyDaily: true,
+    });
+
+    expect(result.status).toBe(SAVE_SCHEDULE_STATUS.SAVED);
+    expect(scheduleDailyMock).toHaveBeenCalledTimes(1);
+    expect(updateScheduleMock).not.toHaveBeenCalled();
+  });
+
+  it("returns an error status when the schedule save fails", async () => {
+    updateScheduleMock.mockResolvedValue({ error: "boom" });
+
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values,
+    });
+
+    expect(result).toEqual({
+      status: SAVE_SCHEDULE_STATUS.ERROR,
+      message: "boom",
+    });
+    expect(scanOnDemandMock).not.toHaveBeenCalled();
+  });
+
+  it("launches the initial scan when requested", async () => {
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values: { ...values, launchInitialScan: true },
+    });
+
+    expect(result.status).toBe(SAVE_SCHEDULE_STATUS.SAVED_AND_LAUNCHED);
+    const formData = scanOnDemandMock.mock.calls[0][0] as FormData;
+    expect(formData.get("providerId")).toBe("p1");
+  });
+
+  it("reports partial success when the initial scan fails", async () => {
+    scanOnDemandMock.mockResolvedValue({ error: "limit reached" });
+
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values: { ...values, launchInitialScan: true },
+    });
+
+    expect(result).toEqual({
+      status: SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED,
+      message: "limit reached",
+    });
+  });
+});
diff --git a/ui/components/scans/schedule/save-schedule.ts b/ui/components/scans/schedule/save-schedule.ts
new file mode 100644
index 0000000000..7e3cfabb45
--- /dev/null
+++ b/ui/components/scans/schedule/save-schedule.ts
@@ -0,0 +1,70 @@
+import { scanOnDemand, scheduleDaily } from "@/actions/scans";
+import { updateSchedule } from "@/actions/schedules";
+import { buildScheduleUpdatePayload } from "@/lib/schedules";
+import type { ScheduleFormValues } from "@/types/schedules";
+
+export const SAVE_SCHEDULE_STATUS = {
+  ERROR: "error",
+  SAVED: "saved",
+  SAVED_AND_LAUNCHED: "saved_and_launched",
+  SAVED_SCAN_FAILED: "saved_scan_failed",
+} as const;
+
+export type SaveScheduleStatus =
+  (typeof SAVE_SCHEDULE_STATUS)[keyof typeof SAVE_SCHEDULE_STATUS];
+
+export interface SaveScheduleParams {
+  providerId: string;
+  values: ScheduleFormValues;
+  /** Save through the legacy `/schedules/daily` endpoint (OSS / non-Cloud). */
+  useLegacyDaily?: boolean;
+}
+
+export interface SaveScheduleResult {
+  status: SaveScheduleStatus;
+  message?: string;
+}
+
+/** Saves a provider's scan schedule and optionally launches the initial scan. */
+export async function saveScheduleWithInitialScan({
+  providerId,
+  values,
+  useLegacyDaily = false,
+}: SaveScheduleParams): Promise<SaveScheduleResult> {
+  let scheduleResult: { error?: unknown } | null;
+
+  if (useLegacyDaily) {
+    const formData = new FormData();
+    formData.set("providerId", providerId);
+    scheduleResult = await scheduleDaily(formData);
+  } else {
+    scheduleResult = await updateSchedule(
+      providerId,
+      buildScheduleUpdatePayload(values),
+    );
+  }
+
+  if (scheduleResult?.error) {
+    return {
+      status: SAVE_SCHEDULE_STATUS.ERROR,
+      message: String(scheduleResult.error),
+    };
+  }
+
+  if (!values.launchInitialScan) {
+    return { status: SAVE_SCHEDULE_STATUS.SAVED };
+  }
+
+  const formData = new FormData();
+  formData.set("providerId", providerId);
+  const scanResult = await scanOnDemand(formData);
+
+  if (scanResult?.error) {
+    return {
+      status: SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED,
+      message: String(scanResult.error),
+    };
+  }
+
+  return { status: SAVE_SCHEDULE_STATUS.SAVED_AND_LAUNCHED };
+}
diff --git a/ui/components/scans/schedule/scan-schedule-fields.test.tsx b/ui/components/scans/schedule/scan-schedule-fields.test.tsx
new file mode 100644
index 0000000000..ed8774db5f
--- /dev/null
+++ b/ui/components/scans/schedule/scan-schedule-fields.test.tsx
@@ -0,0 +1,76 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { useForm } from "react-hook-form";
+import { beforeAll, describe, expect, it, vi } from "vitest";
+
+import { getScheduleFormDefaults } from "@/lib/schedules";
+import type { ScheduleFormValues } from "@/types/schedules";
+
+import { ScanScheduleFields } from "./scan-schedule-fields";
+
+beforeAll(() => {
+  Object.defineProperty(HTMLElement.prototype, "hasPointerCapture", {
+    configurable: true,
+    value: vi.fn(() => false),
+  });
+  Object.defineProperty(HTMLElement.prototype, "setPointerCapture", {
+    configurable: true,
+    value: vi.fn(),
+  });
+  Object.defineProperty(HTMLElement.prototype, "releasePointerCapture", {
+    configurable: true,
+    value: vi.fn(),
+  });
+  Object.defineProperty(HTMLElement.prototype, "scrollIntoView", {
+    configurable: true,
+    value: vi.fn(),
+  });
+});
+
+function ScheduleFieldsHarness() {
+  const form = useForm<ScheduleFormValues>({
+    defaultValues: getScheduleFormDefaults(),
+  });
+
+  return (
+    <ScanScheduleFields
+      form={form}
+      showNextScheduledCopy
+      canUseAdvancedSchedule
+    />
+  );
+}
+
+function getHelperCopy(text: RegExp) {
+  return screen.getByText((_, element) => {
+    return (
+      element?.tagName.toLowerCase() === "p" &&
+      text.test(element.textContent ?? "")
+    );
+  });
+}
+
+describe("ScanScheduleFields", () => {
+  it("updates the helper copy when the cadence changes to interval", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(<ScheduleFieldsHarness />);
+
+    expect(getHelperCopy(/Daily/)).toBeInTheDocument();
+
+    // When
+    await user.click(screen.getByRole("combobox", { name: /repeats/i }));
+    await user.click(screen.getByRole("option", { name: /every 48 hours/i }));
+
+    // Then
+    expect(getHelperCopy(/Every 48 hours/)).toBeInTheDocument();
+    expect(
+      screen.queryByText((_, element) => {
+        return (
+          element?.tagName.toLowerCase() === "p" &&
+          /Daily/.test(element.textContent ?? "")
+        );
+      }),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/ui/components/scans/schedule/scan-schedule-fields.tsx b/ui/components/scans/schedule/scan-schedule-fields.tsx
new file mode 100644
index 0000000000..d01883b23c
--- /dev/null
+++ b/ui/components/scans/schedule/scan-schedule-fields.tsx
@@ -0,0 +1,301 @@
+"use client";
+
+import { format } from "date-fns";
+import { CalendarClock } from "lucide-react";
+import type { ReactNode } from "react";
+import { Controller, type UseFormReturn, useWatch } from "react-hook-form";
+
+import {
+  Checkbox,
+  Field,
+  FieldLabel,
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/shadcn";
+import { CloudFeatureBadgeLink } from "@/components/shared/cloud-feature-badge";
+import {
+  formatScheduleHour,
+  getBrowserTimezone,
+  getNextScheduledRun,
+} from "@/lib/schedules";
+import {
+  SCHEDULE_FREQUENCY,
+  SCHEDULE_WEEKDAY_LABELS,
+  type ScheduleFormValues,
+} from "@/types/schedules";
+
+// The INTERVAL label is resolved at render time from the form's intervalHours.
+const FREQUENCY_OPTIONS = [
+  { value: SCHEDULE_FREQUENCY.DAILY, label: "Daily" },
+  { value: SCHEDULE_FREQUENCY.INTERVAL, label: null },
+  { value: SCHEDULE_FREQUENCY.WEEKLY, label: "Weekly" },
+  { value: SCHEDULE_FREQUENCY.MONTHLY, label: "Monthly" },
+] as const;
+
+const WEEKDAY_OPTIONS = SCHEDULE_WEEKDAY_LABELS.map((label, value) => ({
+  value,
+  label,
+}));
+
+const HOUR_OPTIONS = Array.from({ length: 24 }, (_, hour) => ({
+  value: hour,
+  label: formatScheduleHour(hour),
+}));
+
+const MONTH_DAY_OPTIONS = Array.from({ length: 28 }, (_, index) => index + 1);
+
+interface ScanScheduleFieldsProps {
+  form: UseFormReturn<ScheduleFormValues>;
+  disabled?: boolean;
+  showLaunchInitialScan?: boolean;
+  showNextScheduledCopy?: boolean;
+  /** Rendered at the right of the "Scan Schedule" header row. */
+  headerAction?: ReactNode;
+  /**
+   * When false, the frequency is locked to `Daily` and the advanced cadences
+   * (interval/weekly/monthly) are disabled. Used for non-Cloud (OSS) accounts.
+   */
+  canUseAdvancedSchedule?: boolean;
+  /** Render the "Available in Prowler Cloud" upsell badge on locked controls. */
+  showCloudUpgradeBadge?: boolean;
+}
+
+function NumberSelect({
+  label,
+  labelAddon,
+  value,
+  values,
+  onChange,
+  disabled,
+}: {
+  label: string;
+  labelAddon?: ReactNode;
+  value: number;
+  values: ReadonlyArray<{ value: number; label: string }>;
+  onChange: (value: number) => void;
+  disabled?: boolean;
+}) {
+  return (
+    <Field>
+      <div className="flex items-center justify-between gap-2">
+        <FieldLabel>{label}</FieldLabel>
+        {labelAddon}
+      </div>
+      <Select
+        value={String(value)}
+        onValueChange={(nextValue) => onChange(Number(nextValue))}
+        disabled={disabled}
+      >
+        <SelectTrigger aria-label={label}>
+          <SelectValue />
+        </SelectTrigger>
+        <SelectContent>
+          {values.map((option) => (
+            <SelectItem key={option.value} value={String(option.value)}>
+              {option.label}
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    </Field>
+  );
+}
+
+function getScheduleSummary({
+  frequency,
+  intervalHours,
+  dayOfWeek,
+  dayOfMonth,
+}: Pick<
+  ScheduleFormValues,
+  "frequency" | "intervalHours" | "dayOfWeek" | "dayOfMonth"
+>) {
+  switch (frequency) {
+    case SCHEDULE_FREQUENCY.INTERVAL:
+      return `Every ${intervalHours} hours`;
+    case SCHEDULE_FREQUENCY.WEEKLY:
+      return `Weekly on ${SCHEDULE_WEEKDAY_LABELS[dayOfWeek] ?? SCHEDULE_WEEKDAY_LABELS[0]}`;
+    case SCHEDULE_FREQUENCY.MONTHLY:
+      return `Monthly on day ${dayOfMonth}`;
+    default:
+      return "Daily";
+  }
+}
+
+export function ScanScheduleFields({
+  form,
+  disabled = false,
+  showLaunchInitialScan = false,
+  showNextScheduledCopy = false,
+  headerAction,
+  canUseAdvancedSchedule = true,
+  showCloudUpgradeBadge = false,
+}: ScanScheduleFieldsProps) {
+  // useWatch, not form.watch: form.watch re-renders are dropped by React Compiler memoization.
+  const control = form.control;
+  const [frequency, hour, dayOfWeek, dayOfMonth, intervalHours] = useWatch({
+    control,
+    name: ["frequency", "hour", "dayOfWeek", "dayOfMonth", "intervalHours"],
+  });
+  const timezone = getBrowserTimezone();
+  const scheduleSummary = getScheduleSummary({
+    frequency,
+    intervalHours,
+    dayOfWeek,
+    dayOfMonth,
+  });
+  const frequencyLabel = (option: (typeof FREQUENCY_OPTIONS)[number]) =>
+    option.label ?? `Every ${intervalHours} hours`;
+  // In OSS (non-Cloud) the advanced cadence and time are locked: `/schedules/daily`
+  // ignores them, so they are display-only with a Cloud upsell.
+  const advancedDisabled = disabled || !canUseAdvancedSchedule;
+  const cloudUpgradeBadge = showCloudUpgradeBadge ? (
+    <CloudFeatureBadgeLink size="sm" />
+  ) : null;
+
+  return (
+    <div className="flex flex-col gap-6">
+      <div className="flex items-center justify-between gap-2">
+        <div className="flex items-center gap-2">
+          <CalendarClock className="text-text-neutral-primary size-5" />
+          <h3 className="text-text-neutral-primary text-sm font-medium">
+            Scan Schedule
+          </h3>
+        </div>
+        {headerAction}
+      </div>
+
+      <div className="grid grid-cols-1 gap-4 md:grid-cols-2">
+        <Controller
+          control={form.control}
+          name="hour"
+          render={({ field }) => (
+            <NumberSelect
+              label="Scan Time"
+              labelAddon={cloudUpgradeBadge}
+              value={field.value}
+              values={HOUR_OPTIONS}
+              onChange={field.onChange}
+              disabled={advancedDisabled}
+            />
+          )}
+        />
+
+        <Controller
+          control={form.control}
+          name="frequency"
+          render={({ field }) => (
+            <Field>
+              <div className="flex items-center justify-between gap-2">
+                <FieldLabel>Repeats</FieldLabel>
+                {cloudUpgradeBadge}
+              </div>
+              <Select
+                value={
+                  canUseAdvancedSchedule
+                    ? field.value
+                    : SCHEDULE_FREQUENCY.DAILY
+                }
+                onValueChange={field.onChange}
+                disabled={advancedDisabled}
+              >
+                <SelectTrigger aria-label="Repeats">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {FREQUENCY_OPTIONS.map((option) => (
+                    <SelectItem key={option.value} value={option.value}>
+                      {frequencyLabel(option)}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </Field>
+          )}
+        />
+      </div>
+
+      {frequency === SCHEDULE_FREQUENCY.WEEKLY && (
+        <Controller
+          control={form.control}
+          name="dayOfWeek"
+          render={({ field }) => (
+            <NumberSelect
+              label="Day of week"
+              value={field.value}
+              values={WEEKDAY_OPTIONS}
+              onChange={field.onChange}
+              disabled={disabled}
+            />
+          )}
+        />
+      )}
+
+      {frequency === SCHEDULE_FREQUENCY.MONTHLY && (
+        <Controller
+          control={form.control}
+          name="dayOfMonth"
+          render={({ field }) => (
+            <NumberSelect
+              label="Day of month"
+              value={field.value}
+              values={MONTH_DAY_OPTIONS.map((day) => ({
+                value: day,
+                label: String(day),
+              }))}
+              onChange={field.onChange}
+              disabled={disabled}
+            />
+          )}
+        />
+      )}
+
+      {showNextScheduledCopy &&
+        (canUseAdvancedSchedule ? (
+          <p className="text-text-neutral-secondary text-sm">
+            {scheduleSummary}. The next scheduled scan will start on:{" "}
+            {format(
+              getNextScheduledRun(
+                {
+                  frequency,
+                  hour,
+                  dayOfWeek,
+                  dayOfMonth,
+                  intervalHours,
+                  launchInitialScan: false,
+                },
+                new Date(),
+              ),
+              "MMM d, yyyy",
+            )}{" "}
+            @ {formatScheduleHour(hour)} {timezone}
+          </p>
+        ) : (
+          <p className="text-text-neutral-secondary text-sm">
+            A daily scan will run automatically once the account is connected.
+          </p>
+        ))}
+
+      {showLaunchInitialScan && (
+        <Controller
+          control={form.control}
+          name="launchInitialScan"
+          render={({ field }) => (
+            <label className="flex items-center gap-3 text-sm font-medium">
+              <Checkbox
+                checked={field.value}
+                onCheckedChange={(checked) => field.onChange(checked === true)}
+                disabled={disabled}
+                aria-label="Launch an initial scan now for immediate findings"
+              />
+              <span>Launch an initial scan now for immediate findings</span>
+            </label>
+          )}
+        />
+      )}
+    </div>
+  );
+}
diff --git a/ui/components/scans/table/cells/scan-info-cell.tsx b/ui/components/scans/table/cells/scan-info-cell.tsx
index aa61a118d0..7731a2fae1 100644
--- a/ui/components/scans/table/cells/scan-info-cell.tsx
+++ b/ui/components/scans/table/cells/scan-info-cell.tsx
@@ -1,10 +1,31 @@
 "use client";
 
 import { getScanAlias } from "@/components/scans/scans.utils";
+import {
+  Badge,
+  Tooltip,
+  TooltipContent,
+  TooltipTrigger,
+} from "@/components/shadcn";
 import { EntityInfo } from "@/components/ui/entities";
 import type { ScanProps } from "@/types";
 
 export function ScanInfoCell({ scan }: { scan: ScanProps }) {
+  // Synthetic pending rows have no Scan behind them yet, so there is no id.
+  if (scan.pendingSchedule) {
+    return (
+      <Tooltip>
+        <TooltipTrigger asChild>
+          <Badge variant="tag">Pending</Badge>
+        </TooltipTrigger>
+        <TooltipContent>
+          This scan has not been created yet. Its details will appear after the
+          first scheduled run.
+        </TooltipContent>
+      </Tooltip>
+    );
+  }
+
   return (
     <div className="max-w-[240px] min-w-0">
       <EntityInfo
diff --git a/ui/components/scans/table/cells/schedule-cell.tsx b/ui/components/scans/table/cells/schedule-cell.tsx
index 7e70dde52d..a3f8e0f469 100644
--- a/ui/components/scans/table/cells/schedule-cell.tsx
+++ b/ui/components/scans/table/cells/schedule-cell.tsx
@@ -1,18 +1,23 @@
 "use client";
 
 import { getScanScheduleLabel } from "@/components/scans/scans.utils";
-import { DateWithTime } from "@/components/ui/entities";
+import { StackedCell } from "@/components/shadcn";
+import { formatLocalTimeWithZone } from "@/lib/date-utils";
 import type { ScanProps } from "@/types";
 
+// Trigger label on top, cadence (in the browser's timezone) underneath.
 export function ScheduleCell({ scan }: { scan: ScanProps }) {
+  const schedule = scan.providerSchedule;
+  const localTime = formatLocalTimeWithZone(schedule?.nextScanAt ?? null);
+
   return (
-    <div className="flex flex-col gap-1">
-      <span className="text-text-neutral-primary text-sm">
-        {getScanScheduleLabel(scan.attributes.trigger)}
-      </span>
-      {scan.attributes.scheduled_at && (
-        <DateWithTime dateTime={scan.attributes.scheduled_at} showTime />
-      )}
-    </div>
+    <StackedCell
+      primary={getScanScheduleLabel(scan.attributes.trigger)}
+      secondary={
+        schedule
+          ? `${schedule.cadence ?? schedule.summary}${localTime ? ` @ ${localTime}` : ""}`
+          : undefined
+      }
+    />
   );
 }
diff --git a/ui/components/scans/table/scan-jobs-columns.test.tsx b/ui/components/scans/table/scan-jobs-columns.test.tsx
index 03f22cecc0..a8bde44a1c 100644
--- a/ui/components/scans/table/scan-jobs-columns.test.tsx
+++ b/ui/components/scans/table/scan-jobs-columns.test.tsx
@@ -1,14 +1,25 @@
 import type { CellContext, HeaderContext } from "@tanstack/react-table";
 import { render, screen } from "@testing-library/react";
+import type { ReactNode } from "react";
 import { describe, expect, it, vi } from "vitest";
 
 import type { ScanProps } from "@/types";
 
 vi.mock("@/components/shadcn", () => ({
-  Badge: ({ children }: { children: React.ReactNode }) => (
-    <span>{children}</span>
-  ),
+  Badge: ({ children }: { children: ReactNode }) => <span>{children}</span>,
   Progress: () => <div />,
+  StackedCell: ({
+    primary,
+    secondary,
+  }: {
+    primary: ReactNode;
+    secondary?: ReactNode;
+  }) => (
+    <div>
+      <span>{primary}</span>
+      {secondary ? <span>{secondary}</span> : null}
+    </div>
+  ),
 }));
 
 vi.mock("@/components/ui/entities", () => ({
@@ -148,6 +159,8 @@ describe("getScanJobsColumns", () => {
       "account",
       "scanInfo",
       "scanSchedule",
+      "nextScan",
+      "lastScan",
       "actions",
     ]);
   });
diff --git a/ui/components/scans/table/scan-jobs-columns.tsx b/ui/components/scans/table/scan-jobs-columns.tsx
index 824f1e6f91..d87553e50c 100644
--- a/ui/components/scans/table/scan-jobs-columns.tsx
+++ b/ui/components/scans/table/scan-jobs-columns.tsx
@@ -2,9 +2,10 @@
 
 import type { ColumnDef } from "@tanstack/react-table";
 
-import { DateWithTime } from "@/components/ui/entities";
+import { StackedCell } from "@/components/shadcn";
 import { DataTableColumnHeader } from "@/components/ui/table";
 import { StatusBadge } from "@/components/ui/table/status-badge";
+import { formatLocalDate, formatLocalTimeWithZone } from "@/lib/date-utils";
 import { SCAN_JOBS_TAB, type ScanJobsTab, type ScanProps } from "@/types";
 
 import { formatScanDuration } from "../scans.utils";
@@ -48,15 +49,59 @@ const getScanScheduleColumn = (title: string): ColumnDef<ScanProps> => ({
   cell: ({ row }) => <ScheduleCell scan={row.original} />,
 });
 
+const getScheduleSummary = (scan: ScanProps) =>
+  scan.pendingSchedule ?? scan.providerSchedule;
+
+const renderDateCell = (value: string | null) => {
+  const date = formatLocalDate(value);
+  if (!date) return <span>-</span>;
+
+  return (
+    <StackedCell primary={date} secondary={formatLocalTimeWithZone(value)} />
+  );
+};
+
 const scheduledScanScheduleColumn: ColumnDef<ScanProps> = {
   id: "scanSchedule",
   accessorFn: (row) => row.attributes.scheduled_at,
   header: ({ column }) => (
     <DataTableColumnHeader column={column} title="Schedule" />
   ),
-  cell: ({ row }) => (
-    <DateWithTime dateTime={row.original.attributes.scheduled_at} showTime />
+  // Cadence on top, local fire time underneath.
+  cell: ({ row }) => {
+    const schedule = getScheduleSummary(row.original);
+    if (!schedule) return <span>-</span>;
+
+    return (
+      <StackedCell
+        primary={schedule.cadence ?? schedule.summary}
+        secondary={formatLocalTimeWithZone(
+          row.original.attributes.scheduled_at,
+        )}
+      />
+    );
+  },
+  enableSorting: false,
+};
+
+const nextScanColumn: ColumnDef<ScanProps> = {
+  id: "nextScan",
+  header: ({ column }) => (
+    <DataTableColumnHeader column={column} title="Next Scan" />
   ),
+  // Real rows carry their fire time in scheduled_at; pending rows are
+  // synthesized with the server-computed next_scan_at in the same field.
+  cell: ({ row }) => renderDateCell(row.original.attributes.scheduled_at),
+  enableSorting: false,
+};
+
+const lastScanColumn: ColumnDef<ScanProps> = {
+  id: "lastScan",
+  header: ({ column }) => (
+    <DataTableColumnHeader column={column} title="Last Scan" />
+  ),
+  cell: ({ row }) =>
+    renderDateCell(getScheduleSummary(row.original)?.lastScanAt ?? null),
   enableSorting: false,
 };
 
@@ -104,14 +149,11 @@ const activeColumns = (): ColumnDef<ScanProps>[] => [
     header: ({ column }) => (
       <DataTableColumnHeader column={column} title="Launched" />
     ),
-    cell: ({ row }) => (
-      <DateWithTime
-        dateTime={
-          row.original.attributes.started_at ||
-          row.original.attributes.inserted_at
-        }
-      />
-    ),
+    cell: ({ row }) =>
+      renderDateCell(
+        row.original.attributes.started_at ||
+          row.original.attributes.inserted_at,
+      ),
     enableSorting: false,
   },
   actionsColumn,
@@ -141,9 +183,7 @@ const completedColumns = (): ColumnDef<ScanProps>[] => [
         param="updated_at"
       />
     ),
-    cell: ({ row }) => (
-      <DateWithTime dateTime={row.original.attributes.completed_at} />
-    ),
+    cell: ({ row }) => renderDateCell(row.original.attributes.completed_at),
   },
   actionsColumn,
 ];
@@ -152,19 +192,8 @@ const scheduledColumns = (): ColumnDef<ScanProps>[] => [
   accountColumn,
   scanInfoColumn,
   scheduledScanScheduleColumn,
-  /*
-   * TODO: Restore this column when the API exposes the last completed scan date for this schedule.
-   * {
-   *   id: "lastScan",
-   *   header: ({ column }) => (
-   *     <DataTableColumnHeader column={column} title="Last Run" />
-   *   ),
-   *   cell: ({ row }) => (
-   *     <DateWithTime dateTime={row.original.attributes.completed_at} />
-   *   ),
-   *   enableSorting: false,
-   * },
-   */
+  nextScanColumn,
+  lastScanColumn,
   actionsColumn,
 ];
 
diff --git a/ui/components/scans/table/scan-jobs-row-actions.test.tsx b/ui/components/scans/table/scan-jobs-row-actions.test.tsx
index 9475dcd8ce..7fcc97ecd6 100644
--- a/ui/components/scans/table/scan-jobs-row-actions.test.tsx
+++ b/ui/components/scans/table/scan-jobs-row-actions.test.tsx
@@ -1,19 +1,24 @@
 import { render, screen } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { ScanProps } from "@/types";
 
 import { ScanJobsRowActions } from "./scan-jobs-row-actions";
 
-const { downloadScanZipMock, getTaskMock, pushMock, toastMock } = vi.hoisted(
-  () => ({
-    downloadScanZipMock: vi.fn(),
-    getTaskMock: vi.fn(),
-    pushMock: vi.fn(),
-    toastMock: vi.fn(),
-  }),
-);
+const {
+  downloadScanZipMock,
+  getScheduleMock,
+  getTaskMock,
+  pushMock,
+  toastMock,
+} = vi.hoisted(() => ({
+  downloadScanZipMock: vi.fn(),
+  getScheduleMock: vi.fn(),
+  getTaskMock: vi.fn(),
+  pushMock: vi.fn(),
+  toastMock: vi.fn(),
+}));
 
 vi.mock("next/navigation", () => ({
   useRouter: () => ({
@@ -29,6 +34,10 @@ vi.mock("@/actions/task", () => ({
   getTask: getTaskMock,
 }));
 
+vi.mock("@/actions/schedules", () => ({
+  getSchedule: getScheduleMock,
+}));
+
 vi.mock("@/lib/helper", () => ({
   downloadScanZip: downloadScanZipMock,
 }));
@@ -53,6 +62,26 @@ vi.mock("@/components/scans/edit-alias-modal", () => ({
     ) : null,
 }));
 
+vi.mock("@/components/scans/schedule/edit-scan-schedule-modal", () => ({
+  EDIT_SCAN_SCHEDULE_STATE: {
+    LOADING: "loading",
+    LOADED: "loaded",
+    ERROR: "error",
+  },
+  EditScanScheduleModal: ({
+    open,
+    provider,
+  }: {
+    open: boolean;
+    provider?: { providerId: string };
+  }) =>
+    open ? (
+      <div role="dialog" aria-label="Edit Scan Schedule">
+        Editing schedule for {provider?.providerId}
+      </div>
+    ) : null,
+}));
+
 const makeScan = (
   overrides: Partial<ScanProps["attributes"]> = {},
 ): ScanProps => ({
@@ -80,6 +109,19 @@ const makeScan = (
 });
 
 describe("ScanJobsRowActions", () => {
+  beforeEach(() => {
+    getScheduleMock.mockResolvedValue({
+      data: {
+        type: "schedules",
+        id: "provider-1",
+        attributes: { scan_hour: null },
+        relationships: {
+          provider: { data: { type: "providers", id: "provider-1" } },
+        },
+      },
+    });
+  });
+
   afterEach(() => {
     vi.unstubAllEnvs();
     vi.clearAllMocks();
@@ -95,7 +137,9 @@ describe("ScanJobsRowActions", () => {
     await user.click(
       screen.getByRole("button", { name: /open actions menu/i }),
     );
-    await user.click(screen.getByRole("menuitem", { name: /^edit$/i }));
+    await user.click(
+      screen.getByRole("menuitem", { name: /edit scan alias/i }),
+    );
 
     // Then
     expect(
@@ -103,8 +147,31 @@ describe("ScanJobsRowActions", () => {
     ).toHaveTextContent("Editing Production scan");
   });
 
-  it("does not render the legacy Edit Scan Schedule option", async () => {
+  it("opens Edit Scan Schedule for Prowler Cloud subscribed scan rows", async () => {
     // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    const user = userEvent.setup();
+
+    render(<ScanJobsRowActions scan={makeScan()} />);
+
+    // When
+    await user.click(
+      screen.getByRole("button", { name: /open actions menu/i }),
+    );
+
+    await user.click(
+      screen.getByRole("menuitem", { name: /edit scan schedule/i }),
+    );
+
+    // Then
+    expect(
+      screen.getByRole("dialog", { name: /edit scan schedule/i }),
+    ).toHaveTextContent("Editing schedule for provider-1");
+  });
+
+  it("hides Edit Scan Schedule outside Prowler Cloud (OSS)", async () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
     const user = userEvent.setup();
 
     render(<ScanJobsRowActions scan={makeScan()} />);
@@ -120,24 +187,6 @@ describe("ScanJobsRowActions", () => {
     ).not.toBeInTheDocument();
   });
 
-  it("does not render cancel scan while the scan cancellation API is missing", async () => {
-    // Given
-    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
-    const user = userEvent.setup();
-
-    render(<ScanJobsRowActions scan={makeScan()} />);
-
-    // When
-    await user.click(
-      screen.getByRole("button", { name: /open actions menu/i }),
-    );
-
-    // Then
-    expect(
-      screen.queryByRole("menuitem", { name: /cancel scan/i }),
-    ).not.toBeInTheDocument();
-  });
-
   it("links completed scans to compliance from the actions menu", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/components/scans/table/scan-jobs-row-actions.tsx b/ui/components/scans/table/scan-jobs-row-actions.tsx
index f5847ade6b..ff9991a842 100644
--- a/ui/components/scans/table/scan-jobs-row-actions.tsx
+++ b/ui/components/scans/table/scan-jobs-row-actions.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import {
+  CalendarClock,
   Download,
   Eye,
   Pencil,
@@ -10,6 +11,7 @@ import {
 import { useRouter } from "next/navigation";
 import { useState } from "react";
 
+import { getSchedule } from "@/actions/schedules";
 import { getTask } from "@/actions/task";
 import { getScanErrorDetails } from "@/actions/task/task.adapter";
 import { EditAliasModal } from "@/components/scans/edit-alias-modal";
@@ -17,6 +19,12 @@ import {
   ScanErrorDetailsModal,
   type ScanErrorDetailsState,
 } from "@/components/scans/scan-error-details-modal";
+import {
+  EDIT_SCAN_SCHEDULE_STATE,
+  EditScanScheduleModal,
+  type EditScanScheduleState,
+  type ScanScheduleProvider,
+} from "@/components/scans/schedule/edit-scan-schedule-modal";
 import {
   ActionDropdown,
   ActionDropdownItem,
@@ -24,16 +32,36 @@ import {
 import { useToast } from "@/components/ui";
 import { toLocalDateString } from "@/lib/date-utils";
 import { downloadScanZip } from "@/lib/helper";
-import type { ScanProps } from "@/types";
+import { getScanScheduleCapability } from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
+import type { ProviderType, ScanProps, ScheduleApiResponse } from "@/types";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+} from "@/types/schedules";
 
 interface ScanJobsRowActionsProps {
   scan: ScanProps;
+  /**
+   * Schedule capability override. Only for Prowler Cloud.
+   */
+  capability?: ScanScheduleCapability;
 }
 
-export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
+export function ScanJobsRowActions({
+  scan,
+  capability,
+}: ScanJobsRowActionsProps) {
   const router = useRouter();
+  const canEditSchedule =
+    (capability ?? getScanScheduleCapability(isCloud())) ===
+    SCAN_SCHEDULE_CAPABILITY.ADVANCED;
   const { toast } = useToast();
   const [editOpen, setEditOpen] = useState(false);
+  const [scheduleOpen, setScheduleOpen] = useState(false);
+  const [scheduleState, setScheduleState] = useState<EditScanScheduleState>({
+    kind: EDIT_SCAN_SCHEDULE_STATE.LOADING,
+  });
   const [errorOpen, setErrorOpen] = useState(false);
   const [errorState, setErrorState] = useState<ScanErrorDetailsState>({
     kind: "idle",
@@ -43,6 +71,15 @@ export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
   const isFailed = scanState === "failed";
   const taskId = scan.relationships.task.data?.id;
   const scanDate = toLocalDateString(scan.attributes.completed_at);
+  const providerId = scan.relationships.provider.data?.id;
+  const scheduleProvider: ScanScheduleProvider | undefined = providerId
+    ? {
+        providerId,
+        providerType: (scan.providerInfo?.provider ?? "aws") as ProviderType,
+        providerUid: scan.providerInfo?.uid ?? providerId,
+        providerAlias: scan.providerInfo?.alias ?? null,
+      }
+    : undefined;
 
   const openFindings = () => {
     if (!isCompleted || !scanDate) return;
@@ -96,9 +133,58 @@ export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
     setErrorState({ kind: "loaded", details });
   };
 
+  const openScheduleEditor = async () => {
+    if (!providerId) {
+      setScheduleState({
+        kind: EDIT_SCAN_SCHEDULE_STATE.ERROR,
+        message: "Provider ID is not available for this scan.",
+      });
+      setScheduleOpen(true);
+      return;
+    }
+
+    setScheduleState({ kind: EDIT_SCAN_SCHEDULE_STATE.LOADING });
+    setScheduleOpen(true);
+
+    const response = (await getSchedule(providerId)) as
+      | ScheduleApiResponse
+      | { error?: string };
+
+    if (!response || ("error" in response && response.error)) {
+      setScheduleState({
+        kind: EDIT_SCAN_SCHEDULE_STATE.ERROR,
+        message:
+          response && "error" in response && response.error
+            ? response.error
+            : "Failed to load scan schedule.",
+      });
+      return;
+    }
+
+    setScheduleState({
+      kind: EDIT_SCAN_SCHEDULE_STATE.LOADED,
+      schedule: "data" in response ? response.data : null,
+    });
+  };
+
   return (
     <div className="flex items-center justify-end">
       <ActionDropdown>
+        {canEditSchedule && (
+          <ActionDropdownItem
+            icon={<CalendarClock />}
+            label="Edit Scan Schedule"
+            onSelect={() => void openScheduleEditor()}
+          />
+        )}
+        {/* Synthetic pending rows have no Scan to alias. */}
+        {!scan.pendingSchedule && (
+          <ActionDropdownItem
+            icon={<Pencil />}
+            label="Edit Scan Alias"
+            onSelect={() => setEditOpen(true)}
+          />
+        )}
         {isCompleted && (
           <>
             <ActionDropdownItem
@@ -126,12 +212,6 @@ export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
             onSelect={() => void openErrorDetails()}
           />
         )}
-        {/* TODO: Expand Edit to also cover schedule once the backend exposes a schedule update endpoint. */}
-        <ActionDropdownItem
-          icon={<Pencil />}
-          label="Edit"
-          onSelect={() => setEditOpen(true)}
-        />
         {/* TODO: Restore Cancel Scan once the backend exposes a public scan cancellation endpoint. */}
       </ActionDropdown>
 
@@ -147,6 +227,13 @@ export function ScanJobsRowActions({ scan }: ScanJobsRowActionsProps) {
         onOpenChange={setErrorOpen}
         state={errorState}
       />
+
+      <EditScanScheduleModal
+        open={scheduleOpen}
+        onOpenChange={setScheduleOpen}
+        provider={scheduleProvider}
+        state={scheduleState}
+      />
     </div>
   );
 }
diff --git a/ui/components/shadcn/index.ts b/ui/components/shadcn/index.ts
index 91c08ef72e..18ac317ef5 100644
--- a/ui/components/shadcn/index.ts
+++ b/ui/components/shadcn/index.ts
@@ -20,6 +20,7 @@ export * from "./select/multiselect";
 export * from "./select/select";
 export * from "./separator/separator";
 export * from "./skeleton/skeleton";
+export * from "./stacked-cell/stacked-cell";
 export * from "./tabs/generic-tabs";
 export * from "./tabs/tabs";
 export * from "./textarea/textarea";
diff --git a/ui/components/shadcn/select/multiselect.test.tsx b/ui/components/shadcn/select/multiselect.test.tsx
index 94d03b3bd5..3959d16053 100644
--- a/ui/components/shadcn/select/multiselect.test.tsx
+++ b/ui/components/shadcn/select/multiselect.test.tsx
@@ -214,7 +214,7 @@ describe("MultiSelect", () => {
     ).not.toBeInTheDocument();
   });
 
-  it("uses a normalized dropdown width instead of growing with the longest item", async () => {
+  it("sizes the dropdown to its content with a capped width", async () => {
     const user = userEvent.setup();
 
     render(
@@ -233,10 +233,8 @@ describe("MultiSelect", () => {
 
     await user.click(screen.getByRole("combobox"));
 
-    expect(screen.getByRole("dialog")).toHaveClass(
-      "w-[min(var(--radix-popover-trigger-width),calc(100vw-2rem))]",
-    );
-    expect(screen.getByRole("dialog")).toHaveClass("max-w-[24rem]");
+    expect(screen.getByRole("dialog")).toHaveClass("sm:w-max");
+    expect(screen.getByRole("dialog")).toHaveClass("sm:max-w-[22rem]");
   });
 
   it("keeps long option lists scrollable inside the dropdown", async () => {
diff --git a/ui/components/shadcn/select/multiselect.tsx b/ui/components/shadcn/select/multiselect.tsx
index f89c1394ba..209edbe599 100644
--- a/ui/components/shadcn/select/multiselect.tsx
+++ b/ui/components/shadcn/select/multiselect.tsx
@@ -313,8 +313,8 @@ export function MultiSelectContent({
 
   const widthClasses =
     width === "wide"
-      ? "w-[min(max(var(--radix-popover-trigger-width),24rem),calc(100vw-2rem))] max-w-[32rem]"
-      : "w-[min(var(--radix-popover-trigger-width),calc(100vw-2rem))] max-w-[24rem]";
+      ? "w-[calc(100vw-2rem)] sm:w-max sm:min-w-[min(max(var(--radix-popover-trigger-width),24rem),32rem)] sm:max-w-[32rem]"
+      : "w-[calc(100vw-2rem)] sm:w-max sm:min-w-[min(var(--radix-popover-trigger-width),22rem)] sm:max-w-[22rem]";
 
   function handleSearchValueChange(searchValue: string) {
     if (!canSearch || !searchValue.trim()) return;
@@ -426,7 +426,7 @@ export function MultiSelectItem({
         onSelect?.(value);
       }}
     >
-      <span className="flex min-w-0 flex-1 items-center gap-2 overflow-hidden">
+      <span className="flex min-w-0 flex-1 items-center gap-2 overflow-hidden whitespace-nowrap">
         {children}
       </span>
       <CheckIcon
diff --git a/ui/components/shadcn/stacked-cell/stacked-cell.test.tsx b/ui/components/shadcn/stacked-cell/stacked-cell.test.tsx
new file mode 100644
index 0000000000..61a8cd3e8a
--- /dev/null
+++ b/ui/components/shadcn/stacked-cell/stacked-cell.test.tsx
@@ -0,0 +1,20 @@
+import { render, screen } from "@testing-library/react";
+import { describe, expect, it } from "vitest";
+
+import { StackedCell } from "./stacked-cell";
+
+describe("StackedCell", () => {
+  it("renders primary and secondary lines", () => {
+    render(<StackedCell primary="Jun 15, 2026" secondary="12:00AM MAD" />);
+
+    expect(screen.getByText("Jun 15, 2026")).toBeInTheDocument();
+    expect(screen.getByText("12:00AM MAD")).toBeInTheDocument();
+  });
+
+  it("omits the secondary line when not provided", () => {
+    const { container } = render(<StackedCell primary="Manual" />);
+
+    expect(screen.getByText("Manual")).toBeInTheDocument();
+    expect(container.querySelectorAll("span")).toHaveLength(1);
+  });
+});
diff --git a/ui/components/shadcn/stacked-cell/stacked-cell.tsx b/ui/components/shadcn/stacked-cell/stacked-cell.tsx
new file mode 100644
index 0000000000..3c3184ed3e
--- /dev/null
+++ b/ui/components/shadcn/stacked-cell/stacked-cell.tsx
@@ -0,0 +1,36 @@
+import type { ReactNode } from "react";
+
+import { cn } from "@/lib/utils";
+
+interface StackedCellProps {
+  primary: ReactNode;
+  secondary?: ReactNode;
+  className?: string;
+}
+
+/**
+ * Presentational shell for two-line table cells (the DateWithTime look):
+ * primary line on top, muted secondary line underneath. Content/formatting
+ * belongs to the caller.
+ */
+export function StackedCell({
+  primary,
+  secondary,
+  className,
+}: StackedCellProps) {
+  return (
+    <div
+      data-slot="stacked-cell"
+      className={cn("flex flex-col gap-1", className)}
+    >
+      <span className="text-text-neutral-primary text-sm whitespace-nowrap">
+        {primary}
+      </span>
+      {secondary ? (
+        <span className="text-text-neutral-tertiary text-xs font-medium">
+          {secondary}
+        </span>
+      ) : null}
+    </div>
+  );
+}
diff --git a/ui/components/ui/entities/date-with-time.tsx b/ui/components/ui/entities/date-with-time.tsx
index 16cab1d7ff..8a4eedc49b 100644
--- a/ui/components/ui/entities/date-with-time.tsx
+++ b/ui/components/ui/entities/date-with-time.tsx
@@ -5,6 +5,7 @@ import {
   TooltipContent,
   TooltipTrigger,
 } from "@/components/shadcn/tooltip";
+import { formatLocalTimeWithZone } from "@/lib/date-utils";
 import { cn } from "@/lib/utils";
 
 interface DateWithTimeProps {
@@ -29,18 +30,12 @@ export const DateWithTime = ({
     }
 
     const formattedDate = format(date, "MMM dd, yyyy");
-    const formattedTime = format(date, "h:mma");
-    const timezone =
-      Intl.DateTimeFormat()
-        .resolvedOptions()
-        .timeZone.split("/")
-        .pop()
-        ?.substring(0, 3)
-        .toUpperCase() || "";
+    const timeWithZone = formatLocalTimeWithZone(dateTime);
 
-    const fullText = showTime
-      ? `${formattedDate} ${formattedTime} ${timezone}`
-      : formattedDate;
+    const fullText =
+      showTime && timeWithZone
+        ? `${formattedDate} ${timeWithZone}`
+        : formattedDate;
 
     const content = (
       <div
@@ -59,14 +54,14 @@ export const DateWithTime = ({
         >
           {formattedDate}
         </span>
-        {showTime && (
+        {showTime && timeWithZone && (
           <span
             className={cn(
               "text-text-neutral-tertiary text-xs font-medium whitespace-nowrap",
               inline && "truncate",
             )}
           >
-            {formattedTime} {timezone}
+            {timeWithZone}
           </span>
         )}
       </div>
diff --git a/ui/components/ui/table/data-table-expand-toggle.tsx b/ui/components/ui/table/data-table-expand-toggle.tsx
index 5bd7f13c09..7e18b4e510 100644
--- a/ui/components/ui/table/data-table-expand-toggle.tsx
+++ b/ui/components/ui/table/data-table-expand-toggle.tsx
@@ -44,14 +44,14 @@ export function DataTableExpandToggle<TData>({
   const isExpanded = isExpandedProp ?? row.getIsExpanded();
 
   if (!row.getCanExpand()) {
-    return <div className="w-4" />;
+    return <div className="w-4 shrink-0" />;
   }
 
   return (
     <button
       onClick={row.getToggleExpandedHandler()}
       className={cn(
-        "rounded transition-colors",
+        "shrink-0 rounded transition-colors",
         "hover:bg-prowler-white/10",
         "focus-visible:ring-border-input-primary-press focus-visible:ring-2 focus-visible:outline-none",
       )}
diff --git a/ui/components/ui/table/data-table-expandable-cell.tsx b/ui/components/ui/table/data-table-expandable-cell.tsx
index 8121e81b30..4ecf0b6b95 100644
--- a/ui/components/ui/table/data-table-expandable-cell.tsx
+++ b/ui/components/ui/table/data-table-expandable-cell.tsx
@@ -73,12 +73,13 @@ export function DataTableExpandableCell<TData>({
           {canExpand ? (
             <DataTableExpandToggle row={row} isExpanded={isExpanded} />
           ) : !isChildRow ? (
-            <div className="w-4" />
+            // shrink-0: keep this fixed-width spacer from collapsing under wide content, which would drag the checkbox left
+            <div className="w-4 shrink-0" />
           ) : null}
         </>
       )}
       {checkboxSlot && (
-        <div className="mr-2 flex items-center">{checkboxSlot}</div>
+        <div className="mr-2 flex shrink-0 items-center">{checkboxSlot}</div>
       )}
       {children}
     </div>
diff --git a/ui/components/ui/table/data-table.test.tsx b/ui/components/ui/table/data-table.test.tsx
index e86a39159c..7de2a81be8 100644
--- a/ui/components/ui/table/data-table.test.tsx
+++ b/ui/components/ui/table/data-table.test.tsx
@@ -40,6 +40,19 @@ const columns: ColumnDef<TestRow>[] = [
   },
 ];
 
+const columnsWithActions: ColumnDef<TestRow>[] = [
+  {
+    accessorKey: "name",
+    header: "Name",
+  },
+  {
+    id: "actions",
+    header: "",
+    cell: () => <button type="button">Actions</button>,
+    enableSorting: false,
+  },
+];
+
 const metadata: MetaDataProps = {
   pagination: {
     page: 1,
@@ -99,4 +112,60 @@ describe("DataTable", () => {
       expect(rightContent).toHaveClass("md:w-auto");
     });
   });
+
+  describe("when an actions column is present", () => {
+    it("should keep the actions header and cells sticky on the right edge", () => {
+      // Given
+      render(
+        <DataTable
+          columns={columnsWithActions}
+          data={[{ name: "Finding A" }]}
+        />,
+      );
+
+      // When
+      const columnHeaders = screen.getAllByRole("columnheader");
+      const nameHeader = columnHeaders[0];
+      const actionsHeader = columnHeaders.at(-1);
+      expect(actionsHeader).toBeDefined();
+      const actionsHeaderElement = actionsHeader as HTMLElement;
+      const nameCell = screen.getByText("Finding A").closest("td");
+      const actionsCell = screen
+        .getByRole("button", {
+          name: "Actions",
+        })
+        .closest("td");
+
+      // Then
+      expect(nameHeader).not.toHaveClass("sticky");
+      expect(nameCell).not.toHaveClass("sticky");
+      expect(actionsHeaderElement).not.toHaveClass("sticky");
+      expect(actionsHeaderElement).not.toHaveClass("right-0");
+      expect(actionsHeaderElement).not.toHaveClass("z-20");
+      expect(actionsHeaderElement).toHaveClass("bg-bg-neutral-tertiary");
+      expect(actionsHeaderElement).toHaveClass("border-y");
+      expect(actionsHeaderElement).toHaveClass("last:border-r");
+      expect(actionsHeaderElement).toHaveClass("last:rounded-r-full");
+      expect(actionsHeaderElement).not.toHaveClass("bg-transparent");
+      expect(actionsHeaderElement).not.toHaveClass("border-y-0");
+      expect(actionsHeaderElement).not.toHaveClass("border-l-0");
+      expect(actionsHeaderElement).not.toHaveClass("border-r-0");
+      expect(actionsHeaderElement).not.toHaveClass("last:border-r-0");
+      expect(actionsHeaderElement).not.toHaveClass("backdrop-blur-none");
+      expect(actionsHeaderElement).not.toHaveClass("last:rounded-r-none");
+      expect(actionsHeaderElement).not.toHaveClass("before:bg-gradient-to-r");
+      expect(actionsHeaderElement).not.toHaveClass("before:content-['']");
+      expect(actionsHeaderElement).not.toHaveClass("after:content-['']");
+      expect(actionsHeaderElement).not.toHaveClass("after:rounded-r-full");
+      expect(actionsHeaderElement.querySelector("div")).not.toBeInTheDocument();
+      expect(actionsCell).toHaveClass("sticky");
+      expect(actionsCell).toHaveClass("right-0");
+      expect(actionsCell).toHaveClass("z-20");
+      expect(actionsCell).toHaveClass("bg-bg-neutral-secondary");
+      expect(actionsCell).not.toHaveClass("border-l");
+      expect(actionsCell).toHaveClass("before:bg-gradient-to-r");
+      expect(actionsCell).toHaveClass("before:from-transparent");
+      expect(actionsCell).toHaveClass("before:to-bg-neutral-secondary");
+    });
+  });
 });
diff --git a/ui/components/ui/table/data-table.tsx b/ui/components/ui/table/data-table.tsx
index dba6a450e6..b31092e3e2 100644
--- a/ui/components/ui/table/data-table.tsx
+++ b/ui/components/ui/table/data-table.tsx
@@ -44,6 +44,18 @@ type DataTableRowAttributes = {
  * to allow them to flex naturally within the table layout.
  */
 const DEFAULT_COLUMN_SIZE = 150;
+const ACTIONS_COLUMN_ID = "actions";
+const STICKY_ACTION_COLUMN_CLASS = "sticky right-0 z-20 min-w-12";
+const STICKY_ACTION_CELL_CLASS = `${STICKY_ACTION_COLUMN_CLASS} overflow-visible bg-bg-neutral-secondary before:pointer-events-none before:absolute before:inset-y-0 before:-left-8 before:w-8 before:bg-gradient-to-r before:from-transparent before:to-bg-neutral-secondary before:content-[''] group-hover:bg-bg-neutral-tertiary group-hover:before:to-bg-neutral-tertiary group-data-[state=selected]:bg-bg-neutral-tertiary group-data-[state=selected]:before:to-bg-neutral-tertiary`;
+
+const getStickyActionColumnClassName = (
+  columnId: string,
+  variant: "header" | "cell",
+) => {
+  if (columnId !== ACTIONS_COLUMN_ID) return undefined;
+
+  return variant === "header" ? undefined : STICKY_ACTION_CELL_CLASS;
+};
 
 interface DataTableProviderProps<TData, TValue> {
   columns: ColumnDef<TData, TValue>[];
@@ -286,16 +298,21 @@ export function DataTable<TData, TValue>({
             <TableRow key={`${headerGroup.id}-${selectionKey}-${expansionKey}`}>
               {headerGroup.headers.map((header) => {
                 const size = header.getSize();
+                const isActionsHeader = header.column.id === ACTIONS_COLUMN_ID;
                 return (
                   <TableHead
                     key={header.id}
+                    className={getStickyActionColumnClassName(
+                      header.column.id,
+                      "header",
+                    )}
                     style={
                       getSubRows && size !== DEFAULT_COLUMN_SIZE
                         ? { width: `${size}px` }
                         : undefined
                     }
                   >
-                    {header.isPlaceholder
+                    {header.isPlaceholder || isActionsHeader
                       ? null
                       : flexRender(
                           header.column.columnDef.header,
@@ -323,13 +340,19 @@ export function DataTable<TData, TValue>({
                     <TableRow
                       {...getRowAttributes?.(row)}
                       data-state={row.getIsSelected() && "selected"}
-                      className={cn(onRowClick && "cursor-pointer")}
+                      className={cn("group", onRowClick && "cursor-pointer")}
                       onClick={(event) =>
                         handleRowClick(row, event.target as HTMLElement)
                       }
                     >
                       {row.getVisibleCells().map((cell) => (
-                        <TableCell key={cell.id}>
+                        <TableCell
+                          key={cell.id}
+                          className={getStickyActionColumnClassName(
+                            cell.column.id,
+                            "cell",
+                          )}
+                        >
                           {flexRender(
                             cell.column.columnDef.cell,
                             cell.getContext(),
diff --git a/ui/lib/date-utils.ts b/ui/lib/date-utils.ts
index 7bce896580..894ff9a513 100644
--- a/ui/lib/date-utils.ts
+++ b/ui/lib/date-utils.ts
@@ -22,6 +22,41 @@ export function toLocalDateString(
   }
 }
 
+/** Local date in the app's table format (e.g. "Jun 15, 2026"), as shown by DateWithTime. */
+export function formatLocalDate(
+  value: string | null | undefined,
+): string | undefined {
+  if (!value) return undefined;
+  try {
+    const date = parseISO(value);
+    if (isNaN(date.getTime())) return undefined;
+    return format(date, "MMM dd, yyyy");
+  } catch {
+    return undefined;
+  }
+}
+
+/** Local time with the browser's short zone label (e.g. "12:00AM MAD"), as shown by DateWithTime. */
+export function formatLocalTimeWithZone(
+  value: string | null | undefined,
+): string | undefined {
+  if (!value) return undefined;
+  try {
+    const date = parseISO(value);
+    if (isNaN(date.getTime())) return undefined;
+    const zone =
+      Intl.DateTimeFormat()
+        .resolvedOptions()
+        .timeZone.split("/")
+        .pop()
+        ?.substring(0, 3)
+        .toUpperCase() || "";
+    return `${format(date, "h:mma")} ${zone}`.trim();
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * Formats a duration in seconds to a human-readable string like "2h 5m 30s".
  */
diff --git a/ui/lib/helper.test.ts b/ui/lib/helper.test.ts
index bfe3796453..f2de6e9145 100644
--- a/ui/lib/helper.test.ts
+++ b/ui/lib/helper.test.ts
@@ -1,6 +1,6 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 
-import { downloadScanZip } from "./helper";
+import { downloadScanZip, getErrorMessage } from "./helper";
 
 vi.mock("@/actions/scans", () => ({
   getComplianceCsv: vi.fn(),
@@ -118,3 +118,20 @@ describe("downloadScanZip", () => {
     });
   });
 });
+
+describe("getErrorMessage", () => {
+  it("does not expose HTML gateway pages", () => {
+    // Given
+    const error = new Error(
+      "<html><head><title>502 Bad Gateway</title></head><body><h1>502 Bad Gateway</h1></body></html>",
+    );
+
+    // When
+    const message = getErrorMessage(error);
+
+    // Then
+    expect(message).toBe(
+      "Server is temporarily unavailable. Please try again in a few minutes.",
+    );
+  });
+});
diff --git a/ui/lib/helper.ts b/ui/lib/helper.ts
index 95173dfeef..9674ea0d73 100644
--- a/ui/lib/helper.ts
+++ b/ui/lib/helper.ts
@@ -109,6 +109,25 @@ export const getAuthUrl = (provider: AuthSocialProvider) => {
 const REPORT_PREPARATION_ERROR =
   "Unable to prepare the scan report. Please try again in a few minutes.";
 
+export const GENERIC_SERVER_ERROR_MESSAGE =
+  "Server is temporarily unavailable. Please try again in a few minutes.";
+
+const HTML_ERROR_PATTERN =
+  /(?:<!doctype\s+html|<html\b|<\/?(?:head|title|body|center|h1|h2|pre)\b)/i;
+
+export const sanitizeErrorMessage = (
+  message: string,
+  fallback = GENERIC_SERVER_ERROR_MESSAGE,
+): string => {
+  const trimmedMessage = message.trim();
+
+  if (!trimmedMessage) {
+    return fallback;
+  }
+
+  return HTML_ERROR_PATTERN.test(trimmedMessage) ? fallback : trimmedMessage;
+};
+
 const getPreflightErrorMessage = async (response: Response) => {
   const contentType = response.headers.get("content-type")?.toLowerCase() || "";
 
@@ -404,11 +423,11 @@ export function decryptKey(passkey: string) {
 
 export const getErrorMessage = (error: unknown): string => {
   if (error instanceof Error) {
-    return error.message;
+    return sanitizeErrorMessage(error.message);
   } else if (error && typeof error === "object" && "message" in error) {
-    return String(error.message);
+    return sanitizeErrorMessage(String(error.message));
   } else if (typeof error === "string") {
-    return error;
+    return sanitizeErrorMessage(error);
   } else {
     return "Oops! Something went wrong.";
   }
diff --git a/ui/lib/schedules.test.ts b/ui/lib/schedules.test.ts
new file mode 100644
index 0000000000..4004de0ee1
--- /dev/null
+++ b/ui/lib/schedules.test.ts
@@ -0,0 +1,490 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import {
+  buildProviderScheduleSummary,
+  buildSchedulesByProviderId,
+  buildScheduleUpdatePayload,
+  formatScheduleHour,
+  getBrowserTimezone,
+  getNextScheduledRun,
+  getScanScheduleCapability,
+  getScheduleFormValues,
+  isScheduleConfigured,
+} from "@/lib/schedules";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  SCHEDULE_FREQUENCY,
+  type ScheduleAttributes,
+  type ScheduleProps,
+} from "@/types/schedules";
+
+describe("schedule payload mapping", () => {
+  beforeEach(() => {
+    vi.spyOn(Intl, "DateTimeFormat").mockReturnValue({
+      resolvedOptions: () => ({ timeZone: "Europe/Madrid" }),
+    } as Intl.DateTimeFormat);
+  });
+
+  it("maps daily schedules and clears unused fields", () => {
+    // Given
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.DAILY,
+      hour: 8,
+      dayOfWeek: 2,
+      dayOfMonth: 12,
+      intervalHours: 48,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload).toEqual({
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+      scan_hour: 8,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: null,
+      scan_day_of_week: null,
+      scan_day_of_month: null,
+    });
+  });
+
+  it("maps every 48 hours schedules as an interval", () => {
+    // Given
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.INTERVAL,
+      hour: 23,
+      dayOfWeek: 0,
+      dayOfMonth: 1,
+      intervalHours: 48,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload).toEqual({
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.INTERVAL,
+      scan_hour: 23,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: 48,
+      scan_day_of_week: null,
+      scan_day_of_month: null,
+    });
+  });
+
+  it("preserves a custom interval instead of rewriting it to 48 hours", () => {
+    // Given a schedule whose interval was set outside the UI (e.g. bulk API)
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.INTERVAL,
+      hour: 5,
+      dayOfWeek: 0,
+      dayOfMonth: 1,
+      intervalHours: 72,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload.scan_interval_hours).toBe(72);
+  });
+
+  it("maps weekly schedules with 0 as Sunday and clears interval/month", () => {
+    // Given
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.WEEKLY,
+      hour: 6,
+      dayOfWeek: 0,
+      dayOfMonth: 28,
+      intervalHours: 48,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload).toEqual({
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.WEEKLY,
+      scan_hour: 6,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: null,
+      scan_day_of_week: 0,
+      scan_day_of_month: null,
+    });
+  });
+
+  it("maps monthly schedules and keeps scan_hour 0 (not falsy-coerced)", () => {
+    // Given
+    const values = {
+      frequency: SCHEDULE_FREQUENCY.MONTHLY,
+      hour: 0,
+      dayOfWeek: 5,
+      dayOfMonth: 28,
+      intervalHours: 48,
+      launchInitialScan: false,
+    };
+
+    // When
+    const payload = buildScheduleUpdatePayload(values);
+
+    // Then
+    expect(payload).toEqual({
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.MONTHLY,
+      scan_hour: 0,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: null,
+      scan_day_of_week: null,
+      scan_day_of_month: 28,
+    });
+  });
+});
+
+describe("formatScheduleHour", () => {
+  it.each([
+    [0, "12:00am"],
+    [12, "12:00pm"],
+    [13, "1:00pm"],
+    [23, "11:00pm"],
+    [-1, "11:00pm"],
+    [24, "12:00am"],
+  ])("formats hour %i as %s", (hour, expected) => {
+    expect(formatScheduleHour(hour)).toBe(expected);
+  });
+});
+
+describe("isScheduleConfigured", () => {
+  it("treats a null scan_hour as not configured", () => {
+    expect(isScheduleConfigured({ scan_hour: null })).toBe(false);
+  });
+
+  it("treats scan_hour 0 (midnight) as configured", () => {
+    expect(isScheduleConfigured({ scan_hour: 0 })).toBe(true);
+  });
+
+  it("treats a set scan_hour as configured", () => {
+    expect(isScheduleConfigured({ scan_hour: 14 })).toBe(true);
+  });
+});
+
+describe("getScheduleFormValues", () => {
+  const buildAttributes = (
+    overrides: Partial<ScheduleAttributes> = {},
+  ): ScheduleAttributes => ({
+    scan_enabled: true,
+    scan_frequency: SCHEDULE_FREQUENCY.WEEKLY,
+    scan_hour: 9,
+    scan_timezone: "Europe/Madrid",
+    scan_interval_hours: null,
+    scan_day_of_week: 4,
+    scan_day_of_month: 20,
+    ...overrides,
+  });
+
+  it("returns defaults when there is no schedule", () => {
+    expect(getScheduleFormValues(null)).toEqual({
+      frequency: SCHEDULE_FREQUENCY.DAILY,
+      hour: 0,
+      dayOfWeek: 1,
+      dayOfMonth: 1,
+      intervalHours: 48,
+      launchInitialScan: false,
+    });
+  });
+
+  it("returns defaults when scan_hour is null (unconfigured provider)", () => {
+    expect(getScheduleFormValues(buildAttributes({ scan_hour: null }))).toEqual(
+      {
+        frequency: SCHEDULE_FREQUENCY.DAILY,
+        hour: 0,
+        dayOfWeek: 1,
+        dayOfMonth: 1,
+        intervalHours: 48,
+        launchInitialScan: false,
+      },
+    );
+  });
+
+  it("maps a configured schedule onto the form", () => {
+    expect(getScheduleFormValues(buildAttributes())).toEqual({
+      frequency: SCHEDULE_FREQUENCY.WEEKLY,
+      hour: 9,
+      dayOfWeek: 4,
+      dayOfMonth: 20,
+      intervalHours: 48,
+      launchInitialScan: false,
+    });
+  });
+
+  it("keeps a custom interval from the stored schedule", () => {
+    const values = getScheduleFormValues(
+      buildAttributes({
+        scan_frequency: SCHEDULE_FREQUENCY.INTERVAL,
+        scan_interval_hours: 72,
+        scan_day_of_week: null,
+        scan_day_of_month: null,
+      }),
+    );
+    expect(values.frequency).toBe(SCHEDULE_FREQUENCY.INTERVAL);
+    expect(values.intervalHours).toBe(72);
+  });
+
+  it("falls back to default day fields when the schedule leaves them null", () => {
+    const values = getScheduleFormValues(
+      buildAttributes({ scan_day_of_week: null, scan_day_of_month: null }),
+    );
+    expect(values.dayOfWeek).toBe(1);
+    expect(values.dayOfMonth).toBe(1);
+  });
+});
+
+describe("getNextScheduledRun", () => {
+  const baseValues = {
+    frequency: SCHEDULE_FREQUENCY.DAILY,
+    hour: 14,
+    dayOfWeek: 5,
+    dayOfMonth: 15,
+    intervalHours: 48,
+    launchInitialScan: false,
+  };
+  // Wednesday 2026-06-10 10:30 local.
+  const now = new Date(2026, 5, 10, 10, 30, 0, 0);
+
+  const parts = (date: Date) => ({
+    year: date.getFullYear(),
+    month: date.getMonth(),
+    day: date.getDate(),
+    hour: date.getHours(),
+  });
+
+  it("DAILY: same day when the hour is still ahead", () => {
+    expect(
+      parts(getNextScheduledRun({ ...baseValues, hour: 14 }, now)),
+    ).toEqual({ year: 2026, month: 5, day: 10, hour: 14 });
+  });
+
+  it("DAILY: next day when the hour already passed", () => {
+    expect(parts(getNextScheduledRun({ ...baseValues, hour: 8 }, now))).toEqual(
+      {
+        year: 2026,
+        month: 5,
+        day: 11,
+        hour: 8,
+      },
+    );
+  });
+
+  it("INTERVAL: anchors at the next occurrence of the hour, like DAILY", () => {
+    // The backend derives the INTERVAL anchor as today/tomorrow at scan_hour
+    // and fires the first run there; repeats only start after that.
+    expect(
+      parts(
+        getNextScheduledRun(
+          { ...baseValues, frequency: SCHEDULE_FREQUENCY.INTERVAL, hour: 14 },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 10, hour: 14 });
+
+    expect(
+      parts(
+        getNextScheduledRun(
+          { ...baseValues, frequency: SCHEDULE_FREQUENCY.INTERVAL, hour: 8 },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 11, hour: 8 });
+  });
+
+  it("WEEKLY: advances to the target weekday this week", () => {
+    expect(
+      parts(
+        getNextScheduledRun(
+          {
+            ...baseValues,
+            frequency: SCHEDULE_FREQUENCY.WEEKLY,
+            dayOfWeek: 5,
+            hour: 9,
+          },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 12, hour: 9 });
+  });
+
+  it("WEEKLY: jumps a week when the target day/hour already passed today", () => {
+    expect(
+      parts(
+        getNextScheduledRun(
+          {
+            ...baseValues,
+            frequency: SCHEDULE_FREQUENCY.WEEKLY,
+            dayOfWeek: 3,
+            hour: 8,
+          },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 17, hour: 8 });
+  });
+
+  it("MONTHLY: this month when the day is still ahead", () => {
+    expect(
+      parts(
+        getNextScheduledRun(
+          {
+            ...baseValues,
+            frequency: SCHEDULE_FREQUENCY.MONTHLY,
+            dayOfMonth: 15,
+          },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 5, day: 15, hour: 14 });
+  });
+
+  it("MONTHLY: next month when the day already passed", () => {
+    expect(
+      parts(
+        getNextScheduledRun(
+          {
+            ...baseValues,
+            frequency: SCHEDULE_FREQUENCY.MONTHLY,
+            dayOfMonth: 5,
+          },
+          now,
+        ),
+      ),
+    ).toEqual({ year: 2026, month: 6, day: 5, hour: 14 });
+  });
+});
+
+describe("browser timezone", () => {
+  it("falls back to UTC when browser timezone is unavailable", () => {
+    // Given
+    vi.spyOn(Intl, "DateTimeFormat").mockReturnValue({
+      resolvedOptions: () => ({}),
+    } as Intl.DateTimeFormat);
+
+    // When / Then
+    expect(getBrowserTimezone()).toBe("UTC");
+  });
+});
+
+describe("scan schedule capability", () => {
+  it("returns DAILY_LEGACY for non-Cloud (OSS)", () => {
+    expect(getScanScheduleCapability(false)).toBe(
+      SCAN_SCHEDULE_CAPABILITY.DAILY_LEGACY,
+    );
+  });
+
+  it("returns ADVANCED for Cloud", () => {
+    expect(getScanScheduleCapability(true)).toBe(
+      SCAN_SCHEDULE_CAPABILITY.ADVANCED,
+    );
+  });
+});
+
+describe("buildSchedulesByProviderId", () => {
+  const buildSchedule = (
+    id: string,
+    overrides: Partial<ScheduleAttributes> = {},
+  ): ScheduleProps => ({
+    type: "schedules",
+    id,
+    attributes: {
+      scan_enabled: true,
+      scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+      scan_hour: 9,
+      scan_timezone: "Europe/Madrid",
+      scan_interval_hours: null,
+      scan_day_of_week: null,
+      scan_day_of_month: null,
+      ...overrides,
+    },
+    relationships: {
+      provider: { data: { type: "providers", id } },
+    },
+  });
+
+  it("indexes schedule attributes by provider id (the schedule's own id)", () => {
+    const result = {
+      data: [
+        buildSchedule("provider-1", { scan_hour: 6 }),
+        buildSchedule("provider-2", { scan_hour: null }),
+      ],
+    };
+
+    expect(buildSchedulesByProviderId(result)).toEqual({
+      "provider-1": result.data[0].attributes,
+      "provider-2": result.data[1].attributes,
+    });
+  });
+
+  it("returns an empty map when the request errored (e.g. OSS without /schedules)", () => {
+    expect(buildSchedulesByProviderId({ error: "Not found" })).toEqual({});
+  });
+
+  it("returns an empty map for a null/undefined result", () => {
+    expect(buildSchedulesByProviderId(null)).toEqual({});
+    expect(buildSchedulesByProviderId(undefined)).toEqual({});
+  });
+});
+
+describe("buildProviderScheduleSummary", () => {
+  const buildAttributes = (
+    overrides: Partial<ScheduleAttributes> = {},
+  ): ScheduleAttributes => ({
+    scan_enabled: true,
+    scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+    scan_hour: 9,
+    scan_timezone: "Europe/Madrid",
+    scan_interval_hours: null,
+    scan_day_of_week: null,
+    scan_day_of_month: null,
+    ...overrides,
+  });
+
+  const now = new Date(2026, 5, 10, 10, 30, 0, 0);
+
+  it.each([
+    [{ scan_frequency: SCHEDULE_FREQUENCY.DAILY }, "Daily"],
+    [
+      { scan_frequency: SCHEDULE_FREQUENCY.WEEKLY, scan_day_of_week: 1 },
+      "Weekly on Monday",
+    ],
+    [
+      { scan_frequency: SCHEDULE_FREQUENCY.MONTHLY, scan_day_of_month: 15 },
+      "Monthly on day 15",
+    ],
+    [
+      { scan_frequency: SCHEDULE_FREQUENCY.INTERVAL, scan_interval_hours: 72 },
+      "Every 72 hours",
+    ],
+  ])("exposes the %o cadence as %s", (overrides, cadence) => {
+    expect(
+      buildProviderScheduleSummary(buildAttributes(overrides), now).cadence,
+    ).toBe(cadence);
+  });
+
+  it("passes through server-computed next/last run timestamps", () => {
+    const summary = buildProviderScheduleSummary(
+      buildAttributes({
+        next_scan_at: "2026-06-15T07:00:00Z",
+        last_scan_at: "2026-06-08T07:00:00Z",
+      }),
+      now,
+    );
+
+    expect(summary.nextScanAt).toBe("2026-06-15T07:00:00Z");
+    expect(summary.lastScanAt).toBe("2026-06-08T07:00:00Z");
+  });
+});
diff --git a/ui/lib/schedules.ts b/ui/lib/schedules.ts
new file mode 100644
index 0000000000..1117ababe1
--- /dev/null
+++ b/ui/lib/schedules.ts
@@ -0,0 +1,290 @@
+import { z } from "zod";
+
+import type { ScanScheduleSummary } from "@/types/scans";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+  SCHEDULE_FREQUENCY,
+  SCHEDULE_WEEKDAY_LABELS,
+  type ScheduleAttributes,
+  type ScheduleFormValues,
+  type ScheduleProps,
+  type ScheduleUpdatePayload,
+} from "@/types/schedules";
+
+const DEFAULT_SCHEDULE_HOUR = 0;
+const DEFAULT_DAY_OF_WEEK = 1;
+const DEFAULT_DAY_OF_MONTH = 1;
+// The backend (prowler-cloud) enforces SCAN_INTERVAL_HOURS_MIN = 24. 48 is well
+// above that floor.
+const SCAN_INTERVAL_HOURS_MIN = 24;
+const DEFAULT_INTERVAL_HOURS = 48;
+
+export const scheduleFormSchema = z.object({
+  frequency: z.enum(SCHEDULE_FREQUENCY),
+  hour: z.number().int().min(0).max(23),
+  dayOfWeek: z.number().int().min(0).max(6),
+  dayOfMonth: z.number().int().min(1).max(28),
+  intervalHours: z.number().int().min(SCAN_INTERVAL_HOURS_MIN),
+  launchInitialScan: z.boolean(),
+});
+
+/**
+ * Default scan-schedule capability for the current environment.
+ *
+ * Pure function (no side effects) so it is trivial to unit-test. Prowler OSS has
+ * no billing, so the only distinction it can make is Cloud vs non-Cloud:
+ * non-Cloud → legacy daily-only, Cloud → full scheduling. The prowler-cloud
+ * overlay computes its own (billing-aware) capability and passes it down via the
+ * optional `capability` prop, overriding this default — no billing concept ever
+ * leaks into OSS.
+ */
+export function getScanScheduleCapability(
+  isCloud: boolean,
+): ScanScheduleCapability {
+  return isCloud
+    ? SCAN_SCHEDULE_CAPABILITY.ADVANCED
+    : SCAN_SCHEDULE_CAPABILITY.DAILY_LEGACY;
+}
+
+export function formatScheduleHour(hour: number): string {
+  const normalizedHour = ((hour % 24) + 24) % 24;
+  const period = normalizedHour >= 12 ? "pm" : "am";
+  const displayHour = normalizedHour % 12 === 0 ? 12 : normalizedHour % 12;
+
+  return `${displayHour}:00${period}`;
+}
+
+export function getBrowserTimezone(): string {
+  if (typeof window === "undefined") {
+    return "UTC";
+  }
+
+  return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+}
+
+export function getScheduleFormDefaults(): ScheduleFormValues {
+  return {
+    frequency: SCHEDULE_FREQUENCY.DAILY,
+    hour: DEFAULT_SCHEDULE_HOUR,
+    dayOfWeek: DEFAULT_DAY_OF_WEEK,
+    dayOfMonth: DEFAULT_DAY_OF_MONTH,
+    intervalHours: DEFAULT_INTERVAL_HOURS,
+    launchInitialScan: false,
+  };
+}
+
+export function getScheduleFormValues(
+  schedule?: ScheduleAttributes | null,
+): ScheduleFormValues {
+  const defaults = getScheduleFormDefaults();
+
+  if (!schedule || schedule.scan_hour === null) {
+    return defaults;
+  }
+
+  return {
+    frequency: schedule.scan_frequency,
+    hour: schedule.scan_hour,
+    dayOfWeek: schedule.scan_day_of_week ?? defaults.dayOfWeek,
+    dayOfMonth: schedule.scan_day_of_month ?? defaults.dayOfMonth,
+    intervalHours: schedule.scan_interval_hours ?? defaults.intervalHours,
+    launchInitialScan: false,
+  };
+}
+
+export function buildScheduleUpdatePayload(
+  values: ScheduleFormValues,
+): ScheduleUpdatePayload {
+  return {
+    scan_enabled: true,
+    scan_frequency: values.frequency,
+    scan_hour: values.hour,
+    scan_timezone: getBrowserTimezone(),
+    scan_interval_hours:
+      values.frequency === SCHEDULE_FREQUENCY.INTERVAL
+        ? values.intervalHours
+        : null,
+    scan_day_of_week:
+      values.frequency === SCHEDULE_FREQUENCY.WEEKLY ? values.dayOfWeek : null,
+    scan_day_of_month:
+      values.frequency === SCHEDULE_FREQUENCY.MONTHLY
+        ? values.dayOfMonth
+        : null,
+  };
+}
+
+interface SchedulesActionResult {
+  data?: ScheduleProps[] | null;
+  error?: unknown;
+}
+
+/**
+ * Indexes a `getSchedules()` result by provider id — the schedule resource's own
+ * `id` IS the provider id. Returns an empty map on error or missing data, so
+ * callers can treat schedules as best-effort (e.g. OSS, where the `/schedules`
+ * list endpoint may not exist). Shared by the scans and providers views.
+ */
+export function buildSchedulesByProviderId(
+  result: SchedulesActionResult | null | undefined,
+): Record<string, ScheduleAttributes> {
+  const byProviderId: Record<string, ScheduleAttributes> = {};
+  if (!result || result.error) return byProviderId;
+
+  for (const schedule of result.data ?? []) {
+    byProviderId[schedule.id] = schedule.attributes;
+  }
+
+  return byProviderId;
+}
+
+/**
+ * Whether a provider has an explicitly configured scan schedule.
+ *
+ * The schedule resource is backed by the Provider row itself: an unconfigured
+ * provider — or one whose schedule was removed (DELETE resets the schedule to
+ * defaults: `scan_hour=null`, but leaves `scan_enabled=true`) — comes back with
+ * `scan_hour === null`. So `scan_hour` is the canonical "is configured" signal;
+ * `scan_enabled` is NOT, because a freshly created provider already reports
+ * `scan_enabled=true`.
+ */
+export function isScheduleConfigured(
+  attributes: Pick<ScheduleAttributes, "scan_hour">,
+): boolean {
+  return attributes.scan_hour !== null;
+}
+
+/**
+ * Computes the next time a schedule would run, as a local `Date`. Pure: `now` is
+ * injected so it is deterministic to test. Computation is done in the browser's
+ * local time, which matches the timezone shown next to it (`getBrowserTimezone`),
+ * so no timezone-conversion library is needed. This is an estimate for display;
+ * the backend is the source of truth for the actual fire time.
+ *
+ * INTERVAL shares the DAILY computation: the backend anchors its first run at
+ * the next occurrence of `scan_hour`.
+ */
+export function getNextScheduledRun(
+  values: ScheduleFormValues,
+  now: Date,
+): Date {
+  const next = new Date(now);
+  next.setHours(values.hour, 0, 0, 0);
+
+  switch (values.frequency) {
+    case SCHEDULE_FREQUENCY.WEEKLY: {
+      let delta = (values.dayOfWeek - next.getDay() + 7) % 7;
+      if (delta === 0 && next <= now) delta = 7;
+      next.setDate(next.getDate() + delta);
+      return next;
+    }
+    case SCHEDULE_FREQUENCY.MONTHLY: {
+      next.setDate(values.dayOfMonth);
+      if (next <= now) {
+        next.setMonth(next.getMonth() + 1, values.dayOfMonth);
+      }
+      return next;
+    }
+    default: {
+      // DAILY and INTERVAL (the interval anchor is the next occurrence of the hour)
+      if (next <= now) next.setDate(next.getDate() + 1);
+      return next;
+    }
+  }
+}
+
+export interface ScheduleCadenceParts {
+  /** e.g. "Weekly on Monday" */
+  cadence: string;
+  /** e.g. "9:00am (Europe/Madrid)" */
+  time: string;
+}
+
+export function getScheduleCadenceParts(
+  attributes: ScheduleAttributes,
+): ScheduleCadenceParts {
+  const time = `${formatScheduleHour(attributes.scan_hour ?? 0)} (${attributes.scan_timezone})`;
+
+  switch (attributes.scan_frequency) {
+    case SCHEDULE_FREQUENCY.WEEKLY: {
+      const weekday =
+        SCHEDULE_WEEKDAY_LABELS[attributes.scan_day_of_week ?? 0] ??
+        SCHEDULE_WEEKDAY_LABELS[0];
+      return { cadence: `Weekly on ${weekday}`, time };
+    }
+    case SCHEDULE_FREQUENCY.MONTHLY:
+      return {
+        cadence: `Monthly on day ${attributes.scan_day_of_month ?? 1}`,
+        time,
+      };
+    case SCHEDULE_FREQUENCY.INTERVAL:
+      return {
+        cadence: `Every ${attributes.scan_interval_hours ?? 0} hours`,
+        time,
+      };
+    default:
+      return { cadence: "Daily", time };
+  }
+}
+
+/** Human-readable cadence, e.g. "Weekly on Monday @ 9:00am (Europe/Madrid)". */
+export function describeScheduleCadence(
+  attributes: ScheduleAttributes,
+): string {
+  const { cadence, time } = getScheduleCadenceParts(attributes);
+  return `${cadence} @ ${time}`;
+}
+
+/**
+ * Next-run estimate honoring the schedule's own timezone: `toLocaleString`
+ * converts `now` to that timezone's wall-clock and the offset is applied back.
+ */
+export function getNextScheduledRunInTimezone(
+  attributes: ScheduleAttributes,
+  now: Date,
+): Date | null {
+  if (attributes.scan_hour === null) return null;
+
+  let timezoneNow: Date;
+  try {
+    timezoneNow = new Date(
+      now.toLocaleString("en-US", { timeZone: attributes.scan_timezone }),
+    );
+  } catch {
+    timezoneNow = new Date(now);
+  }
+  if (Number.isNaN(timezoneNow.getTime())) timezoneNow = new Date(now);
+
+  const target = getNextScheduledRun(
+    getScheduleFormValues(attributes),
+    timezoneNow,
+  );
+
+  return new Date(now.getTime() + (target.getTime() - timezoneNow.getTime()));
+}
+
+/**
+ * Builds the display summary (cadence + next/last run) for a provider's
+ * schedule, the way the scans and providers tables render it. Shared so both
+ * views show identical cadence labels.
+ *
+ * `next_scan_at` semantics: an absent field (older API) with an enabled
+ * schedule falls back to a client estimate; an explicit null (paused) means no
+ * next run.
+ */
+export function buildProviderScheduleSummary(
+  attributes: ScheduleAttributes,
+  now: Date,
+): ScanScheduleSummary {
+  const nextScanAt =
+    attributes.next_scan_at === undefined && attributes.scan_enabled
+      ? (getNextScheduledRunInTimezone(attributes, now)?.toISOString() ?? null)
+      : (attributes.next_scan_at ?? null);
+
+  return {
+    summary: describeScheduleCadence(attributes),
+    cadence: getScheduleCadenceParts(attributes).cadence,
+    nextScanAt,
+    lastScanAt: attributes.last_scan_at ?? null,
+  };
+}
diff --git a/ui/lib/server-actions-helper.test.ts b/ui/lib/server-actions-helper.test.ts
new file mode 100644
index 0000000000..bfb9fb5ced
--- /dev/null
+++ b/ui/lib/server-actions-helper.test.ts
@@ -0,0 +1,54 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { captureExceptionMock, captureMessageMock, revalidatePathMock } =
+  vi.hoisted(() => ({
+    captureExceptionMock: vi.fn(),
+    captureMessageMock: vi.fn(),
+    revalidatePathMock: vi.fn(),
+  }));
+
+vi.mock("@sentry/nextjs", () => ({
+  captureException: captureExceptionMock,
+  captureMessage: captureMessageMock,
+}));
+
+vi.mock("next/cache", () => ({
+  revalidatePath: revalidatePathMock,
+}));
+
+vi.mock("./helper", () => ({
+  GENERIC_SERVER_ERROR_MESSAGE:
+    "Server is temporarily unavailable. Please try again in a few minutes.",
+  getErrorMessage: (error: unknown) =>
+    error instanceof Error ? error.message : String(error),
+  parseStringify: (value: unknown) => value,
+  sanitizeErrorMessage: (message: string, fallback: string) =>
+    /<html\b|<\/?body\b|<\/?h1\b/i.test(message) ? fallback : message.trim(),
+}));
+
+import { handleApiResponse } from "./server-actions-helper";
+
+describe("server action error handling", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.spyOn(console, "error").mockImplementation(() => {});
+  });
+
+  it("throws a generic server error instead of raw HTML for 5xx responses", async () => {
+    // Given
+    const response = new Response(
+      "<html><head><title>502 Bad Gateway</title></head><body><center><h1>502 Bad Gateway</h1></center></body></html>",
+      {
+        status: 502,
+        statusText: "Bad Gateway",
+        headers: { "content-type": "text/html" },
+      },
+    );
+
+    // When / Then
+    const result = handleApiResponse(response);
+    await expect(result).rejects.toThrow(
+      "Server is temporarily unavailable. Please try again in a few minutes.",
+    );
+  });
+});
diff --git a/ui/lib/server-actions-helper.ts b/ui/lib/server-actions-helper.ts
index e368d10294..ae677f2ed2 100644
--- a/ui/lib/server-actions-helper.ts
+++ b/ui/lib/server-actions-helper.ts
@@ -3,7 +3,12 @@ import { revalidatePath } from "next/cache";
 
 import { SentryErrorSource, SentryErrorType } from "@/sentry";
 
-import { getErrorMessage, parseStringify } from "./helper";
+import {
+  GENERIC_SERVER_ERROR_MESSAGE,
+  getErrorMessage,
+  parseStringify,
+  sanitizeErrorMessage,
+} from "./helper";
 
 /**
  * Helper function to handle API responses consistently
@@ -17,6 +22,7 @@ export const handleApiResponse = async (
   if (!response.ok) {
     // Read error body safely; prefer JSON, fallback to plain text
     const rawErrorText = await response.text().catch(() => "");
+    const contentType = response.headers.get("content-type")?.toLowerCase();
     let errorData: any = null;
     try {
       errorData = rawErrorText ? JSON.parse(rawErrorText) : null;
@@ -27,13 +33,20 @@ export const handleApiResponse = async (
     const errorsArray = Array.isArray(errorData?.errors)
       ? (errorData.errors as any[])
       : undefined;
-    const errorDetail =
-      errorsArray?.[0]?.detail ||
-      errorData?.error ||
-      errorData?.message ||
-      (rawErrorText && rawErrorText.trim()) ||
-      response.statusText ||
-      "Oops! Something went wrong.";
+    const parsedErrorMessage =
+      errorsArray?.[0]?.detail || errorData?.error || errorData?.message;
+    const fallbackErrorMessage =
+      response.status >= 500 || contentType?.includes("text/html")
+        ? GENERIC_SERVER_ERROR_MESSAGE
+        : response.statusText || "Oops! Something went wrong.";
+    const rawErrorMessage =
+      parsedErrorMessage ||
+      (response.status < 500 && rawErrorText.trim()) ||
+      fallbackErrorMessage;
+    const errorDetail = sanitizeErrorMessage(
+      String(rawErrorMessage),
+      fallbackErrorMessage,
+    );
 
     // Capture error context for Sentry
     const errorContext = {
diff --git a/ui/tests/helpers.ts b/ui/tests/helpers.ts
index dd4692ed57..67d647448f 100644
--- a/ui/tests/helpers.ts
+++ b/ui/tests/helpers.ts
@@ -5,7 +5,6 @@ import {
   AWS_CREDENTIAL_OPTIONS,
   ProvidersPage,
 } from "./providers/providers-page";
-import { ScansPage } from "./scans/scans-page";
 
 export const ERROR_MESSAGES = {
   INVALID_CREDENTIALS: "Invalid email or password",
@@ -123,13 +122,10 @@ export async function addAWSProvider(
   await providersPage.fillStaticCredentials(staticCredentials);
   await providersPage.clickNext();
 
-  // Launch scan
-  await providersPage.verifyLaunchScanPageLoaded();
-  await providersPage.clickNext();
-
-  // Wait for redirect to provider page
-  const scansPage = new ScansPage(page);
-  await scansPage.verifyPageLoaded();
+  // Scans specs launch their own scan. The setup helper should only leave a
+  // connected provider behind so the suite does not spend CI capacity on a
+  // duplicate preparatory scan.
+  await providersPage.completeProviderConnectionWithoutLaunchingScan(accountId);
 }
 
 /**
@@ -223,9 +219,13 @@ export async function deleteProviderIfExists(
   await expect(deleteMenuItem).toBeVisible({ timeout: 5000 });
   await deleteMenuItem.click();
 
-  // Wait for confirmation modal to appear
+  // Wait for confirmation modal to appear. Exclude the Next.js dev error
+  // overlay, which is also role="dialog" and would otherwise be matched first,
+  // making the assertion wait on the wrong (hidden) element.
   const modal = page.page
-    .locator('[role="dialog"], .modal, [data-testid*="modal"]')
+    .locator(
+      '[role="dialog"]:not([data-nextjs-dialog="true"]), .modal, [data-testid*="modal"]',
+    )
     .first();
 
   await expect(modal).toBeVisible({ timeout: 10000 });
diff --git a/ui/tests/providers/providers-page.ts b/ui/tests/providers/providers-page.ts
index 5aeb3723a6..f618c59d97 100644
--- a/ui/tests/providers/providers-page.ts
+++ b/ui/tests/providers/providers-page.ts
@@ -880,7 +880,9 @@ export class ProvidersPage extends BasePage {
         if (actionName === "Check connection") {
           await this.handleCheckConnectionCompletion();
         }
-        if (actionName === "Launch scan") {
+        // "Save" is the wizard's final action (saves the scan schedule) and
+        // "Launch scan" its legacy/manual counterpart; both close the modal.
+        if (actionName === "Launch scan" || actionName === "Save") {
           await this.handleLaunchScanCompletion();
         }
         return;
@@ -893,6 +895,12 @@ export class ProvidersPage extends BasePage {
   }
 
   private async handleCheckConnectionCompletion(): Promise<void> {
+    // A successful connection advances to the schedule step ("Save"); older
+    // flows surfaced a "Launch scan" action instead.
+    const saveScheduleButton = this.page.getByRole("button", {
+      name: "Save",
+      exact: true,
+    });
     const launchScanButton = this.page.getByRole("button", {
       name: "Launch scan",
       exact: true,
@@ -903,6 +911,7 @@ export class ProvidersPage extends BasePage {
 
     try {
       await Promise.race([
+        saveScheduleButton.waitFor({ state: "visible", timeout: 30000 }),
         launchScanButton.waitFor({ state: "visible", timeout: 30000 }),
         this.wizardModal.waitFor({ state: "hidden", timeout: 30000 }),
         connectionError.waitFor({ state: "visible", timeout: 30000 }),
@@ -918,18 +927,103 @@ export class ProvidersPage extends BasePage {
       );
     }
 
-    if (await launchScanButton.isVisible().catch(() => false)) {
+    if (await saveScheduleButton.isVisible().catch(() => false)) {
+      await saveScheduleButton.click();
+      await this.handleLaunchScanCompletion();
+    } else if (await launchScanButton.isVisible().catch(() => false)) {
       await launchScanButton.click();
       await this.handleLaunchScanCompletion();
     }
   }
 
+  private async waitForProviderLaunchChoice(): Promise<void> {
+    const launchAction = this.page
+      .getByRole("button", { name: "Save", exact: true })
+      .or(this.page.getByRole("button", { name: "Launch scan", exact: true }));
+    const connectionError = this.page.locator(
+      "div.border-border-error p.text-text-error-primary",
+    );
+
+    try {
+      await Promise.race([
+        launchAction.waitFor({ state: "visible", timeout: 30000 }),
+        connectionError.waitFor({ state: "visible", timeout: 30000 }),
+      ]);
+    } catch {
+      // Continue and inspect visible state below.
+    }
+
+    if (await connectionError.isVisible().catch(() => false)) {
+      const errorText = await connectionError.textContent();
+      throw new Error(
+        `Test connection failed with error: ${errorText?.trim() || "Unknown error"}`,
+      );
+    }
+
+    await expect(launchAction).toBeVisible();
+  }
+
+  async completeProviderConnectionWithoutLaunchingScan(
+    providerUID: string,
+  ): Promise<void> {
+    await this.verifyWizardModalOpen();
+
+    const checkConnectionButton = this.page.getByRole("button", {
+      name: "Check connection",
+      exact: true,
+    });
+    const launchAction = this.page
+      .getByRole("button", { name: "Save", exact: true })
+      .or(this.page.getByRole("button", { name: "Launch scan", exact: true }));
+    const connectionError = this.page.locator(
+      "div.border-border-error p.text-text-error-primary",
+    );
+
+    // The test-connection step renders its footer action only after an async
+    // load (canSubmit gate). Wait for the footer to settle on an actionable
+    // state (or surface a connection error) instead of reading visibility on
+    // the first frame, which races the render and falls through.
+    await expect(
+      checkConnectionButton.or(launchAction).or(connectionError),
+    ).toBeVisible({ timeout: 30000 });
+
+    if (await connectionError.isVisible().catch(() => false)) {
+      const errorText = await connectionError.textContent();
+      throw new Error(
+        `Test connection failed with error: ${errorText?.trim() || "Unknown error"}`,
+      );
+    }
+
+    // Provider-add E2E validates credentials and provider persistence only.
+    // Launching one scan per provider made CI noisy and overloaded the backend;
+    // scan execution itself is covered by scans.spec.ts.
+    if (await checkConnectionButton.isVisible().catch(() => false)) {
+      await checkConnectionButton.click();
+      await this.waitForProviderLaunchChoice();
+    } else {
+      await expect(launchAction).toBeVisible();
+    }
+
+    await this.wizardModal
+      .getByRole("button", { name: "Close", exact: true })
+      .click();
+    await expect(this.wizardModal).not.toBeVisible({ timeout: 30000 });
+    await this.page.waitForURL(/\/providers/, { timeout: 30000 });
+    await this.verifyLoadProviderPageAfterNewProvider();
+
+    const providerExists =
+      await this.verifySingleRowForProviderUID(providerUID);
+    if (!providerExists) {
+      throw new Error(`Provider with UID ${providerUID} was not found.`);
+    }
+  }
+
   private async handleLaunchScanCompletion(): Promise<void> {
     const connectionError = this.page.locator(
       "div.border-border-error p.text-text-error-primary",
     );
     const launchErrorToast = this.page.getByRole("alert").filter({
-      hasText: /Unable to launch scan/i,
+      hasText: /Unable to (launch scan|save scan schedule)/i,
     });
 
     try {
@@ -1525,9 +1619,11 @@ export class ProvidersPage extends BasePage {
     await this.verifyPageHasProwlerTitle();
     await this.verifyWizardModalOpen();
 
-    // Some providers show "Check connection" before "Launch scan".
+    // The final step saves the scan schedule ("Save"); manual-only accounts
+    // show "Launch scan" and some providers show "Check connection" first.
     const launchAction = this.page
-      .getByRole("button", { name: "Launch scan", exact: true })
+      .getByRole("button", { name: "Save", exact: true })
+      .or(this.page.getByRole("button", { name: "Launch scan", exact: true }))
       .or(
         this.page.getByRole("button", {
           name: "Check connection",
@@ -1555,10 +1651,14 @@ export class ProvidersPage extends BasePage {
       hasText: providerUID,
     });
 
-    // Verify the number of matching rows is 1
-    const count = await matchingRows.count();
-    if (count !== 1) return false;
-    return true;
+    // Use an auto-retrying assertion (not an instant count()) so the check
+    // waits for the table refetch to render the newly added provider row.
+    try {
+      await expect(matchingRows).toHaveCount(1, { timeout: 15000 });
+      return true;
+    } catch {
+      return false;
+    }
   }
 
   async selectAuthenticationMethod(method: AWSCredentialType): Promise<void> {
diff --git a/ui/tests/providers/providers.md b/ui/tests/providers/providers.md
index 944638a75a..e8139b2b3d 100644
--- a/ui/tests/providers/providers.md
+++ b/ui/tests/providers/providers.md
@@ -32,26 +32,26 @@
 4. Fill provider details (account ID and alias)
 5. Select "credentials" authentication type
 6. Fill static credentials (access key and secret key)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AWS provider successfully added with static credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays AWS option
 - Credentials form accepts static credentials
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -88,26 +88,26 @@
 4. Fill provider details (account ID and alias)
 5. Select "role" authentication type
 6. Fill role credentials (access key, secret key, and role ARN)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AWS provider successfully added with role credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays AWS option
 - Role credentials form accepts all required fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -144,26 +144,26 @@
 3. Select Azure provider type
 4. Fill provider details (subscription ID and alias)
 5. Fill Azure credentials (client ID, client secret, tenant ID)
-6. Launch initial scan
-7. Verify redirect to Scans page
-8. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+6. Confirm provider connection without launching a scan
+7. Verify return to Providers page
+8. Verify provider exists in Providers table
 
 ### Expected Result
 
 - Azure provider successfully added with static credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays Azure option
 - Azure credentials form accepts all required fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by subscription ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by subscription ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -201,26 +201,26 @@
 4. Fill provider details (domain ID and alias)
 5. Select static credentials type
 6. Fill M365 credentials (client ID, client secret, tenant ID)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - M365 provider successfully added with static credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays M365 option
 - M365 credentials form accepts all required fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by domain ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by domain ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -258,26 +258,26 @@
 4. Fill provider details (domain ID and alias)
 5. Select certificate credentials type
 6. Fill M365 certificate credentials (client ID, tenant ID, certificate content)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - M365 provider successfully added with certificate credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
 - Provider page loads correctly
 - Connect account page displays M365 option
 - Certificate credentials form accepts all required fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by domain ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by domain ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -316,16 +316,16 @@
 4. Fill provider details (context and alias)
 5. Verify credentials page is loaded
 6. Fill Kubernetes credentials (kubeconfig content)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - Kubernetes provider successfully added with kubeconfig content
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -334,10 +334,10 @@
 - Provider details form accepts context and alias
 - Credentials page loads with kubeconfig content field
 - Kubeconfig content is properly filled in the correct field
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by context)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by context)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -377,16 +377,16 @@
 4. Fill provider details (project ID and alias)
 5. Select service account credentials type
 6. Fill GCP service account key credentials
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - GCP provider successfully added with service account key
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -395,10 +395,10 @@
 - Provider details form accepts project ID and alias
 - Service account credentials page loads with service account key field
 - Service account key is properly filled in the correct field
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by project ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by project ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -439,16 +439,16 @@
 4. Fill provider details (username and alias)
 5. Select personal access token credentials type
 6. Fill GitHub personal access token credentials
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - GitHub provider successfully added with personal access token
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -457,10 +457,10 @@
 - Provider details form accepts username and alias
 - Personal access token credentials page loads with token field
 - Personal access token is properly filled in the correct field
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by username)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by username)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -499,16 +499,16 @@
 4. Fill provider details (username and alias)
 5. Select GitHub App credentials type
 6. Fill GitHub App credentials (App ID and private key)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - GitHub provider successfully added with GitHub App credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -517,10 +517,10 @@
 - Provider details form accepts username and alias
 - GitHub App credentials page loads with App ID and private key fields
 - GitHub App credentials are properly filled in the correct fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by username)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by username)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -560,16 +560,16 @@
 4. Fill provider details (organization name and alias)
 5. Select personal access token credentials type
 6. Fill GitHub organization personal access token credentials
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - GitHub provider successfully added with organization personal access token
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -578,10 +578,10 @@
 - Provider details form accepts organization name and alias
 - Personal access token credentials page loads with token field
 - Organization personal access token is properly filled in the correct field
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by organization name)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by organization name)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -621,16 +621,16 @@
 5. Select "role" authentication type
 6. Switch authentication method to "Use AWS SDK default credentials"
 7. Fill role ARN using AWS SDK credential inputs
-8. Launch initial scan
-9. Verify redirect to Scans page
-10. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+8. Confirm provider connection without launching a scan
+9. Verify return to Providers page
+10. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AWS provider successfully added using AWS SDK default credentials to assume the role
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -638,10 +638,10 @@
 - Connect account page displays AWS option
 - Credentials form exposes AWS SDK default authentication method
 - Role ARN field accepts provided value when SDK method is selected
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -679,16 +679,16 @@
 4. Fill provider details (tenancy ID and alias)
 5. Verify OCI credentials page is loaded
 6. Fill OCI credentials (user ID, fingerprint, key content, region)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - OCI provider successfully added with API Key credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -697,10 +697,10 @@
 - Provider details form accepts tenancy ID and alias
 - OCI credentials page loads
 - Credentials form accepts all required fields (user ID, fingerprint, key content, region)
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by tenancy ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by tenancy ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -798,16 +798,16 @@
 6. Select static credentials type
 7. Verify static credentials page is loaded
 8. Fill AlibabaCloud credentials (access key ID and access key secret)
-9. Launch initial scan
-10. Verify redirect to Scans page
-11. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+9. Confirm provider connection without launching a scan
+10. Verify return to Providers page
+11. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AlibabaCloud provider successfully added with static credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -817,10 +817,10 @@
 - Credentials page loads with credential type selection
 - Static credentials page loads with access key ID and access key secret fields
 - Static credentials are properly filled in the correct fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -860,16 +860,16 @@
 6. Select RAM Role credentials type
 7. Verify RAM Role credentials page is loaded
 8. Fill AlibabaCloud RAM Role credentials (access key ID, access key secret, and role ARN)
-9. Launch initial scan
-10. Verify redirect to Scans page
-11. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+9. Confirm provider connection without launching a scan
+10. Verify return to Providers page
+11. Verify provider exists in Providers table
 
 ### Expected Result
 
 - AlibabaCloud provider successfully added with RAM Role credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -879,10 +879,10 @@
 - Credentials page loads with credential type selection
 - RAM Role credentials page loads with access key ID, access key secret, and role ARN fields
 - RAM Role credentials are properly filled in the correct fields
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by account ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by account ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -924,15 +924,15 @@
 6. Continue to authentication details and provide role ARN
 7. Confirm StackSet deployment checkbox and authenticate
 8. Confirm organization account selection step and continue
-9. Verify organization launch step, choose single scan schedule, and launch
-10. Verify redirect to Scans page
+9. Verify organization launch step, choose daily scan schedule, and save
+10. Verify return to Providers page
 
 ### Expected Result
 
 - AWS Organizations flow completes successfully
 - Accounts are connected and launch step is displayed
 - Scan scheduling selection is applied
-- User is redirected to Scans page after launch
+- User returns to Providers page after saving
 
 ### Key verification points
 
@@ -941,7 +941,7 @@
 - Authentication details step loads
 - Account selection step loads
 - Accounts connected launch step appears
-- Successful redirect to Scans page after launching
+- Successful return to Providers page after saving
 
 ### Notes
 
@@ -978,16 +978,16 @@
 4. Fill provider details (customer ID and alias)
 5. Verify Google Workspace credentials page is loaded
 6. Fill Google Workspace credentials (customer ID, service account JSON, delegated user email)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - Google Workspace provider successfully added with Service Account credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -998,10 +998,10 @@
 - Customer ID help text is visible with instructions on finding the Customer ID
 - Service account JSON field accepts multi-line formatted JSON
 - Delegated user email field validates email format
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by customer ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by customer ID)
+- Provider UID matches the expected value
 
 ### Notes
 
@@ -1042,16 +1042,16 @@
 4. Fill provider details (team ID and alias)
 5. Verify Vercel credentials page is loaded
 6. Fill Vercel credentials (API token)
-7. Launch initial scan
-8. Verify redirect to Scans page
-9. Verify scheduled scan status in Scans table (provider exists and scan name is "scheduled scan")
+7. Confirm provider connection without launching a scan
+8. Verify return to Providers page
+9. Verify provider exists in Providers table
 
 ### Expected Result
 
 - Vercel provider successfully added with API Token credentials
-- Initial scan launched successfully
-- User redirected to Scans page
-- Scheduled scan appears in Scans table with correct provider and scan name
+- Provider connection validated without launching a scan
+- User returned to Providers page
+- Provider appears in Providers table with the expected UID
 
 ### Key verification points
 
@@ -1060,10 +1060,10 @@
 - Provider details form accepts team ID and alias
 - Credentials page loads with the API Token field
 - API Token is properly filled in the correct (masked) field
-- Launch scan page appears
-- Successful redirect to Scans page after scan launch
-- Provider exists in Scans table (verified by team ID)
-- Scan name field contains "scheduled scan"
+- Launch step appears
+- Successful return to Providers page after closing the launch step
+- Provider exists in Providers table (verified by team ID)
+- Provider UID matches the expected value
 
 ### Notes
 
diff --git a/ui/tests/providers/providers.spec.ts b/ui/tests/providers/providers.spec.ts
index b5c9e53df9..4dc8f010ed 100644
--- a/ui/tests/providers/providers.spec.ts
+++ b/ui/tests/providers/providers.spec.ts
@@ -37,7 +37,6 @@ import {
   VercelProviderCredential,
   VERCEL_CREDENTIAL_OPTIONS,
 } from "./providers-page";
-import { ScansPage } from "../scans/scans-page";
 import fs from "fs";
 import { deleteProviderIfExists } from "../helpers";
 
@@ -45,7 +44,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add AWS Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
     // Test data from environment variables
     const accountId = process.env.E2E_AWS_PROVIDER_ACCOUNT_ID ?? "";
     const accessKey = process.env.E2E_AWS_PROVIDER_ACCESS_KEY ?? "";
@@ -123,16 +121,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillStaticCredentials(staticCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to provider page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
 
@@ -196,16 +188,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillRoleCredentials(roleCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to provider page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
 
@@ -271,16 +257,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillRoleCredentials(roleCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to provider page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
 
@@ -297,6 +277,14 @@ test.describe("Add Provider", () => {
         ],
       },
       async ({ page }) => {
+        // AWS Organizations (multi-account onboarding) is a Cloud-only feature,
+        // so this test must never run in the OSS CI. Gate explicitly on the
+        // Cloud env flag instead of relying on the org env vars being absent.
+        test.skip(
+          process.env.NEXT_PUBLIC_IS_CLOUD_ENV !== "true",
+          "AWS Organizations multi-account onboarding is a Cloud-only feature",
+        );
+
         if (!organizationId || !organizationRoleArn) {
           test.skip(
             true,
@@ -343,11 +331,10 @@ test.describe("Add Provider", () => {
         await providersPage.clickNext();
 
         await providersPage.verifyOrganizationsLaunchStepLoaded();
-        await providersPage.chooseOrganizationsScanSchedule("single");
+        await providersPage.chooseOrganizationsScanSchedule("daily");
         await providersPage.clickNext();
 
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
+        await providersPage.verifyLoadProviderPageAfterNewProvider();
       },
     );
   });
@@ -355,7 +342,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add AZURE Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const subscriptionId = process.env.E2E_AZURE_SUBSCRIPTION_ID ?? "";
@@ -422,16 +408,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillAZURECredentials(azureCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(subscriptionId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          subscriptionId,
+        );
       },
     );
   });
@@ -439,7 +419,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add M365 Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const domainId = process.env.E2E_M365_DOMAIN_ID ?? "";
@@ -519,16 +498,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillM365Credentials(m365Credentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(domainId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          domainId,
+        );
       },
     );
 
@@ -596,16 +569,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillM365CertificateCredentials(m365Credentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(domainId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          domainId,
+        );
       },
     );
   });
@@ -613,7 +580,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add Kubernetes Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const context = process.env.E2E_KUBERNETES_CONTEXT ?? "";
@@ -696,16 +662,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillKubernetesCredentials(kubernetesCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to provider page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(context);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          context,
+        );
       },
     );
   });
@@ -713,7 +673,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add GCP Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const projectId = process.env.E2E_GCP_PROJECT_ID ?? "";
@@ -802,16 +761,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillGCPServiceAccountKeyCredentials(gcpCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(projectId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          projectId,
+        );
       },
     );
   });
@@ -819,7 +772,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add GitHub Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     test.describe("Add GitHub provider with username", () => {
       const username = process.env.E2E_GITHUB_USERNAME ?? "";
@@ -899,16 +851,10 @@ test.describe("Add Provider", () => {
           );
           await providersPage.clickNext();
 
-          // Launch scan
-          await providersPage.verifyLaunchScanPageLoaded();
-          await providersPage.clickNext();
-
-          // Wait for redirect to scan page
-          scansPage = new ScansPage(page);
-          await scansPage.verifyPageLoaded();
-
-          // Verify scan status is "Scheduled scan"
-          await scansPage.verifyScheduledScanStatus(username);
+          // Confirm the provider connection without launching a scan
+          await providersPage.completeProviderConnectionWithoutLaunchingScan(
+            username,
+          );
         },
       );
       test(
@@ -981,16 +927,10 @@ test.describe("Add Provider", () => {
           await providersPage.fillGitHubAppCredentials(githubCredentials);
           await providersPage.clickNext();
 
-          // Launch scan
-          await providersPage.verifyLaunchScanPageLoaded();
-          await providersPage.clickNext();
-
-          // Wait for redirect to scan page
-          scansPage = new ScansPage(page);
-          await scansPage.verifyPageLoaded();
-
-          // Verify scan status is "Scheduled scan"
-          await scansPage.verifyScheduledScanStatus(username);
+          // Confirm the provider connection without launching a scan
+          await providersPage.completeProviderConnectionWithoutLaunchingScan(
+            username,
+          );
         },
       );
     });
@@ -1071,16 +1011,10 @@ test.describe("Add Provider", () => {
           );
           await providersPage.clickNext();
 
-          // Launch scan
-          await providersPage.verifyLaunchScanPageLoaded();
-          await providersPage.clickNext();
-
-          // Wait for redirect to scan page
-          scansPage = new ScansPage(page);
-          await scansPage.verifyPageLoaded();
-
-          // Verify scan status is "Scheduled scan"
-          await scansPage.verifyScheduledScanStatus(organization);
+          // Confirm the provider connection without launching a scan
+          await providersPage.completeProviderConnectionWithoutLaunchingScan(
+            organization,
+          );
         },
       );
     });
@@ -1089,7 +1023,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add OCI Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const tenancyId = process.env.E2E_OCI_TENANCY_ID ?? "";
@@ -1162,16 +1095,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillOCICredentials(ociCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(tenancyId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          tenancyId,
+        );
       },
     );
   });
@@ -1179,7 +1106,6 @@ test.describe("Add Provider", () => {
   test.describe.serial("Add AlibabaCloud Provider", () => {
     // Providers page object
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const accountId = process.env.E2E_ALIBABACLOUD_ACCOUNT_ID ?? "";
@@ -1265,16 +1191,10 @@ test.describe("Add Provider", () => {
         );
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
 
@@ -1344,23 +1264,16 @@ test.describe("Add Provider", () => {
         await providersPage.fillAlibabaCloudRoleCredentials(roleCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(accountId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          accountId,
+        );
       },
     );
   });
 
   test.describe.serial("Add Google Workspace Provider", () => {
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     const customerId = process.env.E2E_GOOGLEWORKSPACE_CUSTOMER_ID ?? "";
     const serviceAccountJson =
@@ -1428,23 +1341,16 @@ test.describe("Add Provider", () => {
         );
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(customerId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          customerId,
+        );
       },
     );
   });
 
   test.describe.serial("Add Vercel Provider", () => {
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     const teamId = process.env.E2E_VERCEL_TEAM_ID ?? "";
@@ -1507,27 +1413,20 @@ test.describe("Add Provider", () => {
         await providersPage.fillVercelCredentials(vercelCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(teamId);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          teamId,
+        );
       },
     );
   });
 
   test.describe.serial("Add Okta Provider", () => {
     let providersPage: ProvidersPage;
-    let scansPage: ScansPage;
 
     // Test data from environment variables
     // Org Domain is lowercased by the form, so normalize here to match the
-    // stored provider UID used for cleanup and scan verification.
+    // stored provider UID used for cleanup.
     const orgDomain = (process.env.E2E_OKTA_DOMAIN ?? "").toLowerCase();
     const clientId = process.env.E2E_OKTA_CLIENT_ID ?? "";
     const privateKeyB64 = process.env.E2E_OKTA_BASE64_PRIVATE_KEY ?? "";
@@ -1599,16 +1498,10 @@ test.describe("Add Provider", () => {
         await providersPage.fillOktaCredentials(oktaCredentials);
         await providersPage.clickNext();
 
-        // Launch scan
-        await providersPage.verifyLaunchScanPageLoaded();
-        await providersPage.clickNext();
-
-        // Wait for redirect to scan page
-        scansPage = new ScansPage(page);
-        await scansPage.verifyPageLoaded();
-
-        // Verify scan status is "Scheduled scan"
-        await scansPage.verifyScheduledScanStatus(orgDomain);
+        // Confirm the provider connection without launching a scan
+        await providersPage.completeProviderConnectionWithoutLaunchingScan(
+          orgDomain,
+        );
       },
     );
   });
diff --git a/ui/tests/scans/scans.md b/ui/tests/scans/scans.md
index 2dcd329be6..5baef3a42d 100644
--- a/ui/tests/scans/scans.md
+++ b/ui/tests/scans/scans.md
@@ -21,6 +21,7 @@
 - Admin user authentication required (admin.auth.setup setup)
 - Environment variables configured for : E2E_AWS_PROVIDER_ACCOUNT_ID,E2E_AWS_PROVIDER_ACCESS_KEY and E2E_AWS_PROVIDER_SECRET_KEY
 - Remove any existing AWS provider with the same Account ID before starting the test
+- Create a connected AWS provider without launching a preparatory scan
 - This test must be run serially and never in parallel with other tests, as it requires the Account ID Provider to be already registered.
 
 ### Flow Steps
@@ -55,5 +56,5 @@
 
 - The scans view is tabbed (In Progress / Completed / Scheduled) and `/scans` defaults to Completed. Each empty tab renders an empty-state card instead of a table, so page-loaded checks assert the tabs shell, not the table.
 - The table may take a short time to reflect the new scan; assertions look for a row containing the account ID.
-- Provider cleanup performed before each test to ensure clean state
+- Provider cleanup and provider connection setup are performed before each test to ensure clean state
 - Tests should run serially to avoid state conflicts.
diff --git a/ui/types/index.ts b/ui/types/index.ts
index 69eb4032ac..7f7a035b47 100644
--- a/ui/types/index.ts
+++ b/ui/types/index.ts
@@ -10,5 +10,6 @@ export * from "./providers";
 export * from "./providers-table";
 export * from "./resources";
 export * from "./scans";
+export * from "./schedules";
 export * from "./tasks";
 export * from "./tree";
diff --git a/ui/types/providers-table.ts b/ui/types/providers-table.ts
index 553355b75b..21bfb1ab8c 100644
--- a/ui/types/providers-table.ts
+++ b/ui/types/providers-table.ts
@@ -5,6 +5,7 @@ import {
   OrganizationUnitResource,
 } from "./organizations";
 import { ProviderProps } from "./providers";
+import { ScanScheduleSummary } from "./scans";
 
 export const PROVIDERS_ROW_TYPE = {
   ORGANIZATION: "organization",
@@ -52,6 +53,8 @@ export interface ProvidersProviderRow
   relationships: ProviderTableRelationships;
   groupNames: string[];
   hasSchedule: boolean;
+  /** Cadence/next-run summary when the provider has a configured schedule. */
+  scheduleSummary?: ScanScheduleSummary;
   subRows?: ProvidersTableRow[];
 }
 
diff --git a/ui/types/scans.ts b/ui/types/scans.ts
index 1ebb40c408..14b1c45a41 100644
--- a/ui/types/scans.ts
+++ b/ui/types/scans.ts
@@ -83,12 +83,25 @@ export interface ScanProviderInfo {
   connected: boolean;
 }
 
+/** Cadence summary computed from `/schedules`, e.g. "Weekly on Monday @ 9:00am". */
+export interface ScanScheduleSummary {
+  summary: string;
+  /** e.g. "Weekly on Monday" */
+  cadence?: string;
+  nextScanAt?: string | null;
+  lastScanAt?: string | null;
+}
+
 export interface ScanProps {
   type: "scans";
   id: string;
   attributes: ScanAttributes;
   relationships: ScanRelationships;
   providerInfo?: ScanResultProviderInfo;
+  /** Only on synthetic Scheduled-tab rows for schedules that have not fired yet. */
+  pendingSchedule?: ScanScheduleSummary;
+  /** Current schedule cadence of the scan's provider, when configured. */
+  providerSchedule?: ScanScheduleSummary;
 }
 
 export interface ScanEntityProviderInfo {
diff --git a/ui/types/schedules.ts b/ui/types/schedules.ts
new file mode 100644
index 0000000000..5ac820eaca
--- /dev/null
+++ b/ui/types/schedules.ts
@@ -0,0 +1,97 @@
+import type { ProviderProps } from "./providers";
+
+export const SCHEDULE_FREQUENCY = {
+  DAILY: "DAILY",
+  INTERVAL: "INTERVAL",
+  WEEKLY: "WEEKLY",
+  MONTHLY: "MONTHLY",
+} as const;
+
+export type ScheduleFrequency =
+  (typeof SCHEDULE_FREQUENCY)[keyof typeof SCHEDULE_FREQUENCY];
+
+/** Weekday names indexed by cron convention (0=Sunday). */
+export const SCHEDULE_WEEKDAY_LABELS = [
+  "Sunday",
+  "Monday",
+  "Tuesday",
+  "Wednesday",
+  "Thursday",
+  "Friday",
+  "Saturday",
+] as const;
+
+/**
+ * Scan-schedule capability modes. In Prowler OSS this is resolved purely from
+ * the runtime environment (Cloud vs non-Cloud); the prowler-cloud overlay
+ * computes a billing-aware capability and injects it via the `capability` prop.
+ *
+ * - `ADVANCED`: full scheduling through the new `/schedules/{providerId}` API
+ *   (Prowler Cloud, subscribed/paid).
+ * - `DAILY_LEGACY`: Prowler OSS / non-Cloud. Only the legacy `Daily` schedule
+ *   (`/schedules/daily`) plus optional on-demand scans are allowed.
+ * - `MANUAL_ONLY`: Prowler Cloud trial/onboarding. No schedules at all, only a
+ *   manual on-demand scan subject to the account quota.
+ */
+export const SCAN_SCHEDULE_CAPABILITY = {
+  ADVANCED: "ADVANCED",
+  DAILY_LEGACY: "DAILY_LEGACY",
+  MANUAL_ONLY: "MANUAL_ONLY",
+} as const;
+
+export type ScanScheduleCapability =
+  (typeof SCAN_SCHEDULE_CAPABILITY)[keyof typeof SCAN_SCHEDULE_CAPABILITY];
+
+export interface ScheduleAttributes {
+  scan_enabled: boolean;
+  scan_frequency: ScheduleFrequency;
+  scan_hour: number | null;
+  scan_timezone: string;
+  scan_interval_hours: number | null;
+  scan_day_of_week: number | null;
+  scan_day_of_month: number | null;
+  /** Read-only, server-computed next fire time; null when paused/unconfigured. */
+  next_scan_at?: string | null;
+  /** Read-only, completed_at of the provider's last completed scan. */
+  last_scan_at?: string | null;
+}
+
+export interface ScheduleRelationships {
+  provider: {
+    data: {
+      type: "providers";
+      id: string;
+    };
+  };
+}
+
+export interface ScheduleProps {
+  type: "schedules";
+  id: string;
+  attributes: ScheduleAttributes;
+  relationships: ScheduleRelationships;
+}
+
+export interface ScheduleApiResponse {
+  data: ScheduleProps;
+  included?: ProviderProps[];
+}
+
+export interface ScheduleUpdatePayload {
+  scan_enabled: boolean;
+  scan_frequency: ScheduleFrequency;
+  scan_hour: number;
+  scan_timezone: string;
+  scan_interval_hours: number | null;
+  scan_day_of_week: number | null;
+  scan_day_of_month: number | null;
+}
+
+export interface ScheduleFormValues {
+  frequency: ScheduleFrequency;
+  hour: number;
+  dayOfWeek: number;
+  dayOfMonth: number;
+  intervalHours: number;
+  launchInitialScan: boolean;
+}

From b89b427a86b8215f223fd1741ba7d85d75faa1b5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Pe=C3=B1a?= <adrianjpr@gmail.com>
Date: Thu, 18 Jun 2026 16:37:42 +0200
Subject: [PATCH 091/126] feat: add Makefile local development stack (#11637)

---
 Makefile                              |  29 ++
 api/README.md                         |  36 ++
 docs/developer-guide/introduction.mdx |  33 ++
 scripts/development/dev-local.sh      | 701 ++++++++++++++++++++++++++
 4 files changed, 799 insertions(+)
 create mode 100755 scripts/development/dev-local.sh

diff --git a/Makefile b/Makefile
index 8bdb9bf156..e2623a4bf3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,34 @@
 .DEFAULT_GOAL:=help
 
+DEV_LOCAL := ./scripts/development/dev-local.sh
+
+.PHONY: dev dev-setup dev-attach dev-launch dev-stop dev-clean dev-wipe dev-status
+
+##@ Local Development
+dev: ## Start local API, worker, and database logs
+	$(DEV_LOCAL) all
+
+dev-setup: ## Bootstrap local dependencies, migrations, and fixtures
+	$(DEV_LOCAL) setup
+
+dev-attach: ## Attach to the local tmux development session
+	$(DEV_LOCAL) attach
+
+dev-launch: ## Start the local stack on fixed ports and attach
+	$(DEV_LOCAL) launch
+
+dev-stop: ## Stop the local tmux session and containers
+	$(DEV_LOCAL) kill
+
+dev-clean: ## Remove stopped local development containers
+	$(DEV_LOCAL) clean
+
+dev-wipe: ## Stop everything and delete local development data
+	$(DEV_LOCAL) wipe
+
+dev-status: ## Show local development container status
+	$(DEV_LOCAL) status
+
 ##@ Testing
 test:   ## Test with pytest
 	rm -rf .coverage && \
diff --git a/api/README.md b/api/README.md
index ea9661366f..8efe42c627 100644
--- a/api/README.md
+++ b/api/README.md
@@ -196,6 +196,42 @@ python -m celery -A config.celery worker -l info -E
 
 The Celery worker does not detect and reload changes in the code, so you need to restart it manually when you make changes.
 
+### Makefile-Assisted Local Deployment
+
+This method is an additional local development workflow. It does not replace the manual local deployment or the Docker deployment described in this guide.
+
+PostgreSQL, Valkey, and Neo4j run with Docker Compose, while Django and the Celery worker run natively through `uv`. Additionally, this workflow creates a `tmux` session with panes for the API, worker, and PostgreSQL logs.
+
+Before using this method, ensure `docker compose`, `tmux`, and `uv` are installed.
+
+This workflow is designed for macOS. On Linux, `make dev` and `make dev-attach` should work when Docker, `tmux`, and `uv` are available, and `make dev-launch` is supported from Warp or Ghostty. Windows requires script changes before it can be supported.
+
+From the repository root, run:
+
+```console
+make dev
+```
+
+The API will be available at:
+
+```console
+http://localhost:8080/api/v1
+```
+
+Use these commands to manage the local stack:
+
+```console
+make dev-setup   # Bootstrap dependencies, migrations, and fixtures
+make dev-attach  # Attach to the tmux session
+make dev-launch  # Start the stack on fixed ports and attach
+make dev-stop    # Stop the tmux session and containers
+make dev-clean   # Remove stopped development containers
+make dev-wipe    # Stop everything and delete local development data
+make dev-status  # Show development container status
+```
+
+This workflow does not start the UI. Start it separately from the `ui/` directory when needed.
+
 ### Docker deployment
 
 This method requires `docker` and `docker compose`.
diff --git a/docs/developer-guide/introduction.mdx b/docs/developer-guide/introduction.mdx
index 117640c669..0fae9e8ccc 100644
--- a/docs/developer-guide/introduction.mdx
+++ b/docs/developer-guide/introduction.mdx
@@ -108,6 +108,39 @@ uv sync
 source .venv/bin/activate
 ```
 
+### Running the Local API Development Stack
+
+For API development, Prowler provides a Makefile-based local stack in addition to the manual and Docker Compose workflows documented in the API README. PostgreSQL, Valkey, and Neo4j run with Docker Compose, while Django and the Celery worker run natively through `uv`.
+
+Before using this method, ensure `docker compose`, `tmux`, and `uv` are installed.
+
+This workflow is designed for macOS. On Linux, `make dev` and `make dev-attach` should work when Docker, `tmux`, and `uv` are available, and `make dev-launch` is supported from Warp or Ghostty. Windows requires script changes before it can be supported.
+
+To start the local API stack, run:
+
+```shell
+make dev
+```
+
+This command starts the required services, creates a `tmux` session with panes for the API, worker, and PostgreSQL logs, waits until the API responds, and prints the API URL and log file paths. The API is available at:
+
+```text
+http://localhost:8080/api/v1
+```
+
+Use these commands to manage the stack:
+
+```shell
+make dev-setup   # Bootstrap dependencies, migrations, and fixtures
+make dev-attach  # Attach to the tmux session
+make dev-launch  # Start the stack on fixed ports and attach
+make dev-stop    # Stop the tmux session and containers
+make dev-clean   # Remove stopped development containers
+make dev-wipe    # Stop everything and delete local development data
+make dev-status  # Show development container status
+```
+
+The UI is not started by this workflow. Start it separately by following the UI development instructions in the `ui/` directory.
 
 ### Pre-Commit Hooks
 
diff --git a/scripts/development/dev-local.sh b/scripts/development/dev-local.sh
new file mode 100755
index 0000000000..a044821485
--- /dev/null
+++ b/scripts/development/dev-local.sh
@@ -0,0 +1,701 @@
+#!/usr/bin/env bash
+#
+# Local dev for Prowler API + worker.
+# Postgres / Valkey / Neo4j run in Docker via docker-compose-dev.yml;
+# Django and Celery run natively.
+#
+# Quick start:
+#   make dev-setup   first-time bootstrap (deps, migrations, fixtures)
+#   make dev         launch api + worker + postgres logs in tmux
+#   make dev-attach  attach to the tmux session in the current terminal pane
+#   make dev-launch  use fixed ports and attach interactive local dev
+#   make dev-stop    stop everything: tmux + stop + remove containers
+#   make dev-clean   remove stopped containers only (data preserved)
+#   make dev-wipe    full nuke: kill + clean + delete ./_data/
+#
+# Agent / non-interactive usage: 'make dev' is idempotent, runs
+# everything detached, blocks until the API answers HTTP, and ends with
+# parseable key=value lines (api_url=, api_log=, worker_log=,
+# postgres_log=, attach_cmd=, stop_cmd=).
+# Every pane is teed ANSI-stripped to _data/logs/{api,worker,postgres}.log
+# (truncated per run), so logs are readable with tail -f, no tmux needed.
+#
+# 'attach' does not create Warp panes. It attaches to tmux inside the current
+# terminal pane. If you want native Warp panes, use 'make dev-launch'
+# from Warp instead.
+#
+# Inside the tmux session "prowler-dev-<compose-project>" the prefix key is Ctrl+b. After it:
+#   d              detach (everything keeps running; reattach: make dev-attach)
+#   <arrows>       move between panes
+#   z              zoom current pane (toggle)
+#   [              scrollback mode (q to exit)
+#   x              kill current pane (asks for confirmation)
+#   &              kill current window
+#   :kill-session  end the whole session
+#
+# How to stop everything from inside tmux:
+#   1) Ctrl+b then d           detach back to your shell
+#   2) make dev-stop           tears down tmux + containers
+# Alternative without detaching: open a new tmux window with Ctrl+b then c
+# and run make dev-stop there; the session will close itself.
+#
+# Stop just the python procs (keep containers up to skip a slow neo4j boot next time):
+#   ./scripts/development/dev-local.sh down
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+cd "$REPO_ROOT"
+
+path_hash() {
+  if command -v shasum >/dev/null 2>&1; then
+    printf '%s' "$REPO_ROOT" | shasum | awk '{print substr($1, 1, 8)}'
+  else
+    printf '%s' "$REPO_ROOT" | cksum | awk '{print $1}'
+  fi
+}
+
+compose_project_default() {
+  local base hash
+  base="$(basename "$REPO_ROOT" | tr '[:upper:]' '[:lower:]' | sed -E 's/[^a-z0-9_-]+/-/g; s/^-+//; s/-+$//')"
+  hash="$(path_hash)"
+  printf '%s-%s' "${base:-prowler}" "$hash"
+}
+
+export COMPOSE_PROJECT_NAME="${COMPOSE_PROJECT_NAME:-$(compose_project_default)}"
+
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
+
+export POSTGRES_HOST=localhost
+export POSTGRES_PORT="${POSTGRES_PORT:-5432}"
+export VALKEY_HOST=localhost
+export VALKEY_PORT="${VALKEY_PORT:-6379}"
+export VALKEY_SCHEME="${VALKEY_SCHEME:-redis}"
+export NEO4J_HOST=localhost
+export NEO4J_PORT="${NEO4J_PORT:-7687}"
+export NEO4J_HTTP_PORT="${NEO4J_HTTP_PORT:-7474}"
+export DJANGO_SETTINGS_MODULE=config.django.devel
+export DJANGO_DEBUG="${DJANGO_DEBUG:-True}"
+export DJANGO_PORT="${DJANGO_PORT:-8080}"
+export DJANGO_LOGGING_FORMATTER="${DJANGO_LOGGING_FORMATTER:-human_readable}"
+export DJANGO_LOGGING_LEVEL="${DJANGO_LOGGING_LEVEL:-info}"
+export DJANGO_MANAGE_DB_PARTITIONS="${DJANGO_MANAGE_DB_PARTITIONS:-False}"
+
+if docker compose version >/dev/null 2>&1; then
+  COMPOSE=(docker compose)
+else
+  COMPOSE=(docker-compose)
+fi
+COMPOSE_FILE="docker-compose-dev.yml"
+
+log()  { printf '\033[1;34m→\033[0m %s\n' "$*"; }
+ok()   { printf '\033[1;32m✓\033[0m %s\n' "$*"; }
+warn() { printf '\033[1;33m!\033[0m %s\n' "$*"; }
+
+is_macos() {
+  [ "$(uname -s)" = "Darwin" ]
+}
+
+is_linux() {
+  [ "$(uname -s)" = "Linux" ]
+}
+
+ghostty_available() {
+  command -v ghostty >/dev/null 2>&1 || [ -d /Applications/Ghostty.app ]
+}
+
+launch_terminal_supported() {
+  case "$LAUNCH_TERMINAL" in
+    Ghostty)
+      ghostty_available
+      ;;
+    Terminal|iTerm|iTerm2)
+      is_macos
+      ;;
+    *)
+      is_macos && open -Ra "$LAUNCH_TERMINAL" >/dev/null 2>&1
+      ;;
+  esac
+}
+
+require_uv() {
+  if ! command -v uv >/dev/null 2>&1; then
+    warn "uv not found in PATH. Install: https://docs.astral.sh/uv/getting-started/installation/"
+    exit 1
+  fi
+}
+
+services_up() {
+  log "Starting postgres + valkey + neo4j via Docker (waits for healthchecks)..."
+  "${COMPOSE[@]}" -f "$COMPOSE_FILE" up -d --wait postgres valkey neo4j
+  ok "Services ready: pg:${POSTGRES_PORT} / valkey:${VALKEY_PORT} / neo4j:${NEO4J_PORT} / neo4j-http:${NEO4J_HTTP_PORT}"
+}
+
+kill_tmux_session() {
+  command -v tmux >/dev/null 2>&1 || return 0
+  if tmux has-session -t "$TMUX_SESSION" 2>/dev/null; then
+    log "Killing tmux session '$TMUX_SESSION'"
+    tmux kill-session -t "$TMUX_SESSION"
+  fi
+}
+
+tmux_pane_count() {
+  tmux list-panes -t "$TMUX_SESSION:" 2>/dev/null | wc -l | tr -d ' '
+}
+
+# Tee a tmux pane's output to _data/logs/<name>.log so non-interactive
+# consumers (scripts, agents) can follow the stack without attaching.
+# ANSI codes are stripped; the file is truncated on session creation so
+# its content always matches the current run.
+pipe_pane_log() {
+  local pane="$1" name="$2"
+  local logfile="$REPO_ROOT/_data/logs/$name.log"
+  : > "$logfile"
+  tmux pipe-pane -t "$pane" -o "perl -pe 'BEGIN{\$|=1} s/\\e\\[[0-9;?]*[A-Za-z]//g' >> '$logfile'"
+}
+
+# Stop native dev processes (api/worker/beat) launched outside tmux, e.g. inside
+# Warp panes. Scoped by cwd under REPO_ROOT so other prowler clones running their
+# own stacks are not touched.
+kill_native_procs() {
+  command -v pgrep >/dev/null 2>&1 || return 0
+  command -v lsof  >/dev/null 2>&1 || return 0
+
+  local pids="" pid pcwd pat
+  for pat in "manage.py runserver" "celery -A config.celery worker" "celery -A config.celery beat"; do
+    while IFS= read -r pid; do
+      [ -n "$pid" ] || continue
+      pcwd="$(lsof -a -d cwd -p "$pid" 2>/dev/null | awk 'NR>1 {print $NF; exit}')"
+      case "$pcwd" in
+        "$REPO_ROOT"|"$REPO_ROOT"/*) pids="$pids $pid" ;;
+      esac
+    done < <(pgrep -f "$pat" 2>/dev/null)
+  done
+
+  pids="$(printf '%s\n' "$pids" | tr ' ' '\n' | sed '/^$/d' | sort -u | xargs)"
+  [ -z "$pids" ] && return 0
+
+  log "Stopping native dev procs ($pids) under $REPO_ROOT"
+  # shellcheck disable=SC2086
+  kill -TERM $pids 2>/dev/null || true
+  sleep 0.5
+  # shellcheck disable=SC2086
+  kill -KILL $pids 2>/dev/null || true
+}
+
+services_down() {
+  kill_tmux_session
+  kill_native_procs
+  log "Stopping postgres + valkey + neo4j..."
+  "${COMPOSE[@]}" -f "$COMPOSE_FILE" stop postgres valkey neo4j
+}
+
+services_status() {
+  "${COMPOSE[@]}" -f "$COMPOSE_FILE" ps postgres valkey neo4j
+}
+
+deps() {
+  require_uv
+  log "uv sync (api/)..."
+  (cd api && uv sync)
+}
+
+migrate() {
+  require_uv
+  log "Applying migrations (admin DB)..."
+  (
+    cd api/src/backend
+    uv run python manage.py check_and_fix_socialaccount_sites_migration --database admin
+    uv run python manage.py migrate --database admin
+  )
+  ok "Migrations applied"
+}
+
+fixtures() {
+  require_uv
+  log "Loading dev fixtures..."
+  (
+    cd api/src/backend
+    for fixture in api/fixtures/dev/*.json; do
+      [ -f "$fixture" ] || continue
+      echo "  loading $(basename "$fixture")"
+      uv run python manage.py loaddata "$fixture" --database admin
+    done
+  )
+  ok "Fixtures loaded"
+}
+
+api_run() {
+  require_uv
+  log "Starting Django API on [::]:${DJANGO_PORT} (IPv4 + IPv6 dual-stack)"
+  cd api/src/backend
+  exec uv run python manage.py runserver "[::]:${DJANGO_PORT}"
+}
+
+worker_run() {
+  require_uv
+  log "Starting Celery worker"
+  cd api/src/backend
+  exec uv run python -m celery -A config.celery worker \
+    -l "${DJANGO_LOGGING_LEVEL}" \
+    -Q celery,scans,scan-reports,deletion,backfill,overview,integrations,compliance,attack-paths-scans \
+    -E
+}
+
+beat_run() {
+  require_uv
+  log "Starting Celery beat (DatabaseScheduler)"
+  cd api/src/backend
+  exec uv run python -m celery -A config.celery beat \
+    -l "${DJANGO_LOGGING_LEVEL}" \
+    --scheduler django_celery_beat.schedulers:DatabaseScheduler
+}
+
+TMUX_SESSION="prowler-dev-${COMPOSE_PROJECT_NAME}"
+SCRIPT_PATH="$REPO_ROOT/scripts/development/dev-local.sh"
+
+require_tmux() {
+  if ! command -v tmux >/dev/null 2>&1; then
+    warn "tmux not installed. Run: brew install tmux"
+    exit 1
+  fi
+}
+
+remove_repo_compose_containers() {
+  command -v docker >/dev/null 2>&1 || return 0
+  local ids
+  ids="$(
+    docker ps -aq 2>/dev/null \
+      | while IFS= read -r id; do
+          docker inspect --format '{{.ID}} {{index .Config.Labels "com.docker.compose.project.working_dir"}}' "$id" 2>/dev/null || true
+        done \
+      | awk -v repo="$REPO_ROOT" '$2 == repo {print $1}'
+  )"
+  [ -n "$ids" ] || return 0
+  warn "Removing existing Docker containers for this repo before launch"
+  # shellcheck disable=SC2086
+  docker rm -f $ids >/dev/null
+}
+
+remove_docker_containers_on_ports() {
+  command -v docker >/dev/null 2>&1 || return 0
+  local all_ids ids_to_remove="" id port published_ports
+  all_ids="$(docker ps -aq 2>/dev/null || true)"
+  [ -n "$all_ids" ] || return 0
+
+  for id in $all_ids; do
+    published_ports="$(docker inspect --format '{{range $containerPort, $bindings := .HostConfig.PortBindings}}{{range $bindings}}{{.HostPort}}{{"\n"}}{{end}}{{end}}' "$id" 2>/dev/null || true)"
+    [ -n "$published_ports" ] || continue
+    for port in "$@"; do
+      if printf '%s\n' "$published_ports" | grep -qx "$port"; then
+        ids_to_remove="$ids_to_remove $id"
+        break
+      fi
+    done
+  done
+
+  ids_to_remove="$(printf '%s\n' "$ids_to_remove" | tr ' ' '\n' | sed '/^$/d' | sort -u | xargs)"
+  [ -n "$ids_to_remove" ] || return 0
+  warn "Removing Docker containers publishing fixed dev ports: $ids_to_remove"
+  # shellcheck disable=SC2086
+  docker rm -f $ids_to_remove >/dev/null
+}
+
+kill_listeners_on_ports() {
+  command -v lsof >/dev/null 2>&1 || return 0
+  local pids="" port port_pids
+  for port in "$@"; do
+    port_pids="$(lsof -nP -tiTCP:"$port" -sTCP:LISTEN 2>/dev/null || true)"
+    [ -n "$port_pids" ] && pids="$pids $port_pids"
+  done
+
+  pids="$(printf '%s\n' "$pids" | tr ' ' '\n' | sed '/^$/d' | sort -u | xargs)"
+  [ -n "$pids" ] || return 0
+  warn "Killing local processes listening on fixed dev ports: $pids"
+  # shellcheck disable=SC2086
+  kill -TERM $pids 2>/dev/null || true
+  sleep 0.5
+  # shellcheck disable=SC2086
+  kill -KILL $pids 2>/dev/null || true
+}
+
+clear_dev_port_conflicts() {
+  local ports=("$DJANGO_PORT" "$POSTGRES_PORT" "$VALKEY_PORT" "$NEO4J_PORT" "$NEO4J_HTTP_PORT")
+  log "Ensuring fixed dev ports are free: api:${DJANGO_PORT} pg:${POSTGRES_PORT} valkey:${VALKEY_PORT} neo4j:${NEO4J_PORT} neo4j-http:${NEO4J_HTTP_PORT}"
+  remove_docker_containers_on_ports "${ports[@]}"
+  kill_listeners_on_ports "${ports[@]}"
+}
+
+# Block until the API answers HTTP on DJANGO_PORT (any status code counts).
+wait_for_api() {
+  local timeout="${1:-90}" waited=0
+  log "Waiting for API on :${DJANGO_PORT} (timeout ${timeout}s)..."
+  until curl -s -o /dev/null --max-time 2 "http://localhost:${DJANGO_PORT}/"; do
+    waited=$((waited + 1))
+    if [ "$waited" -ge "$timeout" ]; then
+      warn "API not responding after ${timeout}s. Check _data/logs/api.log"
+      return 1
+    fi
+    sleep 1
+  done
+  ok "API responding on :${DJANGO_PORT}"
+}
+
+needs_db_bootstrap() {
+  ! "${COMPOSE[@]}" -f "$COMPOSE_FILE" exec -T postgres \
+      psql -U prowler -d prowler_db -c 'select 1' >/dev/null 2>&1
+}
+
+bootstrap_db_if_needed() {
+  if needs_db_bootstrap; then
+    warn "App DB user not ready. Bootstrapping (deps + migrate + fixtures)..."
+    deps
+    migrate
+    fixtures
+    ok "DB bootstrap complete"
+  fi
+}
+
+all_run() {
+  require_tmux
+  require_uv
+  services_up
+  bootstrap_db_if_needed
+
+  # Wrap a command so it auto-runs as the pane's foreground process and, on
+  # exit (e.g. Ctrl+C), drops into the user's login shell instead of closing.
+  # Avoids the `send-keys` race where keys arrive before zsh+starship are ready.
+  local user_shell="${SHELL:-/bin/zsh}"
+  pane_cmd() {
+    printf 'bash -c %q' "$1; exec ${user_shell}"
+  }
+  local api_cmd worker_cmd pg_cmd
+  api_cmd="$(pane_cmd "$SCRIPT_PATH api")"
+  worker_cmd="$(pane_cmd "$SCRIPT_PATH worker")"
+  pg_cmd="$(pane_cmd "${COMPOSE[*]} -f $COMPOSE_FILE logs -f postgres")"
+
+  # If a tmux server is already running (e.g. another project's session), new
+  # sessions inherit THAT server's env, not the launcher shell's env. Pass our
+  # overrides explicitly so each pane sees the right project name, ports, etc.
+  local -a env_args=()
+  local var
+  for var in COMPOSE_PROJECT_NAME \
+             POSTGRES_HOST POSTGRES_PORT \
+             VALKEY_HOST VALKEY_PORT VALKEY_SCHEME \
+             NEO4J_HOST NEO4J_PORT NEO4J_HTTP_PORT \
+             DJANGO_SETTINGS_MODULE DJANGO_DEBUG DJANGO_PORT \
+             DJANGO_LOGGING_FORMATTER DJANGO_LOGGING_LEVEL \
+             DJANGO_MANAGE_DB_PARTITIONS; do
+    env_args+=(-e "${var}=${!var-}")
+  done
+
+  local expected_panes=3
+
+  if tmux has-session -t "$TMUX_SESSION" 2>/dev/null; then
+    local current_panes
+    current_panes="$(tmux_pane_count)"
+    if [ "$current_panes" -lt "$expected_panes" ]; then
+      warn "Session '$TMUX_SESSION' has $current_panes pane(s), expected $expected_panes. Rebuilding it."
+      tmux kill-session -t "$TMUX_SESSION"
+    else
+      log "Session '$TMUX_SESSION' already exists"
+    fi
+  fi
+
+  if ! tmux has-session -t "$TMUX_SESSION" 2>/dev/null; then
+    log "Creating tmux session '$TMUX_SESSION' (api / worker / db logs)"
+    tmux new-session -d -s "$TMUX_SESSION" -n services -c "$REPO_ROOT" "${env_args[@]}" "$api_cmd"
+    tmux split-window -t "$TMUX_SESSION:0.0" -v -p 50 -c "$REPO_ROOT" "${env_args[@]}" "$worker_cmd"
+    tmux split-window -t "$TMUX_SESSION:0.1" -h -p 50 -c "$REPO_ROOT" "${env_args[@]}" "$pg_cmd"
+    tmux select-pane -t "$TMUX_SESSION:0.0"
+    tmux set-option -t "$TMUX_SESSION" -g mouse on >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g bell-action none >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g visual-bell off >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g monitor-bell off >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g monitor-activity off >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g visual-activity off >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g activity-action none >/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g silence-action none >/dev/null
+    tmux bind-key -T copy-mode MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "pbcopy" 2>/dev/null
+    tmux bind-key -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe-and-cancel "pbcopy" 2>/dev/null
+    tmux set-option -t "$TMUX_SESSION" -g status-right " API:${DJANGO_PORT} | DB:${POSTGRES_PORT} | Broker:${VALKEY_PORT} " >/dev/null
+
+    mkdir -p "$REPO_ROOT/_data/logs"
+    pipe_pane_log "$TMUX_SESSION:0.0" api
+    pipe_pane_log "$TMUX_SESSION:0.1" worker
+    pipe_pane_log "$TMUX_SESSION:0.2" postgres
+  fi
+
+  wait_for_api 90
+
+  ok "Dev stack ready (detached)"
+  cat <<EOF
+api_url=http://localhost:${DJANGO_PORT}/api/v1
+api_log=_data/logs/api.log
+worker_log=_data/logs/worker.log
+postgres_log=_data/logs/postgres.log
+EOF
+  cat <<EOF
+attach_cmd=make dev-attach
+stop_cmd=make dev-stop
+EOF
+}
+
+attach_run() {
+  require_tmux
+  if ! tmux has-session -t "$TMUX_SESSION" 2>/dev/null; then
+    warn "No session '$TMUX_SESSION'. Starting it with: $0 all"
+    all_run
+  else
+    local current_panes
+    current_panes="$(tmux_pane_count)"
+    if [ "$current_panes" -lt 3 ]; then
+      warn "Session '$TMUX_SESSION' only has $current_panes pane(s). Rebuilding with db logs."
+      tmux kill-session -t "$TMUX_SESSION"
+      all_run
+    fi
+  fi
+  if [ -n "${TMUX:-}" ]; then
+    tmux switch-client -t "$TMUX_SESSION"
+  else
+    tmux attach-session -t "$TMUX_SESSION"
+  fi
+}
+
+clean_run() {
+  log "Removing stopped containers from the compose project..."
+  "${COMPOSE[@]}" -f "$COMPOSE_FILE" rm -f
+  ok "Stopped containers removed (data volumes under ./_data/ untouched)"
+}
+
+wipe_run() {
+  warn "DESTRUCTIVE: this will tear down everything AND delete ./_data/"
+  warn "  postgres database, valkey state, neo4j graph, api jwt keys - all gone."
+  warn "  Next start will require 'make dev-setup' from scratch."
+  kill_run
+  if [ -d ./_data ]; then
+    log "Removing ./_data/ ..."
+    rm -rf ./_data
+  fi
+  ok "Wipe complete. Run 'make dev-setup' for a fresh environment."
+}
+
+kill_run() {
+  kill_tmux_session
+  services_down
+  clean_run
+  ok "Dev stack stopped (tmux killed, containers stopped + removed)"
+}
+
+LAUNCH_TERMINAL="${DEV_LOCAL_TERMINAL:-}"
+if [ -z "$LAUNCH_TERMINAL" ]; then
+  if [ "${TERM_PROGRAM:-}" = "WarpTerminal" ]; then
+    LAUNCH_TERMINAL="Warp"
+  elif ghostty_available; then
+    LAUNCH_TERMINAL="Ghostty"
+  elif is_macos; then
+    LAUNCH_TERMINAL="Terminal"
+  fi
+fi
+
+warp_launch_run() {
+  require_uv
+  kill_tmux_session
+  remove_repo_compose_containers
+  clear_dev_port_conflicts
+
+  log "Launching dev stack in tmux inside the current Warp pane"
+  log "  api:${DJANGO_PORT} pg:${POSTGRES_PORT} valkey:${VALKEY_PORT} neo4j:${NEO4J_PORT} neo4j-http:${NEO4J_HTTP_PORT}"
+  all_run
+  attach_run
+}
+
+launch_run() {
+  if [ "$LAUNCH_TERMINAL" = "Warp" ]; then
+    warp_launch_run
+    return
+  fi
+
+  if [ -z "$LAUNCH_TERMINAL" ]; then
+    warn "make dev-launch requires Warp or Ghostty on Linux, or Terminal/iTerm/Ghostty on macOS."
+    warn "Use 'make dev' plus 'make dev-attach', or set DEV_LOCAL_TERMINAL to a supported terminal."
+    exit 1
+  fi
+
+  if ! launch_terminal_supported; then
+    warn "$LAUNCH_TERMINAL launch is not supported on $(uname -s)."
+    warn "Use Warp or Ghostty, run 'make dev' plus 'make dev-attach', or set DEV_LOCAL_TERMINAL to a supported terminal."
+    exit 1
+  fi
+
+  kill_tmux_session
+  remove_repo_compose_containers
+  clear_dev_port_conflicts
+
+  log "Launching dev stack in a new terminal window"
+  log "  api:${DJANGO_PORT} pg:${POSTGRES_PORT} valkey:${VALKEY_PORT} neo4j:${NEO4J_PORT} neo4j-http:${NEO4J_HTTP_PORT}"
+  log "  tmux session: ${TMUX_SESSION}"
+
+  local cleanup_cmd
+  case "$LAUNCH_TERMINAL" in
+    Terminal)
+      # shellcheck disable=SC2016
+      cleanup_cmd='( sleep 1; osascript -e "tell application \"Terminal\" to close (every window whose name contains \"$WINDOW_TAG\") saving no" >/dev/null 2>&1 ) </dev/null >/dev/null 2>&1 & disown'
+      ;;
+    iTerm|iTerm2)
+      # shellcheck disable=SC2016
+      cleanup_cmd='( sleep 1; osascript -e "tell application \"iTerm\" to close (every window whose name contains \"$WINDOW_TAG\")" >/dev/null 2>&1 ) </dev/null >/dev/null 2>&1 & disown'
+      ;;
+    *)
+      cleanup_cmd=":"
+      ;;
+  esac
+
+  local wrapper
+  wrapper="$(mktemp -t dev-local-launch).sh"
+  cat > "$wrapper" <<EOF
+#!/usr/bin/env bash
+WINDOW_TAG="dev-local-\$\$"
+printf '\033]0;%s\007' "\$WINDOW_TAG"
+export HISTFILE=/dev/null HISTSIZE=0 SAVEHIST=0
+on_exit() {
+  printf '#!/usr/bin/env bash\nexit 0\n' > '$wrapper'
+  $cleanup_cmd
+}
+trap on_exit EXIT
+cd "${REPO_ROOT}"
+export DJANGO_PORT=${DJANGO_PORT}
+export POSTGRES_PORT=${POSTGRES_PORT}
+export VALKEY_PORT=${VALKEY_PORT}
+export NEO4J_PORT=${NEO4J_PORT}
+export NEO4J_HTTP_PORT=${NEO4J_HTTP_PORT}
+"$SCRIPT_PATH" all
+"$SCRIPT_PATH" attach
+EOF
+  chmod +x "$wrapper"
+
+  case "$LAUNCH_TERMINAL" in
+    Ghostty)
+      if is_macos; then
+        open -na Ghostty --args --initial-command="bash '$wrapper'" --wait-after-command=false --quit-after-last-window-closed=true
+      elif is_linux && command -v ghostty >/dev/null 2>&1; then
+        ghostty -e bash "$wrapper" >/dev/null 2>&1 &
+      else
+        warn "Ghostty is not available. Install Ghostty, use Warp, or set DEV_LOCAL_TERMINAL to a supported terminal."
+        exit 1
+      fi
+      ;;
+    iTerm|iTerm2)
+      if ! is_macos; then
+        warn "$LAUNCH_TERMINAL launch is only supported on macOS."
+        exit 1
+      fi
+      osascript -e "tell application \"iTerm\" to create window with default profile command \"bash '$wrapper'\""
+      ;;
+    Terminal)
+      if ! is_macos; then
+        warn "Terminal launch is only supported on macOS."
+        exit 1
+      fi
+      open -a Terminal "$wrapper"
+      ;;
+    *)
+      if ! is_macos; then
+        warn "$LAUNCH_TERMINAL launch is not supported on $(uname -s). Use Warp or Ghostty, or run 'make dev' plus 'make dev-attach'."
+        exit 1
+      fi
+      open -na "$LAUNCH_TERMINAL" "$wrapper"
+      ;;
+  esac
+  ok "Launched in $LAUNCH_TERMINAL (override with DEV_LOCAL_TERMINAL)"
+}
+
+setup() {
+  services_up
+  deps
+  migrate
+  fixtures
+  ok "Setup complete."
+  cat <<EOF
+
+Next run everything in one window:
+  make dev                    # api + worker in tmux
+
+API will be available at http://localhost:${DJANGO_PORT}/api/v1/
+EOF
+}
+
+usage() {
+  cat <<EOF
+Usage: $0 <command>
+
+One-window dev (tmux inside the terminal):
+  all        api + worker + postgres logs in 3 panes (detached,
+             blocks until API responds,
+             ends with parseable api_url= / *_log= / attach_cmd= / stop_cmd= lines)
+  attach     Reattach to the existing dev session
+             Attaches tmux inside the current terminal pane; it does not create
+             native Warp panes.
+             Pane output is also written to _data/logs/{api,worker,postgres}.log
+             (ANSI-stripped, truncated per run) - usable without attaching
+  kill       Stop tmux + stop containers + remove them (full teardown)
+  launch     Use fixed ports, clear conflicts, then spawn the stack
+             - From Warp: runs 'all' and attaches tmux in the current pane
+             - Otherwise: opens a supported terminal running 'all' under tmux
+             (override with DEV_LOCAL_TERMINAL=<App>, e.g. Ghostty/iTerm/Terminal)
+
+Platform support:
+  macOS      Supported for make dev, attach, and launch
+  Linux      make dev and attach should work; launch is supported from Warp or Ghostty
+  Windows    Requires script changes before it can be supported
+
+State (containers postgres + valkey + neo4j):
+  up         Start postgres + valkey + neo4j (waits for healthchecks)
+  down       Stop tmux + postgres + valkey + neo4j (keeps containers around)
+  status     Show container status
+  clean      Remove all stopped containers in the project (data volumes preserved)
+  wipe       Full nuke: kill + clean + delete ./_data/
+
+Python (native, foreground - usually launched via 'all'):
+  api        Run Django API (runserver)
+  worker     Run Celery worker
+  beat       Run Celery beat scheduler
+
+One-shots:
+  setup      up + deps + migrate + fixtures (first-time / fresh DB)
+  deps       uv sync inside api/
+  migrate    Apply migrations to admin DB
+  fixtures   Load dev fixtures
+
+Typical flow:
+  make dev-setup              # first time only
+  make dev                    # daily dev
+  make dev-stop               # when done
+EOF
+}
+
+case "${1:-help}" in
+  all)       shift; if [ "$#" -gt 0 ]; then warn "'all $*' is not supported. Use: $0 all"; exit 1; fi; all_run ;;
+  attach)    attach_run ;;
+  kill)      kill_run ;;
+  launch)    launch_run ;;
+  clean)     clean_run ;;
+  wipe)      wipe_run ;;
+  up)        services_up ;;
+  down)      services_down ;;
+  status)    services_status ;;
+  api)       api_run ;;
+  worker)    worker_run ;;
+  beat)      beat_run ;;
+  setup)     setup ;;
+  deps)      deps ;;
+  migrate)   migrate ;;
+  fixtures)  fixtures ;;
+  help|-h|--help|*) usage ;;
+esac

From 19629e9bb802740faefd94b61c9317cb9fcef53c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Pe=C3=B1a?= <adrianjpr@gmail.com>
Date: Thu, 18 Jun 2026 16:51:02 +0200
Subject: [PATCH 092/126] fix: simplify local dev launch workflow (#11641)

---
 api/README.md                         |   2 +-
 docs/developer-guide/introduction.mdx |   2 +-
 scripts/development/dev-local.sh      | 163 ++------------------------
 3 files changed, 12 insertions(+), 155 deletions(-)

diff --git a/api/README.md b/api/README.md
index 8efe42c627..c510479ab2 100644
--- a/api/README.md
+++ b/api/README.md
@@ -204,7 +204,7 @@ PostgreSQL, Valkey, and Neo4j run with Docker Compose, while Django and the Cele
 
 Before using this method, ensure `docker compose`, `tmux`, and `uv` are installed.
 
-This workflow is designed for macOS. On Linux, `make dev` and `make dev-attach` should work when Docker, `tmux`, and `uv` are available, and `make dev-launch` is supported from Warp or Ghostty. Windows requires script changes before it can be supported.
+This workflow is designed for macOS and should also work on Linux when Docker, `tmux`, and `uv` are available. Windows requires script changes before it can be supported.
 
 From the repository root, run:
 
diff --git a/docs/developer-guide/introduction.mdx b/docs/developer-guide/introduction.mdx
index 0fae9e8ccc..1d434912ef 100644
--- a/docs/developer-guide/introduction.mdx
+++ b/docs/developer-guide/introduction.mdx
@@ -114,7 +114,7 @@ For API development, Prowler provides a Makefile-based local stack in addition t
 
 Before using this method, ensure `docker compose`, `tmux`, and `uv` are installed.
 
-This workflow is designed for macOS. On Linux, `make dev` and `make dev-attach` should work when Docker, `tmux`, and `uv` are available, and `make dev-launch` is supported from Warp or Ghostty. Windows requires script changes before it can be supported.
+This workflow is designed for macOS and should also work on Linux when Docker, `tmux`, and `uv` are available. Windows requires script changes before it can be supported.
 
 To start the local API stack, run:
 
diff --git a/scripts/development/dev-local.sh b/scripts/development/dev-local.sh
index a044821485..d193b81532 100755
--- a/scripts/development/dev-local.sh
+++ b/scripts/development/dev-local.sh
@@ -20,9 +20,7 @@
 # Every pane is teed ANSI-stripped to _data/logs/{api,worker,postgres}.log
 # (truncated per run), so logs are readable with tail -f, no tmux needed.
 #
-# 'attach' does not create Warp panes. It attaches to tmux inside the current
-# terminal pane. If you want native Warp panes, use 'make dev-launch'
-# from Warp instead.
+# 'attach' attaches to tmux inside the current terminal pane.
 #
 # Inside the tmux session "prowler-dev-<compose-project>" the prefix key is Ctrl+b. After it:
 #   d              detach (everything keeps running; reattach: make dev-attach)
@@ -98,32 +96,6 @@ log()  { printf '\033[1;34m→\033[0m %s\n' "$*"; }
 ok()   { printf '\033[1;32m✓\033[0m %s\n' "$*"; }
 warn() { printf '\033[1;33m!\033[0m %s\n' "$*"; }
 
-is_macos() {
-  [ "$(uname -s)" = "Darwin" ]
-}
-
-is_linux() {
-  [ "$(uname -s)" = "Linux" ]
-}
-
-ghostty_available() {
-  command -v ghostty >/dev/null 2>&1 || [ -d /Applications/Ghostty.app ]
-}
-
-launch_terminal_supported() {
-  case "$LAUNCH_TERMINAL" in
-    Ghostty)
-      ghostty_available
-      ;;
-    Terminal|iTerm|iTerm2)
-      is_macos
-      ;;
-    *)
-      is_macos && open -Ra "$LAUNCH_TERMINAL" >/dev/null 2>&1
-      ;;
-  esac
-}
-
 require_uv() {
   if ! command -v uv >/dev/null 2>&1; then
     warn "uv not found in PATH. Install: https://docs.astral.sh/uv/getting-started/installation/"
@@ -160,9 +132,9 @@ pipe_pane_log() {
   tmux pipe-pane -t "$pane" -o "perl -pe 'BEGIN{\$|=1} s/\\e\\[[0-9;?]*[A-Za-z]//g' >> '$logfile'"
 }
 
-# Stop native dev processes (api/worker/beat) launched outside tmux, e.g. inside
-# Warp panes. Scoped by cwd under REPO_ROOT so other prowler clones running their
-# own stacks are not touched.
+# Stop native dev processes (api/worker/beat) launched outside tmux. Scoped by
+# cwd under REPO_ROOT so other prowler clones running their own stacks are not
+# touched.
 kill_native_procs() {
   command -v pgrep >/dev/null 2>&1 || return 0
   command -v lsof  >/dev/null 2>&1 || return 0
@@ -493,129 +465,18 @@ kill_run() {
   ok "Dev stack stopped (tmux killed, containers stopped + removed)"
 }
 
-LAUNCH_TERMINAL="${DEV_LOCAL_TERMINAL:-}"
-if [ -z "$LAUNCH_TERMINAL" ]; then
-  if [ "${TERM_PROGRAM:-}" = "WarpTerminal" ]; then
-    LAUNCH_TERMINAL="Warp"
-  elif ghostty_available; then
-    LAUNCH_TERMINAL="Ghostty"
-  elif is_macos; then
-    LAUNCH_TERMINAL="Terminal"
-  fi
-fi
-
-warp_launch_run() {
+launch_run() {
   require_uv
   kill_tmux_session
   remove_repo_compose_containers
   clear_dev_port_conflicts
 
-  log "Launching dev stack in tmux inside the current Warp pane"
+  log "Launching dev stack in tmux inside the current terminal"
   log "  api:${DJANGO_PORT} pg:${POSTGRES_PORT} valkey:${VALKEY_PORT} neo4j:${NEO4J_PORT} neo4j-http:${NEO4J_HTTP_PORT}"
   all_run
   attach_run
 }
 
-launch_run() {
-  if [ "$LAUNCH_TERMINAL" = "Warp" ]; then
-    warp_launch_run
-    return
-  fi
-
-  if [ -z "$LAUNCH_TERMINAL" ]; then
-    warn "make dev-launch requires Warp or Ghostty on Linux, or Terminal/iTerm/Ghostty on macOS."
-    warn "Use 'make dev' plus 'make dev-attach', or set DEV_LOCAL_TERMINAL to a supported terminal."
-    exit 1
-  fi
-
-  if ! launch_terminal_supported; then
-    warn "$LAUNCH_TERMINAL launch is not supported on $(uname -s)."
-    warn "Use Warp or Ghostty, run 'make dev' plus 'make dev-attach', or set DEV_LOCAL_TERMINAL to a supported terminal."
-    exit 1
-  fi
-
-  kill_tmux_session
-  remove_repo_compose_containers
-  clear_dev_port_conflicts
-
-  log "Launching dev stack in a new terminal window"
-  log "  api:${DJANGO_PORT} pg:${POSTGRES_PORT} valkey:${VALKEY_PORT} neo4j:${NEO4J_PORT} neo4j-http:${NEO4J_HTTP_PORT}"
-  log "  tmux session: ${TMUX_SESSION}"
-
-  local cleanup_cmd
-  case "$LAUNCH_TERMINAL" in
-    Terminal)
-      # shellcheck disable=SC2016
-      cleanup_cmd='( sleep 1; osascript -e "tell application \"Terminal\" to close (every window whose name contains \"$WINDOW_TAG\") saving no" >/dev/null 2>&1 ) </dev/null >/dev/null 2>&1 & disown'
-      ;;
-    iTerm|iTerm2)
-      # shellcheck disable=SC2016
-      cleanup_cmd='( sleep 1; osascript -e "tell application \"iTerm\" to close (every window whose name contains \"$WINDOW_TAG\")" >/dev/null 2>&1 ) </dev/null >/dev/null 2>&1 & disown'
-      ;;
-    *)
-      cleanup_cmd=":"
-      ;;
-  esac
-
-  local wrapper
-  wrapper="$(mktemp -t dev-local-launch).sh"
-  cat > "$wrapper" <<EOF
-#!/usr/bin/env bash
-WINDOW_TAG="dev-local-\$\$"
-printf '\033]0;%s\007' "\$WINDOW_TAG"
-export HISTFILE=/dev/null HISTSIZE=0 SAVEHIST=0
-on_exit() {
-  printf '#!/usr/bin/env bash\nexit 0\n' > '$wrapper'
-  $cleanup_cmd
-}
-trap on_exit EXIT
-cd "${REPO_ROOT}"
-export DJANGO_PORT=${DJANGO_PORT}
-export POSTGRES_PORT=${POSTGRES_PORT}
-export VALKEY_PORT=${VALKEY_PORT}
-export NEO4J_PORT=${NEO4J_PORT}
-export NEO4J_HTTP_PORT=${NEO4J_HTTP_PORT}
-"$SCRIPT_PATH" all
-"$SCRIPT_PATH" attach
-EOF
-  chmod +x "$wrapper"
-
-  case "$LAUNCH_TERMINAL" in
-    Ghostty)
-      if is_macos; then
-        open -na Ghostty --args --initial-command="bash '$wrapper'" --wait-after-command=false --quit-after-last-window-closed=true
-      elif is_linux && command -v ghostty >/dev/null 2>&1; then
-        ghostty -e bash "$wrapper" >/dev/null 2>&1 &
-      else
-        warn "Ghostty is not available. Install Ghostty, use Warp, or set DEV_LOCAL_TERMINAL to a supported terminal."
-        exit 1
-      fi
-      ;;
-    iTerm|iTerm2)
-      if ! is_macos; then
-        warn "$LAUNCH_TERMINAL launch is only supported on macOS."
-        exit 1
-      fi
-      osascript -e "tell application \"iTerm\" to create window with default profile command \"bash '$wrapper'\""
-      ;;
-    Terminal)
-      if ! is_macos; then
-        warn "Terminal launch is only supported on macOS."
-        exit 1
-      fi
-      open -a Terminal "$wrapper"
-      ;;
-    *)
-      if ! is_macos; then
-        warn "$LAUNCH_TERMINAL launch is not supported on $(uname -s). Use Warp or Ghostty, or run 'make dev' plus 'make dev-attach'."
-        exit 1
-      fi
-      open -na "$LAUNCH_TERMINAL" "$wrapper"
-      ;;
-  esac
-  ok "Launched in $LAUNCH_TERMINAL (override with DEV_LOCAL_TERMINAL)"
-}
-
 setup() {
   services_up
   deps
@@ -640,19 +501,15 @@ One-window dev (tmux inside the terminal):
              blocks until API responds,
              ends with parseable api_url= / *_log= / attach_cmd= / stop_cmd= lines)
   attach     Reattach to the existing dev session
-             Attaches tmux inside the current terminal pane; it does not create
-             native Warp panes.
+             Attaches tmux inside the current terminal pane.
              Pane output is also written to _data/logs/{api,worker,postgres}.log
              (ANSI-stripped, truncated per run) - usable without attaching
   kill       Stop tmux + stop containers + remove them (full teardown)
-  launch     Use fixed ports, clear conflicts, then spawn the stack
-             - From Warp: runs 'all' and attaches tmux in the current pane
-             - Otherwise: opens a supported terminal running 'all' under tmux
-             (override with DEV_LOCAL_TERMINAL=<App>, e.g. Ghostty/iTerm/Terminal)
+  launch     Use fixed ports, clear conflicts, then run 'all' and attach tmux
 
 Platform support:
-  macOS      Supported for make dev, attach, and launch
-  Linux      make dev and attach should work; launch is supported from Warp or Ghostty
+  macOS      Supported
+  Linux      Should work when Docker, tmux, and uv are available
   Windows    Requires script changes before it can be supported
 
 State (containers postgres + valkey + neo4j):

From 99285d46569c458a876b6380bb60ded0530aa9c7 Mon Sep 17 00:00:00 2001
From: Josema Camacho <josema@prowler.com>
Date: Thu, 18 Jun 2026 17:42:19 +0200
Subject: [PATCH 093/126] fix(api): close DB connections per request to stop
 ASGI replica connection leak (#11640)

---
 api/CHANGELOG.md                      |  4 ++++
 api/src/backend/api/middleware.py     | 26 ++++++++++++++++++++++++++
 api/src/backend/config/django/base.py |  1 +
 3 files changed, 31 insertions(+)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index db5cc69b03..8e2130fb88 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -15,6 +15,10 @@ All notable changes to the **Prowler API** are documented in this file.
 - Gunicorn worker timeout raised from the 30s default to 120s, so long-running requests are no longer killed prematurely [(#11631)](https://github.com/prowler-cloud/prowler/pull/11631)
 - Sentry now drops ASGI's `RequestAborted` errors from health-check probe disconnects on `/health/live` [(#11632)](https://github.com/prowler-cloud/prowler/pull/11632)
 
+### 🐞 Fixed
+
+- Database connections no longer leak under the ASGI worker, which previously exhausted the read replica's connection slots and caused 500s on read endpoints [(#11640)](https://github.com/prowler-cloud/prowler/pull/11640)
+
 ### 🔐 Security
 
 - `aiohttp` to 3.14.0 and `idna` to 3.15, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
diff --git a/api/src/backend/api/middleware.py b/api/src/backend/api/middleware.py
index 63f2fc630b..2b0a2340c4 100644
--- a/api/src/backend/api/middleware.py
+++ b/api/src/backend/api/middleware.py
@@ -1,9 +1,35 @@
 import logging
 import time
 
+from django.core.handlers.asgi import ASGIRequest
+from django.db import connections
+
 from config.custom_logging import BackendLogger
 
 
+class CloseDBConnectionsMiddleware:
+    """
+    Close request-scoped DB connections at the end of each ASGI request.
+
+    Under the ASGI worker, connections opened by sync views are not released
+    by Django's normal request-boundary cleanup, so they accumulate idle until
+    Postgres runs out of slots. Only ASGI requests are handled; the sync WSGI
+    test client manages its own connections and must be left alone.
+    """
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        try:
+            return self.get_response(request)
+        finally:
+            if isinstance(request, ASGIRequest):
+                for conn in connections.all(initialized_only=True):
+                    if not conn.in_atomic_block:
+                        conn.close_if_unusable_or_obsolete()
+
+
 def extract_auth_info(request) -> dict:
     if getattr(request, "auth", None) is not None:
         tenant_id = request.auth.get("tenant_id", "N/A")
diff --git a/api/src/backend/config/django/base.py b/api/src/backend/config/django/base.py
index 3308561b48..31a9537b5f 100644
--- a/api/src/backend/config/django/base.py
+++ b/api/src/backend/config/django/base.py
@@ -49,6 +49,7 @@ INSTALLED_APPS = [
 ]
 
 MIDDLEWARE = [
+    "api.middleware.CloseDBConnectionsMiddleware",
     "django_guid.middleware.guid_middleware",
     "django.middleware.security.SecurityMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",

From d961d7efe4de1a3a8b671eddf53d0b5e1ba9f5c9 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Fri, 19 Jun 2026 16:00:46 +0900
Subject: [PATCH 094/126] feat(azure): add
 mysql_flexible_server_high_availability_enabled check (#11042)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   3 +-
 .../__init__.py                               |   0
 ...er_high_availability_enabled.metadata.json |  37 ++++
 ...exible_server_high_availability_enabled.py |  34 ++++
 .../azure/services/mysql/mysql_service.py     |   3 +
 ...e_server_high_availability_enabled_test.py | 166 ++++++++++++++++++
 7 files changed, 243 insertions(+), 1 deletion(-)
 create mode 100644 prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.py
 create mode 100644 tests/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 196d2a467e..c9bfa7a1c7 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -21,6 +21,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `databricks_workspace_no_public_ip_enabled` check for Azure provider, verifying Databricks workspaces use secure cluster connectivity (no public IP) so compute nodes are not assigned public IP addresses [(#11036)](https://github.com/prowler-cloud/prowler/pull/11036)
 - `defender_ensure_defender_cspm_is_on` check for Azure provider, verifying Microsoft Defender Cloud Security Posture Management (CSPM) is enabled on the Standard tier [(#11037)](https://github.com/prowler-cloud/prowler/pull/11037)
 - `mysql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying MySQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11041)](https://github.com/prowler-cloud/prowler/pull/11041)
+- `mysql_flexible_server_high_availability_enabled` check for Azure provider, verifying MySQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11042)](https://github.com/prowler-cloud/prowler/pull/11042)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 6f686d24f0..ee0e4ca89b 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1298,7 +1298,8 @@
         "vm_ensure_using_managed_disks",
         "vm_trusted_launch_enabled",
         "cosmosdb_account_automatic_failover_enabled",
-        "mysql_flexible_server_geo_redundant_backup_enabled"
+        "mysql_flexible_server_geo_redundant_backup_enabled",
+        "mysql_flexible_server_high_availability_enabled"
       ]
     },
     {
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/__init__.py b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.metadata.json b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.metadata.json
new file mode 100644
index 0000000000..22a9b93401
--- /dev/null
+++ b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "mysql_flexible_server_high_availability_enabled",
+  "CheckTitle": "MySQL flexible server has high availability enabled",
+  "CheckType": [],
+  "ServiceName": "mysql",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.dbformysql/flexibleservers",
+  "ResourceGroup": "database",
+  "Description": "**Azure MySQL Flexible Server** is evaluated for **high availability** mode. Zone-redundant or same-zone HA provisions a standby replica and provides automatic failover during planned and unplanned outages.",
+  "Risk": "Without **high availability**, a server or zone failure causes **downtime** until manual recovery or redeployment. Applications experience extended unavailability and potential data loss for in-flight transactions during unplanned outages.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/mysql/flexible-server/concepts-high-availability",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.dbformysql/flexibleservers"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az mysql flexible-server update --name <server_name> --resource-group <resource_group_name> --high-availability ZoneRedundant",
+      "NativeIaC": "```bicep\n// Bicep: MySQL Flexible Server with zone-redundant high availability\nresource mysql 'Microsoft.DBforMySQL/flexibleServers@2023-12-30' = {\n  name: '<example_resource_name>'\n  location: '<region>'\n  sku: {\n    name: 'Standard_D2ds_v4'\n    tier: 'GeneralPurpose'\n  }\n  properties: {\n    highAvailability: {\n      mode: 'ZoneRedundant' // CRITICAL: provisions a standby replica with automatic failover\n    }\n  }\n}\n```",
+      "Other": "1. In the Azure portal, open your Azure Database for MySQL flexible server\n2. Under Settings, select High availability\n3. Enable High availability and choose Zone redundant (or Same zone)\n4. Save (high availability requires the General Purpose or Business Critical tier)",
+      "Terraform": "```hcl\n# Terraform: MySQL Flexible Server with zone-redundant high availability\nresource \"azurerm_mysql_flexible_server\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<region>\"\n  sku_name            = \"GP_Standard_D2ds_v4\"\n\n  high_availability {\n    mode = \"ZoneRedundant\" # CRITICAL: provisions a standby replica with automatic failover\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **high availability** (zone-redundant where supported, otherwise same-zone) on production MySQL Flexible Servers so a standby replica provides automatic failover. High availability requires the General Purpose or Business Critical tier; pair it with geo-redundant backup and periodic failover testing for full resilience.",
+      "Url": "https://hub.prowler.com/check/mysql_flexible_server_high_availability_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "High availability for Azure MySQL Flexible Server requires the General Purpose or Business Critical compute tier and is not available on the Burstable tier."
+}
diff --git a/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.py b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.py
new file mode 100644
index 0000000000..e1f3054baf
--- /dev/null
+++ b/prowler/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled.py
@@ -0,0 +1,34 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.mysql.mysql_client import mysql_client
+
+
+class mysql_flexible_server_high_availability_enabled(Check):
+    """
+    Ensure Azure MySQL Flexible Servers have high availability enabled.
+
+    This check evaluates whether each Azure MySQL Flexible Server is configured with high availability (zone-redundant or same-zone), providing automatic failover to a standby replica during outages.
+
+    - PASS: The server has high availability enabled (high_availability_mode is set and not "Disabled").
+    - FAIL: The server does not have high availability enabled.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for subscription_id, servers in mysql_client.flexible_servers.items():
+            subscription_name = mysql_client.subscriptions.get(
+                subscription_id, subscription_id
+            )
+            for server in servers.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
+                report.subscription = subscription_id
+                if (
+                    server.high_availability_mode is not None
+                    and server.high_availability_mode != "Disabled"
+                ):
+                    report.status = "PASS"
+                    report.status_extended = f"High availability is enabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"High availability is disabled for server {server.name} in subscription {subscription_name} ({subscription_id})."
+                findings.append(report)
+        return findings
diff --git a/prowler/providers/azure/services/mysql/mysql_service.py b/prowler/providers/azure/services/mysql/mysql_service.py
index c626661f98..b3a386a193 100644
--- a/prowler/providers/azure/services/mysql/mysql_service.py
+++ b/prowler/providers/azure/services/mysql/mysql_service.py
@@ -23,6 +23,7 @@ class MySQL(AzureService):
                 servers.update({subscription_id: {}})
                 for server in servers_list:
                     backup = getattr(server, "backup", None)
+                    ha = getattr(server, "high_availability", None)
                     servers[subscription_id].update(
                         {
                             server.id: FlexibleServer(
@@ -36,6 +37,7 @@ class MySQL(AzureService):
                                 geo_redundant_backup=getattr(
                                     backup, "geo_redundant_backup", None
                                 ),
+                                high_availability_mode=getattr(ha, "mode", None),
                             )
                         }
                     )
@@ -84,3 +86,4 @@ class FlexibleServer:
     version: str
     configurations: dict[Configuration]
     geo_redundant_backup: Optional[str] = None
+    high_availability_mode: Optional[str] = None
diff --git a/tests/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled_test.py b/tests/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled_test.py
new file mode 100644
index 0000000000..c1084ec47b
--- /dev/null
+++ b/tests/providers/azure/services/mysql/mysql_flexible_server_high_availability_enabled/mysql_flexible_server_high_availability_enabled_test.py
@@ -0,0 +1,166 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.mysql.mysql_service import FlexibleServer
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+class Test_mysql_flexible_server_high_availability_enabled:
+    def test_mysql_no_subscriptions(self):
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_mysql_high_availability_disabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    high_availability_mode="Disabled",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"High availability is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
+
+    def test_mysql_high_availability_not_set(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    high_availability_mode=None,
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"High availability is disabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+
+    def test_mysql_high_availability_enabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        mysql_client = mock.MagicMock
+        mysql_client.subscriptions = {AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME}
+        mysql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: {
+                server_id: FlexibleServer(
+                    resource_id=server_id,
+                    name=server_name,
+                    location="eastus",
+                    version="8.0",
+                    configurations={},
+                    high_availability_mode="ZoneRedundant",
+                )
+            }
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled.mysql_client",
+                new=mysql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.mysql.mysql_flexible_server_high_availability_enabled.mysql_flexible_server_high_availability_enabled import (
+                mysql_flexible_server_high_availability_enabled,
+            )
+
+            check = mysql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"High availability is enabled for server {server_name} in subscription {AZURE_SUBSCRIPTION_DISPLAY}."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"

From 151dcd28954ea606196244ca2680d2abf2fcea20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Fri, 19 Jun 2026 09:07:54 +0200
Subject: [PATCH 095/126] feat(compliance): add DORA compliance framework for
 GCP (#11642)

---
 prowler/CHANGELOG.md                   |   2 +
 prowler/compliance/dora_2022_2554.json | 220 +++++++++++++++++++++++++
 2 files changed, 222 insertions(+)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index c9bfa7a1c7..197a7f961d 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -31,6 +31,8 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `entra_directory_sync_object_takeover_blocked` check for the M365 provider, verifying that hybrid Entra tenants block cloud object takeover through both soft-match and hard-match directory synchronization [(#11098)](https://github.com/prowler-cloud/prowler/pull/11098)
 - `entra_conditional_access_policy_no_deleted_object_references` check for M365 provider [(#11236)](https://github.com/prowler-cloud/prowler/pull/11236)
 - `aks_cluster_defender_enabled` check for Azure provider, verifying that AKS clusters have Microsoft Defender security monitoring enabled [(#11028)](https://github.com/prowler-cloud/prowler/pull/11028)
+- DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the GCP provider, mapping existing GCP checks across the five DORA pillars [(#11642)](https://github.com/prowler-cloud/prowler/pull/11642)
+
 
 ### 🔄 Changed
 
diff --git a/prowler/compliance/dora_2022_2554.json b/prowler/compliance/dora_2022_2554.json
index 1bc4ed41da..4a1db41beb 100644
--- a/prowler/compliance/dora_2022_2554.json
+++ b/prowler/compliance/dora_2022_2554.json
@@ -130,6 +130,20 @@
           "iam_subscription_roles_owner_custom_not_created",
           "iam_role_user_access_admin_restricted",
           "iam_custom_role_has_permissions_to_administer_resource_locks"
+        ],
+        "gcp": [
+          "compute_project_os_login_enabled",
+          "compute_project_os_login_2fa_enabled",
+          "iam_no_service_roles_at_project_level",
+          "iam_sa_no_administrative_privileges",
+          "iam_role_kms_enforce_separation_of_duties",
+          "iam_role_sa_enforce_separation_of_duties",
+          "iam_organization_essential_contacts_configured",
+          "iam_account_access_approval_enabled",
+          "iam_service_account_unused",
+          "compute_instance_default_service_account_in_use",
+          "compute_instance_default_service_account_in_use_with_full_api_access",
+          "gke_cluster_no_default_service_account"
         ]
       }
     },
@@ -170,6 +184,14 @@
           "defender_ensure_wdatp_is_enabled",
           "defender_auto_provisioning_log_analytics_agent_vms_on",
           "policy_ensure_asc_enforcement_enabled"
+        ],
+        "gcp": [
+          "iam_cloud_asset_inventory_enabled",
+          "iam_audit_logs_enabled",
+          "logging_sink_created",
+          "gcr_container_scanning_enabled",
+          "artifacts_container_analysis_enabled",
+          "iam_organization_essential_contacts_configured"
         ]
       }
     },
@@ -217,6 +239,22 @@
           "keyvault_key_rotation_enabled",
           "storage_key_rotation_90_days",
           "aks_network_policy_enabled"
+        ],
+        "gcp": [
+          "cloudsql_instance_ssl_connections",
+          "compute_instance_encryption_with_csek_enabled",
+          "compute_instance_confidential_computing_enabled",
+          "bigquery_dataset_cmk_encryption",
+          "bigquery_table_cmk_encryption",
+          "dataproc_encrypted_with_cmks_disabled",
+          "kms_key_rotation_enabled",
+          "kms_key_rotation_max_90_days",
+          "dns_dnssec_disabled",
+          "dns_rsasha1_in_use_to_key_sign_in_dnssec",
+          "dns_rsasha1_in_use_to_zone_sign_in_dnssec",
+          "compute_network_not_legacy",
+          "compute_network_default_in_use",
+          "compute_instance_single_network_interface"
         ]
       }
     },
@@ -245,6 +283,14 @@
           "network_watcher_enabled",
           "network_public_ip_shodan",
           "vm_scaleset_not_empty"
+        ],
+        "gcp": [
+          "iam_cloud_asset_inventory_enabled",
+          "iam_service_account_unused",
+          "iam_sa_user_managed_key_unused",
+          "apikeys_key_exists",
+          "compute_instance_suspended_without_persistent_disks",
+          "compute_public_address_shodan"
         ]
       }
     },
@@ -329,6 +375,45 @@
           "network_http_internet_access_restricted",
           "network_udp_internet_access_restricted",
           "network_bastion_host_exists"
+        ],
+        "gcp": [
+          "kms_key_not_publicly_accessible",
+          "bigquery_dataset_public_access",
+          "bigquery_dataset_cmk_encryption",
+          "bigquery_table_cmk_encryption",
+          "cloudstorage_bucket_public_access",
+          "cloudstorage_bucket_uniform_bucket_level_access",
+          "cloudstorage_uses_vpc_service_controls",
+          "cloudsql_instance_public_access",
+          "cloudsql_instance_public_ip",
+          "cloudsql_instance_private_ip_assignment",
+          "cloudsql_instance_ssl_connections",
+          "cloudsql_instance_cmek_encryption_enabled",
+          "compute_firewall_ssh_access_from_the_internet_allowed",
+          "compute_firewall_rdp_access_from_the_internet_allowed",
+          "compute_instance_public_ip",
+          "compute_instance_shielded_vm_enabled",
+          "compute_instance_confidential_computing_enabled",
+          "compute_instance_serial_ports_in_use",
+          "compute_instance_block_project_wide_ssh_keys_disabled",
+          "compute_instance_ip_forwarding_is_enabled",
+          "compute_instance_encryption_with_csek_enabled",
+          "compute_image_not_publicly_shared",
+          "dataproc_encrypted_with_cmks_disabled",
+          "kms_key_rotation_enabled",
+          "gke_cluster_no_default_service_account",
+          "cloudfunction_function_inside_vpc",
+          "apikeys_api_restrictions_configured",
+          "apikeys_api_restricted_with_gemini_api",
+          "cloudsql_instance_mysql_local_infile_flag",
+          "cloudsql_instance_mysql_skip_show_database_flag",
+          "cloudsql_instance_sqlserver_contained_database_authentication_flag",
+          "cloudsql_instance_sqlserver_cross_db_ownership_chaining_flag",
+          "cloudsql_instance_sqlserver_external_scripts_enabled_flag",
+          "cloudsql_instance_sqlserver_remote_access_flag",
+          "cloudsql_instance_sqlserver_trace_flag",
+          "cloudsql_instance_sqlserver_user_connections_flag",
+          "cloudsql_instance_sqlserver_user_options_flag"
         ]
       }
     },
@@ -375,6 +460,16 @@
           "defender_container_images_resolved_vulnerabilities",
           "sqlserver_microsoft_defender_enabled",
           "apim_threat_detection_llm_jacking"
+        ],
+        "gcp": [
+          "compute_public_address_shodan",
+          "gcr_container_scanning_enabled",
+          "artifacts_container_analysis_enabled",
+          "compute_subnet_flow_logs_enabled",
+          "compute_network_dns_logging_enabled",
+          "cloudstorage_bucket_logging_enabled",
+          "compute_loadbalancer_logging_enabled",
+          "logging_sink_created"
         ]
       }
     },
@@ -408,6 +503,16 @@
           "defender_attack_path_notifications_properly_configured",
           "vm_backup_enabled",
           "vm_sufficient_daily_backup_retention_period"
+        ],
+        "gcp": [
+          "compute_instance_automatic_restart_enabled",
+          "compute_instance_group_autohealing_enabled",
+          "compute_instance_on_host_maintenance_migrate",
+          "cloudsql_instance_high_availability_enabled",
+          "cloudsql_instance_automated_backups",
+          "compute_instance_deletion_protection_enabled",
+          "compute_instance_group_load_balancer_attached",
+          "compute_instance_preemptible_vm_disabled"
         ]
       }
     },
@@ -459,6 +564,19 @@
           "storage_blob_versioning_is_enabled",
           "storage_geo_redundant_enabled",
           "keyvault_recoverable"
+        ],
+        "gcp": [
+          "cloudsql_instance_automated_backups",
+          "cloudsql_instance_high_availability_enabled",
+          "cloudstorage_bucket_versioning_enabled",
+          "cloudstorage_bucket_soft_delete_enabled",
+          "cloudstorage_bucket_lifecycle_management_enabled",
+          "cloudstorage_bucket_sufficient_retention_period",
+          "compute_instance_group_multiple_zones",
+          "compute_instance_disk_auto_delete_disabled",
+          "compute_instance_deletion_protection_enabled",
+          "compute_snapshot_not_outdated",
+          "compute_instance_suspended_without_persistent_disks"
         ]
       }
     },
@@ -488,6 +606,12 @@
           "sqlserver_vulnerability_assessment_enabled",
           "sqlserver_va_periodic_recurring_scans_enabled",
           "sqlserver_va_scan_reports_configured"
+        ],
+        "gcp": [
+          "gcr_container_scanning_enabled",
+          "artifacts_container_analysis_enabled",
+          "iam_cloud_asset_inventory_enabled",
+          "logging_sink_created"
         ]
       }
     },
@@ -517,6 +641,12 @@
           "defender_ensure_notify_alerts_severity_is_high",
           "defender_attack_path_notifications_properly_configured",
           "monitor_alert_service_health_exists"
+        ],
+        "gcp": [
+          "iam_organization_essential_contacts_configured",
+          "logging_sink_created",
+          "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
+          "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled"
         ]
       }
     },
@@ -573,6 +703,25 @@
           "app_http_logs_enabled",
           "app_function_application_insights_enabled",
           "appinsights_ensure_is_configured"
+        ],
+        "gcp": [
+          "iam_audit_logs_enabled",
+          "cloudstorage_audit_logs_enabled",
+          "logging_sink_created",
+          "cloudstorage_bucket_logging_enabled",
+          "cloudstorage_bucket_log_retention_policy_lock",
+          "cloudstorage_bucket_sufficient_retention_period",
+          "compute_subnet_flow_logs_enabled",
+          "compute_network_dns_logging_enabled",
+          "compute_loadbalancer_logging_enabled",
+          "cloudsql_instance_postgres_enable_pgaudit_flag",
+          "cloudsql_instance_postgres_log_connections_flag",
+          "cloudsql_instance_postgres_log_disconnections_flag",
+          "cloudsql_instance_postgres_log_statement_flag",
+          "cloudsql_instance_postgres_log_min_messages_flag",
+          "cloudsql_instance_postgres_log_error_verbosity_flag",
+          "cloudsql_instance_postgres_log_min_error_statement_flag",
+          "cloudsql_instance_postgres_log_min_duration_statement_flag"
         ]
       }
     },
@@ -605,6 +754,13 @@
           "defender_ensure_mcas_is_enabled",
           "sqlserver_microsoft_defender_enabled",
           "apim_threat_detection_llm_jacking"
+        ],
+        "gcp": [
+          "gcr_container_scanning_enabled",
+          "artifacts_container_analysis_enabled",
+          "compute_public_address_shodan",
+          "iam_cloud_asset_inventory_enabled",
+          "iam_audit_logs_enabled"
         ]
       }
     },
@@ -649,6 +805,19 @@
           "monitor_alert_delete_public_ip_address_rule",
           "monitor_alert_service_health_exists",
           "defender_additional_email_configured_with_a_security_contact"
+        ],
+        "gcp": [
+          "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled",
+          "logging_log_metric_filter_and_alert_for_bucket_permission_changes_enabled",
+          "logging_log_metric_filter_and_alert_for_compute_configuration_changes_enabled",
+          "logging_log_metric_filter_and_alert_for_custom_role_changes_enabled",
+          "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
+          "logging_log_metric_filter_and_alert_for_sql_instance_configuration_changes_enabled",
+          "logging_log_metric_filter_and_alert_for_vpc_firewall_rule_changes_enabled",
+          "logging_log_metric_filter_and_alert_for_vpc_network_changes_enabled",
+          "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled",
+          "iam_organization_essential_contacts_configured",
+          "logging_sink_created"
         ]
       }
     },
@@ -679,6 +848,13 @@
           "sqlserver_va_periodic_recurring_scans_enabled",
           "vm_ensure_using_approved_images",
           "vm_desired_sku_size"
+        ],
+        "gcp": [
+          "gcr_container_scanning_enabled",
+          "artifacts_container_analysis_enabled",
+          "compute_instance_shielded_vm_enabled",
+          "compute_snapshot_not_outdated",
+          "compute_public_address_shodan"
         ]
       }
     },
@@ -723,6 +899,16 @@
           "app_ensure_python_version_is_latest",
           "app_function_latest_runtime_version",
           "storage_smb_protocol_version_is_latest"
+        ],
+        "gcp": [
+          "gcr_container_scanning_enabled",
+          "artifacts_container_analysis_enabled",
+          "compute_snapshot_not_outdated",
+          "compute_network_not_legacy",
+          "dns_rsasha1_in_use_to_key_sign_in_dnssec",
+          "dns_rsasha1_in_use_to_zone_sign_in_dnssec",
+          "apikeys_key_rotated_in_90_days",
+          "iam_sa_user_managed_key_rotate_90_days"
         ]
       }
     },
@@ -765,6 +951,20 @@
           "cosmosdb_account_use_private_endpoints",
           "keyvault_access_only_through_private_endpoints",
           "aks_clusters_created_with_private_nodes"
+        ],
+        "gcp": [
+          "bigquery_dataset_public_access",
+          "cloudstorage_bucket_public_access",
+          "kms_key_not_publicly_accessible",
+          "cloudstorage_uses_vpc_service_controls",
+          "cloudfunction_function_inside_vpc",
+          "iam_sa_no_user_managed_keys",
+          "iam_sa_no_administrative_privileges",
+          "iam_no_service_roles_at_project_level",
+          "apikeys_api_restrictions_configured",
+          "apikeys_api_restricted_with_gemini_api",
+          "compute_image_not_publicly_shared",
+          "iam_cloud_asset_inventory_enabled"
         ]
       }
     },
@@ -804,6 +1004,18 @@
           "app_function_identity_without_admin_privileges",
           "entra_policy_default_users_cannot_create_security_groups",
           "entra_policy_ensure_default_user_cannot_create_apps"
+        ],
+        "gcp": [
+          "iam_sa_no_administrative_privileges",
+          "iam_no_service_roles_at_project_level",
+          "iam_role_kms_enforce_separation_of_duties",
+          "iam_role_sa_enforce_separation_of_duties",
+          "iam_sa_no_user_managed_keys",
+          "compute_instance_default_service_account_in_use",
+          "compute_instance_default_service_account_in_use_with_full_api_access",
+          "gke_cluster_no_default_service_account",
+          "iam_account_access_approval_enabled",
+          "apikeys_api_restrictions_configured"
         ]
       }
     },
@@ -835,6 +1047,14 @@
           "defender_attack_path_notifications_properly_configured",
           "sqlserver_microsoft_defender_enabled",
           "apim_threat_detection_llm_jacking"
+        ],
+        "gcp": [
+          "iam_cloud_asset_inventory_enabled",
+          "iam_audit_logs_enabled",
+          "gcr_container_scanning_enabled",
+          "artifacts_container_analysis_enabled",
+          "compute_public_address_shodan",
+          "logging_sink_created"
         ]
       }
     }

From d27ec7d62e8e5db4a6c4e8cfbd614cb53dc5b0f3 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Fri, 19 Jun 2026 17:21:38 +0900
Subject: [PATCH 096/126] feat(azure): add
 postgresql_flexible_server_geo_redundant_backup_enabled check (#11045)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   5 +
 prowler/compliance/azure/hipaa_azure.json     |   3 +-
 .../compliance/azure/iso27001_2022_azure.json |   6 +-
 .../__init__.py                               |   0
 ...geo_redundant_backup_enabled.metadata.json |  37 +++++
 ...ble_server_geo_redundant_backup_enabled.py |  36 +++++
 .../services/postgresql/postgresql_service.py |  42 +++++-
 ...erver_geo_redundant_backup_enabled_test.py | 132 ++++++++++++++++++
 .../postgresql/postgresql_service_test.py     |  79 ++++++++++-
 9 files changed, 329 insertions(+), 11 deletions(-)
 create mode 100644 prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled.py
 create mode 100644 tests/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 197a7f961d..c3f0fdfa9e 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -22,6 +22,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `defender_ensure_defender_cspm_is_on` check for Azure provider, verifying Microsoft Defender Cloud Security Posture Management (CSPM) is enabled on the Standard tier [(#11037)](https://github.com/prowler-cloud/prowler/pull/11037)
 - `mysql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying MySQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11041)](https://github.com/prowler-cloud/prowler/pull/11041)
 - `mysql_flexible_server_high_availability_enabled` check for Azure provider, verifying MySQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11042)](https://github.com/prowler-cloud/prowler/pull/11042)
+- `postgresql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying PostgreSQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11045)](https://github.com/prowler-cloud/prowler/pull/11045)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
@@ -38,6 +39,10 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 - Replaced the unmaintained `awsipranges` dependency with a small standard-library helper for the `route53_dangling_ip_subdomain_takeover` check [(#9293)](https://github.com/prowler-cloud/prowler/pull/9293)
 
+### 🐞 Fixed
+
+- Azure PostgreSQL flexible server inventory no longer aborts the whole subscription when the `connection_throttle.enable` parameter is missing (e.g. PostgreSQL v18), and logs the expected "Entra ID authentication not enabled" case as a warning instead of an error, so servers are still scanned [(#11045)](https://github.com/prowler-cloud/prowler/pull/11045)
+
 ### 🔐 Security
 
 - `pytest` from 8.3.5 to 9.0.3, patching a known vulnerability in the SDK test dependency [(#11291)](https://github.com/prowler-cloud/prowler/pull/11291)
diff --git a/prowler/compliance/azure/hipaa_azure.json b/prowler/compliance/azure/hipaa_azure.json
index 70f1e7e13f..b27344582f 100644
--- a/prowler/compliance/azure/hipaa_azure.json
+++ b/prowler/compliance/azure/hipaa_azure.json
@@ -440,7 +440,8 @@
         "sqlserver_auditing_retention_90_days",
         "postgresql_flexible_server_log_retention_days_greater_3",
         "cosmosdb_account_backup_policy_continuous",
-        "mysql_flexible_server_geo_redundant_backup_enabled"
+        "mysql_flexible_server_geo_redundant_backup_enabled",
+        "postgresql_flexible_server_geo_redundant_backup_enabled"
       ]
     },
     {
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index ee0e4ca89b..fb5b2d6915 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1268,7 +1268,8 @@
       ],
       "Checks": [
         "cosmosdb_account_backup_policy_continuous",
-        "mysql_flexible_server_geo_redundant_backup_enabled"
+        "mysql_flexible_server_geo_redundant_backup_enabled",
+        "postgresql_flexible_server_geo_redundant_backup_enabled"
       ]
     },
     {
@@ -1299,7 +1300,8 @@
         "vm_trusted_launch_enabled",
         "cosmosdb_account_automatic_failover_enabled",
         "mysql_flexible_server_geo_redundant_backup_enabled",
-        "mysql_flexible_server_high_availability_enabled"
+        "mysql_flexible_server_high_availability_enabled",
+        "postgresql_flexible_server_geo_redundant_backup_enabled"
       ]
     },
     {
diff --git a/prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/__init__.py b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled.metadata.json b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled.metadata.json
new file mode 100644
index 0000000000..7be125ecf2
--- /dev/null
+++ b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "postgresql_flexible_server_geo_redundant_backup_enabled",
+  "CheckTitle": "PostgreSQL flexible server has geo-redundant backup enabled",
+  "CheckType": [],
+  "ServiceName": "postgresql",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
+  "ResourceGroup": "database",
+  "Description": "**Azure PostgreSQL Flexible Server** is evaluated for **geo-redundant backup**. Geo-redundant backup stores backup copies in a paired Azure region, enabling restore and cross-region disaster recovery.",
+  "Risk": "Without **geo-redundant backup**, a regional disaster can cause **permanent data loss**. Locally redundant backups only protect against storage hardware failures within the same region and cannot be restored if the primary region becomes unavailable.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-backup-restore",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/flexibleservers"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az postgres flexible-server create --name <server_name> --resource-group <resource_group_name> --location <region> --geo-redundant-backup Enabled",
+      "NativeIaC": "```bicep\n// Bicep: PostgreSQL Flexible Server with geo-redundant backup (set at creation)\nresource postgresql 'Microsoft.DBforPostgreSQL/flexibleServers@2023-06-01-preview' = {\n  name: '<example_resource_name>'\n  location: '<region>'\n  properties: {\n    backup: {\n      geoRedundantBackup: 'Enabled' // CRITICAL: stores backups in the paired region\n    }\n  }\n}\n```",
+      "Other": "1. Geo-redundant backup must be configured when the server is created; it cannot be enabled on an existing server\n2. In the Azure portal, start creating a new Azure Database for PostgreSQL flexible server\n3. On the Basics tab, under Compute + storage, open Configure server\n4. Set Geographically redundant backup to Enabled and save\n5. Finish creating the server and migrate workloads to it",
+      "Terraform": "```hcl\n# Terraform: PostgreSQL Flexible Server with geo-redundant backup (set at creation)\nresource \"azurerm_postgresql_flexible_server\" \"<example_resource_name>\" {\n  name                         = \"<example_resource_name>\"\n  resource_group_name          = \"<example_resource_name>\"\n  location                     = \"<region>\"\n  geo_redundant_backup_enabled = true # CRITICAL: stores backups in the paired region\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **geo-redundant backup** on PostgreSQL Flexible Servers so backups are replicated to the paired Azure region and can be restored during a regional outage. Because this is set at server creation, plan a migration for existing servers, and pair it with an appropriate backup retention period and periodic restore testing.",
+      "Url": "https://hub.prowler.com/check/postgresql_flexible_server_geo_redundant_backup_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Geo-redundant backup for Azure PostgreSQL Flexible Server can only be configured at server creation time and cannot be changed afterwards."
+}
diff --git a/prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled.py b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled.py
new file mode 100644
index 0000000000..94fdaa7a1c
--- /dev/null
+++ b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled.py
@@ -0,0 +1,36 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.postgresql.postgresql_client import (
+    postgresql_client,
+)
+
+
+class postgresql_flexible_server_geo_redundant_backup_enabled(Check):
+    """
+    Ensure Azure PostgreSQL Flexible Servers have geo-redundant backup enabled.
+
+    This check evaluates whether each Azure PostgreSQL Flexible Server stores backups in a paired Azure region, enabling cross-region disaster recovery.
+
+    - PASS: The server has geo-redundant backup enabled (geo_redundant_backup is "Enabled").
+    - FAIL: The server does not have geo-redundant backup enabled.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for (
+            subscription,
+            flexible_servers,
+        ) in postgresql_client.flexible_servers.items():
+            subscription_name = postgresql_client.subscriptions.get(
+                subscription, subscription
+            )
+            for server in flexible_servers:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
+                report.subscription = subscription
+                if server.geo_redundant_backup == "Enabled":
+                    report.status = "PASS"
+                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has geo-redundant backup enabled."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) does not have geo-redundant backup enabled."
+                findings.append(report)
+        return findings
diff --git a/prowler/providers/azure/services/postgresql/postgresql_service.py b/prowler/providers/azure/services/postgresql/postgresql_service.py
index 13081ad270..dd8121d9dd 100644
--- a/prowler/providers/azure/services/postgresql/postgresql_service.py
+++ b/prowler/providers/azure/services/postgresql/postgresql_service.py
@@ -1,4 +1,5 @@
 from dataclasses import dataclass
+from typing import Optional
 
 from azure.mgmt.postgresqlflexibleservers import PostgreSQLManagementClient
 
@@ -53,6 +54,7 @@ class PostgreSQL(AzureService):
                         subscription, resource_group, postgresql_server.name
                     )
                     location = server_details.location
+                    backup = getattr(server_details, "backup", None)
                     flexible_servers[subscription].append(
                         Server(
                             id=postgresql_server.id,
@@ -68,6 +70,9 @@ class PostgreSQL(AzureService):
                             connection_throttling=connection_throttling,
                             log_retention_days=log_retention_days,
                             firewall=firewall,
+                            geo_redundant_backup=getattr(
+                                backup, "geo_redundant_backup", None
+                            ),
                         )
                     )
             except Exception as error:
@@ -149,15 +154,37 @@ class PostgreSQL(AzureService):
                 )
             return admin_list
         except Exception as e:
-            logger.error(f"Error getting Entra ID admins for {server_name}: {e}")
+            if "authentication is not enabled" in str(e):
+                # Expected when the server uses PostgreSQL authentication only
+                # (Entra/Azure AD auth disabled); not an error.
+                logger.warning(
+                    f"Entra ID authentication is not enabled for {server_name}; skipping Entra ID admins."
+                )
+            else:
+                logger.error(f"Error getting Entra ID admins for {server_name}: {e}")
             return []
 
     def _get_connection_throttling(self, subscription, resouce_group_name, server_name):
         client = self.clients[subscription]
-        connection_throttling = client.configurations.get(
-            resouce_group_name, server_name, "connection_throttle.enable"
-        )
-        return connection_throttling.value.upper()
+        try:
+            connection_throttling = client.configurations.get(
+                resouce_group_name, server_name, "connection_throttle.enable"
+            )
+            return connection_throttling.value.upper()
+        except Exception as error:
+            message = str(error).lower()
+            if "connection_throttle.enable" in message and (
+                "not exist" in message or "not found" in message
+            ):
+                # The "connection_throttle.enable" parameter does not exist on
+                # newer PostgreSQL versions (e.g. v18); this is expected.
+                return None
+            # Any other failure is a genuine problem: surface it, but still
+            # degrade gracefully instead of aborting the subscription inventory.
+            logger.error(
+                f"Error getting connection throttling for {server_name}: {error}"
+            )
+            return None
 
     def _get_log_retention_days(self, subscription, resouce_group_name, server_name):
         client = self.clients[subscription]
@@ -214,6 +241,7 @@ class Server:
     log_checkpoints: str
     log_connections: str
     log_disconnections: str
-    connection_throttling: str
-    log_retention_days: str
+    connection_throttling: Optional[str]
+    log_retention_days: Optional[str]
     firewall: list[Firewall]
+    geo_redundant_backup: Optional[str] = None
diff --git a/tests/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled_test.py b/tests/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled_test.py
new file mode 100644
index 0000000000..db0291c989
--- /dev/null
+++ b/tests/providers/azure/services/postgresql/postgresql_flexible_server_geo_redundant_backup_enabled/postgresql_flexible_server_geo_redundant_backup_enabled_test.py
@@ -0,0 +1,132 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.postgresql.postgresql_service import Server
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+def _make_server(server_id, server_name, geo_redundant_backup):
+    return Server(
+        id=server_id,
+        name=server_name,
+        resource_group="resource_group",
+        location="eastus",
+        require_secure_transport="ON",
+        active_directory_auth="Enabled",
+        entra_id_admins=[],
+        log_checkpoints="ON",
+        log_connections="ON",
+        log_disconnections="ON",
+        connection_throttling="ON",
+        log_retention_days="3",
+        firewall=[],
+        geo_redundant_backup=geo_redundant_backup,
+    )
+
+
+class Test_postgresql_flexible_server_geo_redundant_backup_enabled:
+    def test_no_postgresql_flexible_servers(self):
+        postgresql_client = mock.MagicMock
+        postgresql_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        postgresql_client.flexible_servers = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.postgresql.postgresql_flexible_server_geo_redundant_backup_enabled.postgresql_flexible_server_geo_redundant_backup_enabled.postgresql_client",
+                new=postgresql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.postgresql.postgresql_flexible_server_geo_redundant_backup_enabled.postgresql_flexible_server_geo_redundant_backup_enabled import (
+                postgresql_flexible_server_geo_redundant_backup_enabled,
+            )
+
+            check = postgresql_flexible_server_geo_redundant_backup_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_postgresql_geo_redundant_backup_disabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        postgresql_client = mock.MagicMock
+        postgresql_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        postgresql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: [_make_server(server_id, server_name, "Disabled")]
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.postgresql.postgresql_flexible_server_geo_redundant_backup_enabled.postgresql_flexible_server_geo_redundant_backup_enabled.postgresql_client",
+                new=postgresql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.postgresql.postgresql_flexible_server_geo_redundant_backup_enabled.postgresql_flexible_server_geo_redundant_backup_enabled import (
+                postgresql_flexible_server_geo_redundant_backup_enabled,
+            )
+
+            check = postgresql_flexible_server_geo_redundant_backup_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Flexible Postgresql server {server_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have geo-redundant backup enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
+
+    def test_postgresql_geo_redundant_backup_enabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        postgresql_client = mock.MagicMock
+        postgresql_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        postgresql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: [_make_server(server_id, server_name, "Enabled")]
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.postgresql.postgresql_flexible_server_geo_redundant_backup_enabled.postgresql_flexible_server_geo_redundant_backup_enabled.postgresql_client",
+                new=postgresql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.postgresql.postgresql_flexible_server_geo_redundant_backup_enabled.postgresql_flexible_server_geo_redundant_backup_enabled import (
+                postgresql_flexible_server_geo_redundant_backup_enabled,
+            )
+
+            check = postgresql_flexible_server_geo_redundant_backup_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Flexible Postgresql server {server_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has geo-redundant backup enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
diff --git a/tests/providers/azure/services/postgresql/postgresql_service_test.py b/tests/providers/azure/services/postgresql/postgresql_service_test.py
index f36b5675ec..c0b8bca6c4 100644
--- a/tests/providers/azure/services/postgresql/postgresql_service_test.py
+++ b/tests/providers/azure/services/postgresql/postgresql_service_test.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch
+from unittest.mock import MagicMock, patch
 
 from prowler.providers.azure.services.postgresql.postgresql_service import (
     EntraIdAdmin,
@@ -115,6 +115,44 @@ class Test_SqlServer_Service:
             == "ON"
         )
 
+    def test_get_connection_throttling_missing_parameter_returns_none(self):
+        # PostgreSQL v18 removed the "connection_throttle.enable" parameter; the
+        # service must degrade gracefully (quiet None) instead of raising and
+        # aborting the whole subscription's server inventory.
+        postgresql = PostgreSQL(set_mocked_azure_provider())
+        mock_client = MagicMock()
+        mock_client.configurations.get.side_effect = Exception(
+            "The configuration 'connection_throttle.enable' does not exist for "
+            "server version 18."
+        )
+        postgresql.clients[AZURE_SUBSCRIPTION_ID] = mock_client
+        with patch(
+            "prowler.providers.azure.services.postgresql.postgresql_service.logger"
+        ) as mock_logger:
+            result = postgresql._get_connection_throttling(
+                AZURE_SUBSCRIPTION_ID, "resource_group", "server_name"
+            )
+        assert result is None
+        mock_logger.error.assert_not_called()
+
+    def test_get_connection_throttling_unexpected_error_logs_error(self):
+        # Any other failure (permissions, throttling, transient API errors) must
+        # still be logged as an error, while keeping the scan resilient (None).
+        postgresql = PostgreSQL(set_mocked_azure_provider())
+        mock_client = MagicMock()
+        mock_client.configurations.get.side_effect = Exception(
+            "Some unexpected failure"
+        )
+        postgresql.clients[AZURE_SUBSCRIPTION_ID] = mock_client
+        with patch(
+            "prowler.providers.azure.services.postgresql.postgresql_service.logger"
+        ) as mock_logger:
+            result = postgresql._get_connection_throttling(
+                AZURE_SUBSCRIPTION_ID, "resource_group", "server_name"
+            )
+        assert result is None
+        mock_logger.error.assert_called_once()
+
     def test_get_log_retention_days(self):
         postgesql = PostgreSQL(set_mocked_azure_provider())
         assert (
@@ -138,6 +176,45 @@ class Test_SqlServer_Service:
         assert admins[0].principal_name == "Test Admin User"
         assert admins[0].object_id == "11111111-1111-1111-1111-111111111111"
 
+    def test_get_entra_id_admins_aad_not_enabled_logs_warning(self):
+        # A server using PostgreSQL authentication only (Entra/Azure AD auth
+        # disabled) is an expected state; it should be logged as a warning, not
+        # an error, and return an empty admin list.
+        postgresql = PostgreSQL(set_mocked_azure_provider())
+        mock_client = MagicMock()
+        mock_client.administrators.list_by_server.side_effect = Exception(
+            "Azure AD authentication is not enabled for the given server"
+        )
+        postgresql.clients[AZURE_SUBSCRIPTION_ID] = mock_client
+        with patch(
+            "prowler.providers.azure.services.postgresql.postgresql_service.logger"
+        ) as mock_logger:
+            result = postgresql._get_entra_id_admins(
+                AZURE_SUBSCRIPTION_ID, "resource_group", "server_name"
+            )
+        assert result == []
+        mock_logger.warning.assert_called_once()
+        mock_logger.error.assert_not_called()
+
+    def test_get_entra_id_admins_unexpected_error_logs_error(self):
+        # Any other failure (permissions, throttling, transient API errors) is a
+        # genuine problem and must still be logged as an error.
+        postgresql = PostgreSQL(set_mocked_azure_provider())
+        mock_client = MagicMock()
+        mock_client.administrators.list_by_server.side_effect = Exception(
+            "Some unexpected failure"
+        )
+        postgresql.clients[AZURE_SUBSCRIPTION_ID] = mock_client
+        with patch(
+            "prowler.providers.azure.services.postgresql.postgresql_service.logger"
+        ) as mock_logger:
+            result = postgresql._get_entra_id_admins(
+                AZURE_SUBSCRIPTION_ID, "resource_group", "server_name"
+            )
+        assert result == []
+        mock_logger.error.assert_called_once()
+        mock_logger.warning.assert_not_called()
+
     def test_get_firewall(self):
         postgesql = PostgreSQL(set_mocked_azure_provider())
         assert (

From 9e173978dcf92f74638cf17a61d61c44f55bbcc6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Fri, 19 Jun 2026 10:37:07 +0200
Subject: [PATCH 097/126] feat(compliance): add DORA compliance framework for
 Cloudflare (#11645)

---
 prowler/CHANGELOG.md                   |  1 +
 prowler/compliance/dora_2022_2554.json | 55 ++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index c3f0fdfa9e..b304ce74df 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -33,6 +33,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `entra_conditional_access_policy_no_deleted_object_references` check for M365 provider [(#11236)](https://github.com/prowler-cloud/prowler/pull/11236)
 - `aks_cluster_defender_enabled` check for Azure provider, verifying that AKS clusters have Microsoft Defender security monitoring enabled [(#11028)](https://github.com/prowler-cloud/prowler/pull/11028)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the GCP provider, mapping existing GCP checks across the five DORA pillars [(#11642)](https://github.com/prowler-cloud/prowler/pull/11642)
+- DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Cloudflare provider, mapping existing Cloudflare edge/network checks across the applicable DORA pillars [(#11645)](https://github.com/prowler-cloud/prowler/pull/11645)
 
 
 ### 🔄 Changed
diff --git a/prowler/compliance/dora_2022_2554.json b/prowler/compliance/dora_2022_2554.json
index 4a1db41beb..b6aa1e2f88 100644
--- a/prowler/compliance/dora_2022_2554.json
+++ b/prowler/compliance/dora_2022_2554.json
@@ -255,6 +255,18 @@
           "compute_network_not_legacy",
           "compute_network_default_in_use",
           "compute_instance_single_network_interface"
+        ],
+        "cloudflare": [
+          "zone_universal_ssl_enabled",
+          "zone_ssl_strict",
+          "zone_min_tls_version_secure",
+          "zone_tls_1_3_enabled",
+          "zone_hsts_enabled",
+          "zone_https_redirect_enabled",
+          "zone_automatic_https_rewrites_enabled",
+          "zone_development_mode_disabled",
+          "zone_record_caa_exists",
+          "zone_dnssec_enabled"
         ]
       }
     },
@@ -291,6 +303,11 @@
           "apikeys_key_exists",
           "compute_instance_suspended_without_persistent_disks",
           "compute_public_address_shodan"
+        ],
+        "cloudflare": [
+          "dns_record_no_wildcard",
+          "dns_record_no_internal_ip",
+          "dns_record_cname_target_valid"
         ]
       }
     },
@@ -414,6 +431,32 @@
           "cloudsql_instance_sqlserver_trace_flag",
           "cloudsql_instance_sqlserver_user_connections_flag",
           "cloudsql_instance_sqlserver_user_options_flag"
+        ],
+        "cloudflare": [
+          "zone_universal_ssl_enabled",
+          "zone_ssl_strict",
+          "zone_min_tls_version_secure",
+          "zone_tls_1_3_enabled",
+          "zone_hsts_enabled",
+          "zone_https_redirect_enabled",
+          "zone_automatic_https_rewrites_enabled",
+          "zone_record_caa_exists",
+          "zone_dnssec_enabled",
+          "zone_waf_enabled",
+          "zone_waf_owasp_ruleset_enabled",
+          "zone_firewall_blocking_rules_configured",
+          "zone_browser_integrity_check_enabled",
+          "zone_bot_fight_mode_enabled",
+          "zone_rate_limiting_enabled",
+          "zone_challenge_passage_configured",
+          "zone_ip_geolocation_enabled",
+          "dns_record_proxied",
+          "dns_record_no_internal_ip",
+          "dns_record_no_wildcard",
+          "dns_record_cname_target_valid",
+          "zone_record_spf_exists",
+          "zone_record_dkim_exists",
+          "zone_record_dmarc_exists"
         ]
       }
     },
@@ -470,6 +513,11 @@
           "cloudstorage_bucket_logging_enabled",
           "compute_loadbalancer_logging_enabled",
           "logging_sink_created"
+        ],
+        "cloudflare": [
+          "zone_bot_fight_mode_enabled",
+          "zone_browser_integrity_check_enabled",
+          "zone_rate_limiting_enabled"
         ]
       }
     },
@@ -909,6 +957,9 @@
           "dns_rsasha1_in_use_to_zone_sign_in_dnssec",
           "apikeys_key_rotated_in_90_days",
           "iam_sa_user_managed_key_rotate_90_days"
+        ],
+        "cloudflare": [
+          "zone_min_tls_version_secure"
         ]
       }
     },
@@ -965,6 +1016,10 @@
           "apikeys_api_restricted_with_gemini_api",
           "compute_image_not_publicly_shared",
           "iam_cloud_asset_inventory_enabled"
+        ],
+        "cloudflare": [
+          "zone_record_caa_exists",
+          "dns_record_cname_target_valid"
         ]
       }
     },

From bbf54011eadf3965f4ce18c28589676b644239bd Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Fri, 19 Jun 2026 18:59:37 +0900
Subject: [PATCH 098/126] feat(azure): add
 postgresql_flexible_server_high_availability_enabled check (#11046)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   3 +-
 .../__init__.py                               |   0
 ...er_high_availability_enabled.metadata.json |  37 ++++
 ...exible_server_high_availability_enabled.py |  39 ++++
 .../services/postgresql/postgresql_service.py |   3 +
 ...e_server_high_availability_enabled_test.py | 168 ++++++++++++++++++
 7 files changed, 250 insertions(+), 1 deletion(-)
 create mode 100644 prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled.py
 create mode 100644 tests/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index b304ce74df..2b6f400a97 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -23,6 +23,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `mysql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying MySQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11041)](https://github.com/prowler-cloud/prowler/pull/11041)
 - `mysql_flexible_server_high_availability_enabled` check for Azure provider, verifying MySQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11042)](https://github.com/prowler-cloud/prowler/pull/11042)
 - `postgresql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying PostgreSQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11045)](https://github.com/prowler-cloud/prowler/pull/11045)
+- `postgresql_flexible_server_high_availability_enabled` check for Azure provider, verifying PostgreSQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11046)](https://github.com/prowler-cloud/prowler/pull/11046)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index fb5b2d6915..fbe2204e2d 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1301,7 +1301,8 @@
         "cosmosdb_account_automatic_failover_enabled",
         "mysql_flexible_server_geo_redundant_backup_enabled",
         "mysql_flexible_server_high_availability_enabled",
-        "postgresql_flexible_server_geo_redundant_backup_enabled"
+        "postgresql_flexible_server_geo_redundant_backup_enabled",
+        "postgresql_flexible_server_high_availability_enabled"
       ]
     },
     {
diff --git a/prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/__init__.py b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled.metadata.json b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled.metadata.json
new file mode 100644
index 0000000000..58b6588886
--- /dev/null
+++ b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "postgresql_flexible_server_high_availability_enabled",
+  "CheckTitle": "PostgreSQL flexible server has high availability enabled",
+  "CheckType": [],
+  "ServiceName": "postgresql",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.dbforpostgresql/flexibleservers",
+  "ResourceGroup": "database",
+  "Description": "**Azure PostgreSQL Flexible Server** is evaluated for **high availability** mode. Zone-redundant or same-zone HA provisions a standby replica and provides automatic failover during planned and unplanned outages.",
+  "Risk": "Without **high availability**, a server or zone failure causes **downtime** until manual recovery or redeployment. Critical databases experience extended unavailability and potential data loss for in-flight transactions during unplanned outages.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-high-availability",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.dbforpostgresql/flexibleservers"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az postgres flexible-server update --name <server_name> --resource-group <resource_group_name> --high-availability ZoneRedundant",
+      "NativeIaC": "```bicep\n// Bicep: PostgreSQL Flexible Server with zone-redundant high availability\nresource postgresql 'Microsoft.DBforPostgreSQL/flexibleServers@2023-06-01-preview' = {\n  name: '<example_resource_name>'\n  location: '<region>'\n  sku: {\n    name: 'Standard_D2ds_v4'\n    tier: 'GeneralPurpose'\n  }\n  properties: {\n    highAvailability: {\n      mode: 'ZoneRedundant' // CRITICAL: provisions a standby replica with automatic failover\n    }\n  }\n}\n```",
+      "Other": "1. In the Azure portal, open your Azure Database for PostgreSQL flexible server\n2. Under Settings, select High availability\n3. Enable High availability and choose Zone redundant (or Same zone)\n4. Save (high availability requires the General Purpose or Memory Optimized tier)",
+      "Terraform": "```hcl\n# Terraform: PostgreSQL Flexible Server with zone-redundant high availability\nresource \"azurerm_postgresql_flexible_server\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  resource_group_name = \"<example_resource_name>\"\n  location            = \"<region>\"\n  sku_name            = \"GP_Standard_D2ds_v4\"\n\n  high_availability {\n    mode = \"ZoneRedundant\" # CRITICAL: provisions a standby replica with automatic failover\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **high availability** (zone-redundant where supported, otherwise same-zone) on production PostgreSQL Flexible Servers so a standby replica provides automatic failover. High availability requires the General Purpose or Memory Optimized tier; pair it with geo-redundant backup and periodic failover testing for full resilience.",
+      "Url": "https://hub.prowler.com/check/postgresql_flexible_server_high_availability_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "High availability for Azure PostgreSQL Flexible Server requires the General Purpose or Memory Optimized compute tier and is not available on the Burstable tier."
+}
diff --git a/prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled.py b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled.py
new file mode 100644
index 0000000000..14c69f591e
--- /dev/null
+++ b/prowler/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled.py
@@ -0,0 +1,39 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.postgresql.postgresql_client import (
+    postgresql_client,
+)
+
+
+class postgresql_flexible_server_high_availability_enabled(Check):
+    """
+    Ensure Azure PostgreSQL Flexible Servers have high availability enabled.
+
+    This check evaluates whether each Azure PostgreSQL Flexible Server is configured with high availability (zone-redundant or same-zone), providing automatic failover to a standby replica during outages.
+
+    - PASS: The server has high availability enabled (high_availability_mode is set and not "Disabled").
+    - FAIL: The server does not have high availability enabled.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+        for (
+            subscription,
+            flexible_servers,
+        ) in postgresql_client.flexible_servers.items():
+            subscription_name = postgresql_client.subscriptions.get(
+                subscription, subscription
+            )
+            for server in flexible_servers:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=server)
+                report.subscription = subscription
+                if (
+                    server.high_availability_mode is not None
+                    and server.high_availability_mode != "Disabled"
+                ):
+                    report.status = "PASS"
+                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) has high availability enabled."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Flexible Postgresql server {server.name} from subscription {subscription_name} ({subscription}) does not have high availability enabled."
+                findings.append(report)
+        return findings
diff --git a/prowler/providers/azure/services/postgresql/postgresql_service.py b/prowler/providers/azure/services/postgresql/postgresql_service.py
index dd8121d9dd..2048299bf1 100644
--- a/prowler/providers/azure/services/postgresql/postgresql_service.py
+++ b/prowler/providers/azure/services/postgresql/postgresql_service.py
@@ -55,6 +55,7 @@ class PostgreSQL(AzureService):
                     )
                     location = server_details.location
                     backup = getattr(server_details, "backup", None)
+                    ha = getattr(server_details, "high_availability", None)
                     flexible_servers[subscription].append(
                         Server(
                             id=postgresql_server.id,
@@ -73,6 +74,7 @@ class PostgreSQL(AzureService):
                             geo_redundant_backup=getattr(
                                 backup, "geo_redundant_backup", None
                             ),
+                            high_availability_mode=getattr(ha, "mode", None),
                         )
                     )
             except Exception as error:
@@ -245,3 +247,4 @@ class Server:
     log_retention_days: Optional[str]
     firewall: list[Firewall]
     geo_redundant_backup: Optional[str] = None
+    high_availability_mode: Optional[str] = None
diff --git a/tests/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled_test.py b/tests/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled_test.py
new file mode 100644
index 0000000000..190c8629ce
--- /dev/null
+++ b/tests/providers/azure/services/postgresql/postgresql_flexible_server_high_availability_enabled/postgresql_flexible_server_high_availability_enabled_test.py
@@ -0,0 +1,168 @@
+from unittest import mock
+from uuid import uuid4
+
+from prowler.providers.azure.services.postgresql.postgresql_service import Server
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_DISPLAY,
+    AZURE_SUBSCRIPTION_ID,
+    AZURE_SUBSCRIPTION_NAME,
+    set_mocked_azure_provider,
+)
+
+
+def _make_server(server_id, server_name, high_availability_mode):
+    return Server(
+        id=server_id,
+        name=server_name,
+        resource_group="resource_group",
+        location="eastus",
+        require_secure_transport="ON",
+        active_directory_auth="Enabled",
+        entra_id_admins=[],
+        log_checkpoints="ON",
+        log_connections="ON",
+        log_disconnections="ON",
+        connection_throttling="ON",
+        log_retention_days="3",
+        firewall=[],
+        high_availability_mode=high_availability_mode,
+    )
+
+
+class Test_postgresql_flexible_server_high_availability_enabled:
+    def test_no_postgresql_flexible_servers(self):
+        postgresql_client = mock.MagicMock
+        postgresql_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        postgresql_client.flexible_servers = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.postgresql.postgresql_flexible_server_high_availability_enabled.postgresql_flexible_server_high_availability_enabled.postgresql_client",
+                new=postgresql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.postgresql.postgresql_flexible_server_high_availability_enabled.postgresql_flexible_server_high_availability_enabled import (
+                postgresql_flexible_server_high_availability_enabled,
+            )
+
+            check = postgresql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_postgresql_high_availability_disabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        postgresql_client = mock.MagicMock
+        postgresql_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        postgresql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: [_make_server(server_id, server_name, "Disabled")]
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.postgresql.postgresql_flexible_server_high_availability_enabled.postgresql_flexible_server_high_availability_enabled.postgresql_client",
+                new=postgresql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.postgresql.postgresql_flexible_server_high_availability_enabled.postgresql_flexible_server_high_availability_enabled import (
+                postgresql_flexible_server_high_availability_enabled,
+            )
+
+            check = postgresql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Flexible Postgresql server {server_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have high availability enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"
+
+    def test_postgresql_high_availability_not_set(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        postgresql_client = mock.MagicMock
+        postgresql_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        postgresql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: [_make_server(server_id, server_name, None)]
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.postgresql.postgresql_flexible_server_high_availability_enabled.postgresql_flexible_server_high_availability_enabled.postgresql_client",
+                new=postgresql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.postgresql.postgresql_flexible_server_high_availability_enabled.postgresql_flexible_server_high_availability_enabled import (
+                postgresql_flexible_server_high_availability_enabled,
+            )
+
+            check = postgresql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == f"Flexible Postgresql server {server_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} does not have high availability enabled."
+            )
+
+    def test_postgresql_high_availability_enabled(self):
+        server_id = str(uuid4())
+        server_name = "test-server"
+        postgresql_client = mock.MagicMock
+        postgresql_client.subscriptions = {
+            AZURE_SUBSCRIPTION_ID: AZURE_SUBSCRIPTION_NAME
+        }
+        postgresql_client.flexible_servers = {
+            AZURE_SUBSCRIPTION_ID: [
+                _make_server(server_id, server_name, "ZoneRedundant")
+            ]
+        }
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.postgresql.postgresql_flexible_server_high_availability_enabled.postgresql_flexible_server_high_availability_enabled.postgresql_client",
+                new=postgresql_client,
+            ),
+        ):
+            from prowler.providers.azure.services.postgresql.postgresql_flexible_server_high_availability_enabled.postgresql_flexible_server_high_availability_enabled import (
+                postgresql_flexible_server_high_availability_enabled,
+            )
+
+            check = postgresql_flexible_server_high_availability_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == f"Flexible Postgresql server {server_name} from subscription {AZURE_SUBSCRIPTION_DISPLAY} has high availability enabled."
+            )
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_name == server_name
+            assert result[0].resource_id == server_id
+            assert result[0].location == "eastus"

From e10cf34ad66b77dd1913ac56ec9bb5f3ba36c373 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Fri, 19 Jun 2026 12:17:33 +0200
Subject: [PATCH 099/126] feat(compliance): DORA compliance framework for
 Alibaba Cloud (#11646)

---
 prowler/CHANGELOG.md                   |   1 +
 prowler/compliance/dora_2022_2554.json | 134 +++++++++++++++++++++++++
 2 files changed, 135 insertions(+)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 2b6f400a97..8801277aab 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -35,6 +35,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `aks_cluster_defender_enabled` check for Azure provider, verifying that AKS clusters have Microsoft Defender security monitoring enabled [(#11028)](https://github.com/prowler-cloud/prowler/pull/11028)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the GCP provider, mapping existing GCP checks across the five DORA pillars [(#11642)](https://github.com/prowler-cloud/prowler/pull/11642)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Cloudflare provider, mapping existing Cloudflare edge/network checks across the applicable DORA pillars [(#11645)](https://github.com/prowler-cloud/prowler/pull/11645)
+- DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the AlibabaCloud provider, mapping existing AlibabaCloud checks across the applicable DORA pillars [(#11646)](https://github.com/prowler-cloud/prowler/pull/11646)
 
 
 ### 🔄 Changed
diff --git a/prowler/compliance/dora_2022_2554.json b/prowler/compliance/dora_2022_2554.json
index b6aa1e2f88..e4b5fd69df 100644
--- a/prowler/compliance/dora_2022_2554.json
+++ b/prowler/compliance/dora_2022_2554.json
@@ -144,6 +144,22 @@
           "compute_instance_default_service_account_in_use",
           "compute_instance_default_service_account_in_use_with_full_api_access",
           "gke_cluster_no_default_service_account"
+        ],
+        "alibabacloud": [
+          "ram_no_root_access_key",
+          "ram_user_mfa_enabled_console_access",
+          "ram_user_console_access_unused",
+          "ram_rotate_access_key_90_days",
+          "ram_password_policy_minimum_length",
+          "ram_password_policy_lowercase",
+          "ram_password_policy_uppercase",
+          "ram_password_policy_number",
+          "ram_password_policy_symbol",
+          "ram_password_policy_password_reuse_prevention",
+          "ram_password_policy_max_password_age",
+          "ram_password_policy_max_login_attempts",
+          "ram_policy_attached_only_to_group_or_roles",
+          "ram_policy_no_administrative_privileges"
         ]
       }
     },
@@ -192,6 +208,12 @@
           "gcr_container_scanning_enabled",
           "artifacts_container_analysis_enabled",
           "iam_organization_essential_contacts_configured"
+        ],
+        "alibabacloud": [
+          "securitycenter_advanced_or_enterprise_edition",
+          "securitycenter_all_assets_agent_installed",
+          "securitycenter_vulnerability_scan_enabled",
+          "actiontrail_multi_region_enabled"
         ]
       }
     },
@@ -267,6 +289,15 @@
           "zone_development_mode_disabled",
           "zone_record_caa_exists",
           "zone_dnssec_enabled"
+        ],
+        "alibabacloud": [
+          "oss_bucket_secure_transport_enabled",
+          "rds_instance_ssl_enabled",
+          "rds_instance_tde_enabled",
+          "rds_instance_tde_key_custom",
+          "ecs_attached_disk_encrypted",
+          "ecs_unattached_disk_encrypted",
+          "ecs_instance_no_legacy_network"
         ]
       }
     },
@@ -308,6 +339,10 @@
           "dns_record_no_wildcard",
           "dns_record_no_internal_ip",
           "dns_record_cname_target_valid"
+        ],
+        "alibabacloud": [
+          "securitycenter_all_assets_agent_installed",
+          "ram_user_console_access_unused"
         ]
       }
     },
@@ -457,6 +492,25 @@
           "zone_record_spf_exists",
           "zone_record_dkim_exists",
           "zone_record_dmarc_exists"
+        ],
+        "alibabacloud": [
+          "oss_bucket_not_publicly_accessible",
+          "oss_bucket_secure_transport_enabled",
+          "actiontrail_oss_bucket_not_publicly_accessible",
+          "ecs_attached_disk_encrypted",
+          "ecs_unattached_disk_encrypted",
+          "ecs_securitygroup_restrict_ssh_internet",
+          "ecs_securitygroup_restrict_rdp_internet",
+          "ecs_instance_endpoint_protection_installed",
+          "rds_instance_no_public_access_whitelist",
+          "rds_instance_ssl_enabled",
+          "rds_instance_tde_enabled",
+          "rds_instance_tde_key_custom",
+          "cs_kubernetes_network_policy_enabled",
+          "cs_kubernetes_eni_multiple_ip_enabled",
+          "cs_kubernetes_private_cluster_enabled",
+          "cs_kubernetes_rbac_enabled",
+          "cs_kubernetes_dashboard_disabled"
         ]
       }
     },
@@ -518,6 +572,13 @@
           "zone_bot_fight_mode_enabled",
           "zone_browser_integrity_check_enabled",
           "zone_rate_limiting_enabled"
+        ],
+        "alibabacloud": [
+          "securitycenter_vulnerability_scan_enabled",
+          "securitycenter_notification_enabled_high_risk",
+          "securitycenter_all_assets_agent_installed",
+          "ecs_instance_endpoint_protection_installed",
+          "cs_kubernetes_cloudmonitor_enabled"
         ]
       }
     },
@@ -561,6 +622,11 @@
           "compute_instance_deletion_protection_enabled",
           "compute_instance_group_load_balancer_attached",
           "compute_instance_preemptible_vm_disabled"
+        ],
+        "alibabacloud": [
+          "securitycenter_notification_enabled_high_risk",
+          "cs_kubernetes_cluster_check_recent",
+          "cs_kubernetes_cluster_check_weekly"
         ]
       }
     },
@@ -660,6 +726,11 @@
           "artifacts_container_analysis_enabled",
           "iam_cloud_asset_inventory_enabled",
           "logging_sink_created"
+        ],
+        "alibabacloud": [
+          "securitycenter_vulnerability_scan_enabled",
+          "securitycenter_all_assets_agent_installed",
+          "ecs_instance_latest_os_patches_applied"
         ]
       }
     },
@@ -695,6 +766,9 @@
           "logging_sink_created",
           "logging_log_metric_filter_and_alert_for_project_ownership_changes_enabled",
           "logging_log_metric_filter_and_alert_for_audit_configuration_changes_enabled"
+        ],
+        "alibabacloud": [
+          "securitycenter_notification_enabled_high_risk"
         ]
       }
     },
@@ -770,6 +844,19 @@
           "cloudsql_instance_postgres_log_error_verbosity_flag",
           "cloudsql_instance_postgres_log_min_error_statement_flag",
           "cloudsql_instance_postgres_log_min_duration_statement_flag"
+        ],
+        "alibabacloud": [
+          "actiontrail_multi_region_enabled",
+          "actiontrail_oss_bucket_not_publicly_accessible",
+          "oss_bucket_logging_enabled",
+          "sls_logstore_retention_period",
+          "vpc_flow_logs_enabled",
+          "cs_kubernetes_log_service_enabled",
+          "rds_instance_sql_audit_enabled",
+          "rds_instance_sql_audit_retention",
+          "rds_instance_postgresql_log_connections_enabled",
+          "rds_instance_postgresql_log_disconnections_enabled",
+          "rds_instance_postgresql_log_duration_enabled"
         ]
       }
     },
@@ -809,6 +896,10 @@
           "compute_public_address_shodan",
           "iam_cloud_asset_inventory_enabled",
           "iam_audit_logs_enabled"
+        ],
+        "alibabacloud": [
+          "securitycenter_notification_enabled_high_risk",
+          "securitycenter_vulnerability_scan_enabled"
         ]
       }
     },
@@ -866,6 +957,21 @@
           "logging_log_metric_filter_and_alert_for_vpc_network_route_changes_enabled",
           "iam_organization_essential_contacts_configured",
           "logging_sink_created"
+        ],
+        "alibabacloud": [
+          "sls_management_console_authentication_failures_alert_enabled",
+          "sls_management_console_signin_without_mfa_alert_enabled",
+          "sls_root_account_usage_alert_enabled",
+          "sls_unauthorized_api_calls_alert_enabled",
+          "sls_ram_role_changes_alert_enabled",
+          "sls_oss_bucket_policy_changes_alert_enabled",
+          "sls_oss_permission_changes_alert_enabled",
+          "sls_rds_instance_configuration_changes_alert_enabled",
+          "sls_security_group_changes_alert_enabled",
+          "sls_vpc_changes_alert_enabled",
+          "sls_vpc_network_route_changes_alert_enabled",
+          "sls_cloud_firewall_changes_alert_enabled",
+          "sls_customer_created_cmk_changes_alert_enabled"
         ]
       }
     },
@@ -903,6 +1009,13 @@
           "compute_instance_shielded_vm_enabled",
           "compute_snapshot_not_outdated",
           "compute_public_address_shodan"
+        ],
+        "alibabacloud": [
+          "securitycenter_vulnerability_scan_enabled",
+          "securitycenter_advanced_or_enterprise_edition",
+          "ecs_instance_latest_os_patches_applied",
+          "cs_kubernetes_cluster_check_recent",
+          "cs_kubernetes_cluster_check_weekly"
         ]
       }
     },
@@ -960,6 +1073,11 @@
         ],
         "cloudflare": [
           "zone_min_tls_version_secure"
+        ],
+        "alibabacloud": [
+          "securitycenter_vulnerability_scan_enabled",
+          "ecs_instance_latest_os_patches_applied",
+          "ecs_instance_no_legacy_network"
         ]
       }
     },
@@ -1020,6 +1138,11 @@
         "cloudflare": [
           "zone_record_caa_exists",
           "dns_record_cname_target_valid"
+        ],
+        "alibabacloud": [
+          "ram_policy_no_administrative_privileges",
+          "oss_bucket_not_publicly_accessible",
+          "actiontrail_oss_bucket_not_publicly_accessible"
         ]
       }
     },
@@ -1071,6 +1194,11 @@
           "gke_cluster_no_default_service_account",
           "iam_account_access_approval_enabled",
           "apikeys_api_restrictions_configured"
+        ],
+        "alibabacloud": [
+          "ram_policy_no_administrative_privileges",
+          "ram_policy_attached_only_to_group_or_roles",
+          "ram_no_root_access_key"
         ]
       }
     },
@@ -1110,6 +1238,12 @@
           "artifacts_container_analysis_enabled",
           "compute_public_address_shodan",
           "logging_sink_created"
+        ],
+        "alibabacloud": [
+          "securitycenter_advanced_or_enterprise_edition",
+          "securitycenter_notification_enabled_high_risk",
+          "actiontrail_multi_region_enabled",
+          "sls_logstore_retention_period"
         ]
       }
     }

From 6d8d55361093f909f9ab5bcfff67cd58b8f11228 Mon Sep 17 00:00:00 2001
From: Josema Camacho <josema@prowler.com>
Date: Fri, 19 Jun 2026 12:49:49 +0200
Subject: [PATCH 100/126] fix(api): set gunicorn keep-alive above the load
 balancer idle timeout to stop 502s (#11647)

---
 api/CHANGELOG.md                   | 1 +
 api/src/backend/config/guniconf.py | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 8e2130fb88..a684591651 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -18,6 +18,7 @@ All notable changes to the **Prowler API** are documented in this file.
 ### 🐞 Fixed
 
 - Database connections no longer leak under the ASGI worker, which previously exhausted the read replica's connection slots and caused 500s on read endpoints [(#11640)](https://github.com/prowler-cloud/prowler/pull/11640)
+- Gunicorn keep-alive timeout now exceeds the load balancer idle timeout, stopping 502s from reused connections [(#11647)](https://github.com/prowler-cloud/prowler/pull/11647)
 
 ### 🔐 Security
 
diff --git a/api/src/backend/config/guniconf.py b/api/src/backend/config/guniconf.py
index 63472feec8..3b8b7dbe8c 100644
--- a/api/src/backend/config/guniconf.py
+++ b/api/src/backend/config/guniconf.py
@@ -56,6 +56,12 @@ preload_app = not DEBUG
 # that may take longer, such as complex API operations.
 timeout = env.int("GUNICORN_TIMEOUT", default=120)
 
+# HTTP keep-alive idle timeout. Must exceed the idle timeout of the proxy or load
+# balancer in front of gunicorn, or it reuses a connection gunicorn just closed
+# and returns a 502. Default clears the common 60s; raise `GUNICORN_KEEPALIVE` to
+# stay above a longer one.
+keepalive = env.int("GUNICORN_KEEPALIVE", default=75)
+
 # Logging
 logconfig_dict = DJANGO_LOGGERS
 gunicorn_logger = logging.getLogger(BackendLogger.GUNICORN)

From 218f64595a5ff681bb06ef76737da440e14d6a9f Mon Sep 17 00:00:00 2001
From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
Date: Fri, 19 Jun 2026 12:09:35 +0100
Subject: [PATCH 101/126] fix(metadata): tag IAM policy privilege escalation
 check (#11648)

---
 prowler/CHANGELOG.md                                           | 1 +
 .../iam_policy_allows_privilege_escalation.metadata.json       | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 8801277aab..aadd96bd44 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -45,6 +45,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 ### 🐞 Fixed
 
 - Azure PostgreSQL flexible server inventory no longer aborts the whole subscription when the `connection_throttle.enable` parameter is missing (e.g. PostgreSQL v18), and logs the expected "Entra ID authentication not enabled" case as a warning instead of an error, so servers are still scanned [(#11045)](https://github.com/prowler-cloud/prowler/pull/11045)
+- `iam_policy_allows_privilege_escalation` now includes the `privilege-escalation` category [(#11648)](https://github.com/prowler-cloud/prowler/pull/11648)
 
 ### 🔐 Security
 
diff --git a/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.metadata.json b/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.metadata.json
index 79b02882d7..4c7962242e 100644
--- a/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.metadata.json
+++ b/prowler/providers/aws/services/iam/iam_policy_allows_privilege_escalation/iam_policy_allows_privilege_escalation.metadata.json
@@ -37,7 +37,8 @@
     }
   },
   "Categories": [
-    "identity-access"
+    "identity-access",
+    "privilege-escalation"
   ],
   "DependsOn": [],
   "RelatedTo": [],

From bf3b5c2ba713e533014927141b64948c82c8f32e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Adri=C3=A1n=20Pe=C3=B1a?= <adrianjpr@gmail.com>
Date: Fri, 19 Jun 2026 13:38:51 +0200
Subject: [PATCH 102/126] Merge commit from fork

* fix(saml): cross-tenant account takeover via SAML domain claiming

* chore(changelog): add PR #

* fix(api): bind SAML tokens to validated domain

- Reject SAML assertions with mismatched email domains
- Issue SAML tokens from the validated ACS tenant
- Add regression coverage for cross-tenant SAML token issuance

* fix(api): resolve SAML tenant inside RLS context

- Load the SAML tenant relation before leaving the RLS transaction
- Avoid lazy tenant lookups during the SAML ACS finish flow

---------

Co-authored-by: Pepe Fagoaga <pepe@prowler.com>
---
 api/CHANGELOG.md                           |   8 +
 api/src/backend/api/adapters.py            |  44 ++++-
 api/src/backend/api/tests/test_adapters.py | 162 +++++++++++++++++--
 api/src/backend/api/tests/test_views.py    | 178 +++++++++++++++++----
 api/src/backend/api/v1/views.py            |  21 ++-
 5 files changed, 362 insertions(+), 51 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index a684591651..fe93dcf1b2 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -28,6 +28,14 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ---
 
+## [1.31.3] (Prowler v5.30.3)
+
+### 🔐 Security
+
+- SAML logins now link to an existing account only when the asserted email domain matches the ACS endpoint and the user is already a member of that domain's tenant, fixing a cross-tenant account takeover [(GHSA-h8m9-jgf8-vwvp)](https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp) [(#XXXXX)](https://github.com/prowler-cloud/prowler/pull/XXXXX)
+
+---
+
 ## [1.31.2] (Prowler v5.30.2)
 
 ### 🔄 Changed
diff --git a/api/src/backend/api/adapters.py b/api/src/backend/api/adapters.py
index e09dc972b4..1d0d2ace00 100644
--- a/api/src/backend/api/adapters.py
+++ b/api/src/backend/api/adapters.py
@@ -3,7 +3,14 @@ from django.db import transaction
 
 from api.db_router import MainRouter
 from api.db_utils import rls_transaction
-from api.models import Membership, Role, Tenant, User, UserRoleRelationship
+from api.models import (
+    Membership,
+    Role,
+    SAMLConfiguration,
+    Tenant,
+    User,
+    UserRoleRelationship,
+)
 
 
 class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
@@ -18,7 +25,42 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
         # Link existing accounts with the same email address
         email = sociallogin.account.extra_data.get("email")
         if sociallogin.provider.id == "saml":
+            # For SAML, the asserted NameID email cannot be trusted on its own:
+            # any tenant can claim any email domain in its SAML configuration. To
+            # prevent cross-tenant account takeover (GHSA-h8m9-jgf8-vwvp), only link
+            # the incoming SAML session to an existing account when (1) the email
+            # domain matches the tenant whose ACS endpoint is being used and (2) the
+            # existing user is already a member of that tenant.
             email = sociallogin.user.email
+            if not email:
+                return
+
+            domain = email.rsplit("@", 1)[-1].lower()
+            resolver_match = getattr(request, "resolver_match", None)
+            organization_slug = (
+                (resolver_match.kwargs or {}).get("organization_slug", "")
+                if resolver_match
+                else ""
+            ).lower()
+            # The ACS endpoint is scoped per email domain; reject mismatches so an
+            # attacker cannot replay an assertion through another tenant's endpoint.
+            if organization_slug != domain:
+                return
+
+            try:
+                saml_config = SAMLConfiguration.objects.using(MainRouter.admin_db).get(
+                    email_domain=domain
+                )
+            except SAMLConfiguration.DoesNotExist:
+                return
+
+            existing_user = self.get_user_by_email(email)
+            if existing_user and existing_user.is_member_of_tenant(
+                str(saml_config.tenant_id)
+            ):
+                sociallogin.connect(request, existing_user)
+            return
+
         if email:
             existing_user = self.get_user_by_email(email)
             if existing_user:
diff --git a/api/src/backend/api/tests/test_adapters.py b/api/src/backend/api/tests/test_adapters.py
index 22b44b3506..182e4ddc25 100644
--- a/api/src/backend/api/tests/test_adapters.py
+++ b/api/src/backend/api/tests/test_adapters.py
@@ -1,3 +1,4 @@
+from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -5,9 +6,48 @@ from allauth.socialaccount.models import SocialLogin
 from django.contrib.auth import get_user_model
 
 from api.adapters import ProwlerSocialAccountAdapter
+from api.db_router import MainRouter
+from api.models import SAMLConfiguration
 
 User = get_user_model()
 
+# Minimal, well-formed IdP metadata accepted by SAMLConfiguration._parse_metadata.
+VALID_METADATA = """<?xml version='1.0' encoding='UTF-8'?>
+<md:EntityDescriptor entityID='TEST' xmlns:md='urn:oasis:names:tc:SAML:2.0:metadata'>
+<md:IDPSSODescriptor WantAuthnRequestsSigned='false' protocolSupportEnumeration='urn:oasis:names:tc:SAML:2.0:protocol'>
+    <md:KeyDescriptor use='signing'>
+    <ds:KeyInfo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
+        <ds:X509Data>
+        <ds:X509Certificate>FAKECERTDATA</ds:X509Certificate>
+        </ds:X509Data>
+    </ds:KeyInfo>
+    </md:KeyDescriptor>
+    <md:SingleSignOnService Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' Location='https://idp.test/sso'/>
+</md:IDPSSODescriptor>
+</md:EntityDescriptor>
+"""
+
+
+def _saml_request(rf, organization_slug):
+    """Build an ACS request whose resolver_match carries the organization slug,
+    mirroring how Django populates it after routing the SAML ACS URL."""
+    request = rf.post(f"/api/v1/accounts/saml/{organization_slug}/acs/finish/")
+    request.resolver_match = SimpleNamespace(
+        kwargs={"organization_slug": organization_slug}
+    )
+    return request
+
+
+def _saml_sociallogin(user):
+    sociallogin = MagicMock(spec=SocialLogin)
+    sociallogin.account = MagicMock()
+    sociallogin.provider = MagicMock()
+    sociallogin.provider.id = "saml"
+    sociallogin.account.extra_data = {}
+    sociallogin.user = user
+    sociallogin.connect = MagicMock()
+    return sociallogin
+
 
 @pytest.mark.django_db
 class TestProwlerSocialAccountAdapter:
@@ -20,26 +60,99 @@ class TestProwlerSocialAccountAdapter:
         adapter = ProwlerSocialAccountAdapter()
         assert adapter.get_user_by_email("notfound@example.com") is None
 
-    def test_pre_social_login_links_existing_user(self, create_test_user, rf):
+    def test_pre_social_login_links_member_of_saml_tenant(
+        self, create_test_user, tenants_fixture, rf
+    ):
+        """A SAML login links to an existing account only when that user is
+        already a member of the tenant that owns the asserted email domain."""
         adapter = ProwlerSocialAccountAdapter()
+        # create_test_user (dev@prowler.com) is a member of tenant1.
+        domain = create_test_user.email.rsplit("@", 1)[-1]
+        SAMLConfiguration.objects.using(MainRouter.admin_db).create(
+            email_domain=domain,
+            metadata_xml=VALID_METADATA,
+            tenant=tenants_fixture[0],
+        )
 
-        sociallogin = MagicMock(spec=SocialLogin)
-        sociallogin.account = MagicMock()
-        sociallogin.provider = MagicMock()
-        sociallogin.provider.id = "saml"
-        sociallogin.account.extra_data = {}
-        sociallogin.user = create_test_user
-        sociallogin.connect = MagicMock()
-
-        adapter.pre_social_login(rf.get("/"), sociallogin)
+        sociallogin = _saml_sociallogin(create_test_user)
+        adapter.pre_social_login(_saml_request(rf, domain), sociallogin)
 
         call_args = sociallogin.connect.call_args
         assert call_args is not None
-
-        called_request, called_user = call_args[0]
-        assert called_request.path == "/"
+        _, called_user = call_args[0]
         assert called_user.email == create_test_user.email
 
+    def test_pre_social_login_blocks_cross_tenant_takeover(
+        self, create_test_user, tenants_fixture, rf
+    ):
+        """GHSA-h8m9-jgf8-vwvp: an attacker tenant that claims the victim's
+        email domain must NOT be able to link to the victim's account, because
+        the victim is not a member of the attacker's tenant."""
+        adapter = ProwlerSocialAccountAdapter()
+        domain = create_test_user.email.rsplit("@", 1)[-1]
+        # tenant3 is the attacker tenant; create_test_user is NOT a member of it.
+        attacker_tenant = tenants_fixture[2]
+        assert not create_test_user.is_member_of_tenant(str(attacker_tenant.id))
+        SAMLConfiguration.objects.using(MainRouter.admin_db).create(
+            email_domain=domain,
+            metadata_xml=VALID_METADATA,
+            tenant=attacker_tenant,
+        )
+
+        sociallogin = _saml_sociallogin(create_test_user)
+        adapter.pre_social_login(_saml_request(rf, domain), sociallogin)
+
+        sociallogin.connect.assert_not_called()
+
+    def test_pre_social_login_blocks_domain_slug_mismatch(
+        self, create_test_user, tenants_fixture, rf
+    ):
+        """The asserted email domain must match the ACS endpoint's slug, so an
+        assertion cannot be replayed through a different tenant's endpoint."""
+        adapter = ProwlerSocialAccountAdapter()
+        domain = create_test_user.email.rsplit("@", 1)[-1]
+        SAMLConfiguration.objects.using(MainRouter.admin_db).create(
+            email_domain=domain,
+            metadata_xml=VALID_METADATA,
+            tenant=tenants_fixture[0],
+        )
+
+        sociallogin = _saml_sociallogin(create_test_user)
+        # Slug points at a different domain than the asserted email.
+        adapter.pre_social_login(_saml_request(rf, "attacker.com"), sociallogin)
+
+        sociallogin.connect.assert_not_called()
+
+    def test_pre_social_login_blocks_when_no_saml_config(
+        self, create_test_user, tenants_fixture, rf
+    ):
+        """No SAML configuration for the domain means nothing to link against."""
+        adapter = ProwlerSocialAccountAdapter()
+        domain = create_test_user.email.rsplit("@", 1)[-1]
+
+        sociallogin = _saml_sociallogin(create_test_user)
+        adapter.pre_social_login(_saml_request(rf, domain), sociallogin)
+
+        sociallogin.connect.assert_not_called()
+
+    def test_pre_social_login_blocks_without_resolver_match(
+        self, create_test_user, tenants_fixture, rf
+    ):
+        """Fail closed: if the request has no resolver_match we cannot bind the
+        assertion to a tenant, so no linking happens."""
+        adapter = ProwlerSocialAccountAdapter()
+        domain = create_test_user.email.rsplit("@", 1)[-1]
+        SAMLConfiguration.objects.using(MainRouter.admin_db).create(
+            email_domain=domain,
+            metadata_xml=VALID_METADATA,
+            tenant=tenants_fixture[0],
+        )
+
+        sociallogin = _saml_sociallogin(create_test_user)
+        adapter.pre_social_login(rf.post("/"), sociallogin)
+
+        sociallogin.connect.assert_not_called()
+
     def test_pre_social_login_no_link_if_email_missing(self, rf):
         adapter = ProwlerSocialAccountAdapter()
 
@@ -47,14 +160,35 @@ class TestProwlerSocialAccountAdapter:
         sociallogin.account = MagicMock()
         sociallogin.provider = MagicMock()
         sociallogin.user = MagicMock()
+        sociallogin.user.email = ""
         sociallogin.provider.id = "saml"
         sociallogin.account.extra_data = {}
         sociallogin.connect = MagicMock()
 
-        adapter.pre_social_login(rf.get("/"), sociallogin)
+        adapter.pre_social_login(_saml_request(rf, "prowler.com"), sociallogin)
 
         sociallogin.connect.assert_not_called()
 
+    def test_pre_social_login_non_saml_links_by_email(self, create_test_user, rf):
+        """Non-SAML providers (e.g. Google/GitHub) still link to an existing
+        local account by email; the tenant binding only applies to SAML."""
+        adapter = ProwlerSocialAccountAdapter()
+
+        sociallogin = MagicMock(spec=SocialLogin)
+        sociallogin.account = MagicMock()
+        sociallogin.provider = MagicMock()
+        sociallogin.provider.id = "google"
+        sociallogin.account.extra_data = {"email": create_test_user.email}
+        sociallogin.user = create_test_user
+        sociallogin.connect = MagicMock()
+
+        adapter.pre_social_login(rf.get("/"), sociallogin)
+
+        call_args = sociallogin.connect.call_args
+        assert call_args is not None
+        _, called_user = call_args[0]
+        assert called_user.email == create_test_user.email
+
     def test_save_user_saml_sets_session_flag(self, rf):
         adapter = ProwlerSocialAccountAdapter()
         request = rf.get("/")
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index 35098c1907..49234777da 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -13586,7 +13586,9 @@ class TestTenantFinishACSView:
         )
 
         request = RequestFactory().get(
-            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+            reverse(
+                "saml_finish_acs", kwargs={"organization_slug": saml_setup["domain"]}
+            )
         )
         request.user = user
         request.session = {}
@@ -13606,18 +13608,23 @@ class TestTenantFinishACSView:
             patch("api.models.User.objects.get") as mock_user_get,
         ):
             mock_get_app_or_404.return_value = MagicMock(
-                provider="saml", client_id="testtenant", name="Test App", settings={}
+                provider="saml",
+                client_id=saml_setup["domain"],
+                name="Test App",
+                settings={},
             )
             mock_sa_get.return_value = social_account
             mock_socialapp_get.return_value = MagicMock(provider_id="saml")
             mock_saml_domain_get.return_value = SimpleNamespace(
                 tenant_id=tenants_fixture[0].id
             )
-            mock_saml_config_get.return_value = MagicMock()
+            mock_saml_config_get.return_value = SimpleNamespace(
+                email_domain=saml_setup["domain"], tenant=tenants_fixture[0]
+            )
             mock_user_get.return_value = user
 
             view = TenantFinishACSView.as_view()
-            response = view(request, organization_slug="testtenant")
+            response = view(request, organization_slug=saml_setup["domain"])
 
         assert response.status_code == 302
 
@@ -13665,6 +13672,79 @@ class TestTenantFinishACSView:
         user.company_name = original_company
         user.save()
 
+    def test_dispatch_rejects_assertion_email_domain_that_differs_from_slug(
+        self, tenants_fixture, saml_setup, monkeypatch
+    ):
+        monkeypatch.setenv("AUTH_URL", "http://localhost")
+        monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
+        victim_tenant = tenants_fixture[0]
+        attacker_tenant = tenants_fixture[1]
+        attacker_domain = "attacker.com"
+
+        SAMLConfiguration.objects.using(MainRouter.admin_db).create(
+            email_domain=attacker_domain,
+            metadata_xml="""<?xml version='1.0' encoding='UTF-8'?>
+                <md:EntityDescriptor entityID='ATTACKER' xmlns:md='urn:oasis:names:tc:SAML:2.0:metadata'>
+                <md:IDPSSODescriptor WantAuthnRequestsSigned='false' protocolSupportEnumeration='urn:oasis:names:tc:SAML:2.0:protocol'>
+                    <md:KeyDescriptor use='signing'>
+                    <ds:KeyInfo xmlns:ds='http://www.w3.org/2000/09/xmldsig#'>
+                        <ds:X509Data>
+                        <ds:X509Certificate>TEST</ds:X509Certificate>
+                        </ds:X509Data>
+                    </ds:KeyInfo>
+                    </md:KeyDescriptor>
+                    <md:SingleSignOnService Binding='urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST' Location='https://ATTACKER/sso/saml'/>
+                </md:IDPSSODescriptor>
+                </md:EntityDescriptor>
+            """,
+            tenant=attacker_tenant,
+        )
+        user = User.objects.using(MainRouter.admin_db).create(
+            email=f"intruder@{saml_setup['domain']}", name="Intruder"
+        )
+        social_account = SocialAccount(
+            user=user,
+            provider="ATTACKER",
+            extra_data={
+                "firstName": ["Mallory"],
+                "lastName": ["Example"],
+            },
+        )
+        request = RequestFactory().get(
+            reverse("saml_finish_acs", kwargs={"organization_slug": attacker_domain})
+        )
+        request.user = user
+        request.session = {}
+
+        with (
+            patch(
+                "allauth.socialaccount.providers.saml.views.get_app_or_404"
+            ) as mock_get_app_or_404,
+            patch(
+                "allauth.socialaccount.models.SocialAccount.objects.get"
+            ) as mock_sa_get,
+        ):
+            mock_get_app_or_404.return_value = MagicMock(
+                provider="saml",
+                provider_id="ATTACKER",
+                client_id=attacker_domain,
+                name="Attacker App",
+                settings={},
+            )
+            mock_sa_get.return_value = social_account
+
+            view = TenantFinishACSView.as_view()
+            response = view(request, organization_slug=attacker_domain)
+
+        assert response.status_code == 302
+        assert "sso_saml_failed=true" in response.url
+        assert not (
+            Membership.objects.using(MainRouter.admin_db)
+            .filter(user=user, tenant=victim_tenant)
+            .exists()
+        )
+        assert not SAMLToken.objects.using(MainRouter.admin_db).filter(user=user).exists()
+
     def test_rollback_saml_user_when_error_occurs(self, users_fixture, monkeypatch):
         """Test that a user is properly deleted when created during SAML flow and an error occurs"""
         monkeypatch.setenv("AUTH_URL", "http://localhost")
@@ -13734,7 +13814,9 @@ class TestTenantFinishACSView:
         )
 
         request = RequestFactory().get(
-            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+            reverse(
+                "saml_finish_acs", kwargs={"organization_slug": saml_setup["domain"]}
+            )
         )
         request.user = user
         request.session = {}
@@ -13754,16 +13836,21 @@ class TestTenantFinishACSView:
             patch("api.models.User.objects.get") as mock_user_get,
         ):
             mock_get_app_or_404.return_value = MagicMock(
-                provider="saml", client_id="testtenant", name="Test App", settings={}
+                provider="saml",
+                client_id=saml_setup["domain"],
+                name="Test App",
+                settings={},
             )
             mock_sa_get.return_value = social_account
             mock_socialapp_get.return_value = MagicMock(provider_id="saml")
             mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
-            mock_saml_config_get.return_value = MagicMock()
+            mock_saml_config_get.return_value = SimpleNamespace(
+                email_domain=saml_setup["domain"], tenant=tenant
+            )
             mock_user_get.return_value = user
 
             view = TenantFinishACSView.as_view()
-            response = view(request, organization_slug="testtenant")
+            response = view(request, organization_slug=saml_setup["domain"])
 
         assert response.status_code == 302
 
@@ -13802,7 +13889,9 @@ class TestTenantFinishACSView:
         )
 
         request = RequestFactory().get(
-            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+            reverse(
+                "saml_finish_acs", kwargs={"organization_slug": saml_setup["domain"]}
+            )
         )
         request.user = user
         request.session = {}
@@ -13822,16 +13911,21 @@ class TestTenantFinishACSView:
             patch("api.models.User.objects.get") as mock_user_get,
         ):
             mock_get_app_or_404.return_value = MagicMock(
-                provider="saml", client_id="testtenant", name="Test App", settings={}
+                provider="saml",
+                client_id=saml_setup["domain"],
+                name="Test App",
+                settings={},
             )
             mock_sa_get.return_value = social_account
             mock_socialapp_get.return_value = MagicMock(provider_id="saml")
             mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
-            mock_saml_config_get.return_value = MagicMock()
+            mock_saml_config_get.return_value = SimpleNamespace(
+                email_domain=saml_setup["domain"], tenant=tenant
+            )
             mock_user_get.return_value = user
 
             view = TenantFinishACSView.as_view()
-            response = view(request, organization_slug="testtenant")
+            response = view(request, organization_slug=saml_setup["domain"])
 
         assert response.status_code == 302
 
@@ -13881,7 +13975,9 @@ class TestTenantFinishACSView:
         )
 
         request = RequestFactory().get(
-            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+            reverse(
+                "saml_finish_acs", kwargs={"organization_slug": saml_setup["domain"]}
+            )
         )
         request.user = user
         request.session = {}
@@ -13901,16 +13997,21 @@ class TestTenantFinishACSView:
             patch("api.models.User.objects.get") as mock_user_get,
         ):
             mock_get_app_or_404.return_value = MagicMock(
-                provider="saml", client_id="testtenant", name="Test App", settings={}
+                provider="saml",
+                client_id=saml_setup["domain"],
+                name="Test App",
+                settings={},
             )
             mock_sa_get.return_value = social_account
             mock_socialapp_get.return_value = MagicMock(provider_id="saml")
             mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
-            mock_saml_config_get.return_value = MagicMock()
+            mock_saml_config_get.return_value = SimpleNamespace(
+                email_domain=saml_setup["domain"], tenant=tenant
+            )
             mock_user_get.return_value = user
 
             view = TenantFinishACSView.as_view()
-            response = view(request, organization_slug="testtenant")
+            response = view(request, organization_slug=saml_setup["domain"])
 
         assert response.status_code == 302
 
@@ -13959,7 +14060,9 @@ class TestTenantFinishACSView:
         )
 
         request = RequestFactory().get(
-            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+            reverse(
+                "saml_finish_acs", kwargs={"organization_slug": saml_setup["domain"]}
+            )
         )
         request.user = user
         request.session = {}
@@ -13979,16 +14082,21 @@ class TestTenantFinishACSView:
             patch("api.models.User.objects.get") as mock_user_get,
         ):
             mock_get_app_or_404.return_value = MagicMock(
-                provider="saml", client_id="testtenant", name="Test App", settings={}
+                provider="saml",
+                client_id=saml_setup["domain"],
+                name="Test App",
+                settings={},
             )
             mock_sa_get.return_value = social_account
             mock_socialapp_get.return_value = MagicMock(provider_id="saml")
             mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
-            mock_saml_config_get.return_value = MagicMock()
+            mock_saml_config_get.return_value = SimpleNamespace(
+                email_domain=saml_setup["domain"], tenant=tenant
+            )
             mock_user_get.return_value = user
 
             view = TenantFinishACSView.as_view()
-            response = view(request, organization_slug="testtenant")
+            response = view(request, organization_slug=saml_setup["domain"])
 
         assert response.status_code == 302
 
@@ -14043,7 +14151,9 @@ class TestTenantFinishACSView:
         )
 
         request = RequestFactory().get(
-            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+            reverse(
+                "saml_finish_acs", kwargs={"organization_slug": saml_setup["domain"]}
+            )
         )
         request.user = user
         request.session = {}
@@ -14063,16 +14173,21 @@ class TestTenantFinishACSView:
             patch("api.models.User.objects.get") as mock_user_get,
         ):
             mock_get_app_or_404.return_value = MagicMock(
-                provider="saml", client_id="testtenant", name="Test App", settings={}
+                provider="saml",
+                client_id=saml_setup["domain"],
+                name="Test App",
+                settings={},
             )
             mock_sa_get.return_value = social_account
             mock_socialapp_get.return_value = MagicMock(provider_id="saml")
             mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
-            mock_saml_config_get.return_value = MagicMock()
+            mock_saml_config_get.return_value = SimpleNamespace(
+                email_domain=saml_setup["domain"], tenant=tenant
+            )
             mock_user_get.return_value = user
 
             view = TenantFinishACSView.as_view()
-            response = view(request, organization_slug="testtenant")
+            response = view(request, organization_slug=saml_setup["domain"])
 
         assert response.status_code == 302
 
@@ -14126,7 +14241,9 @@ class TestTenantFinishACSView:
         )
 
         request = RequestFactory().get(
-            reverse("saml_finish_acs", kwargs={"organization_slug": "testtenant"})
+            reverse(
+                "saml_finish_acs", kwargs={"organization_slug": saml_setup["domain"]}
+            )
         )
         request.user = non_admin_user
         request.session = {}
@@ -14146,16 +14263,21 @@ class TestTenantFinishACSView:
             patch("api.models.User.objects.get") as mock_user_get,
         ):
             mock_get_app_or_404.return_value = MagicMock(
-                provider="saml", client_id="testtenant", name="Test App", settings={}
+                provider="saml",
+                client_id=saml_setup["domain"],
+                name="Test App",
+                settings={},
             )
             mock_sa_get.return_value = social_account
             mock_socialapp_get.return_value = MagicMock(provider_id="saml")
             mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
-            mock_saml_config_get.return_value = MagicMock()
+            mock_saml_config_get.return_value = SimpleNamespace(
+                email_domain=saml_setup["domain"], tenant=tenant
+            )
             mock_user_get.return_value = non_admin_user
 
             view = TenantFinishACSView.as_view()
-            response = view(request, organization_slug="testtenant")
+            response = view(request, organization_slug=saml_setup["domain"])
 
         assert response.status_code == 302
 
diff --git a/api/src/backend/api/v1/views.py b/api/src/backend/api/v1/views.py
index 4cf39cdce1..6b2616b289 100644
--- a/api/src/backend/api/v1/views.py
+++ b/api/src/backend/api/v1/views.py
@@ -767,7 +767,10 @@ class TenantFinishACSView(FinishACSView):
         try:
             check = SAMLDomainIndex.objects.get(email_domain=organization_slug)
             with rls_transaction(str(check.tenant_id)):
-                SAMLConfiguration.objects.get(tenant_id=str(check.tenant_id))
+                saml_config = SAMLConfiguration.objects.select_related("tenant").get(
+                    tenant_id=str(check.tenant_id)
+                )
+                tenant = saml_config.tenant
             social_app = SocialApp.objects.get(
                 provider="saml", client_id=organization_slug
             )
@@ -787,6 +790,15 @@ class TenantFinishACSView(FinishACSView):
             callback_url = env.str("AUTH_URL")
             return redirect(f"{callback_url}?sso_saml_failed=true")
 
+        requested_domain = organization_slug.lower()
+        configured_domain = saml_config.email_domain.lower()
+        email_domain = user.email.rsplit("@", 1)[-1].lower()
+        if configured_domain != requested_domain or email_domain != configured_domain:
+            logger.error("SAML email domain does not match requested organization")
+            self._rollback_saml_user(request)
+            callback_url = env.str("AUTH_URL")
+            return redirect(f"{callback_url}?sso_saml_failed=true")
+
         extra = social_account.extra_data
         user.first_name = (
             extra.get("firstName", [""])[0] if extra.get("firstName") else ""
@@ -800,13 +812,6 @@ class TenantFinishACSView(FinishACSView):
             user.name = "N/A"
         user.save()
 
-        email_domain = user.email.split("@")[-1]
-        tenant = (
-            SAMLConfiguration.objects.using(MainRouter.admin_db)
-            .get(email_domain=email_domain)
-            .tenant
-        )
-
         # Only remap roles when the IdP provides a userType attribute.
         # Without it, the user's current roles are left untouched.
         role_name = (

From 7f96d895bb5d8890b254ee9421e2844170219c16 Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Fri, 19 Jun 2026 13:48:47 +0200
Subject: [PATCH 103/126] fix: API changelog from advisory merge (#11649)

---
 api/CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index fe93dcf1b2..6073f71f0c 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -32,7 +32,7 @@ All notable changes to the **Prowler API** are documented in this file.
 
 ### 🔐 Security
 
-- SAML logins now link to an existing account only when the asserted email domain matches the ACS endpoint and the user is already a member of that domain's tenant, fixing a cross-tenant account takeover [(GHSA-h8m9-jgf8-vwvp)](https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp) [(#XXXXX)](https://github.com/prowler-cloud/prowler/pull/XXXXX)
+- SAML logins now link to an existing account only when the asserted email domain matches the ACS endpoint and the user is already a member of that domain's tenant, fixing a cross-tenant account takeover [(GHSA-h8m9-jgf8-vwvp)](https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp)
 
 ---
 

From a7917f779ae901de82e4428b70089e2f640921a0 Mon Sep 17 00:00:00 2001
From: Pepe Fagoaga <pepe@prowler.com>
Date: Fri, 19 Jun 2026 15:21:38 +0200
Subject: [PATCH 104/126] chore(sdk): changelog for v5.30.3 (#11651)

---
 prowler/CHANGELOG.md | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index aadd96bd44..29b2fd9ecc 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -37,7 +37,6 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Cloudflare provider, mapping existing Cloudflare edge/network checks across the applicable DORA pillars [(#11645)](https://github.com/prowler-cloud/prowler/pull/11645)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the AlibabaCloud provider, mapping existing AlibabaCloud checks across the applicable DORA pillars [(#11646)](https://github.com/prowler-cloud/prowler/pull/11646)
 
-
 ### 🔄 Changed
 
 - Replaced the unmaintained `awsipranges` dependency with a small standard-library helper for the `route53_dangling_ip_subdomain_takeover` check [(#9293)](https://github.com/prowler-cloud/prowler/pull/9293)
@@ -56,7 +55,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 ---
 
-## [5.30.3] (Prowler UNRELEASED)
+## [5.30.3] (Prowler v5.30.3)
 
 ### 🐞 Fixed
 

From ccc1f161d24c10d2c55bad9b35c533870852d229 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Mon, 22 Jun 2026 17:26:03 +0900
Subject: [PATCH 105/126] feat(gcp): add
 cloudfunction_function_not_publicly_accessible check (#11022)

Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../cloudfunction_function_inside_vpc.py      |   6 +-
 .../__init__.py                               |   0
 ...tion_not_publicly_accessible.metadata.json |  40 +++
 ...nction_function_not_publicly_accessible.py |  44 ++++
 .../cloudfunction/cloudfunction_service.py    |  62 +++++
 .../cloudfunction_function_inside_vpc_test.py |  11 +
 .../__init__.py                               |   0
 ...n_function_not_publicly_accessible_test.py | 216 +++++++++++++++++
 .../cloudfunction_service_test.py             | 229 +++++++++++++++++-
 10 files changed, 602 insertions(+), 7 deletions(-)
 create mode 100644 prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/__init__.py
 create mode 100644 prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible.metadata.json
 create mode 100644 prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible.py
 create mode 100644 tests/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/__init__.py
 create mode 100644 tests/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 29b2fd9ecc..bdb5f9abf0 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -12,6 +12,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `sagemaker_clarify_exists` check for AWS provider [(#11211)](https://github.com/prowler-cloud/prowler/pull/11211)
 - `cloudsql_instance_high_availability_enabled` check for GCP provider, verifying Cloud SQL primary instances use `REGIONAL` availability for automatic zone failover [(#11024)](https://github.com/prowler-cloud/prowler/pull/11024)
 - `cloudfunction_function_inside_vpc` check for GCP provider, verifying Cloud Functions have a Serverless VPC Access connector for private egress [(#11021)](https://github.com/prowler-cloud/prowler/pull/11021)
+- `cloudfunction_function_not_publicly_accessible` check for GCP provider, detecting Cloud Functions with `allUsers` or `allAuthenticatedUsers` IAM invocation bindings [(#11022)](https://github.com/prowler-cloud/prowler/pull/11022)
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 - `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py
index 46866b350d..3b28db7d8e 100644
--- a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc.py
@@ -25,7 +25,11 @@ class cloudfunction_function_inside_vpc(Check):
         for function in cloudfunction_client.functions:
             if function.state != "ACTIVE":
                 continue
-            report = Check_Report_GCP(metadata=self.metadata(), resource=function)
+            report = Check_Report_GCP(
+                metadata=self.metadata(),
+                resource=function,
+                resource_id=function.name,
+            )
             if function.vpc_connector:
                 report.status = "PASS"
                 report.status_extended = (
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/__init__.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible.metadata.json b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible.metadata.json
new file mode 100644
index 0000000000..8c9247b2bd
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible.metadata.json
@@ -0,0 +1,40 @@
+{
+  "Provider": "gcp",
+  "CheckID": "cloudfunction_function_not_publicly_accessible",
+  "CheckTitle": "Cloud Function is not publicly invocable",
+  "CheckType": [],
+  "ServiceName": "cloudfunction",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "cloudfunctions.googleapis.com/Function",
+  "Description": "Cloud Functions deny invocation to `allUsers` and `allAuthenticatedUsers`, so only **explicitly authorized identities or services** can trigger them.\n\nThe evaluation reviews each function's IAM policy bindings to confirm no public principals are granted invoker access.",
+  "Risk": "Publicly invocable Cloud Functions expose **business logic** to the internet and let any caller trigger execution. This enables **unauthorized data access** when the function returns sensitive output, **code execution** in shared environments, and **denial-of-wallet** attacks driven by uncontrolled invocation costs.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://cloud.google.com/functions/docs/securing/authenticating",
+    "https://cloud.google.com/iam/docs/overview"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "gcloud functions remove-iam-policy-binding <FUNCTION_NAME> --region=<REGION> --member=<allUsers|allAuthenticatedUsers> --role=roles/cloudfunctions.invoker",
+      "NativeIaC": "",
+      "Other": "1. In Google Cloud Console, go to Cloud Functions\n2. Select the function and open the Permissions tab\n3. Remove any binding with allUsers or allAuthenticatedUsers\n4. Grant invocation rights only to specific service accounts or user groups",
+      "Terraform": "```hcl\nresource \"google_cloudfunctions2_function_iam_binding\" \"<example_resource_name>\" {\n  project        = \"<example_resource_id>\"\n  location       = \"<example_resource_id>\"\n  cloud_function = \"<example_resource_name>\"\n  role           = \"roles/cloudfunctions.invoker\"\n  members        = [\"serviceAccount:<example_resource_id>\"] # Critical: never include allUsers or allAuthenticatedUsers\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Apply **least privilege** to Cloud Function invocation: grant `roles/cloudfunctions.invoker` only to specific service accounts or groups.\n\nFor externally exposed functions, front them with **API Gateway** or **Cloud Endpoints** that enforce authentication and rate limiting.",
+      "Url": "https://hub.prowler.com/check/cloudfunction_function_not_publicly_accessible"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "cloudfunction_function_inside_vpc",
+    "secretmanager_secret_not_publicly_accessible",
+    "cloudstorage_bucket_public_access"
+  ],
+  "Notes": "This check evaluates function-level IAM policies. Organization policy constraints/iam.allowedPolicyMemberDomains can prevent public bindings at the org level."
+}
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible.py
new file mode 100644
index 0000000000..14ee874f22
--- /dev/null
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible.py
@@ -0,0 +1,44 @@
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.cloudfunction.cloudfunction_client import (
+    cloudfunction_client,
+)
+
+
+class cloudfunction_function_not_publicly_accessible(Check):
+    """Check that Cloud Functions do not grant invocation rights to all users.
+
+    Verifies that no active Cloud Function has an IAM binding granting access
+    to `allUsers` or `allAuthenticatedUsers`. Non-`ACTIVE` functions are
+    skipped because their IAM bindings are transient.
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        """Execute the public-access check across all Cloud Functions.
+
+        Returns:
+            A list of `Check_Report_GCP` findings, one per active Cloud
+            Function. Status is `FAIL` when the function is invokable by
+            `allUsers` or `allAuthenticatedUsers` and `PASS` otherwise.
+        """
+        findings = []
+        for function in cloudfunction_client.functions:
+            if function.state != "ACTIVE":
+                continue
+            report = Check_Report_GCP(
+                metadata=self.metadata(),
+                resource=function,
+                resource_id=function.name,
+            )
+            if function.publicly_accessible:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Cloud Function {function.name} is publicly invocable "
+                    f"(allUsers or allAuthenticatedUsers IAM binding detected)."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Cloud Function {function.name} is not publicly accessible."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py b/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
index d1043151b7..9905c98748 100644
--- a/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
+++ b/prowler/providers/gcp/services/cloudfunction/cloudfunction_service.py
@@ -1,5 +1,6 @@
 from typing import Optional
 
+from googleapiclient import discovery
 from pydantic.v1 import BaseModel
 
 from prowler.lib.logger import logger
@@ -20,7 +21,9 @@ class CloudFunction(GCPService):
         """Initialize the service and preload Cloud Functions."""
         super().__init__("cloudfunctions", provider, api_version="v2")
         self.functions = []
+        self._run_client = None
         self._get_functions()
+        self._get_functions_iam_policy()
 
     def _get_functions(self) -> None:
         """Fetch Cloud Functions for every project and location."""
@@ -47,10 +50,13 @@ class CloudFunction(GCPService):
                                     service_config = fn.get("serviceConfig", {})
                                     self.functions.append(
                                         Function(
+                                            id=fn["name"],
                                             name=fn["name"].split("/")[-1],
                                             project_id=project_id,
                                             location=location_id,
                                             state=fn.get("state", "UNKNOWN"),
+                                            environment=fn.get("environment", "GEN_1"),
+                                            service=service_config.get("service"),
                                             vpc_connector=service_config.get(
                                                 "vpcConnector"
                                             ),
@@ -73,12 +79,68 @@ class CloudFunction(GCPService):
                     f"{project_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
                 )
 
+    def _get_functions_iam_policy(self) -> None:
+        """Fetch IAM policy for every Cloud Function in parallel.
+
+        For gen2 functions, IAM is delegated to the underlying Cloud Run
+        service, so a `run.googleapis.com` v2 client is required.
+        """
+        if any(f.environment == "GEN_2" for f in self.functions):
+            self._run_client = discovery.build(
+                "run",
+                "v2",
+                credentials=self.credentials,
+                num_retries=DEFAULT_RETRY_ATTEMPTS,
+            )
+        self.__threading_call__(self._get_function_iam_policy, self.functions)
+
+    def _get_function_iam_policy(self, function: "Function") -> None:
+        """Mark a Cloud Function as publicly accessible when bound to `allUsers` or `allAuthenticatedUsers`.
+
+        Cloud Functions gen2 delegates invocation IAM to its backing Cloud Run
+        service, so the binding is queried via the Run API. Gen1 functions are
+        queried through the Cloud Functions API directly.
+        """
+        try:
+            if function.environment == "GEN_2" and function.service:
+                response = (
+                    self._run_client.projects()
+                    .locations()
+                    .services()
+                    .getIamPolicy(resource=function.service)
+                    .execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+                )
+            else:
+                response = (
+                    self.client.projects()
+                    .locations()
+                    .functions()
+                    .getIamPolicy(resource=function.id)
+                    .execute(
+                        http=self.__get_AuthorizedHttp_client__(),
+                        num_retries=DEFAULT_RETRY_ATTEMPTS,
+                    )
+                )
+            for binding in response.get("bindings", []):
+                members = binding.get("members", [])
+                if "allUsers" in members or "allAuthenticatedUsers" in members:
+                    function.publicly_accessible = True
+                    break
+        except Exception as error:
+            logger.error(
+                f"{function.location} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
 
 class Function(BaseModel):
     """Cloud Function resource consumed by GCP checks."""
 
+    id: str
     name: str
     project_id: str
     location: str
     state: str
+    environment: str = "GEN_1"
+    service: Optional[str] = None
     vpc_connector: Optional[str] = None
+    publicly_accessible: bool = False
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py
index b764760538..8428e56d86 100644
--- a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py
+++ b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_inside_vpc/cloudfunction_function_inside_vpc_test.py
@@ -13,6 +13,13 @@ _CHECK_PATH = (
 _CLIENT_PATH = f"{_CHECK_PATH}.cloudfunction_client"
 
 
+def _function_id(name: str) -> str:
+    return (
+        f"projects/{GCP_PROJECT_ID}/locations/{GCP_US_CENTER1_LOCATION}"
+        f"/functions/{name}"
+    )
+
+
 class Test_cloudfunction_function_inside_vpc:
     def test_no_functions(self):
         cloudfunction_client = mock.MagicMock()
@@ -63,6 +70,7 @@ class Test_cloudfunction_function_inside_vpc:
             )
             cloudfunction_client.functions = [
                 Function(
+                    id=_function_id("fn-vpc"),
                     name="fn-vpc",
                     project_id=GCP_PROJECT_ID,
                     location=GCP_US_CENTER1_LOCATION,
@@ -106,6 +114,7 @@ class Test_cloudfunction_function_inside_vpc:
 
             cloudfunction_client.functions = [
                 Function(
+                    id=_function_id("fn-public"),
                     name="fn-public",
                     project_id=GCP_PROJECT_ID,
                     location=GCP_US_CENTER1_LOCATION,
@@ -149,6 +158,7 @@ class Test_cloudfunction_function_inside_vpc:
 
             cloudfunction_client.functions = [
                 Function(
+                    id=_function_id("fn-empty"),
                     name="fn-empty",
                     project_id=GCP_PROJECT_ID,
                     location=GCP_US_CENTER1_LOCATION,
@@ -184,6 +194,7 @@ class Test_cloudfunction_function_inside_vpc:
 
             cloudfunction_client.functions = [
                 Function(
+                    id=_function_id("fn-deploy"),
                     name="fn-deploy",
                     project_id=GCP_PROJECT_ID,
                     location=GCP_US_CENTER1_LOCATION,
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/__init__.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible_test.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible_test.py
new file mode 100644
index 0000000000..615890bd58
--- /dev/null
+++ b/tests/providers/gcp/services/cloudfunction/cloudfunction_function_not_publicly_accessible/cloudfunction_function_not_publicly_accessible_test.py
@@ -0,0 +1,216 @@
+from unittest import mock
+
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_PROJECT_ID,
+    GCP_US_CENTER1_LOCATION,
+    set_mocked_gcp_provider,
+)
+
+_CHECK_PATH = (
+    "prowler.providers.gcp.services.cloudfunction."
+    "cloudfunction_function_not_publicly_accessible."
+    "cloudfunction_function_not_publicly_accessible"
+)
+_CLIENT_PATH = f"{_CHECK_PATH}.cloudfunction_client"
+
+
+def _function_id(name: str) -> str:
+    return (
+        f"projects/{GCP_PROJECT_ID}/locations/{GCP_US_CENTER1_LOCATION}"
+        f"/functions/{name}"
+    )
+
+
+class Test_cloudfunction_function_not_publicly_accessible:
+    def test_no_functions(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_not_publicly_accessible.cloudfunction_function_not_publicly_accessible import (
+                cloudfunction_function_not_publicly_accessible,
+            )
+
+            cloudfunction_client.functions = []
+
+            check = cloudfunction_function_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_function_private(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_not_publicly_accessible.cloudfunction_function_not_publicly_accessible import (
+                cloudfunction_function_not_publicly_accessible,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    id=_function_id("fn-private"),
+                    name="fn-private",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    publicly_accessible=False,
+                )
+            ]
+
+            check = cloudfunction_function_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Cloud Function fn-private is not publicly accessible."
+            )
+            assert result[0].resource_id == "fn-private"
+            assert result[0].resource_name == "fn-private"
+            assert result[0].location == GCP_US_CENTER1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_function_publicly_accessible(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_not_publicly_accessible.cloudfunction_function_not_publicly_accessible import (
+                cloudfunction_function_not_publicly_accessible,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    id=_function_id("fn-public"),
+                    name="fn-public",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    publicly_accessible=True,
+                )
+            ]
+
+            check = cloudfunction_function_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                "Cloud Function fn-public is publicly invocable "
+                "(allUsers or allAuthenticatedUsers IAM binding detected)."
+            )
+            assert result[0].resource_id == "fn-public"
+            assert result[0].resource_name == "fn-public"
+            assert result[0].location == GCP_US_CENTER1_LOCATION
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_multiple_functions_mixed(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_not_publicly_accessible.cloudfunction_function_not_publicly_accessible import (
+                cloudfunction_function_not_publicly_accessible,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    id=_function_id("fn-private"),
+                    name="fn-private",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    publicly_accessible=False,
+                ),
+                Function(
+                    id=_function_id("fn-public"),
+                    name="fn-public",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="ACTIVE",
+                    publicly_accessible=True,
+                ),
+            ]
+
+            check = cloudfunction_function_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 2
+
+            by_id = {r.resource_id: r for r in result}
+            assert by_id["fn-private"].status == "PASS"
+            assert by_id["fn-public"].status == "FAIL"
+
+    def test_inactive_function_skipped(self):
+        cloudfunction_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=cloudfunction_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_function_not_publicly_accessible.cloudfunction_function_not_publicly_accessible import (
+                cloudfunction_function_not_publicly_accessible,
+            )
+            from prowler.providers.gcp.services.cloudfunction.cloudfunction_service import (
+                Function,
+            )
+
+            cloudfunction_client.functions = [
+                Function(
+                    id=_function_id("fn-deleting"),
+                    name="fn-deleting",
+                    project_id=GCP_PROJECT_ID,
+                    location=GCP_US_CENTER1_LOCATION,
+                    state="DELETING",
+                    publicly_accessible=True,
+                )
+            ]
+
+            check = cloudfunction_function_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 0
diff --git a/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py b/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
index 82f77a939f..d97b80336b 100644
--- a/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
+++ b/tests/providers/gcp/services/cloudfunction/cloudfunction_service_test.py
@@ -11,12 +11,18 @@ from tests.providers.gcp.gcp_fixtures import (
 
 _LOCATION_ID = "us-central1"
 _FUNCTION_NAME = "my-function"
+_FUNCTION_ID = (
+    f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/functions/{_FUNCTION_NAME}"
+)
+_RUN_SERVICE = (
+    f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/services/{_FUNCTION_NAME}"
+)
 _CONNECTOR = (
     f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/connectors/my-connector"
 )
 
 
-def _make_cloudfunction_client(functions_list):
+def _make_cloudfunction_client(functions_list, iam_bindings=None):
     """Return a mock GCP API client for the Cloud Functions v2 service."""
     client = MagicMock()
 
@@ -30,6 +36,29 @@ def _make_cloudfunction_client(functions_list):
     }
     client.projects().locations().functions().list_next.return_value = None
 
+    iam_response = {"bindings": iam_bindings or []}
+
+    def mock_get_iam_policy(resource):
+        rv = MagicMock()
+        rv.execute.return_value = iam_response
+        return rv
+
+    client.projects().locations().functions().getIamPolicy = mock_get_iam_policy
+
+    return client
+
+
+def _make_run_client(iam_bindings=None):
+    """Return a mock Cloud Run v2 client for gen2 IAM policy lookups."""
+    client = MagicMock()
+    iam_response = {"bindings": iam_bindings or []}
+
+    def mock_get_iam_policy(resource):
+        rv = MagicMock()
+        rv.execute.return_value = iam_response
+        return rv
+
+    client.projects().locations().services().getIamPolicy = mock_get_iam_policy
     return client
 
 
@@ -39,9 +68,11 @@ class TestCloudFunctionService:
             return _make_cloudfunction_client(
                 functions_list=[
                     {
-                        "name": f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/functions/{_FUNCTION_NAME}",
+                        "name": _FUNCTION_ID,
                         "state": "ACTIVE",
+                        "environment": "GEN_2",
                         "serviceConfig": {
+                            "service": _RUN_SERVICE,
                             "vpcConnector": _CONNECTOR,
                         },
                     }
@@ -57,6 +88,10 @@ class TestCloudFunctionService:
                 "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
                 new=mock_api_client,
             ),
+            patch(
+                "prowler.providers.gcp.services.cloudfunction.cloudfunction_service.discovery.build",
+                return_value=_make_run_client(),
+            ),
         ):
             cf_client = CloudFunction(
                 set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
@@ -64,11 +99,15 @@ class TestCloudFunctionService:
 
             assert len(cf_client.functions) == 1
             fn = cf_client.functions[0]
+            assert fn.id == _FUNCTION_ID
             assert fn.name == _FUNCTION_NAME
             assert fn.project_id == GCP_PROJECT_ID
             assert fn.location == _LOCATION_ID
             assert fn.state == "ACTIVE"
+            assert fn.environment == "GEN_2"
+            assert fn.service == _RUN_SERVICE
             assert fn.vpc_connector == _CONNECTOR
+            assert fn.publicly_accessible is False
 
     def test_get_functions_without_vpc_connector(self):
         def mock_api_client(*args, **kwargs):
@@ -77,11 +116,190 @@ class TestCloudFunctionService:
                     {
                         "name": f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/functions/no-vpc-func",
                         "state": "ACTIVE",
-                        "serviceConfig": {},
+                        "environment": "GEN_2",
+                        "serviceConfig": {
+                            "service": f"projects/{GCP_PROJECT_ID}/locations/{_LOCATION_ID}/services/no-vpc-func",
+                        },
                     }
                 ]
             )
 
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.cloudfunction.cloudfunction_service.discovery.build",
+                return_value=_make_run_client(),
+            ),
+        ):
+            cf_client = CloudFunction(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(cf_client.functions) == 1
+            fn = cf_client.functions[0]
+            assert fn.name == "no-vpc-func"
+            assert fn.vpc_connector is None
+            assert fn.publicly_accessible is False
+
+    def test_get_functions_iam_policy_gen2_all_users(self):
+        """Gen2 functions: allUsers binding lives on the Cloud Run service."""
+
+        def mock_api_client(*args, **kwargs):
+            return _make_cloudfunction_client(
+                functions_list=[
+                    {
+                        "name": _FUNCTION_ID,
+                        "state": "ACTIVE",
+                        "environment": "GEN_2",
+                        "serviceConfig": {"service": _RUN_SERVICE},
+                    }
+                ]
+            )
+
+        run_client = _make_run_client(
+            iam_bindings=[
+                {
+                    "role": "roles/run.invoker",
+                    "members": ["allUsers"],
+                }
+            ]
+        )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.cloudfunction.cloudfunction_service.discovery.build",
+                return_value=run_client,
+            ),
+        ):
+            cf_client = CloudFunction(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(cf_client.functions) == 1
+            assert cf_client.functions[0].publicly_accessible is True
+
+    def test_get_functions_iam_policy_gen2_all_authenticated_users(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_cloudfunction_client(
+                functions_list=[
+                    {
+                        "name": _FUNCTION_ID,
+                        "state": "ACTIVE",
+                        "environment": "GEN_2",
+                        "serviceConfig": {"service": _RUN_SERVICE},
+                    }
+                ]
+            )
+
+        run_client = _make_run_client(
+            iam_bindings=[
+                {
+                    "role": "roles/run.invoker",
+                    "members": ["allAuthenticatedUsers"],
+                }
+            ]
+        )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.cloudfunction.cloudfunction_service.discovery.build",
+                return_value=run_client,
+            ),
+        ):
+            cf_client = CloudFunction(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(cf_client.functions) == 1
+            assert cf_client.functions[0].publicly_accessible is True
+
+    def test_get_functions_iam_policy_gen2_not_public(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_cloudfunction_client(
+                functions_list=[
+                    {
+                        "name": _FUNCTION_ID,
+                        "state": "ACTIVE",
+                        "environment": "GEN_2",
+                        "serviceConfig": {"service": _RUN_SERVICE},
+                    }
+                ]
+            )
+
+        run_client = _make_run_client(
+            iam_bindings=[
+                {
+                    "role": "roles/run.invoker",
+                    "members": ["serviceAccount:sa@project.iam.gserviceaccount.com"],
+                }
+            ]
+        )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+            patch(
+                "prowler.providers.gcp.services.cloudfunction.cloudfunction_service.discovery.build",
+                return_value=run_client,
+            ),
+        ):
+            cf_client = CloudFunction(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(cf_client.functions) == 1
+            assert cf_client.functions[0].publicly_accessible is False
+
+    def test_get_functions_iam_policy_gen1_all_users(self):
+        """Gen1 functions: IAM binding lives on the Cloud Functions resource itself."""
+
+        def mock_api_client(*args, **kwargs):
+            return _make_cloudfunction_client(
+                functions_list=[
+                    {
+                        "name": _FUNCTION_ID,
+                        "state": "ACTIVE",
+                        "environment": "GEN_1",
+                        "serviceConfig": {},
+                    }
+                ],
+                iam_bindings=[
+                    {
+                        "role": "roles/cloudfunctions.invoker",
+                        "members": ["allUsers"],
+                    }
+                ],
+            )
+
         with (
             patch(
                 "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
@@ -97,6 +315,5 @@ class TestCloudFunctionService:
             )
 
             assert len(cf_client.functions) == 1
-            fn = cf_client.functions[0]
-            assert fn.name == "no-vpc-func"
-            assert fn.vpc_connector is None
+            assert cf_client.functions[0].environment == "GEN_1"
+            assert cf_client.functions[0].publicly_accessible is True

From 8a1d7bcd6b0013009211e7cc253679ac2bc55b1e Mon Sep 17 00:00:00 2001
From: varunmamillapalli <varunmamillapalli@gmail.com>
Date: Mon, 22 Jun 2026 05:19:20 -0400
Subject: [PATCH 106/126] feat(linode): add provider with administration
 compute and networking services (#11633)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 .github/labeler.yml                           |   5 +
 .github/workflows/sdk-tests.yml               |  24 ++
 README.md                                     |   1 +
 docs/docs.json                                |   7 +
 .../providers/linode/authentication.mdx       |  97 +++++
 .../linode/getting-started-linode.mdx         |  61 ++++
 prowler/CHANGELOG.md                          |   1 +
 prowler/__main__.py                           |   5 +
 prowler/compliance/linode/__init__.py         |   0
 prowler/config/config.py                      |   1 +
 prowler/config/linode_mutelist_example.yaml   |  18 +
 prowler/lib/check/check.py                    |   4 +
 prowler/lib/check/models.py                   |  31 ++
 prowler/lib/cli/parser.py                     |   8 +-
 prowler/lib/outputs/finding.py                |  18 +
 prowler/lib/outputs/html/html.py              |  57 +++
 prowler/lib/outputs/outputs.py                |   2 +
 prowler/lib/outputs/summary_table.py          |   5 +
 prowler/providers/common/provider.py          |  10 +
 prowler/providers/linode/__init__.py          |   0
 .../providers/linode/exceptions/__init__.py   |   0
 .../providers/linode/exceptions/exceptions.py | 106 ++++++
 prowler/providers/linode/lib/__init__.py      |   0
 .../linode/lib/arguments/__init__.py          |   0
 .../linode/lib/arguments/arguments.py         |  24 ++
 .../providers/linode/lib/mutelist/__init__.py |   0
 .../providers/linode/lib/mutelist/mutelist.py |  30 ++
 .../providers/linode/lib/service/__init__.py  |   0
 .../providers/linode/lib/service/service.py   |  86 +++++
 prowler/providers/linode/linode_provider.py   | 343 ++++++++++++++++++
 prowler/providers/linode/models.py            |  38 ++
 prowler/providers/linode/services/__init__.py |   0
 .../services/administration/__init__.py       |   0
 .../administration/administration_client.py   |   6 +
 .../administration/administration_service.py  |  46 +++
 .../__init__.py                               |   0
 ...inistration_user_2fa_enabled.metadata.json |  36 ++
 .../administration_user_2fa_enabled.py        |  41 +++
 .../linode/services/compute/__init__.py       |   0
 .../linode/services/compute/compute_client.py |   4 +
 .../__init__.py                               |   0
 ...ute_instance_backups_enabled.metadata.json |  37 ++
 .../compute_instance_backups_enabled.py       |  40 ++
 .../__init__.py                               |   0
 ...ance_disk_encryption_enabled.metadata.json |  37 ++
 ...ompute_instance_disk_encryption_enabled.py |  42 +++
 .../__init__.py                               |   0
 ...te_instance_watchdog_enabled.metadata.json |  36 ++
 .../compute_instance_watchdog_enabled.py      |  40 ++
 .../services/compute/compute_service.py       |  99 +++++
 .../linode/services/networking/__init__.py    |   0
 .../services/networking/networking_client.py  |   6 +
 .../__init__.py                               |   0
 ...firewall_assigned_to_devices.metadata.json |  38 ++
 ...networking_firewall_assigned_to_devices.py |  52 +++
 .../__init__.py                               |   0
 ..._default_inbound_policy_drop.metadata.json |  38 ++
 ...ng_firewall_default_inbound_policy_drop.py |  42 +++
 .../__init__.py                               |   0
 ...default_outbound_policy_drop.metadata.json |  38 ++
 ...g_firewall_default_outbound_policy_drop.py |  42 +++
 .../__init__.py                               |   0
 ...all_inbound_rules_configured.metadata.json |  38 ++
 ...rking_firewall_inbound_rules_configured.py |  42 +++
 .../__init__.py                               |   0
 ...ll_outbound_rules_configured.metadata.json |  38 ++
 ...king_firewall_outbound_rules_configured.py |  42 +++
 .../__init__.py                               |   0
 ...king_firewall_status_enabled.metadata.json |  38 ++
 .../networking_firewall_status_enabled.py     |  42 +++
 .../services/networking/networking_service.py | 127 +++++++
 pyproject.toml                                |   3 +
 tests/lib/cli/parser_test.py                  |   3 +-
 tests/lib/outputs/finding_test.py             |  81 +++++
 .../mutelist/fixtures/linode_mutelist.yaml    |   9 +
 .../lib/mutelist/linode_mutelist_test.py      |  98 +++++
 tests/providers/linode/linode_fixtures.py     |  34 ++
 .../providers/linode/linode_metadata_test.py  |  46 +++
 .../providers/linode/linode_provider_test.py  | 146 ++++++++
 .../administration_user_2fa_enabled_test.py   |  97 +++++
 .../linode_administration_service_test.py     | 102 ++++++
 .../compute_instance_backups_enabled_test.py  | 109 ++++++
 ...e_instance_disk_encryption_enabled_test.py | 109 ++++++
 .../compute_instance_watchdog_enabled_test.py | 109 ++++++
 .../compute/linode_compute_service_test.py    | 143 ++++++++
 .../linode_networking_service_test.py         | 193 ++++++++++
 ...rking_firewall_assigned_to_devices_test.py | 142 ++++++++
 ...rewall_default_inbound_policy_drop_test.py | 105 ++++++
 ...ewall_default_outbound_policy_drop_test.py | 105 ++++++
 ..._firewall_inbound_rules_configured_test.py | 117 ++++++
 ...firewall_outbound_rules_configured_test.py | 117 ++++++
 ...networking_firewall_status_enabled_test.py | 105 ++++++
 uv.lock                                       |  36 ++
 93 files changed, 4074 insertions(+), 4 deletions(-)
 create mode 100644 docs/user-guide/providers/linode/authentication.mdx
 create mode 100644 docs/user-guide/providers/linode/getting-started-linode.mdx
 create mode 100644 prowler/compliance/linode/__init__.py
 create mode 100644 prowler/config/linode_mutelist_example.yaml
 create mode 100644 prowler/providers/linode/__init__.py
 create mode 100644 prowler/providers/linode/exceptions/__init__.py
 create mode 100644 prowler/providers/linode/exceptions/exceptions.py
 create mode 100644 prowler/providers/linode/lib/__init__.py
 create mode 100644 prowler/providers/linode/lib/arguments/__init__.py
 create mode 100644 prowler/providers/linode/lib/arguments/arguments.py
 create mode 100644 prowler/providers/linode/lib/mutelist/__init__.py
 create mode 100644 prowler/providers/linode/lib/mutelist/mutelist.py
 create mode 100644 prowler/providers/linode/lib/service/__init__.py
 create mode 100644 prowler/providers/linode/lib/service/service.py
 create mode 100644 prowler/providers/linode/linode_provider.py
 create mode 100644 prowler/providers/linode/models.py
 create mode 100644 prowler/providers/linode/services/__init__.py
 create mode 100644 prowler/providers/linode/services/administration/__init__.py
 create mode 100644 prowler/providers/linode/services/administration/administration_client.py
 create mode 100644 prowler/providers/linode/services/administration/administration_service.py
 create mode 100644 prowler/providers/linode/services/administration/administration_user_2fa_enabled/__init__.py
 create mode 100644 prowler/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled.metadata.json
 create mode 100644 prowler/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled.py
 create mode 100644 prowler/providers/linode/services/compute/__init__.py
 create mode 100644 prowler/providers/linode/services/compute/compute_client.py
 create mode 100644 prowler/providers/linode/services/compute/compute_instance_backups_enabled/__init__.py
 create mode 100644 prowler/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled.metadata.json
 create mode 100644 prowler/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled.py
 create mode 100644 prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/__init__.py
 create mode 100644 prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled.metadata.json
 create mode 100644 prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled.py
 create mode 100644 prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/__init__.py
 create mode 100644 prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled.metadata.json
 create mode 100644 prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled.py
 create mode 100644 prowler/providers/linode/services/compute/compute_service.py
 create mode 100644 prowler/providers/linode/services/networking/__init__.py
 create mode 100644 prowler/providers/linode/services/networking/networking_client.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/__init__.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices.metadata.json
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/__init__.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop.metadata.json
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/__init__.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop.metadata.json
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/__init__.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured.metadata.json
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/__init__.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured.metadata.json
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_status_enabled/__init__.py
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled.metadata.json
 create mode 100644 prowler/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled.py
 create mode 100644 prowler/providers/linode/services/networking/networking_service.py
 create mode 100644 tests/providers/linode/lib/mutelist/fixtures/linode_mutelist.yaml
 create mode 100644 tests/providers/linode/lib/mutelist/linode_mutelist_test.py
 create mode 100644 tests/providers/linode/linode_fixtures.py
 create mode 100644 tests/providers/linode/linode_metadata_test.py
 create mode 100644 tests/providers/linode/linode_provider_test.py
 create mode 100644 tests/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled_test.py
 create mode 100644 tests/providers/linode/services/administration/linode_administration_service_test.py
 create mode 100644 tests/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled_test.py
 create mode 100644 tests/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled_test.py
 create mode 100644 tests/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled_test.py
 create mode 100644 tests/providers/linode/services/compute/linode_compute_service_test.py
 create mode 100644 tests/providers/linode/services/networking/linode_networking_service_test.py
 create mode 100644 tests/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices_test.py
 create mode 100644 tests/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop_test.py
 create mode 100644 tests/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop_test.py
 create mode 100644 tests/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured_test.py
 create mode 100644 tests/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured_test.py
 create mode 100644 tests/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled_test.py

diff --git a/.github/labeler.yml b/.github/labeler.yml
index 1b0dfd0400..b9abb1dfd0 100644
--- a/.github/labeler.yml
+++ b/.github/labeler.yml
@@ -77,6 +77,11 @@ provider/okta:
       - any-glob-to-any-file: "prowler/providers/okta/**"
       - any-glob-to-any-file: "tests/providers/okta/**"
 
+provider/linode:
+  - changed-files:
+      - any-glob-to-any-file: "prowler/providers/linode/**"
+      - any-glob-to-any-file: "tests/providers/linode/**"
+
 github_actions:
   - changed-files:
       - any-glob-to-any-file: ".github/workflows/*"
diff --git a/.github/workflows/sdk-tests.yml b/.github/workflows/sdk-tests.yml
index 2952ebc2d5..4fc6cab0b7 100644
--- a/.github/workflows/sdk-tests.yml
+++ b/.github/workflows/sdk-tests.yml
@@ -590,6 +590,30 @@ jobs:
           flags: prowler-py${{ matrix.python-version }}-stackit
           files: ./stackit_coverage.xml
 
+      # Linode Provider
+      - name: Check if Linode files changed
+        if: steps.check-changes.outputs.any_changed == 'true'
+        id: changed-linode
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            ./prowler/**/linode/**
+            ./tests/**/linode/**
+            ./uv.lock
+
+      - name: Run Linode tests
+        if: steps.changed-linode.outputs.any_changed == 'true'
+        run: uv run pytest -n auto --cov=./prowler/providers/linode --cov-report=xml:linode_coverage.xml tests/providers/linode
+
+      - name: Upload Linode coverage to Codecov
+        if: steps.changed-linode.outputs.any_changed == 'true'
+        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        with:
+          flags: prowler-py${{ matrix.python-version }}-linode
+          files: ./linode_coverage.xml
+
       # External Provider (dynamic loading)
       - name: Check if External Provider files changed
         if: steps.check-changes.outputs.any_changed == 'true'
diff --git a/README.md b/README.md
index 74e91021ca..1886377869 100644
--- a/README.md
+++ b/README.md
@@ -121,6 +121,7 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 | OpenStack | 34 | 5 | 0 | 9 | Official | UI, API, CLI |
 | Vercel | 26 | 6 | 0 | 8 | Official | UI, API, CLI |
 | Okta | 1 | 1 | 0 | 1 | Official | CLI |
+| Linode [Contact us](https://prowler.com/contact) | 10 | 3 | 0 | 4 | Unofficial | CLI |
 | Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 0 | 1 | Unofficial | CLI |
 | StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 0 | 3 | Unofficial | CLI |
 | NHN | 6 | 2 | 1 | 0 | Unofficial | CLI |
diff --git a/docs/docs.json b/docs/docs.json
index a74aa7e91d..5b88b5d2da 100644
--- a/docs/docs.json
+++ b/docs/docs.json
@@ -359,6 +359,13 @@
                   "user-guide/providers/okta/getting-started-okta",
                   "user-guide/providers/okta/authentication"
                 ]
+              },
+              {
+                "group": "Linode",
+                "pages": [
+                  "user-guide/providers/linode/getting-started-linode",
+                  "user-guide/providers/linode/authentication"
+                ]
               }
             ]
           },
diff --git a/docs/user-guide/providers/linode/authentication.mdx b/docs/user-guide/providers/linode/authentication.mdx
new file mode 100644
index 0000000000..feac121f40
--- /dev/null
+++ b/docs/user-guide/providers/linode/authentication.mdx
@@ -0,0 +1,97 @@
+---
+title: "Linode Authentication in Prowler"
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+<VersionBadge version="5.31.0" />
+
+Prowler for Linode uses a **Personal Access Token** (PAT) for authentication. Prowler reads the token **exclusively** from the `LINODE_TOKEN` environment variable, so the secret is never exposed in shell history or process listings. There are no credential CLI flags.
+
+## Required Permissions
+
+Prowler requires read-only access to your Linode account. The following OAuth scopes are needed on the Personal Access Token:
+
+| Scope | Access | Description |
+|-------|--------|-------------|
+| `account` | `Read Only` | Required to list users and verify account identity |
+| `linodes` | `Read Only` | Required to list instances and their configurations |
+| `firewall` | `Read Only` | Required to list firewalls and their rules |
+
+<Warning>
+Ensure the token has all required scopes. Missing permissions will cause some checks to fail or return incomplete results.
+</Warning>
+
+---
+
+## Personal Access Token
+
+### Step 1: Create a Personal Access Token
+
+1. Log into the [Linode Cloud Manager](https://cloud.linode.com).
+2. Click on your username in the top-right corner, then select **API Tokens** under the "My Profile" section.
+3. Click **Create a Personal Access Token**.
+4. Configure the token:
+   - **Label:** A descriptive name (e.g., "Prowler Security Scanner")
+   - **Expiry:** Set an appropriate expiration (e.g., 6 months)
+   - **Permissions:** Set the following scopes to **Read Only**:
+     - Account
+     - Linodes
+     - Firewall
+   - All other scopes can be set to **No Access**
+5. Click **Create Token**.
+6. Copy the token immediately — it will not be shown again.
+
+### Step 2: Configure Authentication
+
+Set the `LINODE_TOKEN` environment variable:
+
+```bash
+export LINODE_TOKEN="your-personal-access-token"
+```
+
+Then run Prowler:
+
+```bash
+prowler linode
+```
+
+---
+
+## Verifying Authentication
+
+To verify that Prowler can connect to your Linode account, run:
+
+```bash
+prowler linode --list-checks
+```
+
+If authentication succeeds, you will see a list of available checks. If it fails, Prowler will display an error message indicating the credentials issue.
+
+---
+
+## CI/CD Integration
+
+For automated pipelines, set the token as a secret environment variable:
+
+**GitHub Actions:**
+
+```yaml
+env:
+  LINODE_TOKEN: ${{ secrets.LINODE_TOKEN }}
+
+steps:
+  - name: Run Prowler
+    run: prowler linode
+```
+
+**GitLab CI:**
+
+```yaml
+variables:
+  LINODE_TOKEN: $LINODE_TOKEN
+
+prowler_scan:
+  script:
+    - prowler linode
+```
diff --git a/docs/user-guide/providers/linode/getting-started-linode.mdx b/docs/user-guide/providers/linode/getting-started-linode.mdx
new file mode 100644
index 0000000000..128fdf1c90
--- /dev/null
+++ b/docs/user-guide/providers/linode/getting-started-linode.mdx
@@ -0,0 +1,61 @@
+---
+title: 'Getting Started With Linode on Prowler'
+---
+
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
+<VersionBadge version="5.31.0" />
+
+Prowler for Linode scans your Linode infrastructure for security misconfigurations, including compute settings, networking rules, user account security, and more.
+
+<Note>
+Linode support in Prowler is community-maintained. For commercial support or to request additional service coverage, [contact us](https://prowler.com/contact).
+</Note>
+
+## Prerequisites
+
+Set up authentication for Linode with the [Linode Authentication](/user-guide/providers/linode/authentication) guide before starting:
+
+- Create a Linode Personal Access Token with read-only permissions
+- The token requires at minimum: `account:read_only`, `linodes:read_only`, and `firewall:read_only` scopes
+
+## Prowler CLI
+
+### Run Prowler for Linode
+
+Once authenticated with a Personal Access Token, set the `LINODE_TOKEN` environment variable and run Prowler for Linode. Prowler reads the token exclusively from the environment variable, so the secret is never exposed in shell history or process listings:
+
+```bash
+export LINODE_TOKEN="your-personal-access-token"
+prowler linode
+```
+
+### Run Specific Checks
+
+```bash
+prowler linode --checks compute_instance_backups_enabled compute_instance_watchdog_enabled
+```
+
+### Run a Specific Service
+
+```bash
+prowler linode --services networking
+```
+
+### Scan Specific Regions
+
+Use `--region` (alias `--filter-region` / `-f`) to limit the scan to one or more Linode regions. Region-less resources (account administration and Cloud Firewalls) are always scanned; only regional resources such as instances are filtered. When the flag is omitted, all regions are scanned.
+
+```bash
+prowler linode --region eu-central us-east
+```
+
+## Available Services
+
+Prowler for Linode currently supports the following services:
+
+| Service | Description |
+|---------|-------------|
+| `administration` | Account administration includes users and access controls such as two-factor authentication |
+| `compute` | Compute includes Linode instances and their workload configuration |
+| `networking` | Networking includes Cloud Firewalls and their stateful network rules |
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index bdb5f9abf0..3df8df9c2e 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -29,6 +29,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
 - TLS certificate verification in the `codepipeline_project_repo_private` check, which previously used an unverified SSL context, leaving the repository-visibility probe open to MITM tampering [(#11603)](https://github.com/prowler-cloud/prowler/pull/11603)
+- Support for Linode cloud provider, with compute, networking and administration services [(#11633)](https://github.com/prowler-cloud/prowler/pull/11633)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Azure provider, mapping existing Azure checks across the five DORA pillars [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
 - Rename DORA to DORA_2022_2554 to follow the naming <name>_<version> in compliance frameworks [(#11551)](https://github.com/prowler-cloud/prowler/pull/11551)
 - `entra_directory_sync_object_takeover_blocked` check for the M365 provider, verifying that hybrid Entra tenants block cloud object takeover through both soft-match and hard-match directory synchronization [(#11098)](https://github.com/prowler-cloud/prowler/pull/11098)
diff --git a/prowler/__main__.py b/prowler/__main__.py
index 533a704359..d4c925f74f 100644
--- a/prowler/__main__.py
+++ b/prowler/__main__.py
@@ -147,6 +147,7 @@ from prowler.providers.iac.models import IACOutputOptions
 from prowler.providers.image.exceptions.exceptions import ImageBaseException
 from prowler.providers.image.models import ImageOutputOptions
 from prowler.providers.kubernetes.models import KubernetesOutputOptions
+from prowler.providers.linode.models import LinodeOutputOptions
 from prowler.providers.llm.models import LLMOutputOptions
 from prowler.providers.m365.models import M365OutputOptions
 from prowler.providers.mongodbatlas.models import MongoDBAtlasOutputOptions
@@ -439,6 +440,10 @@ def prowler():
         output_options = ScalewayOutputOptions(
             args, bulk_checks_metadata, global_provider.identity
         )
+    elif provider == "linode":
+        output_options = LinodeOutputOptions(
+            args, bulk_checks_metadata, global_provider.identity
+        )
     else:
         # Dynamic fallback: any external/custom provider
         try:
diff --git a/prowler/compliance/linode/__init__.py b/prowler/compliance/linode/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/config/config.py b/prowler/config/config.py
index 9e2b079da6..723a9b67d3 100644
--- a/prowler/config/config.py
+++ b/prowler/config/config.py
@@ -80,6 +80,7 @@ class Provider(str, Enum):
     VERCEL = "vercel"
     OKTA = "okta"
     STACKIT = "stackit"
+    LINODE = "linode"
 
 
 # Compliance
diff --git a/prowler/config/linode_mutelist_example.yaml b/prowler/config/linode_mutelist_example.yaml
new file mode 100644
index 0000000000..1b08ab6fda
--- /dev/null
+++ b/prowler/config/linode_mutelist_example.yaml
@@ -0,0 +1,18 @@
+### Account, Check and/or Region can be * to apply for all the cases.
+### Account == <Linode Account UUID>
+### Region == * (Linode is non-regional)
+### Resources and tags are lists that can have either Regex or Keywords.
+### Tags is an optional list that matches on tuples of 'key=value' and are "ANDed" together.
+### Use an alternation Regex to match one of multiple tags with "ORed" logic.
+### For each check you can except Accounts, Regions, Resources and/or Tags.
+###########################  MUTELIST EXAMPLE  ###########################
+Mutelist:
+  Accounts:
+    "example-account-uuid":
+      Checks:
+        "administration_user_2fa_enabled":
+          Regions:
+            - "*"
+          Resources:
+            - "example-user@example.com"
+            - "another-user@example.com"
diff --git a/prowler/lib/check/check.py b/prowler/lib/check/check.py
index 300520f589..c0c6a02e5d 100644
--- a/prowler/lib/check/check.py
+++ b/prowler/lib/check/check.py
@@ -797,6 +797,10 @@ def execute(
                 is_finding_muted_args["org_domain"] = (
                     global_provider.identity.org_domain
                 )
+            elif global_provider.type == "linode":
+                is_finding_muted_args["account_id"] = (
+                    global_provider.identity.account_id
+                )
             elif not is_builtin_provider(global_provider.type):
                 # External/custom provider — delegate identity args
                 is_finding_muted_args = global_provider.get_mutelist_finding_args()
diff --git a/prowler/lib/check/models.py b/prowler/lib/check/models.py
index f9155c68f7..aa16d7969b 100644
--- a/prowler/lib/check/models.py
+++ b/prowler/lib/check/models.py
@@ -1106,6 +1106,37 @@ class CheckReportCloudflare(Check_Report):
         return "global"
 
 
+@dataclass
+class CheckReportLinode(Check_Report):
+    """Contains the Linode Check's finding information."""
+
+    resource_name: str
+    resource_id: str
+    region: str
+
+    def __init__(
+        self,
+        metadata: Dict,
+        resource: Any,
+        resource_name: str,
+        resource_id: str,
+        region: str = "global",
+    ) -> None:
+        """Initialize the Linode Check's finding information.
+
+        Args:
+            metadata: The metadata of the check.
+            resource: Basic information about the resource.
+            resource_name: The name of the resource related with the finding.
+            resource_id: The id of the resource related with the finding.
+            region: The region of the resource related with the finding.
+        """
+        super().__init__(metadata, resource)
+        self.resource_name = resource_name
+        self.resource_id = resource_id
+        self.region = region
+
+
 @dataclass
 class CheckReportM365(Check_Report):
     """Contains the M365 Check's finding information."""
diff --git a/prowler/lib/cli/parser.py b/prowler/lib/cli/parser.py
index 2848e9c788..b65a702fbc 100644
--- a/prowler/lib/cli/parser.py
+++ b/prowler/lib/cli/parser.py
@@ -51,6 +51,7 @@ class ProwlerArgumentParser:
             "okta",
             "scaleway",
             "stackit",
+            "linode",
         }
         all_providers = set(Provider.get_available_providers())
         new_providers = sorted(all_providers - known_providers)
@@ -73,10 +74,10 @@ class ProwlerArgumentParser:
         self.parser = argparse.ArgumentParser(
             prog="prowler",
             formatter_class=RawTextHelpFormatter,
-            usage=f"prowler [-h] [--version] {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,dashboard,iac,image,llm{extra_providers_csv}}} ...",
+            usage=f"prowler [-h] [--version] {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,linode,dashboard,iac,image,llm{extra_providers_csv}}} ...",
             epilog=f"""
 Available Cloud Providers:
-  {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,iac,llm,image,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel{extra_providers_csv}}}
+  {{aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,iac,llm,image,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,linode{extra_providers_csv}}}
     aws                 AWS Provider
     azure               Azure Provider
     gcp                 GCP Provider
@@ -96,7 +97,8 @@ Available Cloud Providers:
     nhn                 NHN Provider (Unofficial)
     mongodbatlas        MongoDB Atlas Provider
     scaleway            Scaleway Provider
-    vercel              Vercel Provider{extra_providers_text}
+    vercel              Vercel Provider
+    linode              Linode Provider{extra_providers_text}
 
 
 Available components:
diff --git a/prowler/lib/outputs/finding.py b/prowler/lib/outputs/finding.py
index 9f772d17c4..ed8bda4039 100644
--- a/prowler/lib/outputs/finding.py
+++ b/prowler/lib/outputs/finding.py
@@ -468,6 +468,24 @@ class Finding(BaseModel):
                 output_data["resource_uid"] = check_output.resource_id
                 output_data["region"] = check_output.region
 
+            elif provider.type == "linode":
+                output_data["auth_method"] = "api_token"
+                # account_uid is a required string, but the account ID may be
+                # unavailable when the token lacks account:read_only scope. Fall
+                # back to the username/email so findings are never dropped.
+                output_data["account_uid"] = (
+                    get_nested_attribute(provider, "identity.account_id")
+                    or get_nested_attribute(provider, "identity.username")
+                    or get_nested_attribute(provider, "identity.email")
+                    or "linode"
+                )
+                output_data["account_name"] = get_nested_attribute(
+                    provider, "identity.username"
+                ) or get_nested_attribute(provider, "identity.email")
+                output_data["resource_name"] = check_output.resource_name
+                output_data["resource_uid"] = check_output.resource_id
+                output_data["region"] = check_output.region
+
             elif provider.type == "alibabacloud":
                 output_data["auth_method"] = get_nested_attribute(
                     provider, "identity.identity_arn"
diff --git a/prowler/lib/outputs/html/html.py b/prowler/lib/outputs/html/html.py
index 545bcbc456..18dd4b0f3d 100644
--- a/prowler/lib/outputs/html/html.py
+++ b/prowler/lib/outputs/html/html.py
@@ -1582,6 +1582,63 @@ class HTML(Output):
             )
             return ""
 
+    @staticmethod
+    def get_linode_assessment_summary(provider: Provider) -> str:
+        """
+        get_linode_assessment_summary gets the HTML assessment summary for the Linode provider
+
+        Args:
+            provider (Provider): the Linode provider object
+
+        Returns:
+            str: HTML assessment summary for the Linode provider
+        """
+        try:
+            username = getattr(provider.identity, "username", None) or "-"
+            email = getattr(provider.identity, "email", None) or "-"
+            account_id = getattr(provider.identity, "account_id", None) or "-"
+
+            assessment_items = f"""
+                            <li class="list-group-item">
+                                <b>Account ID:</b> {account_id}
+                            </li>
+                            <li class="list-group-item">
+                                <b>Username:</b> {username}
+                            </li>
+                            <li class="list-group-item">
+                                <b>Email:</b> {email}
+                            </li>"""
+
+            credentials_items = """
+                            <li class="list-group-item">
+                                <b>Authentication:</b> API Token
+                            </li>"""
+
+            return f"""
+                <div class="col-md-2">
+                    <div class="card">
+                        <div class="card-header">
+                            Linode Assessment Summary
+                        </div>
+                        <ul class="list-group list-group-flush">{assessment_items}
+                        </ul>
+                    </div>
+                </div>
+                <div class="col-md-4">
+                    <div class="card">
+                        <div class="card-header">
+                            Linode Credentials
+                        </div>
+                        <ul class="list-group list-group-flush">{credentials_items}
+                        </ul>
+                    </div>
+                </div>"""
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
+            )
+            return ""
+
     @staticmethod
     def get_assessment_summary(provider: Provider) -> str:
         """
diff --git a/prowler/lib/outputs/outputs.py b/prowler/lib/outputs/outputs.py
index a1f37a9dfc..40dc4635ba 100644
--- a/prowler/lib/outputs/outputs.py
+++ b/prowler/lib/outputs/outputs.py
@@ -46,6 +46,8 @@ def stdout_report(finding, color, verbose, status, fix, provider=None):
         details = finding.region
     elif finding.check_metadata.Provider == "scaleway":
         details = finding.region
+    elif finding.check_metadata.Provider == "linode":
+        details = finding.region
     else:
         # Dynamic fallback: any external/custom provider
         if provider is None:
diff --git a/prowler/lib/outputs/summary_table.py b/prowler/lib/outputs/summary_table.py
index 43d4a547c1..77b4c2725a 100644
--- a/prowler/lib/outputs/summary_table.py
+++ b/prowler/lib/outputs/summary_table.py
@@ -121,6 +121,11 @@ def display_summary_table(
         elif provider.type == "scaleway":
             entity_type = "Organization"
             audited_entities = provider.identity.organization_id
+        elif provider.type == "linode":
+            entity_type = "Account"
+            audited_entities = (
+                provider.identity.username or provider.identity.email or "linode"
+            )
         else:
             # Dynamic fallback: any external/custom provider
             entity_type, audited_entities = provider.get_summary_entity()
diff --git a/prowler/providers/common/provider.py b/prowler/providers/common/provider.py
index 77ae9180a3..9c314b3233 100644
--- a/prowler/providers/common/provider.py
+++ b/prowler/providers/common/provider.py
@@ -586,6 +586,16 @@ class Provider(ABC):
                         mutelist_path=arguments.mutelist_file,
                         fixer_config=fixer_config,
                     )
+                elif arguments.provider == "linode":
+                    # Credentials are read from the LINODE_TOKEN env var by the
+                    # provider itself; there are no credential CLI flags to
+                    # avoid leaking secrets.
+                    provider_class(
+                        config_path=arguments.config_file,
+                        mutelist_path=arguments.mutelist_file,
+                        fixer_config=fixer_config,
+                        regions=getattr(arguments, "region", None),
+                    )
                 else:
                     # Dynamic fallback: any external/custom provider.
                     # Honor the from_cli_args type hint (-> Provider): if the
diff --git a/prowler/providers/linode/__init__.py b/prowler/providers/linode/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/exceptions/__init__.py b/prowler/providers/linode/exceptions/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/exceptions/exceptions.py b/prowler/providers/linode/exceptions/exceptions.py
new file mode 100644
index 0000000000..6c39f477db
--- /dev/null
+++ b/prowler/providers/linode/exceptions/exceptions.py
@@ -0,0 +1,106 @@
+from prowler.exceptions.exceptions import ProwlerException
+
+
+# Exceptions codes from 18000 to 18099 are reserved for Linode exceptions
+class LinodeBaseException(ProwlerException):
+    """Base class for Linode errors."""
+
+    LINODE_ERROR_CODES = {
+        (18000, "LinodeCredentialsError"): {
+            "message": "Linode credentials not found or invalid",
+            "remediation": "Provide a valid Personal Access Token for Linode via the LINODE_TOKEN environment variable.",
+        },
+        (18001, "LinodeAuthenticationError"): {
+            "message": "Linode authentication failed",
+            "remediation": "Verify the Linode Personal Access Token and ensure it has the required scopes (linodes:read_only, firewalls:read_only, account:read_only).",
+        },
+        (18002, "LinodeSessionError"): {
+            "message": "Linode session setup failed",
+            "remediation": "Review the Linode SDK initialization parameters and credentials.",
+        },
+        (18003, "LinodeIdentityError"): {
+            "message": "Unable to retrieve Linode identity or account information",
+            "remediation": "Ensure the Personal Access Token allows access to the Linode account and profile APIs.",
+        },
+        (18004, "LinodeMissingPermissionError"): {
+            "message": "Linode token is missing a required permission scope",
+            "remediation": "Grant the Personal Access Token the read-only scope required for the affected service (account:read_only, linodes:read_only, firewall:read_only).",
+        },
+        (18005, "LinodeInvalidRegionError"): {
+            "message": "One or more requested Linode regions are invalid",
+            "remediation": "Pass a valid Linode region id to --region. See https://www.linode.com/global-infrastructure/ or the API /v4/regions endpoint for the current list.",
+        },
+    }
+
+    def __init__(self, code, file=None, original_exception=None, message=None):
+        provider = "Linode"
+        error_info = self.LINODE_ERROR_CODES.get((code, self.__class__.__name__))
+        if error_info is None:
+            error_info = {
+                "message": message or "Unknown Linode error",
+                "remediation": "Check the Linode API documentation for more details.",
+            }
+        elif message:
+            error_info = error_info.copy()
+            error_info["message"] = message
+        super().__init__(
+            code=code,
+            source=provider,
+            file=file,
+            original_exception=original_exception,
+            error_info=error_info,
+        )
+
+
+class LinodeCredentialsError(LinodeBaseException):
+    """Exception for Linode credential errors."""
+
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            18000, file=file, original_exception=original_exception, message=message
+        )
+
+
+class LinodeAuthenticationError(LinodeBaseException):
+    """Exception for Linode authentication errors."""
+
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            18001, file=file, original_exception=original_exception, message=message
+        )
+
+
+class LinodeSessionError(LinodeBaseException):
+    """Exception for Linode session setup errors."""
+
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            18002, file=file, original_exception=original_exception, message=message
+        )
+
+
+class LinodeIdentityError(LinodeBaseException):
+    """Exception for Linode identity errors."""
+
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            18003, file=file, original_exception=original_exception, message=message
+        )
+
+
+class LinodeMissingPermissionError(LinodeBaseException):
+    """Exception for Linode missing permission scope errors."""
+
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            18004, file=file, original_exception=original_exception, message=message
+        )
+
+
+class LinodeInvalidRegionError(LinodeBaseException):
+    """Exception for invalid Linode region filters."""
+
+    def __init__(self, file=None, original_exception=None, message=None):
+        super().__init__(
+            18005, file=file, original_exception=original_exception, message=message
+        )
diff --git a/prowler/providers/linode/lib/__init__.py b/prowler/providers/linode/lib/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/lib/arguments/__init__.py b/prowler/providers/linode/lib/arguments/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/lib/arguments/arguments.py b/prowler/providers/linode/lib/arguments/arguments.py
new file mode 100644
index 0000000000..b8af36dba9
--- /dev/null
+++ b/prowler/providers/linode/lib/arguments/arguments.py
@@ -0,0 +1,24 @@
+def init_parser(self):
+    """Init the Linode provider CLI parser."""
+    linode_parser = self.subparsers.add_parser(
+        "linode", parents=[self.common_providers_parser], help="Linode Provider"
+    )
+
+    # Authentication
+    # Credentials are read exclusively from the standard Linode environment
+    # variable (LINODE_TOKEN) to avoid leaking secrets into shell history and
+    # process listings. There are no credential CLI flags.
+
+    # Regions
+    regions_subparser = linode_parser.add_argument_group("Regions")
+    regions_subparser.add_argument(
+        "--region",
+        "--filter-region",
+        "-f",
+        nargs="+",
+        default=None,
+        metavar="REGION",
+        help="Linode region(s) to scan (e.g. eu-central us-east). Region-less "
+        "resources (account, networking) are always scanned. If omitted, all "
+        "regions are scanned.",
+    )
diff --git a/prowler/providers/linode/lib/mutelist/__init__.py b/prowler/providers/linode/lib/mutelist/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/lib/mutelist/mutelist.py b/prowler/providers/linode/lib/mutelist/mutelist.py
new file mode 100644
index 0000000000..c7da04a58a
--- /dev/null
+++ b/prowler/providers/linode/lib/mutelist/mutelist.py
@@ -0,0 +1,30 @@
+from prowler.lib.check.models import CheckReportLinode
+from prowler.lib.mutelist.mutelist import Mutelist
+from prowler.lib.outputs.utils import unroll_dict, unroll_tags
+
+
+class LinodeMutelist(Mutelist):
+    """Linode-specific mutelist helper."""
+
+    def is_finding_muted(
+        self,
+        finding: CheckReportLinode,
+        account_id: str,
+    ) -> bool:
+        """
+        Check if a Linode finding is muted.
+
+        Args:
+            finding: CheckReportLinode instance containing check metadata, region, resource info, and tags.
+            account_id: Linode account identifier.
+
+        Returns:
+            True if the finding is muted, False otherwise.
+        """
+        return self.is_muted(
+            account_id,
+            finding.check_metadata.CheckID,
+            finding.region or "global",
+            finding.resource_id or finding.resource_name,
+            unroll_dict(unroll_tags(finding.resource_tags)),
+        )
diff --git a/prowler/providers/linode/lib/service/__init__.py b/prowler/providers/linode/lib/service/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/lib/service/service.py b/prowler/providers/linode/lib/service/service.py
new file mode 100644
index 0000000000..d1a9de65db
--- /dev/null
+++ b/prowler/providers/linode/lib/service/service.py
@@ -0,0 +1,86 @@
+import os
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from prowler.lib.logger import logger
+from prowler.providers.linode.exceptions.exceptions import LinodeMissingPermissionError
+from prowler.providers.linode.linode_provider import LinodeProvider
+
+MAX_WORKERS = 10
+
+
+class LinodeService:
+    """Base class for Linode services to share provider context."""
+
+    def __init__(self, service: str, provider: LinodeProvider):
+        """
+        Initialize the Linode service with provider context.
+
+        Args:
+            service: The Linode service name (e.g., administration, compute, networking).
+            provider: LinodeProvider instance containing session, audit config, and fixer config.
+        """
+        self.provider = provider
+        self.client = provider.session.client
+        self.audit_config = provider.audit_config
+        self.fixer_config = provider.fixer_config
+        self.service = service.lower() if not service.islower() else service
+
+        self.thread_pool = ThreadPoolExecutor(max_workers=MAX_WORKERS)
+
+    def _log_fetch_error(
+        self, resource_label: str, required_scope: str, error: Exception
+    ) -> None:
+        """Log a resource-fetch failure, distinguishing an insufficient-scope
+        (HTTP 401/403) error from a generic API error.
+
+        This never raises: a single service's missing permission must not abort
+        the rest of the scan. When the token lacks the required scope, the log
+        names the exact scope to grant via ``LinodeMissingPermissionError``.
+
+        Args:
+            resource_label: Human-readable resource name (e.g. "firewalls").
+            required_scope: The Linode OAuth scope needed (e.g. "firewall:read_only").
+            error: The exception raised by the SDK call.
+        """
+        service_name = getattr(self, "service", "linode")
+        status = getattr(error, "status", None)
+        if status in (401, 403) or "not authorized to use this endpoint" in str(error):
+            logger.error(
+                str(
+                    LinodeMissingPermissionError(
+                        file=os.path.basename(__file__),
+                        message=(
+                            f"{service_name} - unable to list {resource_label}: the Linode "
+                            f"token lacks the '{required_scope}' scope; skipping these checks."
+                        ),
+                        original_exception=error,
+                    )
+                )
+            )
+        else:
+            logger.error(
+                f"{service_name} - Error fetching {resource_label}: "
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+    def __threading_call__(self, call, iterator):
+        """Execute a function across multiple items using threading."""
+        items = list(iterator) if not isinstance(iterator, list) else iterator
+
+        futures = {self.thread_pool.submit(call, item): item for item in items}
+        results = []
+
+        for future in as_completed(futures):
+            try:
+                result = future.result()
+                if result is not None:
+                    results.append(result)
+            except Exception as error:
+                item = futures[future]
+                item_id = getattr(item, "id", str(item))
+                logger.error(
+                    f"{self.service} - Threading error processing {item_id}: "
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+        return results
diff --git a/prowler/providers/linode/linode_provider.py b/prowler/providers/linode/linode_provider.py
new file mode 100644
index 0000000000..ab069fab3d
--- /dev/null
+++ b/prowler/providers/linode/linode_provider.py
@@ -0,0 +1,343 @@
+import logging
+import os
+
+from colorama import Fore, Style
+from linode_api4 import LinodeClient
+
+from prowler.config.config import (
+    default_config_file_path,
+    get_default_mute_file_path,
+    load_and_validate_config_file,
+)
+from prowler.lib.logger import logger
+from prowler.lib.utils.utils import print_boxes
+from prowler.providers.common.models import Audit_Metadata, Connection
+from prowler.providers.common.provider import Provider
+from prowler.providers.linode.exceptions.exceptions import (
+    LinodeAuthenticationError,
+    LinodeCredentialsError,
+    LinodeIdentityError,
+    LinodeInvalidRegionError,
+    LinodeSessionError,
+)
+from prowler.providers.linode.lib.mutelist.mutelist import LinodeMutelist
+from prowler.providers.linode.models import (
+    LinodeIdentityInfo,
+    LinodeSession,
+)
+
+
+class LinodeProvider(Provider):
+    """Linode provider."""
+
+    _type: str = "linode"
+    _session: LinodeSession
+    _identity: LinodeIdentityInfo
+    _audit_config: dict
+    _fixer_config: dict
+    _mutelist: LinodeMutelist
+    _regions: set
+    audit_metadata: Audit_Metadata
+
+    def __init__(
+        self,
+        config_path: str = None,
+        config_content: dict | None = None,
+        fixer_config: dict | None = None,
+        mutelist_path: str = None,
+        mutelist_content: dict = None,
+        token: str = None,
+        regions: list = None,
+    ):
+        """
+        Initializes the LinodeProvider instance.
+
+        Args:
+            config_path (str): Path to the configuration file.
+            config_content (dict): Audit configuration content.
+            fixer_config (dict): Fixer configuration.
+            mutelist_path (str): Path to the mutelist file.
+            mutelist_content (dict): Mutelist content.
+            token (str): Linode Personal Access Token (falls back to LINODE_TOKEN env var).
+            regions (list): Region(s) to scan regional resources in. Region-less
+                resources are always scanned. ``None`` scans all regions.
+
+        Raises:
+            LinodeCredentialsError: If no token is provided.
+            LinodeSessionError: If the Linode session cannot be established.
+            LinodeIdentityError: If user or account identity cannot be retrieved.
+        """
+        logger.info("Instantiating Linode provider...")
+
+        # Mute noisy HTTP client logs
+        logging.getLogger("urllib3").setLevel(logging.WARNING)
+
+        if config_content:
+            self._audit_config = config_content
+        else:
+            if not config_path:
+                config_path = default_config_file_path
+            self._audit_config = load_and_validate_config_file(self._type, config_path)
+
+        self._session = LinodeProvider.setup_session(token=token)
+
+        # Region filter for regional resources, validated against the live
+        # Linode regions list. None means scan all regions.
+        self._regions = LinodeProvider.validate_regions(self._session, regions)
+
+        self._identity = LinodeProvider.setup_identity(self._session)
+
+        self._fixer_config = fixer_config if fixer_config is not None else {}
+
+        if mutelist_content:
+            self._mutelist = LinodeMutelist(mutelist_content=mutelist_content)
+        else:
+            if not mutelist_path:
+                mutelist_path = get_default_mute_file_path(self.type)
+            self._mutelist = LinodeMutelist(mutelist_path=mutelist_path)
+
+        Provider.set_global_provider(self)
+
+    @property
+    def type(self):
+        return self._type
+
+    @property
+    def session(self):
+        return self._session
+
+    @property
+    def identity(self):
+        return self._identity
+
+    @property
+    def audit_config(self):
+        return self._audit_config
+
+    @property
+    def fixer_config(self):
+        return self._fixer_config
+
+    @property
+    def mutelist(self) -> LinodeMutelist:
+        return self._mutelist
+
+    @property
+    def regions(self):
+        """Set of regions to scan for regional resources, or None for all."""
+        return self._regions
+
+    def validate_arguments(self) -> None:
+        """Linode provider has no provider-specific arguments to validate."""
+        return None
+
+    @staticmethod
+    def setup_session(token: str = None) -> LinodeSession:
+        """Initialize Linode SDK client.
+
+        Credentials can be provided as argument or read from environment variable:
+        - LINODE_TOKEN (Personal Access Token)
+
+        Args:
+            token: Linode Personal Access Token (optional, falls back to env var).
+
+        Returns:
+            LinodeSession: The initialized Linode session.
+
+        Raises:
+            LinodeCredentialsError: If no credentials are provided.
+            LinodeSessionError: If session setup fails.
+        """
+        token = token or os.environ.get("LINODE_TOKEN", "")
+
+        if not token:
+            raise LinodeCredentialsError(
+                file=os.path.basename(__file__),
+                message="Linode credentials not found. Set the LINODE_TOKEN environment variable.",
+            )
+
+        try:
+            client = LinodeClient(token)
+            return LinodeSession(client=client, token=token)
+        except Exception as error:
+            logger.critical(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
+            )
+            raise LinodeSessionError(
+                file=os.path.basename(__file__),
+                original_exception=error,
+            )
+
+    @staticmethod
+    def validate_regions(session: LinodeSession, regions: list = None):
+        """Validate the requested regions against the live Linode regions list.
+
+        The ``/v4/regions`` endpoint is public, so this works regardless of the
+        token's scope. Validating against the live list (instead of a static
+        file) avoids rejecting newly added Linode regions.
+
+        Args:
+            session: The Linode session.
+            regions: The region ids requested via --region (or None).
+
+        Returns:
+            The validated set of region ids, or None when no filter is given.
+
+        Raises:
+            LinodeInvalidRegionError: If any requested region id is unknown.
+        """
+        if not regions:
+            return None
+
+        requested = set(regions)
+        try:
+            available = {region.id for region in session.client.regions()}
+        except Exception as error:
+            # Do not block a scan if the regions list cannot be fetched.
+            logger.warning(
+                f"Unable to validate Linode regions: {error}. "
+                "Proceeding with the requested regions without validation."
+            )
+            return requested
+
+        invalid = requested - available
+        if invalid:
+            raise LinodeInvalidRegionError(
+                file=os.path.basename(__file__),
+                message=(
+                    f"Invalid Linode region(s): {', '.join(sorted(invalid))}. "
+                    f"Valid regions are: {', '.join(sorted(available))}."
+                ),
+            )
+        return requested
+
+    @staticmethod
+    def setup_identity(session: LinodeSession) -> LinodeIdentityInfo:
+        """Fetch user and account metadata for Linode.
+
+        The authenticated user's profile is retrieved first to validate the
+        token. Any valid token can read its own profile, so a failure here
+        (for example a ``401 Invalid Token``) means the credentials are invalid
+        and the scan is aborted instead of silently returning empty results.
+
+        Args:
+            session: The Linode session.
+
+        Returns:
+            LinodeIdentityInfo: The identity information.
+
+        Raises:
+            LinodeAuthenticationError: If the token is invalid.
+            LinodeIdentityError: If identity setup fails unexpectedly.
+        """
+        try:
+            client = session.client
+            username = None
+            email = None
+            account_id = None
+
+            # Validate the token by reading the authenticated user's profile.
+            # A failure here means the credentials are invalid, so abort.
+            try:
+                profile = client.profile()
+                username = profile.username
+                email = profile.email
+            except Exception as error:
+                logger.critical(
+                    f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
+                )
+                raise LinodeAuthenticationError(
+                    file=os.path.basename(__file__),
+                    original_exception=error,
+                )
+
+            # The account endpoint requires the account:read_only scope. A
+            # token without that scope is still valid, so continue without the
+            # account ID instead of failing the scan.
+            try:
+                account = client.account()
+                account_id = getattr(account, "euuid", None)
+            except Exception as error:
+                logger.warning(
+                    f"Unable to retrieve Linode account info: {error}. Continuing without account ID."
+                )
+
+            return LinodeIdentityInfo(
+                username=username,
+                email=email,
+                account_id=account_id,
+            )
+        except LinodeAuthenticationError:
+            raise
+        except Exception as error:
+            logger.critical(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}] -- {error}"
+            )
+            raise LinodeIdentityError(
+                file=os.path.basename(__file__),
+                original_exception=error,
+            )
+
+    def print_credentials(self) -> None:
+        report_title = (
+            f"{Style.BRIGHT}Using the Linode credentials below:{Style.RESET_ALL}"
+        )
+        report_lines = []
+
+        report_lines.append(
+            f"Authentication: {Fore.YELLOW}Personal Access Token{Style.RESET_ALL}"
+        )
+
+        if self.identity.username:
+            report_lines.append(
+                f"Username: {Fore.YELLOW}{self.identity.username}{Style.RESET_ALL}"
+            )
+
+        if self.identity.email:
+            report_lines.append(
+                f"Email: {Fore.YELLOW}{self.identity.email}{Style.RESET_ALL}"
+            )
+
+        if self.identity.account_id:
+            report_lines.append(
+                f"Account ID: {Fore.YELLOW}{self.identity.account_id}{Style.RESET_ALL}"
+            )
+
+        print_boxes(report_lines, report_title)
+
+    @staticmethod
+    def test_connection(
+        token: str = None,
+        raise_on_exception: bool = True,
+    ) -> Connection:
+        """Test connection to Linode.
+
+        Args:
+            token: Linode Personal Access Token.
+            raise_on_exception: Flag indicating whether to raise an exception if the connection fails.
+
+        Returns:
+            Connection: Connection object with is_connected status.
+        """
+        try:
+            session = LinodeProvider.setup_session(token=token)
+            # Validate by fetching profile
+            session.client.profile()
+            return Connection(is_connected=True)
+        except LinodeCredentialsError as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            if raise_on_exception:
+                raise
+            return Connection(is_connected=False, error=error)
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+            if raise_on_exception:
+                raise LinodeAuthenticationError(
+                    file=os.path.basename(__file__),
+                    original_exception=error,
+                )
+            return Connection(is_connected=False, error=error)
diff --git a/prowler/providers/linode/models.py b/prowler/providers/linode/models.py
new file mode 100644
index 0000000000..8e41e881a7
--- /dev/null
+++ b/prowler/providers/linode/models.py
@@ -0,0 +1,38 @@
+from typing import Any, Optional
+
+from pydantic import BaseModel
+
+from prowler.config.config import output_file_timestamp
+from prowler.providers.common.models import ProviderOutputOptions
+
+
+class LinodeSession(BaseModel):
+    """Linode session information."""
+
+    client: Any
+    token: Optional[str] = None
+
+
+class LinodeIdentityInfo(BaseModel):
+    """Linode identity and scoping information."""
+
+    username: Optional[str] = None
+    email: Optional[str] = None
+    account_id: Optional[str] = None
+
+
+class LinodeOutputOptions(ProviderOutputOptions):
+    """Customize output filenames for Linode scans."""
+
+    def __init__(self, arguments, bulk_checks_metadata, identity: LinodeIdentityInfo):
+        super().__init__(arguments, bulk_checks_metadata)
+        if (
+            not hasattr(arguments, "output_filename")
+            or arguments.output_filename is None
+        ):
+            account_fragment = identity.account_id or identity.username or "linode"
+            self.output_filename = (
+                f"prowler-output-{account_fragment}-{output_file_timestamp}"
+            )
+        else:
+            self.output_filename = arguments.output_filename
diff --git a/prowler/providers/linode/services/__init__.py b/prowler/providers/linode/services/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/administration/__init__.py b/prowler/providers/linode/services/administration/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/administration/administration_client.py b/prowler/providers/linode/services/administration/administration_client.py
new file mode 100644
index 0000000000..99a242e9ee
--- /dev/null
+++ b/prowler/providers/linode/services/administration/administration_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.linode.services.administration.administration_service import (
+    AdministrationService,
+)
+
+administration_client = AdministrationService(Provider.get_global_provider())
diff --git a/prowler/providers/linode/services/administration/administration_service.py b/prowler/providers/linode/services/administration/administration_service.py
new file mode 100644
index 0000000000..7704cf11b2
--- /dev/null
+++ b/prowler/providers/linode/services/administration/administration_service.py
@@ -0,0 +1,46 @@
+from typing import List
+
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.linode.lib.service.service import LinodeService
+
+
+class User(BaseModel):
+    """Model for a Linode account user."""
+
+    username: str
+    email: str = ""
+    tfa_enabled: bool = False
+    restricted: bool = False
+
+
+class AdministrationService(LinodeService):
+    """Service to interact with Linode Account Users."""
+
+    def __init__(self, provider):
+        super().__init__("administration", provider)
+        self.users: List[User] = []
+        self._describe_users()
+
+    def _describe_users(self):
+        """Fetch all Linode account users."""
+        try:
+            raw_users = self.client.account.users()
+            for user in raw_users:
+                try:
+                    self.users.append(
+                        User(
+                            username=getattr(user, "username", "") or "",
+                            email=getattr(user, "email", "") or "",
+                            tfa_enabled=getattr(user, "tfa_enabled", False) or False,
+                            restricted=getattr(user, "restricted", False) or False,
+                        )
+                    )
+                except Exception as error:
+                    logger.error(
+                        f"account - Error processing user {getattr(user, 'username', 'unknown')}: "
+                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+        except Exception as error:
+            self._log_fetch_error("account users", "account:read_only", error)
diff --git a/prowler/providers/linode/services/administration/administration_user_2fa_enabled/__init__.py b/prowler/providers/linode/services/administration/administration_user_2fa_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled.metadata.json b/prowler/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled.metadata.json
new file mode 100644
index 0000000000..c16e26f56d
--- /dev/null
+++ b/prowler/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+  "Provider": "linode",
+  "CheckID": "administration_user_2fa_enabled",
+  "CheckTitle": "Linode account user has two-factor authentication enabled",
+  "CheckType": [],
+  "ServiceName": "administration",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "**Linode account users** are assessed for **two-factor authentication (2FA)** enablement. 2FA adds a second verification factor (a TOTP code or security key) on top of the password, so a stolen or guessed password alone is not enough to sign in to the **Linode Cloud Manager**.",
+  "Risk": "Without **2FA**, a single compromised password — through phishing, credential stuffing, or brute force — grants an attacker full access to the user's Linode account. This can lead to **data exfiltration**, destruction of instances and backups, and resource abuse for **cryptomining**, impacting **confidentiality**, **integrity**, and **availability**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/manage-2fa"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Linode Cloud Manager\n2. Navigate to My Profile > Login & Authentication\n3. Under Security Settings, configure all 3 security questions\n4. Enable Two-Factor Authentication",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable `2FA` for all Linode account users. Use an authenticator app (`TOTP`) for the second factor and store backup codes securely.",
+      "Url": "https://hub.prowler.com/check/administration_user_2fa_enabled"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled.py b/prowler/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled.py
new file mode 100644
index 0000000000..2bb2c92729
--- /dev/null
+++ b/prowler/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled.py
@@ -0,0 +1,41 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.providers.linode.services.administration.administration_client import (
+    administration_client,
+)
+
+
+class administration_user_2fa_enabled(Check):
+    """Check if Linode account users have two-factor authentication enabled."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the administration_user_2fa_enabled check.
+
+        Iterates over all account users and checks whether two-factor
+        authentication is enabled.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each user.
+        """
+        findings = []
+
+        for user in administration_client.users:
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=user,
+                resource_name=user.username,
+                resource_id=user.username,
+                region="global",
+            )
+
+            if user.tfa_enabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"User '{user.username}' has two-factor authentication enabled."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"User '{user.username}' does not have two-factor authentication enabled."
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/compute/__init__.py b/prowler/providers/linode/services/compute/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/compute/compute_client.py b/prowler/providers/linode/services/compute/compute_client.py
new file mode 100644
index 0000000000..8dc03fa36d
--- /dev/null
+++ b/prowler/providers/linode/services/compute/compute_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.linode.services.compute.compute_service import ComputeService
+
+compute_client = ComputeService(Provider.get_global_provider())
diff --git a/prowler/providers/linode/services/compute/compute_instance_backups_enabled/__init__.py b/prowler/providers/linode/services/compute/compute_instance_backups_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled.metadata.json b/prowler/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled.metadata.json
new file mode 100644
index 0000000000..b425e5c5b0
--- /dev/null
+++ b/prowler/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "linode",
+  "CheckID": "compute_instance_backups_enabled",
+  "CheckTitle": "Linode Instance has the Backup service enabled",
+  "CheckType": [],
+  "ServiceName": "compute",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "compute",
+  "Description": "**Linode instances** are assessed for enrollment in the **Linode Backup service**, which performs automatic daily and weekly snapshots of an instance's disks. Without it enabled, there is no managed recovery point to restore from after a data-loss event.",
+  "Risk": "With the **Backup service** disabled, there is no automated recovery point for the instance. Accidental deletion, **ransomware**, disk corruption, or operator error can result in **permanent data loss** and extended **downtime**, directly impacting **availability** and data **integrity**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/enable-backups",
+    "https://techdocs.akamai.com/cloud-computing/docs/create-a-compute-instance#configure-additional-options"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "linode-cli linodes backups-enable <linode_id>",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Linode Cloud Manager\n2. Select the Linode instance\n3. Navigate to the Backups tab\n4. Click 'Enable Backups'",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable the `Linode Backup service` on this instance to ensure automated recovery points are available. Consider supplementing it with manual snapshots before critical changes.",
+      "Url": "https://hub.prowler.com/check/compute_instance_backups_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled.py b/prowler/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled.py
new file mode 100644
index 0000000000..c7ae903fbf
--- /dev/null
+++ b/prowler/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled.py
@@ -0,0 +1,40 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.providers.linode.services.compute.compute_client import compute_client
+
+
+class compute_instance_backups_enabled(Check):
+    """Check if Linode instances have the Backup service enabled."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the compute_instance_backups_enabled check.
+
+        Iterates over all Linode instances and checks whether the Backup
+        service is enabled.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each instance.
+        """
+        findings = []
+
+        for instance in compute_client.instances:
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=instance,
+                resource_name=instance.label,
+                resource_id=str(instance.id),
+                region=instance.region,
+            )
+            report.resource_tags = instance.tags
+
+            if instance.backups_enabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Instance {instance.label} has the Backup service enabled."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Instance {instance.label} does not have the Backup service enabled."
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/__init__.py b/prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled.metadata.json b/prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled.metadata.json
new file mode 100644
index 0000000000..878030dc25
--- /dev/null
+++ b/prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "linode",
+  "CheckID": "compute_instance_disk_encryption_enabled",
+  "CheckTitle": "Linode Instance has disk encryption enabled",
+  "CheckType": [],
+  "ServiceName": "compute",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "compute",
+  "Description": "**Linode instances** are assessed for **disk encryption** status. Disk encryption protects **data at rest** on the instance's underlying disks, keeping stored data unreadable without the encryption keys even if the physical media is accessed.",
+  "Risk": "Without **disk encryption**, data at rest on the instance's disks is stored unprotected. This increases the risk of **data exposure** through physical access to decommissioned or stolen storage media, or via certain **hypervisor-level** vulnerabilities, compromising the **confidentiality** of sensitive data.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/local-disk-encryption",
+    "https://techdocs.akamai.com/cloud-computing/docs/create-a-compute-instance#enable-or-disable-disk-encryption"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Disk encryption must be enabled at instance creation time or by rebuilding the instance\n2. Create a new instance with disk_encryption set to 'enabled'\n3. Migrate data from the unencrypted instance to the new encrypted instance",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable `disk encryption` for this instance. Because it cannot be toggled on existing instances, rebuild or migrate to a new instance with encryption enabled.",
+      "Url": "https://hub.prowler.com/check/compute_instance_disk_encryption_enabled"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled.py b/prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled.py
new file mode 100644
index 0000000000..abe364d0b4
--- /dev/null
+++ b/prowler/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled.py
@@ -0,0 +1,42 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.providers.linode.services.compute.compute_client import compute_client
+
+
+class compute_instance_disk_encryption_enabled(Check):
+    """Check if Linode instances have disk encryption enabled."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the compute_instance_disk_encryption_enabled check.
+
+        Iterates over all Linode instances and checks whether disk encryption
+        is enabled.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each instance.
+        """
+        findings = []
+
+        for instance in compute_client.instances:
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=instance,
+                resource_name=instance.label,
+                resource_id=str(instance.id),
+                region=instance.region,
+            )
+            report.resource_tags = instance.tags
+
+            if instance.disk_encryption == "enabled":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Instance {instance.label} has disk encryption enabled."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Instance {instance.label} does not have disk encryption enabled."
+                )
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/__init__.py b/prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled.metadata.json b/prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled.metadata.json
new file mode 100644
index 0000000000..42e3c8f46f
--- /dev/null
+++ b/prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+  "Provider": "linode",
+  "CheckID": "compute_instance_watchdog_enabled",
+  "CheckTitle": "Linode Instance has Watchdog (Lassie) enabled",
+  "CheckType": [],
+  "ServiceName": "compute",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "compute",
+  "Description": "**Linode instances** are assessed for **Watchdog (Lassie)** status. Watchdog is Linode's automatic recovery feature that monitors an instance and reboots it if it powers off unexpectedly, helping maintain availability without manual intervention.",
+  "Risk": "With **Watchdog (Lassie)** disabled, an instance that crashes or shuts down unexpectedly stays offline until it is manually restarted. This prolongs **downtime**, delays detection of availability incidents, and weakens the **availability** of services running on the instance.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/recover-from-unexpected-shutdowns-with-lassie"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "linode-cli linodes update <linode_id> --watchdog_enabled true",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Linode Cloud Manager\n2. Select the Linode instance\n3. Navigate to the Settings tab\n4. Enable the Shutdown Watchdog (Lassie) toggle",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable `Watchdog (Lassie)` on this instance to automatically recover from unexpected shutdowns and improve availability protection.",
+      "Url": "https://hub.prowler.com/check/compute_instance_watchdog_enabled"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled.py b/prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled.py
new file mode 100644
index 0000000000..498deb970c
--- /dev/null
+++ b/prowler/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled.py
@@ -0,0 +1,40 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.providers.linode.services.compute.compute_client import compute_client
+
+
+class compute_instance_watchdog_enabled(Check):
+    """Check if Linode instances have Watchdog (Lassie) enabled."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the compute_instance_watchdog_enabled check.
+
+        Iterates over all Linode instances and checks whether Watchdog
+        (Lassie) is enabled.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each instance.
+        """
+        findings = []
+
+        for instance in compute_client.instances:
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=instance,
+                resource_name=instance.label,
+                resource_id=str(instance.id),
+                region=instance.region,
+            )
+            report.resource_tags = instance.tags
+
+            if instance.watchdog_enabled:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Instance {instance.label} has Watchdog (Lassie) enabled."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Instance {instance.label} does not have Watchdog (Lassie) enabled."
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/compute/compute_service.py b/prowler/providers/linode/services/compute/compute_service.py
new file mode 100644
index 0000000000..51d38aa834
--- /dev/null
+++ b/prowler/providers/linode/services/compute/compute_service.py
@@ -0,0 +1,99 @@
+from typing import List
+
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.linode.lib.service.service import LinodeService
+
+
+class Instance(BaseModel):
+    """Model for a Linode Instance."""
+
+    id: int
+    label: str
+    region: str
+    status: str
+    backups_enabled: bool = False
+    disk_encryption: str = "disabled"  # "enabled" or "disabled"
+    watchdog_enabled: bool = False
+    tags: List[str] = []
+
+
+class ComputeService(LinodeService):
+    """Service to interact with Linode Instances."""
+
+    def __init__(self, provider):
+        super().__init__("compute", provider)
+        self.instances: List[Instance] = []
+        self._describe_instances()
+
+    def _describe_instances(self):
+        """Fetch all Linode instances with firewall and IP details."""
+        # Optional --region filter. None scans all regions. Region-less services
+        # do not call this, so they are always scanned.
+        regions_filter = getattr(getattr(self, "provider", None), "regions", None)
+        try:
+            raw_instances = self.client.linode.instances()
+            for inst in raw_instances:
+                try:
+                    region = (
+                        inst.region.id
+                        if hasattr(inst.region, "id")
+                        else str(inst.region)
+                    )
+                    if regions_filter and region not in regions_filter:
+                        continue
+
+                    # Get backup status
+                    backups_enabled = False
+                    try:
+                        backups = getattr(inst, "backups", None)
+                        if backups:
+                            backups_enabled = getattr(backups, "enabled", False)
+                    except Exception as error:
+                        logger.warning(
+                            f"instance - Unable to fetch backup status for instance "
+                            f"{inst.id}: {error}"
+                        )
+
+                    # Get disk encryption status
+                    disk_encryption = "disabled"
+                    try:
+                        de = getattr(inst, "disk_encryption", None)
+                        if de:
+                            disk_encryption = str(de)
+                    except Exception as error:
+                        logger.warning(
+                            f"instance - Unable to fetch disk encryption status for "
+                            f"instance {inst.id}: {error}"
+                        )
+
+                    # Get watchdog status
+                    watchdog_enabled = False
+                    try:
+                        watchdog_enabled = getattr(inst, "watchdog_enabled", False)
+                    except Exception as error:
+                        logger.warning(
+                            f"instance - Unable to fetch watchdog status for instance "
+                            f"{inst.id}: {error}"
+                        )
+
+                    self.instances.append(
+                        Instance(
+                            id=inst.id,
+                            label=inst.label or f"linode-{inst.id}",
+                            region=region,
+                            status=inst.status or "unknown",
+                            backups_enabled=backups_enabled,
+                            disk_encryption=disk_encryption,
+                            watchdog_enabled=watchdog_enabled,
+                            tags=inst.tags or [],
+                        )
+                    )
+                except Exception as error:
+                    logger.error(
+                        f"instance - Error processing instance {inst.id}: "
+                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+        except Exception as error:
+            self._log_fetch_error("instances", "linodes:read_only", error)
diff --git a/prowler/providers/linode/services/networking/__init__.py b/prowler/providers/linode/services/networking/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/networking/networking_client.py b/prowler/providers/linode/services/networking/networking_client.py
new file mode 100644
index 0000000000..0f0406048b
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.linode.services.networking.networking_service import (
+    NetworkingService,
+)
+
+networking_client = NetworkingService(Provider.get_global_provider())
diff --git a/prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/__init__.py b/prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices.metadata.json b/prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices.metadata.json
new file mode 100644
index 0000000000..475601e5b3
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "linode",
+  "CheckID": "networking_firewall_assigned_to_devices",
+  "CheckTitle": "Linode Cloud Firewall is assigned to devices",
+  "CheckType": [],
+  "ServiceName": "networking",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "network",
+  "Description": "**Linode Cloud Firewalls** are checked to verify each one is attached to at least one device, such as a **Linode instance** or **NodeBalancer**. A firewall only filters traffic for the resources it is assigned to, so an unassigned firewall enforces no protection at all.",
+  "Risk": "An **unassigned firewall** provides no protection to running workloads, leaving their network exposure governed only by default behavior. This commonly signals a **misconfigured control** where operators assume traffic is filtered when it is not, raising the risk of **unauthorized network access** to unprotected instances.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/apply-firewall-rules-to-a-service"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Linode Cloud Manager\n2. Navigate to Firewalls\n3. Select the associated firewall\n4. Click on either the Linodes or Nodebalancers tab and add those devices to the firewall",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Attach each firewall to applicable Linode devices, such as `Linodes` or `NodeBalancers`, to enforce intended network controls.",
+      "Url": "https://hub.prowler.com/check/networking_firewall_assigned_to_devices"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "networking_firewall_status_enabled"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices.py b/prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices.py
new file mode 100644
index 0000000000..f245dd168e
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices.py
@@ -0,0 +1,52 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.lib.logger import logger
+from prowler.providers.linode.services.networking.networking_client import (
+    networking_client,
+)
+
+
+class networking_firewall_assigned_to_devices(Check):
+    """Check if Linode Cloud Firewalls are assigned to at least one device."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the networking_firewall_assigned_to_devices check.
+
+        Iterates over all Cloud Firewalls and checks whether each one is
+        assigned to at least one device.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each firewall.
+        """
+        findings = []
+
+        for fw in networking_client.firewalls:
+            # When the device count could not be determined (the devices fetch
+            # failed) skip the firewall instead of reporting a false FAIL.
+            if fw.attached_devices_count is None:
+                logger.warning(
+                    f"firewall - Skipping firewall '{fw.label}' ({fw.id}): "
+                    "device assignment could not be determined."
+                )
+                continue
+
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=fw,
+                resource_name=fw.label,
+                resource_id=str(fw.id),
+                region="global",
+            )
+            report.resource_tags = fw.tags
+
+            if fw.attached_devices_count > 0:
+                report.status = "PASS"
+                report.status_extended = f"Firewall '{fw.label}' is assigned to {fw.attached_devices_count} device(s)."
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Firewall '{fw.label}' is not assigned to any device."
+                )
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/__init__.py b/prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop.metadata.json b/prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop.metadata.json
new file mode 100644
index 0000000000..16f0666f7d
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "linode",
+  "CheckID": "networking_firewall_default_inbound_policy_drop",
+  "CheckTitle": "Linode Cloud Firewall default inbound policy is DROP",
+  "CheckType": [],
+  "ServiceName": "networking",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "network",
+  "Description": "**Linode Cloud Firewalls** apply a **default inbound policy** to ingress traffic that does not match any explicit rule. This check verifies the default is set to `DROP`, enforcing a **default-deny** posture so that only traffic intentionally permitted by a rule is allowed in.",
+  "Risk": "When the default inbound policy is `ACCEPT` instead of `DROP`, any traffic not explicitly denied by a rule is permitted. This **default-allow** posture can silently expose services, management ports, and unintended endpoints to the internet, enlarging the attack surface and increasing the risk of **unauthorized access**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/manage-firewall-rules"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Linode Cloud Manager\n2. Navigate to Firewalls\n3. Select the associated firewall\n4. In the Rules tab, set the default inbound policy to DROP",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Set the default inbound policy to `DROP` and allow only explicitly required inbound traffic.",
+      "Url": "https://hub.prowler.com/check/networking_firewall_default_inbound_policy_drop"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "networking_firewall_inbound_rules_configured"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop.py b/prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop.py
new file mode 100644
index 0000000000..2f5c8cb6c3
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop.py
@@ -0,0 +1,42 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.providers.linode.services.networking.networking_client import (
+    networking_client,
+)
+
+
+class networking_firewall_default_inbound_policy_drop(Check):
+    """Check if Linode Cloud Firewall default inbound policy is DROP."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the networking_firewall_default_inbound_policy_drop check.
+
+        Iterates over all Cloud Firewalls and checks whether the default
+        inbound policy is DROP.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each firewall.
+        """
+        findings = []
+
+        for fw in networking_client.firewalls:
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=fw,
+                resource_name=fw.label,
+                resource_id=str(fw.id),
+                region="global",
+            )
+            report.resource_tags = fw.tags
+
+            if fw.inbound_policy == "DROP":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Firewall '{fw.label}' has default inbound policy set to DROP."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Firewall '{fw.label}' has default inbound policy set to {fw.inbound_policy}."
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/__init__.py b/prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop.metadata.json b/prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop.metadata.json
new file mode 100644
index 0000000000..5de3985464
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "linode",
+  "CheckID": "networking_firewall_default_outbound_policy_drop",
+  "CheckTitle": "Linode Cloud Firewall default outbound policy is DROP",
+  "CheckType": [],
+  "ServiceName": "networking",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "network",
+  "Description": "**Linode Cloud Firewalls** apply a **default outbound policy** to egress traffic that matches no explicit rule. This check verifies the default is set to `DROP`, enforcing **default-deny egress** so that only approved outbound connections are allowed to leave the instance.",
+  "Risk": "An outbound default of `ACCEPT` permits unrestricted egress from the instance. If a host is compromised, this eases **data exfiltration** and **command-and-control (C2)** communication and lets malware reach arbitrary external endpoints, harming **confidentiality** and enabling lateral movement.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/manage-firewall-rules"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Linode Cloud Manager\n2. Navigate to Firewalls\n3. Select the associated firewall\n4. In the Rules tab, set the default outbound policy to DROP",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Set the default outbound policy to `DROP` and allow only explicit outbound destinations and services.",
+      "Url": "https://hub.prowler.com/check/networking_firewall_default_outbound_policy_drop"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "networking_firewall_outbound_rules_configured"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop.py b/prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop.py
new file mode 100644
index 0000000000..011693aee9
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop.py
@@ -0,0 +1,42 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.providers.linode.services.networking.networking_client import (
+    networking_client,
+)
+
+
+class networking_firewall_default_outbound_policy_drop(Check):
+    """Check if Linode Cloud Firewall default outbound policy is DROP."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the networking_firewall_default_outbound_policy_drop check.
+
+        Iterates over all Cloud Firewalls and checks whether the default
+        outbound policy is DROP.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each firewall.
+        """
+        findings = []
+
+        for fw in networking_client.firewalls:
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=fw,
+                resource_name=fw.label,
+                resource_id=str(fw.id),
+                region="global",
+            )
+            report.resource_tags = fw.tags
+
+            if fw.outbound_policy == "DROP":
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Firewall '{fw.label}' has default outbound policy set to DROP."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = f"Firewall '{fw.label}' has default outbound policy set to {fw.outbound_policy}."
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/__init__.py b/prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured.metadata.json b/prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured.metadata.json
new file mode 100644
index 0000000000..5e54dc6241
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "linode",
+  "CheckID": "networking_firewall_inbound_rules_configured",
+  "CheckTitle": "Linode Cloud Firewall inbound rules are configured",
+  "CheckType": [],
+  "ServiceName": "networking",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "network",
+  "Description": "**Linode Cloud Firewalls** are checked to determine whether explicit **inbound rules** are configured. Defined ingress rules express the intended allow-list of sources, ports, and protocols instead of relying solely on the firewall's default policy.",
+  "Risk": "Without explicit **inbound rules**, ingress filtering depends entirely on the default policy and no intentional allow-list is documented. This makes the firewall's behavior ambiguous and harder to audit, raising the chance of **overly permissive access** or gaps in the protection operators expect.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/manage-firewall-rules"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Linode Cloud Manager\n2. Navigate to Firewalls\n3. Select the associated firewall\n4. Click Add an Inbound Rule in the Rules tab",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure explicit `inbound rules` to define allowed ingress sources, ports, and protocols and enforce expected security boundaries.",
+      "Url": "https://hub.prowler.com/check/networking_firewall_inbound_rules_configured"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "networking_firewall_default_inbound_policy_drop"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured.py b/prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured.py
new file mode 100644
index 0000000000..9eba9ddeb6
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured.py
@@ -0,0 +1,42 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.providers.linode.services.networking.networking_client import (
+    networking_client,
+)
+
+
+class networking_firewall_inbound_rules_configured(Check):
+    """Check if Linode Cloud Firewall has inbound rules configured."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the networking_firewall_inbound_rules_configured check.
+
+        Iterates over all Cloud Firewalls and checks whether at least one
+        explicit inbound rule is configured.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each firewall.
+        """
+        findings = []
+
+        for fw in networking_client.firewalls:
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=fw,
+                resource_name=fw.label,
+                resource_id=str(fw.id),
+                region="global",
+            )
+            report.resource_tags = fw.tags
+
+            if len(fw.inbound_rules) == 0:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Firewall '{fw.label}' has no inbound rules configured."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Firewall '{fw.label}' has {len(fw.inbound_rules)} inbound rule(s) configured."
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/__init__.py b/prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured.metadata.json b/prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured.metadata.json
new file mode 100644
index 0000000000..9bedf854cc
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "linode",
+  "CheckID": "networking_firewall_outbound_rules_configured",
+  "CheckTitle": "Linode Cloud Firewall outbound rules are configured",
+  "CheckType": [],
+  "ServiceName": "networking",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "network",
+  "Description": "**Linode Cloud Firewalls** are checked to determine whether explicit **outbound rules** are configured. Defined egress rules express which destinations, ports, and protocols an instance is permitted to reach, rather than depending only on the firewall's default policy.",
+  "Risk": "Without explicit **outbound rules**, egress behavior depends solely on the default policy and no intended destination allow-list exists. Unconstrained or undocumented egress complicates auditing and can enable **data exfiltration** or connections to malicious endpoints if a host is compromised.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/manage-firewall-rules"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Linode Cloud Manager\n2. Navigate to Firewalls\n3. Select the associated firewall\n4. Click Add an Outbound Rule in the Rules tab",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure explicit `outbound rules` to control allowed egress destinations, ports, and protocols.",
+      "Url": "https://hub.prowler.com/check/networking_firewall_outbound_rules_configured"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "networking_firewall_default_outbound_policy_drop"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured.py b/prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured.py
new file mode 100644
index 0000000000..1d97dca075
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured.py
@@ -0,0 +1,42 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.providers.linode.services.networking.networking_client import (
+    networking_client,
+)
+
+
+class networking_firewall_outbound_rules_configured(Check):
+    """Check if Linode Cloud Firewall has outbound rules configured."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the networking_firewall_outbound_rules_configured check.
+
+        Iterates over all Cloud Firewalls and checks whether at least one
+        explicit outbound rule is configured.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each firewall.
+        """
+        findings = []
+
+        for fw in networking_client.firewalls:
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=fw,
+                resource_name=fw.label,
+                resource_id=str(fw.id),
+                region="global",
+            )
+            report.resource_tags = fw.tags
+
+            if len(fw.outbound_rules) == 0:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Firewall '{fw.label}' has no outbound rules configured."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = f"Firewall '{fw.label}' has {len(fw.outbound_rules)} outbound rule(s) configured."
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/networking/networking_firewall_status_enabled/__init__.py b/prowler/providers/linode/services/networking/networking_firewall_status_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled.metadata.json b/prowler/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled.metadata.json
new file mode 100644
index 0000000000..dd1e760d4c
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "linode",
+  "CheckID": "networking_firewall_status_enabled",
+  "CheckTitle": "Linode Cloud Firewall status is enabled",
+  "CheckType": [],
+  "ServiceName": "networking",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "network",
+  "Description": "**Linode Cloud Firewalls** can be in an `enabled` or `disabled` state. This check verifies the firewall status is `enabled`, because a firewall must be active for its inbound and outbound policies and rules to actually filter network traffic.",
+  "Risk": "A `disabled` firewall enforces **none** of its configured rules or default policies, leaving attached instances with no network filtering. This can unexpectedly expose management ports and services to the internet, significantly increasing the risk of **unauthorized access** and exploitation.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://techdocs.akamai.com/cloud-computing/docs/update-cloud-firewall-status"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Log in to the Linode Cloud Manager\n2. Navigate to Firewalls\n3. Click on the Enable button from the options corresponding to the firewall whose status you would like to update",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable `Linode Cloud Firewalls` so configured network filtering controls are actively enforced.",
+      "Url": "https://hub.prowler.com/check/networking_firewall_status_enabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "networking_firewall_assigned_to_devices"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled.py b/prowler/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled.py
new file mode 100644
index 0000000000..603a088bd0
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled.py
@@ -0,0 +1,42 @@
+from prowler.lib.check.models import Check, CheckReportLinode
+from prowler.providers.linode.services.networking.networking_client import (
+    networking_client,
+)
+
+
+class networking_firewall_status_enabled(Check):
+    """Check if Linode Cloud Firewalls are enabled."""
+
+    def execute(self) -> list[CheckReportLinode]:
+        """Execute the networking_firewall_status_enabled check.
+
+        Iterates over all Cloud Firewalls and checks whether each one has
+        an enabled status.
+
+        Returns:
+            list[CheckReportLinode]: A list of findings for each firewall.
+        """
+        findings = []
+
+        for fw in networking_client.firewalls:
+            report = CheckReportLinode(
+                metadata=self.metadata(),
+                resource=fw,
+                resource_name=fw.label,
+                resource_id=str(fw.id),
+                region="global",
+            )
+            report.resource_tags = fw.tags
+
+            if fw.status == "enabled":
+                report.status = "PASS"
+                report.status_extended = f"Firewall '{fw.label}' is enabled."
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Firewall '{fw.label}' is not enabled (status: {fw.status})."
+                )
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/linode/services/networking/networking_service.py b/prowler/providers/linode/services/networking/networking_service.py
new file mode 100644
index 0000000000..97f811a98a
--- /dev/null
+++ b/prowler/providers/linode/services/networking/networking_service.py
@@ -0,0 +1,127 @@
+from typing import List, Optional
+
+from pydantic import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.linode.lib.service.service import LinodeService
+
+
+class FirewallRule(BaseModel):
+    """Model for a single firewall rule."""
+
+    protocol: str = "TCP"
+    ports: str = ""  # e.g. "22", "1-65535", ""
+    addresses_ipv4: List[str] = []
+    addresses_ipv6: List[str] = []
+    action: str = "ACCEPT"  # ACCEPT or DROP
+    label: str = ""
+
+
+class Firewall(BaseModel):
+    """Model for a Linode Cloud Firewall."""
+
+    id: int
+    label: str
+    status: str
+    inbound_rules: List[FirewallRule] = []
+    outbound_rules: List[FirewallRule] = []
+    inbound_policy: str
+    outbound_policy: str
+    # None means the device count could not be determined (fetch failed), as
+    # opposed to 0 which means the firewall genuinely has no devices attached.
+    attached_devices_count: Optional[int] = None
+    tags: List[str] = []
+
+
+class NetworkingService(LinodeService):
+    """Service to interact with Linode Cloud Firewalls."""
+
+    def __init__(self, provider):
+        super().__init__("networking", provider)
+        self.firewalls: List[Firewall] = []
+        self._describe_firewalls()
+
+    def _describe_firewalls(self):
+        """Fetch all Linode Cloud Firewalls with their rules."""
+        try:
+            raw_firewalls = self.client.networking.firewalls()
+            for fw in raw_firewalls:
+                try:
+                    inbound_rules = []
+                    outbound_rules = []
+                    inbound_policy = ""
+                    outbound_policy = ""
+                    attached_devices_count = None
+
+                    try:
+                        attached_devices_count = len(fw.devices)
+                    except Exception as error:
+                        logger.warning(
+                            f"firewall - Unable to fetch devices for firewall {fw.id}: {error}"
+                        )
+
+                    try:
+                        # linode_api4 Firewall objects expose rules as a mapped object.
+                        rules = fw.rules
+                        inbound_policy = getattr(rules, "inbound_policy", "")
+                        outbound_policy = getattr(rules, "outbound_policy", "")
+                        inbound = getattr(rules, "inbound", [])
+                        outbound = getattr(rules, "outbound", [])
+
+                        for rule in inbound:
+                            addresses = getattr(rule, "addresses", None)
+                            inbound_rules.append(
+                                FirewallRule(
+                                    protocol=(
+                                        getattr(rule, "protocol", None) or "TCP"
+                                    ).upper(),
+                                    ports=getattr(rule, "ports", "") or "",
+                                    addresses_ipv4=getattr(addresses, "ipv4", []) or [],
+                                    addresses_ipv6=getattr(addresses, "ipv6", []) or [],
+                                    action=(
+                                        getattr(rule, "action", None) or "ACCEPT"
+                                    ).upper(),
+                                    label=getattr(rule, "label", "") or "",
+                                )
+                            )
+                        for rule in outbound:
+                            addresses = getattr(rule, "addresses", None)
+                            outbound_rules.append(
+                                FirewallRule(
+                                    protocol=(
+                                        getattr(rule, "protocol", None) or "TCP"
+                                    ).upper(),
+                                    ports=getattr(rule, "ports", "") or "",
+                                    addresses_ipv4=getattr(addresses, "ipv4", []) or [],
+                                    addresses_ipv6=getattr(addresses, "ipv6", []) or [],
+                                    action=(
+                                        getattr(rule, "action", None) or "ACCEPT"
+                                    ).upper(),
+                                    label=getattr(rule, "label", "") or "",
+                                )
+                            )
+                    except Exception as error:
+                        logger.warning(
+                            f"firewall - Unable to fetch rules for firewall {fw.id}: {error}"
+                        )
+
+                    self.firewalls.append(
+                        Firewall(
+                            id=fw.id,
+                            label=fw.label or f"firewall-{fw.id}",
+                            status=fw.status or "unknown",
+                            inbound_rules=inbound_rules,
+                            outbound_rules=outbound_rules,
+                            inbound_policy=inbound_policy,
+                            outbound_policy=outbound_policy,
+                            attached_devices_count=attached_devices_count,
+                            tags=fw.tags or [],
+                        )
+                    )
+                except Exception as error:
+                    logger.error(
+                        f"firewall - Error processing firewall {fw.id}: "
+                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+        except Exception as error:
+            self._log_fetch_error("firewalls", "firewall:read_only", error)
diff --git a/pyproject.toml b/pyproject.toml
index f3cec52678..8ad1f6888d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -78,6 +78,7 @@ dependencies = [
   "google-auth-httplib2==0.2.0",
   "jsonschema==4.23.0",
   "kubernetes==32.0.1",
+  "linode-api4==5.45.0",
   "markdown==3.10.2",
   "microsoft-kiota-abstractions==1.9.9",
   "numpy==2.2.6",
@@ -218,6 +219,7 @@ constraint-dependencies = [
   "coverage==7.6.12",
   "darabonba-core==1.0.5",
   "decorator==5.2.1",
+  "deprecated==1.3.1",
   "dill==0.4.1",
   "distro==1.9.0",
   "dnspython==2.8.0",
@@ -300,6 +302,7 @@ constraint-dependencies = [
   "platformdirs==4.9.6",
   "plotly==6.7.0",
   "pluggy==1.6.0",
+  "polling==0.3.2",
   "prek==0.3.9",
   "propcache==0.5.2",
   "proto-plus==1.28.0",
diff --git a/tests/lib/cli/parser_test.py b/tests/lib/cli/parser_test.py
index cd602a3a61..94b6ad2b4d 100644
--- a/tests/lib/cli/parser_test.py
+++ b/tests/lib/cli/parser_test.py
@@ -17,7 +17,7 @@ prowler_command = "prowler"
 
 # capsys
 # https://docs.pytest.org/en/7.1.x/how-to/capture-stdout-stderr.html
-prowler_default_usage_error = "usage: prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,dashboard,iac,image,llm} ..."
+prowler_default_usage_error = "usage: prowler [-h] [--version] {aws,azure,gcp,kubernetes,m365,github,googleworkspace,okta,nhn,mongodbatlas,oraclecloud,alibabacloud,cloudflare,openstack,scaleway,stackit,vercel,linode,dashboard,iac,image,llm} ..."
 
 
 def mock_get_available_providers():
@@ -39,6 +39,7 @@ def mock_get_available_providers():
         "cloudflare",
         "openstack",
         "stackit",
+        "linode",
     ]
 
 
diff --git a/tests/lib/outputs/finding_test.py b/tests/lib/outputs/finding_test.py
index 0f1cb14e25..f843cb8f00 100644
--- a/tests/lib/outputs/finding_test.py
+++ b/tests/lib/outputs/finding_test.py
@@ -761,6 +761,87 @@ class TestFinding:
         assert finding_output.metadata.Severity == Severity.high
         assert finding_output.metadata.ResourceType == "mock_resource_type"
 
+    def _build_linode_check_output(self):
+        check_output = MagicMock()
+        check_output.resource_id = "12345"
+        check_output.resource_name = "test-instance"
+        check_output.resource_details = ""
+        check_output.resource_tags = {}
+        check_output.region = "us-east"
+        check_output.status = Status.PASS
+        check_output.status_extended = "Instance is compliant"
+        check_output.muted = False
+        check_output.check_metadata = mock_check_metadata(provider="linode")
+        check_output.resource = {}
+        check_output.compliance = {}
+        return check_output
+
+    def test_generate_output_linode(self):
+        """Test Linode output generation when the account ID is available."""
+        from prowler.providers.linode.models import LinodeIdentityInfo
+
+        provider = MagicMock()
+        provider.type = "linode"
+        provider.identity = LinodeIdentityInfo(
+            username="admin",
+            email="admin@example.com",
+            account_id="E1AF1B6C-1111-2222-3333-444455556666",
+        )
+
+        check_output = self._build_linode_check_output()
+        output_options = MagicMock()
+        output_options.unix_timestamp = False
+
+        finding_output = Finding.generate_output(provider, check_output, output_options)
+
+        assert finding_output.provider == "linode"
+        assert finding_output.auth_method == "api_token"
+        assert finding_output.account_uid == "E1AF1B6C-1111-2222-3333-444455556666"
+        assert finding_output.account_name == "admin"
+
+    def test_generate_output_linode_without_account_id_falls_back_to_username(self):
+        """account_uid is required; when account_id is None it must fall back to
+        the username so findings are never silently dropped."""
+        from prowler.providers.linode.models import LinodeIdentityInfo
+
+        provider = MagicMock()
+        provider.type = "linode"
+        provider.identity = LinodeIdentityInfo(
+            username="admin",
+            email="admin@example.com",
+            account_id=None,
+        )
+
+        check_output = self._build_linode_check_output()
+        output_options = MagicMock()
+        output_options.unix_timestamp = False
+
+        finding_output = Finding.generate_output(provider, check_output, output_options)
+
+        # Must not raise a ValidationError and must use the username fallback
+        assert finding_output.account_uid == "admin"
+
+    def test_generate_output_linode_without_account_id_or_username(self):
+        """When neither account_id nor username/email is available, account_uid
+        falls back to the literal provider name."""
+        from prowler.providers.linode.models import LinodeIdentityInfo
+
+        provider = MagicMock()
+        provider.type = "linode"
+        provider.identity = LinodeIdentityInfo(
+            username=None,
+            email=None,
+            account_id=None,
+        )
+
+        check_output = self._build_linode_check_output()
+        output_options = MagicMock()
+        output_options.unix_timestamp = False
+
+        finding_output = Finding.generate_output(provider, check_output, output_options)
+
+        assert finding_output.account_uid == "linode"
+
     def test_generate_output_iac_remote(self):
         # Mock provider
         provider = MagicMock()
diff --git a/tests/providers/linode/lib/mutelist/fixtures/linode_mutelist.yaml b/tests/providers/linode/lib/mutelist/fixtures/linode_mutelist.yaml
new file mode 100644
index 0000000000..60a3edef84
--- /dev/null
+++ b/tests/providers/linode/lib/mutelist/fixtures/linode_mutelist.yaml
@@ -0,0 +1,9 @@
+Mutelist:
+  Accounts:
+    "E1AF1B6C-1111-2222-3333-444455556666":
+      Checks:
+        "administration_user_2fa_enabled":
+          Regions:
+            - "*"
+          Resources:
+            - "admin"
diff --git a/tests/providers/linode/lib/mutelist/linode_mutelist_test.py b/tests/providers/linode/lib/mutelist/linode_mutelist_test.py
new file mode 100644
index 0000000000..f122e5bcae
--- /dev/null
+++ b/tests/providers/linode/lib/mutelist/linode_mutelist_test.py
@@ -0,0 +1,98 @@
+from unittest.mock import MagicMock
+
+import yaml
+
+from prowler.providers.linode.lib.mutelist.mutelist import LinodeMutelist
+
+MUTELIST_FIXTURE_PATH = (
+    "tests/providers/linode/lib/mutelist/fixtures/linode_mutelist.yaml"
+)
+
+
+class Test_linode_mutelist:
+    def test_get_mutelist_file_from_local_file(self):
+        mutelist = LinodeMutelist(mutelist_path=MUTELIST_FIXTURE_PATH)
+
+        with open(MUTELIST_FIXTURE_PATH) as f:
+            mutelist_fixture = yaml.safe_load(f)["Mutelist"]
+
+        assert mutelist.mutelist == mutelist_fixture
+        assert mutelist.mutelist_file_path == MUTELIST_FIXTURE_PATH
+
+    def test_get_mutelist_file_from_local_file_non_existent(self):
+        mutelist_path = "tests/providers/linode/lib/mutelist/fixtures/not_present"
+        mutelist = LinodeMutelist(mutelist_path=mutelist_path)
+
+        assert mutelist.mutelist == {}
+        assert mutelist.mutelist_file_path == mutelist_path
+
+    def test_validate_mutelist_not_valid_key(self):
+        with open(MUTELIST_FIXTURE_PATH) as f:
+            mutelist_fixture = yaml.safe_load(f)["Mutelist"]
+
+        mutelist_fixture["Accounts1"] = mutelist_fixture["Accounts"]
+        del mutelist_fixture["Accounts"]
+
+        mutelist = LinodeMutelist(mutelist_content=mutelist_fixture)
+
+        assert len(mutelist.validate_mutelist(mutelist_fixture)) == 0
+        assert mutelist.mutelist == {}
+        assert mutelist.mutelist_file_path is None
+
+    def test_is_finding_muted(self):
+        mutelist_content = {
+            "Accounts": {
+                "E1AF1B6C-1111-2222-3333-444455556666": {
+                    "Checks": {
+                        "administration_user_2fa_enabled": {
+                            "Regions": ["*"],
+                            "Resources": ["admin"],
+                        }
+                    }
+                }
+            }
+        }
+
+        mutelist = LinodeMutelist(mutelist_content=mutelist_content)
+
+        finding = MagicMock()
+        finding.check_metadata = MagicMock()
+        finding.check_metadata.CheckID = "administration_user_2fa_enabled"
+        finding.status = "FAIL"
+        finding.region = "global"
+        finding.resource_id = "admin"
+        finding.resource_name = "admin"
+        finding.resource_tags = []
+
+        assert mutelist.is_finding_muted(
+            finding, "E1AF1B6C-1111-2222-3333-444455556666"
+        )
+
+    def test_is_finding_not_muted(self):
+        mutelist_content = {
+            "Accounts": {
+                "E1AF1B6C-1111-2222-3333-444455556666": {
+                    "Checks": {
+                        "administration_user_2fa_enabled": {
+                            "Regions": ["*"],
+                            "Resources": ["other-user"],
+                        }
+                    }
+                }
+            }
+        }
+
+        mutelist = LinodeMutelist(mutelist_content=mutelist_content)
+
+        finding = MagicMock()
+        finding.check_metadata = MagicMock()
+        finding.check_metadata.CheckID = "administration_user_2fa_enabled"
+        finding.status = "FAIL"
+        finding.region = "global"
+        finding.resource_id = "admin"
+        finding.resource_name = "admin"
+        finding.resource_tags = []
+
+        assert not mutelist.is_finding_muted(
+            finding, "E1AF1B6C-1111-2222-3333-444455556666"
+        )
diff --git a/tests/providers/linode/linode_fixtures.py b/tests/providers/linode/linode_fixtures.py
new file mode 100644
index 0000000000..5786ffe881
--- /dev/null
+++ b/tests/providers/linode/linode_fixtures.py
@@ -0,0 +1,34 @@
+from unittest.mock import MagicMock
+
+from prowler.providers.linode.models import (
+    LinodeIdentityInfo,
+    LinodeSession,
+)
+
+# Linode Identity
+USERNAME = "admin"
+EMAIL = "admin@example.com"
+ACCOUNT_ID = "E1AF1B6C-1111-2222-3333-444455556666"
+
+# Linode Credentials
+TOKEN = "fake-linode-token-for-testing"
+
+
+def set_mocked_linode_provider(
+    username: str = USERNAME,
+    email: str = EMAIL,
+    account_id: str = ACCOUNT_ID,
+):
+    """Return a mocked LinodeProvider with identity and session set."""
+    provider = MagicMock()
+    provider.type = "linode"
+    provider.identity = LinodeIdentityInfo(
+        username=username,
+        email=email,
+        account_id=account_id,
+    )
+    provider.session = LinodeSession(
+        client=MagicMock(),
+        token=TOKEN,
+    )
+    return provider
diff --git a/tests/providers/linode/linode_metadata_test.py b/tests/providers/linode/linode_metadata_test.py
new file mode 100644
index 0000000000..9409c468af
--- /dev/null
+++ b/tests/providers/linode/linode_metadata_test.py
@@ -0,0 +1,46 @@
+from pathlib import Path
+
+import pytest
+
+from prowler.lib.check.models import CheckMetadata
+
+EXPECTED_SERVICE_NAMES = {
+    "administration": "administration",
+    "compute": "compute",
+    "networking": "networking",
+}
+
+
+@pytest.mark.parametrize(
+    "metadata_file",
+    sorted(Path("prowler/providers/linode").glob("services/**/*.metadata.json")),
+)
+def test_linode_check_metadata_is_valid(metadata_file):
+    metadata = CheckMetadata.parse_file(metadata_file)
+    assert metadata.Provider == "linode"
+    assert metadata.CheckID == metadata_file.stem.replace(".metadata", "")
+
+
+@pytest.mark.parametrize(
+    "metadata_file",
+    sorted(Path("prowler/providers/linode").glob("services/**/*.metadata.json")),
+)
+def test_linode_checks_metadata_use_canonical_hub_urls(metadata_file):
+    metadata = CheckMetadata.parse_file(metadata_file)
+    url = metadata.Remediation.Recommendation.Url
+    assert not url.startswith(
+        "https://hub.prowler.com/checks/linode/"
+    ), f"{metadata_file}: non-canonical hub URL {url}"
+
+
+@pytest.mark.parametrize(
+    "metadata_file",
+    sorted(Path("prowler/providers/linode").glob("services/**/*.metadata.json")),
+)
+def test_linode_check_metadata_uses_product_area_service_names(metadata_file):
+    metadata = CheckMetadata.parse_file(metadata_file)
+    service_folder = metadata_file.relative_to(
+        Path("prowler/providers/linode/services")
+    ).parts[0]
+
+    assert metadata.ServiceName == EXPECTED_SERVICE_NAMES[service_folder]
diff --git a/tests/providers/linode/linode_provider_test.py b/tests/providers/linode/linode_provider_test.py
new file mode 100644
index 0000000000..67df6ccc20
--- /dev/null
+++ b/tests/providers/linode/linode_provider_test.py
@@ -0,0 +1,146 @@
+import os
+from unittest import mock
+
+import pytest
+
+from prowler.providers.linode.exceptions.exceptions import (
+    LinodeAuthenticationError,
+    LinodeCredentialsError,
+    LinodeInvalidRegionError,
+)
+from prowler.providers.linode.linode_provider import LinodeProvider
+from prowler.providers.linode.models import LinodeIdentityInfo, LinodeSession
+from tests.providers.linode.linode_fixtures import (
+    ACCOUNT_ID,
+    EMAIL,
+    TOKEN,
+    USERNAME,
+)
+
+
+class TestLinodeProvider_setup_session:
+    def test_missing_token_raises_credentials_error(self):
+        with mock.patch.dict(os.environ, {"LINODE_TOKEN": ""}, clear=False):
+            os.environ.pop("LINODE_TOKEN", None)
+            with pytest.raises(LinodeCredentialsError):
+                LinodeProvider.setup_session()
+
+    def test_returns_session_with_token(self):
+        session = LinodeProvider.setup_session(token=TOKEN)
+        assert isinstance(session, LinodeSession)
+        assert session.token == TOKEN
+        assert session.client is not None
+
+    def test_reads_token_from_env(self):
+        with mock.patch.dict(os.environ, {"LINODE_TOKEN": TOKEN}, clear=False):
+            session = LinodeProvider.setup_session()
+            assert session.token == TOKEN
+
+
+class TestLinodeProvider_setup_identity:
+    def _build_session(self):
+        client = mock.MagicMock()
+        return LinodeSession(client=client, token=TOKEN)
+
+    def test_resolves_identity_from_profile_and_account(self):
+        session = self._build_session()
+        profile = mock.MagicMock()
+        profile.username = USERNAME
+        profile.email = EMAIL
+        session.client.profile.return_value = profile
+
+        account = mock.MagicMock()
+        account.euuid = ACCOUNT_ID
+        session.client.account.return_value = account
+
+        identity = LinodeProvider.setup_identity(session)
+
+        assert isinstance(identity, LinodeIdentityInfo)
+        assert identity.username == USERNAME
+        assert identity.email == EMAIL
+        assert identity.account_id == ACCOUNT_ID
+
+    def test_invalid_token_raises_authentication_error(self):
+        # An invalid token fails the profile call (any valid token can read its
+        # own profile), so the scan must abort instead of returning empty data.
+        session = self._build_session()
+        session.client.profile.side_effect = Exception("[401] Invalid Token")
+
+        with pytest.raises(LinodeAuthenticationError):
+            LinodeProvider.setup_identity(session)
+
+    def test_identity_with_account_failure_still_returns(self):
+        session = self._build_session()
+        profile = mock.MagicMock()
+        profile.username = USERNAME
+        profile.email = EMAIL
+        session.client.profile.return_value = profile
+        session.client.account.side_effect = Exception("forbidden")
+
+        identity = LinodeProvider.setup_identity(session)
+
+        assert identity.username == USERNAME
+        assert identity.email == EMAIL
+        assert identity.account_id is None
+
+
+class TestLinodeProvider_test_connection:
+    def test_successful_connection(self):
+        with mock.patch(
+            "prowler.providers.linode.linode_provider.LinodeProvider.setup_session"
+        ) as mock_session:
+            session = mock.MagicMock()
+            session.client.profile.return_value = mock.MagicMock()
+            mock_session.return_value = session
+
+            conn = LinodeProvider.test_connection(token=TOKEN, raise_on_exception=False)
+
+            assert conn.is_connected is True
+
+    def test_missing_credentials(self):
+        with mock.patch.dict(os.environ, {"LINODE_TOKEN": ""}, clear=False):
+            os.environ.pop("LINODE_TOKEN", None)
+            conn = LinodeProvider.test_connection(token=None, raise_on_exception=False)
+            assert conn.is_connected is False
+
+    def test_connection_failure_raises_when_requested(self):
+        with mock.patch(
+            "prowler.providers.linode.linode_provider.LinodeProvider.setup_session"
+        ) as mock_session:
+            mock_session.side_effect = LinodeCredentialsError(
+                file="test", message="No token"
+            )
+            with pytest.raises(LinodeCredentialsError):
+                LinodeProvider.test_connection(token=None, raise_on_exception=True)
+
+
+class TestLinodeProvider_validate_regions:
+    def _session_with_regions(self, region_ids):
+        client = mock.MagicMock()
+        client.regions.return_value = [mock.MagicMock(id=rid) for rid in region_ids]
+        return LinodeSession(client=client, token=TOKEN)
+
+    def test_no_regions_returns_none(self):
+        session = self._session_with_regions(["eu-central", "us-east"])
+        assert LinodeProvider.validate_regions(session, None) is None
+
+    def test_valid_regions_returns_set(self):
+        session = self._session_with_regions(["eu-central", "us-east", "ap-south"])
+        result = LinodeProvider.validate_regions(session, ["eu-central", "us-east"])
+        assert result == {"eu-central", "us-east"}
+
+    def test_invalid_region_raises(self):
+        session = self._session_with_regions(["eu-central", "us-east"])
+        with pytest.raises(LinodeInvalidRegionError):
+            LinodeProvider.validate_regions(session, ["eu-central", "nonexistent"])
+
+    def test_regions_api_failure_does_not_block(self):
+        # If the public regions list cannot be fetched, the scan proceeds with
+        # the requested regions instead of failing.
+        client = mock.MagicMock()
+        client.regions.side_effect = Exception("regions API error")
+        session = LinodeSession(client=client, token=TOKEN)
+
+        result = LinodeProvider.validate_regions(session, ["eu-central"])
+
+        assert result == {"eu-central"}
diff --git a/tests/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled_test.py b/tests/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled_test.py
new file mode 100644
index 0000000000..a4e77c662a
--- /dev/null
+++ b/tests/providers/linode/services/administration/administration_user_2fa_enabled/administration_user_2fa_enabled_test.py
@@ -0,0 +1,97 @@
+from unittest import mock
+
+from prowler.providers.linode.services.administration.administration_service import (
+    User,
+)
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_administration_user_2fa_enabled:
+    def test_no_users(self):
+        administration_client = mock.MagicMock()
+        administration_client.users = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.administration.administration_user_2fa_enabled.administration_user_2fa_enabled.administration_client",
+                new=administration_client,
+            ),
+        ):
+            from prowler.providers.linode.services.administration.administration_user_2fa_enabled.administration_user_2fa_enabled import (
+                administration_user_2fa_enabled,
+            )
+
+            check = administration_user_2fa_enabled()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_user_with_2fa(self):
+        administration_client = mock.MagicMock()
+        administration_client.users = [
+            User(
+                username="admin",
+                email="admin@example.com",
+                tfa_enabled=True,
+                restricted=False,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.administration.administration_user_2fa_enabled.administration_user_2fa_enabled.administration_client",
+                new=administration_client,
+            ),
+        ):
+            from prowler.providers.linode.services.administration.administration_user_2fa_enabled.administration_user_2fa_enabled import (
+                administration_user_2fa_enabled,
+            )
+
+            check = administration_user_2fa_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_name == "admin"
+            assert result[0].resource_id == "admin"
+
+    def test_user_without_2fa(self):
+        administration_client = mock.MagicMock()
+        administration_client.users = [
+            User(
+                username="dev-user",
+                email="dev@example.com",
+                tfa_enabled=False,
+                restricted=True,
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.administration.administration_user_2fa_enabled.administration_user_2fa_enabled.administration_client",
+                new=administration_client,
+            ),
+        ):
+            from prowler.providers.linode.services.administration.administration_user_2fa_enabled.administration_user_2fa_enabled import (
+                administration_user_2fa_enabled,
+            )
+
+            check = administration_user_2fa_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_name == "dev-user"
+            assert result[0].resource_id == "dev-user"
diff --git a/tests/providers/linode/services/administration/linode_administration_service_test.py b/tests/providers/linode/services/administration/linode_administration_service_test.py
new file mode 100644
index 0000000000..b8393c073a
--- /dev/null
+++ b/tests/providers/linode/services/administration/linode_administration_service_test.py
@@ -0,0 +1,102 @@
+from unittest.mock import MagicMock, patch
+
+from linode_api4.errors import ApiError
+
+from prowler.providers.linode.services.administration.administration_service import (
+    AdministrationService,
+)
+
+
+def _mock_user(username="admin", email="admin@example.com", tfa=True, restricted=False):
+    user = MagicMock()
+    user.username = username
+    user.email = email
+    user.tfa_enabled = tfa
+    user.restricted = restricted
+    return user
+
+
+def _build_service(account_users_return=None, account_users_side_effect=None):
+    """Build an AdministrationService with an isolated mock client."""
+    service = object.__new__(AdministrationService)
+    service.users = []
+
+    # Build isolated mock hierarchy for client.account.users()
+    # Must explicitly create the users callable as a fresh MagicMock
+    # because check tests contaminate MagicMock class with users=[...]
+    users_callable = MagicMock()
+    if account_users_side_effect:
+        users_callable.side_effect = account_users_side_effect
+    else:
+        users_callable.return_value = account_users_return or []
+
+    account_mock = MagicMock()
+    account_mock.users = users_callable
+
+    client_mock = MagicMock()
+    client_mock.account = account_mock
+    service.client = client_mock
+    return service
+
+
+class TestLinodeAdministrationService:
+    def test_describe_users_parses_correctly(self):
+        mock_users = [
+            _mock_user("admin", "admin@example.com", True, False),
+            _mock_user("reader", "reader@example.com", False, True),
+        ]
+
+        service = _build_service(account_users_return=mock_users)
+        service._describe_users()
+
+        assert len(service.users) == 2
+        assert service.users[0].username == "admin"
+        assert service.users[0].tfa_enabled is True
+        assert service.users[1].username == "reader"
+        assert service.users[1].restricted is True
+
+    def test_describe_users_handles_empty_list(self):
+        service = _build_service(account_users_return=[])
+        service._describe_users()
+
+        assert len(service.users) == 0
+
+    def test_describe_users_handles_api_error(self):
+        service = _build_service(account_users_side_effect=Exception("API error"))
+        service._describe_users()
+
+        assert len(service.users) == 0
+
+    def test_describe_users_handles_null_fields(self):
+        """A user with null tfa_enabled/email must still be included with safe
+        defaults instead of being dropped by a ValidationError."""
+        user = MagicMock()
+        user.username = "partial"
+        user.email = None
+        user.tfa_enabled = None
+        user.restricted = None
+
+        service = _build_service(account_users_return=[user])
+        service._describe_users()
+
+        assert len(service.users) == 1
+        assert service.users[0].username == "partial"
+        assert service.users[0].email == ""
+        assert service.users[0].tfa_enabled is False
+        assert service.users[0].restricted is False
+
+    def test_describe_users_missing_scope_logs_permission_error(self):
+        error = ApiError(
+            "Your OAuth token is not authorized to use this endpoint.", status=401
+        )
+        service = _build_service(account_users_side_effect=error)
+
+        with patch(
+            "prowler.providers.linode.lib.service.service.logger"
+        ) as logger_mock:
+            service._describe_users()
+
+        assert len(service.users) == 0
+        logged = " ".join(str(c) for c in logger_mock.error.call_args_list)
+        assert "LinodeMissingPermissionError" in logged
+        assert "account:read_only" in logged
diff --git a/tests/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled_test.py b/tests/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled_test.py
new file mode 100644
index 0000000000..93e19fa6b1
--- /dev/null
+++ b/tests/providers/linode/services/compute/compute_instance_backups_enabled/compute_instance_backups_enabled_test.py
@@ -0,0 +1,109 @@
+from unittest import mock
+
+from prowler.providers.linode.services.compute.compute_service import (
+    Instance,
+)
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_compute_instance_backups_enabled:
+    def test_no_instances(self):
+        compute_client = mock.MagicMock()
+        compute_client.instances = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.compute.compute_instance_backups_enabled.compute_instance_backups_enabled.compute_client",
+                new=compute_client,
+            ),
+        ):
+            from prowler.providers.linode.services.compute.compute_instance_backups_enabled.compute_instance_backups_enabled import (
+                compute_instance_backups_enabled,
+            )
+
+            check = compute_instance_backups_enabled()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_compute_instance_backups_enabled(self):
+        compute_client = mock.MagicMock()
+        compute_client.instances = [
+            Instance(
+                id=12345,
+                label="ubuntu-eu-central",
+                region="us-east",
+                status="running",
+                backups_enabled=True,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.compute.compute_instance_backups_enabled.compute_instance_backups_enabled.compute_client",
+                new=compute_client,
+            ),
+        ):
+            from prowler.providers.linode.services.compute.compute_instance_backups_enabled.compute_instance_backups_enabled import (
+                compute_instance_backups_enabled,
+            )
+
+            check = compute_instance_backups_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "12345"
+            assert result[0].resource_name == "ubuntu-eu-central"
+            assert (
+                result[0].status_extended
+                == "Instance ubuntu-eu-central has the Backup service enabled."
+            )
+
+    def test_instance_backups_disabled(self):
+        compute_client = mock.MagicMock()
+        compute_client.instances = [
+            Instance(
+                id=12345,
+                label="ubuntu-eu-central",
+                region="us-east",
+                status="running",
+                backups_enabled=False,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.compute.compute_instance_backups_enabled.compute_instance_backups_enabled.compute_client",
+                new=compute_client,
+            ),
+        ):
+            from prowler.providers.linode.services.compute.compute_instance_backups_enabled.compute_instance_backups_enabled import (
+                compute_instance_backups_enabled,
+            )
+
+            check = compute_instance_backups_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "12345"
+            assert result[0].resource_name == "ubuntu-eu-central"
+            assert (
+                result[0].status_extended
+                == "Instance ubuntu-eu-central does not have the Backup service enabled."
+            )
diff --git a/tests/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled_test.py b/tests/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled_test.py
new file mode 100644
index 0000000000..d5023d2f94
--- /dev/null
+++ b/tests/providers/linode/services/compute/compute_instance_disk_encryption_enabled/compute_instance_disk_encryption_enabled_test.py
@@ -0,0 +1,109 @@
+from unittest import mock
+
+from prowler.providers.linode.services.compute.compute_service import (
+    Instance,
+)
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_compute_instance_disk_encryption_enabled:
+    def test_no_instances(self):
+        compute_client = mock.MagicMock()
+        compute_client.instances = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.compute.compute_instance_disk_encryption_enabled.compute_instance_disk_encryption_enabled.compute_client",
+                new=compute_client,
+            ),
+        ):
+            from prowler.providers.linode.services.compute.compute_instance_disk_encryption_enabled.compute_instance_disk_encryption_enabled import (
+                compute_instance_disk_encryption_enabled,
+            )
+
+            check = compute_instance_disk_encryption_enabled()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_compute_instance_disk_encryption_enabled(self):
+        compute_client = mock.MagicMock()
+        compute_client.instances = [
+            Instance(
+                id=12345,
+                label="ubuntu-eu-central",
+                region="us-east",
+                status="running",
+                disk_encryption="enabled",
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.compute.compute_instance_disk_encryption_enabled.compute_instance_disk_encryption_enabled.compute_client",
+                new=compute_client,
+            ),
+        ):
+            from prowler.providers.linode.services.compute.compute_instance_disk_encryption_enabled.compute_instance_disk_encryption_enabled import (
+                compute_instance_disk_encryption_enabled,
+            )
+
+            check = compute_instance_disk_encryption_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "12345"
+            assert result[0].resource_name == "ubuntu-eu-central"
+            assert (
+                result[0].status_extended
+                == "Instance ubuntu-eu-central has disk encryption enabled."
+            )
+
+    def test_instance_disk_encryption_disabled(self):
+        compute_client = mock.MagicMock()
+        compute_client.instances = [
+            Instance(
+                id=12345,
+                label="ubuntu-eu-central",
+                region="us-east",
+                status="running",
+                disk_encryption="disabled",
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.compute.compute_instance_disk_encryption_enabled.compute_instance_disk_encryption_enabled.compute_client",
+                new=compute_client,
+            ),
+        ):
+            from prowler.providers.linode.services.compute.compute_instance_disk_encryption_enabled.compute_instance_disk_encryption_enabled import (
+                compute_instance_disk_encryption_enabled,
+            )
+
+            check = compute_instance_disk_encryption_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "12345"
+            assert result[0].resource_name == "ubuntu-eu-central"
+            assert (
+                result[0].status_extended
+                == "Instance ubuntu-eu-central does not have disk encryption enabled."
+            )
diff --git a/tests/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled_test.py b/tests/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled_test.py
new file mode 100644
index 0000000000..db5ddaacd0
--- /dev/null
+++ b/tests/providers/linode/services/compute/compute_instance_watchdog_enabled/compute_instance_watchdog_enabled_test.py
@@ -0,0 +1,109 @@
+from unittest import mock
+
+from prowler.providers.linode.services.compute.compute_service import (
+    Instance,
+)
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_compute_instance_watchdog_enabled:
+    def test_no_instances(self):
+        compute_client = mock.MagicMock()
+        compute_client.instances = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.compute.compute_instance_watchdog_enabled.compute_instance_watchdog_enabled.compute_client",
+                new=compute_client,
+            ),
+        ):
+            from prowler.providers.linode.services.compute.compute_instance_watchdog_enabled.compute_instance_watchdog_enabled import (
+                compute_instance_watchdog_enabled,
+            )
+
+            check = compute_instance_watchdog_enabled()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_compute_instance_watchdog_enabled(self):
+        compute_client = mock.MagicMock()
+        compute_client.instances = [
+            Instance(
+                id=12345,
+                label="ubuntu-eu-central",
+                region="us-east",
+                status="running",
+                watchdog_enabled=True,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.compute.compute_instance_watchdog_enabled.compute_instance_watchdog_enabled.compute_client",
+                new=compute_client,
+            ),
+        ):
+            from prowler.providers.linode.services.compute.compute_instance_watchdog_enabled.compute_instance_watchdog_enabled import (
+                compute_instance_watchdog_enabled,
+            )
+
+            check = compute_instance_watchdog_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "12345"
+            assert result[0].resource_name == "ubuntu-eu-central"
+            assert (
+                result[0].status_extended
+                == "Instance ubuntu-eu-central has Watchdog (Lassie) enabled."
+            )
+
+    def test_instance_watchdog_disabled(self):
+        compute_client = mock.MagicMock()
+        compute_client.instances = [
+            Instance(
+                id=12345,
+                label="ubuntu-eu-central",
+                region="us-east",
+                status="running",
+                watchdog_enabled=False,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.compute.compute_instance_watchdog_enabled.compute_instance_watchdog_enabled.compute_client",
+                new=compute_client,
+            ),
+        ):
+            from prowler.providers.linode.services.compute.compute_instance_watchdog_enabled.compute_instance_watchdog_enabled import (
+                compute_instance_watchdog_enabled,
+            )
+
+            check = compute_instance_watchdog_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "12345"
+            assert result[0].resource_name == "ubuntu-eu-central"
+            assert (
+                result[0].status_extended
+                == "Instance ubuntu-eu-central does not have Watchdog (Lassie) enabled."
+            )
diff --git a/tests/providers/linode/services/compute/linode_compute_service_test.py b/tests/providers/linode/services/compute/linode_compute_service_test.py
new file mode 100644
index 0000000000..09b1a54e84
--- /dev/null
+++ b/tests/providers/linode/services/compute/linode_compute_service_test.py
@@ -0,0 +1,143 @@
+from unittest.mock import MagicMock, patch
+
+from linode_api4.errors import ApiError
+
+from prowler.providers.linode.services.compute.compute_service import (
+    ComputeService,
+)
+
+
+def _mock_instance(
+    id=1,
+    label="my-instance",
+    region="us-east",
+    status="running",
+    backups_enabled=True,
+    disk_encryption="enabled",
+    watchdog_enabled=True,
+    tags=None,
+):
+    inst = MagicMock()
+    inst.id = id
+    inst.label = label
+    region_mock = MagicMock()
+    region_mock.id = region
+    inst.region = region_mock
+    inst.status = status
+    backups = MagicMock()
+    backups.enabled = backups_enabled
+    inst.backups = backups
+    inst.disk_encryption = disk_encryption
+    inst.watchdog_enabled = watchdog_enabled
+    inst.tags = tags or []
+    return inst
+
+
+def _build_service(linode_instances_return=None, linode_instances_side_effect=None):
+    """Build a ComputeService with an isolated mock client."""
+    service = object.__new__(ComputeService)
+    service.instances = []
+
+    # Build isolated mock hierarchy for client.linode.instances()
+    # Must explicitly create the instances callable as a fresh MagicMock
+    # because check tests contaminate MagicMock class with instances=[...]
+    instances_callable = MagicMock()
+    if linode_instances_side_effect:
+        instances_callable.side_effect = linode_instances_side_effect
+    else:
+        instances_callable.return_value = linode_instances_return or []
+
+    linode_mock = MagicMock()
+    linode_mock.instances = instances_callable
+
+    client_mock = MagicMock()
+    client_mock.linode = linode_mock
+    service.client = client_mock
+    return service
+
+
+class TestLinodeComputeService:
+    def test_describe_instances_parses_correctly(self):
+        mock_instances = [
+            _mock_instance(id=1, label="web-1", region="us-east"),
+            _mock_instance(id=2, label="db-1", region="eu-west", backups_enabled=False),
+        ]
+
+        service = _build_service(linode_instances_return=mock_instances)
+        service._describe_instances()
+
+        assert len(service.instances) == 2
+        assert service.instances[0].label == "web-1"
+        assert service.instances[0].region == "us-east"
+        assert service.instances[0].backups_enabled is True
+        assert service.instances[1].label == "db-1"
+        assert service.instances[1].backups_enabled is False
+
+    def test_describe_instances_handles_empty_list(self):
+        service = _build_service(linode_instances_return=[])
+        service._describe_instances()
+
+        assert len(service.instances) == 0
+
+    def test_describe_instances_handles_api_error(self):
+        service = _build_service(linode_instances_side_effect=Exception("API error"))
+        service._describe_instances()
+
+        assert len(service.instances) == 0
+
+    def test_describe_instances_missing_scope_logs_permission_error(self):
+        error = ApiError(
+            "Your OAuth token is not authorized to use this endpoint.", status=401
+        )
+        service = _build_service(linode_instances_side_effect=error)
+
+        with patch(
+            "prowler.providers.linode.lib.service.service.logger"
+        ) as logger_mock:
+            service._describe_instances()
+
+        assert len(service.instances) == 0
+        logged = " ".join(str(c) for c in logger_mock.error.call_args_list)
+        assert "LinodeMissingPermissionError" in logged
+        assert "linodes:read_only" in logged
+
+    def test_describe_instances_disk_encryption(self):
+        mock_instances = [
+            _mock_instance(id=1, disk_encryption="enabled"),
+            _mock_instance(id=2, disk_encryption="disabled"),
+        ]
+
+        service = _build_service(linode_instances_return=mock_instances)
+        service._describe_instances()
+
+        assert service.instances[0].disk_encryption == "enabled"
+        assert service.instances[1].disk_encryption == "disabled"
+
+    def test_describe_instances_region_filter_keeps_only_matching(self):
+        mock_instances = [
+            _mock_instance(id=1, label="eu", region="eu-central"),
+            _mock_instance(id=2, label="us", region="us-east"),
+            _mock_instance(id=3, label="eu-2", region="eu-central"),
+        ]
+        service = _build_service(linode_instances_return=mock_instances)
+        service.provider = MagicMock()
+        service.provider.regions = {"eu-central"}
+
+        service._describe_instances()
+
+        assert len(service.instances) == 2
+        assert {i.label for i in service.instances} == {"eu", "eu-2"}
+        assert all(i.region == "eu-central" for i in service.instances)
+
+    def test_describe_instances_no_region_filter_keeps_all(self):
+        mock_instances = [
+            _mock_instance(id=1, region="eu-central"),
+            _mock_instance(id=2, region="us-east"),
+        ]
+        service = _build_service(linode_instances_return=mock_instances)
+        service.provider = MagicMock()
+        service.provider.regions = None
+
+        service._describe_instances()
+
+        assert len(service.instances) == 2
diff --git a/tests/providers/linode/services/networking/linode_networking_service_test.py b/tests/providers/linode/services/networking/linode_networking_service_test.py
new file mode 100644
index 0000000000..cd4f43f423
--- /dev/null
+++ b/tests/providers/linode/services/networking/linode_networking_service_test.py
@@ -0,0 +1,193 @@
+from unittest.mock import MagicMock, patch
+
+from linode_api4.errors import ApiError
+
+from prowler.providers.linode.services.networking.networking_service import (
+    NetworkingService,
+)
+
+
+def _mock_rule(
+    protocol="TCP", ports="22", ipv4=None, ipv6=None, action="ACCEPT", label=""
+):
+    rule = MagicMock()
+    rule.protocol = protocol
+    rule.ports = ports
+    rule.action = action
+    rule.label = label
+    addresses = MagicMock()
+    addresses.ipv4 = ipv4 or []
+    addresses.ipv6 = ipv6 or []
+    rule.addresses = addresses
+    return rule
+
+
+def _mock_firewall(
+    id=1, label="my-fw", status="enabled", inbound=None, outbound=None, tags=None
+):
+    fw = MagicMock()
+    fw.id = id
+    fw.label = label
+    fw.status = status
+    fw.tags = tags or []
+    rules = MagicMock()
+    rules.inbound = inbound or []
+    rules.outbound = outbound or []
+    rules.inbound_policy = "DROP"
+    rules.outbound_policy = "DROP"
+    fw.rules = rules
+    return fw
+
+
+def _build_service(
+    networking_firewalls_return=None, networking_firewalls_side_effect=None
+):
+    """Build a NetworkingService instance with a properly isolated mock client."""
+    service = object.__new__(NetworkingService)
+    service.firewalls = []
+
+    firewalls_callable = MagicMock()
+    if networking_firewalls_side_effect:
+        firewalls_callable.side_effect = networking_firewalls_side_effect
+    else:
+        firewalls_callable.return_value = networking_firewalls_return or []
+
+    networking_mock = MagicMock()
+    networking_mock.firewalls = firewalls_callable
+
+    client_mock = MagicMock()
+    client_mock.networking = networking_mock
+    service.client = client_mock
+    return service
+
+
+class TestLinodeNetworkingService:
+    def test_describe_firewalls_parses_correctly(self):
+        inbound_rules = [
+            _mock_rule("TCP", "22", ipv4=["192.168.1.0/24"]),
+            _mock_rule("TCP", "443", ipv4=["0.0.0.0/0"]),
+        ]
+        mock_fws = [
+            _mock_firewall(id=1, label="prod-fw", inbound=inbound_rules),
+        ]
+
+        service = _build_service(networking_firewalls_return=mock_fws)
+        service._describe_firewalls()
+
+        assert len(service.firewalls) == 1
+        assert service.firewalls[0].label == "prod-fw"
+        assert len(service.firewalls[0].inbound_rules) == 2
+        assert service.firewalls[0].inbound_rules[0].ports == "22"
+        assert service.firewalls[0].inbound_rules[0].addresses_ipv4 == [
+            "192.168.1.0/24"
+        ]
+        assert service.firewalls[0].inbound_rules[1].addresses_ipv4 == ["0.0.0.0/0"]
+
+    def test_describe_firewalls_handles_empty_list(self):
+        service = _build_service(networking_firewalls_return=[])
+        service._describe_firewalls()
+
+        assert len(service.firewalls) == 0
+
+    def test_describe_firewalls_handles_api_error(self):
+        service = _build_service(
+            networking_firewalls_side_effect=Exception("API error")
+        )
+        service._describe_firewalls()
+
+        assert len(service.firewalls) == 0
+
+    def test_describe_firewalls_missing_scope_logs_permission_error(self):
+        error = ApiError(
+            "Your OAuth token is not authorized to use this endpoint.", status=401
+        )
+        service = _build_service(networking_firewalls_side_effect=error)
+
+        with patch(
+            "prowler.providers.linode.lib.service.service.logger"
+        ) as logger_mock:
+            service._describe_firewalls()
+
+        assert len(service.firewalls) == 0
+        logged = " ".join(str(c) for c in logger_mock.error.call_args_list)
+        assert "LinodeMissingPermissionError" in logged
+        assert "firewall:read_only" in logged
+
+    def test_describe_firewalls_device_fetch_error_yields_none_count(self):
+        """A devices fetch failure must leave attached_devices_count as None
+        (undetermined) rather than 0, to avoid a false 'not assigned' FAIL."""
+
+        class _NoDevicesFw:
+            id = 5
+            label = "no-devices-fw"
+            status = "enabled"
+            tags = []
+
+            @property
+            def devices(self):
+                raise Exception("devices API error")
+
+            @property
+            def rules(self):
+                r = MagicMock()
+                r.inbound = []
+                r.outbound = []
+                r.inbound_policy = "DROP"
+                r.outbound_policy = "DROP"
+                return r
+
+        service = _build_service(networking_firewalls_return=[_NoDevicesFw()])
+        service._describe_firewalls()
+
+        assert len(service.firewalls) == 1
+        assert service.firewalls[0].attached_devices_count is None
+
+    def test_describe_firewalls_handles_null_rule_fields(self):
+        """Rule fields returned as explicit null must fall back to defaults
+        instead of raising a ValidationError that drops the whole firewall."""
+        rule = MagicMock()
+        rule.protocol = None
+        rule.ports = None
+        rule.action = None
+        rule.label = None
+        addresses = MagicMock()
+        addresses.ipv4 = None
+        addresses.ipv6 = None
+        rule.addresses = addresses
+
+        mock_fws = [_mock_firewall(id=6, label="null-rule-fw", inbound=[rule])]
+
+        service = _build_service(networking_firewalls_return=mock_fws)
+        service._describe_firewalls()
+
+        assert len(service.firewalls) == 1
+        parsed = service.firewalls[0].inbound_rules[0]
+        assert parsed.protocol == "TCP"
+        assert parsed.action == "ACCEPT"
+        assert parsed.ports == ""
+        assert parsed.addresses_ipv4 == []
+        assert parsed.addresses_ipv6 == []
+        assert parsed.label == ""
+
+    def test_describe_firewalls_handles_rules_fetch_error(self):
+        """Firewall is still added even if rules fail to load."""
+
+        class _BrokenFw:
+            id = 1
+            label = "broken-fw"
+            status = "enabled"
+            tags = []
+            devices = []
+
+            @property
+            def rules(self):
+                raise Exception("rules API error")
+
+        fw = _BrokenFw()
+
+        service = _build_service(networking_firewalls_return=[fw])
+        service._describe_firewalls()
+
+        assert len(service.firewalls) == 1
+        assert service.firewalls[0].label == "broken-fw"
+        assert len(service.firewalls[0].inbound_rules) == 0
diff --git a/tests/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices_test.py b/tests/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices_test.py
new file mode 100644
index 0000000000..72d8a9f454
--- /dev/null
+++ b/tests/providers/linode/services/networking/networking_firewall_assigned_to_devices/networking_firewall_assigned_to_devices_test.py
@@ -0,0 +1,142 @@
+from unittest import mock
+
+from prowler.providers.linode.services.networking.networking_service import Firewall
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_networking_firewall_assigned_to_devices:
+    def test_no_firewalls(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_assigned_to_devices.networking_firewall_assigned_to_devices.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_assigned_to_devices.networking_firewall_assigned_to_devices import (
+                networking_firewall_assigned_to_devices,
+            )
+
+            check = networking_firewall_assigned_to_devices()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_firewall_assigned(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=100,
+                label="assigned-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=2,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_assigned_to_devices.networking_firewall_assigned_to_devices.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_assigned_to_devices.networking_firewall_assigned_to_devices import (
+                networking_firewall_assigned_to_devices,
+            )
+
+            check = networking_firewall_assigned_to_devices()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "100"
+            assert result[0].resource_name == "assigned-fw"
+
+    def test_firewall_not_assigned(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=101,
+                label="unassigned-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=0,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_assigned_to_devices.networking_firewall_assigned_to_devices.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_assigned_to_devices.networking_firewall_assigned_to_devices import (
+                networking_firewall_assigned_to_devices,
+            )
+
+            check = networking_firewall_assigned_to_devices()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "101"
+            assert result[0].resource_name == "unassigned-fw"
+
+    def test_firewall_device_count_undetermined_is_skipped(self):
+        # attached_devices_count is None when the devices fetch failed; the
+        # firewall must be skipped rather than reported as a false FAIL.
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=102,
+                label="undetermined-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=None,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_assigned_to_devices.networking_firewall_assigned_to_devices.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_assigned_to_devices.networking_firewall_assigned_to_devices import (
+                networking_firewall_assigned_to_devices,
+            )
+
+            check = networking_firewall_assigned_to_devices()
+            result = check.execute()
+
+            assert len(result) == 0
diff --git a/tests/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop_test.py b/tests/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop_test.py
new file mode 100644
index 0000000000..1543a45656
--- /dev/null
+++ b/tests/providers/linode/services/networking/networking_firewall_default_inbound_policy_drop/networking_firewall_default_inbound_policy_drop_test.py
@@ -0,0 +1,105 @@
+from unittest import mock
+
+from prowler.providers.linode.services.networking.networking_service import Firewall
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_networking_firewall_default_inbound_policy_drop:
+    def test_no_firewalls(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_default_inbound_policy_drop.networking_firewall_default_inbound_policy_drop.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_default_inbound_policy_drop.networking_firewall_default_inbound_policy_drop import (
+                networking_firewall_default_inbound_policy_drop,
+            )
+
+            check = networking_firewall_default_inbound_policy_drop()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_inbound_policy_drop(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=100,
+                label="drop-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_default_inbound_policy_drop.networking_firewall_default_inbound_policy_drop.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_default_inbound_policy_drop.networking_firewall_default_inbound_policy_drop import (
+                networking_firewall_default_inbound_policy_drop,
+            )
+
+            check = networking_firewall_default_inbound_policy_drop()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "100"
+            assert result[0].resource_name == "drop-fw"
+
+    def test_inbound_policy_accept(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=101,
+                label="accept-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="ACCEPT",
+                outbound_policy="DROP",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_default_inbound_policy_drop.networking_firewall_default_inbound_policy_drop.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_default_inbound_policy_drop.networking_firewall_default_inbound_policy_drop import (
+                networking_firewall_default_inbound_policy_drop,
+            )
+
+            check = networking_firewall_default_inbound_policy_drop()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "101"
+            assert result[0].resource_name == "accept-fw"
diff --git a/tests/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop_test.py b/tests/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop_test.py
new file mode 100644
index 0000000000..5a586d710c
--- /dev/null
+++ b/tests/providers/linode/services/networking/networking_firewall_default_outbound_policy_drop/networking_firewall_default_outbound_policy_drop_test.py
@@ -0,0 +1,105 @@
+from unittest import mock
+
+from prowler.providers.linode.services.networking.networking_service import Firewall
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_networking_firewall_default_outbound_policy_drop:
+    def test_no_firewalls(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_default_outbound_policy_drop.networking_firewall_default_outbound_policy_drop.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_default_outbound_policy_drop.networking_firewall_default_outbound_policy_drop import (
+                networking_firewall_default_outbound_policy_drop,
+            )
+
+            check = networking_firewall_default_outbound_policy_drop()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_outbound_policy_drop(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=100,
+                label="drop-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_default_outbound_policy_drop.networking_firewall_default_outbound_policy_drop.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_default_outbound_policy_drop.networking_firewall_default_outbound_policy_drop import (
+                networking_firewall_default_outbound_policy_drop,
+            )
+
+            check = networking_firewall_default_outbound_policy_drop()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "100"
+            assert result[0].resource_name == "drop-fw"
+
+    def test_outbound_policy_accept(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=101,
+                label="accept-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="ACCEPT",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_default_outbound_policy_drop.networking_firewall_default_outbound_policy_drop.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_default_outbound_policy_drop.networking_firewall_default_outbound_policy_drop import (
+                networking_firewall_default_outbound_policy_drop,
+            )
+
+            check = networking_firewall_default_outbound_policy_drop()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "101"
+            assert result[0].resource_name == "accept-fw"
diff --git a/tests/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured_test.py b/tests/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured_test.py
new file mode 100644
index 0000000000..9b8272c2f2
--- /dev/null
+++ b/tests/providers/linode/services/networking/networking_firewall_inbound_rules_configured/networking_firewall_inbound_rules_configured_test.py
@@ -0,0 +1,117 @@
+from unittest import mock
+
+from prowler.providers.linode.services.networking.networking_service import (
+    Firewall,
+    FirewallRule,
+)
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_networking_firewall_inbound_rules_configured:
+    def test_no_firewalls(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_inbound_rules_configured.networking_firewall_inbound_rules_configured.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_inbound_rules_configured.networking_firewall_inbound_rules_configured import (
+                networking_firewall_inbound_rules_configured,
+            )
+
+            check = networking_firewall_inbound_rules_configured()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_inbound_rules_empty(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=100,
+                label="empty-inbound-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_inbound_rules_configured.networking_firewall_inbound_rules_configured.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_inbound_rules_configured.networking_firewall_inbound_rules_configured import (
+                networking_firewall_inbound_rules_configured,
+            )
+
+            check = networking_firewall_inbound_rules_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "100"
+            assert result[0].resource_name == "empty-inbound-fw"
+
+    def test_inbound_rules_not_empty(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=101,
+                label="non-empty-inbound-fw",
+                status="enabled",
+                inbound_rules=[
+                    FirewallRule(
+                        protocol="TCP",
+                        ports="443",
+                        addresses_ipv4=["0.0.0.0/0"],
+                        addresses_ipv6=[],
+                        action="ACCEPT",
+                        label="allow-https",
+                    )
+                ],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_inbound_rules_configured.networking_firewall_inbound_rules_configured.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_inbound_rules_configured.networking_firewall_inbound_rules_configured import (
+                networking_firewall_inbound_rules_configured,
+            )
+
+            check = networking_firewall_inbound_rules_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "101"
+            assert result[0].resource_name == "non-empty-inbound-fw"
diff --git a/tests/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured_test.py b/tests/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured_test.py
new file mode 100644
index 0000000000..658569c940
--- /dev/null
+++ b/tests/providers/linode/services/networking/networking_firewall_outbound_rules_configured/networking_firewall_outbound_rules_configured_test.py
@@ -0,0 +1,117 @@
+from unittest import mock
+
+from prowler.providers.linode.services.networking.networking_service import (
+    Firewall,
+    FirewallRule,
+)
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_networking_firewall_outbound_rules_configured:
+    def test_no_firewalls(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_outbound_rules_configured.networking_firewall_outbound_rules_configured.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_outbound_rules_configured.networking_firewall_outbound_rules_configured import (
+                networking_firewall_outbound_rules_configured,
+            )
+
+            check = networking_firewall_outbound_rules_configured()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_outbound_rules_empty(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=100,
+                label="empty-outbound-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_outbound_rules_configured.networking_firewall_outbound_rules_configured.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_outbound_rules_configured.networking_firewall_outbound_rules_configured import (
+                networking_firewall_outbound_rules_configured,
+            )
+
+            check = networking_firewall_outbound_rules_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "100"
+            assert result[0].resource_name == "empty-outbound-fw"
+
+    def test_outbound_rules_not_empty(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=101,
+                label="non-empty-outbound-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[
+                    FirewallRule(
+                        protocol="TCP",
+                        ports="443",
+                        addresses_ipv4=["0.0.0.0/0"],
+                        addresses_ipv6=[],
+                        action="ACCEPT",
+                        label="allow-https-egress",
+                    )
+                ],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_outbound_rules_configured.networking_firewall_outbound_rules_configured.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_outbound_rules_configured.networking_firewall_outbound_rules_configured import (
+                networking_firewall_outbound_rules_configured,
+            )
+
+            check = networking_firewall_outbound_rules_configured()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "101"
+            assert result[0].resource_name == "non-empty-outbound-fw"
diff --git a/tests/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled_test.py b/tests/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled_test.py
new file mode 100644
index 0000000000..632d94ca2e
--- /dev/null
+++ b/tests/providers/linode/services/networking/networking_firewall_status_enabled/networking_firewall_status_enabled_test.py
@@ -0,0 +1,105 @@
+from unittest import mock
+
+from prowler.providers.linode.services.networking.networking_service import Firewall
+from tests.providers.linode.linode_fixtures import set_mocked_linode_provider
+
+
+class Test_networking_firewall_status_enabled:
+    def test_no_firewalls(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = []
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_status_enabled.networking_firewall_status_enabled.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_status_enabled.networking_firewall_status_enabled import (
+                networking_firewall_status_enabled,
+            )
+
+            check = networking_firewall_status_enabled()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_firewall_enabled(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=100,
+                label="enabled-fw",
+                status="enabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_status_enabled.networking_firewall_status_enabled.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_status_enabled.networking_firewall_status_enabled import (
+                networking_firewall_status_enabled,
+            )
+
+            check = networking_firewall_status_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_id == "100"
+            assert result[0].resource_name == "enabled-fw"
+
+    def test_firewall_disabled(self):
+        networking_client = mock.MagicMock()
+        networking_client.firewalls = [
+            Firewall(
+                id=101,
+                label="disabled-fw",
+                status="disabled",
+                inbound_rules=[],
+                outbound_rules=[],
+                inbound_policy="DROP",
+                outbound_policy="DROP",
+                attached_devices_count=1,
+                tags=[],
+            )
+        ]
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_linode_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.linode.services.networking.networking_firewall_status_enabled.networking_firewall_status_enabled.networking_client",
+                new=networking_client,
+            ),
+        ):
+            from prowler.providers.linode.services.networking.networking_firewall_status_enabled.networking_firewall_status_enabled import (
+                networking_firewall_status_enabled,
+            )
+
+            check = networking_firewall_status_enabled()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].resource_id == "101"
+            assert result[0].resource_name == "disabled-fw"
diff --git a/uv.lock b/uv.lock
index b221255e33..4d0d6c0a70 100644
--- a/uv.lock
+++ b/uv.lock
@@ -70,6 +70,7 @@ constraints = [
     { name = "coverage", specifier = "==7.6.12" },
     { name = "darabonba-core", specifier = "==1.0.5" },
     { name = "decorator", specifier = "==5.2.1" },
+    { name = "deprecated", specifier = "==1.3.1" },
     { name = "dill", specifier = "==0.4.1" },
     { name = "distro", specifier = "==1.9.0" },
     { name = "dnspython", specifier = "==2.8.0" },
@@ -152,6 +153,7 @@ constraints = [
     { name = "platformdirs", specifier = "==4.9.6" },
     { name = "plotly", specifier = "==6.7.0" },
     { name = "pluggy", specifier = "==1.6.0" },
+    { name = "polling", specifier = "==0.3.2" },
     { name = "prek", specifier = "==0.3.9" },
     { name = "propcache", specifier = "==0.5.2" },
     { name = "proto-plus", specifier = "==1.28.0" },
@@ -1781,6 +1783,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/07/6c/aa3f2f849e01cb6a001cd8554a88d4c77c5c1a31c95bdf1cf9301e6d9ef4/defusedxml-0.7.1-py2.py3-none-any.whl", hash = "sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61", size = 25604, upload-time = "2021-03-08T10:59:24.45Z" },
 ]
 
+[[package]]
+name = "deprecated"
+version = "1.3.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "wrapt" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/49/85/12f0a49a7c4ffb70572b6c2ef13c90c88fd190debda93b23f026b25f9634/deprecated-1.3.1.tar.gz", hash = "sha256:b1b50e0ff0c1fddaa5708a2c6b0a6588bb09b892825ab2b214ac9ea9d92a5223", size = 2932523, upload-time = "2025-10-30T08:19:02.757Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/84/d0/205d54408c08b13550c733c4b85429e7ead111c7f0014309637425520a9a/deprecated-1.3.1-py2.py3-none-any.whl", hash = "sha256:597bfef186b6f60181535a29fbe44865ce137a5079f295b479886c82729d5f3f", size = 11298, upload-time = "2025-10-30T08:19:00.758Z" },
+]
+
 [[package]]
 name = "detect-secrets"
 version = "1.5.0"
@@ -2516,6 +2530,20 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/41/a0/b91504515c1f9a299fc157967ffbd2f0321bce0516a3d5b89f6f4cad0355/lazy_object_proxy-1.12.0-pp39.pp310.pp311.graalpy311-none-any.whl", hash = "sha256:c3b2e0af1f7f77c4263759c4824316ce458fabe0fceadcd24ef8ca08b2d1e402", size = 15072, upload-time = "2025-08-22T13:50:05.498Z" },
 ]
 
+[[package]]
+name = "linode-api4"
+version = "5.45.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "deprecated" },
+    { name = "polling" },
+    { name = "requests" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b2/b5/fce03d9b81008dcc0fe4961ce10e140ac3ae5ab17f2cdd659763e4964c0d/linode_api4-5.45.0.tar.gz", hash = "sha256:af8a0a5638345ad467447112dcf5d58ec47e7dd192b89ce0c8537a1e5c435d04", size = 283375, upload-time = "2026-06-11T18:05:13.671Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/18/38/19e3c8f7b7a9dbeea2aa5af61f70162bff5131b3d39acbe73e8d0dd12972/linode_api4-5.45.0-py3-none-any.whl", hash = "sha256:3cc2650b13d8d3bc7735fa8e92a639669618f320471dc8e519db778c6020eacd", size = 158336, upload-time = "2026-06-11T18:05:11.799Z" },
+]
+
 [[package]]
 name = "lz4"
 version = "4.4.5"
@@ -3372,6 +3400,12 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
 ]
 
+[[package]]
+name = "polling"
+version = "0.3.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/8f/c5/4249317962180d97ec7a60fe38aa91f86216533bd478a427a5468945c5c9/polling-0.3.2.tar.gz", hash = "sha256:3afd62320c99b725c70f379964bf548b302fc7f04d4604e6c315d9012309cc9a", size = 5189, upload-time = "2021-05-22T19:48:41.466Z" }
+
 [[package]]
 name = "prek"
 version = "0.3.9"
@@ -3578,6 +3612,7 @@ dependencies = [
     { name = "h2" },
     { name = "jsonschema" },
     { name = "kubernetes" },
+    { name = "linode-api4" },
     { name = "markdown" },
     { name = "microsoft-kiota-abstractions" },
     { name = "msgraph-sdk" },
@@ -3686,6 +3721,7 @@ requires-dist = [
     { name = "h2", specifier = "==4.3.0" },
     { name = "jsonschema", specifier = "==4.23.0" },
     { name = "kubernetes", specifier = "==32.0.1" },
+    { name = "linode-api4", specifier = "==5.45.0" },
     { name = "markdown", specifier = "==3.10.2" },
     { name = "microsoft-kiota-abstractions", specifier = "==1.9.9" },
     { name = "msgraph-sdk", specifier = "==1.55.0" },

From 5d5f0676e090bc33c16f21775ce98448426477e9 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Mon, 22 Jun 2026 19:55:42 +0900
Subject: [PATCH 107/126] feat(gcp): add
 secretmanager_secret_not_publicly_accessible check (#11025)

Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../gcp/services/secretmanager/__init__.py    |   0
 .../secretmanager/secretmanager_client.py     |   6 +
 .../__init__.py                               |   0
 ...cret_not_publicly_accessible.metadata.json |  40 +++++
 ...tmanager_secret_not_publicly_accessible.py |  41 +++++
 .../secretmanager/secretmanager_service.py    |  87 +++++++++
 .../gcp/services/secretmanager/__init__.py    |   0
 .../__init__.py                               |   0
 ...ger_secret_not_publicly_accessible_test.py | 169 ++++++++++++++++++
 .../secretmanager_service_test.py             | 162 +++++++++++++++++
 11 files changed, 506 insertions(+)
 create mode 100644 prowler/providers/gcp/services/secretmanager/__init__.py
 create mode 100644 prowler/providers/gcp/services/secretmanager/secretmanager_client.py
 create mode 100644 prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/__init__.py
 create mode 100644 prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible.metadata.json
 create mode 100644 prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible.py
 create mode 100644 prowler/providers/gcp/services/secretmanager/secretmanager_service.py
 create mode 100644 tests/providers/gcp/services/secretmanager/__init__.py
 create mode 100644 tests/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/__init__.py
 create mode 100644 tests/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible_test.py
 create mode 100644 tests/providers/gcp/services/secretmanager/secretmanager_service_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 3df8df9c2e..ba6c2a2916 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -13,6 +13,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `cloudsql_instance_high_availability_enabled` check for GCP provider, verifying Cloud SQL primary instances use `REGIONAL` availability for automatic zone failover [(#11024)](https://github.com/prowler-cloud/prowler/pull/11024)
 - `cloudfunction_function_inside_vpc` check for GCP provider, verifying Cloud Functions have a Serverless VPC Access connector for private egress [(#11021)](https://github.com/prowler-cloud/prowler/pull/11021)
 - `cloudfunction_function_not_publicly_accessible` check for GCP provider, detecting Cloud Functions with `allUsers` or `allAuthenticatedUsers` IAM invocation bindings [(#11022)](https://github.com/prowler-cloud/prowler/pull/11022)
+- `secretmanager_secret_not_publicly_accessible` check for GCP provider, detecting Secret Manager secrets with public IAM bindings [(#11025)](https://github.com/prowler-cloud/prowler/pull/11025)
 - `identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions [(#11523)](https://github.com/prowler-cloud/prowler/pull/11523)
 - `cosmosdb_account_automatic_failover_enabled` check for Azure provider [(#11031)](https://github.com/prowler-cloud/prowler/pull/11031)
 - `cosmosdb_account_backup_policy_continuous` check for Azure provider [(#11032)](https://github.com/prowler-cloud/prowler/pull/11032)
diff --git a/prowler/providers/gcp/services/secretmanager/__init__.py b/prowler/providers/gcp/services/secretmanager/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/secretmanager/secretmanager_client.py b/prowler/providers/gcp/services/secretmanager/secretmanager_client.py
new file mode 100644
index 0000000000..dc18866cb3
--- /dev/null
+++ b/prowler/providers/gcp/services/secretmanager/secretmanager_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.common.provider import Provider
+from prowler.providers.gcp.services.secretmanager.secretmanager_service import (
+    SecretManager,
+)
+
+secretmanager_client = SecretManager(Provider.get_global_provider())
diff --git a/prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/__init__.py b/prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible.metadata.json b/prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible.metadata.json
new file mode 100644
index 0000000000..9f1f4d3381
--- /dev/null
+++ b/prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible.metadata.json
@@ -0,0 +1,40 @@
+{
+  "Provider": "gcp",
+  "CheckID": "secretmanager_secret_not_publicly_accessible",
+  "CheckTitle": "Secret Manager secret is not publicly accessible",
+  "CheckType": [],
+  "ServiceName": "secretmanager",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "critical",
+  "ResourceType": "secretmanager.googleapis.com/Secret",
+  "Description": "Secret Manager secrets deny access to `allUsers` and `allAuthenticatedUsers`, so only **explicitly authorized identities** can read or use them.\n\nThe evaluation reviews each secret's IAM policy bindings to confirm no public principals are granted access.",
+  "Risk": "Granting public IAM access to a secret exposes credentials, API keys, certificates, or other sensitive values to any caller on the internet or any authenticated Google account. This compromises **confidentiality**, enables **lateral movement** with leaked credentials, and can trigger regulatory breaches under PCI-DSS, ISO 27001, and GDPR.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://cloud.google.com/secret-manager/docs/access-control",
+    "https://cloud.google.com/iam/docs/overview"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "gcloud secrets remove-iam-policy-binding <SECRET_NAME> --member=<allUsers|allAuthenticatedUsers> --role=roles/secretmanager.secretAccessor",
+      "NativeIaC": "",
+      "Other": "1. In Google Cloud Console, go to Security > Secret Manager\n2. Select the secret and open the Permissions tab\n3. Remove any binding with allUsers or allAuthenticatedUsers\n4. Grant access only to required service accounts or groups",
+      "Terraform": "```hcl\nresource \"google_secret_manager_secret_iam_binding\" \"<example_resource_name>\" {\n  secret_id = \"<example_resource_id>\"\n  role      = \"roles/secretmanager.secretAccessor\"\n  members   = [\"serviceAccount:<example_resource_id>\"] # Critical: never include allUsers or allAuthenticatedUsers\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Apply **least privilege** to Secret Manager: grant `roles/secretmanager.secretAccessor` only to the specific service accounts or groups that need to read each secret.\n\nUse **workload identity** for GKE workloads and rotate credentials regularly to limit blast radius when a binding is misconfigured.",
+      "Url": "https://hub.prowler.com/check/secretmanager_secret_not_publicly_accessible"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "secretmanager_secret_rotation_enabled",
+    "kms_key_not_publicly_accessible",
+    "cloudstorage_bucket_public_access"
+  ],
+  "Notes": "This check evaluates the secret-level IAM policy. Project-level IAM policies that may indirectly grant public access are not evaluated by this check."
+}
diff --git a/prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible.py b/prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible.py
new file mode 100644
index 0000000000..fb52a119fa
--- /dev/null
+++ b/prowler/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible.py
@@ -0,0 +1,41 @@
+from prowler.lib.check.models import Check, Check_Report_GCP
+from prowler.providers.gcp.services.secretmanager.secretmanager_client import (
+    secretmanager_client,
+)
+
+
+class secretmanager_secret_not_publicly_accessible(Check):
+    """Check that Secret Manager secrets do not grant access to all users.
+
+    Verifies that no Secret Manager secret has an IAM binding granting access
+    to `allUsers` or `allAuthenticatedUsers`.
+    """
+
+    def execute(self) -> list[Check_Report_GCP]:
+        """Execute the public-access check across all Secret Manager secrets.
+
+        Returns:
+            A list of `Check_Report_GCP` findings, one per secret. Status is
+            `FAIL` when the secret is accessible to `allUsers` or
+            `allAuthenticatedUsers` and `PASS` otherwise.
+        """
+        findings = []
+        for secret in secretmanager_client.secrets:
+            report = Check_Report_GCP(
+                metadata=self.metadata(),
+                resource=secret,
+                resource_id=secret.name,
+            )
+            if secret.publicly_accessible:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Secret {secret.name} is publicly accessible "
+                    f"(allUsers or allAuthenticatedUsers IAM binding detected)."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Secret {secret.name} is not publicly accessible."
+                )
+            findings.append(report)
+        return findings
diff --git a/prowler/providers/gcp/services/secretmanager/secretmanager_service.py b/prowler/providers/gcp/services/secretmanager/secretmanager_service.py
new file mode 100644
index 0000000000..6a193d8ece
--- /dev/null
+++ b/prowler/providers/gcp/services/secretmanager/secretmanager_service.py
@@ -0,0 +1,87 @@
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.gcp.config import DEFAULT_RETRY_ATTEMPTS
+from prowler.providers.gcp.gcp_provider import GcpProvider
+from prowler.providers.gcp.lib.service.service import GCPService
+
+
+class SecretManager(GCPService):
+    """Secret Manager service client.
+
+    Enumerates Secret Manager secrets across every accessible project using
+    the `secretmanager.googleapis.com` v1 API and exposes them through the
+    `secrets` attribute.
+    """
+
+    def __init__(self, provider: GcpProvider) -> None:
+        """Initialize the service and preload secrets with their IAM policies."""
+        super().__init__("secretmanager", provider)
+        self.secrets = []
+        self._get_secrets()
+        self._get_secrets_iam_policy()
+
+    def _get_secrets(self) -> None:
+        """Fetch Secret Manager secrets for every project."""
+        for project_id in self.project_ids:
+            try:
+                request = (
+                    self.client.projects()
+                    .secrets()
+                    .list(parent=f"projects/{project_id}")
+                )
+                while request is not None:
+                    response = request.execute(num_retries=DEFAULT_RETRY_ATTEMPTS)
+                    for secret in response.get("secrets", []):
+                        self.secrets.append(
+                            Secret(
+                                id=secret["name"],
+                                name=secret["name"].split("/")[-1],
+                                project_id=project_id,
+                            )
+                        )
+                    request = (
+                        self.client.projects()
+                        .secrets()
+                        .list_next(previous_request=request, previous_response=response)
+                    )
+            except Exception as error:
+                logger.error(
+                    f"{project_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+
+    def _get_secrets_iam_policy(self) -> None:
+        """Fetch IAM policy for every Secret Manager secret in parallel."""
+        self.__threading_call__(self._get_secret_iam_policy, self.secrets)
+
+    def _get_secret_iam_policy(self, secret: "Secret") -> None:
+        """Mark a secret as publicly accessible when bound to `allUsers` or `allAuthenticatedUsers`."""
+        try:
+            response = (
+                self.client.projects()
+                .secrets()
+                .getIamPolicy(resource=secret.id)
+                .execute(
+                    http=self.__get_AuthorizedHttp_client__(),
+                    num_retries=DEFAULT_RETRY_ATTEMPTS,
+                )
+            )
+            for binding in response.get("bindings", []):
+                members = binding.get("members", [])
+                if "allUsers" in members or "allAuthenticatedUsers" in members:
+                    secret.publicly_accessible = True
+                    break
+        except Exception as error:
+            logger.error(
+                f"{secret.project_id} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+class Secret(BaseModel):
+    """Secret Manager secret resource consumed by GCP checks."""
+
+    id: str
+    name: str
+    project_id: str
+    location: str = "global"
+    publicly_accessible: bool = False
diff --git a/tests/providers/gcp/services/secretmanager/__init__.py b/tests/providers/gcp/services/secretmanager/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/__init__.py b/tests/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible_test.py b/tests/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible_test.py
new file mode 100644
index 0000000000..f925966f3c
--- /dev/null
+++ b/tests/providers/gcp/services/secretmanager/secretmanager_secret_not_publicly_accessible/secretmanager_secret_not_publicly_accessible_test.py
@@ -0,0 +1,169 @@
+from unittest import mock
+
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_PROJECT_ID,
+    set_mocked_gcp_provider,
+)
+
+_CHECK_PATH = (
+    "prowler.providers.gcp.services.secretmanager."
+    "secretmanager_secret_not_publicly_accessible."
+    "secretmanager_secret_not_publicly_accessible"
+)
+_CLIENT_PATH = f"{_CHECK_PATH}.secretmanager_client"
+
+
+def _secret_id(name: str) -> str:
+    return f"projects/{GCP_PROJECT_ID}/secrets/{name}"
+
+
+class Test_secretmanager_secret_not_publicly_accessible:
+    def test_no_secrets(self):
+        secretmanager_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=secretmanager_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.secretmanager.secretmanager_secret_not_publicly_accessible.secretmanager_secret_not_publicly_accessible import (
+                secretmanager_secret_not_publicly_accessible,
+            )
+
+            secretmanager_client.secrets = []
+
+            check = secretmanager_secret_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_secret_private(self):
+        secretmanager_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=secretmanager_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.secretmanager.secretmanager_secret_not_publicly_accessible.secretmanager_secret_not_publicly_accessible import (
+                secretmanager_secret_not_publicly_accessible,
+            )
+            from prowler.providers.gcp.services.secretmanager.secretmanager_service import (
+                Secret,
+            )
+
+            secretmanager_client.secrets = [
+                Secret(
+                    id=_secret_id("secret-private"),
+                    name="secret-private",
+                    project_id=GCP_PROJECT_ID,
+                    publicly_accessible=False,
+                )
+            ]
+
+            check = secretmanager_secret_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Secret secret-private is not publicly accessible."
+            )
+            assert result[0].resource_id == "secret-private"
+            assert result[0].resource_name == "secret-private"
+            assert result[0].location == "global"
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_secret_publicly_accessible(self):
+        secretmanager_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=secretmanager_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.secretmanager.secretmanager_secret_not_publicly_accessible.secretmanager_secret_not_publicly_accessible import (
+                secretmanager_secret_not_publicly_accessible,
+            )
+            from prowler.providers.gcp.services.secretmanager.secretmanager_service import (
+                Secret,
+            )
+
+            secretmanager_client.secrets = [
+                Secret(
+                    id=_secret_id("secret-public"),
+                    name="secret-public",
+                    project_id=GCP_PROJECT_ID,
+                    publicly_accessible=True,
+                )
+            ]
+
+            check = secretmanager_secret_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                "Secret secret-public is publicly accessible "
+                "(allUsers or allAuthenticatedUsers IAM binding detected)."
+            )
+            assert result[0].resource_id == "secret-public"
+            assert result[0].resource_name == "secret-public"
+            assert result[0].location == "global"
+            assert result[0].project_id == GCP_PROJECT_ID
+
+    def test_multiple_secrets_mixed(self):
+        secretmanager_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_gcp_provider(),
+            ),
+            mock.patch(
+                _CLIENT_PATH,
+                new=secretmanager_client,
+            ),
+        ):
+            from prowler.providers.gcp.services.secretmanager.secretmanager_secret_not_publicly_accessible.secretmanager_secret_not_publicly_accessible import (
+                secretmanager_secret_not_publicly_accessible,
+            )
+            from prowler.providers.gcp.services.secretmanager.secretmanager_service import (
+                Secret,
+            )
+
+            secretmanager_client.secrets = [
+                Secret(
+                    id=_secret_id("secret-private"),
+                    name="secret-private",
+                    project_id=GCP_PROJECT_ID,
+                    publicly_accessible=False,
+                ),
+                Secret(
+                    id=_secret_id("secret-public"),
+                    name="secret-public",
+                    project_id=GCP_PROJECT_ID,
+                    publicly_accessible=True,
+                ),
+            ]
+
+            check = secretmanager_secret_not_publicly_accessible()
+            result = check.execute()
+            assert len(result) == 2
+
+            by_id = {r.resource_id: r for r in result}
+            assert by_id["secret-private"].status == "PASS"
+            assert by_id["secret-public"].status == "FAIL"
diff --git a/tests/providers/gcp/services/secretmanager/secretmanager_service_test.py b/tests/providers/gcp/services/secretmanager/secretmanager_service_test.py
new file mode 100644
index 0000000000..213134c245
--- /dev/null
+++ b/tests/providers/gcp/services/secretmanager/secretmanager_service_test.py
@@ -0,0 +1,162 @@
+from unittest.mock import MagicMock, patch
+
+from prowler.providers.gcp.services.secretmanager.secretmanager_service import (
+    SecretManager,
+)
+from tests.providers.gcp.gcp_fixtures import (
+    GCP_PROJECT_ID,
+    mock_is_api_active,
+    set_mocked_gcp_provider,
+)
+
+
+def _make_secretmanager_client(secrets_list, iam_bindings=None):
+    """Return a mock GCP API client for the Secret Manager service."""
+    client = MagicMock()
+
+    client.projects().secrets().list().execute.return_value = {"secrets": secrets_list}
+    client.projects().secrets().list_next.return_value = None
+
+    iam_response = {"bindings": iam_bindings or []}
+
+    def mock_get_iam_policy(resource):
+        rv = MagicMock()
+        rv.execute.return_value = iam_response
+        return rv
+
+    client.projects().secrets().getIamPolicy = mock_get_iam_policy
+
+    return client
+
+
+class TestSecretManagerService:
+    def test_get_secrets(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_secretmanager_client(
+                secrets_list=[
+                    {
+                        "name": f"projects/{GCP_PROJECT_ID}/secrets/my-secret",
+                    }
+                ]
+            )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+        ):
+            sm_client = SecretManager(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(sm_client.secrets) == 1
+            secret = sm_client.secrets[0]
+            assert secret.name == "my-secret"
+            assert secret.id == f"projects/{GCP_PROJECT_ID}/secrets/my-secret"
+            assert secret.project_id == GCP_PROJECT_ID
+            assert secret.location == "global"
+            assert secret.publicly_accessible is False
+
+    def test_get_secrets_iam_policy_all_users(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_secretmanager_client(
+                secrets_list=[
+                    {
+                        "name": f"projects/{GCP_PROJECT_ID}/secrets/public-secret",
+                    }
+                ],
+                iam_bindings=[
+                    {
+                        "role": "roles/secretmanager.secretAccessor",
+                        "members": ["allUsers"],
+                    }
+                ],
+            )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+        ):
+            sm_client = SecretManager(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(sm_client.secrets) == 1
+            assert sm_client.secrets[0].publicly_accessible is True
+
+    def test_get_secrets_iam_policy_all_authenticated_users(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_secretmanager_client(
+                secrets_list=[
+                    {
+                        "name": f"projects/{GCP_PROJECT_ID}/secrets/auth-users-secret",
+                    }
+                ],
+                iam_bindings=[
+                    {
+                        "role": "roles/secretmanager.secretAccessor",
+                        "members": ["allAuthenticatedUsers"],
+                    }
+                ],
+            )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+        ):
+            sm_client = SecretManager(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(sm_client.secrets) == 1
+            assert sm_client.secrets[0].publicly_accessible is True
+
+    def test_get_secrets_iam_policy_not_public(self):
+        def mock_api_client(*args, **kwargs):
+            return _make_secretmanager_client(
+                secrets_list=[
+                    {
+                        "name": f"projects/{GCP_PROJECT_ID}/secrets/private-secret",
+                    }
+                ],
+                iam_bindings=[
+                    {
+                        "role": "roles/secretmanager.secretAccessor",
+                        "members": ["user:alice@example.com"],
+                    }
+                ],
+            )
+
+        with (
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__is_api_active__",
+                new=mock_is_api_active,
+            ),
+            patch(
+                "prowler.providers.gcp.lib.service.service.GCPService.__generate_client__",
+                new=mock_api_client,
+            ),
+        ):
+            sm_client = SecretManager(
+                set_mocked_gcp_provider(project_ids=[GCP_PROJECT_ID])
+            )
+
+            assert len(sm_client.secrets) == 1
+            assert sm_client.secrets[0].publicly_accessible is False

From 13f51de5c189882f28c51dc2708272ccb3abdbf8 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Mon, 22 Jun 2026 20:17:23 +0900
Subject: [PATCH 108/126] feat(azure): add aks_cluster_azure_monitor_enabled
 check (#11029)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   1 +
 .../__init__.py                               |   0
 ...luster_azure_monitor_enabled.metadata.json |  38 ++++++
 .../aks_cluster_azure_monitor_enabled.py      |  32 +++++
 .../aks_cluster_azure_monitor_enabled_test.py | 121 ++++++++++++++++++
 6 files changed, 193 insertions(+)
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled.py
 create mode 100644 tests/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index ba6c2a2916..b8a11980d1 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -26,6 +26,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `mysql_flexible_server_high_availability_enabled` check for Azure provider, verifying MySQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11042)](https://github.com/prowler-cloud/prowler/pull/11042)
 - `postgresql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying PostgreSQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11045)](https://github.com/prowler-cloud/prowler/pull/11045)
 - `postgresql_flexible_server_high_availability_enabled` check for Azure provider, verifying PostgreSQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11046)](https://github.com/prowler-cloud/prowler/pull/11046)
+- `aks_cluster_azure_monitor_enabled` check for Azure provider, verifying AKS clusters have Azure Monitor (Container Insights) enabled for metrics, logs, and alerting [(#11029)](https://github.com/prowler-cloud/prowler/pull/11029)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index fbe2204e2d..e6c531fbc4 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1346,6 +1346,7 @@
         }
       ],
       "Checks": [
+        "aks_cluster_azure_monitor_enabled",
         "defender_ensure_defender_cspm_is_on",
         "monitor_alert_create_policy_assignment",
         "monitor_alert_create_update_nsg",
diff --git a/prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/__init__.py b/prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled.metadata.json b/prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled.metadata.json
new file mode 100644
index 0000000000..362b8e4d73
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "aks_cluster_azure_monitor_enabled",
+  "CheckTitle": "AKS cluster has Azure Monitor metrics enabled",
+  "CheckType": [],
+  "ServiceName": "aks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.containerservice/managedclusters",
+  "ResourceGroup": "container",
+  "Description": "**Azure Kubernetes Service** clusters are evaluated for **Azure Monitor managed service for Prometheus** (the cluster's `azureMonitorProfile.metrics` configuration). When enabled, cluster and workload metrics are collected into an Azure Monitor workspace for dashboards and alerting. This is distinct from Container Insights (the `omsagent` logs addon).",
+  "Risk": "Without **Azure Monitor metrics**, cluster degradation, resource exhaustion, and anomalous behavior go undetected. Lack of metric-based observability delays incident detection and hampers investigation after a security or availability event.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/kubernetes-monitoring-enable",
+    "https://learn.microsoft.com/en-us/azure/azure-monitor/containers/prometheus-metrics-enable",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/managedclusters"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --enable-azure-monitor-metrics",
+      "NativeIaC": "```bicep\n// Bicep: AKS cluster with Azure Monitor managed Prometheus metrics enabled\nresource aks 'Microsoft.ContainerService/managedClusters@2024-02-01' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  properties: {\n    azureMonitorProfile: {\n      metrics: {\n        enabled: true // CRITICAL: enables Azure Monitor managed service for Prometheus (metrics)\n      }\n    }\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your AKS cluster\n2. In the left menu, select Monitoring > Insights\n3. Click Configure monitoring\n4. Ensure 'Enable Prometheus metrics' is selected and choose (or create) an Azure Monitor workspace\n5. Click Configure to enable Azure Monitor managed Prometheus metrics",
+      "Terraform": "```hcl\n# Terraform: AKS cluster with Azure Monitor managed Prometheus metrics enabled\nresource \"azurerm_kubernetes_cluster\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  location            = \"<region>\"\n  resource_group_name = \"<example_resource_name>\"\n  dns_prefix          = \"<example_resource_name>\"\n\n  monitor_metrics {} # CRITICAL: enables Azure Monitor managed service for Prometheus (metrics)\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **Azure Monitor managed service for Prometheus** on AKS clusters so cluster and workload metrics are collected into an Azure Monitor workspace. Pair it with alerting on cluster health and resource saturation, and consider also enabling Container Insights (logs) for full observability.",
+      "Url": "https://hub.prowler.com/check/aks_cluster_azure_monitor_enabled"
+    }
+  },
+  "Categories": [
+    "logging"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled.py b/prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled.py
new file mode 100644
index 0000000000..0c47f6373c
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled.py
@@ -0,0 +1,32 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.aks.aks_client import aks_client
+
+
+class aks_cluster_azure_monitor_enabled(Check):
+    """
+    Ensure Azure Monitor is enabled for AKS clusters.
+
+    This check evaluates whether each Azure Kubernetes Service cluster has Azure Monitor integration enabled for metrics collection, log aggregation, and alerting.
+
+    - PASS: The cluster has Azure Monitor enabled.
+    - FAIL: The cluster does not have Azure Monitor enabled.
+    """
+
+    def execute(self) -> list[Check_Report_Azure]:
+        findings = []
+
+        for subscription_name, clusters in aks_client.clusters.items():
+            for cluster in clusters.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
+                report.subscription = subscription_name
+
+                if cluster.azure_monitor_enabled:
+                    report.status = "PASS"
+                    report.status_extended = f"Cluster '{cluster.name}' has Azure Monitor managed Prometheus metrics enabled."
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = f"Cluster '{cluster.name}' does not have Azure Monitor managed Prometheus metrics enabled."
+
+                findings.append(report)
+
+        return findings
diff --git a/tests/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled_test.py b/tests/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled_test.py
new file mode 100644
index 0000000000..a209a50199
--- /dev/null
+++ b/tests/providers/azure/services/aks/aks_cluster_azure_monitor_enabled/aks_cluster_azure_monitor_enabled_test.py
@@ -0,0 +1,121 @@
+from importlib import import_module
+from unittest import mock
+from uuid import uuid4
+
+import pytest
+
+from prowler.providers.azure.services.aks.aks_service import Cluster
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+CHECK_MODULE = (
+    "prowler.providers.azure.services.aks.aks_cluster_azure_monitor_enabled."
+    "aks_cluster_azure_monitor_enabled"
+)
+CHECK_CLIENT_PATCH = f"{CHECK_MODULE}.aks_client"
+
+
+def get_check_class():
+    return import_module(CHECK_MODULE).aks_cluster_azure_monitor_enabled
+
+
+def build_cluster(azure_monitor_enabled):
+    return Cluster(
+        id=str(uuid4()),
+        name="test-cluster",
+        public_fqdn="test.azmk8s.io",
+        private_fqdn=None,
+        network_policy=None,
+        agent_pool_profiles=[],
+        rbac_enabled=True,
+        location="eastus",
+        azure_monitor_enabled=azure_monitor_enabled,
+    )
+
+
+class Test_aks_cluster_azure_monitor_enabled:
+    def test_no_subscriptions(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_azure_monitor_enabled = get_check_class()
+
+            aks_client.clusters = {}
+
+            check = aks_cluster_azure_monitor_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_azure_monitor_enabled = get_check_class()
+
+            cluster = build_cluster(azure_monitor_enabled=True)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_azure_monitor_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Cluster 'test-cluster' has Azure Monitor managed Prometheus metrics enabled."
+            )
+            assert result[0].resource_name == "test-cluster"
+            assert result[0].resource_id == cluster.id
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "eastus"
+
+    @pytest.mark.parametrize("azure_monitor_enabled", [False, None])
+    def test_fail(self, azure_monitor_enabled):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_azure_monitor_enabled = get_check_class()
+
+            cluster = build_cluster(azure_monitor_enabled=azure_monitor_enabled)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_azure_monitor_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Cluster 'test-cluster' does not have Azure Monitor managed Prometheus metrics enabled."
+            )
+            assert result[0].resource_name == "test-cluster"
+            assert result[0].resource_id == cluster.id
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "eastus"

From 6dda1ae485a64e83426fc3008b2a94b4bdcc5d18 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Mon, 22 Jun 2026 20:38:17 +0900
Subject: [PATCH 109/126] feat(azure): add aks_cluster_local_accounts_disabled
 check (#11030)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   1 +
 .../__init__.py                               |   0
 ...ster_local_accounts_disabled.metadata.json |  38 ++++++
 .../aks_cluster_local_accounts_disabled.py    |  36 ++++++
 ...ks_cluster_local_accounts_disabled_test.py | 121 ++++++++++++++++++
 6 files changed, 197 insertions(+)
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/__init__.py
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled.metadata.json
 create mode 100644 prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled.py
 create mode 100644 tests/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index b8a11980d1..23cd40bd08 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -27,6 +27,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `postgresql_flexible_server_geo_redundant_backup_enabled` check for Azure provider, verifying PostgreSQL Flexible Servers have geo-redundant backup enabled so backups are replicated to the paired region [(#11045)](https://github.com/prowler-cloud/prowler/pull/11045)
 - `postgresql_flexible_server_high_availability_enabled` check for Azure provider, verifying PostgreSQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11046)](https://github.com/prowler-cloud/prowler/pull/11046)
 - `aks_cluster_azure_monitor_enabled` check for Azure provider, verifying AKS clusters have Azure Monitor (Container Insights) enabled for metrics, logs, and alerting [(#11029)](https://github.com/prowler-cloud/prowler/pull/11029)
+- `aks_cluster_local_accounts_disabled` check for Azure provider, verifying AKS clusters have local accounts disabled so authentication is forced through Microsoft Entra ID [(#11030)](https://github.com/prowler-cloud/prowler/pull/11030)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index e6c531fbc4..527dfc9dc2 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -271,6 +271,7 @@
         }
       ],
       "Checks": [
+        "aks_cluster_local_accounts_disabled",
         "defender_ensure_defender_for_containers_is_on",
         "defender_ensure_defender_for_cosmosdb_is_on",
         "defender_ensure_defender_for_databases_is_on",
diff --git a/prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/__init__.py b/prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled.metadata.json b/prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled.metadata.json
new file mode 100644
index 0000000000..5577d4799c
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled.metadata.json
@@ -0,0 +1,38 @@
+{
+  "Provider": "azure",
+  "CheckID": "aks_cluster_local_accounts_disabled",
+  "CheckTitle": "AKS cluster has local accounts disabled",
+  "CheckType": [],
+  "ServiceName": "aks",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "microsoft.containerservice/managedclusters",
+  "ResourceGroup": "container",
+  "Description": "**Azure Kubernetes Service** clusters are evaluated for **local account** status. Disabling local accounts forces all cluster authentication through Microsoft Entra ID, ensuring centralized identity management, MFA, and conditional access.",
+  "Risk": "Local accounts bypass **Entra ID** authentication, MFA, and conditional access policies. Compromised local credentials (such as the static cluster-admin certificate) provide persistent cluster access without an identity-based audit trail or governance.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/aks/manage-local-accounts-managed-azure-ad",
+    "https://learn.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest#az-aks-update",
+    "https://learn.microsoft.com/en-us/azure/templates/microsoft.containerservice/managedclusters"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az aks update --resource-group <RESOURCE_GROUP> --name <CLUSTER_NAME> --disable-local-accounts",
+      "NativeIaC": "```bicep\n// Bicep: AKS cluster with local accounts disabled\nresource aks 'Microsoft.ContainerService/managedClusters@2024-02-01' = {\n  name: '<example_resource_name>'\n  location: resourceGroup().location\n  properties: {\n    disableLocalAccounts: true // CRITICAL: forces authentication through Entra ID\n    aadProfile: {\n      managed: true\n      enableAzureRbac: true\n    }\n  }\n}\n```",
+      "Other": "1. Sign in to the Azure portal and open your AKS cluster\n2. Ensure Microsoft Entra ID (AAD) authentication is configured for the cluster\n3. Under Settings, select Cluster configuration (or Authentication and Authorization)\n4. Set Local accounts to Disabled\n5. Save the configuration",
+      "Terraform": "```hcl\n# Terraform: AKS cluster with local accounts disabled\nresource \"azurerm_kubernetes_cluster\" \"<example_resource_name>\" {\n  name                  = \"<example_resource_name>\"\n  location              = \"<region>\"\n  resource_group_name   = \"<example_resource_name>\"\n  dns_prefix            = \"<example_resource_name>\"\n  local_account_disabled = true # CRITICAL: forces authentication through Entra ID\n\n  azure_active_directory_role_based_access_control {\n    azure_rbac_enabled = true\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Disable local accounts on AKS clusters and require **Microsoft Entra ID** authentication with Azure RBAC. Before disabling, confirm Entra ID integration and break-glass access are in place so administrators retain authenticated access, then enforce MFA and conditional access on cluster identities.",
+      "Url": "https://hub.prowler.com/check/aks_cluster_local_accounts_disabled"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled.py b/prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled.py
new file mode 100644
index 0000000000..85670e0d15
--- /dev/null
+++ b/prowler/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled.py
@@ -0,0 +1,36 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.aks.aks_client import aks_client
+
+
+class aks_cluster_local_accounts_disabled(Check):
+    """
+    Ensure local accounts are disabled on AKS clusters.
+
+    This check evaluates whether each Azure Kubernetes Service cluster has local accounts disabled, forcing all authentication through Microsoft Entra ID.
+
+    - PASS: The cluster has local accounts disabled.
+    - FAIL: The cluster has local accounts enabled.
+    """
+
+    def execute(self) -> list[Check_Report_Azure]:
+        findings = []
+
+        for subscription_name, clusters in aks_client.clusters.items():
+            for cluster in clusters.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=cluster)
+                report.subscription = subscription_name
+
+                if cluster.local_accounts_disabled:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Cluster '{cluster.name}' has local accounts disabled."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"Cluster '{cluster.name}' has local accounts enabled."
+                    )
+
+                findings.append(report)
+
+        return findings
diff --git a/tests/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled_test.py b/tests/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled_test.py
new file mode 100644
index 0000000000..a4c63dc172
--- /dev/null
+++ b/tests/providers/azure/services/aks/aks_cluster_local_accounts_disabled/aks_cluster_local_accounts_disabled_test.py
@@ -0,0 +1,121 @@
+from importlib import import_module
+from unittest import mock
+from uuid import uuid4
+
+import pytest
+
+from prowler.providers.azure.services.aks.aks_service import Cluster
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+CHECK_MODULE = (
+    "prowler.providers.azure.services.aks.aks_cluster_local_accounts_disabled."
+    "aks_cluster_local_accounts_disabled"
+)
+CHECK_CLIENT_PATCH = f"{CHECK_MODULE}.aks_client"
+
+
+def get_check_class():
+    return import_module(CHECK_MODULE).aks_cluster_local_accounts_disabled
+
+
+def build_cluster(local_accounts_disabled):
+    return Cluster(
+        id=str(uuid4()),
+        name="test-cluster",
+        public_fqdn="test.azmk8s.io",
+        private_fqdn=None,
+        network_policy=None,
+        agent_pool_profiles=[],
+        rbac_enabled=True,
+        location="eastus",
+        local_accounts_disabled=local_accounts_disabled,
+    )
+
+
+class Test_aks_cluster_local_accounts_disabled:
+    def test_no_subscriptions(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_local_accounts_disabled = get_check_class()
+
+            aks_client.clusters = {}
+
+            check = aks_cluster_local_accounts_disabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_pass(self):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_local_accounts_disabled = get_check_class()
+
+            cluster = build_cluster(local_accounts_disabled=True)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_local_accounts_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert (
+                result[0].status_extended
+                == "Cluster 'test-cluster' has local accounts disabled."
+            )
+            assert result[0].resource_name == "test-cluster"
+            assert result[0].resource_id == cluster.id
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "eastus"
+
+    @pytest.mark.parametrize("local_accounts_disabled", [False, None])
+    def test_fail(self, local_accounts_disabled):
+        aks_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                CHECK_CLIENT_PATCH,
+                new=aks_client,
+            ),
+        ):
+            aks_cluster_local_accounts_disabled = get_check_class()
+
+            cluster = build_cluster(local_accounts_disabled=local_accounts_disabled)
+            aks_client.clusters = {AZURE_SUBSCRIPTION_ID: {cluster.id: cluster}}
+
+            check = aks_cluster_local_accounts_disabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert (
+                result[0].status_extended
+                == "Cluster 'test-cluster' has local accounts enabled."
+            )
+            assert result[0].resource_name == "test-cluster"
+            assert result[0].resource_id == cluster.id
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].location == "eastus"

From 869f0726f54af7bc7dd863a90b48590e6a1cd0f7 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Mon, 22 Jun 2026 21:03:54 +0900
Subject: [PATCH 110/126] feat(azure): add network_subnet_nsg_associated check
 (#11043)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 prowler/compliance/azure/cis_5.0_azure.json   |   4 +-
 .../compliance/azure/iso27001_2022_azure.json |   2 +
 prowler/compliance/azure/soc2_azure.json      |   3 +-
 .../azure/services/network/network_service.py |  52 +++++
 .../network_subnet_nsg_associated/__init__.py |   0
 ...etwork_subnet_nsg_associated.metadata.json |  37 ++++
 .../network_subnet_nsg_associated.py          |  54 +++++
 .../network_subnet_nsg_associated_test.py     | 188 ++++++++++++++++++
 9 files changed, 339 insertions(+), 2 deletions(-)
 create mode 100644 prowler/providers/azure/services/network/network_subnet_nsg_associated/__init__.py
 create mode 100644 prowler/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated.metadata.json
 create mode 100644 prowler/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated.py
 create mode 100644 tests/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 23cd40bd08..124bdab8b1 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -28,6 +28,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `postgresql_flexible_server_high_availability_enabled` check for Azure provider, verifying PostgreSQL Flexible Servers have high availability enabled for automatic failover to a standby replica [(#11046)](https://github.com/prowler-cloud/prowler/pull/11046)
 - `aks_cluster_azure_monitor_enabled` check for Azure provider, verifying AKS clusters have Azure Monitor (Container Insights) enabled for metrics, logs, and alerting [(#11029)](https://github.com/prowler-cloud/prowler/pull/11029)
 - `aks_cluster_local_accounts_disabled` check for Azure provider, verifying AKS clusters have local accounts disabled so authentication is forced through Microsoft Entra ID [(#11030)](https://github.com/prowler-cloud/prowler/pull/11030)
+- `network_subnet_nsg_associated` check for Azure provider, verifying virtual network subnets have a network security group associated to enforce traffic filtering [(#11043)](https://github.com/prowler-cloud/prowler/pull/11043)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/cis_5.0_azure.json b/prowler/compliance/azure/cis_5.0_azure.json
index 086320fecd..35f77ce310 100644
--- a/prowler/compliance/azure/cis_5.0_azure.json
+++ b/prowler/compliance/azure/cis_5.0_azure.json
@@ -1974,7 +1974,9 @@
     {
       "Id": "7.11",
       "Description": "Ensure subnets are associated with network security groups",
-      "Checks": [],
+      "Checks": [
+        "network_subnet_nsg_associated"
+      ],
       "Attributes": [
         {
           "Section": "7 Networking Services",
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 527dfc9dc2..6659e6ee0a 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1429,6 +1429,7 @@
         "network_public_ip_shodan",
         "network_rdp_internet_access_restricted",
         "network_ssh_internet_access_restricted",
+        "network_subnet_nsg_associated",
         "network_udp_internet_access_restricted",
         "network_watcher_enabled"
       ]
@@ -1483,6 +1484,7 @@
         "network_public_ip_shodan",
         "network_rdp_internet_access_restricted",
         "network_ssh_internet_access_restricted",
+        "network_subnet_nsg_associated",
         "network_udp_internet_access_restricted",
         "network_watcher_enabled"
       ]
diff --git a/prowler/compliance/azure/soc2_azure.json b/prowler/compliance/azure/soc2_azure.json
index d8936f5485..20db26baf9 100644
--- a/prowler/compliance/azure/soc2_azure.json
+++ b/prowler/compliance/azure/soc2_azure.json
@@ -307,7 +307,8 @@
         "app_minimum_tls_version_12",
         "mysql_flexible_server_minimum_tls_version_12",
         "sqlserver_recommended_minimal_tls_version",
-        "storage_ensure_minimum_tls_version_12"
+        "storage_ensure_minimum_tls_version_12",
+        "network_subnet_nsg_associated"
       ]
     },
     {
diff --git a/prowler/providers/azure/services/network/network_service.py b/prowler/providers/azure/services/network/network_service.py
index 0eb6144534..98668bdbfa 100644
--- a/prowler/providers/azure/services/network/network_service.py
+++ b/prowler/providers/azure/services/network/network_service.py
@@ -17,6 +17,7 @@ class Network(AzureService):
         self.bastion_hosts = self._get_bastion_hosts()
         self.network_watchers = self._get_network_watchers()
         self.public_ip_addresses = self._get_public_ip_addresses()
+        self.virtual_networks = self._get_virtual_networks()
 
     def _get_security_groups(self):
         logger.info("Network - Getting Network Security Groups...")
@@ -203,6 +204,38 @@ class Network(AzureService):
                 )
         return public_ip_addresses
 
+    def _get_virtual_networks(self):
+        logger.info("Network - Getting Virtual Networks...")
+        virtual_networks = {}
+        for subscription, client in self.clients.items():
+            try:
+                virtual_networks[subscription] = []
+                vnet_list = client.virtual_networks.list_all()
+                for vnet in vnet_list:
+                    subnets = []
+                    for subnet in getattr(vnet, "subnets", []) or []:
+                        nsg = getattr(subnet, "network_security_group", None)
+                        subnets.append(
+                            VNetSubnet(
+                                id=subnet.id,
+                                name=subnet.name,
+                                nsg_id=getattr(nsg, "id", None) if nsg else None,
+                            )
+                        )
+                    virtual_networks[subscription].append(
+                        VirtualNetwork(
+                            id=vnet.id,
+                            name=vnet.name,
+                            location=vnet.location,
+                            subnets=subnets,
+                        )
+                    )
+            except Exception as error:
+                logger.error(
+                    f"Subscription name: {subscription} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                )
+        return virtual_networks
+
 
 @dataclass
 class BastionHost:
@@ -261,3 +294,22 @@ class PublicIp:
     name: str
     location: str
     ip_address: str
+
+
+@dataclass
+class VNetSubnet:
+    id: str
+    name: str
+    nsg_id: Optional[str] = None
+
+
+@dataclass
+class VirtualNetwork:
+    id: str
+    name: str
+    location: str
+    subnets: List[VNetSubnet] = None
+
+    def __post_init__(self):
+        if self.subnets is None:
+            self.subnets = []
diff --git a/prowler/providers/azure/services/network/network_subnet_nsg_associated/__init__.py b/prowler/providers/azure/services/network/network_subnet_nsg_associated/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated.metadata.json b/prowler/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated.metadata.json
new file mode 100644
index 0000000000..73cb41f886
--- /dev/null
+++ b/prowler/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "network_subnet_nsg_associated",
+  "CheckTitle": "Subnet has a network security group associated",
+  "CheckType": [],
+  "ServiceName": "network",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "microsoft.network/virtualnetworks/subnets",
+  "ResourceGroup": "network",
+  "Description": "**Azure Virtual Network** subnets are evaluated for **Network Security Group (NSG)** association. Each subnet should have an NSG to enforce inbound and outbound traffic filtering rules. Subnets without NSGs allow all traffic by default.",
+  "Risk": "Subnets without NSGs have **no network-level access control**. All inbound and outbound traffic is allowed by default, enabling **lateral movement**, **unauthorized access** to resources, and **data exfiltration** across the virtual network.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview",
+    "https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az network vnet subnet update --resource-group <rg> --vnet-name <vnet> --name <subnet> --network-security-group <nsg_name>",
+      "NativeIaC": "```bicep\nresource vnet 'Microsoft.Network/virtualNetworks@2023-09-01' existing = {\n  name: '<example_resource_name>'\n}\n\nresource subnet 'Microsoft.Network/virtualNetworks/subnets@2023-09-01' = {\n  name: '<example_resource_name>'\n  parent: vnet\n  properties: {\n    addressPrefix: '10.0.1.0/24'\n    networkSecurityGroup: {\n      id: '<example_resource_id>' // Critical: associates NSG with subnet\n    }\n  }\n}\n```",
+      "Other": "1. Sign in to Azure portal\n2. Go to Virtual networks and select the VNet\n3. Click on Subnets\n4. Select the subnet without an NSG\n5. Under Network security group, select an existing NSG or create a new one\n6. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_subnet_network_security_group_association\" \"<example_resource_name>\" {\n  subnet_id                 = \"<example_resource_id>\"  # Critical: associates NSG with subnet\n  network_security_group_id = \"<example_resource_id>\"\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Associate a **Network Security Group** with every subnet. Create NSG rules following **least privilege** \u2014 deny all by default and allow only required traffic. Exclude Azure-managed subnets (GatewaySubnet, AzureFirewallSubnet, AzureBastionSubnet) which have their own security controls.",
+      "Url": "https://hub.prowler.com/check/network_subnet_nsg_associated"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check excludes Azure-managed subnets (GatewaySubnet, AzureFirewallSubnet, AzureFirewallManagementSubnet, AzureBastionSubnet, RouteServerSubnet) which should not have custom NSGs."
+}
diff --git a/prowler/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated.py b/prowler/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated.py
new file mode 100644
index 0000000000..054f663351
--- /dev/null
+++ b/prowler/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated.py
@@ -0,0 +1,54 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.network.network_client import network_client
+
+# Subnets that are managed by Azure and should not have custom NSGs
+EXCLUDED_SUBNET_NAMES = {
+    "GatewaySubnet",
+    "AzureFirewallSubnet",
+    "AzureFirewallManagementSubnet",
+    "AzureBastionSubnet",
+    "RouteServerSubnet",
+}
+
+
+class network_subnet_nsg_associated(Check):
+    """
+    Ensure every subnet has a Network Security Group (NSG) associated.
+
+    This check evaluates whether each subnet in every virtual network has an NSG associated to enforce inbound and outbound traffic filtering. Azure-managed subnets (e.g. GatewaySubnet, AzureFirewallSubnet, AzureBastionSubnet) are excluded because they must not have custom NSGs.
+
+    - PASS: The subnet has an NSG associated.
+    - FAIL: The subnet does not have an NSG associated.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for subscription_name, vnets in network_client.virtual_networks.items():
+            for vnet in vnets:
+                for subnet in vnet.subnets:
+                    if subnet.name in EXCLUDED_SUBNET_NAMES:
+                        continue
+
+                    report = Check_Report_Azure(metadata=self.metadata(), resource=vnet)
+                    report.subscription = subscription_name
+                    report.resource_name = f"{vnet.name}/{subnet.name}"
+                    report.resource_id = subnet.id
+                    report.location = vnet.location
+
+                    if subnet.nsg_id:
+                        report.status = "PASS"
+                        report.status_extended = (
+                            f"Subnet '{subnet.name}' in VNet '{vnet.name}' "
+                            f"has an NSG associated."
+                        )
+                    else:
+                        report.status = "FAIL"
+                        report.status_extended = (
+                            f"Subnet '{subnet.name}' in VNet '{vnet.name}' "
+                            f"does not have an NSG associated."
+                        )
+
+                    findings.append(report)
+
+        return findings
diff --git a/tests/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated_test.py b/tests/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated_test.py
new file mode 100644
index 0000000000..4166c6f968
--- /dev/null
+++ b/tests/providers/azure/services/network/network_subnet_nsg_associated/network_subnet_nsg_associated_test.py
@@ -0,0 +1,188 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+VNET_ID = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet"
+SUBNET_ID = f"{VNET_ID}/subnets/test-subnet"
+NSG_ID = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg1/providers/Microsoft.Network/networkSecurityGroups/test-nsg"
+
+
+class Test_network_subnet_nsg_associated:
+    def test_no_subscriptions(self):
+        network_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated.network_client",
+                new=network_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated import (
+                network_subnet_nsg_associated,
+            )
+
+            network_client.virtual_networks = {}
+
+            check = network_subnet_nsg_associated()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_subnet_with_nsg(self):
+        network_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated.network_client",
+                new=network_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_service import (
+                VirtualNetwork,
+                VNetSubnet,
+            )
+            from prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated import (
+                network_subnet_nsg_associated,
+            )
+
+            vnet = VirtualNetwork(
+                id=VNET_ID,
+                name="test-vnet",
+                location="eastus",
+                subnets=[VNetSubnet(id=SUBNET_ID, name="test-subnet", nsg_id=NSG_ID)],
+            )
+            network_client.virtual_networks = {AZURE_SUBSCRIPTION_ID: [vnet]}
+
+            check = network_subnet_nsg_associated()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_subnet_without_nsg(self):
+        network_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated.network_client",
+                new=network_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_service import (
+                VirtualNetwork,
+                VNetSubnet,
+            )
+            from prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated import (
+                network_subnet_nsg_associated,
+            )
+
+            vnet = VirtualNetwork(
+                id=VNET_ID,
+                name="test-vnet",
+                location="eastus",
+                subnets=[VNetSubnet(id=SUBNET_ID, name="app-subnet", nsg_id=None)],
+            )
+            network_client.virtual_networks = {AZURE_SUBSCRIPTION_ID: [vnet]}
+
+            check = network_subnet_nsg_associated()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+
+    def test_gateway_subnet_excluded(self):
+        network_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated.network_client",
+                new=network_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_service import (
+                VirtualNetwork,
+                VNetSubnet,
+            )
+            from prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated import (
+                network_subnet_nsg_associated,
+            )
+
+            vnet = VirtualNetwork(
+                id=VNET_ID,
+                name="test-vnet",
+                location="eastus",
+                subnets=[
+                    VNetSubnet(
+                        id=f"{VNET_ID}/subnets/GatewaySubnet",
+                        name="GatewaySubnet",
+                        nsg_id=None,
+                    )
+                ],
+            )
+            network_client.virtual_networks = {AZURE_SUBSCRIPTION_ID: [vnet]}
+
+            check = network_subnet_nsg_associated()
+            result = check.execute()
+            # GatewaySubnet should be excluded
+            assert len(result) == 0
+
+    def test_mixed_subnets(self):
+        network_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated.network_client",
+                new=network_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_service import (
+                VirtualNetwork,
+                VNetSubnet,
+            )
+            from prowler.providers.azure.services.network.network_subnet_nsg_associated.network_subnet_nsg_associated import (
+                network_subnet_nsg_associated,
+            )
+
+            vnet = VirtualNetwork(
+                id=VNET_ID,
+                name="test-vnet",
+                location="eastus",
+                subnets=[
+                    VNetSubnet(id=f"{VNET_ID}/subnets/app", name="app", nsg_id=NSG_ID),
+                    VNetSubnet(id=f"{VNET_ID}/subnets/db", name="db", nsg_id=None),
+                    VNetSubnet(
+                        id=f"{VNET_ID}/subnets/GatewaySubnet",
+                        name="GatewaySubnet",
+                        nsg_id=None,
+                    ),
+                ],
+            )
+            network_client.virtual_networks = {AZURE_SUBSCRIPTION_ID: [vnet]}
+
+            check = network_subnet_nsg_associated()
+            result = check.execute()
+            # 2 results: app (PASS) + db (FAIL), GatewaySubnet excluded
+            assert len(result) == 2
+            statuses = {r.status for r in result}
+            assert "PASS" in statuses
+            assert "FAIL" in statuses

From 30d737c7d7ce99349c46b067b684614b4843d29e Mon Sep 17 00:00:00 2001
From: abdou <b-abderrahmane@outlook.com>
Date: Mon, 22 Jun 2026 14:05:11 +0200
Subject: [PATCH 111/126] fix(api): bound Celery worker concurrency to a
 configurable default (#11075)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Adrián Jesús Peña Rodríguez <adrianjpr@gmail.com>
---
 api/.env.example                              |  3 ++
 api/CHANGELOG.md                              |  1 +
 api/docs/orphan-task-recovery.md              |  1 +
 .../backend/api/tests/test_celery_settings.py | 27 ++++++++++++++
 api/src/backend/api/tests/test_views.py       |  4 ++-
 api/src/backend/config/settings/celery.py     |  5 +++
 docs/troubleshooting.mdx                      | 35 +++++++++++++++++++
 7 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/api/.env.example b/api/.env.example
index 0be5388790..f97d868890 100644
--- a/api/.env.example
+++ b/api/.env.example
@@ -24,6 +24,9 @@ DJANGO_THROTTLE_TOKEN_OBTAIN=50/minute
 # Decide whether to allow Django manage database table partitions
 DJANGO_MANAGE_DB_PARTITIONS=[True|False]
 DJANGO_CELERY_DEADLOCK_ATTEMPTS=5
+# Optional: bound Celery's prefork pool size. Unset → Celery uses os.cpu_count().
+# Useful on Kubernetes nodes with many CPUs where unbounded prefork balloons memory.
+# DJANGO_CELERY_WORKER_CONCURRENCY=4
 DJANGO_BROKER_VISIBILITY_TIMEOUT=86400
 DJANGO_SENTRY_DSN=
 
diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index 6073f71f0c..cb9d6fb179 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -9,6 +9,7 @@ All notable changes to the **Prowler API** are documented in this file.
 - Provider group filters for API endpoints that support cloud provider filtering, including exact and `__in` variants [(#11573)](https://github.com/prowler-cloud/prowler/pull/11573)
 - Provider filters for `GET /api/v1/compliance-overviews`, `/metadata`, and `/requirements`, using latest completed scans per matching provider [(#11587)](https://github.com/prowler-cloud/prowler/pull/11587)
 - Server-Sent Events (SSE) infrastructure for the API: a base viewset, a tenant-aware channel manager, and channel-name helpers backed by `django-eventstream` over Valkey Pub/Sub and served through the Gunicorn ASGI worker, so feature endpoints can stream events to clients over a single long-lived connection [(#11556)](https://github.com/prowler-cloud/prowler/pull/11556)
+- `DJANGO_CELERY_WORKER_CONCURRENCY` to configure Celery workers concurrency. Unset for default behaviour [(#11075)](https://github.com/prowler-cloud/prowler/pull/11075)
 
 ### 🔄 Changed
 
diff --git a/api/docs/orphan-task-recovery.md b/api/docs/orphan-task-recovery.md
index a47b4f36a9..af4eefc1ac 100644
--- a/api/docs/orphan-task-recovery.md
+++ b/api/docs/orphan-task-recovery.md
@@ -65,6 +65,7 @@ All settings have safe defaults; override via environment variables.
 | Env var | Default | Purpose |
 | --- | --- | --- |
 | `DJANGO_CELERY_WORKER_PREFETCH_MULTIPLIER` | `1` | Tasks reserved per worker process. |
+| `DJANGO_CELERY_WORKER_CONCURRENCY` | unset | Optional Celery prefork pool size. When unset, Celery uses its CPU-based default. Set this on worker containers to bound idle memory on hosts with many CPUs. |
 | `DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT` | `60` | Seconds the worker drains/re-queues on `SIGTERM` before force-kill. |
 | `DJANGO_CELERY_TASK_TIME_LIMIT` | `21600` (6h) | Hard limit for most tasks; connection checks are capped at 120s. |
 | `DJANGO_CELERY_TASK_SOFT_TIME_LIMIT` | hard - 600 | Soft limit; raises `SoftTimeLimitExceeded` for cleanup. |
diff --git a/api/src/backend/api/tests/test_celery_settings.py b/api/src/backend/api/tests/test_celery_settings.py
index d4010796ee..dcd8930edc 100644
--- a/api/src/backend/api/tests/test_celery_settings.py
+++ b/api/src/backend/api/tests/test_celery_settings.py
@@ -41,3 +41,30 @@ class TestBuildCeleryBrokerUrl:
     def test_invalid_scheme_raises_error(self):
         with pytest.raises(ValueError, match="Invalid VALKEY_SCHEME 'http'"):
             _build_celery_broker_url("http", "", "", "valkey", "6379", "0")
+
+
+class TestCeleryWorkerConcurrency:
+    def _reimport_settings(self):
+        """Fresh import — importlib.reload() doesn't clear the module namespace,
+        so an attribute set by a prior test would leak into the unset case."""
+        import sys
+
+        sys.modules.pop("config.settings.celery", None)
+        import config.settings.celery as celery_settings
+
+        return celery_settings
+
+    def test_unset_leaves_setting_absent(self, monkeypatch):
+        monkeypatch.delenv("DJANGO_CELERY_WORKER_CONCURRENCY", raising=False)
+        mod = self._reimport_settings()
+        assert not hasattr(mod, "CELERY_WORKER_CONCURRENCY")
+
+    def test_explicit_value_applied(self, monkeypatch):
+        monkeypatch.setenv("DJANGO_CELERY_WORKER_CONCURRENCY", "8")
+        mod = self._reimport_settings()
+        assert mod.CELERY_WORKER_CONCURRENCY == 8
+
+    def test_invalid_value_raises(self, monkeypatch):
+        monkeypatch.setenv("DJANGO_CELERY_WORKER_CONCURRENCY", "not-a-number")
+        with pytest.raises(ValueError):
+            self._reimport_settings()
diff --git a/api/src/backend/api/tests/test_views.py b/api/src/backend/api/tests/test_views.py
index 49234777da..613cef4755 100644
--- a/api/src/backend/api/tests/test_views.py
+++ b/api/src/backend/api/tests/test_views.py
@@ -13743,7 +13743,9 @@ class TestTenantFinishACSView:
             .filter(user=user, tenant=victim_tenant)
             .exists()
         )
-        assert not SAMLToken.objects.using(MainRouter.admin_db).filter(user=user).exists()
+        assert (
+            not SAMLToken.objects.using(MainRouter.admin_db).filter(user=user).exists()
+        )
 
     def test_rollback_saml_user_when_error_occurs(self, users_fixture, monkeypatch):
         """Test that a user is properly deleted when created during SAML flow and an error occurs"""
diff --git a/api/src/backend/config/settings/celery.py b/api/src/backend/config/settings/celery.py
index b7030ebea4..b7105a548c 100644
--- a/api/src/backend/config/settings/celery.py
+++ b/api/src/backend/config/settings/celery.py
@@ -53,3 +53,8 @@ CELERY_TASK_TRACK_STARTED = True
 CELERY_BROKER_CONNECTION_RETRY_ON_STARTUP = True
 
 CELERY_DEADLOCK_ATTEMPTS = env.int("DJANGO_CELERY_DEADLOCK_ATTEMPTS", default=5)
+
+# Opt-in override for Celery's prefork pool size. When unset, Celery falls back
+# to its default (os.cpu_count()).
+if "DJANGO_CELERY_WORKER_CONCURRENCY" in env.ENVIRON:
+    CELERY_WORKER_CONCURRENCY = env.int("DJANGO_CELERY_WORKER_CONCURRENCY")
diff --git a/docs/troubleshooting.mdx b/docs/troubleshooting.mdx
index 50cc43a3c0..3125d74ef5 100644
--- a/docs/troubleshooting.mdx
+++ b/docs/troubleshooting.mdx
@@ -2,6 +2,8 @@
 title: 'Troubleshooting'
 ---
 
+import { VersionBadge } from "/snippets/version-badge.mdx"
+
 ## Running `prowler` I get `[File: utils.py:15] [Module: utils] CRITICAL: path/redacted: OSError[13]`
 
 That is an error related to file descriptors or opened files allowed by your operating system.
@@ -81,6 +83,39 @@ docker compose down
 docker compose up -d
 ```
 
+### Worker Uses Too Much Memory on Hosts with Many CPUs
+
+<VersionBadge version="5.31.0" />
+
+When Prowler App runs self-hosted on a machine or Kubernetes node with many CPUs,
+the Celery worker may create one prefork process per detected CPU if concurrency
+is not configured explicitly. Each process loads the SDK runtime and cloud
+provider clients, so idle memory can be high and worker containers can be
+terminated by their memory limit.
+
+Set `DJANGO_CELERY_WORKER_CONCURRENCY` in the worker runtime environment to cap
+the number of prefork processes:
+
+```yaml
+services:
+  worker:
+    environment:
+      DJANGO_CELERY_WORKER_CONCURRENCY: "4"
+```
+
+For Kubernetes deployments, set the same variable on the worker Deployment:
+
+```yaml
+env:
+  - name: DJANGO_CELERY_WORKER_CONCURRENCY
+    value: "4"
+```
+
+Lower values reduce idle memory and the number of tasks a worker can run in
+parallel. Increase the value only when the worker has enough memory for the
+expected scan workload. Leaving the variable unset preserves Celery's default
+CPU-based concurrency.
+
 ### API Container Fails to Start with JWT Key Permission Error
 
 See [GitHub Issue #8897](https://github.com/prowler-cloud/prowler/issues/8897) for more details.

From 45cfe4e41196d152ba833c1136ef94ba60c52e1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Mon, 22 Jun 2026 15:30:15 +0200
Subject: [PATCH 112/126] feat(aws): add transfer_server_pqc_ssh_kex_enabled
 check (#11315)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 contrib/k8s/helm/prowler-api/values.yaml      |   7 +
 .../cli/tutorials/configuration_file.mdx      |   1 +
 prowler/CHANGELOG.md                          |   1 +
 ...itected_framework_security_pillar_aws.json |   1 +
 prowler/compliance/aws/ccc_aws.json           |   1 +
 prowler/compliance/aws/ens_rd2022_aws.json    |   6 +-
 .../aws/fedramp_moderate_revision_4_aws.json  |   2 +
 prowler/compliance/aws/ffiec_aws.json         |   1 +
 .../aws/gxp_21_cfr_part_11_aws.json           |   1 +
 prowler/compliance/aws/iso27001_2013_aws.json |   3 +-
 .../compliance/aws/kisa_isms_p_2023_aws.json  |   2 +
 .../aws/kisa_isms_p_2023_korean_aws.json      |   2 +
 .../aws/nist_800_171_revision_2_aws.json      |   1 +
 .../aws/nist_800_53_revision_5_aws.json       |   2 +
 .../aws/rbi_cyber_security_framework_aws.json |   1 +
 .../compliance/aws/secnumcloud_3.2_aws.json   |   1 +
 prowler/compliance/csa_ccm_4.0.json           |   2 +
 prowler/config/config.yaml                    |   8 +
 .../__init__.py                               |   0
 ...r_server_pqc_ssh_kex_enabled.metadata.json |  43 ++++
 .../transfer_server_pqc_ssh_kex_enabled.py    |  50 ++++
 .../aws/services/transfer/transfer_service.py |   4 +
 ...ransfer_server_pqc_ssh_kex_enabled_test.py | 215 ++++++++++++++++++
 .../transfer/transfer_service_test.py         |   5 +
 24 files changed, 357 insertions(+), 3 deletions(-)
 create mode 100644 prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/__init__.py
 create mode 100644 prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled.metadata.json
 create mode 100644 prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled.py
 create mode 100644 tests/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled_test.py

diff --git a/contrib/k8s/helm/prowler-api/values.yaml b/contrib/k8s/helm/prowler-api/values.yaml
index 0395c6f704..72c4b26088 100644
--- a/contrib/k8s/helm/prowler-api/values.yaml
+++ b/contrib/k8s/helm/prowler-api/values.yaml
@@ -438,6 +438,13 @@ mainConfig:
     # Minimum number of Availability Zones that an ELBv2 must be in
     elbv2_min_azs: 2
 
+    # AWS Post-Quantum SSH Key Exchange Configuration
+    # aws.transfer_server_pqc_ssh_kex_enabled
+    transfer_pqc_ssh_allowed_policies:
+      - "TransferSecurityPolicy-2025-03"
+      - "TransferSecurityPolicy-FIPS-2025-03"
+      - "TransferSecurityPolicy-AS2Restricted-2025-07"
+
 
     # AWS Secrets Configuration
     # Patterns to ignore in the secrets checks
diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx
index caf8853a1b..4b918c869f 100644
--- a/docs/user-guide/cli/tutorials/configuration_file.mdx
+++ b/docs/user-guide/cli/tutorials/configuration_file.mdx
@@ -67,6 +67,7 @@ The following list includes all the AWS checks with configurable variables that
 | `secretsmanager_secret_rotated_periodically`                  | `max_days_secret_unrotated`                      | Integer         |
 | `ssm_document_secrets`                                        | `secrets_ignore_patterns`                        | List of Strings |
 | `trustedadvisor_premium_support_plan_subscribed`              | `verify_premium_support_plans`                   | Boolean         |
+| `transfer_server_pqc_ssh_kex_enabled`                        | `transfer_pqc_ssh_allowed_policies`              | List of Strings |
 | `dynamodb_table_cross_account_access`                         | `trusted_account_ids`                            | List of Strings |
 | `eventbridge_bus_cross_account_access`                        | `trusted_account_ids`                            | List of Strings |
 | `eventbridge_schema_registry_cross_account_access`            | `trusted_account_ids`                            | List of Strings |
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 124bdab8b1..b479000569 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -42,6 +42,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the GCP provider, mapping existing GCP checks across the five DORA pillars [(#11642)](https://github.com/prowler-cloud/prowler/pull/11642)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Cloudflare provider, mapping existing Cloudflare edge/network checks across the applicable DORA pillars [(#11645)](https://github.com/prowler-cloud/prowler/pull/11645)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the AlibabaCloud provider, mapping existing AlibabaCloud checks across the applicable DORA pillars [(#11646)](https://github.com/prowler-cloud/prowler/pull/11646)
+- `transfer_server_pqc_ssh_kex_enabled` check for AWS provider to verify Transfer Family servers use a post-quantum hybrid SSH key exchange security policy [(#11315)](https://github.com/prowler-cloud/prowler/pull/11315)
 
 ### 🔄 Changed
 
diff --git a/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json b/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
index 94c50eb68a..e99760d8be 100644
--- a/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
+++ b/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
@@ -1151,6 +1151,7 @@
         "elb_insecure_ssl_ciphers",
         "elb_ssl_listeners",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_ssl_listeners",
         "s3_bucket_secure_transport_policy"
       ]
diff --git a/prowler/compliance/aws/ccc_aws.json b/prowler/compliance/aws/ccc_aws.json
index d1a20ee3d0..298b803c1c 100644
--- a/prowler/compliance/aws/ccc_aws.json
+++ b/prowler/compliance/aws/ccc_aws.json
@@ -49,6 +49,7 @@
         "elb_insecure_ssl_ciphers",
         "elb_ssl_listeners",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_ssl_listeners",
         "elbv2_nlb_tls_termination_enabled",
         "s3_bucket_secure_transport_policy",
diff --git a/prowler/compliance/aws/ens_rd2022_aws.json b/prowler/compliance/aws/ens_rd2022_aws.json
index f6c574daef..850ffb6850 100644
--- a/prowler/compliance/aws/ens_rd2022_aws.json
+++ b/prowler/compliance/aws/ens_rd2022_aws.json
@@ -2366,7 +2366,8 @@
         }
       ],
       "Checks": [
-        "elbv2_insecure_ssl_ciphers"
+        "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled"
       ]
     },
     {
@@ -2389,7 +2390,8 @@
         }
       ],
       "Checks": [
-        "elbv2_insecure_ssl_ciphers"
+        "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled"
       ]
     },
     {
diff --git a/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json b/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
index c914a58b2c..1090931bf5 100644
--- a/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
+++ b/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
@@ -1145,6 +1145,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "opensearch_service_domains_node_to_node_encryption_enabled",
         "s3_bucket_secure_transport_policy"
@@ -1164,6 +1165,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "opensearch_service_domains_node_to_node_encryption_enabled",
         "s3_bucket_secure_transport_policy"
diff --git a/prowler/compliance/aws/ffiec_aws.json b/prowler/compliance/aws/ffiec_aws.json
index 23ab8953b6..ad5ff3068f 100644
--- a/prowler/compliance/aws/ffiec_aws.json
+++ b/prowler/compliance/aws/ffiec_aws.json
@@ -487,6 +487,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "s3_bucket_secure_transport_policy"
       ]
diff --git a/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json b/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
index 39534c4fdc..29b21c3a69 100644
--- a/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
+++ b/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
@@ -266,6 +266,7 @@
         "ec2_ebs_default_encryption",
         "efs_encryption_at_rest_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "opensearch_service_domains_encryption_at_rest_enabled",
         "opensearch_service_domains_node_to_node_encryption_enabled",
diff --git a/prowler/compliance/aws/iso27001_2013_aws.json b/prowler/compliance/aws/iso27001_2013_aws.json
index ad31ea0af4..4709458f8b 100644
--- a/prowler/compliance/aws/iso27001_2013_aws.json
+++ b/prowler/compliance/aws/iso27001_2013_aws.json
@@ -35,7 +35,8 @@
       ],
       "Checks": [
         "elb_insecure_ssl_ciphers",
-        "elbv2_insecure_ssl_ciphers"
+        "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled"
       ]
     },
     {
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
index d172e615dd..526c656c5a 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
@@ -2040,6 +2040,7 @@
         "elb_ssl_listeners",
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_nlb_tls_termination_enabled",
         "elbv2_ssl_listeners",
         "glue_data_catalogs_connection_passwords_encryption_enabled",
@@ -3090,6 +3091,7 @@
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_desync_mitigation_mode",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_internet_facing",
         "elbv2_listeners_underneath",
         "elbv2_logging_enabled",
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
index 1748d96442..1cc50d15af 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
@@ -2042,6 +2042,7 @@
         "elb_ssl_listeners",
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_nlb_tls_termination_enabled",
         "elbv2_ssl_listeners",
         "glue_data_catalogs_connection_passwords_encryption_enabled",
@@ -3093,6 +3094,7 @@
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_desync_mitigation_mode",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_internet_facing",
         "elbv2_listeners_underneath",
         "elbv2_logging_enabled",
diff --git a/prowler/compliance/aws/nist_800_171_revision_2_aws.json b/prowler/compliance/aws/nist_800_171_revision_2_aws.json
index 8e28ee383d..35b67d75b0 100644
--- a/prowler/compliance/aws/nist_800_171_revision_2_aws.json
+++ b/prowler/compliance/aws/nist_800_171_revision_2_aws.json
@@ -653,6 +653,7 @@
         "apigateway_restapi_client_certificate_enabled",
         "ec2_ebs_volume_encryption",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "opensearch_service_domains_node_to_node_encryption_enabled",
         "s3_bucket_default_encryption",
         "s3_bucket_secure_transport_policy"
diff --git a/prowler/compliance/aws/nist_800_53_revision_5_aws.json b/prowler/compliance/aws/nist_800_53_revision_5_aws.json
index 858df01fd9..ac25515f93 100644
--- a/prowler/compliance/aws/nist_800_53_revision_5_aws.json
+++ b/prowler/compliance/aws/nist_800_53_revision_5_aws.json
@@ -5262,6 +5262,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "opensearch_service_domains_node_to_node_encryption_enabled",
         "s3_bucket_secure_transport_policy"
@@ -5549,6 +5550,7 @@
       ],
       "Checks": [
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners"
       ]
     },
diff --git a/prowler/compliance/aws/rbi_cyber_security_framework_aws.json b/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
index b4566a8929..22c3774959 100644
--- a/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
+++ b/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
@@ -40,6 +40,7 @@
         "ec2_instance_public_ip",
         "efs_encryption_at_rest_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "ec2_ebs_default_encryption",
         "emr_cluster_master_nodes_no_public_ip",
diff --git a/prowler/compliance/aws/secnumcloud_3.2_aws.json b/prowler/compliance/aws/secnumcloud_3.2_aws.json
index 1e157b47c7..794de281de 100644
--- a/prowler/compliance/aws/secnumcloud_3.2_aws.json
+++ b/prowler/compliance/aws/secnumcloud_3.2_aws.json
@@ -474,6 +474,7 @@
         "elbv2_ssl_listeners",
         "elb_insecure_ssl_ciphers",
         "elbv2_insecure_ssl_ciphers",
+        "transfer_server_pqc_ssh_kex_enabled",
         "redshift_cluster_in_transit_encryption_enabled",
         "elasticache_redis_cluster_in_transit_encryption_enabled",
         "dynamodb_accelerator_cluster_in_transit_encryption_enabled",
diff --git a/prowler/compliance/csa_ccm_4.0.json b/prowler/compliance/csa_ccm_4.0.json
index 57f1a67758..b6bb382cda 100644
--- a/prowler/compliance/csa_ccm_4.0.json
+++ b/prowler/compliance/csa_ccm_4.0.json
@@ -1602,6 +1602,7 @@
           "cloudfront_distributions_origin_traffic_encrypted",
           "cloudfront_distributions_custom_ssl_certificate",
           "transfer_server_in_transit_encryption_enabled",
+          "transfer_server_pqc_ssh_kex_enabled",
           "sagemaker_notebook_instance_encryption_enabled",
           "sagemaker_training_jobs_volume_and_output_encryption_enabled",
           "workspaces_volume_encryption_enabled",
@@ -1785,6 +1786,7 @@
           "acm_certificates_with_secure_key_algorithms",
           "elb_insecure_ssl_ciphers",
           "elbv2_insecure_ssl_ciphers",
+          "transfer_server_pqc_ssh_kex_enabled",
           "cloudfront_distributions_using_deprecated_ssl_protocols"
         ],
         "azure": [
diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml
index 28f07c2051..f9dda5dc92 100644
--- a/prowler/config/config.yaml
+++ b/prowler/config/config.yaml
@@ -380,6 +380,14 @@ aws:
   # Minimum number of Availability Zones that an ELBv2 must be in
   elbv2_min_azs: 2
 
+  # AWS Post-Quantum SSH Key Exchange Configuration
+  # aws.transfer_server_pqc_ssh_kex_enabled
+  # Allowed AWS Transfer Family security policies with post-quantum SSH key exchange
+  transfer_pqc_ssh_allowed_policies:
+    - "TransferSecurityPolicy-2025-03"
+    - "TransferSecurityPolicy-FIPS-2025-03"
+    - "TransferSecurityPolicy-AS2Restricted-2025-07"
+
   # AWS Elasticache Configuration
   # aws.elasticache_redis_cluster_backup_enabled
   # Minimum number of days that a Redis cluster must have backups retention period
diff --git a/prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/__init__.py b/prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled.metadata.json b/prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled.metadata.json
new file mode 100644
index 0000000000..773c85b7ab
--- /dev/null
+++ b/prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled.metadata.json
@@ -0,0 +1,43 @@
+{
+  "Provider": "aws",
+  "CheckID": "transfer_server_pqc_ssh_kex_enabled",
+  "CheckTitle": "AWS Transfer Family server uses a post-quantum hybrid SSH key exchange security policy",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "transfer",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "AwsTransferServer",
+  "ResourceGroup": "network",
+  "Description": "**AWS Transfer Family servers** (SFTP, FTPS, AS2) are assessed for use of an approved **post-quantum (PQ) hybrid SSH key exchange security policy**. Servers whose `SecurityPolicyName` is not in the configured allowlist of PQ-ready Transfer Family security policies leave file-transfer sessions exposed to **harvest-now, decrypt-later** attacks.",
+  "Risk": "Without a PQ-ready security policy, SSH/SFTP traffic captured today can be stored and decrypted in the future once a **cryptographically relevant quantum computer** is available. This threatens long-term **confidentiality** of transferred files, credentials, and metadata.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/transfer/latest/userguide/post-quantum-security-policies.html",
+    "https://docs.aws.amazon.com/transfer/latest/userguide/security-policies.html",
+    "https://aws.amazon.com/security/post-quantum-cryptography/",
+    "https://csrc.nist.gov/projects/post-quantum-cryptography"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws transfer update-server --server-id <server_id> --security-policy-name TransferSecurityPolicy-2025-03",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::Transfer::Server\n    Properties:\n      Protocols:\n        - SFTP\n      SecurityPolicyName: TransferSecurityPolicy-2025-03  # FIX: post-quantum hybrid SSH KEX policy\n```",
+      "Other": "1. In the AWS Console, go to AWS Transfer Family > Servers\n2. Select the server and choose Edit on the Additional details panel\n3. Set Cryptographic algorithm options (Security policy) to TransferSecurityPolicy-2025-03 (or another approved PQ policy)\n4. Save the changes",
+      "Terraform": "```hcl\nresource \"aws_transfer_server\" \"<example_resource_name>\" {\n  protocols              = [\"SFTP\"]\n  security_policy_name   = \"TransferSecurityPolicy-2025-03\" # FIX: post-quantum hybrid SSH KEX policy\n  endpoint_type          = \"PUBLIC\"\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Migrate AWS Transfer Family servers to a **post-quantum security policy** (e.g., `TransferSecurityPolicy-2025-03`, `TransferSecurityPolicy-FIPS-2025-03`, `TransferSecurityPolicy-AS2Restricted-2025-07`) that adds ML-KEM hybrid SSH key exchange. Avoid deprecated `*-PQ-SSH-Experimental-2023-04` policies. Review allowed policies regularly as AWS publishes new PQ-ready options.",
+      "Url": "https://hub.prowler.com/check/transfer_server_pqc_ssh_kex_enabled"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "transfer_server_in_transit_encryption_enabled"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled.py b/prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled.py
new file mode 100644
index 0000000000..a7d70df2df
--- /dev/null
+++ b/prowler/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled.py
@@ -0,0 +1,50 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.transfer.transfer_client import transfer_client
+
+PQC_TRANSFER_POLICIES_DEFAULT = [
+    "TransferSecurityPolicy-2025-03",
+    "TransferSecurityPolicy-FIPS-2025-03",
+    "TransferSecurityPolicy-AS2Restricted-2025-07",
+]
+
+
+class transfer_server_pqc_ssh_kex_enabled(Check):
+    """Verify that every AWS Transfer Family server uses a post-quantum security policy.
+
+    A Transfer Family server PASSES when its ``SecurityPolicyName`` is in the
+    configured allowlist of policies that enable hybrid ML-KEM SSH key exchange.
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Check whether Transfer Family servers use approved PQ SSH KEX policies.
+
+        Iterates through discovered AWS Transfer Family servers and compares each
+        server's ``SecurityPolicyName`` with the configured allowlist of
+        post-quantum hybrid SSH key exchange security policies.
+
+        Returns:
+            list[Check_Report_AWS]: A list of reports for each Transfer Family
+            server, including the evaluated security policy context.
+        """
+        findings = []
+        pqc_policies = transfer_client.audit_config.get(
+            "transfer_pqc_ssh_allowed_policies", PQC_TRANSFER_POLICIES_DEFAULT
+        )
+        for server in transfer_client.servers.values():
+            report = Check_Report_AWS(metadata=self.metadata(), resource=server)
+            policy = server.security_policy_name or "<none>"
+            if server.security_policy_name in pqc_policies:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Transfer Server {server.id} uses post-quantum security policy "
+                    f"{policy}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Transfer Server {server.id} uses security policy {policy}, "
+                    "which does not enable post-quantum hybrid SSH key exchange."
+                )
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/transfer/transfer_service.py b/prowler/providers/aws/services/transfer/transfer_service.py
index f86e195a31..968b0c9e60 100644
--- a/prowler/providers/aws/services/transfer/transfer_service.py
+++ b/prowler/providers/aws/services/transfer/transfer_service.py
@@ -46,6 +46,9 @@ class Transfer(AWSService):
             )
             for protocol in server_description.get("Protocols", []):
                 server.protocols.append(Protocol(protocol))
+            server.security_policy_name = server_description.get(
+                "SecurityPolicyName", ""
+            )
             server.tags = server_description.get("Tags", [])
         except Exception as error:
             logger.error(
@@ -65,4 +68,5 @@ class Server(BaseModel):
     id: str
     region: str
     protocols: List[Protocol] = Field(default_factory=list)
+    security_policy_name: str = ""
     tags: List[Dict[str, str]] = Field(default_factory=list)
diff --git a/tests/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled_test.py b/tests/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled_test.py
new file mode 100644
index 0000000000..d1a098f0ad
--- /dev/null
+++ b/tests/providers/aws/services/transfer/transfer_server_pqc_ssh_kex_enabled/transfer_server_pqc_ssh_kex_enabled_test.py
@@ -0,0 +1,215 @@
+from unittest import mock
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+SERVER_ID = "s-01234567890abcdef"
+SERVER_ARN = (
+    f"arn:aws:transfer:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:server/{SERVER_ID}"
+)
+
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def _make_describe_server_mock(security_policy_name: str):
+    def _mock(self, operation_name, kwarg):
+        if operation_name == "ListServers":
+            return {
+                "Servers": [
+                    {
+                        "Arn": SERVER_ARN,
+                        "ServerId": SERVER_ID,
+                    }
+                ]
+            }
+        if operation_name == "DescribeServer":
+            return {
+                "Server": {
+                    "Arn": SERVER_ARN,
+                    "ServerId": SERVER_ID,
+                    "Protocols": ["SFTP"],
+                    "SecurityPolicyName": security_policy_name,
+                }
+            }
+        return make_api_call(self, operation_name, kwarg)
+
+    return _mock
+
+
+mock_pqc = _make_describe_server_mock("TransferSecurityPolicy-2025-03")
+mock_fips_pqc = _make_describe_server_mock("TransferSecurityPolicy-FIPS-2025-03")
+mock_classical = _make_describe_server_mock("TransferSecurityPolicy-2024-01")
+mock_no_policy = _make_describe_server_mock("")
+
+
+class Test_transfer_server_pqc_ssh_kex_enabled:
+    @mock_aws
+    def test_no_servers(self):
+        from prowler.providers.aws.services.transfer.transfer_service import Transfer
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled.transfer_client",
+                new=Transfer(aws_provider),
+            ):
+                from prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled import (
+                    transfer_server_pqc_ssh_kex_enabled,
+                )
+
+                check = transfer_server_pqc_ssh_kex_enabled()
+                result = check.execute()
+
+                assert len(result) == 0
+
+    @patch("botocore.client.BaseClient._make_api_call", new=mock_pqc)
+    @mock_aws
+    def test_pq_policy(self):
+        from prowler.providers.aws.services.transfer.transfer_service import Transfer
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled.transfer_client",
+                new=Transfer(aws_provider),
+            ):
+                from prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled import (
+                    transfer_server_pqc_ssh_kex_enabled,
+                )
+
+                check = transfer_server_pqc_ssh_kex_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+                assert "TransferSecurityPolicy-2025-03" in result[0].status_extended
+                assert result[0].resource_id == SERVER_ID
+                assert result[0].resource_arn == SERVER_ARN
+                assert result[0].region == AWS_REGION_US_EAST_1
+
+    @patch("botocore.client.BaseClient._make_api_call", new=mock_fips_pqc)
+    @mock_aws
+    def test_fips_pq_policy(self):
+        from prowler.providers.aws.services.transfer.transfer_service import Transfer
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled.transfer_client",
+                new=Transfer(aws_provider),
+            ):
+                from prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled import (
+                    transfer_server_pqc_ssh_kex_enabled,
+                )
+
+                check = transfer_server_pqc_ssh_kex_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+                assert "FIPS-2025-03" in result[0].status_extended
+
+    @patch("botocore.client.BaseClient._make_api_call", new=mock_classical)
+    @mock_aws
+    def test_classical_policy(self):
+        from prowler.providers.aws.services.transfer.transfer_service import Transfer
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled.transfer_client",
+                new=Transfer(aws_provider),
+            ):
+                from prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled import (
+                    transfer_server_pqc_ssh_kex_enabled,
+                )
+
+                check = transfer_server_pqc_ssh_kex_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert "TransferSecurityPolicy-2024-01" in result[0].status_extended
+                assert "does not enable post-quantum" in result[0].status_extended
+
+    @patch("botocore.client.BaseClient._make_api_call", new=mock_no_policy)
+    @mock_aws
+    def test_missing_policy(self):
+        from prowler.providers.aws.services.transfer.transfer_service import Transfer
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled.transfer_client",
+                new=Transfer(aws_provider),
+            ):
+                from prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled import (
+                    transfer_server_pqc_ssh_kex_enabled,
+                )
+
+                check = transfer_server_pqc_ssh_kex_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert "<none>" in result[0].status_extended
+
+    @patch("botocore.client.BaseClient._make_api_call", new=mock_classical)
+    @mock_aws
+    def test_configurable_allowlist(self):
+        from prowler.providers.aws.services.transfer.transfer_service import Transfer
+
+        aws_provider = set_mocked_aws_provider(
+            [AWS_REGION_US_EAST_1],
+            audit_config={
+                "transfer_pqc_ssh_allowed_policies": [
+                    "TransferSecurityPolicy-2025-03",
+                    "TransferSecurityPolicy-2024-01",
+                ]
+            },
+        )
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled.transfer_client",
+                new=Transfer(aws_provider),
+            ):
+                from prowler.providers.aws.services.transfer.transfer_server_pqc_ssh_kex_enabled.transfer_server_pqc_ssh_kex_enabled import (
+                    transfer_server_pqc_ssh_kex_enabled,
+                )
+
+                check = transfer_server_pqc_ssh_kex_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
diff --git a/tests/providers/aws/services/transfer/transfer_service_test.py b/tests/providers/aws/services/transfer/transfer_service_test.py
index 61a963ab09..7a08e66c92 100644
--- a/tests/providers/aws/services/transfer/transfer_service_test.py
+++ b/tests/providers/aws/services/transfer/transfer_service_test.py
@@ -35,6 +35,7 @@ def mock_make_api_call(self, operation_name, kwarg):
                 "Arn": SERVER_ARN,
                 "ServerId": SERVER_ID,
                 "Protocols": ["SFTP"],
+                "SecurityPolicyName": "TransferSecurityPolicy-2025-03",
                 "Tags": [{"Key": "key", "Value": "value"}],
             }
         }
@@ -83,3 +84,7 @@ class Test_transfer_service:
         assert transfer.servers[SERVER_ARN].region == "us-east-1"
         assert transfer.servers[SERVER_ARN].tags == [{"Key": "key", "Value": "value"}]
         assert transfer.servers[SERVER_ARN].protocols[0] == Protocol.SFTP
+        assert (
+            transfer.servers[SERVER_ARN].security_policy_name
+            == "TransferSecurityPolicy-2025-03"
+        )

From 5ee8b9680d058ba31387e0af5205a68e238dd7e3 Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Mon, 22 Jun 2026 16:21:35 +0200
Subject: [PATCH 113/126] feat(ui): add organization bulk scan scheduling
 (#11643)

---
 ui/actions/schedules/schedules.test.ts        | 115 ++++-
 ui/actions/schedules/schedules.ts             |  53 ++-
 .../providers/providers-page.utils.test.ts    |  71 ++-
 .../providers/providers-page.utils.ts         |  43 +-
 ui/app/(prowler)/scans/page.tsx               |   4 +
 .../organizations/org-launch-scan.test.tsx    | 447 ++++++++++++++----
 .../organizations/org-launch-scan.tsx         | 253 ++++++++--
 .../providers-accounts-table.test.tsx         | 306 ++++++++++++
 .../providers/providers-accounts-table.tsx    | 129 ++++-
 .../providers-accounts-view.test.tsx          |  36 +-
 .../providers/providers-accounts-view.tsx     |   1 +
 .../providers/table/column-providers.tsx      |  10 +
 .../table/data-table-row-actions.test.tsx     | 124 ++++-
 .../table/data-table-row-actions.tsx          | 154 ++++--
 .../wizard/provider-wizard-modal.tsx          |  11 +-
 .../wizard/steps/launch-step.test.tsx         |  30 ++
 .../providers/wizard/steps/launch-step.tsx    |  52 +-
 .../scans/launch-scan-modal.test.tsx          |  48 ++
 ui/components/scans/launch-scan-modal.tsx     |  22 +-
 .../edit-scan-schedule-modal.test.tsx         | 164 ++++++-
 .../schedule/edit-scan-schedule-modal.tsx     | 155 ++++--
 .../scans/table/scan-jobs-columns.test.tsx    |  25 +-
 .../scans/table/scan-jobs-columns.tsx         |  40 +-
 .../table/scan-jobs-row-actions.test.tsx      |  47 ++
 .../scans/table/scan-jobs-row-actions.tsx     |   2 +-
 .../scans/table/scan-jobs-table.test.tsx      |  23 +-
 ui/components/scans/table/scan-jobs-table.tsx |   8 +-
 ui/components/ui/table/data-table.test.tsx    |   1 +
 ui/components/ui/table/data-table.tsx         |   2 +-
 ui/hooks/use-scan-schedule-capability.test.ts |  53 +++
 ui/hooks/use-scan-schedule-capability.ts      |  17 +
 ui/lib/schedules.ts                           |  10 +
 ui/types/providers-table.ts                   |   1 +
 ui/types/schedules.ts                         |  43 +-
 34 files changed, 2253 insertions(+), 247 deletions(-)
 create mode 100644 ui/components/providers/providers-accounts-table.test.tsx
 create mode 100644 ui/hooks/use-scan-schedule-capability.test.ts
 create mode 100644 ui/hooks/use-scan-schedule-capability.ts

diff --git a/ui/actions/schedules/schedules.test.ts b/ui/actions/schedules/schedules.test.ts
index 9e05799116..d676e12d67 100644
--- a/ui/actions/schedules/schedules.test.ts
+++ b/ui/actions/schedules/schedules.test.ts
@@ -1,6 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-import { SCHEDULE_FREQUENCY } from "@/types/schedules";
+import {
+  SCHEDULE_FREQUENCY,
+  type ScheduleUpdatePayload,
+} from "@/types/schedules";
 
 const {
   fetchMock,
@@ -30,9 +33,15 @@ vi.mock("@/lib/server-actions-helper", () => ({
   handleApiResponse: handleApiResponseMock,
 }));
 
-import { getSchedule, removeSchedule, updateSchedule } from "./schedules";
+import {
+  getSchedule,
+  removeSchedule,
+  updateSchedule,
+  updateSchedulesBulk,
+} from "./schedules";
 
 const PROVIDER_ID = "1795f636-37e6-42f6-b158-d4faaa64e0fc";
+const SECOND_PROVIDER_ID = "9b7fae7d-5e72-49fe-8b0b-5bff5930db1a";
 
 const payload = {
   scan_enabled: true,
@@ -61,6 +70,108 @@ describe("schedule write actions revalidate only on success", () => {
     expect(revalidatePathMock).toHaveBeenCalledWith("/providers");
   });
 
+  it("posts the JSON:API bulk schedule payload", async () => {
+    handleApiResponseMock.mockResolvedValue({
+      data: {
+        type: "schedules-bulk",
+        attributes: {
+          updated: [PROVIDER_ID, SECOND_PROVIDER_ID],
+          failed: [],
+        },
+      },
+    });
+
+    await updateSchedulesBulk([PROVIDER_ID, SECOND_PROVIDER_ID], payload);
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      "https://api.example.com/api/v1/schedules/bulk",
+      expect.objectContaining({
+        method: "POST",
+        headers: { Authorization: "Bearer token" },
+        body: JSON.stringify({
+          data: {
+            type: "schedules-bulk",
+            attributes: {
+              schedule: payload,
+              provider_ids: [PROVIDER_ID, SECOND_PROVIDER_ID],
+            },
+          },
+        }),
+      }),
+    );
+  });
+
+  it("rejects invalid bulk provider ids without issuing a request", async () => {
+    expect(
+      await updateSchedulesBulk([PROVIDER_ID, "../users/me"], payload),
+    ).toEqual({
+      error: "Invalid provider ids.",
+    });
+    expect(await updateSchedulesBulk([], payload)).toEqual({
+      error: "Invalid provider ids.",
+    });
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("rejects invalid bulk schedule payloads without issuing a request", async () => {
+    const invalidPayload = {
+      ...payload,
+      scan_hour: "12",
+    } as unknown as ScheduleUpdatePayload;
+
+    expect(
+      await updateSchedulesBulk(
+        [PROVIDER_ID, SECOND_PROVIDER_ID],
+        invalidPayload,
+      ),
+    ).toEqual({
+      error: "Invalid schedule payload.",
+    });
+    expect(getAuthHeadersMock).not.toHaveBeenCalled();
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("normalizes bulk auth header errors", async () => {
+    const authError = new Error("Session expired");
+    getAuthHeadersMock.mockRejectedValue(authError);
+
+    expect(
+      await updateSchedulesBulk([PROVIDER_ID, SECOND_PROVIDER_ID], payload),
+    ).toEqual({ error: "Failed" });
+    expect(handleApiErrorMock).toHaveBeenCalledWith(authError);
+    expect(fetchMock).not.toHaveBeenCalled();
+  });
+
+  it("revalidates /scans and /providers after a partial bulk success", async () => {
+    handleApiResponseMock.mockResolvedValue({
+      data: {
+        type: "schedules-bulk",
+        attributes: {
+          updated: [PROVIDER_ID],
+          failed: [{ provider_id: SECOND_PROVIDER_ID, error: "Denied" }],
+        },
+      },
+    });
+
+    const result = await updateSchedulesBulk(
+      [PROVIDER_ID, SECOND_PROVIDER_ID],
+      payload,
+    );
+
+    expect(result.data?.attributes?.updated).toEqual([PROVIDER_ID]);
+    expect(result.data?.attributes?.failed).toHaveLength(1);
+    expect(revalidatePathMock).toHaveBeenCalledWith("/scans");
+    expect(revalidatePathMock).toHaveBeenCalledWith("/providers");
+  });
+
+  it("does not revalidate when the bulk update returns an error result", async () => {
+    handleApiResponseMock.mockResolvedValue({ error: "Bulk rejected" });
+
+    await updateSchedulesBulk([PROVIDER_ID, SECOND_PROVIDER_ID], payload);
+
+    expect(revalidatePathMock).not.toHaveBeenCalled();
+  });
+
   it("does not revalidate when the update returns an error result", async () => {
     handleApiResponseMock.mockResolvedValue({ error: "Schedule rejected" });
 
diff --git a/ui/actions/schedules/schedules.ts b/ui/actions/schedules/schedules.ts
index c8e0d9993f..6b197823eb 100644
--- a/ui/actions/schedules/schedules.ts
+++ b/ui/actions/schedules/schedules.ts
@@ -4,8 +4,13 @@ import { revalidatePath } from "next/cache";
 import { z } from "zod";
 
 import { apiBaseUrl, getAuthHeaders } from "@/lib";
+import { scheduleUpdatePayloadSchema } from "@/lib/schedules";
 import { handleApiError, handleApiResponse } from "@/lib/server-actions-helper";
-import type { ScheduleProps, ScheduleUpdatePayload } from "@/types/schedules";
+import type {
+  ScheduleProps,
+  SchedulesBulkResponse,
+  ScheduleUpdatePayload,
+} from "@/types/schedules";
 
 // SSRF guard: the id is interpolated into the request URL, so only UUIDs pass.
 const providerIdSchema = z.uuid();
@@ -15,6 +20,13 @@ function parseProviderId(providerId: string): string | null {
   return parsed.success ? parsed.data : null;
 }
 
+function parseProviderIds(providerIds: string[]): string[] | null {
+  if (providerIds.length === 0) return null;
+
+  const ids = providerIds.map(parseProviderId);
+  return ids.every((id): id is string => id !== null) ? ids : null;
+}
+
 function revalidateScheduleViews() {
   revalidatePath("/scans");
   revalidatePath("/providers");
@@ -104,6 +116,45 @@ export const updateSchedule = async (
   }
 };
 
+export const updateSchedulesBulk = async (
+  providerIds: string[],
+  payload: ScheduleUpdatePayload,
+): Promise<SchedulesBulkResponse> => {
+  const ids = parseProviderIds(providerIds);
+  if (!ids) return { error: "Invalid provider ids." };
+
+  const parsedPayload = scheduleUpdatePayloadSchema.safeParse(payload);
+  if (!parsedPayload.success) return { error: "Invalid schedule payload." };
+
+  try {
+    const headers = await getAuthHeaders({ contentType: true });
+    const url = new URL(`${apiBaseUrl}/schedules/bulk`);
+    const body = {
+      data: {
+        type: "schedules-bulk",
+        attributes: {
+          schedule: parsedPayload.data,
+          provider_ids: ids,
+        },
+      },
+    };
+
+    const response = await fetch(url.toString(), {
+      method: "POST",
+      headers,
+      body: JSON.stringify(body),
+    });
+
+    const result = (await handleApiResponse(response)) as SchedulesBulkResponse;
+    if (!result?.error) {
+      revalidateScheduleViews();
+    }
+    return result;
+  } catch (error) {
+    return handleApiError(error);
+  }
+};
+
 export const removeSchedule = async (providerId: string) => {
   const id = parseProviderId(providerId);
   if (!id) return { error: "Invalid provider id." };
diff --git a/ui/app/(prowler)/providers/providers-page.utils.test.ts b/ui/app/(prowler)/providers/providers-page.utils.test.ts
index b5dcd6d844..5727807d85 100644
--- a/ui/app/(prowler)/providers/providers-page.utils.test.ts
+++ b/ui/app/(prowler)/providers/providers-page.utils.test.ts
@@ -28,7 +28,10 @@ vi.mock("@/actions/schedules", () => schedulesActionsMock);
 
 import { SearchParamsProps } from "@/types";
 import { ProvidersApiResponse } from "@/types/providers";
-import { ProvidersProviderRow } from "@/types/providers-table";
+import {
+  isProvidersOrganizationRow,
+  ProvidersProviderRow,
+} from "@/types/providers-table";
 import {
   SCHEDULE_FREQUENCY,
   type ScheduleAttributes,
@@ -643,13 +646,73 @@ describe("buildProvidersTableRows", () => {
 
     // Then
     expect(rows).toHaveLength(1);
-    expect(rows[0].rowType).toBe(PROVIDERS_ROW_TYPE.ORGANIZATION);
-    expect(rows[0].subRows).toHaveLength(2);
+    const orgRow = rows[0];
+    expect(isProvidersOrganizationRow(orgRow)).toBe(true);
+    if (!isProvidersOrganizationRow(orgRow)) {
+      throw new Error("Expected organization row");
+    }
+    expect(orgRow.subRows).toHaveLength(2);
     expect(
-      rows[0].subRows?.every(
+      orgRow.subRows?.every(
         (row) => row.rowType === PROVIDERS_ROW_TYPE.PROVIDER,
       ),
     ).toBe(true);
+    expect(orgRow.providerIds).toEqual(["provider-1", "provider-2"]);
+  });
+
+  it("keeps organization relationship provider ids even when providers are not in the visible page", () => {
+    // Given
+    const providers = [
+      toProviderRow(providersResponse.data[0], {
+        relationships: {
+          ...providersResponse.data[0].relationships,
+          organization: {
+            data: null,
+          },
+        },
+      }),
+    ];
+
+    // When
+    const rows = buildProvidersTableRows({
+      providers,
+      organizations: [
+        {
+          id: "org-1",
+          type: "organizations",
+          attributes: {
+            name: "Large Organization",
+            org_type: "aws",
+            external_id: "o-large",
+            metadata: {},
+            root_external_id: "r-large",
+          },
+          relationships: {
+            providers: {
+              data: [
+                { type: "providers", id: "provider-1" },
+                { type: "providers", id: "provider-not-in-page" },
+              ],
+            },
+            organizational_units: {
+              data: [],
+            },
+          },
+        },
+      ],
+      organizationUnits: [],
+      isCloud: true,
+    });
+
+    // Then
+    expect(rows).toHaveLength(1);
+    const orgRow = rows[0];
+    expect(isProvidersOrganizationRow(orgRow)).toBe(true);
+    if (!isProvidersOrganizationRow(orgRow)) {
+      throw new Error("Expected organization row");
+    }
+    expect(orgRow.subRows).toHaveLength(1);
+    expect(orgRow.providerIds).toEqual(["provider-1", "provider-not-in-page"]);
   });
 });
 
diff --git a/ui/app/(prowler)/providers/providers-page.utils.ts b/ui/app/(prowler)/providers/providers-page.utils.ts
index a37d6eb510..32ce2a5321 100644
--- a/ui/app/(prowler)/providers/providers-page.utils.ts
+++ b/ui/app/(prowler)/providers/providers-page.utils.ts
@@ -183,6 +183,7 @@ const createOrganizationRow = ({
   externalId,
   organizationId,
   parentExternalId,
+  providerIds,
   subRows,
 }: {
   externalId: string | null;
@@ -191,6 +192,7 @@ const createOrganizationRow = ({
   name: string;
   organizationId: string | null;
   parentExternalId: string | null;
+  providerIds: string[];
   subRows: ProvidersTableRow[];
 }): ProvidersOrganizationRow => ({
   id,
@@ -200,7 +202,8 @@ const createOrganizationRow = ({
   externalId,
   organizationId,
   parentExternalId,
-  providerCount: countProviderRows(subRows),
+  providerCount: providerIds.length,
+  providerIds,
   subRows,
 });
 
@@ -234,14 +237,14 @@ function getProviderRowsByIds({
     .filter((provider): provider is ProvidersProviderRow => Boolean(provider));
 }
 
-function countProviderRows(rows: ProvidersTableRow[]): number {
-  return rows.reduce((total, row) => {
-    if (row.rowType === PROVIDERS_ROW_TYPE.PROVIDER) {
-      return total + 1;
-    }
+function dedupeIds(ids: string[]): string[] {
+  return Array.from(new Set(ids));
+}
 
-    return total + countProviderRows(row.subRows);
-  }, 0);
+function collectOrganizationRowProviderIds(
+  rows: ProvidersOrganizationRow[],
+): string[] {
+  return dedupeIds(rows.flatMap((row) => row.providerIds));
 }
 
 function getOrganizationUnitRelationshipId(
@@ -308,6 +311,13 @@ function buildOrganizationUnitRows({
           ? providerRowsFromRelationships
           : (providersByOrganizationUnitId.get(organizationUnit.id) ?? []);
       const subRows = [...childOrganizationUnitRows, ...providerRows];
+      const directProviderIds =
+        providerRowsFromRelationships.length > 0
+          ? getRelationshipProviderIds(organizationUnit.relationships)
+          : providerRows.map((provider) => provider.id);
+      const childProviderIds = collectOrganizationRowProviderIds(
+        childOrganizationUnitRows,
+      );
 
       return createOrganizationRow({
         groupKind: PROVIDERS_GROUP_KIND.ORGANIZATION_UNIT,
@@ -316,10 +326,13 @@ function buildOrganizationUnitRows({
         externalId: organizationUnit.attributes.external_id,
         organizationId,
         parentExternalId: organizationUnit.attributes.parent_external_id,
+        providerIds: dedupeIds([...childProviderIds, ...directProviderIds]),
         subRows,
       });
     })
-    .filter((organizationUnitRow) => organizationUnitRow.subRows.length > 0);
+    .filter(
+      (organizationUnitRow) => organizationUnitRow.providerIds.length > 0,
+    );
 }
 
 export function buildProvidersTableRows({
@@ -418,6 +431,12 @@ export function buildProvidersTableRows({
               (provider) => !providersInOus.has(provider.id),
             );
       const subRows = [...organizationProviders, ...organizationUnitRows];
+      const directProviderIds =
+        organizationProvidersFromRelationships.length > 0
+          ? getRelationshipProviderIds(organization.relationships)
+          : organizationProviders.map((provider) => provider.id);
+      const organizationUnitProviderIds =
+        collectOrganizationRowProviderIds(organizationUnitRows);
 
       return createOrganizationRow({
         groupKind: PROVIDERS_GROUP_KIND.ORGANIZATION,
@@ -426,10 +445,14 @@ export function buildProvidersTableRows({
         externalId: organization.attributes.external_id,
         organizationId: organization.id,
         parentExternalId: organization.attributes.root_external_id,
+        providerIds: dedupeIds([
+          ...directProviderIds,
+          ...organizationUnitProviderIds,
+        ]),
         subRows,
       });
     })
-    .filter((organizationRow) => organizationRow.subRows.length > 0);
+    .filter((organizationRow) => organizationRow.providerIds.length > 0);
 
   const assignedProviderIds = new Set<string>();
 
diff --git a/ui/app/(prowler)/scans/page.tsx b/ui/app/(prowler)/scans/page.tsx
index d945380f93..f50126719e 100644
--- a/ui/app/(prowler)/scans/page.tsx
+++ b/ui/app/(prowler)/scans/page.tsx
@@ -30,6 +30,7 @@ import {
   ScanProps,
   SearchParamsProps,
 } from "@/types";
+import type { ScanScheduleCapability } from "@/types/schedules";
 
 const ACTIVE_SCAN_COUNT_PAGE_SIZE = 1;
 // Pending schedule rows are derived from provider schedules, but must honor the
@@ -244,9 +245,11 @@ export default async function Scans({
 const SSRDataTableScans = async ({
   searchParams,
   providers,
+  scanScheduleCapability,
 }: {
   searchParams: SearchParamsProps;
   providers: ProviderProps[];
+  scanScheduleCapability?: ScanScheduleCapability;
 }) => {
   const tab = getScanJobsTab(searchParams.tab);
 
@@ -359,6 +362,7 @@ const SSRDataTableScans = async ({
       meta={tableMeta}
       tab={tab}
       hasFilters={hasUserFilters}
+      scanScheduleCapability={scanScheduleCapability}
     />
   );
 };
diff --git a/ui/components/providers/organizations/org-launch-scan.test.tsx b/ui/components/providers/organizations/org-launch-scan.test.tsx
index f7ef851a0c..9d98cef5af 100644
--- a/ui/components/providers/organizations/org-launch-scan.test.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.test.tsx
@@ -1,22 +1,37 @@
 import { act, render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
 import type { ComponentProps } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import { useOrgSetupStore } from "@/store/organizations/store";
-import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
+import {
+  SCAN_JOBS_TAB,
+  SCAN_SCHEDULE_CAPABILITY,
+  SCHEDULE_FREQUENCY,
+} from "@/types";
 
 import { OrgLaunchScan } from "./org-launch-scan";
 
-const { launchOrganizationScansMock, pushMock, toastMock } = vi.hoisted(() => ({
+const {
+  launchOrganizationScansMock,
+  pushMock,
+  toastMock,
+  updateSchedulesBulkMock,
+} = vi.hoisted(() => ({
   launchOrganizationScansMock: vi.fn(),
   pushMock: vi.fn(),
   toastMock: vi.fn(),
+  updateSchedulesBulkMock: vi.fn(),
 }));
 
 vi.mock("@/actions/scans/scans", () => ({
   launchOrganizationScans: launchOrganizationScansMock,
 }));
 
+vi.mock("@/actions/schedules/schedules", () => ({
+  updateSchedulesBulk: updateSchedulesBulkMock,
+}));
+
 vi.mock("next/navigation", () => ({
   useRouter: () => ({
     push: pushMock,
@@ -32,117 +47,381 @@ vi.mock("@/components/ui", () => ({
   }),
 }));
 
+const PROVIDER_IDS = ["provider-1", "provider-2"];
+
+const lastFooterConfig = (onFooterChange: ReturnType<typeof vi.fn>) =>
+  onFooterChange.mock.calls.at(-1)?.[0];
+
 describe("OrgLaunchScan", () => {
   beforeEach(() => {
+    vi.spyOn(Intl, "DateTimeFormat").mockReturnValue({
+      resolvedOptions: () => ({ timeZone: "Europe/Madrid" }),
+    } as Intl.DateTimeFormat);
     sessionStorage.clear();
     localStorage.clear();
     launchOrganizationScansMock.mockReset();
     pushMock.mockReset();
     toastMock.mockReset();
+    updateSchedulesBulkMock.mockReset();
+    launchOrganizationScansMock.mockResolvedValue({
+      successCount: 2,
+      failureCount: 0,
+      totalCount: 2,
+      errors: [],
+    });
+    updateSchedulesBulkMock.mockResolvedValue({
+      data: {
+        type: "schedules-bulk",
+        attributes: {
+          updated: PROVIDER_IDS,
+          failed: [],
+        },
+      },
+    });
     useOrgSetupStore.getState().reset();
     useOrgSetupStore
       .getState()
       .setOrganization("org-1", "My Organization", "o-abc123def4");
-    useOrgSetupStore.getState().setCreatedProviderIds(["provider-1"]);
+    useOrgSetupStore.getState().setCreatedProviderIds(PROVIDER_IDS);
   });
 
-  it("shows a success toast with an action linking to scans", async () => {
-    // Given
-    launchOrganizationScansMock.mockResolvedValue({ successCount: 1 });
-    const onFooterChange = vi.fn();
+  describe("when capability is ADVANCED", () => {
+    it("should save schedules through the bulk endpoint", async () => {
+      // Given
+      const onFooterChange = vi.fn();
 
-    render(
-      <OrgLaunchScan
-        onClose={vi.fn()}
-        onBack={vi.fn()}
-        onFooterChange={onFooterChange}
-      />,
-    );
+      render(
+        <OrgLaunchScan
+          onClose={vi.fn()}
+          onBack={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
 
-    // When
-    await waitFor(() => {
-      expect(onFooterChange).toHaveBeenCalled();
-    });
-    const footerConfig = onFooterChange.mock.calls.at(-1)?.[0];
-    await act(async () => {
-      footerConfig.onAction?.();
+      // When
+      await screen.findByText("Scan Schedule");
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() =>
+        expect(updateSchedulesBulkMock).toHaveBeenCalledTimes(1),
+      );
+      expect(updateSchedulesBulkMock).toHaveBeenCalledWith(
+        PROVIDER_IDS,
+        expect.objectContaining({
+          scan_enabled: true,
+          scan_frequency: SCHEDULE_FREQUENCY.DAILY,
+          scan_hour: expect.any(Number),
+          scan_timezone: "Europe/Madrid",
+        }),
+      );
+      expect(launchOrganizationScansMock).not.toHaveBeenCalled();
+      expect(pushMock).toHaveBeenCalledWith("/providers");
+      expect(
+        toastMock.mock.calls[0]?.[0].action.props.children.props.href,
+      ).toBe(`/scans?tab=${SCAN_JOBS_TAB.SCHEDULED}`);
     });
 
-    // Then
-    await waitFor(() => {
-      expect(toastMock).toHaveBeenCalledTimes(1);
+    it("should launch initial scans only for updated providers", async () => {
+      // Given
+      const user = userEvent.setup();
+      const onFooterChange = vi.fn();
+      updateSchedulesBulkMock.mockResolvedValue({
+        data: {
+          type: "schedules-bulk",
+          attributes: {
+            updated: ["provider-2"],
+            failed: [{ id: "provider-1", error: "Denied" }],
+          },
+        },
+      });
+
+      render(
+        <OrgLaunchScan
+          onClose={vi.fn()}
+          onBack={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+
+      // When
+      await user.click(
+        await screen.findByRole("checkbox", {
+          name: /launch an initial scan now/i,
+        }),
+      );
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() =>
+        expect(launchOrganizationScansMock).toHaveBeenCalledTimes(1),
+      );
+      expect(launchOrganizationScansMock).toHaveBeenCalledWith(
+        ["provider-2"],
+        "single",
+      );
+      expect(
+        toastMock.mock.calls[0]?.[0].action.props.children.props.href,
+      ).toBe(`/scans?tab=${SCAN_JOBS_TAB.ACTIVE}`);
+    });
+
+    it("should disable launch actions while schedule capability is loading", async () => {
+      // Given
+      const onFooterChange = vi.fn();
+
+      render(
+        <OrgLaunchScan
+          onClose={vi.fn()}
+          onBack={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+          isScheduleCapabilityLoading
+        />,
+      );
+
+      // When
+      await screen.findByText("Loading scan options...");
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      expect(lastFooterConfig(onFooterChange)?.backDisabled).toBe(true);
+      expect(lastFooterConfig(onFooterChange)?.actionDisabled).toBe(true);
+      expect(updateSchedulesBulkMock).not.toHaveBeenCalled();
+      expect(launchOrganizationScansMock).not.toHaveBeenCalled();
+    });
+
+    it("should surface an error toast and stay on the wizard when the bulk update fails", async () => {
+      // Given
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      updateSchedulesBulkMock.mockResolvedValue({ error: "Denied" });
+
+      render(
+        <OrgLaunchScan
+          onClose={onClose}
+          onBack={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+
+      // When
+      await screen.findByText("Scan Schedule");
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() =>
+        expect(toastMock).toHaveBeenCalledWith(
+          expect.objectContaining({
+            variant: "destructive",
+            title: "Unable to save scan schedules",
+          }),
+        ),
+      );
+      expect(launchOrganizationScansMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+      expect(onClose).not.toHaveBeenCalled();
+    });
+
+    it("should treat a fully-failed bulk response as an error without navigating away", async () => {
+      // Given
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      updateSchedulesBulkMock.mockResolvedValue({
+        data: {
+          type: "schedules-bulk",
+          attributes: {
+            updated: [],
+            failed: [
+              { id: "provider-1", error: "Denied" },
+              { id: "provider-2", error: "Denied" },
+            ],
+          },
+        },
+      });
+
+      render(
+        <OrgLaunchScan
+          onClose={onClose}
+          onBack={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+
+      // When
+      await screen.findByText("Scan Schedule");
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() =>
+        expect(toastMock).toHaveBeenCalledWith(
+          expect.objectContaining({
+            variant: "destructive",
+            title: "Unable to save scan schedules",
+            description: "The scan schedule could not be saved for 2 accounts.",
+          }),
+        ),
+      );
+      expect(launchOrganizationScansMock).not.toHaveBeenCalled();
+      expect(pushMock).not.toHaveBeenCalled();
+      expect(onClose).not.toHaveBeenCalled();
+    });
+
+    it("should describe partial failures in the success toast", async () => {
+      // Given
+      const onFooterChange = vi.fn();
+      updateSchedulesBulkMock.mockResolvedValue({
+        data: {
+          type: "schedules-bulk",
+          attributes: {
+            updated: ["provider-2"],
+            failed: [{ provider_id: "provider-1", error: "Denied" }],
+          },
+        },
+      });
+
+      render(
+        <OrgLaunchScan
+          onClose={vi.fn()}
+          onBack={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        />,
+      );
+
+      // When
+      await screen.findByText("Scan Schedule");
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(toastMock).toHaveBeenCalled());
+      expect(toastMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          title: "Scan schedules saved",
+          description:
+            "The schedule was saved for 1 account, but 1 account could not be updated.",
+        }),
+      );
     });
-    const toastPayload = toastMock.mock.calls[0]?.[0];
-    expect(toastPayload.title).toBe("Scan Launched");
-    expect(toastPayload.action).toBeDefined();
-    expect(toastPayload.action.props.children.props.href).toBe("/scans");
   });
 
-  it("uses a single manual scan when schedules are unavailable", async () => {
-    // Given
-    launchOrganizationScansMock.mockResolvedValue({ successCount: 1 });
-    const onFooterChange = vi.fn();
+  describe("when capability is DAILY_LEGACY", () => {
+    it("should keep the legacy daily scheduling path", async () => {
+      // Given
+      const onFooterChange = vi.fn();
 
-    render(
-      <OrgLaunchScan
-        onClose={vi.fn()}
-        onBack={vi.fn()}
-        onFooterChange={onFooterChange}
-        capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
-      />,
-    );
+      render(
+        <OrgLaunchScan
+          onClose={vi.fn()}
+          onBack={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.DAILY_LEGACY}
+        />,
+      );
 
-    // Then
-    expect(
-      screen.getByText(/scheduled scans are not available for trial accounts/i),
-    ).toBeInTheDocument();
-    expect(screen.queryByRole("combobox")).not.toBeInTheDocument();
+      // When
+      await screen.findByText(
+        "Select a Prowler scan schedule for these accounts.",
+      );
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
 
-    // When
-    await waitFor(() => {
-      expect(onFooterChange).toHaveBeenCalled();
+      // Then
+      await waitFor(() =>
+        expect(launchOrganizationScansMock).toHaveBeenCalledWith(
+          PROVIDER_IDS,
+          "daily",
+        ),
+      );
+      expect(updateSchedulesBulkMock).not.toHaveBeenCalled();
+      expect(
+        toastMock.mock.calls[0]?.[0].action.props.children.props.href,
+      ).toBe(`/scans?tab=${SCAN_JOBS_TAB.SCHEDULED}`);
     });
-    const footerConfig = onFooterChange.mock.calls.at(-1)?.[0];
-    await act(async () => {
-      footerConfig.onAction?.();
-    });
-
-    // Then
-    await waitFor(() => {
-      expect(launchOrganizationScansMock).toHaveBeenCalledTimes(1);
-    });
-    expect(launchOrganizationScansMock).toHaveBeenCalledWith(
-      ["provider-1"],
-      "single",
-    );
   });
 
-  it("blocks manual scans when the trial scan limit is reached", async () => {
-    // Given
-    const onFooterChange = vi.fn();
+  describe("when capability is MANUAL_ONLY", () => {
+    it("should launch single scans without rendering schedule controls", async () => {
+      // Given
+      const onFooterChange = vi.fn();
 
-    render(
-      <OrgLaunchScan
-        onClose={vi.fn()}
-        onBack={vi.fn()}
-        onFooterChange={onFooterChange}
-        capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
-        isScanLimitReached
-      />,
-    );
+      render(
+        <OrgLaunchScan
+          onClose={vi.fn()}
+          onBack={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+        />,
+      );
 
-    // When
-    await waitFor(() => {
-      expect(onFooterChange).toHaveBeenCalled();
-    });
-    const footerConfig = onFooterChange.mock.calls.at(-1)?.[0];
-    await act(async () => {
-      footerConfig.onAction?.();
+      // When
+      expect(
+        screen.getByText(
+          /scheduled scans are not available for trial accounts/i,
+        ),
+      ).toBeInTheDocument();
+      expect(screen.queryByRole("combobox")).not.toBeInTheDocument();
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() =>
+        expect(launchOrganizationScansMock).toHaveBeenCalledWith(
+          PROVIDER_IDS,
+          "single",
+        ),
+      );
+      expect(updateSchedulesBulkMock).not.toHaveBeenCalled();
+      expect(
+        toastMock.mock.calls[0]?.[0].action.props.children.props.href,
+      ).toBe(`/scans?tab=${SCAN_JOBS_TAB.ACTIVE}`);
     });
+  });
 
-    // Then
-    expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
-    expect(footerConfig.actionDisabled).toBe(true);
-    expect(launchOrganizationScansMock).not.toHaveBeenCalled();
+  describe("when capability is BLOCKED", () => {
+    it("should disable the action without calling scans or schedules", async () => {
+      // Given
+      const onFooterChange = vi.fn();
+
+      render(
+        <OrgLaunchScan
+          onClose={vi.fn()}
+          onBack={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.BLOCKED}
+        />,
+      );
+
+      // When
+      await waitFor(() => {
+        expect(lastFooterConfig(onFooterChange)?.actionDisabled).toBe(true);
+      });
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+      expect(updateSchedulesBulkMock).not.toHaveBeenCalled();
+      expect(launchOrganizationScansMock).not.toHaveBeenCalled();
+    });
   });
 });
diff --git a/ui/components/providers/organizations/org-launch-scan.tsx b/ui/components/providers/organizations/org-launch-scan.tsx
index 6aede38b81..70b0cc46d3 100644
--- a/ui/components/providers/organizations/org-launch-scan.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.tsx
@@ -1,15 +1,19 @@
 "use client";
 
+import { zodResolver } from "@hookform/resolvers/zod";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useEffect, useRef, useState } from "react";
+import { useForm, useWatch } from "react-hook-form";
 
 import { launchOrganizationScans } from "@/actions/scans/scans";
+import { updateSchedulesBulk } from "@/actions/schedules/schedules";
 import { AWSProviderBadge } from "@/components/icons/providers-badge";
 import {
   WIZARD_FOOTER_ACTION_TYPE,
   WizardFooterConfig,
 } from "@/components/providers/wizard/steps/footer-controls";
+import { ScanScheduleFields } from "@/components/scans/schedule/scan-schedule-fields";
 import {
   Select,
   SelectContent,
@@ -20,11 +24,21 @@ import {
 import { Spinner } from "@/components/shadcn/spinner/spinner";
 import { TreeStatusIcon } from "@/components/shadcn/tree-view/tree-status-icon";
 import { ToastAction, useToast } from "@/components/ui";
+import {
+  buildScheduleUpdatePayload,
+  getScanScheduleCapability,
+  getScheduleFormDefaults,
+  scheduleFormSchema,
+} from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
 import { useOrgSetupStore } from "@/store/organizations/store";
 import {
+  SCAN_JOBS_TAB,
   SCAN_SCHEDULE_CAPABILITY,
   type ScanScheduleCapability,
-} from "@/types/schedules";
+  type ScheduleFormValues,
+  type SchedulesBulkResponse,
+} from "@/types";
 import { TREE_ITEM_STATUS } from "@/types/tree";
 
 interface OrgLaunchScanProps {
@@ -32,12 +46,17 @@ interface OrgLaunchScanProps {
   onBack: () => void;
   onFooterChange: (config: WizardFooterConfig) => void;
   /**
-   * Schedule capability override. Prowler Cloud passes MANUAL_ONLY for trial
-   * tenants so organization onboarding cannot create recurring schedules.
+   * Schedule capability override. Prowler Cloud passes MANUAL_ONLY/BLOCKED for
+   * billing-limited tenants; OSS falls back to an environment-based capability.
    */
   capability?: ScanScheduleCapability;
   /** Cloud-only manual scan quota signal. */
   isScanLimitReached?: boolean;
+  /**
+   * Cloud-only loading state while billing is resolved into a schedule
+   * capability. OSS leaves it false.
+   */
+  isScheduleCapabilityLoading?: boolean;
 }
 
 const SCAN_SCHEDULE = {
@@ -47,30 +66,182 @@ const SCAN_SCHEDULE = {
 
 type ScanScheduleOption = (typeof SCAN_SCHEDULE)[keyof typeof SCAN_SCHEDULE];
 
+function getStringArray(value: unknown): string[] {
+  return Array.isArray(value)
+    ? value.filter((item): item is string => typeof item === "string")
+    : [];
+}
+
+/**
+ * Providers whose schedule was actually saved. The backend reports successes
+ * under `updated`, populated only after each provider's schedule commits, so
+ * it already excludes failures — no client-side subtraction is needed.
+ */
+function getUpdatedProviderIds(result: SchedulesBulkResponse): string[] {
+  return getStringArray(result.data?.attributes?.updated);
+}
+
+function getFailedCount(result: SchedulesBulkResponse): number {
+  const failed = result.data?.attributes?.failed;
+  return Array.isArray(failed) ? failed.length : 0;
+}
+
+function formatAccountCount(count: number): string {
+  return `${count} account${count === 1 ? "" : "s"}`;
+}
+
+function getScansHref(tab: (typeof SCAN_JOBS_TAB)[keyof typeof SCAN_JOBS_TAB]) {
+  return `/scans?tab=${tab}`;
+}
+
 export function OrgLaunchScan({
   onClose,
   onBack,
   onFooterChange,
   capability,
   isScanLimitReached = false,
+  isScheduleCapabilityLoading = false,
 }: OrgLaunchScanProps) {
   const router = useRouter();
   const { toast } = useToast();
   const { organizationExternalId, createdProviderIds, reset } =
     useOrgSetupStore();
 
+  const resolvedCapability = capability ?? getScanScheduleCapability(isCloud());
+  const isAdvanced = resolvedCapability === SCAN_SCHEDULE_CAPABILITY.ADVANCED;
+  const isDailyLegacy =
+    resolvedCapability === SCAN_SCHEDULE_CAPABILITY.DAILY_LEGACY;
+  const isManualOnly =
+    resolvedCapability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
+  const isBlocked =
+    resolvedCapability === SCAN_SCHEDULE_CAPABILITY.BLOCKED ||
+    (isManualOnly && isScanLimitReached);
+
   const [isLaunching, setIsLaunching] = useState(false);
   const [scheduleOption, setScheduleOption] = useState<ScanScheduleOption>(
     SCAN_SCHEDULE.DAILY,
   );
+  const form = useForm<ScheduleFormValues>({
+    resolver: zodResolver(scheduleFormSchema),
+    defaultValues: getScheduleFormDefaults(),
+  });
+  const launchInitialScan = useWatch({
+    control: form.control,
+    name: "launchInitialScan",
+  });
   const launchActionRef = useRef<() => void>(() => {});
-  const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
+
   const effectiveScheduleOption = isManualOnly
     ? SCAN_SCHEDULE.SINGLE
     : scheduleOption;
+  const actionDisabled =
+    isLaunching ||
+    isScheduleCapabilityLoading ||
+    isBlocked ||
+    createdProviderIds.length === 0;
+  const actionLabel = isAdvanced
+    ? isLaunching
+      ? launchInitialScan
+        ? "Saving and launching..."
+        : "Saving..."
+      : launchInitialScan
+        ? "Save and launch scan"
+        : "Save"
+    : isLaunching
+      ? "Launching scans..."
+      : "Launch scan";
 
-  const handleLaunchScan = async () => {
-    if (isManualOnly && isScanLimitReached) {
+  const finishSuccess = () => {
+    reset();
+    onClose();
+    router.push("/providers");
+  };
+
+  const handleAdvancedSchedule = form.handleSubmit(async (values) => {
+    if (actionDisabled || !isAdvanced) {
+      return;
+    }
+
+    setIsLaunching(true);
+
+    const result = await updateSchedulesBulk(
+      createdProviderIds,
+      buildScheduleUpdatePayload(values),
+    );
+
+    if (result.error) {
+      setIsLaunching(false);
+      toast({
+        variant: "destructive",
+        title: "Unable to save scan schedules",
+        description: String(result.error),
+      });
+      return;
+    }
+
+    const updatedProviderIds = getUpdatedProviderIds(result);
+    const failedCount = getFailedCount(result);
+
+    // No provider was actually updated (e.g. the endpoint returned 200 but every
+    // schedule failed). Surface it as an error and keep the wizard open to retry
+    // instead of navigating away with a misleading "saved for 0 accounts" toast.
+    if (updatedProviderIds.length === 0) {
+      setIsLaunching(false);
+      toast({
+        variant: "destructive",
+        title: "Unable to save scan schedules",
+        description:
+          failedCount > 0
+            ? `The scan schedule could not be saved for ${formatAccountCount(failedCount)}.`
+            : "The scan schedule could not be saved for any account.",
+      });
+      return;
+    }
+
+    let initialScanFailureCount = 0;
+    let initialScanSuccessCount = 0;
+
+    if (values.launchInitialScan) {
+      const scanResult = await launchOrganizationScans(
+        updatedProviderIds,
+        SCAN_SCHEDULE.SINGLE,
+      );
+      initialScanFailureCount = scanResult.failureCount;
+      initialScanSuccessCount = scanResult.successCount;
+    }
+
+    setIsLaunching(false);
+    finishSuccess();
+
+    const updatedCount = updatedProviderIds.length;
+    const description =
+      failedCount > 0
+        ? `The schedule was saved for ${formatAccountCount(updatedCount)}, but ${formatAccountCount(failedCount)} could not be updated.`
+        : `The scan schedule was saved for ${formatAccountCount(updatedCount)}.`;
+    const targetTab =
+      initialScanSuccessCount > 0
+        ? SCAN_JOBS_TAB.ACTIVE
+        : SCAN_JOBS_TAB.SCHEDULED;
+
+    toast({
+      title:
+        values.launchInitialScan && initialScanFailureCount === 0
+          ? "Scan schedules saved and initial scans launched"
+          : "Scan schedules saved",
+      description:
+        initialScanFailureCount > 0
+          ? `${description} Initial scans failed for ${formatAccountCount(initialScanFailureCount)}.`
+          : description,
+      action: (
+        <ToastAction altText="Go to scans" asChild>
+          <Link href={getScansHref(targetTab)}>Go to scans</Link>
+        </ToastAction>
+      ),
+    });
+  });
+
+  const handleLegacyLaunch = async () => {
+    if (actionDisabled || isAdvanced) {
       return;
     }
 
@@ -81,52 +252,58 @@ export function OrgLaunchScan({
       effectiveScheduleOption,
     );
     const successCount = result.successCount;
+    const targetTab =
+      effectiveScheduleOption === SCAN_SCHEDULE.SINGLE
+        ? SCAN_JOBS_TAB.ACTIVE
+        : SCAN_JOBS_TAB.SCHEDULED;
 
     setIsLaunching(false);
-    reset();
-    onClose();
-    router.push("/providers");
+    finishSuccess();
 
     toast({
       title: "Scan Launched",
       description:
         effectiveScheduleOption === SCAN_SCHEDULE.DAILY
-          ? `Daily scan scheduled for ${successCount} account${successCount !== 1 ? "s" : ""}.`
-          : `Single scan launched for ${successCount} account${successCount !== 1 ? "s" : ""}.`,
+          ? `Daily scan scheduled for ${formatAccountCount(successCount)}.`
+          : `Single scan launched for ${formatAccountCount(successCount)}.`,
       action: (
         <ToastAction altText="Go to scans" asChild>
-          <Link href="/scans">Go to scans</Link>
+          <Link href={getScansHref(targetTab)}>Go to scans</Link>
         </ToastAction>
       ),
     });
   };
 
   launchActionRef.current = () => {
-    void handleLaunchScan();
+    if (isAdvanced) {
+      void handleAdvancedSchedule();
+      return;
+    }
+    void handleLegacyLaunch();
   };
 
   useEffect(() => {
     onFooterChange({
       showBack: true,
       backLabel: "Back",
-      backDisabled: isLaunching,
+      backDisabled: isLaunching || isScheduleCapabilityLoading,
       onBack,
       showAction: true,
-      actionLabel: "Launch scan",
-      actionDisabled:
-        isLaunching ||
-        createdProviderIds.length === 0 ||
-        (isManualOnly && isScanLimitReached),
+      actionLabel,
+      actionDisabled,
       actionType: WIZARD_FOOTER_ACTION_TYPE.BUTTON,
       onAction: () => {
         launchActionRef.current();
       },
     });
   }, [
+    actionDisabled,
+    actionLabel,
     createdProviderIds.length,
+    isAdvanced,
     isLaunching,
-    isManualOnly,
-    isScanLimitReached,
+    isScheduleCapabilityLoading,
+    launchInitialScan,
     onBack,
     onFooterChange,
   ]);
@@ -149,11 +326,17 @@ export function OrgLaunchScan({
         </div>
       </div>
 
-      {isLaunching ? (
+      {isLaunching || isScheduleCapabilityLoading ? (
         <div className="flex min-h-[220px] items-center justify-center">
           <div className="flex items-center gap-3 py-2">
             <Spinner className="size-6" />
-            <p className="text-sm font-medium">Launching scans...</p>
+            <p className="text-sm font-medium">
+              {isScheduleCapabilityLoading
+                ? "Loading scan options..."
+                : isAdvanced
+                  ? "Saving scan schedules..."
+                  : "Launching scans..."}
+            </p>
           </div>
         </div>
       ) : (
@@ -177,20 +360,26 @@ export function OrgLaunchScan({
             </p>
           )}
 
-          {isManualOnly ? (
+          {isBlocked ? (
+            <p className="text-text-error-primary text-sm">
+              You have reached your scan limit, so additional scans are not
+              available right now.
+            </p>
+          ) : isAdvanced ? (
+            <ScanScheduleFields
+              form={form}
+              disabled={isLaunching}
+              showLaunchInitialScan
+              showNextScheduledCopy
+            />
+          ) : isManualOnly ? (
             <div className="flex flex-col gap-3">
               <p className="text-text-neutral-secondary text-sm">
                 Scheduled scans are not available for trial accounts. These
                 accounts will run a one-time manual scan now.
               </p>
-              {isScanLimitReached && (
-                <p className="text-text-error-primary text-sm">
-                  You have reached your scan limit, so additional scans are not
-                  available right now.
-                </p>
-              )}
             </div>
-          ) : (
+          ) : isDailyLegacy ? (
             <div className="flex flex-col gap-4">
               <p className="text-text-neutral-secondary text-sm">
                 Select a Prowler scan schedule for these accounts.
@@ -215,7 +404,7 @@ export function OrgLaunchScan({
                 </SelectContent>
               </Select>
             </div>
-          )}
+          ) : null}
         </div>
       )}
     </div>
diff --git a/ui/components/providers/providers-accounts-table.test.tsx b/ui/components/providers/providers-accounts-table.test.tsx
new file mode 100644
index 0000000000..4fe66a6bd7
--- /dev/null
+++ b/ui/components/providers/providers-accounts-table.test.tsx
@@ -0,0 +1,306 @@
+import { render, screen } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { MetaDataProps } from "@/types";
+import {
+  PROVIDERS_GROUP_KIND,
+  PROVIDERS_ROW_TYPE,
+  type ProvidersTableRow,
+} from "@/types/providers-table";
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
+
+const { dataTableMockState, getColumnProvidersMock } = vi.hoisted(() => ({
+  dataTableMockState: {
+    nextSelection: {} as Record<string, boolean>,
+  },
+  getColumnProvidersMock: vi.fn((..._args: unknown[]) => []),
+}));
+
+vi.mock("@/components/ui/table", () => ({
+  DataTable: ({
+    onRowSelectionChange,
+  }: {
+    onRowSelectionChange?: (selection: Record<string, boolean>) => void;
+  }) => (
+    <div data-testid="providers-data-table">
+      <button
+        type="button"
+        onClick={() => onRowSelectionChange?.(dataTableMockState.nextSelection)}
+      >
+        Apply selection
+      </button>
+    </div>
+  ),
+}));
+
+vi.mock("./table", () => ({
+  getColumnProviders: (...args: unknown[]) => getColumnProvidersMock(...args),
+}));
+
+import {
+  computeSelectedScheduleProviders,
+  ProvidersAccountsTable,
+} from "./providers-accounts-table";
+
+const metadata: MetaDataProps = {
+  pagination: { page: 1, pages: 1, count: 0, itemsPerPage: [10] },
+  version: "latest",
+};
+
+const createProviderRow = (
+  id: string,
+  uid = id,
+  alias: string | null = id,
+): ProvidersTableRow =>
+  ({
+    id,
+    rowType: PROVIDERS_ROW_TYPE.PROVIDER,
+    type: "providers",
+    attributes: {
+      provider: "aws",
+      uid,
+      alias,
+      status: "completed",
+      resources: 0,
+      connection: {
+        connected: true,
+        last_checked_at: "2026-01-01T00:00:00Z",
+      },
+      scanner_args: {
+        only_logs: false,
+        excluded_checks: [],
+        aws_retries_max_attempts: 3,
+      },
+      inserted_at: "2026-01-01T00:00:00Z",
+      updated_at: "2026-01-01T00:00:00Z",
+      created_by: {
+        object: "user",
+        id: "user-1",
+      },
+    },
+    relationships: {
+      secret: { data: { id: `secret-${id}`, type: "secrets" } },
+      provider_groups: { meta: { count: 0 }, data: [] },
+    },
+    groupNames: [],
+    hasSchedule: false,
+  }) as ProvidersTableRow;
+
+const providerOne = createProviderRow("provider-1", "111111111111", "Prod");
+const providerTwo = createProviderRow("provider-2", "222222222222", "Stage");
+const providerThree = createProviderRow("provider-3", "333333333333", "Dev");
+
+const organizationRow: ProvidersTableRow = {
+  id: "org-1",
+  rowType: PROVIDERS_ROW_TYPE.ORGANIZATION,
+  groupKind: PROVIDERS_GROUP_KIND.ORGANIZATION,
+  name: "My AWS Organization",
+  externalId: "o-abc123def4",
+  parentExternalId: null,
+  organizationId: "org-1",
+  providerCount: 3,
+  providerIds: ["provider-1", "provider-2", "provider-hidden"],
+  subRows: [providerOne, providerTwo],
+};
+
+const organizationalUnitRow: ProvidersTableRow = {
+  id: "ou-1",
+  rowType: PROVIDERS_ROW_TYPE.ORGANIZATION,
+  groupKind: PROVIDERS_GROUP_KIND.ORGANIZATION_UNIT,
+  name: "Production OU",
+  externalId: "ou-abc123",
+  parentExternalId: "o-abc123def4",
+  organizationId: "org-1",
+  providerCount: 2,
+  providerIds: ["provider-2", "provider-hidden-ou"],
+  subRows: [providerTwo],
+};
+
+describe("ProvidersAccountsTable", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    dataTableMockState.nextSelection = {};
+  });
+
+  it("passes scan schedule capability to provider row action columns", () => {
+    // Given/When
+    render(
+      <ProvidersAccountsTable
+        isCloud
+        metadata={metadata}
+        rows={[]}
+        scanScheduleCapability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+      />,
+    );
+
+    // Then
+    expect(screen.getByTestId("providers-data-table")).toBeInTheDocument();
+    expect(getColumnProvidersMock).toHaveBeenCalledWith(
+      expect.any(Object),
+      [],
+      [],
+      [],
+      expect.any(Function),
+      expect.any(Function),
+      expect.any(Function),
+      SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY,
+    );
+  });
+
+  describe("schedule provider selection", () => {
+    it("uses the selected provider id for provider rows", () => {
+      // Given
+      const rows = [providerOne, providerTwo];
+
+      // When
+      const result = computeSelectedScheduleProviders(rows, { "0": true });
+
+      // Then
+      expect(result.providerIds).toEqual(["provider-1"]);
+      expect(result.providers.map((provider) => provider.providerId)).toEqual([
+        "provider-1",
+      ]);
+    });
+
+    it("uses every organization provider id when the organization is selected", () => {
+      // Given
+      const rows = [organizationRow];
+
+      // When
+      const result = computeSelectedScheduleProviders(rows, { "0": true });
+
+      // Then
+      expect(result.providerIds).toEqual([
+        "provider-1",
+        "provider-2",
+        "provider-hidden",
+      ]);
+      expect(result.providers.map((provider) => provider.providerId)).toEqual([
+        "provider-1",
+        "provider-2",
+      ]);
+    });
+
+    it("uses every organizational unit provider id when the OU is selected", () => {
+      // Given
+      const rows = [
+        {
+          ...organizationRow,
+          subRows: [organizationalUnitRow],
+        },
+      ];
+
+      // When
+      const result = computeSelectedScheduleProviders(rows, { "0.0": true });
+
+      // Then
+      expect(result.providerIds).toEqual(["provider-2", "provider-hidden-ou"]);
+    });
+
+    it("deduplicates provider ids when an organization and child provider are selected", () => {
+      // Given
+      const rows = [organizationRow];
+
+      // When
+      const result = computeSelectedScheduleProviders(rows, {
+        "0": true,
+        "0.0": true,
+      });
+
+      // Then
+      expect(result.providerIds).toEqual([
+        "provider-1",
+        "provider-2",
+        "provider-hidden",
+      ]);
+    });
+
+    it("uses only selected child providers when an organization is partially selected", () => {
+      // Given
+      const rows = [organizationRow, providerThree];
+
+      // When
+      const result = computeSelectedScheduleProviders(rows, {
+        "0.1": true,
+        "1": true,
+      });
+
+      // Then
+      expect(result.providerIds).toEqual(["provider-2", "provider-3"]);
+    });
+  });
+
+  it("passes selected provider ids to provider row action columns", async () => {
+    // Given
+    const user = userEvent.setup();
+    dataTableMockState.nextSelection = { "0": true };
+    render(
+      <ProvidersAccountsTable
+        isCloud
+        metadata={metadata}
+        rows={[providerOne]}
+        scanScheduleCapability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button", { name: "Apply selection" }));
+
+    // Then
+    expect(getColumnProvidersMock).toHaveBeenLastCalledWith(
+      expect.any(Object),
+      ["provider-1"],
+      ["provider-1"],
+      [
+        expect.objectContaining({
+          providerId: "provider-1",
+          providerType: "aws",
+          providerUid: "111111111111",
+          providerAlias: "Prod",
+        }),
+      ],
+      expect.any(Function),
+      expect.any(Function),
+      expect.any(Function),
+      SCAN_SCHEDULE_CAPABILITY.ADVANCED,
+    );
+  });
+
+  it("passes selected organization provider ids and visible providers to provider row action columns", async () => {
+    // Given
+    const user = userEvent.setup();
+    dataTableMockState.nextSelection = { "0": true };
+    render(
+      <ProvidersAccountsTable
+        isCloud
+        metadata={metadata}
+        rows={[organizationRow]}
+        scanScheduleCapability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+      />,
+    );
+
+    await user.click(screen.getByRole("button", { name: "Apply selection" }));
+
+    // Then
+    expect(getColumnProvidersMock).toHaveBeenLastCalledWith(
+      expect.any(Object),
+      [],
+      ["provider-1", "provider-2", "provider-hidden"],
+      [
+        expect.objectContaining({ providerId: "provider-1" }),
+        expect.objectContaining({ providerId: "provider-2" }),
+      ],
+      expect.any(Function),
+      expect.any(Function),
+      expect.any(Function),
+      SCAN_SCHEDULE_CAPABILITY.ADVANCED,
+    );
+  });
+});
diff --git a/ui/components/providers/providers-accounts-table.tsx b/ui/components/providers/providers-accounts-table.tsx
index 0c25b609d9..0f51e4dc66 100644
--- a/ui/components/providers/providers-accounts-table.tsx
+++ b/ui/components/providers/providers-accounts-table.tsx
@@ -1,7 +1,7 @@
 "use client";
 
 import { RowSelectionState } from "@tanstack/react-table";
-import { useEffect, useState } from "react";
+import { useState } from "react";
 
 import type {
   OrgWizardInitialData,
@@ -11,8 +11,13 @@ import { DataTable } from "@/components/ui/table";
 import { MetaDataProps } from "@/types";
 import {
   isProvidersOrganizationRow,
+  isProvidersProviderRow,
   ProvidersTableRow,
 } from "@/types/providers-table";
+import type {
+  ScanScheduleCapability,
+  ScanScheduleProvider,
+} from "@/types/schedules";
 
 import { getColumnProviders } from "./table";
 
@@ -20,6 +25,7 @@ interface ProvidersAccountsTableProps {
   isCloud: boolean;
   metadata?: MetaDataProps;
   rows: ProvidersTableRow[];
+  scanScheduleCapability?: ScanScheduleCapability;
   onOpenProviderWizard: (initialData?: ProviderWizardInitialData) => void;
   onOpenOrganizationWizard: (initialData: OrgWizardInitialData) => void;
 }
@@ -50,31 +56,132 @@ function computeTestableProviderIds(
   return ids;
 }
 
-export function ProvidersAccountsTable({
+function toScanScheduleProvider(
+  row: ProvidersTableRow,
+): ScanScheduleProvider | null {
+  if (!isProvidersProviderRow(row)) return null;
+
+  return {
+    providerId: row.id,
+    providerType: row.attributes.provider,
+    providerUid: row.attributes.uid,
+    providerAlias: row.attributes.alias,
+  };
+}
+
+function appendUnique(target: string[], seen: Set<string>, ids: string[]) {
+  for (const id of ids) {
+    if (seen.has(id)) continue;
+    seen.add(id);
+    target.push(id);
+  }
+}
+
+function appendUniqueProvider(
+  target: ScanScheduleProvider[],
+  seen: Set<string>,
+  provider: ScanScheduleProvider | null,
+) {
+  if (!provider || seen.has(provider.providerId)) return;
+  seen.add(provider.providerId);
+  target.push(provider);
+}
+
+function collectVisibleScheduleProviders(rows: ProvidersTableRow[]) {
+  const providers: ScanScheduleProvider[] = [];
+  const seen = new Set<string>();
+
+  function walk(items: ProvidersTableRow[]) {
+    for (const item of items) {
+      appendUniqueProvider(providers, seen, toScanScheduleProvider(item));
+      if (isProvidersOrganizationRow(item)) {
+        walk(item.subRows);
+      }
+    }
+  }
+
+  walk(rows);
+  return providers;
+}
+
+export interface SelectedScheduleProvidersResult {
+  providerIds: string[];
+  providers: ScanScheduleProvider[];
+}
+
+export function computeSelectedScheduleProviders(
+  rows: ProvidersTableRow[],
+  rowSelection: RowSelectionState,
+): SelectedScheduleProvidersResult {
+  const providerIds: string[] = [];
+  const providers: ScanScheduleProvider[] = [];
+  const seenProviderIds = new Set<string>();
+  const seenVisibleProviders = new Set<string>();
+
+  function walk(items: ProvidersTableRow[], prefix: string) {
+    items.forEach((item, idx) => {
+      const key = prefix ? `${prefix}.${idx}` : `${idx}`;
+      const isSelected = rowSelection[key] === true;
+
+      if (isProvidersOrganizationRow(item)) {
+        if (isSelected) {
+          appendUnique(providerIds, seenProviderIds, item.providerIds);
+          for (const provider of collectVisibleScheduleProviders(
+            item.subRows,
+          )) {
+            appendUniqueProvider(providers, seenVisibleProviders, provider);
+          }
+          return;
+        }
+
+        walk(item.subRows, key);
+        return;
+      }
+
+      if (isSelected) {
+        appendUnique(providerIds, seenProviderIds, [item.id]);
+        appendUniqueProvider(
+          providers,
+          seenVisibleProviders,
+          toScanScheduleProvider(item),
+        );
+      }
+    });
+  }
+
+  walk(rows, "");
+
+  return { providerIds, providers };
+}
+
+function ProvidersAccountsTableContent({
   isCloud,
   metadata,
   rows,
+  scanScheduleCapability,
   onOpenProviderWizard,
   onOpenOrganizationWizard,
 }: ProvidersAccountsTableProps) {
   const [rowSelection, setRowSelection] = useState<RowSelectionState>({});
 
-  // Reset selection when page changes
-  const currentPage = metadata?.pagination?.page;
-  useEffect(() => {
-    setRowSelection({});
-  }, [currentPage]);
-
   const testableProviderIds = computeTestableProviderIds(rows, rowSelection);
+  const selectedScheduleProviders = computeSelectedScheduleProviders(
+    rows,
+    rowSelection,
+  );
+  const selectedScheduleProviderIds = selectedScheduleProviders.providerIds;
 
   const clearSelection = () => setRowSelection({});
 
   const columns = getColumnProviders(
     rowSelection,
     testableProviderIds,
+    selectedScheduleProviderIds,
+    selectedScheduleProviders.providers,
     clearSelection,
     onOpenProviderWizard,
     onOpenOrganizationWizard,
+    scanScheduleCapability,
   );
 
   return (
@@ -92,3 +199,9 @@ export function ProvidersAccountsTable({
     />
   );
 }
+
+export function ProvidersAccountsTable(props: ProvidersAccountsTableProps) {
+  const currentPage = props.metadata?.pagination?.page ?? "none";
+
+  return <ProvidersAccountsTableContent key={currentPage} {...props} />;
+}
diff --git a/ui/components/providers/providers-accounts-view.test.tsx b/ui/components/providers/providers-accounts-view.test.tsx
index c8b3baf596..f888f7f4d8 100644
--- a/ui/components/providers/providers-accounts-view.test.tsx
+++ b/ui/components/providers/providers-accounts-view.test.tsx
@@ -5,8 +5,15 @@ import { afterEach, describe, expect, it, vi } from "vitest";
 
 import type { FilterOption, MetaDataProps, ProviderProps } from "@/types";
 import type { ProvidersTableRow } from "@/types/providers-table";
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
 
-const { refreshMock, replaceMock, searchParamsValue } = vi.hoisted(() => ({
+const {
+  providersAccountsTableSpy,
+  refreshMock,
+  replaceMock,
+  searchParamsValue,
+} = vi.hoisted(() => ({
+  providersAccountsTableSpy: vi.fn(),
   refreshMock: vi.fn(),
   replaceMock: vi.fn(),
   searchParamsValue: { current: "" },
@@ -49,7 +56,10 @@ vi.mock("@/components/providers/providers-filters", () => ({
 }));
 
 vi.mock("@/components/providers/providers-accounts-table", () => ({
-  ProvidersAccountsTable: () => <div data-testid="providers-table">Table</div>,
+  ProvidersAccountsTable: (props: { scanScheduleCapability?: string }) => {
+    providersAccountsTableSpy(props);
+    return <div data-testid="providers-table">Table</div>;
+  },
 }));
 
 vi.mock("@/components/providers/wizard", () => ({
@@ -123,6 +133,7 @@ const disconnectedProviders: ProviderProps[] = [
 describe("ProvidersAccountsView", () => {
   afterEach(() => {
     vi.restoreAllMocks();
+    providersAccountsTableSpy.mockClear();
     searchParamsValue.current = "";
     window.history.replaceState({}, "", "/");
   });
@@ -285,6 +296,27 @@ describe("ProvidersAccountsView", () => {
     ).not.toBeInTheDocument();
   });
 
+  it("passes scan schedule capability to provider row actions", () => {
+    // Given/When
+    render(
+      <ProvidersAccountsView
+        isCloud
+        filters={filters}
+        metadata={metadata}
+        providers={disconnectedProviders}
+        rows={rows}
+        scanScheduleCapability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+      />,
+    );
+
+    // Then
+    expect(providersAccountsTableSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        scanScheduleCapability: SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY,
+      }),
+    );
+  });
+
   it("opens the provider wizard from the normal Add Provider button", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/components/providers/providers-accounts-view.tsx b/ui/components/providers/providers-accounts-view.tsx
index d1ff22a958..8a5d8f93fc 100644
--- a/ui/components/providers/providers-accounts-view.tsx
+++ b/ui/components/providers/providers-accounts-view.tsx
@@ -152,6 +152,7 @@ export function ProvidersAccountsView({
             isCloud={isCloud}
             metadata={metadata}
             rows={rows}
+            scanScheduleCapability={scanScheduleCapability}
             onOpenProviderWizard={openProviderWizard}
             onOpenOrganizationWizard={openOrganizationWizard}
           />
diff --git a/ui/components/providers/table/column-providers.tsx b/ui/components/providers/table/column-providers.tsx
index 7a0daf9b40..c88c61b78e 100644
--- a/ui/components/providers/table/column-providers.tsx
+++ b/ui/components/providers/table/column-providers.tsx
@@ -20,6 +20,10 @@ import {
   ProvidersProviderRow,
   ProvidersTableRow,
 } from "@/types/providers-table";
+import type {
+  ScanScheduleCapability,
+  ScanScheduleProvider,
+} from "@/types/schedules";
 
 import { LinkToScans } from "../link-to-scans";
 import { DataTableRowActions } from "./data-table-row-actions";
@@ -103,9 +107,12 @@ function countSelectedLeaves(rows: Row<ProvidersTableRow>[]): number {
 export function getColumnProviders(
   rowSelection: RowSelectionState,
   testableProviderIds: string[],
+  selectedScheduleProviderIds: string[],
+  selectedScheduleProviders: ScanScheduleProvider[],
   onClearSelection: () => void,
   onOpenProviderWizard: (initialData?: ProviderWizardInitialData) => void,
   onOpenOrganizationWizard: (initialData: OrgWizardInitialData) => void,
+  scanScheduleCapability?: ScanScheduleCapability,
 ): ColumnDef<ProvidersTableRow>[] {
   return [
     {
@@ -317,9 +324,12 @@ export function getColumnProviders(
             hasSelection={hasSelection}
             isRowSelected={row.getIsSelected()}
             testableProviderIds={testableProviderIds}
+            selectedScheduleProviderIds={selectedScheduleProviderIds}
+            selectedScheduleProviders={selectedScheduleProviders}
             onClearSelection={onClearSelection}
             onOpenProviderWizard={onOpenProviderWizard}
             onOpenOrganizationWizard={onOpenOrganizationWizard}
+            capability={scanScheduleCapability}
           />
         );
       },
diff --git a/ui/components/providers/table/data-table-row-actions.test.tsx b/ui/components/providers/table/data-table-row-actions.test.tsx
index dc0aeadf47..0fd6823851 100644
--- a/ui/components/providers/table/data-table-row-actions.test.tsx
+++ b/ui/components/providers/table/data-table-row-actions.test.tsx
@@ -9,6 +9,7 @@ import {
   PROVIDERS_ROW_TYPE,
   ProvidersTableRow,
 } from "@/types/providers-table";
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
 
 const { checkConnectionProviderMock, getScheduleMock, pushMock } = vi.hoisted(
   () => ({
@@ -55,13 +56,16 @@ vi.mock("@/components/scans/schedule/edit-scan-schedule-modal", () => ({
   EditScanScheduleModal: ({
     open,
     provider,
+    providers,
   }: {
     open: boolean;
     provider?: { providerId: string };
+    providers?: { providerId: string }[];
   }) =>
     open ? (
       <div role="dialog" aria-label="Edit Scan Schedule">
-        Editing schedule for {provider?.providerId}
+        Editing schedule for{" "}
+        {providers ? `${providers.length} providers` : provider?.providerId}
       </div>
     ) : null,
 }));
@@ -130,6 +134,7 @@ const createOrgRow = () =>
       parentExternalId: null,
       organizationId: "org-1",
       providerCount: 3,
+      providerIds: ["provider-child-1", "provider-child-2"],
       subRows: [
         {
           id: "provider-child-1",
@@ -162,6 +167,7 @@ const createOuRow = () =>
       parentExternalId: "o-abc123def4",
       organizationId: "org-1",
       providerCount: 2,
+      providerIds: ["provider-ou-child-1"],
       subRows: [
         {
           id: "provider-ou-child-1",
@@ -305,6 +311,56 @@ describe("DataTableRowActions", () => {
     ).toHaveTextContent("Editing schedule for provider-1");
   });
 
+  it("hides Edit Scan Schedule for manual-only Cloud provider rows", async () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    const user = userEvent.setup();
+
+    render(
+      <DataTableRowActions
+        row={createRow(true)}
+        hasSelection={false}
+        isRowSelected={false}
+        testableProviderIds={[]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+        capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button"));
+
+    // Then
+    expect(screen.queryByText("Edit Scan Schedule")).not.toBeInTheDocument();
+  });
+
+  it("hides Edit Scan Schedule for blocked Cloud provider rows", async () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    const user = userEvent.setup();
+
+    render(
+      <DataTableRowActions
+        row={createRow(true)}
+        hasSelection={false}
+        isRowSelected={false}
+        testableProviderIds={[]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+        capability={SCAN_SCHEDULE_CAPABILITY.BLOCKED}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button"));
+
+    // Then
+    expect(screen.queryByText("Edit Scan Schedule")).not.toBeInTheDocument();
+  });
+
   it("renders Update Credentials for provider rows with credentials", async () => {
     // Given
     const user = userEvent.setup();
@@ -351,6 +407,29 @@ describe("DataTableRowActions", () => {
     expect(screen.getByText("Delete Organization")).toBeInTheDocument();
   });
 
+  it("opens Edit Scan Schedule for AWS organization rows", async () => {
+    const user = userEvent.setup();
+    render(
+      <DataTableRowActions
+        row={createOrgRow()}
+        hasSelection={false}
+        isRowSelected={false}
+        testableProviderIds={[]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+        capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+      />,
+    );
+
+    await user.click(screen.getByRole("button"));
+    await user.click(screen.getByText("Edit Scan Schedule"));
+
+    expect(
+      screen.getByRole("dialog", { name: /edit scan schedule/i }),
+    ).toHaveTextContent("Editing schedule for 2 providers");
+  });
+
   it("renders Delete Organization with destructive styling for org rows", async () => {
     const user = userEvent.setup();
     render(
@@ -436,6 +515,49 @@ describe("DataTableRowActions", () => {
     expect(screen.queryByText("Test Connections (1)")).not.toBeInTheDocument();
   });
 
+  it("shows bulk Edit Scan Schedule next to Test Connection for selected rows", async () => {
+    // Given
+    const user = userEvent.setup();
+    render(
+      <DataTableRowActions
+        row={createOrgRow()}
+        hasSelection={true}
+        isRowSelected={true}
+        testableProviderIds={["provider-child-1", "provider-standalone"]}
+        selectedScheduleProviderIds={[
+          "provider-child-1",
+          "provider-child-2",
+          "provider-standalone",
+        ]}
+        selectedScheduleProviders={[
+          {
+            providerId: "provider-child-1",
+            providerType: "aws",
+            providerUid: "111",
+            providerAlias: null,
+          },
+          {
+            providerId: "provider-standalone",
+            providerType: "aws",
+            providerUid: "999",
+            providerAlias: "Standalone",
+          },
+        ]}
+        onClearSelection={vi.fn()}
+        onOpenProviderWizard={vi.fn()}
+        onOpenOrganizationWizard={vi.fn()}
+        capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+      />,
+    );
+
+    // When
+    await user.click(screen.getByRole("button"));
+
+    // Then
+    expect(screen.getByText("Edit Scan Schedule (3)")).toBeInTheDocument();
+    expect(screen.getByText("Test Connection (2)")).toBeInTheDocument();
+  });
+
   it("does NOT render Edit Organization Name or Update Credentials for OU rows", async () => {
     const user = userEvent.setup();
     render(
diff --git a/ui/components/providers/table/data-table-row-actions.tsx b/ui/components/providers/table/data-table-row-actions.tsx
index 44d7198e2e..a2c63e0cb7 100644
--- a/ui/components/providers/table/data-table-row-actions.tsx
+++ b/ui/components/providers/table/data-table-row-actions.tsx
@@ -24,7 +24,6 @@ import {
   EDIT_SCAN_SCHEDULE_STATE,
   EditScanScheduleModal,
   type EditScanScheduleState,
-  type ScanScheduleProvider,
 } from "@/components/scans/schedule/edit-scan-schedule-modal";
 import {
   ActionDropdown,
@@ -49,6 +48,7 @@ import {
 import {
   SCAN_SCHEDULE_CAPABILITY,
   type ScanScheduleCapability,
+  type ScanScheduleProvider,
   type ScheduleApiResponse,
 } from "@/types/schedules";
 
@@ -64,6 +64,10 @@ interface DataTableRowActionsProps {
   isRowSelected: boolean;
   /** IDs of all selected providers that have credentials (testable) */
   testableProviderIds: string[];
+  /** IDs of all selected providers that can receive schedule updates. */
+  selectedScheduleProviderIds?: string[];
+  /** Visible selected providers used as modal reference rows. */
+  selectedScheduleProviders?: ScanScheduleProvider[];
   /** Callback to clear the row selection after bulk operation */
   onClearSelection: () => void;
   onOpenProviderWizard: (initialData?: ProviderWizardInitialData) => void;
@@ -91,28 +95,56 @@ function collectTestableChildProviderIds(rows: ProvidersTableRow[]): string[] {
   return ids;
 }
 
+function collectChildScheduleProviders(
+  rows: ProvidersTableRow[],
+): ScanScheduleProvider[] {
+  const providers: ScanScheduleProvider[] = [];
+
+  for (const row of rows) {
+    if (row.rowType === PROVIDERS_ROW_TYPE.PROVIDER) {
+      providers.push({
+        providerId: row.id,
+        providerType: row.attributes.provider,
+        providerUid: row.attributes.uid,
+        providerAlias: row.attributes.alias,
+      });
+      continue;
+    }
+
+    providers.push(...collectChildScheduleProviders(row.subRows));
+  }
+
+  return providers;
+}
+
 interface OrgGroupDropdownActionsProps {
   rowData: ProvidersOrganizationRow;
   loading: boolean;
+  canEditSchedule: boolean;
   hasSelection: boolean;
   testableProviderIds: string[];
   childTestableIds: string[];
+  scheduleProviderCount: number;
   onClearSelection: () => void;
   onBulkTest: (ids: string[]) => Promise<void>;
   onTestChildConnections: () => Promise<void>;
   onOpenOrganizationWizard: (initialData: OrgWizardInitialData) => void;
+  onOpenScheduleEditor: () => void;
 }
 
 function OrgGroupDropdownActions({
   rowData,
   loading,
+  canEditSchedule,
   hasSelection,
   testableProviderIds,
   childTestableIds,
+  scheduleProviderCount,
   onClearSelection,
   onBulkTest,
   onTestChildConnections,
   onOpenOrganizationWizard,
+  onOpenScheduleEditor,
 }: OrgGroupDropdownActionsProps) {
   const [isDeleteOrgOpen, setIsDeleteOrgOpen] = useState(false);
   const [isEditNameOpen, setIsEditNameOpen] = useState(false);
@@ -191,6 +223,14 @@ function OrgGroupDropdownActions({
               />
             </>
           )}
+          {isOrgKind && canEditSchedule && (
+            <ActionDropdownItem
+              icon={<CalendarClock />}
+              label="Edit Scan Schedule"
+              onSelect={() => onOpenScheduleEditor()}
+              disabled={scheduleProviderCount === 0}
+            />
+          )}
           <ActionDropdownItem
             icon={<Rocket />}
             label={loading ? "Testing..." : `Test Connections (${testCount})`}
@@ -226,6 +266,8 @@ export function DataTableRowActions({
   hasSelection,
   isRowSelected,
   testableProviderIds,
+  selectedScheduleProviderIds = [],
+  selectedScheduleProviders = [],
   onClearSelection,
   onOpenProviderWizard,
   onOpenOrganizationWizard,
@@ -266,6 +308,10 @@ export function DataTableRowActions({
   const childTestableIds = isOrganizationRow
     ? collectTestableChildProviderIds(rowData.subRows)
     : [];
+  const childScheduleProviders = isOrganizationRow
+    ? collectChildScheduleProviders(rowData.subRows)
+    : [];
+  const childScheduleProviderIds = isOrganizationRow ? rowData.providerIds : [];
 
   const handleBulkTest = async (ids: string[]) => {
     if (ids.length === 0) return;
@@ -329,8 +375,17 @@ export function DataTableRowActions({
     await handleBulkTest(childTestableIds);
   };
 
-  const openScheduleEditor = async () => {
-    if (!providerId) {
+  const openScheduleEditor = async (
+    targetProviders: ScanScheduleProvider[] = scheduleProvider
+      ? [scheduleProvider]
+      : [],
+    targetProviderIds: string[] = targetProviders.map(
+      (target) => target.providerId,
+    ),
+  ) => {
+    const targetProviderId = targetProviderIds[0];
+
+    if (!targetProviderId) {
       setScheduleState({
         kind: EDIT_SCAN_SCHEDULE_STATE.ERROR,
         message: "Provider ID is not available.",
@@ -342,7 +397,7 @@ export function DataTableRowActions({
     setScheduleState({ kind: EDIT_SCAN_SCHEDULE_STATE.LOADING });
     setIsScheduleOpen(true);
 
-    const response = (await getSchedule(providerId)) as
+    const response = (await getSchedule(targetProviderId)) as
       | ScheduleApiResponse
       | { error?: string };
 
@@ -367,38 +422,81 @@ export function DataTableRowActions({
   if (hasSelection && isRowSelected) {
     const bulkCount =
       testableProviderIds.length > 1 ? ` (${testableProviderIds.length})` : "";
+    const selectedScheduleProviderCount = selectedScheduleProviderIds.length;
 
     return (
-      <div className="relative flex items-center justify-end gap-2">
-        <ActionDropdown>
-          <ActionDropdownItem
-            icon={<Rocket />}
-            label={loading ? "Testing..." : `Test Connection${bulkCount}`}
-            onSelect={(e) => {
-              e.preventDefault();
-              handleTestConnection();
-            }}
-            disabled={testableProviderIds.length === 0 || loading}
-          />
-        </ActionDropdown>
-      </div>
+      <>
+        <EditScanScheduleModal
+          open={isScheduleOpen}
+          onOpenChange={setIsScheduleOpen}
+          providers={selectedScheduleProviders}
+          providerIds={selectedScheduleProviderIds}
+          targetName="Selected providers"
+          state={scheduleState}
+          onSaved={onClearSelection}
+        />
+        <div className="relative flex items-center justify-end gap-2">
+          <ActionDropdown>
+            {canEditSchedule && selectedScheduleProviderCount > 0 && (
+              <ActionDropdownItem
+                icon={<CalendarClock />}
+                label={`Edit Scan Schedule (${selectedScheduleProviderCount})`}
+                onSelect={() =>
+                  void openScheduleEditor(
+                    selectedScheduleProviders,
+                    selectedScheduleProviderIds,
+                  )
+                }
+              />
+            )}
+            <ActionDropdownItem
+              icon={<Rocket />}
+              label={loading ? "Testing..." : `Test Connection${bulkCount}`}
+              onSelect={(e) => {
+                e.preventDefault();
+                handleTestConnection();
+              }}
+              disabled={testableProviderIds.length === 0 || loading}
+            />
+          </ActionDropdown>
+        </div>
+      </>
     );
   }
 
   // Organization / Organization Unit row actions
   if (isProvidersOrganizationRow(rowData) && orgGroupKind) {
     return (
-      <OrgGroupDropdownActions
-        rowData={rowData}
-        loading={loading}
-        hasSelection={hasSelection}
-        testableProviderIds={testableProviderIds}
-        childTestableIds={childTestableIds}
-        onClearSelection={onClearSelection}
-        onBulkTest={handleBulkTest}
-        onTestChildConnections={handleTestChildConnections}
-        onOpenOrganizationWizard={onOpenOrganizationWizard}
-      />
+      <>
+        <EditScanScheduleModal
+          open={isScheduleOpen}
+          onOpenChange={setIsScheduleOpen}
+          providers={childScheduleProviders}
+          providerIds={childScheduleProviderIds}
+          targetName={rowData.name}
+          targetId={rowData.externalId ?? undefined}
+          state={scheduleState}
+        />
+        <OrgGroupDropdownActions
+          rowData={rowData}
+          loading={loading}
+          canEditSchedule={canEditSchedule}
+          hasSelection={hasSelection}
+          testableProviderIds={testableProviderIds}
+          childTestableIds={childTestableIds}
+          scheduleProviderCount={childScheduleProviderIds.length}
+          onClearSelection={onClearSelection}
+          onBulkTest={handleBulkTest}
+          onTestChildConnections={handleTestChildConnections}
+          onOpenOrganizationWizard={onOpenOrganizationWizard}
+          onOpenScheduleEditor={() =>
+            void openScheduleEditor(
+              childScheduleProviders,
+              childScheduleProviderIds,
+            )
+          }
+        />
+      </>
     );
   }
 
diff --git a/ui/components/providers/wizard/provider-wizard-modal.tsx b/ui/components/providers/wizard/provider-wizard-modal.tsx
index 8904b35e43..ec6f60fe64 100644
--- a/ui/components/providers/wizard/provider-wizard-modal.tsx
+++ b/ui/components/providers/wizard/provider-wizard-modal.tsx
@@ -8,6 +8,7 @@ import { OrgSetupForm } from "@/components/providers/organizations/org-setup-for
 import { Button } from "@/components/shadcn/button/button";
 import { DialogHeader, DialogTitle } from "@/components/shadcn/dialog";
 import { Modal } from "@/components/shadcn/modal";
+import { useScanScheduleCapability } from "@/hooks/use-scan-schedule-capability";
 import { useScrollHint } from "@/hooks/use-scroll-hint";
 import { advanceActiveTour, endActiveTour } from "@/lib/tours/use-driver-tour";
 import { ORG_SETUP_PHASE, ORG_WIZARD_STEP } from "@/types/organizations";
@@ -89,6 +90,10 @@ export function ProviderWizardModal({
     enabled: open,
     refreshToken: scrollHintRefreshToken,
   });
+  const {
+    capability: resolvedScanScheduleCapability,
+    isScheduleCapabilityLoading,
+  } = useScanScheduleCapability(scanScheduleCapability);
   const docsDestination = getProviderWizardDocsDestination(docsLink);
 
   return (
@@ -200,8 +205,9 @@ export function ProviderWizardModal({
                       onBack={() => setCurrentStep(PROVIDER_WIZARD_STEP.TEST)}
                       onClose={handleClose}
                       onFooterChange={setFooterConfig}
-                      capability={scanScheduleCapability}
+                      capability={resolvedScanScheduleCapability}
                       isScanLimitReached={isScanLimitReached}
+                      isScheduleCapabilityLoading={isScheduleCapabilityLoading}
                     />
                   )}
 
@@ -255,8 +261,9 @@ export function ProviderWizardModal({
                         setOrgCurrentStep(ORG_WIZARD_STEP.VALIDATE);
                       }}
                       onFooterChange={setFooterConfig}
-                      capability={scanScheduleCapability}
+                      capability={resolvedScanScheduleCapability}
                       isScanLimitReached={isScanLimitReached}
+                      isScheduleCapabilityLoading={isScheduleCapabilityLoading}
                     />
                   )}
 
diff --git a/ui/components/providers/wizard/steps/launch-step.test.tsx b/ui/components/providers/wizard/steps/launch-step.test.tsx
index cfa8e2e63d..22802e6424 100644
--- a/ui/components/providers/wizard/steps/launch-step.test.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.test.tsx
@@ -295,6 +295,36 @@ describe("LaunchStep", () => {
         expect.objectContaining({ title: "Unable to save scan schedule" }),
       );
     });
+
+    it("disables launch actions while schedule capability is loading", async () => {
+      // Given
+      const onFooterChange = vi.fn();
+      seedConnectedProvider();
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={vi.fn()}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.ADVANCED}
+          isScheduleCapabilityLoading
+        />,
+      );
+
+      // When
+      await screen.findByText("Loading scan options...");
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      expect(lastFooterConfig(onFooterChange)?.backDisabled).toBe(true);
+      expect(lastFooterConfig(onFooterChange)?.actionDisabled).toBe(true);
+      expect(scanOnDemandMock).not.toHaveBeenCalled();
+      expect(updateScheduleMock).not.toHaveBeenCalled();
+      expect(scheduleDailyMock).not.toHaveBeenCalled();
+    });
   });
 
   describe("Prowler Cloud trial/onboarding (manual scan only)", () => {
diff --git a/ui/components/providers/wizard/steps/launch-step.tsx b/ui/components/providers/wizard/steps/launch-step.tsx
index db42d5be0e..7e2f0348dd 100644
--- a/ui/components/providers/wizard/steps/launch-step.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.tsx
@@ -67,6 +67,11 @@ interface LaunchStepProps {
    * Cloud-only signal; never set in OSS.
    */
   isScanLimitReached?: boolean;
+  /**
+   * Cloud-only loading state while billing is resolved into a schedule
+   * capability. OSS leaves it false.
+   */
+  isScheduleCapabilityLoading?: boolean;
 }
 
 export function LaunchStep({
@@ -75,6 +80,7 @@ export function LaunchStep({
   onFooterChange,
   capability: capabilityProp,
   isScanLimitReached = false,
+  isScheduleCapabilityLoading = false,
 }: LaunchStepProps) {
   const { toast } = useToast();
   const { providerAlias, providerId, providerType, providerUid } =
@@ -82,6 +88,7 @@ export function LaunchStep({
   const capability = capabilityProp ?? getScanScheduleCapability(isCloud());
   const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
   const isAdvanced = capability === SCAN_SCHEDULE_CAPABILITY.ADVANCED;
+  const isBlocked = capability === SCAN_SCHEDULE_CAPABILITY.BLOCKED;
   const [isLaunching, setIsLaunching] = useState(false);
   const [mode, setMode] = useState<LaunchMode>(
     isAdvanced ? LAUNCH_MODE.SCHEDULE : LAUNCH_MODE.NOW,
@@ -93,7 +100,12 @@ export function LaunchStep({
 
   const isScheduleMode = isAdvanced && mode === LAUNCH_MODE.SCHEDULE;
   const isLimitBlocked = mode === LAUNCH_MODE.NOW && isScanLimitReached;
-  const isActionBlocked = isLaunching || !providerId || isLimitBlocked;
+  const isActionBlocked =
+    isLaunching ||
+    isScheduleCapabilityLoading ||
+    !providerId ||
+    isBlocked ||
+    isLimitBlocked;
   const launchInitialScan = useWatch({
     control: form.control,
     name: "launchInitialScan",
@@ -111,15 +123,21 @@ export function LaunchStep({
     return launchInitialScan ? "Save and launch scan" : "Save";
   })();
 
+  useEffect(() => {
+    if (!isAdvanced && mode !== LAUNCH_MODE.NOW) {
+      setMode(LAUNCH_MODE.NOW);
+    }
+  }, [isAdvanced, mode]);
+
   const launchOnDemandScan = async (): Promise<{ error?: unknown } | null> => {
-    if (!providerId) return null;
+    if (!providerId || isBlocked) return null;
     const formData = new FormData();
     formData.set("providerId", providerId);
     return scanOnDemand(formData);
   };
 
   const handleManualScan = async () => {
-    if (isScanLimitReached) {
+    if (isActionBlocked) {
       return;
     }
 
@@ -150,7 +168,7 @@ export function LaunchStep({
   };
 
   const handleSaveSchedule = form.handleSubmit(async (values) => {
-    if (!providerId) {
+    if (!providerId || isBlocked || isScheduleCapabilityLoading) {
       return;
     }
 
@@ -207,6 +225,10 @@ export function LaunchStep({
   // always invokes the current closure without re-running on every render.
   const actionRef = useRef<() => void>(() => {});
   actionRef.current = () => {
+    if (isBlocked || isScheduleCapabilityLoading) {
+      return;
+    }
+
     if (!isScheduleMode) {
       void handleManualScan();
       return;
@@ -218,7 +240,7 @@ export function LaunchStep({
     onFooterChange({
       showBack: true,
       backLabel: "Back",
-      backDisabled: isLaunching,
+      backDisabled: isLaunching || isScheduleCapabilityLoading,
       onBack,
       showAction: true,
       actionLabel,
@@ -229,6 +251,7 @@ export function LaunchStep({
   }, [
     isActionBlocked,
     isLaunching,
+    isScheduleCapabilityLoading,
     actionLabel,
     isScheduleMode,
     launchInitialScan,
@@ -237,13 +260,17 @@ export function LaunchStep({
     onFooterChange,
   ]);
 
-  if (isLaunching) {
+  if (isLaunching || isScheduleCapabilityLoading) {
     return (
       <div className="flex min-h-[320px] items-center justify-center">
         <div className="flex items-center gap-3 py-2">
           <Spinner className="size-6" />
           <p className="text-sm font-medium">
-            {!isScheduleMode ? "Launching scan..." : "Saving scan schedule..."}
+            {isScheduleCapabilityLoading
+              ? "Loading scan options..."
+              : !isScheduleMode
+                ? "Launching scan..."
+                : "Saving scan schedule..."}
           </p>
         </div>
       </div>
@@ -284,7 +311,11 @@ export function LaunchStep({
           aria-label="Scan mode"
         >
           <label className="flex items-center gap-2 text-sm">
-            <RadioGroupItem value={LAUNCH_MODE.NOW} aria-label="Run now" />
+            <RadioGroupItem
+              value={LAUNCH_MODE.NOW}
+              aria-label="Run now"
+              disabled={isBlocked}
+            />
             Run now
           </label>
           <label className="flex items-center gap-2 text-sm">
@@ -295,6 +326,7 @@ export function LaunchStep({
             />
             On a schedule
             {!isAdvanced &&
+              !isBlocked &&
               (isManualOnly ? (
                 <CloudFeatureBadge label="Requires subscription" size="sm" />
               ) : (
@@ -304,14 +336,14 @@ export function LaunchStep({
         </RadioGroup>
       </Field>
 
-      {!isAdvanced && (
+      {!isAdvanced && !isBlocked && (
         <p className="text-text-neutral-secondary text-sm">
           Scheduled scans are not available for this account. Run now to get
           immediate findings.
         </p>
       )}
 
-      {isLimitBlocked && (
+      {(isLimitBlocked || isBlocked) && (
         <p className="text-text-error-primary text-sm">
           You have reached your scan limit, so additional scans are not
           available right now.
diff --git a/ui/components/scans/launch-scan-modal.test.tsx b/ui/components/scans/launch-scan-modal.test.tsx
index 97e18dbcae..bfcfb62c07 100644
--- a/ui/components/scans/launch-scan-modal.test.tsx
+++ b/ui/components/scans/launch-scan-modal.test.tsx
@@ -432,6 +432,28 @@ describe("LaunchScanModal", () => {
       expect(getScheduleMock).not.toHaveBeenCalled();
     });
 
+    it("hides schedule mode but allows manual scans in MANUAL_ONLY", async () => {
+      const user = userEvent.setup();
+
+      render(
+        <LaunchScanModal
+          open
+          onOpenChange={vi.fn()}
+          providers={[provider]}
+          capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+        />,
+      );
+
+      expect(screen.queryByRole("radio")).not.toBeInTheDocument();
+
+      await user.selectOptions(screen.getByLabelText("Providers"), provider.id);
+      await user.click(screen.getByRole("button", { name: /launch scan/i }));
+
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      expect(getScheduleMock).not.toHaveBeenCalled();
+      expect(updateScheduleMock).not.toHaveBeenCalled();
+    });
+
     it("hides the mode selector and blocks over-limit accounts in MANUAL_ONLY", () => {
       render(
         <LaunchScanModal
@@ -449,5 +471,31 @@ describe("LaunchScanModal", () => {
         screen.getByRole("button", { name: /launch scan/i }),
       ).toBeDisabled();
     });
+
+    it("blocks scans and schedules in BLOCKED", async () => {
+      const user = userEvent.setup();
+
+      render(
+        <LaunchScanModal
+          open
+          onOpenChange={vi.fn()}
+          providers={[provider]}
+          capability={SCAN_SCHEDULE_CAPABILITY.BLOCKED}
+        />,
+      );
+
+      expect(screen.queryByRole("radio")).not.toBeInTheDocument();
+      expect(screen.getByText(/reached your scan limit/i)).toBeInTheDocument();
+
+      await user.selectOptions(screen.getByLabelText("Providers"), provider.id);
+      await user.click(screen.getByRole("button", { name: /launch scan/i }));
+
+      expect(
+        screen.getByRole("button", { name: /launch scan/i }),
+      ).toBeDisabled();
+      expect(scanOnDemandMock).not.toHaveBeenCalled();
+      expect(getScheduleMock).not.toHaveBeenCalled();
+      expect(updateScheduleMock).not.toHaveBeenCalled();
+    });
   });
 });
diff --git a/ui/components/scans/launch-scan-modal.tsx b/ui/components/scans/launch-scan-modal.tsx
index 387f2a1f9e..62721b9e7a 100644
--- a/ui/components/scans/launch-scan-modal.tsx
+++ b/ui/components/scans/launch-scan-modal.tsx
@@ -109,7 +109,10 @@ function LaunchScanForm({
 
   const isAdvanced = capability === SCAN_SCHEDULE_CAPABILITY.ADVANCED;
   const isManualOnly = capability === SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY;
-  const isScheduleMode = mode === LAUNCH_MODE.SCHEDULE;
+  const isBlocked =
+    capability === SCAN_SCHEDULE_CAPABILITY.BLOCKED ||
+    (isManualOnly && isScanLimitReached);
+  const isScheduleMode = isAdvanced && mode === LAUNCH_MODE.SCHEDULE;
 
   // useWatch, not form.watch: form.watch re-renders are dropped by React Compiler memoization.
   const providerId = useWatch({ control: form.control, name: "providerId" });
@@ -152,11 +155,14 @@ function LaunchScanForm({
   };
 
   const handleModeChange = (nextMode: string) => {
+    if (nextMode === LAUNCH_MODE.SCHEDULE && !isAdvanced) return;
     setMode(nextMode as LaunchMode);
     if (nextMode === LAUNCH_MODE.SCHEDULE) void loadSchedule(providerId);
   };
 
   const launchNow = form.handleSubmit(async ({ providerId, scanAlias }) => {
+    if (isBlocked) return;
+
     const formData = new FormData();
     formData.set("providerId", providerId);
     const trimmedAlias = scanAlias?.trim();
@@ -192,6 +198,8 @@ function LaunchScanForm({
   });
 
   const saveSchedule = async () => {
+    if (isBlocked || !isAdvanced) return;
+
     const providerValid = await form.trigger("providerId");
     if (!providerValid) return;
 
@@ -233,6 +241,8 @@ function LaunchScanForm({
 
   const onSubmit = (event: React.FormEvent<HTMLFormElement>) => {
     event.preventDefault();
+    if (isBlocked) return;
+
     if (isScheduleMode) {
       void saveSchedule();
       return;
@@ -246,7 +256,6 @@ function LaunchScanForm({
   const isSubmitting =
     form.formState.isSubmitting || scheduleForm.formState.isSubmitting;
   const isScheduleLoading = scheduleLoad === SCHEDULE_LOAD_STATE.LOADING;
-  const isLimitBlocked = isManualOnly && isScanLimitReached;
 
   return (
     // min-w-0: let this dialog grid item shrink so a long provider UID truncates instead of widening the modal
@@ -273,7 +282,7 @@ function LaunchScanForm({
         {providerError && <FieldError>{providerError}</FieldError>}
       </Field>
 
-      {!isManualOnly && (
+      {!isManualOnly && !isBlocked && (
         <Field>
           <FieldLabel>Mode</FieldLabel>
           <RadioGroup
@@ -299,7 +308,7 @@ function LaunchScanForm({
         </Field>
       )}
 
-      {isLimitBlocked && (
+      {isBlocked && (
         <p className="text-text-error-primary text-sm">
           You have reached your scan limit, so additional scans are not
           available right now.
@@ -355,10 +364,7 @@ function LaunchScanForm({
         }
         loadingText={isScheduleMode ? "Saving..." : "Launching..."}
         isDisabled={
-          isSubmitting ||
-          !providers.length ||
-          isScheduleLoading ||
-          isLimitBlocked
+          isSubmitting || !providers.length || isScheduleLoading || isBlocked
         }
         rightIcon={<Rocket className="size-4" />}
       />
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
index 9d1e96b46a..a3a715110a 100644
--- a/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
@@ -2,13 +2,19 @@ import { render, screen, waitFor, within } from "@testing-library/react";
 import userEvent from "@testing-library/user-event";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const { refreshMock, removeScheduleMock, toastMock, updateScheduleMock } =
-  vi.hoisted(() => ({
-    refreshMock: vi.fn(),
-    removeScheduleMock: vi.fn(),
-    toastMock: vi.fn(),
-    updateScheduleMock: vi.fn(),
-  }));
+const {
+  refreshMock,
+  removeScheduleMock,
+  toastMock,
+  updateScheduleMock,
+  updateSchedulesBulkMock,
+} = vi.hoisted(() => ({
+  refreshMock: vi.fn(),
+  removeScheduleMock: vi.fn(),
+  toastMock: vi.fn(),
+  updateScheduleMock: vi.fn(),
+  updateSchedulesBulkMock: vi.fn(),
+}));
 
 vi.mock("next/navigation", () => ({
   useRouter: () => ({ refresh: refreshMock }),
@@ -17,14 +23,44 @@ vi.mock("next/navigation", () => ({
 vi.mock("@/actions/schedules", () => ({
   removeSchedule: removeScheduleMock,
   updateSchedule: updateScheduleMock,
+  updateSchedulesBulk: updateSchedulesBulkMock,
 }));
 
 vi.mock("@/components/ui/toast", () => ({
   toast: toastMock,
 }));
 
+vi.mock("@/components/icons/providers-badge/provider-type-icon", () => ({
+  ProviderTypeIconStack: ({ items }: { items: Array<{ type: string }> }) => (
+    <div data-testid="provider-type-icon-stack">
+      {items.map((item) => (
+        <span key={item.type}>{item.type}</span>
+      ))}
+    </div>
+  ),
+}));
+
 vi.mock("@/components/ui/entities", () => ({
-  EntityInfo: () => null,
+  EntityInfo: ({
+    badge,
+    cloudProvider,
+    entityAlias,
+    icon,
+  }: {
+    badge?: string;
+    cloudProvider?: string;
+    entityAlias?: string;
+    icon?: React.ReactNode;
+  }) => (
+    <div data-testid="entity-info">
+      {cloudProvider && (
+        <span data-testid="single-cloud-provider">{cloudProvider}</span>
+      )}
+      {icon}
+      {entityAlias && <span>{entityAlias}</span>}
+      {badge && <span>{badge}</span>}
+    </div>
+  ),
 }));
 
 vi.mock("@/components/shadcn/modal", () => ({
@@ -58,6 +94,32 @@ const provider = {
   providerAlias: "Production",
 };
 
+const organizationProviders = [
+  provider,
+  {
+    providerId: "p2",
+    providerType: "aws" as const,
+    providerUid: "210987654321",
+    providerAlias: "Staging",
+  },
+];
+
+const multiCloudProviders = [
+  provider,
+  {
+    providerId: "p2",
+    providerType: "azure" as const,
+    providerUid: "azure-subscription",
+    providerAlias: "Azure Prod",
+  },
+  {
+    providerId: "p3",
+    providerType: "aws" as const,
+    providerUid: "210987654321",
+    providerAlias: "AWS Staging",
+  },
+];
+
 const schedule: ScheduleProps = {
   type: "schedules",
   id: "p1",
@@ -89,6 +151,7 @@ describe("EditScanScheduleModal remove flow", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     removeScheduleMock.mockResolvedValue({ success: true });
+    updateSchedulesBulkMock.mockResolvedValue({ success: true });
   });
 
   it("asks for confirmation before removing the schedule", async () => {
@@ -162,4 +225,89 @@ describe("EditScanScheduleModal remove flow", () => {
 
     expect(removeScheduleMock).not.toHaveBeenCalled();
   });
+
+  it("saves organization schedules through the bulk endpoint", async () => {
+    const user = userEvent.setup();
+    render(
+      <EditScanScheduleModal
+        open
+        onOpenChange={vi.fn()}
+        providers={organizationProviders}
+        targetName="My AWS Organization"
+        targetId="o-abc123def4"
+        state={{ kind: EDIT_SCAN_SCHEDULE_STATE.LOADED, schedule }}
+      />,
+    );
+
+    await user.click(screen.getByRole("button", { name: "Save" }));
+
+    await waitFor(() =>
+      expect(updateSchedulesBulkMock).toHaveBeenCalledWith(
+        ["p1", "p2"],
+        expect.objectContaining({
+          scan_enabled: true,
+          scan_frequency: "DAILY",
+          scan_hour: 4,
+        }),
+      ),
+    );
+    expect(updateScheduleMock).not.toHaveBeenCalled();
+    expect(toastMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        description: "The scan schedule was updated for 2 providers.",
+      }),
+    );
+  });
+
+  it("uses explicit provider ids for organization bulk schedules", async () => {
+    const user = userEvent.setup();
+    render(
+      <EditScanScheduleModal
+        open
+        onOpenChange={vi.fn()}
+        providers={[organizationProviders[0]]}
+        providerIds={["p1", "p2", "p3"]}
+        targetName="My AWS Organization"
+        targetId="o-abc123def4"
+        state={{ kind: EDIT_SCAN_SCHEDULE_STATE.LOADED, schedule }}
+      />,
+    );
+
+    await user.click(screen.getByRole("button", { name: "Save" }));
+
+    await waitFor(() =>
+      expect(updateSchedulesBulkMock).toHaveBeenCalledWith(
+        ["p1", "p2", "p3"],
+        expect.objectContaining({
+          scan_enabled: true,
+          scan_frequency: "DAILY",
+          scan_hour: 4,
+        }),
+      ),
+    );
+    expect(toastMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        description: "The scan schedule was updated for 3 providers.",
+      }),
+    );
+  });
+
+  it("shows one logo per selected provider type in bulk mode", () => {
+    render(
+      <EditScanScheduleModal
+        open
+        onOpenChange={vi.fn()}
+        providers={multiCloudProviders}
+        targetName="Selected providers"
+        state={{ kind: EDIT_SCAN_SCHEDULE_STATE.LOADED, schedule }}
+      />,
+    );
+
+    const stack = screen.getByTestId("provider-type-icon-stack");
+    expect(stack).toHaveTextContent("aws");
+    expect(stack).toHaveTextContent("azure");
+    expect(
+      screen.queryByTestId("single-cloud-provider"),
+    ).not.toBeInTheDocument();
+  });
 });
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
index c84d79e7f3..5d3690db66 100644
--- a/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
@@ -6,12 +6,21 @@ import { useRouter } from "next/navigation";
 import { useState } from "react";
 import { useForm } from "react-hook-form";
 
-import { removeSchedule, updateSchedule } from "@/actions/schedules";
+import {
+  removeSchedule,
+  updateSchedule,
+  updateSchedulesBulk,
+} from "@/actions/schedules";
+import {
+  ProviderTypeIconStack,
+  type ProviderTypeIconStackItem,
+} from "@/components/icons/providers-badge/provider-type-icon";
 import { Button, FieldError } from "@/components/shadcn";
 import { Modal } from "@/components/shadcn/modal";
 import { EntityInfo } from "@/components/ui/entities";
 import { FormButtons } from "@/components/ui/form";
 import { toast } from "@/components/ui/toast";
+import { runWithConcurrencyLimit } from "@/lib/concurrency";
 import {
   buildScheduleUpdatePayload,
   getScheduleFormValues,
@@ -19,17 +28,13 @@ import {
   scheduleFormSchema,
 } from "@/lib/schedules";
 import type { ProviderType, ScheduleProps } from "@/types";
-import type { ScheduleFormValues } from "@/types/schedules";
+import type {
+  ScanScheduleProvider,
+  ScheduleFormValues,
+} from "@/types/schedules";
 
 import { ScanScheduleFields } from "./scan-schedule-fields";
 
-export interface ScanScheduleProvider {
-  providerId: string;
-  providerType: ProviderType;
-  providerUid: string;
-  providerAlias: string | null;
-}
-
 export const EDIT_SCAN_SCHEDULE_STATE = {
   LOADING: "loading",
   LOADED: "loaded",
@@ -45,22 +50,56 @@ export type EditScanScheduleState =
   | { kind: typeof EDIT_SCAN_SCHEDULE_STATE.ERROR; message: string };
 
 interface EditScanScheduleFormProps {
-  provider: ScanScheduleProvider;
+  provider?: ScanScheduleProvider;
+  providers?: ScanScheduleProvider[];
+  providerIds?: string[];
+  targetName?: string;
+  targetId?: string;
   schedule: ScheduleProps | null;
   onClose: () => void;
+  onSaved?: () => void;
 }
 
 interface EditScanScheduleModalProps {
   open: boolean;
   onOpenChange: (open: boolean) => void;
   provider?: ScanScheduleProvider;
+  providers?: ScanScheduleProvider[];
+  providerIds?: string[];
+  targetName?: string;
+  targetId?: string;
   state: EditScanScheduleState;
+  onSaved?: () => void;
+}
+
+function getBulkProviderTypeIconItems(
+  providers: ScanScheduleProvider[],
+): ProviderTypeIconStackItem[] {
+  const seen = new Set<ProviderType>();
+  const items: ProviderTypeIconStackItem[] = [];
+
+  for (const provider of providers) {
+    if (seen.has(provider.providerType)) continue;
+    seen.add(provider.providerType);
+    items.push({
+      key: provider.providerType,
+      type: provider.providerType,
+      tooltip: provider.providerType,
+    });
+  }
+
+  return items;
 }
 
 function EditScanScheduleForm({
   provider,
+  providers,
+  providerIds,
+  targetName,
+  targetId,
   schedule,
   onClose,
+  onSaved,
 }: EditScanScheduleFormProps) {
   const router = useRouter();
   const [isConfirmRemoveOpen, setIsConfirmRemoveOpen] = useState(false);
@@ -72,12 +111,23 @@ function EditScanScheduleForm({
   const hasSchedule = schedule
     ? isScheduleConfigured(schedule.attributes)
     : false;
+  const targetProviders = providers ?? (provider ? [provider] : []);
+  const targetProviderIds =
+    providerIds ?? targetProviders.map((target) => target.providerId);
+  const referenceProvider = targetProviders[0];
+  const isBulk = providers !== undefined || providerIds !== undefined;
+  const bulkProviderTypeIconItems = isBulk
+    ? getBulkProviderTypeIconItems(targetProviders)
+    : [];
+  const providerCountLabel = `${targetProviderIds.length} provider${
+    targetProviderIds.length === 1 ? "" : "s"
+  }`;
 
   const onSubmit = form.handleSubmit(async (values) => {
-    const result = await updateSchedule(
-      provider.providerId,
-      buildScheduleUpdatePayload(values),
-    );
+    const payload = buildScheduleUpdatePayload(values);
+    const result = isBulk
+      ? await updateSchedulesBulk(targetProviderIds, payload)
+      : await updateSchedule(targetProviderIds[0], payload);
 
     if (result?.error) {
       form.setError("root", { message: String(result.error) });
@@ -86,27 +136,38 @@ function EditScanScheduleForm({
 
     toast({
       title: "Scan schedule saved",
-      description: "The scan schedule was updated successfully.",
+      description: isBulk
+        ? `The scan schedule was updated for ${providerCountLabel}.`
+        : "The scan schedule was updated successfully.",
     });
+    onSaved?.();
     onClose();
     router.refresh();
   });
 
   const handleRemove = async () => {
     setIsRemoving(true);
-    const result = await removeSchedule(provider.providerId);
+    const results = await runWithConcurrencyLimit(
+      targetProviderIds,
+      10,
+      (providerId) => removeSchedule(providerId),
+    );
     setIsRemoving(false);
     setIsConfirmRemoveOpen(false);
 
-    if (result?.error) {
-      form.setError("root", { message: String(result.error) });
+    const failedResult = results.find((result) => result?.error);
+    if (failedResult?.error) {
+      form.setError("root", { message: String(failedResult.error) });
       return;
     }
 
     toast({
       title: "Scan schedule removed",
-      description: "The scan schedule was removed successfully.",
+      description: isBulk
+        ? `The scan schedule was removed for ${providerCountLabel}.`
+        : "The scan schedule was removed successfully.",
     });
+    onSaved?.();
     onClose();
     router.refresh();
   };
@@ -116,11 +177,30 @@ function EditScanScheduleForm({
 
   return (
     <form onSubmit={onSubmit} className="flex flex-col gap-8">
-      <EntityInfo
-        cloudProvider={provider.providerType}
-        entityAlias={provider.providerAlias ?? provider.providerUid}
-        entityId={provider.providerUid}
-      />
+      {referenceProvider && (
+        <EntityInfo
+          cloudProvider={isBulk ? undefined : referenceProvider.providerType}
+          icon={
+            isBulk && bulkProviderTypeIconItems.length > 0 ? (
+              <ProviderTypeIconStack
+                items={bulkProviderTypeIconItems}
+                max={bulkProviderTypeIconItems.length}
+                size={35}
+                className="flex-wrap"
+              />
+            ) : undefined
+          }
+          entityAlias={
+            isBulk
+              ? (targetName ?? providerCountLabel)
+              : (referenceProvider.providerAlias ??
+                referenceProvider.providerUid)
+          }
+          entityId={isBulk ? targetId : referenceProvider.providerUid}
+          idLabel={isBulk ? "ID" : "UID"}
+          badge={isBulk ? providerCountLabel : undefined}
+        />
+      )}
 
       <ScanScheduleFields
         form={form}
@@ -154,7 +234,11 @@ function EditScanScheduleForm({
         open={isConfirmRemoveOpen}
         onOpenChange={setIsConfirmRemoveOpen}
         title="Are you absolutely sure?"
-        description="This action cannot be undone. The scan schedule for this provider will be removed and scans will no longer run automatically."
+        description={
+          isBulk
+            ? `This action cannot be undone. The scan schedule for these ${providerCountLabel} will be removed and scans will no longer run automatically.`
+            : "This action cannot be undone. The scan schedule for this provider will be removed and scans will no longer run automatically."
+        }
       >
         <div className="flex w-full justify-end gap-4">
           <Button
@@ -186,9 +270,21 @@ export function EditScanScheduleModal({
   open,
   onOpenChange,
   provider,
+  providers,
+  providerIds,
+  targetName,
+  targetId,
   state,
+  onSaved,
 }: EditScanScheduleModalProps) {
   const close = () => onOpenChange(false);
+  const hasTarget = Boolean(
+    provider || providers?.length || providerIds?.length,
+  );
+  const keyPrefix =
+    provider?.providerId ??
+    providerIds?.join(":") ??
+    providers?.map((item) => item.providerId).join(":");
 
   return (
     <Modal
@@ -214,12 +310,17 @@ export function EditScanScheduleModal({
         </div>
       )}
 
-      {state.kind === EDIT_SCAN_SCHEDULE_STATE.LOADED && provider && (
+      {state.kind === EDIT_SCAN_SCHEDULE_STATE.LOADED && hasTarget && (
         <EditScanScheduleForm
-          key={`${provider.providerId}-${state.schedule?.attributes.scan_hour ?? "none"}`}
+          key={`${keyPrefix}-${state.schedule?.attributes.scan_hour ?? "none"}`}
           provider={provider}
+          providers={providers}
+          providerIds={providerIds}
+          targetName={targetName}
+          targetId={targetId}
           schedule={state.schedule}
           onClose={close}
+          onSaved={onSaved}
         />
       )}
     </Modal>
diff --git a/ui/components/scans/table/scan-jobs-columns.test.tsx b/ui/components/scans/table/scan-jobs-columns.test.tsx
index a8bde44a1c..4f8891666c 100644
--- a/ui/components/scans/table/scan-jobs-columns.test.tsx
+++ b/ui/components/scans/table/scan-jobs-columns.test.tsx
@@ -59,10 +59,16 @@ vi.mock("@/components/ui/table", () => ({
 }));
 
 vi.mock("./scan-jobs-row-actions", () => ({
-  ScanJobsRowActions: () => <button type="button" />,
+  ScanJobsRowActions: ({ capability }: { capability?: string }) => (
+    <button type="button">{capability ?? "no-capability"}</button>
+  ),
 }));
 
 import { SCAN_JOBS_TAB, type ScanJobsTab } from "@/types";
+import {
+  SCAN_SCHEDULE_CAPABILITY,
+  type ScanScheduleCapability,
+} from "@/types/schedules";
 
 import { getScanJobsColumns } from "./scan-jobs-columns";
 
@@ -107,9 +113,11 @@ const renderCell = (
   columnId: string,
   scan: ScanProps,
   tab: ScanJobsTab = SCAN_JOBS_TAB.COMPLETED,
+  capability?: ScanScheduleCapability,
 ) => {
   const column = getScanJobsColumns({
     tab,
+    capability,
   }).find((item) => item.id === columnId);
   const cell = column?.cell as
     | ((context: CellContext<ScanProps, unknown>) => React.ReactNode)
@@ -201,4 +209,19 @@ describe("getScanJobsColumns", () => {
     expect(screen.getByText("Schedule")).toBeInTheDocument();
     expect(screen.queryByText("Scheduled")).not.toBeInTheDocument();
   });
+
+  it("passes scan schedule capability to row actions", () => {
+    renderCell(
+      "actions",
+      makeCompletedScan(),
+      SCAN_JOBS_TAB.COMPLETED,
+      SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY,
+    );
+
+    expect(
+      screen.getByRole("button", {
+        name: SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY,
+      }),
+    ).toBeVisible();
+  });
 });
diff --git a/ui/components/scans/table/scan-jobs-columns.tsx b/ui/components/scans/table/scan-jobs-columns.tsx
index d87553e50c..501f4e962f 100644
--- a/ui/components/scans/table/scan-jobs-columns.tsx
+++ b/ui/components/scans/table/scan-jobs-columns.tsx
@@ -7,6 +7,7 @@ import { DataTableColumnHeader } from "@/components/ui/table";
 import { StatusBadge } from "@/components/ui/table/status-badge";
 import { formatLocalDate, formatLocalTimeWithZone } from "@/lib/date-utils";
 import { SCAN_JOBS_TAB, type ScanJobsTab, type ScanProps } from "@/types";
+import type { ScanScheduleCapability } from "@/types/schedules";
 
 import { formatScanDuration } from "../scans.utils";
 import {
@@ -20,6 +21,7 @@ import { ScanJobsRowActions } from "./scan-jobs-row-actions";
 
 interface GetScanJobsColumnsOptions {
   tab: ScanJobsTab;
+  capability?: ScanScheduleCapability;
 }
 
 const accountColumn: ColumnDef<ScanProps> = {
@@ -116,12 +118,16 @@ const resourcesColumn: ColumnDef<ScanProps> = {
   enableSorting: false,
 };
 
-const actionsColumn: ColumnDef<ScanProps> = {
+const actionsColumn = (
+  capability?: ScanScheduleCapability,
+): ColumnDef<ScanProps> => ({
   id: "actions",
   header: ({ column }) => <DataTableColumnHeader column={column} title="" />,
-  cell: ({ row }) => <ScanJobsRowActions scan={row.original} />,
+  cell: ({ row }) => (
+    <ScanJobsRowActions scan={row.original} capability={capability} />
+  ),
   enableSorting: false,
-};
+});
 
 const durationColumn: ColumnDef<ScanProps> = {
   id: "duration",
@@ -132,7 +138,9 @@ const durationColumn: ColumnDef<ScanProps> = {
   enableSorting: false,
 };
 
-const activeColumns = (): ColumnDef<ScanProps>[] => [
+const activeColumns = (
+  capability?: ScanScheduleCapability,
+): ColumnDef<ScanProps>[] => [
   accountColumn,
   scanInfoColumn,
   {
@@ -156,10 +164,12 @@ const activeColumns = (): ColumnDef<ScanProps>[] => [
       ),
     enableSorting: false,
   },
-  actionsColumn,
+  actionsColumn(capability),
 ];
 
-const completedColumns = (): ColumnDef<ScanProps>[] => [
+const completedColumns = (
+  capability?: ScanScheduleCapability,
+): ColumnDef<ScanProps>[] => [
   accountColumn,
   scanInfoColumn,
   resourcesColumn,
@@ -185,22 +195,28 @@ const completedColumns = (): ColumnDef<ScanProps>[] => [
     ),
     cell: ({ row }) => renderDateCell(row.original.attributes.completed_at),
   },
-  actionsColumn,
+  actionsColumn(capability),
 ];
 
-const scheduledColumns = (): ColumnDef<ScanProps>[] => [
+const scheduledColumns = (
+  capability?: ScanScheduleCapability,
+): ColumnDef<ScanProps>[] => [
   accountColumn,
   scanInfoColumn,
   scheduledScanScheduleColumn,
   nextScanColumn,
   lastScanColumn,
-  actionsColumn,
+  actionsColumn(capability),
 ];
 
 export function getScanJobsColumns(
   options: GetScanJobsColumnsOptions,
 ): ColumnDef<ScanProps>[] {
-  if (options.tab === SCAN_JOBS_TAB.SCHEDULED) return scheduledColumns();
-  if (options.tab === SCAN_JOBS_TAB.ACTIVE) return activeColumns();
-  return completedColumns();
+  if (options.tab === SCAN_JOBS_TAB.SCHEDULED) {
+    return scheduledColumns(options.capability);
+  }
+  if (options.tab === SCAN_JOBS_TAB.ACTIVE) {
+    return activeColumns(options.capability);
+  }
+  return completedColumns(options.capability);
 }
diff --git a/ui/components/scans/table/scan-jobs-row-actions.test.tsx b/ui/components/scans/table/scan-jobs-row-actions.test.tsx
index 7fcc97ecd6..8d9cacd5fa 100644
--- a/ui/components/scans/table/scan-jobs-row-actions.test.tsx
+++ b/ui/components/scans/table/scan-jobs-row-actions.test.tsx
@@ -3,6 +3,7 @@ import userEvent from "@testing-library/user-event";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import type { ScanProps } from "@/types";
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
 
 import { ScanJobsRowActions } from "./scan-jobs-row-actions";
 
@@ -187,6 +188,52 @@ describe("ScanJobsRowActions", () => {
     ).not.toBeInTheDocument();
   });
 
+  it("hides Edit Scan Schedule for manual-only Cloud scan rows", async () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    const user = userEvent.setup();
+
+    render(
+      <ScanJobsRowActions
+        scan={makeScan()}
+        capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+      />,
+    );
+
+    // When
+    await user.click(
+      screen.getByRole("button", { name: /open actions menu/i }),
+    );
+
+    // Then
+    expect(
+      screen.queryByRole("menuitem", { name: /edit scan schedule/i }),
+    ).not.toBeInTheDocument();
+  });
+
+  it("hides Edit Scan Schedule for blocked Cloud scan rows", async () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+    const user = userEvent.setup();
+
+    render(
+      <ScanJobsRowActions
+        scan={makeScan()}
+        capability={SCAN_SCHEDULE_CAPABILITY.BLOCKED}
+      />,
+    );
+
+    // When
+    await user.click(
+      screen.getByRole("button", { name: /open actions menu/i }),
+    );
+
+    // Then
+    expect(
+      screen.queryByRole("menuitem", { name: /edit scan schedule/i }),
+    ).not.toBeInTheDocument();
+  });
+
   it("links completed scans to compliance from the actions menu", async () => {
     // Given
     const user = userEvent.setup();
diff --git a/ui/components/scans/table/scan-jobs-row-actions.tsx b/ui/components/scans/table/scan-jobs-row-actions.tsx
index ff9991a842..9fa3beb8f6 100644
--- a/ui/components/scans/table/scan-jobs-row-actions.tsx
+++ b/ui/components/scans/table/scan-jobs-row-actions.tsx
@@ -23,7 +23,6 @@ import {
   EDIT_SCAN_SCHEDULE_STATE,
   EditScanScheduleModal,
   type EditScanScheduleState,
-  type ScanScheduleProvider,
 } from "@/components/scans/schedule/edit-scan-schedule-modal";
 import {
   ActionDropdown,
@@ -38,6 +37,7 @@ import type { ProviderType, ScanProps, ScheduleApiResponse } from "@/types";
 import {
   SCAN_SCHEDULE_CAPABILITY,
   type ScanScheduleCapability,
+  type ScanScheduleProvider,
 } from "@/types/schedules";
 
 interface ScanJobsRowActionsProps {
diff --git a/ui/components/scans/table/scan-jobs-table.test.tsx b/ui/components/scans/table/scan-jobs-table.test.tsx
index 9f819fa9d6..f11f227373 100644
--- a/ui/components/scans/table/scan-jobs-table.test.tsx
+++ b/ui/components/scans/table/scan-jobs-table.test.tsx
@@ -2,9 +2,14 @@ import { render, screen } from "@testing-library/react";
 import { describe, expect, it, vi } from "vitest";
 
 import { SCAN_JOBS_TAB, type ScanProps } from "@/types";
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
 
 import { ScanJobsTable } from "./scan-jobs-table";
 
+const { getScanJobsColumnsMock } = vi.hoisted(() => ({
+  getScanJobsColumnsMock: vi.fn((_options: unknown) => []),
+}));
+
 vi.mock("@/components/ui/table", () => ({
   DataTable: ({ data }: { data: ScanProps[] }) => (
     <div data-testid="scan-jobs-data-table">{data.length}</div>
@@ -12,7 +17,7 @@ vi.mock("@/components/ui/table", () => ({
 }));
 
 vi.mock("./scan-jobs-columns", () => ({
-  getScanJobsColumns: () => [],
+  getScanJobsColumns: (options: unknown) => getScanJobsColumnsMock(options),
 }));
 
 vi.mock("../auto-refresh", () => ({
@@ -96,4 +101,20 @@ describe("ScanJobsTable", () => {
       screen.queryByTestId("no-scans-empty-state"),
     ).not.toBeInTheDocument();
   });
+
+  it("passes scan schedule capability to scan job columns", () => {
+    render(
+      <ScanJobsTable
+        data={[]}
+        tab={SCAN_JOBS_TAB.ACTIVE}
+        hasFilters
+        scanScheduleCapability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+      />,
+    );
+
+    expect(getScanJobsColumnsMock).toHaveBeenCalledWith({
+      tab: SCAN_JOBS_TAB.ACTIVE,
+      capability: SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY,
+    });
+  });
 });
diff --git a/ui/components/scans/table/scan-jobs-table.tsx b/ui/components/scans/table/scan-jobs-table.tsx
index e94f6cb490..de8d57c4a9 100644
--- a/ui/components/scans/table/scan-jobs-table.tsx
+++ b/ui/components/scans/table/scan-jobs-table.tsx
@@ -3,6 +3,7 @@
 import { DataTable } from "@/components/ui/table";
 import type { MetaDataProps, ScanJobsTab, ScanProps } from "@/types";
 import { SCAN_JOBS_TAB } from "@/types";
+import type { ScanScheduleCapability } from "@/types/schedules";
 
 import { AutoRefresh } from "../auto-refresh";
 import { NoScansEmptyState } from "../no-scans-empty-state";
@@ -13,6 +14,7 @@ interface ScanJobsTableProps {
   meta?: MetaDataProps;
   tab: ScanJobsTab;
   hasFilters?: boolean;
+  scanScheduleCapability?: ScanScheduleCapability;
 }
 
 const REFRESHING_STATES = ["available", "executing"] as const;
@@ -22,13 +24,17 @@ export function ScanJobsTable({
   meta,
   tab,
   hasFilters = false,
+  scanScheduleCapability,
 }: ScanJobsTableProps) {
   const hasRefreshingScan = data.some((scan) =>
     REFRESHING_STATES.includes(
       scan.attributes.state as (typeof REFRESHING_STATES)[number],
     ),
   );
-  const columns = getScanJobsColumns({ tab });
+  const columns = getScanJobsColumns({
+    tab,
+    capability: scanScheduleCapability,
+  });
   const showEmptyState = data.length === 0 && !hasFilters;
 
   return (
diff --git a/ui/components/ui/table/data-table.test.tsx b/ui/components/ui/table/data-table.test.tsx
index 7de2a81be8..090710bcfb 100644
--- a/ui/components/ui/table/data-table.test.tsx
+++ b/ui/components/ui/table/data-table.test.tsx
@@ -162,6 +162,7 @@ describe("DataTable", () => {
       expect(actionsCell).toHaveClass("right-0");
       expect(actionsCell).toHaveClass("z-20");
       expect(actionsCell).toHaveClass("bg-bg-neutral-secondary");
+      expect(actionsCell).toHaveClass("last:rounded-r-none!");
       expect(actionsCell).not.toHaveClass("border-l");
       expect(actionsCell).toHaveClass("before:bg-gradient-to-r");
       expect(actionsCell).toHaveClass("before:from-transparent");
diff --git a/ui/components/ui/table/data-table.tsx b/ui/components/ui/table/data-table.tsx
index b31092e3e2..0bfb51c556 100644
--- a/ui/components/ui/table/data-table.tsx
+++ b/ui/components/ui/table/data-table.tsx
@@ -46,7 +46,7 @@ type DataTableRowAttributes = {
 const DEFAULT_COLUMN_SIZE = 150;
 const ACTIONS_COLUMN_ID = "actions";
 const STICKY_ACTION_COLUMN_CLASS = "sticky right-0 z-20 min-w-12";
-const STICKY_ACTION_CELL_CLASS = `${STICKY_ACTION_COLUMN_CLASS} overflow-visible bg-bg-neutral-secondary before:pointer-events-none before:absolute before:inset-y-0 before:-left-8 before:w-8 before:bg-gradient-to-r before:from-transparent before:to-bg-neutral-secondary before:content-[''] group-hover:bg-bg-neutral-tertiary group-hover:before:to-bg-neutral-tertiary group-data-[state=selected]:bg-bg-neutral-tertiary group-data-[state=selected]:before:to-bg-neutral-tertiary`;
+const STICKY_ACTION_CELL_CLASS = `${STICKY_ACTION_COLUMN_CLASS} last:rounded-r-none! overflow-visible bg-bg-neutral-secondary before:pointer-events-none before:absolute before:inset-y-0 before:-left-8 before:w-8 before:bg-gradient-to-r before:from-transparent before:to-bg-neutral-secondary before:content-[''] group-hover:bg-bg-neutral-tertiary group-hover:before:to-bg-neutral-tertiary group-data-[state=selected]:bg-bg-neutral-tertiary group-data-[state=selected]:before:to-bg-neutral-tertiary`;
 
 const getStickyActionColumnClassName = (
   columnId: string,
diff --git a/ui/hooks/use-scan-schedule-capability.test.ts b/ui/hooks/use-scan-schedule-capability.test.ts
new file mode 100644
index 0000000000..9310365cf9
--- /dev/null
+++ b/ui/hooks/use-scan-schedule-capability.test.ts
@@ -0,0 +1,53 @@
+import { renderHook } from "@testing-library/react";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
+
+import { useScanScheduleCapability } from "./use-scan-schedule-capability";
+
+describe("useScanScheduleCapability", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("returns DAILY_LEGACY for OSS without loading", () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "false");
+
+    // When
+    const { result } = renderHook(() => useScanScheduleCapability());
+
+    // Then
+    expect(result.current).toEqual({
+      capability: SCAN_SCHEDULE_CAPABILITY.DAILY_LEGACY,
+      isScheduleCapabilityLoading: false,
+    });
+  });
+
+  it("returns ADVANCED for Cloud env without loading", () => {
+    // Given
+    vi.stubEnv("NEXT_PUBLIC_IS_CLOUD_ENV", "true");
+
+    // When
+    const { result } = renderHook(() => useScanScheduleCapability());
+
+    // Then
+    expect(result.current).toEqual({
+      capability: SCAN_SCHEDULE_CAPABILITY.ADVANCED,
+      isScheduleCapabilityLoading: false,
+    });
+  });
+
+  it("honors explicit capability overrides", () => {
+    // Given / When
+    const { result } = renderHook(() =>
+      useScanScheduleCapability(SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY),
+    );
+
+    // Then
+    expect(result.current).toEqual({
+      capability: SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY,
+      isScheduleCapabilityLoading: false,
+    });
+  });
+});
diff --git a/ui/hooks/use-scan-schedule-capability.ts b/ui/hooks/use-scan-schedule-capability.ts
new file mode 100644
index 0000000000..5a3e353172
--- /dev/null
+++ b/ui/hooks/use-scan-schedule-capability.ts
@@ -0,0 +1,17 @@
+import { getScanScheduleCapability } from "@/lib/schedules";
+import { isCloud } from "@/lib/shared/env";
+import type { ScanScheduleCapability } from "@/types/schedules";
+
+interface UseScanScheduleCapabilityResult {
+  capability: ScanScheduleCapability;
+  isScheduleCapabilityLoading: boolean;
+}
+
+export function useScanScheduleCapability(
+  capabilityOverride?: ScanScheduleCapability,
+): UseScanScheduleCapabilityResult {
+  return {
+    capability: capabilityOverride ?? getScanScheduleCapability(isCloud()),
+    isScheduleCapabilityLoading: false,
+  };
+}
diff --git a/ui/lib/schedules.ts b/ui/lib/schedules.ts
index 1117ababe1..bd6651426b 100644
--- a/ui/lib/schedules.ts
+++ b/ui/lib/schedules.ts
@@ -29,6 +29,16 @@ export const scheduleFormSchema = z.object({
   launchInitialScan: z.boolean(),
 });
 
+export const scheduleUpdatePayloadSchema = z.object({
+  scan_enabled: z.boolean(),
+  scan_frequency: z.enum(SCHEDULE_FREQUENCY),
+  scan_hour: z.number().int().min(0).max(23),
+  scan_timezone: z.string().min(1),
+  scan_interval_hours: z.number().int().min(SCAN_INTERVAL_HOURS_MIN).nullable(),
+  scan_day_of_week: z.number().int().min(0).max(6).nullable(),
+  scan_day_of_month: z.number().int().min(1).max(28).nullable(),
+});
+
 /**
  * Default scan-schedule capability for the current environment.
  *
diff --git a/ui/types/providers-table.ts b/ui/types/providers-table.ts
index 21bfb1ab8c..4394cec713 100644
--- a/ui/types/providers-table.ts
+++ b/ui/types/providers-table.ts
@@ -67,6 +67,7 @@ export interface ProvidersOrganizationRow {
   parentExternalId: string | null;
   organizationId: string | null;
   providerCount: number;
+  providerIds: string[];
   subRows: ProvidersTableRow[];
 }
 
diff --git a/ui/types/schedules.ts b/ui/types/schedules.ts
index 5ac820eaca..429377a494 100644
--- a/ui/types/schedules.ts
+++ b/ui/types/schedules.ts
@@ -1,4 +1,4 @@
-import type { ProviderProps } from "./providers";
+import type { ProviderProps, ProviderType } from "./providers";
 
 export const SCHEDULE_FREQUENCY = {
   DAILY: "DAILY",
@@ -26,17 +26,21 @@ export const SCHEDULE_WEEKDAY_LABELS = [
  * the runtime environment (Cloud vs non-Cloud); the prowler-cloud overlay
  * computes a billing-aware capability and injects it via the `capability` prop.
  *
- * - `ADVANCED`: full scheduling through the new `/schedules/{providerId}` API
- *   (Prowler Cloud, subscribed/paid).
+ * - `ADVANCED`: full scheduling through the new schedules API —
+ *   `/schedules/{providerId}` for a single provider, `/schedules/bulk` for the
+ *   organization flow (Prowler Cloud, subscribed/paid).
  * - `DAILY_LEGACY`: Prowler OSS / non-Cloud. Only the legacy `Daily` schedule
  *   (`/schedules/daily`) plus optional on-demand scans are allowed.
  * - `MANUAL_ONLY`: Prowler Cloud trial/onboarding. No schedules at all, only a
  *   manual on-demand scan subject to the account quota.
+ * - `BLOCKED`: Prowler Cloud account over the scan limit. No scan or schedule
+ *   action is available.
  */
 export const SCAN_SCHEDULE_CAPABILITY = {
   ADVANCED: "ADVANCED",
   DAILY_LEGACY: "DAILY_LEGACY",
   MANUAL_ONLY: "MANUAL_ONLY",
+  BLOCKED: "BLOCKED",
 } as const;
 
 export type ScanScheduleCapability =
@@ -87,6 +91,39 @@ export interface ScheduleUpdatePayload {
   scan_day_of_month: number | null;
 }
 
+/** Per-provider failure, as returned by `/schedules/bulk`: `{ id, error }`. */
+export interface SchedulesBulkFailure {
+  id: string;
+  error: string;
+}
+
+export interface SchedulesBulkAttributes {
+  /** Provider ids whose schedule was committed (already excludes failures). */
+  updated?: string[];
+  failed?: SchedulesBulkFailure[];
+}
+
+export interface SchedulesBulkData {
+  type: "schedules-bulk";
+  id?: string;
+  attributes?: SchedulesBulkAttributes;
+}
+
+export interface SchedulesBulkResponse {
+  data?: SchedulesBulkData;
+  error?: unknown;
+  errors?: unknown;
+  status?: number;
+}
+
+/** Minimal provider identity needed to render and target schedule actions. */
+export interface ScanScheduleProvider {
+  providerId: string;
+  providerType: ProviderType;
+  providerUid: string;
+  providerAlias: string | null;
+}
+
 export interface ScheduleFormValues {
   frequency: ScheduleFrequency;
   hour: number;

From 2375f1d962adecd8cf604b164b0dd0ee9d8eed8e Mon Sep 17 00:00:00 2001
From: Josema Camacho <josema@prowler.com>
Date: Mon, 22 Jun 2026 16:30:33 +0200
Subject: [PATCH 114/126] fix(api): uvicorn worker keepalive (#11663)

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 api/CHANGELOG.md                   |  3 +-
 api/pyproject.toml                 |  4 ++-
 api/src/backend/config/guniconf.py | 47 ++++++++++++------------------
 api/uv.lock                        | 29 ++++++++++++++++++
 4 files changed, 53 insertions(+), 30 deletions(-)

diff --git a/api/CHANGELOG.md b/api/CHANGELOG.md
index cb9d6fb179..bb19eb81fc 100644
--- a/api/CHANGELOG.md
+++ b/api/CHANGELOG.md
@@ -15,11 +15,12 @@ All notable changes to the **Prowler API** are documented in this file.
 
 - Gunicorn worker timeout raised from the 30s default to 120s, so long-running requests are no longer killed prematurely [(#11631)](https://github.com/prowler-cloud/prowler/pull/11631)
 - Sentry now drops ASGI's `RequestAborted` errors from health-check probe disconnects on `/health/live` [(#11632)](https://github.com/prowler-cloud/prowler/pull/11632)
+- Gunicorn keep-alive timeout now exceeds the load balancer idle timeout, stopping 502s from reused connections [(#11647)](https://github.com/prowler-cloud/prowler/pull/11647)
+- API runs under the Uvicorn worker so keep-alive outlives the load balancer idle timeout, fixing Gunicorn's intermittent 502s [(#11663)](https://github.com/prowler-cloud/prowler/pull/11663)
 
 ### 🐞 Fixed
 
 - Database connections no longer leak under the ASGI worker, which previously exhausted the read replica's connection slots and caused 500s on read endpoints [(#11640)](https://github.com/prowler-cloud/prowler/pull/11640)
-- Gunicorn keep-alive timeout now exceeds the load balancer idle timeout, stopping 502s from reused connections [(#11647)](https://github.com/prowler-cloud/prowler/pull/11647)
 
 ### 🔐 Security
 
diff --git a/api/pyproject.toml b/api/pyproject.toml
index 41014d3382..f678b908fc 100644
--- a/api/pyproject.toml
+++ b/api/pyproject.toml
@@ -62,7 +62,8 @@ dependencies = [
   "gevent (==25.9.1)",
   "werkzeug (==3.1.7)",
   "sqlparse (==0.5.5)",
-  "fonttools (==4.62.1)"
+  "fonttools (==4.62.1)",
+  "uvicorn-worker (==0.4.0)",
 ]
 description = "Prowler's API (Django/DRF)"
 license = "Apache-2.0"
@@ -422,6 +423,7 @@ constraint-dependencies = [
   "uritemplate==4.2.0",
   "urllib3==2.7.0",
   "uuid6==2024.7.10",
+  "uvicorn==0.49.0",
   "uvloop==0.22.1",
   "vine==5.1.0",
   "vulture==2.14",
diff --git a/api/src/backend/config/guniconf.py b/api/src/backend/config/guniconf.py
index 3b8b7dbe8c..6f85a9e1bc 100644
--- a/api/src/backend/config/guniconf.py
+++ b/api/src/backend/config/guniconf.py
@@ -3,6 +3,8 @@ import multiprocessing
 import os
 import threading
 
+from uvicorn_worker import UvicornWorker
+
 from config.env import env
 
 # Ensure the environment variable for Django settings is set
@@ -12,6 +14,7 @@ os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.django.production")
 import django  # noqa: E402
 
 django.setup()
+
 from api.compliance import warm_compliance_caches  # noqa: E402
 from config.django.production import LOGGING as DJANGO_LOGGERS, DEBUG  # noqa: E402
 from config.custom_logging import BackendLogger  # noqa: E402
@@ -19,34 +22,28 @@ from config.custom_logging import BackendLogger  # noqa: E402
 BIND_ADDRESS = env("DJANGO_BIND_ADDRESS", default="127.0.0.1")
 PORT = env("DJANGO_PORT", default=8080)
 
+
+class ProwlerUvicornWorker(UvicornWorker):
+    CONFIG_KWARGS = {
+        # Keep-alive idle timeout. Must exceed the load balancer idle timeout.
+        "timeout_keep_alive": env.int("GUNICORN_KEEPALIVE", default=75),
+        "loop": "uvloop",
+        "lifespan": "off",  # Django ASGIHandler doesn't handle lifespan scopes
+    }
+
+
+# Required so SSE endpoints can keep the event loop alive while waiting for events
+worker_class = env(
+    "DJANGO_WORKER_CLASS",
+    default="config.guniconf.ProwlerUvicornWorker",
+)
+
 # Server settings
 bind = f"{BIND_ADDRESS}:{PORT}"
 
 workers = env.int("DJANGO_WORKERS", default=multiprocessing.cpu_count() * 2 + 1)
 reload = DEBUG
 
-# Native ASGI worker (gunicorn 24+). Required so SSE endpoints can keep the
-# event loop alive while waiting for events.
-worker_class = env("DJANGO_WORKER_CLASS", default="asgi")
-
-# Lifespan protocol. Django's ASGIHandler (config.asgi:application) serves only
-# HTTP scopes and raises "Django can only handle ASGI/HTTP connections, not
-# lifespan." gunicorn's default ("auto") probes the app with a lifespan scope
-# to detect support, which triggers that error. We use no lifespan startup or
-# shutdown hooks, so disable the protocol entirely.
-asgi_lifespan = env("DJANGO_ASGI_LIFESPAN", default="off")
-
-# Event loop for the ASGI worker. "auto" uses uvloop when it is installed and
-# falls back to the stdlib asyncio loop otherwise; uvloop gives the SSE event
-# loop more headroom under many concurrent open streams.
-asgi_loop = env("DJANGO_ASGI_LOOP", default="uvloop")
-
-# Max concurrent connections per ASGI worker. Each open SSE stream holds one
-# connection for its whole lifetime, so this caps simultaneous SSE clients per
-# worker (gunicorn's default is 1000). The sync-only `threads` option has no
-# effect on ASGI workers.
-worker_connections = env.int("DJANGO_WORKER_CONNECTIONS", default=1000)
-
 # Preload the application before forking workers in production: the app is
 # imported once in the master and workers fork from it. In development, disable
 # preload so the server restarts on code changes.
@@ -56,12 +53,6 @@ preload_app = not DEBUG
 # that may take longer, such as complex API operations.
 timeout = env.int("GUNICORN_TIMEOUT", default=120)
 
-# HTTP keep-alive idle timeout. Must exceed the idle timeout of the proxy or load
-# balancer in front of gunicorn, or it reuses a connection gunicorn just closed
-# and returns a 502. Default clears the common 60s; raise `GUNICORN_KEEPALIVE` to
-# stay above a longer one.
-keepalive = env.int("GUNICORN_KEEPALIVE", default=75)
-
 # Logging
 logconfig_dict = DJANGO_LOGGERS
 gunicorn_logger = logging.getLogger(BackendLogger.GUNICORN)
diff --git a/api/uv.lock b/api/uv.lock
index f96318c1f4..3b5cca9b6a 100644
--- a/api/uv.lock
+++ b/api/uv.lock
@@ -357,6 +357,7 @@ constraints = [
     { name = "uritemplate", specifier = "==4.2.0" },
     { name = "urllib3", specifier = "==2.7.0" },
     { name = "uuid6", specifier = "==2024.7.10" },
+    { name = "uvicorn", specifier = "==0.49.0" },
     { name = "uvloop", specifier = "==0.22.1" },
     { name = "vine", specifier = "==5.1.0" },
     { name = "vulture", specifier = "==2.14" },
@@ -4575,6 +4576,7 @@ dependencies = [
     { name = "sentry-sdk", extra = ["django"] },
     { name = "sqlparse" },
     { name = "uuid6" },
+    { name = "uvicorn-worker" },
     { name = "uvloop" },
     { name = "werkzeug" },
     { name = "xmlsec" },
@@ -4641,6 +4643,7 @@ requires-dist = [
     { name = "sentry-sdk", extras = ["django"], specifier = "==2.56.0" },
     { name = "sqlparse", specifier = "==0.5.5" },
     { name = "uuid6", specifier = "==2024.7.10" },
+    { name = "uvicorn-worker", specifier = "==0.4.0" },
     { name = "uvloop", specifier = "==0.22.1" },
     { name = "werkzeug", specifier = "==3.1.7" },
     { name = "xmlsec", specifier = "==1.3.17" },
@@ -5846,6 +5849,32 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d3/3e/4ae6af487ce5781ed71d5fe10aca72e7cbc4d4f45afc31b120287082a8dd/uuid6-2024.7.10-py3-none-any.whl", hash = "sha256:93432c00ba403751f722829ad21759ff9db051dea140bf81493271e8e4dd18b7", size = 6376, upload-time = "2024-07-10T16:39:36.148Z" },
 ]
 
+[[package]]
+name = "uvicorn"
+version = "0.49.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "click" },
+    { name = "h11" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/c4/1f/fa18009dea8469069cca78a4e877a008ab78f08b064bfc9ab891579077ff/uvicorn-0.49.0.tar.gz", hash = "sha256:ebf4271aa580d9de97f93192d4595176df6e91f9aae919ca73e4fc07df1e66a3", size = 91284, upload-time = "2026-06-03T22:01:30.448Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/88/fa/e1388bbcf24ef3274f45c0c1c7b501fd14971037c1b6ee23610553307497/uvicorn-0.49.0-py3-none-any.whl", hash = "sha256:ba3d14c3ee7e41c6c654c46c9eb489d33213cdd30aa1696eab1374337c13f68f", size = 71376, upload-time = "2026-06-03T22:01:29.037Z" },
+]
+
+[[package]]
+name = "uvicorn-worker"
+version = "0.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "gunicorn" },
+    { name = "uvicorn" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/80/59/9101b9c0680fd80e9d26c07deb822a5d18a324339fcf9cd017885ee808ad/uvicorn_worker-0.4.0.tar.gz", hash = "sha256:8ee5306070d8f38dce124adce488c3c0b50f20cf0c0222b12c66188da7214493", size = 9361, upload-time = "2025-09-20T10:47:01.218Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/90/25/09cd7a90c8bb7fb693be0d6704fccd5f9778d5513214b7a01cc4a94ff314/uvicorn_worker-0.4.0-py3-none-any.whl", hash = "sha256:e2ed952cef976f5e9e429d7269640bbcafbd36c80aa80f1003c8c77a6797abde", size = 5364, upload-time = "2025-09-20T10:46:59.776Z" },
+]
+
 [[package]]
 name = "uvloop"
 version = "0.22.1"

From b9298b4023f14cf5e119468c7e19914b5cd5a97b Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Mon, 22 Jun 2026 23:34:52 +0900
Subject: [PATCH 115/126] feat(azure): add network_vnet_ddos_protection_enabled
 check (#11044)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |  1 +
 prowler/compliance/azure/cis_2.0_azure.json   |  3 +-
 prowler/compliance/azure/cis_5.0_azure.json   |  4 +-
 .../compliance/azure/iso27001_2022_azure.json |  1 +
 .../azure/services/network/network_service.py |  4 +
 .../__init__.py                               |  0
 ...vnet_ddos_protection_enabled.metadata.json | 36 +++++++
 .../network_vnet_ddos_protection_enabled.py   | 41 ++++++++
 ...twork_vnet_ddos_protection_enabled_test.py | 99 +++++++++++++++++++
 9 files changed, 187 insertions(+), 2 deletions(-)
 create mode 100644 prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/__init__.py
 create mode 100644 prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled.metadata.json
 create mode 100644 prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled.py
 create mode 100644 tests/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index b479000569..7dd9d94d3f 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -29,6 +29,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `aks_cluster_azure_monitor_enabled` check for Azure provider, verifying AKS clusters have Azure Monitor (Container Insights) enabled for metrics, logs, and alerting [(#11029)](https://github.com/prowler-cloud/prowler/pull/11029)
 - `aks_cluster_local_accounts_disabled` check for Azure provider, verifying AKS clusters have local accounts disabled so authentication is forced through Microsoft Entra ID [(#11030)](https://github.com/prowler-cloud/prowler/pull/11030)
 - `network_subnet_nsg_associated` check for Azure provider, verifying virtual network subnets have a network security group associated to enforce traffic filtering [(#11043)](https://github.com/prowler-cloud/prowler/pull/11043)
+- `network_vnet_ddos_protection_enabled` check for Azure provider, verifying virtual networks have Azure DDoS Network Protection enabled [(#11044)](https://github.com/prowler-cloud/prowler/pull/11044)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/cis_2.0_azure.json b/prowler/compliance/azure/cis_2.0_azure.json
index 73f4dc3611..59bd153352 100644
--- a/prowler/compliance/azure/cis_2.0_azure.json
+++ b/prowler/compliance/azure/cis_2.0_azure.json
@@ -2714,7 +2714,8 @@
       "Id": "6.6",
       "Description": "Ensure that Network Watcher is 'Enabled'",
       "Checks": [
-        "network_watcher_enabled"
+        "network_watcher_enabled",
+        "network_vnet_ddos_protection_enabled"
       ],
       "Attributes": [
         {
diff --git a/prowler/compliance/azure/cis_5.0_azure.json b/prowler/compliance/azure/cis_5.0_azure.json
index 35f77ce310..8ea6f50d7c 100644
--- a/prowler/compliance/azure/cis_5.0_azure.json
+++ b/prowler/compliance/azure/cis_5.0_azure.json
@@ -2935,7 +2935,9 @@
     {
       "Id": "8.5",
       "Description": "Ensure Azure DDoS Network Protection is enabled on virtual networks",
-      "Checks": [],
+      "Checks": [
+        "network_vnet_ddos_protection_enabled"
+      ],
       "Attributes": [
         {
           "Section": "8 Security Services",
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 6659e6ee0a..c1d92b1dc5 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1431,6 +1431,7 @@
         "network_ssh_internet_access_restricted",
         "network_subnet_nsg_associated",
         "network_udp_internet_access_restricted",
+        "network_vnet_ddos_protection_enabled",
         "network_watcher_enabled"
       ]
     },
diff --git a/prowler/providers/azure/services/network/network_service.py b/prowler/providers/azure/services/network/network_service.py
index 98668bdbfa..a924cf9609 100644
--- a/prowler/providers/azure/services/network/network_service.py
+++ b/prowler/providers/azure/services/network/network_service.py
@@ -227,6 +227,9 @@ class Network(AzureService):
                             id=vnet.id,
                             name=vnet.name,
                             location=vnet.location,
+                            enable_ddos_protection=getattr(
+                                vnet, "enable_ddos_protection", False
+                            ),
                             subnets=subnets,
                         )
                     )
@@ -308,6 +311,7 @@ class VirtualNetwork:
     id: str
     name: str
     location: str
+    enable_ddos_protection: bool = False
     subnets: List[VNetSubnet] = None
 
     def __post_init__(self):
diff --git a/prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/__init__.py b/prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled.metadata.json b/prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled.metadata.json
new file mode 100644
index 0000000000..dfeef103c1
--- /dev/null
+++ b/prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled.metadata.json
@@ -0,0 +1,36 @@
+{
+  "Provider": "azure",
+  "CheckID": "network_vnet_ddos_protection_enabled",
+  "CheckTitle": "Virtual network has Azure DDoS Network Protection enabled",
+  "CheckType": [],
+  "ServiceName": "network",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.network/virtualnetworks",
+  "ResourceGroup": "network",
+  "Description": "**Azure Virtual Networks** are evaluated for **DDoS Network Protection**. When enabled, Azure DDoS Protection provides enhanced mitigation against volumetric, protocol, and application-layer DDoS attacks targeting resources deployed in the virtual network.",
+  "Risk": "Without DDoS protection, Azure resources are only covered by **DDoS Infrastructure Protection** (basic), which may not mitigate sophisticated or large-scale attacks. Successful DDoS attacks cause **service unavailability** and potential **data exposure** during failover.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az network ddos-protection create --resource-group <rg> --name <plan> && az network vnet update --resource-group <rg> --name <vnet> --ddos-protection-plan <plan_id>",
+      "NativeIaC": "```bicep\nresource vnet 'Microsoft.Network/virtualNetworks@2023-09-01' = {\n  name: '<example_resource_name>'\n  location: '<example_location>'\n  properties: {\n    addressSpace: { addressPrefixes: ['10.0.0.0/16'] }\n    enableDdosProtection: true // Critical: enables DDoS Protection\n    ddosProtectionPlan: { id: '<example_resource_id>' }\n  }\n}\n```",
+      "Other": "1. Sign in to Azure portal\n2. Search for 'DDoS protection plans'\n3. Create a new DDoS protection plan\n4. Go to Virtual networks and select the target VNet\n5. Under DDoS protection, select 'Enable' and select the plan\n6. Click Save",
+      "Terraform": "```hcl\nresource \"azurerm_virtual_network\" \"<example_resource_name>\" {\n  name                = \"<example_resource_name>\"\n  location            = \"<example_location>\"\n  resource_group_name = \"<example_resource_name>\"\n  address_space       = [\"10.0.0.0/16\"]\n\n  ddos_protection_plan {\n    id     = \"<example_resource_id>\"  # Critical: associates DDoS Protection Plan\n    enable = true\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Enable **Azure DDoS Network Protection** on virtual networks hosting internet-facing workloads. Consider cost implications — DDoS Network Protection has a monthly charge per plan. Use **DDoS IP Protection** as a lower-cost alternative for individual public IPs.",
+      "Url": "https://hub.prowler.com/check/network_vnet_ddos_protection_enabled"
+    }
+  },
+  "Categories": [
+    "internet-exposed"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Azure DDoS Network Protection has a monthly cost (~$2,944/month per plan). Consider whether the workload justifies this cost. Internal-only VNets without internet-facing resources may not need DDoS protection."
+}
diff --git a/prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled.py b/prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled.py
new file mode 100644
index 0000000000..6a9a081fb7
--- /dev/null
+++ b/prowler/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled.py
@@ -0,0 +1,41 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.network.network_client import network_client
+
+
+class network_vnet_ddos_protection_enabled(Check):
+    """
+    Ensure Azure DDoS Network Protection is enabled on virtual networks.
+
+    This check evaluates whether each virtual network has a DDoS protection plan associated, providing always-on traffic monitoring and adaptive mitigation against volumetric and protocol attacks.
+
+    - PASS: The virtual network has DDoS protection enabled.
+    - FAIL: The virtual network does not have DDoS protection enabled.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for subscription_name, vnets in network_client.virtual_networks.items():
+            for vnet in vnets:
+                report = Check_Report_Azure(metadata=self.metadata(), resource=vnet)
+                report.subscription = subscription_name
+                report.resource_name = vnet.name
+                report.resource_id = vnet.id
+                report.location = vnet.location
+
+                if vnet.enable_ddos_protection:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Virtual network '{vnet.name}' has DDoS "
+                        f"protection enabled."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"Virtual network '{vnet.name}' does not have "
+                        f"DDoS protection enabled."
+                    )
+
+                findings.append(report)
+
+        return findings
diff --git a/tests/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled_test.py b/tests/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled_test.py
new file mode 100644
index 0000000000..f37d3eb781
--- /dev/null
+++ b/tests/providers/azure/services/network/network_vnet_ddos_protection_enabled/network_vnet_ddos_protection_enabled_test.py
@@ -0,0 +1,99 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+VNET_ID = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet"
+
+
+class Test_network_vnet_ddos_protection_enabled:
+    def test_no_subscriptions(self):
+        network_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_vnet_ddos_protection_enabled.network_vnet_ddos_protection_enabled.network_client",
+                new=network_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_vnet_ddos_protection_enabled.network_vnet_ddos_protection_enabled import (
+                network_vnet_ddos_protection_enabled,
+            )
+
+            network_client.virtual_networks = {}
+
+            check = network_vnet_ddos_protection_enabled()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_ddos_enabled(self):
+        network_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_vnet_ddos_protection_enabled.network_vnet_ddos_protection_enabled.network_client",
+                new=network_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_vnet_ddos_protection_enabled.network_vnet_ddos_protection_enabled import (
+                network_vnet_ddos_protection_enabled,
+            )
+            from prowler.providers.azure.services.network.network_service import (
+                VirtualNetwork,
+            )
+
+            vnet = VirtualNetwork(
+                id=VNET_ID,
+                name="test-vnet",
+                location="eastus",
+                enable_ddos_protection=True,
+            )
+            network_client.virtual_networks = {AZURE_SUBSCRIPTION_ID: [vnet]}
+
+            check = network_vnet_ddos_protection_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_ddos_disabled(self):
+        network_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.network.network_vnet_ddos_protection_enabled.network_vnet_ddos_protection_enabled.network_client",
+                new=network_client,
+            ),
+        ):
+            from prowler.providers.azure.services.network.network_vnet_ddos_protection_enabled.network_vnet_ddos_protection_enabled import (
+                network_vnet_ddos_protection_enabled,
+            )
+            from prowler.providers.azure.services.network.network_service import (
+                VirtualNetwork,
+            )
+
+            vnet = VirtualNetwork(
+                id=VNET_ID,
+                name="test-vnet",
+                location="eastus",
+                enable_ddos_protection=False,
+            )
+            network_client.virtual_networks = {AZURE_SUBSCRIPTION_ID: [vnet]}
+
+            check = network_vnet_ddos_protection_enabled()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"

From ca48fd07199541bafb924d8b07ad39e844e0e921 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Mon, 22 Jun 2026 17:12:01 +0200
Subject: [PATCH 116/126] feat(aws): add apigateway_domain_name_pqc_tls_enabled
 check (#11316)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 contrib/k8s/helm/prowler-api/values.yaml      |   7 +
 .../cli/tutorials/configuration_file.mdx      |   1 +
 permissions/prowler-additions-policy.json     |   4 +-
 .../cloudformation/prowler-scan-role.yml      |   2 +
 prowler/CHANGELOG.md                          |   1 +
 ...itected_framework_security_pillar_aws.json |   1 +
 prowler/compliance/aws/ccc_aws.json           |   1 +
 prowler/compliance/aws/ens_rd2022_aws.json    |   2 +
 .../aws/fedramp_moderate_revision_4_aws.json  |   2 +
 prowler/compliance/aws/ffiec_aws.json         |   1 +
 .../aws/gxp_21_cfr_part_11_aws.json           |   1 +
 prowler/compliance/aws/iso27001_2013_aws.json |   1 +
 .../compliance/aws/kisa_isms_p_2023_aws.json  |   2 +
 .../aws/kisa_isms_p_2023_korean_aws.json      |   2 +
 .../aws/nist_800_171_revision_2_aws.json      |   1 +
 .../aws/nist_800_53_revision_5_aws.json       |   2 +
 .../aws/rbi_cyber_security_framework_aws.json |   1 +
 .../compliance/aws/secnumcloud_3.2_aws.json   |   1 +
 prowler/config/config.yaml                    |   8 +
 .../__init__.py                               |   0
 ..._domain_name_pqc_tls_enabled.metadata.json |  41 +++
 .../apigateway_domain_name_pqc_tls_enabled.py |  55 ++++
 .../services/apigateway/apigateway_service.py |  53 +++-
 ...ateway_domain_name_pqc_tls_enabled_test.py | 243 ++++++++++++++++++
 .../apigateway/apigateway_service_test.py     |  23 ++
 25 files changed, 454 insertions(+), 2 deletions(-)
 create mode 100644 prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/__init__.py
 create mode 100644 prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.metadata.json
 create mode 100644 prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py
 create mode 100644 tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py

diff --git a/contrib/k8s/helm/prowler-api/values.yaml b/contrib/k8s/helm/prowler-api/values.yaml
index 72c4b26088..db861f7b88 100644
--- a/contrib/k8s/helm/prowler-api/values.yaml
+++ b/contrib/k8s/helm/prowler-api/values.yaml
@@ -438,6 +438,13 @@ mainConfig:
     # Minimum number of Availability Zones that an ELBv2 must be in
     elbv2_min_azs: 2
 
+    # AWS Post-Quantum TLS Configuration
+    # aws.apigateway_domain_name_pqc_tls_enabled
+    apigateway_pqc_tls_allowed_policies:
+      - "SecurityPolicy_TLS13_1_2_FIPS_PFS_PQ_2025_09"
+      - "SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09"
+      - "SecurityPolicy_TLS13_1_2_PQ_2025_09"
+
     # AWS Post-Quantum SSH Key Exchange Configuration
     # aws.transfer_server_pqc_ssh_kex_enabled
     transfer_pqc_ssh_allowed_policies:
diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx
index 4b918c869f..58f30f413d 100644
--- a/docs/user-guide/cli/tutorials/configuration_file.mdx
+++ b/docs/user-guide/cli/tutorials/configuration_file.mdx
@@ -55,6 +55,7 @@ The following list includes all the AWS checks with configurable variables that
 | `elasticache_redis_cluster_backup_enabled`                    | `minimum_snapshot_retention_period`              | Integer         |
 | `elb_is_in_multiple_az`                                       | `elb_min_azs`                                    | Integer         |
 | `elbv2_is_in_multiple_az`                                     | `elbv2_min_azs`                                  | Integer         |
+| `apigateway_domain_name_pqc_tls_enabled`                      | `apigateway_pqc_tls_allowed_policies`            | List of Strings |
 | `guardduty_is_enabled`                                        | `mute_non_default_regions`                       | Boolean         |
 | `iam_user_access_not_stale_to_sagemaker`                      | `max_unused_sagemaker_access_days`               | Integer         |
 | `iam_user_accesskey_unused`                                   | `max_unused_access_keys_days`                    | Integer         |
diff --git a/permissions/prowler-additions-policy.json b/permissions/prowler-additions-policy.json
index 906f06fbfb..37579edb35 100644
--- a/permissions/prowler-additions-policy.json
+++ b/permissions/prowler-additions-policy.json
@@ -61,7 +61,9 @@
       ],
       "Resource": [
         "arn:*:apigateway:*::/restapis/*",
-        "arn:*:apigateway:*::/apis/*"
+        "arn:*:apigateway:*::/apis/*",
+        "arn:*:apigateway:*::/domainnames",
+        "arn:*:apigateway:*::/domainnames/*"
       ],
       "Sid": "AllowAPIGatewayReadOnly"
     }
diff --git a/permissions/templates/cloudformation/prowler-scan-role.yml b/permissions/templates/cloudformation/prowler-scan-role.yml
index 395fed6424..2ab6d41289 100644
--- a/permissions/templates/cloudformation/prowler-scan-role.yml
+++ b/permissions/templates/cloudformation/prowler-scan-role.yml
@@ -150,6 +150,8 @@ Resources:
                 Resource:
                   - "arn:*:apigateway:*::/restapis/*"
                   - "arn:*:apigateway:*::/apis/*"
+                  - "arn:*:apigateway:*::/domainnames"
+                  - "arn:*:apigateway:*::/domainnames/*"
         - !If
           - OrganizationsEnabled
           - PolicyName: ProwlerOrganizations
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 7dd9d94d3f..003ed6b11f 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -43,6 +43,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the GCP provider, mapping existing GCP checks across the five DORA pillars [(#11642)](https://github.com/prowler-cloud/prowler/pull/11642)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Cloudflare provider, mapping existing Cloudflare edge/network checks across the applicable DORA pillars [(#11645)](https://github.com/prowler-cloud/prowler/pull/11645)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the AlibabaCloud provider, mapping existing AlibabaCloud checks across the applicable DORA pillars [(#11646)](https://github.com/prowler-cloud/prowler/pull/11646)
+- `apigateway_domain_name_pqc_tls_enabled` check for AWS provider to verify API Gateway custom domain names use a post-quantum TLS security policy [(#11316)](https://github.com/prowler-cloud/prowler/pull/11316)
 - `transfer_server_pqc_ssh_kex_enabled` check for AWS provider to verify Transfer Family servers use a post-quantum hybrid SSH key exchange security policy [(#11315)](https://github.com/prowler-cloud/prowler/pull/11315)
 
 ### 🔄 Changed
diff --git a/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json b/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
index e99760d8be..8002f5d61c 100644
--- a/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
+++ b/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
@@ -1151,6 +1151,7 @@
         "elb_insecure_ssl_ciphers",
         "elb_ssl_listeners",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_ssl_listeners",
         "s3_bucket_secure_transport_policy"
diff --git a/prowler/compliance/aws/ccc_aws.json b/prowler/compliance/aws/ccc_aws.json
index 298b803c1c..7fec0c7d71 100644
--- a/prowler/compliance/aws/ccc_aws.json
+++ b/prowler/compliance/aws/ccc_aws.json
@@ -49,6 +49,7 @@
         "elb_insecure_ssl_ciphers",
         "elb_ssl_listeners",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_ssl_listeners",
         "elbv2_nlb_tls_termination_enabled",
diff --git a/prowler/compliance/aws/ens_rd2022_aws.json b/prowler/compliance/aws/ens_rd2022_aws.json
index 850ffb6850..7b0658c040 100644
--- a/prowler/compliance/aws/ens_rd2022_aws.json
+++ b/prowler/compliance/aws/ens_rd2022_aws.json
@@ -2367,6 +2367,7 @@
       ],
       "Checks": [
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled"
       ]
     },
@@ -2391,6 +2392,7 @@
       ],
       "Checks": [
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled"
       ]
     },
diff --git a/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json b/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
index 1090931bf5..11ce0fc381 100644
--- a/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
+++ b/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
@@ -1145,6 +1145,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "opensearch_service_domains_node_to_node_encryption_enabled",
@@ -1165,6 +1166,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "opensearch_service_domains_node_to_node_encryption_enabled",
diff --git a/prowler/compliance/aws/ffiec_aws.json b/prowler/compliance/aws/ffiec_aws.json
index ad5ff3068f..5a7fa14bc3 100644
--- a/prowler/compliance/aws/ffiec_aws.json
+++ b/prowler/compliance/aws/ffiec_aws.json
@@ -487,6 +487,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "s3_bucket_secure_transport_policy"
diff --git a/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json b/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
index 29b21c3a69..022a778bad 100644
--- a/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
+++ b/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
@@ -266,6 +266,7 @@
         "ec2_ebs_default_encryption",
         "efs_encryption_at_rest_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "opensearch_service_domains_encryption_at_rest_enabled",
diff --git a/prowler/compliance/aws/iso27001_2013_aws.json b/prowler/compliance/aws/iso27001_2013_aws.json
index 4709458f8b..791aea8993 100644
--- a/prowler/compliance/aws/iso27001_2013_aws.json
+++ b/prowler/compliance/aws/iso27001_2013_aws.json
@@ -36,6 +36,7 @@
       "Checks": [
         "elb_insecure_ssl_ciphers",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled"
       ]
     },
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
index 526c656c5a..734a92e8d3 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
@@ -2040,6 +2040,7 @@
         "elb_ssl_listeners",
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_nlb_tls_termination_enabled",
         "elbv2_ssl_listeners",
@@ -3091,6 +3092,7 @@
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_desync_mitigation_mode",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_internet_facing",
         "elbv2_listeners_underneath",
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
index 1cc50d15af..05ef1c0082 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
@@ -2042,6 +2042,7 @@
         "elb_ssl_listeners",
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_nlb_tls_termination_enabled",
         "elbv2_ssl_listeners",
@@ -3094,6 +3095,7 @@
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_desync_mitigation_mode",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_internet_facing",
         "elbv2_listeners_underneath",
diff --git a/prowler/compliance/aws/nist_800_171_revision_2_aws.json b/prowler/compliance/aws/nist_800_171_revision_2_aws.json
index 35b67d75b0..d5a55398ce 100644
--- a/prowler/compliance/aws/nist_800_171_revision_2_aws.json
+++ b/prowler/compliance/aws/nist_800_171_revision_2_aws.json
@@ -653,6 +653,7 @@
         "apigateway_restapi_client_certificate_enabled",
         "ec2_ebs_volume_encryption",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "opensearch_service_domains_node_to_node_encryption_enabled",
         "s3_bucket_default_encryption",
diff --git a/prowler/compliance/aws/nist_800_53_revision_5_aws.json b/prowler/compliance/aws/nist_800_53_revision_5_aws.json
index ac25515f93..a1cf795225 100644
--- a/prowler/compliance/aws/nist_800_53_revision_5_aws.json
+++ b/prowler/compliance/aws/nist_800_53_revision_5_aws.json
@@ -5262,6 +5262,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "opensearch_service_domains_node_to_node_encryption_enabled",
@@ -5550,6 +5551,7 @@
       ],
       "Checks": [
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners"
       ]
diff --git a/prowler/compliance/aws/rbi_cyber_security_framework_aws.json b/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
index 22c3774959..46d2411902 100644
--- a/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
+++ b/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
@@ -40,6 +40,7 @@
         "ec2_instance_public_ip",
         "efs_encryption_at_rest_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
         "ec2_ebs_default_encryption",
diff --git a/prowler/compliance/aws/secnumcloud_3.2_aws.json b/prowler/compliance/aws/secnumcloud_3.2_aws.json
index 794de281de..c49e7c201a 100644
--- a/prowler/compliance/aws/secnumcloud_3.2_aws.json
+++ b/prowler/compliance/aws/secnumcloud_3.2_aws.json
@@ -474,6 +474,7 @@
         "elbv2_ssl_listeners",
         "elb_insecure_ssl_ciphers",
         "elbv2_insecure_ssl_ciphers",
+        "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "redshift_cluster_in_transit_encryption_enabled",
         "elasticache_redis_cluster_in_transit_encryption_enabled",
diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml
index f9dda5dc92..004fa1207a 100644
--- a/prowler/config/config.yaml
+++ b/prowler/config/config.yaml
@@ -380,6 +380,14 @@ aws:
   # Minimum number of Availability Zones that an ELBv2 must be in
   elbv2_min_azs: 2
 
+  # AWS Post-Quantum TLS Configuration
+  # aws.apigateway_domain_name_pqc_tls_enabled
+  # Allowed post-quantum TLS security policies for API Gateway custom domain names
+  apigateway_pqc_tls_allowed_policies:
+    - "SecurityPolicy_TLS13_1_2_FIPS_PFS_PQ_2025_09"
+    - "SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09"
+    - "SecurityPolicy_TLS13_1_2_PQ_2025_09"
+
   # AWS Post-Quantum SSH Key Exchange Configuration
   # aws.transfer_server_pqc_ssh_kex_enabled
   # Allowed AWS Transfer Family security policies with post-quantum SSH key exchange
diff --git a/prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/__init__.py b/prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.metadata.json b/prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.metadata.json
new file mode 100644
index 0000000000..276f6e1741
--- /dev/null
+++ b/prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.metadata.json
@@ -0,0 +1,41 @@
+{
+  "Provider": "aws",
+  "CheckID": "apigateway_domain_name_pqc_tls_enabled",
+  "CheckTitle": "API Gateway custom domain names use a post-quantum TLS security policy",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "apigateway",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "AwsApiGatewayDomainName",
+  "ResourceGroup": "network",
+  "Description": "**API Gateway custom domain names** for REST APIs are assessed for use of a **post-quantum (PQ) TLS security policy** such as `SecurityPolicy_TLS13_1_2_PQ_2025_09`. Custom domains with legacy policies such as `TLS_1_0` or `TLS_1_2` lack hybrid ML-KEM key exchange, leaving captured traffic vulnerable to future quantum decryption.",
+  "Risk": "Without a PQ-ready TLS policy, traffic to API Gateway custom domains captured today can be decrypted once a **cryptographically relevant quantum computer** exists (**harvest-now, decrypt-later** attack). This threatens long-term **confidentiality** of API payloads, credentials, and bearer tokens.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-custom-domain-tls-version.html",
+    "https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-security-policies-list.html",
+    "https://aws.amazon.com/security/post-quantum-cryptography/",
+    "https://csrc.nist.gov/projects/post-quantum-cryptography"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws apigateway update-domain-name --domain-name <domain_name> --patch-operations op=replace,path=/securityPolicy,value=SecurityPolicy_TLS13_1_2_PQ_2025_09",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::ApiGateway::DomainName\n    Properties:\n      DomainName: api.example.com\n      RegionalCertificateArn: <example_certificate_arn>\n      SecurityPolicy: SecurityPolicy_TLS13_1_2_PQ_2025_09  # FIX: enhanced post-quantum security policy\n      EndpointConfiguration:\n        Types:\n          - REGIONAL\n```",
+      "Other": "1. In the AWS Console, go to API Gateway > Custom domain names\n2. Select the custom domain and choose Edit on Domain name configurations\n3. Set Security policy to SecurityPolicy_TLS13_1_2_PQ_2025_09 (post-quantum) and Endpoint access mode to Strict\n4. Save the changes",
+      "Terraform": "```hcl\nresource \"aws_api_gateway_domain_name\" \"<example_resource_name>\" {\n  domain_name              = \"api.example.com\"\n  regional_certificate_arn = \"<example_certificate_arn>\"\n  security_policy          = \"SecurityPolicy_TLS13_1_2_PQ_2025_09\" # FIX: enhanced post-quantum security policy\n  endpoint_configuration {\n    types = [\"REGIONAL\"]\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Migrate every API Gateway custom domain name to an **enhanced post-quantum TLS policy** such as `SecurityPolicy_TLS13_1_2_PQ_2025_09` that enables hybrid ML-KEM key exchange. Note that you must also enable Strict endpoint access mode and that mutual TLS is not supported on enhanced policies. Review allowed policies regularly as AWS publishes new PQ-ready options.",
+      "Url": "https://hub.prowler.com/check/apigateway_domain_name_pqc_tls_enabled"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "API Gateway HTTP and WebSocket APIs only support the legacy TLS_1_2 security policy and therefore cannot use post-quantum TLS today; this check evaluates REST API custom domain names only."
+}
diff --git a/prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py b/prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py
new file mode 100644
index 0000000000..d9c2d071f9
--- /dev/null
+++ b/prowler/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled.py
@@ -0,0 +1,55 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.apigateway.apigateway_client import (
+    apigateway_client,
+)
+
+PQC_APIGATEWAY_POLICIES_DEFAULT = [
+    "SecurityPolicy_TLS13_1_2_FIPS_PFS_PQ_2025_09",
+    "SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09",
+    "SecurityPolicy_TLS13_1_2_PQ_2025_09",
+]
+
+
+def _get_allowed_policies(configured_policies: object) -> list[str]:
+    if not isinstance(configured_policies, list):
+        return PQC_APIGATEWAY_POLICIES_DEFAULT
+
+    return configured_policies
+
+
+class apigateway_domain_name_pqc_tls_enabled(Check):
+    """Verify that every API Gateway custom domain name uses a post-quantum TLS policy.
+
+    A custom domain name PASSES when its ``securityPolicy`` belongs to the
+    configured allowlist of enhanced post-quantum policies.
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the API Gateway custom domain post-quantum TLS check.
+
+        Returns:
+            A list of reports for API Gateway custom domain names and their
+            post-quantum TLS policy compliance status.
+        """
+        findings = []
+        pqc_policies = _get_allowed_policies(
+            apigateway_client.audit_config.get("apigateway_pqc_tls_allowed_policies")
+        )
+        for domain in apigateway_client.domain_names:
+            report = Check_Report_AWS(metadata=self.metadata(), resource=domain)
+            policy = domain.security_policy or "<none>"
+            if domain.security_policy in pqc_policies:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"API Gateway custom domain {domain.name} uses post-quantum "
+                    f"TLS policy {policy}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"API Gateway custom domain {domain.name} uses TLS policy "
+                    f"{policy}, which is not in the post-quantum allowlist."
+                )
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/apigateway/apigateway_service.py b/prowler/providers/aws/services/apigateway/apigateway_service.py
index 4f887a2da8..099551f440 100644
--- a/prowler/providers/aws/services/apigateway/apigateway_service.py
+++ b/prowler/providers/aws/services/apigateway/apigateway_service.py
@@ -1,4 +1,4 @@
-from typing import Optional
+from typing import Any, Optional
 
 from botocore.exceptions import ClientError
 from pydantic.v1 import BaseModel
@@ -13,12 +13,45 @@ class APIGateway(AWSService):
         # Call AWSService's __init__
         super().__init__(__class__.__name__, provider)
         self.rest_apis = []
+        self.domain_names = []
         self.__threading_call__(self._get_rest_apis)
+        self.__threading_call__(self._get_domain_names)
         self._get_authorizers()
         self._get_rest_api()
         self._get_stages()
         self._get_resources()
 
+    def _get_domain_names(self, regional_client: Any) -> None:
+        """Get API Gateway custom domain names for a regional client.
+
+        Args:
+            regional_client: Regional API Gateway boto3 client used to list
+                custom domain names.
+        """
+        logger.info("APIGateway - Getting custom domain names...")
+        try:
+            paginator = regional_client.get_paginator("get_domain_names")
+            for page in paginator.paginate():
+                for item in page.get("items", []):
+                    domain_name = item.get("domainName", "")
+                    arn = f"arn:{self.audited_partition}:apigateway:{regional_client.region}::/domainnames/{domain_name}"
+                    if not self.audit_resources or (
+                        is_resource_filtered(arn, self.audit_resources)
+                    ):
+                        self.domain_names.append(
+                            DomainName(
+                                name=domain_name,
+                                arn=arn,
+                                region=regional_client.region,
+                                security_policy=item.get("securityPolicy", ""),
+                                tags=[item.get("tags", {})],
+                            )
+                        )
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
     def _get_rest_apis(self, regional_client):
         logger.info("APIGateway - Getting Rest APIs...")
         try:
@@ -249,3 +282,21 @@ class RestAPI(BaseModel):
     stages: list[Stage] = []
     tags: Optional[list] = []
     resources: list[PathResourceMethods] = []
+
+
+class DomainName(BaseModel):
+    """API Gateway custom domain name metadata.
+
+    Attributes:
+        name: Custom domain name.
+        arn: Custom domain name ARN.
+        region: AWS region where the custom domain name exists.
+        security_policy: TLS security policy configured for the custom domain.
+        tags: Custom domain tags.
+    """
+
+    name: str
+    arn: str
+    region: str
+    security_policy: str = ""
+    tags: Optional[list] = []
diff --git a/tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py b/tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py
new file mode 100644
index 0000000000..6d460be32e
--- /dev/null
+++ b/tests/providers/aws/services/apigateway/apigateway_domain_name_pqc_tls_enabled/apigateway_domain_name_pqc_tls_enabled_test.py
@@ -0,0 +1,243 @@
+from unittest import mock
+
+from moto import mock_aws
+
+from prowler.providers.aws.services.apigateway.apigateway_service import DomainName
+from tests.providers.aws.utils import (
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+DOMAIN_NAME = "api.example.com"
+DOMAIN_ARN = f"arn:aws:apigateway:{AWS_REGION_US_EAST_1}::/domainnames/{DOMAIN_NAME}"
+
+
+def _build_client(security_policy: str):
+    apigw_client = mock.MagicMock()
+    apigw_client.audit_config = {}
+    apigw_client.domain_names = [
+        DomainName(
+            name=DOMAIN_NAME,
+            arn=DOMAIN_ARN,
+            region=AWS_REGION_US_EAST_1,
+            security_policy=security_policy,
+        )
+    ]
+    return apigw_client
+
+
+class Test_apigateway_domain_name_pqc_tls_enabled:
+    @mock_aws
+    def test_no_domains(self):
+        apigw_client = mock.MagicMock()
+        apigw_client.audit_config = {}
+        apigw_client.domain_names = []
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled.apigateway_client",
+                new=apigw_client,
+            ):
+                from prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled import (
+                    apigateway_domain_name_pqc_tls_enabled,
+                )
+
+                check = apigateway_domain_name_pqc_tls_enabled()
+                result = check.execute()
+
+                assert len(result) == 0
+
+    @mock_aws
+    def test_tls13_only_policy_fails_by_default(self):
+        apigw_client = _build_client("SecurityPolicy_TLS13_1_3_2025_09")
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled.apigateway_client",
+                new=apigw_client,
+            ):
+                from prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled import (
+                    apigateway_domain_name_pqc_tls_enabled,
+                )
+
+                check = apigateway_domain_name_pqc_tls_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert "SecurityPolicy_TLS13_1_3_2025_09" in result[0].status_extended
+                assert "not in the post-quantum allowlist" in result[0].status_extended
+                assert result[0].resource_id == DOMAIN_NAME
+                assert result[0].resource_arn == DOMAIN_ARN
+                assert result[0].region == AWS_REGION_US_EAST_1
+
+    @mock_aws
+    def test_alternate_pq_policy(self):
+        apigw_client = _build_client("SecurityPolicy_TLS13_1_2_PQ_2025_09")
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled.apigateway_client",
+                new=apigw_client,
+            ):
+                from prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled import (
+                    apigateway_domain_name_pqc_tls_enabled,
+                )
+
+                check = apigateway_domain_name_pqc_tls_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+                assert (
+                    "SecurityPolicy_TLS13_1_2_PQ_2025_09" in result[0].status_extended
+                )
+
+    @mock_aws
+    def test_legacy_tls_1_2(self):
+        apigw_client = _build_client("TLS_1_2")
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled.apigateway_client",
+                new=apigw_client,
+            ):
+                from prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled import (
+                    apigateway_domain_name_pqc_tls_enabled,
+                )
+
+                check = apigateway_domain_name_pqc_tls_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert "TLS_1_2" in result[0].status_extended
+                assert "not in the post-quantum allowlist" in result[0].status_extended
+
+    @mock_aws
+    def test_missing_security_policy(self):
+        apigw_client = _build_client("")
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled.apigateway_client",
+                new=apigw_client,
+            ):
+                from prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled import (
+                    apigateway_domain_name_pqc_tls_enabled,
+                )
+
+                check = apigateway_domain_name_pqc_tls_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "FAIL"
+                assert "<none>" in result[0].status_extended
+
+    @mock_aws
+    def test_configurable_allowlist(self):
+        apigw_client = _build_client("TLS_1_2")
+        apigw_client.audit_config = {
+            "apigateway_pqc_tls_allowed_policies": [
+                "TLS_1_2",
+            ]
+        }
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled.apigateway_client",
+                new=apigw_client,
+            ):
+                from prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled import (
+                    apigateway_domain_name_pqc_tls_enabled,
+                )
+
+                check = apigateway_domain_name_pqc_tls_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+
+    @mock_aws
+    def test_null_config_uses_default_allowlist(self):
+        apigw_client = _build_client("SecurityPolicy_TLS13_1_2_PQ_2025_09")
+        apigw_client.audit_config = {
+            "apigateway_pqc_tls_allowed_policies": None,
+        }
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled.apigateway_client",
+                new=apigw_client,
+            ):
+                from prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled import (
+                    apigateway_domain_name_pqc_tls_enabled,
+                )
+
+                check = apigateway_domain_name_pqc_tls_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
+
+    @mock_aws
+    def test_non_iterable_config_uses_default_allowlist(self):
+        apigw_client = _build_client("SecurityPolicy_TLS13_1_2_PQ_2025_09")
+        apigw_client.audit_config = {
+            "apigateway_pqc_tls_allowed_policies": 123,
+        }
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ):
+            with mock.patch(
+                "prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled.apigateway_client",
+                new=apigw_client,
+            ):
+                from prowler.providers.aws.services.apigateway.apigateway_domain_name_pqc_tls_enabled.apigateway_domain_name_pqc_tls_enabled import (
+                    apigateway_domain_name_pqc_tls_enabled,
+                )
+
+                check = apigateway_domain_name_pqc_tls_enabled()
+                result = check.execute()
+
+                assert len(result) == 1
+                assert result[0].status == "PASS"
diff --git a/tests/providers/aws/services/apigateway/apigateway_service_test.py b/tests/providers/aws/services/apigateway/apigateway_service_test.py
index 9396693ec3..c153af2871 100644
--- a/tests/providers/aws/services/apigateway/apigateway_service_test.py
+++ b/tests/providers/aws/services/apigateway/apigateway_service_test.py
@@ -206,3 +206,26 @@ class Test_APIGateway_Service:
         assert list(apigateway.rest_apis[0].resources[1].resource_methods.values()) == [
             "AWS_IAM"
         ]
+
+    # Test APIGateway _get_domain_names
+    @mock_aws
+    def test_get_domain_names(self):
+        apigateway_client = client("apigateway", region_name=AWS_REGION_US_EAST_1)
+
+        apigateway_client.create_domain_name(
+            domainName="api.example.com",
+            securityPolicy="SecurityPolicy_TLS13_1_3_2025_09",
+        )
+
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        apigateway = APIGateway(aws_provider)
+
+        assert len(apigateway.domain_names) == 1
+        domain = apigateway.domain_names[0]
+        assert domain.name == "api.example.com"
+        assert domain.region == AWS_REGION_US_EAST_1
+        assert domain.security_policy == "SecurityPolicy_TLS13_1_3_2025_09"
+        assert (
+            domain.arn
+            == f"arn:aws:apigateway:{AWS_REGION_US_EAST_1}::/domainnames/api.example.com"
+        )

From 6826422a6a1b4883ff16bfe347f464cc24e22105 Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Tue, 23 Jun 2026 00:30:18 +0900
Subject: [PATCH 117/126] feat(azure): add
 entra_app_registration_credential_not_expired check (#11038)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   1 +
 .../compliance/azure/mitre_attack_azure.json  |   1 +
 .../azure/secnumcloud_3.2_azure.json          |   3 +-
 prowler/compliance/azure/soc2_azure.json      |   3 +-
 .../__init__.py                               |   0
 ...ation_credential_not_expired.metadata.json |  37 +++
 ...app_registration_credential_not_expired.py |  72 +++++
 .../azure/services/entra/entra_service.py     |  73 +++++
 ...egistration_credential_not_expired_test.py | 269 ++++++++++++++++++
 10 files changed, 458 insertions(+), 2 deletions(-)
 create mode 100644 prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/__init__.py
 create mode 100644 prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired.metadata.json
 create mode 100644 prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired.py
 create mode 100644 tests/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 003ed6b11f..e4bf63c602 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -30,6 +30,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `aks_cluster_local_accounts_disabled` check for Azure provider, verifying AKS clusters have local accounts disabled so authentication is forced through Microsoft Entra ID [(#11030)](https://github.com/prowler-cloud/prowler/pull/11030)
 - `network_subnet_nsg_associated` check for Azure provider, verifying virtual network subnets have a network security group associated to enforce traffic filtering [(#11043)](https://github.com/prowler-cloud/prowler/pull/11043)
 - `network_vnet_ddos_protection_enabled` check for Azure provider, verifying virtual networks have Azure DDoS Network Protection enabled [(#11044)](https://github.com/prowler-cloud/prowler/pull/11044)
+- `entra_app_registration_credential_not_expired` check for Azure provider, verifying Entra ID app registration secrets and certificates are not expired, expiring within 30 days, or without an expiration date [(#11038)](https://github.com/prowler-cloud/prowler/pull/11038)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index c1d92b1dc5..04da31be78 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1519,6 +1519,7 @@
       "Checks": [
         "app_minimum_tls_version_12",
         "cosmosdb_account_minimum_tls_version",
+        "entra_app_registration_credential_not_expired",
         "monitor_storage_account_with_activity_logs_cmk_encrypted",
         "sqlserver_tde_encrypted_with_cmk",
         "sqlserver_tde_encryption_enabled",
diff --git a/prowler/compliance/azure/mitre_attack_azure.json b/prowler/compliance/azure/mitre_attack_azure.json
index 92ddd72713..8b338da534 100644
--- a/prowler/compliance/azure/mitre_attack_azure.json
+++ b/prowler/compliance/azure/mitre_attack_azure.json
@@ -212,6 +212,7 @@
       "Description": "Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.[1] Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.",
       "TechniqueURL": "https://attack.mitre.org/techniques/T1078/",
       "Checks": [
+        "entra_app_registration_credential_not_expired",
         "entra_conditional_access_policy_require_mfa_for_management_api",
         "entra_global_admin_in_less_than_five_users",
         "entra_non_privileged_user_has_mfa",
diff --git a/prowler/compliance/azure/secnumcloud_3.2_azure.json b/prowler/compliance/azure/secnumcloud_3.2_azure.json
index ef8c94113e..ef6141d446 100644
--- a/prowler/compliance/azure/secnumcloud_3.2_azure.json
+++ b/prowler/compliance/azure/secnumcloud_3.2_azure.json
@@ -493,7 +493,8 @@
         "keyvault_non_rbac_secret_expiration_set",
         "keyvault_logging_enabled",
         "keyvault_private_endpoints",
-        "keyvault_access_only_through_private_endpoints"
+        "keyvault_access_only_through_private_endpoints",
+        "entra_app_registration_credential_not_expired"
       ]
     },
     {
diff --git a/prowler/compliance/azure/soc2_azure.json b/prowler/compliance/azure/soc2_azure.json
index 20db26baf9..e0839cedaa 100644
--- a/prowler/compliance/azure/soc2_azure.json
+++ b/prowler/compliance/azure/soc2_azure.json
@@ -241,7 +241,8 @@
         "app_function_not_publicly_accessible",
         "containerregistry_not_publicly_accessible",
         "network_public_ip_shodan",
-        "storage_blob_public_access_level_is_disabled"
+        "storage_blob_public_access_level_is_disabled",
+        "entra_app_registration_credential_not_expired"
       ]
     },
     {
diff --git a/prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/__init__.py b/prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired.metadata.json b/prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired.metadata.json
new file mode 100644
index 0000000000..c786fd49af
--- /dev/null
+++ b/prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "entra_app_registration_credential_not_expired",
+  "CheckTitle": "App registration credentials are not expired or expiring soon",
+  "CheckType": [],
+  "ServiceName": "entra",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "**Microsoft Entra ID** app registrations are evaluated for **credential validity**. Each app's password secrets and certificate credentials are checked for expiration. Credentials that are already expired, expiring within 30 days, or have no expiration date are flagged.",
+  "Risk": "Expired credentials cause **service outages** when apps can no longer authenticate. Credentials without expiration violate **least privilege** by persisting indefinitely. Long-lived or leaked secrets enable **unauthorized API access**, **data exfiltration**, and **lateral movement** via the app's permissions.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal",
+    "https://learn.microsoft.com/en-us/graph/api/resources/application"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az ad app credential reset --id <app_id> --years 1",
+      "NativeIaC": "",
+      "Other": "1. Sign in to Microsoft Entra admin center\n2. Go to Identity > Applications > App registrations\n3. Select the application with the expiring credential\n4. Go to Certificates & secrets\n5. Delete the expired credential\n6. Add a new credential with an appropriate expiration (recommended: 6-12 months)\n7. Update the consuming application with the new credential\n8. Consider migrating to managed identities or federated credentials where possible",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Rotate app registration credentials before expiration. Set expiration to 6-12 months maximum. Prefer **managed identities** or **federated credentials** over secrets. Monitor credential expiry with Azure Monitor alerts or Microsoft Entra workbooks.",
+      "Url": "https://hub.prowler.com/check/entra_app_registration_credential_not_expired"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check evaluates both password secrets and certificate credentials. Each credential is reported individually. Apps with no credentials are skipped."
+}
diff --git a/prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired.py b/prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired.py
new file mode 100644
index 0000000000..5cbdf009a0
--- /dev/null
+++ b/prowler/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired.py
@@ -0,0 +1,72 @@
+from datetime import datetime, timezone
+
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.entra.entra_client import entra_client
+
+EXPIRY_WARNING_DAYS = 30
+
+
+class entra_app_registration_credential_not_expired(Check):
+    """
+    Ensure Microsoft Entra ID app registration credentials are not expired or expiring soon.
+
+    This check evaluates each app registration's password secrets and certificate credentials. A credential is reported individually and flagged when it is already expired, expiring within 30 days, or has no expiration date. Apps with no credentials are skipped.
+
+    - PASS: The credential is valid for more than 30 days.
+    - FAIL: The credential is expired, expiring within 30 days, or has no expiration date.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for tenant_domain, apps in entra_client.app_registrations.items():
+            for app_id, app in apps.items():
+                if not app.credentials:
+                    continue
+
+                for credential in app.credentials:
+                    report = Check_Report_Azure(metadata=self.metadata(), resource=app)
+                    report.subscription = f"Tenant: {tenant_domain}"
+                    report.resource_name = (
+                        f"{app.name} ({credential.credential_type}: "
+                        f"{credential.display_name or 'unnamed'})"
+                    )
+
+                    if credential.end_date_time is None:
+                        report.status = "FAIL"
+                        report.status_extended = (
+                            f"App '{app.name}' has a {credential.credential_type} "
+                            f"credential with no expiration date."
+                        )
+                    else:
+                        now = datetime.now(timezone.utc)
+                        end = credential.end_date_time
+                        if end.tzinfo is None:
+                            end = end.replace(tzinfo=timezone.utc)
+                        if end <= now:
+                            days_ago = (now - end).days
+                            report.status = "FAIL"
+                            report.status_extended = (
+                                f"App '{app.name}' has a {credential.credential_type} "
+                                f"credential that expired {days_ago} days ago."
+                            )
+                        elif (end - now).days <= EXPIRY_WARNING_DAYS:
+                            days_left = (end - now).days
+                            report.status = "FAIL"
+                            report.status_extended = (
+                                f"App '{app.name}' has a {credential.credential_type} "
+                                f"credential expiring in {days_left} days (within the "
+                                f"{EXPIRY_WARNING_DAYS}-day rotation threshold); rotate it soon."
+                            )
+                        else:
+                            days_left = (end - now).days
+                            report.status = "PASS"
+                            report.status_extended = (
+                                f"App '{app.name}' has a {credential.credential_type} "
+                                f"credential valid for {days_left} more days (beyond the "
+                                f"{EXPIRY_WARNING_DAYS}-day rotation threshold)."
+                            )
+
+                    findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/entra/entra_service.py b/prowler/providers/azure/services/entra/entra_service.py
index eb1d62ac11..cda5070ec3 100644
--- a/prowler/providers/azure/services/entra/entra_service.py
+++ b/prowler/providers/azure/services/entra/entra_service.py
@@ -1,5 +1,6 @@
 import asyncio
 from asyncio import gather
+from datetime import datetime
 from typing import List, Optional
 from uuid import UUID
 
@@ -49,6 +50,7 @@ class Entra(AzureService):
                 self._get_named_locations(),
                 self._get_directory_roles(),
                 self._get_conditional_access_policy(),
+                self._get_app_registrations(),
             )
         )
 
@@ -58,6 +60,7 @@ class Entra(AzureService):
         self.named_locations = attributes[3]
         self.directory_roles = attributes[4]
         self.conditional_access_policy = attributes[5]
+        self.app_registrations = attributes[6]
 
         if created_loop:
             asyncio.set_event_loop(None)
@@ -416,6 +419,64 @@ class Entra(AzureService):
 
         return conditional_access_policy
 
+    async def _get_app_registrations(self):
+        logger.info("Entra - Getting app registrations...")
+        app_registrations = {}
+        try:
+            for tenant, client in self.clients.items():
+                app_registrations[tenant] = {}
+                apps_response = await client.applications.get()
+
+                try:
+                    while apps_response:
+                        for app in getattr(apps_response, "value", []) or []:
+                            credentials = []
+                            for cred in getattr(app, "password_credentials", []) or []:
+                                credentials.append(
+                                    AppCredential(
+                                        display_name=getattr(cred, "display_name", "")
+                                        or "",
+                                        credential_type="password",
+                                        end_date_time=getattr(
+                                            cred, "end_date_time", None
+                                        ),
+                                    )
+                                )
+                            for cred in getattr(app, "key_credentials", []) or []:
+                                credentials.append(
+                                    AppCredential(
+                                        display_name=getattr(cred, "display_name", "")
+                                        or "",
+                                        credential_type="certificate",
+                                        end_date_time=getattr(
+                                            cred, "end_date_time", None
+                                        ),
+                                    )
+                                )
+                            app_registrations[tenant][app.id] = AppRegistration(
+                                id=app.id,
+                                name=getattr(app, "display_name", "") or "",
+                                credentials=credentials,
+                            )
+
+                        next_link = getattr(apps_response, "odata_next_link", None)
+                        if not next_link:
+                            break
+                        apps_response = await client.applications.with_url(
+                            next_link
+                        ).get()
+
+                except Exception as error:
+                    logger.error(
+                        f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                    )
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+        return app_registrations
+
 
 class User(BaseModel):
     id: str
@@ -481,3 +542,15 @@ class ConditionalAccessPolicy(BaseModel):
     users: dict[str, List[str]]
     target_resources: dict[str, List[str]]
     access_controls: dict[str, List[str]]
+
+
+class AppCredential(BaseModel):
+    display_name: str = ""
+    credential_type: str  # "password" or "certificate"
+    end_date_time: Optional[datetime] = None
+
+
+class AppRegistration(BaseModel):
+    id: str
+    name: str
+    credentials: List[AppCredential] = []
diff --git a/tests/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired_test.py b/tests/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired_test.py
new file mode 100644
index 0000000000..89fa5bac16
--- /dev/null
+++ b/tests/providers/azure/services/entra/entra_app_registration_credential_not_expired/entra_app_registration_credential_not_expired_test.py
@@ -0,0 +1,269 @@
+from datetime import datetime, timezone, timedelta
+from unittest import mock
+from uuid import uuid4
+
+from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provider
+
+
+class Test_entra_app_registration_credential_not_expired:
+    def test_entra_no_tenants(self):
+        entra_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired import (
+                entra_app_registration_credential_not_expired,
+            )
+
+            entra_client.app_registrations = {}
+
+            check = entra_app_registration_credential_not_expired()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_entra_app_no_credentials(self):
+        entra_client = mock.MagicMock
+        app_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired import (
+                entra_app_registration_credential_not_expired,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AppRegistration,
+            )
+
+            app = AppRegistration(id=app_id, name="no-creds-app", credentials=[])
+            entra_client.app_registrations = {DOMAIN: {app_id: app}}
+
+            check = entra_app_registration_credential_not_expired()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_entra_app_credential_expired(self):
+        entra_client = mock.MagicMock
+        app_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired import (
+                entra_app_registration_credential_not_expired,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AppCredential,
+                AppRegistration,
+            )
+
+            app = AppRegistration(
+                id=app_id,
+                name="expired-app",
+                credentials=[
+                    AppCredential(
+                        display_name="old-secret",
+                        credential_type="password",
+                        end_date_time=datetime.now(timezone.utc) - timedelta(days=30),
+                    )
+                ],
+            )
+            entra_client.app_registrations = {DOMAIN: {app_id: app}}
+
+            check = entra_app_registration_credential_not_expired()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "expired" in result[0].status_extended
+
+    def test_entra_app_credential_expiring_soon(self):
+        entra_client = mock.MagicMock
+        app_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired import (
+                entra_app_registration_credential_not_expired,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AppCredential,
+                AppRegistration,
+            )
+
+            app = AppRegistration(
+                id=app_id,
+                name="expiring-soon-app",
+                credentials=[
+                    AppCredential(
+                        display_name="expiring-cert",
+                        credential_type="certificate",
+                        end_date_time=datetime.now(timezone.utc) + timedelta(days=15),
+                    )
+                ],
+            )
+            entra_client.app_registrations = {DOMAIN: {app_id: app}}
+
+            check = entra_app_registration_credential_not_expired()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "expiring in" in result[0].status_extended
+
+    def test_entra_app_credential_no_expiration(self):
+        entra_client = mock.MagicMock
+        app_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired import (
+                entra_app_registration_credential_not_expired,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AppCredential,
+                AppRegistration,
+            )
+
+            app = AppRegistration(
+                id=app_id,
+                name="no-expiry-app",
+                credentials=[
+                    AppCredential(
+                        display_name="forever-secret",
+                        credential_type="password",
+                        end_date_time=None,
+                    )
+                ],
+            )
+            entra_client.app_registrations = {DOMAIN: {app_id: app}}
+
+            check = entra_app_registration_credential_not_expired()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "no expiration" in result[0].status_extended
+
+    def test_entra_app_credential_valid(self):
+        entra_client = mock.MagicMock
+        app_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired import (
+                entra_app_registration_credential_not_expired,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AppCredential,
+                AppRegistration,
+            )
+
+            app = AppRegistration(
+                id=app_id,
+                name="healthy-app",
+                credentials=[
+                    AppCredential(
+                        display_name="good-secret",
+                        credential_type="password",
+                        end_date_time=datetime.now(timezone.utc) + timedelta(days=180),
+                    )
+                ],
+            )
+            entra_client.app_registrations = {DOMAIN: {app_id: app}}
+
+            check = entra_app_registration_credential_not_expired()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "more days" in result[0].status_extended
+
+    def test_entra_app_multiple_credentials_mixed(self):
+        entra_client = mock.MagicMock
+        app_id = str(uuid4())
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired.entra_client",
+                new=entra_client,
+            ),
+        ):
+            from prowler.providers.azure.services.entra.entra_app_registration_credential_not_expired.entra_app_registration_credential_not_expired import (
+                entra_app_registration_credential_not_expired,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AppCredential,
+                AppRegistration,
+            )
+
+            app = AppRegistration(
+                id=app_id,
+                name="mixed-app",
+                credentials=[
+                    AppCredential(
+                        display_name="expired-one",
+                        credential_type="password",
+                        end_date_time=datetime.now(timezone.utc) - timedelta(days=10),
+                    ),
+                    AppCredential(
+                        display_name="valid-one",
+                        credential_type="certificate",
+                        end_date_time=datetime.now(timezone.utc) + timedelta(days=200),
+                    ),
+                ],
+            )
+            entra_client.app_registrations = {DOMAIN: {app_id: app}}
+
+            check = entra_app_registration_credential_not_expired()
+            result = check.execute()
+            assert len(result) == 2
+            statuses = {r.status for r in result}
+            assert "FAIL" in statuses
+            assert "PASS" in statuses

From 10d9fc35e6269a2b954a224eff52834f1ceb3ba9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Mon, 22 Jun 2026 17:44:51 +0200
Subject: [PATCH 118/126] feat(aws): add
 cloudfront_distributions_pqc_tls_enabled check (#11317)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 contrib/k8s/helm/prowler-api/values.yaml      |   3 +
 .../cli/tutorials/configuration_file.mdx      |   1 +
 prowler/CHANGELOG.md                          |   1 +
 ...itected_framework_security_pillar_aws.json |   1 +
 prowler/compliance/aws/ccc_aws.json           |   1 +
 prowler/compliance/aws/ens_rd2022_aws.json    |   2 +
 .../aws/fedramp_moderate_revision_4_aws.json  |   2 +
 prowler/compliance/aws/ffiec_aws.json         |   1 +
 .../aws/gxp_21_cfr_part_11_aws.json           |   1 +
 prowler/compliance/aws/iso27001_2013_aws.json |   1 +
 .../compliance/aws/kisa_isms_p_2023_aws.json  |   2 +
 .../aws/kisa_isms_p_2023_korean_aws.json      |   2 +
 .../aws/nist_800_171_revision_2_aws.json      |   1 +
 .../aws/nist_800_53_revision_5_aws.json       |   2 +
 .../aws/rbi_cyber_security_framework_aws.json |   1 +
 .../compliance/aws/secnumcloud_3.2_aws.json   |   1 +
 prowler/config/config.yaml                    |   4 +
 .../__init__.py                               |   0
 ...istributions_pqc_tls_enabled.metadata.json |  43 +++++
 ...loudfront_distributions_pqc_tls_enabled.py |  56 +++++++
 .../services/cloudfront/cloudfront_service.py |   5 +
 ...ront_distributions_pqc_tls_enabled_test.py | 158 ++++++++++++++++++
 .../cloudfront/cloudfront_service_test.py     |   7 +
 23 files changed, 296 insertions(+)
 create mode 100644 prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/__init__.py
 create mode 100644 prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled.metadata.json
 create mode 100644 prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled.py
 create mode 100644 tests/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled_test.py

diff --git a/contrib/k8s/helm/prowler-api/values.yaml b/contrib/k8s/helm/prowler-api/values.yaml
index db861f7b88..32149aeb7f 100644
--- a/contrib/k8s/helm/prowler-api/values.yaml
+++ b/contrib/k8s/helm/prowler-api/values.yaml
@@ -439,6 +439,9 @@ mainConfig:
     elbv2_min_azs: 2
 
     # AWS Post-Quantum TLS Configuration
+    # aws.cloudfront_distributions_pqc_tls_enabled
+    cloudfront_pqc_min_protocol_versions:
+      - "TLSv1.3_2025"
     # aws.apigateway_domain_name_pqc_tls_enabled
     apigateway_pqc_tls_allowed_policies:
       - "SecurityPolicy_TLS13_1_2_FIPS_PFS_PQ_2025_09"
diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx
index 58f30f413d..9f9f38a0dc 100644
--- a/docs/user-guide/cli/tutorials/configuration_file.mdx
+++ b/docs/user-guide/cli/tutorials/configuration_file.mdx
@@ -55,6 +55,7 @@ The following list includes all the AWS checks with configurable variables that
 | `elasticache_redis_cluster_backup_enabled`                    | `minimum_snapshot_retention_period`              | Integer         |
 | `elb_is_in_multiple_az`                                       | `elb_min_azs`                                    | Integer         |
 | `elbv2_is_in_multiple_az`                                     | `elbv2_min_azs`                                  | Integer         |
+| `cloudfront_distributions_pqc_tls_enabled`                    | `cloudfront_pqc_min_protocol_versions`           | List of Strings |
 | `apigateway_domain_name_pqc_tls_enabled`                      | `apigateway_pqc_tls_allowed_policies`            | List of Strings |
 | `guardduty_is_enabled`                                        | `mute_non_default_regions`                       | Boolean         |
 | `iam_user_access_not_stale_to_sagemaker`                      | `max_unused_sagemaker_access_days`               | Integer         |
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index e4bf63c602..731f774d1a 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -44,6 +44,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the GCP provider, mapping existing GCP checks across the five DORA pillars [(#11642)](https://github.com/prowler-cloud/prowler/pull/11642)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Cloudflare provider, mapping existing Cloudflare edge/network checks across the applicable DORA pillars [(#11645)](https://github.com/prowler-cloud/prowler/pull/11645)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the AlibabaCloud provider, mapping existing AlibabaCloud checks across the applicable DORA pillars [(#11646)](https://github.com/prowler-cloud/prowler/pull/11646)
+- `cloudfront_distributions_pqc_tls_enabled` check for AWS provider to verify CloudFront distributions enforce a post-quantum TLS 1.3 security policy [(#11317)](https://github.com/prowler-cloud/prowler/pull/11317)
 - `apigateway_domain_name_pqc_tls_enabled` check for AWS provider to verify API Gateway custom domain names use a post-quantum TLS security policy [(#11316)](https://github.com/prowler-cloud/prowler/pull/11316)
 - `transfer_server_pqc_ssh_kex_enabled` check for AWS provider to verify Transfer Family servers use a post-quantum hybrid SSH key exchange security policy [(#11315)](https://github.com/prowler-cloud/prowler/pull/11315)
 
diff --git a/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json b/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
index 8002f5d61c..4c4eaee252 100644
--- a/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
+++ b/prowler/compliance/aws/aws_well_architected_framework_security_pillar_aws.json
@@ -1151,6 +1151,7 @@
         "elb_insecure_ssl_ciphers",
         "elb_ssl_listeners",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_ssl_listeners",
diff --git a/prowler/compliance/aws/ccc_aws.json b/prowler/compliance/aws/ccc_aws.json
index 7fec0c7d71..003e9e17a0 100644
--- a/prowler/compliance/aws/ccc_aws.json
+++ b/prowler/compliance/aws/ccc_aws.json
@@ -49,6 +49,7 @@
         "elb_insecure_ssl_ciphers",
         "elb_ssl_listeners",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_ssl_listeners",
diff --git a/prowler/compliance/aws/ens_rd2022_aws.json b/prowler/compliance/aws/ens_rd2022_aws.json
index 7b0658c040..8fcd3263e9 100644
--- a/prowler/compliance/aws/ens_rd2022_aws.json
+++ b/prowler/compliance/aws/ens_rd2022_aws.json
@@ -2367,6 +2367,7 @@
       ],
       "Checks": [
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled"
       ]
@@ -2392,6 +2393,7 @@
       ],
       "Checks": [
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled"
       ]
diff --git a/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json b/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
index 11ce0fc381..11f66ada6b 100644
--- a/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
+++ b/prowler/compliance/aws/fedramp_moderate_revision_4_aws.json
@@ -1145,6 +1145,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
@@ -1166,6 +1167,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
diff --git a/prowler/compliance/aws/ffiec_aws.json b/prowler/compliance/aws/ffiec_aws.json
index 5a7fa14bc3..53f7275a85 100644
--- a/prowler/compliance/aws/ffiec_aws.json
+++ b/prowler/compliance/aws/ffiec_aws.json
@@ -487,6 +487,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
diff --git a/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json b/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
index 022a778bad..bcf8f19c3b 100644
--- a/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
+++ b/prowler/compliance/aws/gxp_21_cfr_part_11_aws.json
@@ -266,6 +266,7 @@
         "ec2_ebs_default_encryption",
         "efs_encryption_at_rest_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
diff --git a/prowler/compliance/aws/iso27001_2013_aws.json b/prowler/compliance/aws/iso27001_2013_aws.json
index 791aea8993..190693d121 100644
--- a/prowler/compliance/aws/iso27001_2013_aws.json
+++ b/prowler/compliance/aws/iso27001_2013_aws.json
@@ -36,6 +36,7 @@
       "Checks": [
         "elb_insecure_ssl_ciphers",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled"
       ]
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
index 734a92e8d3..c24b5a23e5 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_aws.json
@@ -2040,6 +2040,7 @@
         "elb_ssl_listeners",
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_nlb_tls_termination_enabled",
@@ -3092,6 +3093,7 @@
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_desync_mitigation_mode",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_internet_facing",
diff --git a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
index 05ef1c0082..50e2a149a5 100644
--- a/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
+++ b/prowler/compliance/aws/kisa_isms_p_2023_korean_aws.json
@@ -2042,6 +2042,7 @@
         "elb_ssl_listeners",
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_nlb_tls_termination_enabled",
@@ -3095,6 +3096,7 @@
         "elb_ssl_listeners_use_acm_certificate",
         "elbv2_desync_mitigation_mode",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elbv2_internet_facing",
diff --git a/prowler/compliance/aws/nist_800_171_revision_2_aws.json b/prowler/compliance/aws/nist_800_171_revision_2_aws.json
index d5a55398ce..e5a456bbb3 100644
--- a/prowler/compliance/aws/nist_800_171_revision_2_aws.json
+++ b/prowler/compliance/aws/nist_800_171_revision_2_aws.json
@@ -653,6 +653,7 @@
         "apigateway_restapi_client_certificate_enabled",
         "ec2_ebs_volume_encryption",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "opensearch_service_domains_node_to_node_encryption_enabled",
diff --git a/prowler/compliance/aws/nist_800_53_revision_5_aws.json b/prowler/compliance/aws/nist_800_53_revision_5_aws.json
index a1cf795225..c9eb755e49 100644
--- a/prowler/compliance/aws/nist_800_53_revision_5_aws.json
+++ b/prowler/compliance/aws/nist_800_53_revision_5_aws.json
@@ -5262,6 +5262,7 @@
       "Checks": [
         "apigateway_restapi_client_certificate_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
@@ -5551,6 +5552,7 @@
       ],
       "Checks": [
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners"
diff --git a/prowler/compliance/aws/rbi_cyber_security_framework_aws.json b/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
index 46d2411902..f4e8d1d70e 100644
--- a/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
+++ b/prowler/compliance/aws/rbi_cyber_security_framework_aws.json
@@ -40,6 +40,7 @@
         "ec2_instance_public_ip",
         "efs_encryption_at_rest_enabled",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "elb_ssl_listeners",
diff --git a/prowler/compliance/aws/secnumcloud_3.2_aws.json b/prowler/compliance/aws/secnumcloud_3.2_aws.json
index c49e7c201a..d8736c2d6b 100644
--- a/prowler/compliance/aws/secnumcloud_3.2_aws.json
+++ b/prowler/compliance/aws/secnumcloud_3.2_aws.json
@@ -474,6 +474,7 @@
         "elbv2_ssl_listeners",
         "elb_insecure_ssl_ciphers",
         "elbv2_insecure_ssl_ciphers",
+        "cloudfront_distributions_pqc_tls_enabled",
         "apigateway_domain_name_pqc_tls_enabled",
         "transfer_server_pqc_ssh_kex_enabled",
         "redshift_cluster_in_transit_encryption_enabled",
diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml
index 004fa1207a..0e063de264 100644
--- a/prowler/config/config.yaml
+++ b/prowler/config/config.yaml
@@ -381,6 +381,10 @@ aws:
   elbv2_min_azs: 2
 
   # AWS Post-Quantum TLS Configuration
+  # aws.cloudfront_distributions_pqc_tls_enabled
+  # Allowed CloudFront MinimumProtocolVersion values that enable post-quantum hybrid key exchange
+  cloudfront_pqc_min_protocol_versions:
+    - "TLSv1.3_2025"
   # aws.apigateway_domain_name_pqc_tls_enabled
   # Allowed post-quantum TLS security policies for API Gateway custom domain names
   apigateway_pqc_tls_allowed_policies:
diff --git a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/__init__.py b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled.metadata.json b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled.metadata.json
new file mode 100644
index 0000000000..465f4335c2
--- /dev/null
+++ b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled.metadata.json
@@ -0,0 +1,43 @@
+{
+  "Provider": "aws",
+  "CheckID": "cloudfront_distributions_pqc_tls_enabled",
+  "CheckTitle": "CloudFront distributions enforce a post-quantum TLS 1.3 security policy",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "cloudfront",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "AwsCloudFrontDistribution",
+  "ResourceGroup": "network",
+  "Description": "**CloudFront distributions** are assessed for use of a **TLS 1.3-only security policy** (`TLSv1.3_2025`). CloudFront's quantum-safe key exchanges (`X25519MLKEM768`, `SecP256r1MLKEM768`) only work with TLS 1.3. Distributions that allow TLS 1.2 (or older) fallback to classical key exchanges and are exposed to `harvest-now, decrypt-later` attacks.",
+  "Risk": "Without a TLS 1.3-only policy, viewer traffic captured today can be decrypted once a **cryptographically relevant quantum computer** is available. Distributions using the default CloudFront certificate (`*.cloudfront.net`) cannot enable a post-quantum policy because they are pinned to the legacy `TLSv1` policy.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/secure-connections-supported-viewer-protocols-ciphers.html",
+    "https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/DownloadDistValuesGeneral.html#DownloadDistValues-security-policy",
+    "https://aws.amazon.com/security/post-quantum-cryptography/",
+    "https://csrc.nist.gov/projects/post-quantum-cryptography"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws cloudfront update-distribution --id <distribution_id> --distribution-config '{...\"ViewerCertificate\":{\"MinimumProtocolVersion\":\"TLSv1.3_2025\",...}}'",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::CloudFront::Distribution\n    Properties:\n      DistributionConfig:\n        ViewerCertificate:\n          AcmCertificateArn: <example_certificate_arn>\n          SslSupportMethod: sni-only\n          MinimumProtocolVersion: TLSv1.3_2025  # FIX: enforces TLS 1.3 + post-quantum KEX\n```",
+      "Other": "1. In the AWS Console, go to CloudFront > Distributions\n2. Select the distribution and open the General tab\n3. Choose Edit on Settings\n4. Set Custom SSL certificate (do not use the default *.cloudfront.net certificate)\n5. Set Security policy to TLSv1.3_2025\n6. Save changes",
+      "Terraform": "```hcl\nresource \"aws_cloudfront_distribution\" \"<example_resource_name>\" {\n  # ...\n  viewer_certificate {\n    acm_certificate_arn      = \"<example_certificate_arn>\"\n    ssl_support_method       = \"sni-only\"\n    minimum_protocol_version = \"TLSv1.3_2025\" # FIX: enforces TLS 1.3 + post-quantum KEX\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Use a **custom SSL certificate** with **SNI** support and set `MinimumProtocolVersion` to `TLSv1.3_2025` so CloudFront refuses TLS 1.2 handshakes and uses the hybrid ML-KEM key exchange. Distributions still using the default CloudFront certificate must be migrated to a custom certificate to enable post-quantum TLS.",
+      "Url": "https://hub.prowler.com/check/cloudfront_distributions_pqc_tls_enabled"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [
+    "cloudfront_distributions_using_deprecated_ssl_protocols"
+  ],
+  "Notes": ""
+}
diff --git a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled.py b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled.py
new file mode 100644
index 0000000000..6c472d43c7
--- /dev/null
+++ b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled.py
@@ -0,0 +1,56 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.cloudfront.cloudfront_client import (
+    cloudfront_client,
+)
+
+PQC_CLOUDFRONT_POLICIES_DEFAULT = [
+    "TLSv1.3_2025",
+]
+
+
+class cloudfront_distributions_pqc_tls_enabled(Check):
+    """Verify that every CloudFront distribution enforces TLS 1.3 with post-quantum key exchange.
+
+    Quantum-safe key exchanges (``X25519MLKEM768``, ``SecP256r1MLKEM768``) are
+    only available on TLS 1.3 viewer connections. A distribution PASSES when
+    its ``MinimumProtocolVersion`` belongs to the configured allowlist of
+    TLS 1.3-only policies. Distributions that rely on the default CloudFront
+    certificate are pinned to the legacy ``TLSv1`` policy and therefore FAIL.
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the CloudFront post-quantum TLS policy check.
+
+        Returns:
+            A list of reports containing each CloudFront distribution's
+            post-quantum TLS compliance status.
+        """
+        findings = []
+        pqc_policies = cloudfront_client.audit_config.get(
+            "cloudfront_pqc_min_protocol_versions", PQC_CLOUDFRONT_POLICIES_DEFAULT
+        )
+        for distribution in cloudfront_client.distributions.values():
+            report = Check_Report_AWS(metadata=self.metadata(), resource=distribution)
+            policy = distribution.minimum_protocol_version or "<none>"
+            if distribution.default_certificate:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"CloudFront Distribution {distribution.id} uses the default "
+                    "CloudFront certificate, which pins the security policy to "
+                    "TLSv1 and cannot enable post-quantum TLS."
+                )
+            elif distribution.minimum_protocol_version in pqc_policies:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"CloudFront Distribution {distribution.id} uses post-quantum "
+                    f"TLS policy {policy}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"CloudFront Distribution {distribution.id} uses TLS policy "
+                    f"{policy}, which is not in the post-quantum allowlist."
+                )
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/cloudfront/cloudfront_service.py b/prowler/providers/aws/services/cloudfront/cloudfront_service.py
index 0826c9adfd..660b483c4c 100644
--- a/prowler/providers/aws/services/cloudfront/cloudfront_service.py
+++ b/prowler/providers/aws/services/cloudfront/cloudfront_service.py
@@ -48,6 +48,9 @@ class CloudFront(AWSService):
                                     "SSLSupportMethod", "static-ip"
                                 )
                             )
+                            minimum_protocol_version = item["ViewerCertificate"].get(
+                                "MinimumProtocolVersion", ""
+                            )
                             origins = []
                             for origin in item.get("Origins", {}).get("Items", []):
                                 origins.append(
@@ -79,6 +82,7 @@ class CloudFront(AWSService):
                                 ssl_support_method=ssl_support_method,
                                 default_certificate=default_certificate,
                                 certificate=certificate,
+                                minimum_protocol_version=minimum_protocol_version,
                             )
                             self.distributions[distribution_id] = distribution
 
@@ -268,3 +272,4 @@ class Distribution(BaseModel):
     origin_failover: Optional[bool] = None
     ssl_support_method: Optional[SSLSupportMethod] = None
     certificate: Optional[str] = None
+    minimum_protocol_version: str = ""
diff --git a/tests/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled_test.py b/tests/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled_test.py
new file mode 100644
index 0000000000..5170d5538d
--- /dev/null
+++ b/tests/providers/aws/services/cloudfront/cloudfront_distributions_pqc_tls_enabled/cloudfront_distributions_pqc_tls_enabled_test.py
@@ -0,0 +1,158 @@
+import sys
+from unittest import mock
+
+from prowler.providers.aws.services.cloudfront.cloudfront_service import (
+    Distribution,
+    Origin,
+)
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+DISTRIBUTION_ID = "E27LVI50CSW06W"
+DISTRIBUTION_ARN = (
+    f"arn:aws:cloudfront::{AWS_ACCOUNT_NUMBER}:distribution/{DISTRIBUTION_ID}"
+)
+REGION = "us-east-1"
+CHECK_MODULE = "prowler.providers.aws.services.cloudfront.cloudfront_distributions_pqc_tls_enabled.cloudfront_distributions_pqc_tls_enabled"
+CLIENT_MODULE = "prowler.providers.aws.services.cloudfront.cloudfront_client"
+
+
+def _clear_cloudfront_modules():
+    sys.modules.pop(CHECK_MODULE, None)
+    sys.modules.pop(CLIENT_MODULE, None)
+
+
+def _build_distribution(
+    *,
+    minimum_protocol_version: str,
+    default_certificate: bool = False,
+):
+    return Distribution(
+        arn=DISTRIBUTION_ARN,
+        id=DISTRIBUTION_ID,
+        region=REGION,
+        origins=[
+            Origin(
+                id="o1",
+                domain_name="origin.example.com",
+                origin_protocol_policy="https-only",
+                origin_ssl_protocols=["TLSv1.2"],
+            )
+        ],
+        origin_failover=False,
+        minimum_protocol_version=minimum_protocol_version,
+        default_certificate=default_certificate,
+    )
+
+
+def _build_client(distributions: dict, audit_config: dict | None = None):
+    cloudfront_client = mock.MagicMock()
+    cloudfront_client.distributions = distributions
+    cloudfront_client.audit_config = audit_config or {}
+    return cloudfront_client
+
+
+def _execute_check(cloudfront_client):
+    aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+    _clear_cloudfront_modules()
+
+    try:
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.cloudfront.cloudfront_service.CloudFront",
+                return_value=cloudfront_client,
+            ),
+        ):
+            from prowler.providers.aws.services.cloudfront.cloudfront_distributions_pqc_tls_enabled.cloudfront_distributions_pqc_tls_enabled import (
+                cloudfront_distributions_pqc_tls_enabled,
+            )
+
+            check = cloudfront_distributions_pqc_tls_enabled()
+            return check.execute()
+    finally:
+        _clear_cloudfront_modules()
+
+
+class Test_cloudfront_distributions_pqc_tls_enabled:
+    def test_no_distributions(self):
+        cloudfront_client = _build_client({})
+
+        result = _execute_check(cloudfront_client)
+
+        assert len(result) == 0
+
+    def test_pq_policy_tls13_2025(self):
+        cloudfront_client = _build_client(
+            {
+                DISTRIBUTION_ID: _build_distribution(
+                    minimum_protocol_version="TLSv1.3_2025"
+                )
+            }
+        )
+
+        result = _execute_check(cloudfront_client)
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert "TLSv1.3_2025" in result[0].status_extended
+        assert result[0].resource_id == DISTRIBUTION_ID
+        assert result[0].resource_arn == DISTRIBUTION_ARN
+
+    def test_classical_tls12_2021(self):
+        cloudfront_client = _build_client(
+            {
+                DISTRIBUTION_ID: _build_distribution(
+                    minimum_protocol_version="TLSv1.2_2021"
+                )
+            }
+        )
+
+        result = _execute_check(cloudfront_client)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "TLSv1.2_2021" in result[0].status_extended
+        assert "not in the post-quantum allowlist" in result[0].status_extended
+
+    def test_default_cloudfront_certificate(self):
+        cloudfront_client = _build_client(
+            {
+                DISTRIBUTION_ID: _build_distribution(
+                    minimum_protocol_version="TLSv1",
+                    default_certificate=True,
+                )
+            }
+        )
+
+        result = _execute_check(cloudfront_client)
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert "default CloudFront certificate" in result[0].status_extended
+
+    def test_configurable_allowlist(self):
+        cloudfront_client = _build_client(
+            {
+                DISTRIBUTION_ID: _build_distribution(
+                    minimum_protocol_version="TLSv1.2_2021"
+                )
+            },
+            audit_config={
+                "cloudfront_pqc_min_protocol_versions": [
+                    "TLSv1.3_2025",
+                    "TLSv1.2_2021",
+                ]
+            },
+        )
+
+        result = _execute_check(cloudfront_client)
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
diff --git a/tests/providers/aws/services/cloudfront/cloudfront_service_test.py b/tests/providers/aws/services/cloudfront/cloudfront_service_test.py
index 4c0a9b349e..5dd6f712a7 100644
--- a/tests/providers/aws/services/cloudfront/cloudfront_service_test.py
+++ b/tests/providers/aws/services/cloudfront/cloudfront_service_test.py
@@ -64,6 +64,7 @@ def example_distribution_config(ref):
         "ViewerCertificate": {
             "SSLSupportMethod": "static-ip",
             "Certificate": "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012",
+            "MinimumProtocolVersion": "TLSv1.3_2025",
         },
         "Comment": "an optional comment that's not actually optional",
         "Enabled": False,
@@ -234,6 +235,7 @@ class Test_CloudFront_Service:
         ]
         SSL_SUPPORT_METHOD = SSLSupportMethod.sni_only
         CERTIFICATE = "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"
+        MINIMUM_PROTOCOL_VERSION = "TLSv1.3_2025"
 
         cloudfront = mock.MagicMock
         cloudfront.distributions = {
@@ -249,6 +251,7 @@ class Test_CloudFront_Service:
                 tags=TAGS,
                 ssl_support_method=SSL_SUPPORT_METHOD,
                 certificate=CERTIFICATE,
+                minimum_protocol_version=MINIMUM_PROTOCOL_VERSION,
             )
         }
 
@@ -288,6 +291,10 @@ class Test_CloudFront_Service:
             == DEFAULT_CACHE_CONFIG.field_level_encryption_id
         )
         assert cloudfront.distributions[DISTRIBUTION_ID].tags == TAGS
+        assert (
+            cloudfront.distributions[DISTRIBUTION_ID].minimum_protocol_version
+            == MINIMUM_PROTOCOL_VERSION
+        )
 
     def test_get_log_delivery_sources_with_active_delivery(self):
         from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER

From bdd44a0dce1eca68a3b321f6bc90ebf6b5bfc51c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Mon, 22 Jun 2026 18:13:17 +0200
Subject: [PATCH 119/126] feat(aws): add acmpca service and pqc key algorithm
 check (#11318)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 contrib/k8s/helm/prowler-api/values.yaml      |   5 +
 .../cli/tutorials/configuration_file.mdx      |   2 +
 prowler/CHANGELOG.md                          |   1 +
 prowler/config/config.yaml                    |   6 +
 .../providers/aws/services/acmpca/__init__.py |   0
 .../__init__.py                               |   0
 ..._authority_pqc_key_algorithm.metadata.json |  41 +++++
 ...certificate_authority_pqc_key_algorithm.py |  49 ++++++
 .../aws/services/acmpca/acmpca_client.py      |   4 +
 .../aws/services/acmpca/acmpca_service.py     |  97 +++++++++++
 ...ficate_authority_pqc_key_algorithm_test.py | 157 ++++++++++++++++++
 .../services/acmpca/acmpca_service_test.py    |  65 ++++++++
 12 files changed, 427 insertions(+)
 create mode 100644 prowler/providers/aws/services/acmpca/__init__.py
 create mode 100644 prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/__init__.py
 create mode 100644 prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.metadata.json
 create mode 100644 prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.py
 create mode 100644 prowler/providers/aws/services/acmpca/acmpca_client.py
 create mode 100644 prowler/providers/aws/services/acmpca/acmpca_service.py
 create mode 100644 tests/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm_test.py
 create mode 100644 tests/providers/aws/services/acmpca/acmpca_service_test.py

diff --git a/contrib/k8s/helm/prowler-api/values.yaml b/contrib/k8s/helm/prowler-api/values.yaml
index 32149aeb7f..4f0ff3ae14 100644
--- a/contrib/k8s/helm/prowler-api/values.yaml
+++ b/contrib/k8s/helm/prowler-api/values.yaml
@@ -439,6 +439,11 @@ mainConfig:
     elbv2_min_azs: 2
 
     # AWS Post-Quantum TLS Configuration
+    # aws.acmpca_certificate_authority_pqc_key_algorithm
+    acmpca_pqc_key_algorithms:
+      - "ML_DSA_44"
+      - "ML_DSA_65"
+      - "ML_DSA_87"
     # aws.cloudfront_distributions_pqc_tls_enabled
     cloudfront_pqc_min_protocol_versions:
       - "TLSv1.3_2025"
diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx
index 9f9f38a0dc..23e54317e6 100644
--- a/docs/user-guide/cli/tutorials/configuration_file.mdx
+++ b/docs/user-guide/cli/tutorials/configuration_file.mdx
@@ -13,11 +13,13 @@ Additionally, you can input a custom configuration file using the `--config-file
 ## AWS
 
 ### Configurable Checks
+
 The following list includes all the AWS checks with configurable variables that can be changed in the configuration yaml file:
 
 | Check Name                                                    | Value                                            | Type            |
 |---------------------------------------------------------------|--------------------------------------------------|-----------------|
 | `acm_certificates_expiration_check`                           | `days_to_expire_threshold`                       | Integer         |
+| `acmpca_certificate_authority_pqc_key_algorithm`              | `acmpca_pqc_key_algorithms`                      | List of Strings |
 | `appstream_fleet_maximum_session_duration`                    | `max_session_duration_seconds`                   | Integer         |
 | `appstream_fleet_session_disconnect_timeout`                  | `max_disconnect_timeout_in_seconds`              | Integer         |
 | `appstream_fleet_session_idle_disconnect_timeout`             | `max_idle_disconnect_timeout_in_seconds`         | Integer         |
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 731f774d1a..b2927bdd2c 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -47,6 +47,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `cloudfront_distributions_pqc_tls_enabled` check for AWS provider to verify CloudFront distributions enforce a post-quantum TLS 1.3 security policy [(#11317)](https://github.com/prowler-cloud/prowler/pull/11317)
 - `apigateway_domain_name_pqc_tls_enabled` check for AWS provider to verify API Gateway custom domain names use a post-quantum TLS security policy [(#11316)](https://github.com/prowler-cloud/prowler/pull/11316)
 - `transfer_server_pqc_ssh_kex_enabled` check for AWS provider to verify Transfer Family servers use a post-quantum hybrid SSH key exchange security policy [(#11315)](https://github.com/prowler-cloud/prowler/pull/11315)
+- `acmpca_certificate_authority_pqc_key_algorithm` check and new `acmpca` service for AWS provider to verify AWS Private CA certificate authorities use a post-quantum (ML-DSA) key algorithm [(#11318)](https://github.com/prowler-cloud/prowler/pull/11318)
 
 ### 🔄 Changed
 
diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml
index 0e063de264..de529312b3 100644
--- a/prowler/config/config.yaml
+++ b/prowler/config/config.yaml
@@ -381,6 +381,12 @@ aws:
   elbv2_min_azs: 2
 
   # AWS Post-Quantum TLS Configuration
+  # aws.acmpca_certificate_authority_pqc_key_algorithm
+  # Allowed post-quantum key algorithms for AWS Private CA certificate authorities
+  acmpca_pqc_key_algorithms:
+    - "ML_DSA_44"
+    - "ML_DSA_65"
+    - "ML_DSA_87"
   # aws.cloudfront_distributions_pqc_tls_enabled
   # Allowed CloudFront MinimumProtocolVersion values that enable post-quantum hybrid key exchange
   cloudfront_pqc_min_protocol_versions:
diff --git a/prowler/providers/aws/services/acmpca/__init__.py b/prowler/providers/aws/services/acmpca/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/__init__.py b/prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.metadata.json b/prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.metadata.json
new file mode 100644
index 0000000000..6915540539
--- /dev/null
+++ b/prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.metadata.json
@@ -0,0 +1,41 @@
+{
+  "Provider": "aws",
+  "CheckID": "acmpca_certificate_authority_pqc_key_algorithm",
+  "CheckTitle": "AWS Private CA certificate authorities use a post-quantum (ML-DSA) key algorithm",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "acmpca",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "AwsAcmPcaCertificateAuthority",
+  "ResourceGroup": "security",
+  "Description": "**AWS Private Certificate Authorities (Private CAs)** are assessed for use of a **post-quantum digital signature key algorithm** (`ML_DSA_44`, `ML_DSA_65`, `ML_DSA_87`). CAs that still issue certificates with RSA or ECC algorithms produce signatures vulnerable to forgery once a cryptographically relevant quantum computer is available.",
+  "Risk": "RSA and ECC signatures can be broken by Shor's algorithm on a sufficiently large quantum computer. A compromised CA private key would let an attacker issue arbitrary certificates trusted across the PKI, undermining identity and code-signing controls. Migrating CAs to **ML-DSA** (NIST FIPS 204) provides quantum-resistant signatures so issued certificates retain integrity in the post-quantum era.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/privateca/latest/userguide/PcaTerms.html",
+    "https://aws.amazon.com/about-aws/whats-new/2025/11/aws-private-ca-post-quantum-digital-certificates/",
+    "https://aws.amazon.com/blogs/security/post-quantum-ml-dsa-code-signing-with-aws-private-ca-and-aws-kms/",
+    "https://csrc.nist.gov/pubs/fips/204/final"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws acm-pca create-certificate-authority --certificate-authority-configuration '{\"KeyAlgorithm\":\"ML_DSA_65\",\"SigningAlgorithm\":\"ML_DSA_65\",\"Subject\":{...}}' --certificate-authority-type SUBORDINATE",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::ACMPCA::CertificateAuthority\n    Properties:\n      Type: SUBORDINATE\n      KeyAlgorithm: ML_DSA_65        # FIX: post-quantum signature algorithm\n      SigningAlgorithm: ML_DSA_65\n      Subject:\n        CommonName: example-pqc-ca\n```",
+      "Other": "Existing CAs cannot have their key algorithm changed; create a new CA with KeyAlgorithm = ML_DSA_44 / ML_DSA_65 / ML_DSA_87, re-issue certificates from it, and decommission the legacy CA once dependent workloads have rotated.",
+      "Terraform": "```hcl\nresource \"aws_acmpca_certificate_authority\" \"<example_resource_name>\" {\n  type = \"SUBORDINATE\"\n  certificate_authority_configuration {\n    key_algorithm     = \"ML_DSA_65\" # FIX: post-quantum signature algorithm\n    signing_algorithm = \"ML_DSA_65\"\n    subject {\n      common_name = \"example-pqc-ca\"\n    }\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Create new Private CAs with a **post-quantum key algorithm** (`ML_DSA_44`, `ML_DSA_65`, or `ML_DSA_87`) and migrate workloads off legacy RSA/ECC CAs. Plan crypto-agility for your PKI so that quantum-resistant trust anchors can be rolled out before threat actors gain access to a cryptographically relevant quantum computer.",
+      "Url": "https://hub.prowler.com/check/acmpca_certificate_authority_pqc_key_algorithm"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}
diff --git a/prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.py b/prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.py
new file mode 100644
index 0000000000..738875baee
--- /dev/null
+++ b/prowler/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm.py
@@ -0,0 +1,49 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.acmpca.acmpca_client import acmpca_client
+
+PQC_PCA_KEY_ALGORITHMS_DEFAULT = [
+    "ML_DSA_44",
+    "ML_DSA_65",
+    "ML_DSA_87",
+]
+
+
+class acmpca_certificate_authority_pqc_key_algorithm(Check):
+    """Verify that every AWS Private CA uses a post-quantum key algorithm.
+
+    A Private CA PASSES when its ``KeyAlgorithm`` belongs to the configured
+    allowlist of post-quantum signature algorithms (ML-DSA family).
+    Deleted CAs are skipped.
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        """Execute the check against AWS Private CAs.
+
+        Returns:
+            A list of reports with each non-deleted CA PQC key algorithm status.
+        """
+
+        findings = []
+        pqc_algorithms = acmpca_client.audit_config.get(
+            "acmpca_pqc_key_algorithms", PQC_PCA_KEY_ALGORITHMS_DEFAULT
+        )
+        for ca in acmpca_client.certificate_authorities.values():
+            if ca.status == "DELETED":
+                continue
+            report = Check_Report_AWS(metadata=self.metadata(), resource=ca)
+            algorithm = ca.key_algorithm or "<none>"
+            if ca.key_algorithm in pqc_algorithms:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"AWS Private CA {ca.id} uses post-quantum key algorithm "
+                    f"{algorithm}."
+                )
+            else:
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"AWS Private CA {ca.id} uses key algorithm {algorithm}, "
+                    "which is not post-quantum (ML-DSA)."
+                )
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/aws/services/acmpca/acmpca_client.py b/prowler/providers/aws/services/acmpca/acmpca_client.py
new file mode 100644
index 0000000000..c8e22730bc
--- /dev/null
+++ b/prowler/providers/aws/services/acmpca/acmpca_client.py
@@ -0,0 +1,4 @@
+from prowler.providers.aws.services.acmpca.acmpca_service import ACMPCA
+from prowler.providers.common.provider import Provider
+
+acmpca_client = ACMPCA(Provider.get_global_provider())
diff --git a/prowler/providers/aws/services/acmpca/acmpca_service.py b/prowler/providers/aws/services/acmpca/acmpca_service.py
new file mode 100644
index 0000000000..9c6fb77096
--- /dev/null
+++ b/prowler/providers/aws/services/acmpca/acmpca_service.py
@@ -0,0 +1,97 @@
+from __future__ import annotations
+
+from typing import Any, Dict, List
+
+from pydantic.v1 import BaseModel, Field
+
+from prowler.lib.logger import logger
+from prowler.lib.scan_filters.scan_filters import is_resource_filtered
+from prowler.providers.aws.aws_provider import AwsProvider
+from prowler.providers.aws.lib.service.service import AWSService
+
+
+class ACMPCA(AWSService):
+    """AWS Private CA service class to list certificate authorities."""
+
+    def __init__(self, provider: AwsProvider) -> None:
+        """Initialize the AWS Private CA service.
+
+        Args:
+            provider: AWS provider instance with session and audit context.
+        """
+
+        # The boto3 client identifier for AWS Private CA is "acm-pca"
+        super().__init__("acm-pca", provider)
+        self.certificate_authorities: dict[str, CertificateAuthority] = {}
+        self.__threading_call__(self._list_certificate_authorities)
+
+    def _list_certificate_authorities(self, regional_client: Any) -> None:
+        """List AWS Private CAs and their tags in a region.
+
+        Args:
+            regional_client: Regional AWS Private CA client.
+        """
+
+        logger.info("ACM PCA - Listing Certificate Authorities...")
+        try:
+            paginator = regional_client.get_paginator("list_certificate_authorities")
+            for page in paginator.paginate():
+                for ca in page.get("CertificateAuthorities", []):
+                    arn = ca.get("Arn", "")
+                    if not arn:
+                        continue
+                    if self.audit_resources and not is_resource_filtered(
+                        arn, self.audit_resources
+                    ):
+                        continue
+                    config = ca.get("CertificateAuthorityConfiguration", {})
+                    tags = []
+                    try:
+                        tags = regional_client.list_tags(
+                            CertificateAuthorityArn=arn
+                        ).get("Tags", [])
+                    except Exception as error:
+                        logger.error(
+                            f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                        )
+                    self.certificate_authorities[arn] = CertificateAuthority(
+                        arn=arn,
+                        id=arn.split("/")[-1],
+                        region=regional_client.region,
+                        status=ca.get("Status", ""),
+                        type=ca.get("Type", ""),
+                        usage_mode=ca.get("UsageMode", ""),
+                        key_algorithm=config.get("KeyAlgorithm", ""),
+                        signing_algorithm=config.get("SigningAlgorithm", ""),
+                        tags=tags,
+                    )
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+class CertificateAuthority(BaseModel):
+    """AWS Private Certificate Authority metadata.
+
+    Attributes:
+        arn: Certificate authority ARN.
+        id: Certificate authority identifier.
+        region: AWS region where the certificate authority exists.
+        status: Certificate authority lifecycle status.
+        type: Certificate authority type.
+        usage_mode: Certificate authority usage mode.
+        key_algorithm: Key algorithm configured for the certificate authority.
+        signing_algorithm: Signing algorithm configured for the certificate authority.
+        tags: Tags attached to the certificate authority.
+    """
+
+    arn: str
+    id: str
+    region: str
+    status: str = ""
+    type: str = ""
+    usage_mode: str = ""
+    key_algorithm: str = ""
+    signing_algorithm: str = ""
+    tags: List[Dict[str, str]] = Field(default_factory=list)
diff --git a/tests/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm_test.py b/tests/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm_test.py
new file mode 100644
index 0000000000..1685115755
--- /dev/null
+++ b/tests/providers/aws/services/acmpca/acmpca_certificate_authority_pqc_key_algorithm/acmpca_certificate_authority_pqc_key_algorithm_test.py
@@ -0,0 +1,157 @@
+from unittest import mock
+
+from prowler.providers.aws.services.acmpca.acmpca_service import CertificateAuthority
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+CA_ID = "12345678-1234-1234-1234-123456789012"
+CA_ARN = f"arn:aws:acm-pca:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:certificate-authority/{CA_ID}"
+
+
+def _build_client(certificate_authorities, audit_config=None):
+    acmpca_client = mock.MagicMock()
+    acmpca_client.certificate_authorities = certificate_authorities
+    acmpca_client.audit_config = audit_config or {}
+    return acmpca_client
+
+
+def _ca(key_algorithm: str, status: str = "ACTIVE"):
+    return CertificateAuthority(
+        arn=CA_ARN,
+        id=CA_ID,
+        region=AWS_REGION_US_EAST_1,
+        status=status,
+        type="SUBORDINATE",
+        usage_mode="GENERAL_PURPOSE",
+        key_algorithm=key_algorithm,
+        signing_algorithm="ML_DSA_65" if "ML_DSA" in key_algorithm else "SHA256WITHRSA",
+    )
+
+
+class Test_acmpca_certificate_authority_pqc_key_algorithm:
+    def test_no_cas(self):
+        acmpca_client = _build_client({})
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm.acmpca_client",
+                new=acmpca_client,
+            ),
+        ):
+            from prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm import (
+                acmpca_certificate_authority_pqc_key_algorithm,
+            )
+
+            check = acmpca_certificate_authority_pqc_key_algorithm()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_ml_dsa_65(self):
+        acmpca_client = _build_client({CA_ARN: _ca("ML_DSA_65")})
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm.acmpca_client",
+                new=acmpca_client,
+            ),
+        ):
+            from prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm import (
+                acmpca_certificate_authority_pqc_key_algorithm,
+            )
+
+            check = acmpca_certificate_authority_pqc_key_algorithm()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "ML_DSA_65" in result[0].status_extended
+            assert result[0].resource_id == CA_ID
+            assert result[0].resource_arn == CA_ARN
+
+    def test_rsa_2048_fails(self):
+        acmpca_client = _build_client({CA_ARN: _ca("RSA_2048")})
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm.acmpca_client",
+                new=acmpca_client,
+            ),
+        ):
+            from prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm import (
+                acmpca_certificate_authority_pqc_key_algorithm,
+            )
+
+            check = acmpca_certificate_authority_pqc_key_algorithm()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "RSA_2048" in result[0].status_extended
+
+    def test_deleted_ca_skipped(self):
+        acmpca_client = _build_client({CA_ARN: _ca("RSA_2048", status="DELETED")})
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm.acmpca_client",
+                new=acmpca_client,
+            ),
+        ):
+            from prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm import (
+                acmpca_certificate_authority_pqc_key_algorithm,
+            )
+
+            check = acmpca_certificate_authority_pqc_key_algorithm()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_configurable_allowlist(self):
+        acmpca_client = _build_client(
+            {CA_ARN: _ca("RSA_2048")},
+            audit_config={"acmpca_pqc_key_algorithms": ["ML_DSA_65", "RSA_2048"]},
+        )
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ),
+            mock.patch(
+                "prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm.acmpca_client",
+                new=acmpca_client,
+            ),
+        ):
+            from prowler.providers.aws.services.acmpca.acmpca_certificate_authority_pqc_key_algorithm.acmpca_certificate_authority_pqc_key_algorithm import (
+                acmpca_certificate_authority_pqc_key_algorithm,
+            )
+
+            check = acmpca_certificate_authority_pqc_key_algorithm()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
diff --git a/tests/providers/aws/services/acmpca/acmpca_service_test.py b/tests/providers/aws/services/acmpca/acmpca_service_test.py
new file mode 100644
index 0000000000..024df5e5a2
--- /dev/null
+++ b/tests/providers/aws/services/acmpca/acmpca_service_test.py
@@ -0,0 +1,65 @@
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from prowler.providers.aws.services.acmpca.acmpca_service import (
+    ACMPCA,
+    CertificateAuthority,
+)
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+CA_ID = "12345678-1234-1234-1234-123456789012"
+CA_ARN = f"arn:aws:acm-pca:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:certificate-authority/{CA_ID}"
+
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def mock_make_api_call(self, operation_name, kwarg):
+    if operation_name == "ListCertificateAuthorities":
+        return {
+            "CertificateAuthorities": [
+                {
+                    "Arn": CA_ARN,
+                    "Status": "ACTIVE",
+                    "Type": "SUBORDINATE",
+                    "UsageMode": "GENERAL_PURPOSE",
+                    "CertificateAuthorityConfiguration": {
+                        "KeyAlgorithm": "ML_DSA_65",
+                        "SigningAlgorithm": "ML_DSA_65",
+                    },
+                }
+            ]
+        }
+    if operation_name == "ListTags":
+        assert kwarg["CertificateAuthorityArn"] == CA_ARN
+        return {"Tags": [{"Key": "Environment", "Value": "test"}]}
+    return make_api_call(self, operation_name, kwarg)
+
+
+class Test_ACMPCA_Service:
+    @mock_aws
+    def test_service(self):
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        acmpca = ACMPCA(aws_provider)
+        assert acmpca.service == "acm-pca"
+
+    @patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+    @mock_aws
+    def test_list_certificate_authorities(self):
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        acmpca = ACMPCA(aws_provider)
+        assert len(acmpca.certificate_authorities) == 1
+        ca = acmpca.certificate_authorities[CA_ARN]
+        assert isinstance(ca, CertificateAuthority)
+        assert ca.id == CA_ID
+        assert ca.region == AWS_REGION_US_EAST_1
+        assert ca.status == "ACTIVE"
+        assert ca.type == "SUBORDINATE"
+        assert ca.key_algorithm == "ML_DSA_65"
+        assert ca.signing_algorithm == "ML_DSA_65"
+        assert ca.tags == [{"Key": "Environment", "Value": "test"}]

From 29329f6203a4ca5e1c495bbcded387cc4aef85de Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Tue, 23 Jun 2026 01:18:22 +0900
Subject: [PATCH 120/126] feat(azure): add
 entra_authentication_methods_policy_strong_auth_enforced check (#11039)

Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../compliance/azure/iso27001_2022_azure.json |   1 +
 .../azure/secnumcloud_3.2_azure.json          |   1 +
 .../__init__.py                               |   0
 ..._policy_strong_auth_enforced.metadata.json |  37 ++++
 ...ion_methods_policy_strong_auth_enforced.py |  63 ++++++
 .../azure/services/entra/entra_service.py     |  85 ++++++++
 ...ethods_policy_strong_auth_enforced_test.py | 205 ++++++++++++++++++
 8 files changed, 393 insertions(+)
 create mode 100644 prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/__init__.py
 create mode 100644 prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced.metadata.json
 create mode 100644 prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced.py
 create mode 100644 tests/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index b2927bdd2c..05c2a87094 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -31,6 +31,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `network_subnet_nsg_associated` check for Azure provider, verifying virtual network subnets have a network security group associated to enforce traffic filtering [(#11043)](https://github.com/prowler-cloud/prowler/pull/11043)
 - `network_vnet_ddos_protection_enabled` check for Azure provider, verifying virtual networks have Azure DDoS Network Protection enabled [(#11044)](https://github.com/prowler-cloud/prowler/pull/11044)
 - `entra_app_registration_credential_not_expired` check for Azure provider, verifying Entra ID app registration secrets and certificates are not expired, expiring within 30 days, or without an expiration date [(#11038)](https://github.com/prowler-cloud/prowler/pull/11038)
+- `entra_authentication_methods_policy_strong_auth_enforced` check for Azure provider, verifying the Entra ID authentication methods policy enforces MFA registration and enables at least one strong method (Microsoft Authenticator, FIDO2, or X.509 certificate) [(#11039)](https://github.com/prowler-cloud/prowler/pull/11039)
 - `aks_cluster_auto_upgrade_enabled` check for Azure provider [(#11027)](https://github.com/prowler-cloud/prowler/pull/11027)
 - Public `Provider.get_class()` method that resolves a provider class by name for both built-in and external (entry-point) providers [(#11398)](https://github.com/prowler-cloud/prowler/pull/11398)
 - Jira timeout preventing the calls from hanging indefinitely when the Jira endpoint is unreachable or slow [(#11602)](https://github.com/prowler-cloud/prowler/pull/11602)
diff --git a/prowler/compliance/azure/iso27001_2022_azure.json b/prowler/compliance/azure/iso27001_2022_azure.json
index 04da31be78..ab17f7057c 100644
--- a/prowler/compliance/azure/iso27001_2022_azure.json
+++ b/prowler/compliance/azure/iso27001_2022_azure.json
@@ -1103,6 +1103,7 @@
         }
       ],
       "Checks": [
+        "entra_authentication_methods_policy_strong_auth_enforced",
         "entra_conditional_access_policy_require_mfa_for_management_app",
         "entra_non_privileged_user_has_mfa entra_privileged_user_has_mfa",
         "entra_user_with_vm_access_has_mfa",
diff --git a/prowler/compliance/azure/secnumcloud_3.2_azure.json b/prowler/compliance/azure/secnumcloud_3.2_azure.json
index ef6141d446..aedf2133d4 100644
--- a/prowler/compliance/azure/secnumcloud_3.2_azure.json
+++ b/prowler/compliance/azure/secnumcloud_3.2_azure.json
@@ -339,6 +339,7 @@
         }
       ],
       "Checks": [
+        "entra_authentication_methods_policy_strong_auth_enforced",
         "entra_non_privileged_user_has_mfa",
         "entra_privileged_user_has_mfa",
         "entra_security_defaults_enabled"
diff --git a/prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/__init__.py b/prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced.metadata.json b/prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced.metadata.json
new file mode 100644
index 0000000000..11dfa6e85b
--- /dev/null
+++ b/prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "entra_authentication_methods_policy_strong_auth_enforced",
+  "CheckTitle": "Strong authentication methods are enabled with registration enforcement",
+  "CheckType": [],
+  "ServiceName": "entra",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "high",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "IAM",
+  "Description": "**Microsoft Entra ID** authentication methods policy is evaluated for **strong authentication enforcement**. The check verifies that at least one strong method (Microsoft Authenticator, FIDO2, or X.509 Certificate) is enabled and that the MFA registration campaign is active to prompt users to enroll.",
+  "Risk": "Without strong authentication methods, the tenant relies on **passwords alone** or weak factors like SMS/voice. Password-only authentication enables **credential stuffing**, **phishing**, and **brute force** attacks. Without registration enforcement, users may never enroll in MFA even when it is available.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage",
+    "https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-nudge-authenticator-app"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "",
+      "NativeIaC": "",
+      "Other": "1. Sign in to Microsoft Entra admin center\n2. Go to Protection > Authentication methods > Policies\n3. Enable Microsoft Authenticator and/or FIDO2 security keys\n4. Go to Protection > Authentication methods > Registration campaign\n5. Set State to Enabled\n6. Configure included users/groups\n7. Consider disabling weak methods (SMS, Voice) after users migrate",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Enable **Microsoft Authenticator** and **FIDO2 security keys** as authentication methods. Activate the **MFA registration campaign** to prompt users to register. Disable weak methods (SMS, voice) after migration. Use **Conditional Access** to require strong authentication for all users.",
+      "Url": "https://hub.prowler.com/check/entra_authentication_methods_policy_strong_auth_enforced"
+    }
+  },
+  "Categories": [
+    "identity-access"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check reports a single finding per tenant and passes only when both the MFA registration campaign is enabled and at least one strong method is enabled. Microsoft recommends phishing-resistant methods (FIDO2, certificate-based) over app-based push notifications."
+}
diff --git a/prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced.py b/prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced.py
new file mode 100644
index 0000000000..efdbcfa6a0
--- /dev/null
+++ b/prowler/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced.py
@@ -0,0 +1,63 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.entra.entra_client import entra_client
+
+# Methods considered strong (phishing-resistant or app-based MFA)
+STRONG_METHODS = {"microsoftAuthenticator", "fido2", "x509Certificate"}
+
+
+class entra_authentication_methods_policy_strong_auth_enforced(Check):
+    """
+    Ensure the Entra ID authentication methods policy enforces strong authentication.
+
+    This check evaluates the tenant authentication methods policy and reports a single finding per tenant. Strong authentication is considered enforced only when BOTH conditions hold:
+    1. The MFA registration campaign is enabled (users are prompted to register methods).
+    2. At least one strong, phishing-resistant or app-based method (Microsoft Authenticator, FIDO2, or X.509 certificate) is enabled.
+
+    - PASS: Both conditions hold.
+    - FAIL: One or both conditions are missing; the status extended names exactly what is missing.
+    """
+
+    def execute(self) -> Check_Report_Azure:
+        findings = []
+
+        for tenant_domain, policy in entra_client.authentication_methods_policy.items():
+            if policy is None:
+                continue
+
+            report = Check_Report_Azure(metadata=self.metadata(), resource=policy)
+            report.subscription = f"Tenant: {tenant_domain}"
+            report.resource_name = "Authentication Methods Policy"
+            report.resource_id = policy.id
+
+            registration_enabled = policy.registration_enforcement_state == "enabled"
+            enabled_strong = [
+                config.method_name
+                for config in policy.method_configurations
+                if config.state == "enabled" and config.method_name in STRONG_METHODS
+            ]
+
+            if registration_enabled and enabled_strong:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"Strong authentication is enforced for tenant {tenant_domain}: "
+                    f"the MFA registration campaign is enabled and strong methods are "
+                    f"enabled ({', '.join(enabled_strong)})."
+                )
+            else:
+                issues = []
+                if not registration_enabled:
+                    issues.append("the MFA registration campaign is not enabled")
+                if not enabled_strong:
+                    issues.append(
+                        "no strong authentication methods (Microsoft Authenticator, "
+                        "FIDO2, or X.509 Certificate) are enabled"
+                    )
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"Strong authentication is not enforced for tenant "
+                    f"{tenant_domain}: {'; '.join(issues)}."
+                )
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/entra/entra_service.py b/prowler/providers/azure/services/entra/entra_service.py
index cda5070ec3..d77880b425 100644
--- a/prowler/providers/azure/services/entra/entra_service.py
+++ b/prowler/providers/azure/services/entra/entra_service.py
@@ -51,6 +51,7 @@ class Entra(AzureService):
                 self._get_directory_roles(),
                 self._get_conditional_access_policy(),
                 self._get_app_registrations(),
+                self._get_authentication_methods_policy(),
             )
         )
 
@@ -61,6 +62,7 @@ class Entra(AzureService):
         self.directory_roles = attributes[4]
         self.conditional_access_policy = attributes[5]
         self.app_registrations = attributes[6]
+        self.authentication_methods_policy = attributes[7]
 
         if created_loop:
             asyncio.set_event_loop(None)
@@ -477,6 +479,77 @@ class Entra(AzureService):
 
         return app_registrations
 
+    async def _get_authentication_methods_policy(self):
+        logger.info("Entra - Getting authentication methods policy...")
+        auth_methods_policy = {}
+        try:
+            for tenant, client in self.clients.items():
+                policy_response = (
+                    await client.policies.authentication_methods_policy.get()
+                )
+
+                if not policy_response:
+                    auth_methods_policy[tenant] = None
+                    continue
+
+                # Parse registration enforcement
+                reg_enforcement = getattr(
+                    policy_response, "registration_enforcement", None
+                )
+                reg_campaign = (
+                    getattr(
+                        reg_enforcement,
+                        "authentication_methods_registration_campaign",
+                        None,
+                    )
+                    if reg_enforcement
+                    else None
+                )
+                registration_enforcement_state = (
+                    getattr(reg_campaign, "state", None) if reg_campaign else None
+                )
+
+                # Parse authentication method configurations
+                method_configs = []
+                for config in (
+                    getattr(
+                        policy_response,
+                        "authentication_method_configurations",
+                        [],
+                    )
+                    or []
+                ):
+                    odata_type = getattr(config, "odata_type", "") or ""
+                    # Extract method name from odata_type
+                    # e.g. "#microsoft.graph.microsoftAuthenticatorAuthenticationMethodConfiguration"
+                    method_name = (
+                        odata_type.split(".")[-1].replace(
+                            "AuthenticationMethodConfiguration", ""
+                        )
+                        if odata_type
+                        else getattr(config, "id", "unknown")
+                    )
+                    method_configs.append(
+                        AuthMethodConfig(
+                            id=getattr(config, "id", "") or "",
+                            method_name=method_name,
+                            state=getattr(config, "state", "disabled") or "disabled",
+                        )
+                    )
+
+                auth_methods_policy[tenant] = AuthMethodsPolicy(
+                    id=getattr(policy_response, "id", "") or "",
+                    registration_enforcement_state=registration_enforcement_state,
+                    method_configurations=method_configs,
+                )
+
+        except Exception as error:
+            logger.error(
+                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+        return auth_methods_policy
+
 
 class User(BaseModel):
     id: str
@@ -554,3 +627,15 @@ class AppRegistration(BaseModel):
     id: str
     name: str
     credentials: List[AppCredential] = []
+
+
+class AuthMethodConfig(BaseModel):
+    id: str = ""
+    method_name: str
+    state: str = "disabled"  # "enabled" or "disabled"
+
+
+class AuthMethodsPolicy(BaseModel):
+    id: str = ""
+    registration_enforcement_state: Optional[str] = None  # "enabled" or "disabled"
+    method_configurations: List[AuthMethodConfig] = []
diff --git a/tests/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced_test.py b/tests/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced_test.py
new file mode 100644
index 0000000000..e3102bf3e9
--- /dev/null
+++ b/tests/providers/azure/services/entra/entra_authentication_methods_policy_strong_auth_enforced/entra_authentication_methods_policy_strong_auth_enforced_test.py
@@ -0,0 +1,205 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import DOMAIN, set_mocked_azure_provider
+
+CHECK_MODULE = (
+    "prowler.providers.azure.services.entra."
+    "entra_authentication_methods_policy_strong_auth_enforced."
+    "entra_authentication_methods_policy_strong_auth_enforced"
+)
+
+
+class Test_entra_authentication_methods_policy_strong_auth_enforced:
+    def test_entra_no_tenants(self):
+        entra_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(f"{CHECK_MODULE}.entra_client", new=entra_client),
+        ):
+            from prowler.providers.azure.services.entra.entra_authentication_methods_policy_strong_auth_enforced.entra_authentication_methods_policy_strong_auth_enforced import (
+                entra_authentication_methods_policy_strong_auth_enforced,
+            )
+
+            entra_client.authentication_methods_policy = {}
+
+            check = entra_authentication_methods_policy_strong_auth_enforced()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_entra_policy_none(self):
+        entra_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(f"{CHECK_MODULE}.entra_client", new=entra_client),
+        ):
+            from prowler.providers.azure.services.entra.entra_authentication_methods_policy_strong_auth_enforced.entra_authentication_methods_policy_strong_auth_enforced import (
+                entra_authentication_methods_policy_strong_auth_enforced,
+            )
+
+            entra_client.authentication_methods_policy = {DOMAIN: None}
+
+            check = entra_authentication_methods_policy_strong_auth_enforced()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_entra_registration_enabled_strong_method_enabled(self):
+        entra_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(f"{CHECK_MODULE}.entra_client", new=entra_client),
+        ):
+            from prowler.providers.azure.services.entra.entra_authentication_methods_policy_strong_auth_enforced.entra_authentication_methods_policy_strong_auth_enforced import (
+                entra_authentication_methods_policy_strong_auth_enforced,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AuthMethodConfig,
+                AuthMethodsPolicy,
+            )
+
+            policy = AuthMethodsPolicy(
+                id="authMethodsPolicy",
+                registration_enforcement_state="enabled",
+                method_configurations=[
+                    AuthMethodConfig(
+                        id="MicrosoftAuthenticator",
+                        method_name="microsoftAuthenticator",
+                        state="enabled",
+                    ),
+                    AuthMethodConfig(id="Sms", method_name="sms", state="enabled"),
+                ],
+            )
+            entra_client.authentication_methods_policy = {DOMAIN: policy}
+
+            check = entra_authentication_methods_policy_strong_auth_enforced()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].resource_name == "Authentication Methods Policy"
+            assert result[0].resource_id == "authMethodsPolicy"
+            assert "is enforced" in result[0].status_extended
+            assert "microsoftAuthenticator" in result[0].status_extended
+
+    def test_entra_registration_disabled_no_strong_methods(self):
+        entra_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(f"{CHECK_MODULE}.entra_client", new=entra_client),
+        ):
+            from prowler.providers.azure.services.entra.entra_authentication_methods_policy_strong_auth_enforced.entra_authentication_methods_policy_strong_auth_enforced import (
+                entra_authentication_methods_policy_strong_auth_enforced,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AuthMethodConfig,
+                AuthMethodsPolicy,
+            )
+
+            policy = AuthMethodsPolicy(
+                id="authMethodsPolicy",
+                registration_enforcement_state="disabled",
+                method_configurations=[
+                    AuthMethodConfig(id="Sms", method_name="sms", state="enabled"),
+                    AuthMethodConfig(id="Voice", method_name="voice", state="enabled"),
+                ],
+            )
+            entra_client.authentication_methods_policy = {DOMAIN: policy}
+
+            check = entra_authentication_methods_policy_strong_auth_enforced()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "is not enforced" in result[0].status_extended
+            assert "registration campaign is not enabled" in result[0].status_extended
+            assert "no strong authentication methods" in result[0].status_extended
+
+    def test_entra_registration_disabled_strong_method_enabled(self):
+        entra_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(f"{CHECK_MODULE}.entra_client", new=entra_client),
+        ):
+            from prowler.providers.azure.services.entra.entra_authentication_methods_policy_strong_auth_enforced.entra_authentication_methods_policy_strong_auth_enforced import (
+                entra_authentication_methods_policy_strong_auth_enforced,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AuthMethodConfig,
+                AuthMethodsPolicy,
+            )
+
+            policy = AuthMethodsPolicy(
+                id="authMethodsPolicy",
+                registration_enforcement_state="disabled",
+                method_configurations=[
+                    AuthMethodConfig(id="Fido2", method_name="fido2", state="enabled"),
+                ],
+            )
+            entra_client.authentication_methods_policy = {DOMAIN: policy}
+
+            check = entra_authentication_methods_policy_strong_auth_enforced()
+            result = check.execute()
+            # Strong method present but registration campaign off -> not enforced
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "registration campaign is not enabled" in result[0].status_extended
+            assert "no strong authentication methods" not in result[0].status_extended
+
+    def test_entra_multiple_strong_methods(self):
+        entra_client = mock.MagicMock
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(f"{CHECK_MODULE}.entra_client", new=entra_client),
+        ):
+            from prowler.providers.azure.services.entra.entra_authentication_methods_policy_strong_auth_enforced.entra_authentication_methods_policy_strong_auth_enforced import (
+                entra_authentication_methods_policy_strong_auth_enforced,
+            )
+            from prowler.providers.azure.services.entra.entra_service import (
+                AuthMethodConfig,
+                AuthMethodsPolicy,
+            )
+
+            policy = AuthMethodsPolicy(
+                id="authMethodsPolicy",
+                registration_enforcement_state="enabled",
+                method_configurations=[
+                    AuthMethodConfig(
+                        id="MicrosoftAuthenticator",
+                        method_name="microsoftAuthenticator",
+                        state="enabled",
+                    ),
+                    AuthMethodConfig(id="Fido2", method_name="fido2", state="enabled"),
+                    AuthMethodConfig(
+                        id="x509", method_name="x509Certificate", state="enabled"
+                    ),
+                ],
+            )
+            entra_client.authentication_methods_policy = {DOMAIN: policy}
+
+            check = entra_authentication_methods_policy_strong_auth_enforced()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "microsoftAuthenticator" in result[0].status_extended
+            assert "fido2" in result[0].status_extended

From 04e6e330a778baa19c8481354304a2610382f4b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Mon, 22 Jun 2026 19:39:16 +0200
Subject: [PATCH 121/126] feat(aws): add rolesanywhere service and pqc trust
 anchor check (#11319)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 contrib/k8s/helm/prowler-api/values.yaml      |   6 +
 .../cli/tutorials/configuration_file.mdx      |   1 +
 permissions/prowler-additions-policy.json     |   2 +
 .../cloudformation/prowler-scan-role.yml      |   2 +
 prowler/CHANGELOG.md                          |   1 +
 prowler/config/config.yaml                    |   7 +
 .../aws/services/rolesanywhere/__init__.py    |   0
 .../rolesanywhere/rolesanywhere_client.py     |   6 +
 .../rolesanywhere/rolesanywhere_service.py    |  64 ++++++
 .../__init__.py                               |   0
 ...nywhere_trust_anchor_pqc_pki.metadata.json |  43 ++++
 .../rolesanywhere_trust_anchor_pqc_pki.py     |  79 +++++++
 .../rolesanywhere_service_test.py             |  92 ++++++++
 ...rolesanywhere_trust_anchor_pqc_pki_test.py | 203 ++++++++++++++++++
 14 files changed, 506 insertions(+)
 create mode 100644 prowler/providers/aws/services/rolesanywhere/__init__.py
 create mode 100644 prowler/providers/aws/services/rolesanywhere/rolesanywhere_client.py
 create mode 100644 prowler/providers/aws/services/rolesanywhere/rolesanywhere_service.py
 create mode 100644 prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/__init__.py
 create mode 100644 prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki.metadata.json
 create mode 100644 prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki.py
 create mode 100644 tests/providers/aws/services/rolesanywhere/rolesanywhere_service_test.py
 create mode 100644 tests/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki_test.py

diff --git a/contrib/k8s/helm/prowler-api/values.yaml b/contrib/k8s/helm/prowler-api/values.yaml
index 4f0ff3ae14..a6074c7852 100644
--- a/contrib/k8s/helm/prowler-api/values.yaml
+++ b/contrib/k8s/helm/prowler-api/values.yaml
@@ -461,6 +461,12 @@ mainConfig:
       - "TransferSecurityPolicy-AS2Restricted-2025-07"
 
 
+    # aws.rolesanywhere_trust_anchor_pqc_pki
+    rolesanywhere_pqc_pca_key_algorithms:
+      - "ML_DSA_44"
+      - "ML_DSA_65"
+      - "ML_DSA_87"
+
     # AWS Secrets Configuration
     # Patterns to ignore in the secrets checks
     secrets_ignore_patterns: []
diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx
index 23e54317e6..d695bad7bd 100644
--- a/docs/user-guide/cli/tutorials/configuration_file.mdx
+++ b/docs/user-guide/cli/tutorials/configuration_file.mdx
@@ -57,6 +57,7 @@ The following list includes all the AWS checks with configurable variables that
 | `elasticache_redis_cluster_backup_enabled`                    | `minimum_snapshot_retention_period`              | Integer         |
 | `elb_is_in_multiple_az`                                       | `elb_min_azs`                                    | Integer         |
 | `elbv2_is_in_multiple_az`                                     | `elbv2_min_azs`                                  | Integer         |
+| `rolesanywhere_trust_anchor_pqc_pki`                          | `rolesanywhere_pqc_pca_key_algorithms`           | List of Strings |
 | `cloudfront_distributions_pqc_tls_enabled`                    | `cloudfront_pqc_min_protocol_versions`           | List of Strings |
 | `apigateway_domain_name_pqc_tls_enabled`                      | `apigateway_pqc_tls_allowed_policies`            | List of Strings |
 | `guardduty_is_enabled`                                        | `mute_non_default_regions`                       | Boolean         |
diff --git a/permissions/prowler-additions-policy.json b/permissions/prowler-additions-policy.json
index 37579edb35..c0da045603 100644
--- a/permissions/prowler-additions-policy.json
+++ b/permissions/prowler-additions-policy.json
@@ -36,6 +36,8 @@
         "lightsail:GetRelationalDatabases",
         "macie2:GetMacieSession",
         "macie2:GetAutomatedDiscoveryConfiguration",
+        "rolesanywhere:ListTagsForResource",
+        "rolesanywhere:ListTrustAnchors",
         "s3:GetAccountPublicAccessBlock",
         "shield:DescribeProtection",
         "shield:GetSubscriptionState",
diff --git a/permissions/templates/cloudformation/prowler-scan-role.yml b/permissions/templates/cloudformation/prowler-scan-role.yml
index 2ab6d41289..a7d91b0071 100644
--- a/permissions/templates/cloudformation/prowler-scan-role.yml
+++ b/permissions/templates/cloudformation/prowler-scan-role.yml
@@ -129,6 +129,8 @@ Resources:
                   - "lightsail:GetRelationalDatabases"
                   - "macie2:GetMacieSession"
                   - "macie2:GetAutomatedDiscoveryConfiguration"
+                  - "rolesanywhere:ListTagsForResource"
+                  - "rolesanywhere:ListTrustAnchors"
                   - "s3:GetAccountPublicAccessBlock"
                   - "shield:DescribeProtection"
                   - "shield:GetSubscriptionState"
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 05c2a87094..94e947dd7a 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -49,6 +49,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `apigateway_domain_name_pqc_tls_enabled` check for AWS provider to verify API Gateway custom domain names use a post-quantum TLS security policy [(#11316)](https://github.com/prowler-cloud/prowler/pull/11316)
 - `transfer_server_pqc_ssh_kex_enabled` check for AWS provider to verify Transfer Family servers use a post-quantum hybrid SSH key exchange security policy [(#11315)](https://github.com/prowler-cloud/prowler/pull/11315)
 - `acmpca_certificate_authority_pqc_key_algorithm` check and new `acmpca` service for AWS provider to verify AWS Private CA certificate authorities use a post-quantum (ML-DSA) key algorithm [(#11318)](https://github.com/prowler-cloud/prowler/pull/11318)
+- `rolesanywhere_trust_anchor_pqc_pki` check and new `rolesanywhere` service for AWS provider to verify IAM Roles Anywhere trust anchors are backed by a post-quantum (ML-DSA) PKI [(#11319)](https://github.com/prowler-cloud/prowler/pull/11319)
 
 ### 🔄 Changed
 
diff --git a/prowler/config/config.yaml b/prowler/config/config.yaml
index de529312b3..59f69ec821 100644
--- a/prowler/config/config.yaml
+++ b/prowler/config/config.yaml
@@ -398,6 +398,13 @@ aws:
     - "SecurityPolicy_TLS13_1_2_PFS_PQ_2025_09"
     - "SecurityPolicy_TLS13_1_2_PQ_2025_09"
 
+  # aws.rolesanywhere_trust_anchor_pqc_pki
+  # Allowed post-quantum key algorithms for AWS Private CAs backing IAM Roles Anywhere trust anchors
+  rolesanywhere_pqc_pca_key_algorithms:
+    - "ML_DSA_44"
+    - "ML_DSA_65"
+    - "ML_DSA_87"
+
   # AWS Post-Quantum SSH Key Exchange Configuration
   # aws.transfer_server_pqc_ssh_kex_enabled
   # Allowed AWS Transfer Family security policies with post-quantum SSH key exchange
diff --git a/prowler/providers/aws/services/rolesanywhere/__init__.py b/prowler/providers/aws/services/rolesanywhere/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_client.py b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_client.py
new file mode 100644
index 0000000000..254f0a5dbf
--- /dev/null
+++ b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_client.py
@@ -0,0 +1,6 @@
+from prowler.providers.aws.services.rolesanywhere.rolesanywhere_service import (
+    RolesAnywhere,
+)
+from prowler.providers.common.provider import Provider
+
+rolesanywhere_client = RolesAnywhere(Provider.get_global_provider())
diff --git a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_service.py b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_service.py
new file mode 100644
index 0000000000..46dca281d6
--- /dev/null
+++ b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_service.py
@@ -0,0 +1,64 @@
+from typing import Dict, List
+
+from pydantic.v1 import BaseModel, Field
+
+from prowler.lib.logger import logger
+from prowler.lib.scan_filters.scan_filters import is_resource_filtered
+from prowler.providers.aws.lib.service.service import AWSService
+
+
+class RolesAnywhere(AWSService):
+    def __init__(self, provider):
+        super().__init__(__class__.__name__, provider)
+        self.trust_anchors = {}
+        self.__threading_call__(self._list_trust_anchors)
+
+    def _list_trust_anchors(self, regional_client):
+        logger.info("RolesAnywhere - Listing Trust Anchors...")
+        try:
+            paginator = regional_client.get_paginator("list_trust_anchors")
+            for page in paginator.paginate():
+                for ta in page.get("trustAnchors", []):
+                    arn = ta.get("trustAnchorArn", "")
+                    if not arn:
+                        continue
+                    if self.audit_resources and not is_resource_filtered(
+                        arn, self.audit_resources
+                    ):
+                        continue
+                    source = ta.get("source", {}) or {}
+                    source_data = source.get("sourceData", {}) or {}
+                    tags = []
+                    try:
+                        tags = regional_client.list_tags_for_resource(
+                            resourceArn=arn
+                        ).get("tags", [])
+                    except Exception as error:
+                        logger.warning(
+                            f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+                        )
+                    self.trust_anchors[arn] = TrustAnchor(
+                        arn=arn,
+                        id=ta.get("trustAnchorId", ""),
+                        name=ta.get("name", ""),
+                        region=regional_client.region,
+                        enabled=ta.get("enabled", False),
+                        source_type=source.get("sourceType", ""),
+                        acm_pca_arn=source_data.get("acmPcaArn", ""),
+                        tags=tags,
+                    )
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+class TrustAnchor(BaseModel):
+    arn: str
+    id: str
+    name: str
+    region: str
+    enabled: bool = False
+    source_type: str = ""
+    acm_pca_arn: str = ""
+    tags: List[Dict[str, str]] = Field(default_factory=list)
diff --git a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/__init__.py b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki.metadata.json b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki.metadata.json
new file mode 100644
index 0000000000..7d919f83a7
--- /dev/null
+++ b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki.metadata.json
@@ -0,0 +1,43 @@
+{
+  "Provider": "aws",
+  "CheckID": "rolesanywhere_trust_anchor_pqc_pki",
+  "CheckTitle": "IAM Roles Anywhere trust anchors are backed by a post-quantum (ML-DSA) PKI",
+  "CheckType": [
+    "Software and Configuration Checks/AWS Security Best Practices"
+  ],
+  "ServiceName": "rolesanywhere",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "low",
+  "ResourceType": "AwsRolesAnywhereTrustAnchor",
+  "ResourceGroup": "security",
+  "Description": "**IAM Roles Anywhere trust anchors** are assessed for use of a **post-quantum digital signature algorithm** (ML-DSA). A trust anchor backed by an AWS Private CA whose `KeyAlgorithm` is RSA or ECC produces signatures vulnerable to forgery by a future quantum attacker, allowing an unintended actor to issue certificates and obtain unauthorized AWS access.",
+  "Risk": "Trust anchors are the root of trust for workloads authenticating to AWS via X.509 certificates. If the signing CA uses RSA or ECC, an attacker with quantum capability could forge end-entity certificates and impersonate workloads. Migrating trust anchors to **ML-DSA-backed PKI** (NIST FIPS 204) protects this control plane in the post-quantum era.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://docs.aws.amazon.com/rolesanywhere/latest/userguide/introduction.html",
+    "https://aws.amazon.com/about-aws/whats-new/2026/03/iam-roles-anywhere-post-quantum-digital-certificates/",
+    "https://aws.amazon.com/security/post-quantum-cryptography/",
+    "https://csrc.nist.gov/pubs/fips/204/final"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aws rolesanywhere create-trust-anchor --name pqc-trust --source 'sourceType=AWS_ACM_PCA,sourceData={acmPcaArn=<ml_dsa_ca_arn>}' --enabled",
+      "NativeIaC": "```yaml\nResources:\n  <example_resource_name>:\n    Type: AWS::RolesAnywhere::TrustAnchor\n    Properties:\n      Name: pqc-trust\n      Enabled: true\n      Source:\n        SourceType: AWS_ACM_PCA\n        SourceData:\n          AcmPcaArn: <ml_dsa_ca_arn>   # FIX: PCA must use ML_DSA key algorithm\n```",
+      "Other": "1. Create a new AWS Private CA with a post-quantum KeyAlgorithm (ML_DSA_44/65/87)\n2. Create a new Roles Anywhere trust anchor with sourceType=AWS_ACM_PCA pointing to the new CA\n3. Rotate end-entity certificates issued from the new CA\n4. Delete the legacy trust anchor once workloads have rotated",
+      "Terraform": "```hcl\nresource \"aws_rolesanywhere_trust_anchor\" \"<example_resource_name>\" {\n  name    = \"pqc-trust\"\n  enabled = true\n  source {\n    source_type = \"AWS_ACM_PCA\"\n    source_data {\n      acm_pca_arn = \"<ml_dsa_ca_arn>\" # FIX: PCA must use ML_DSA key algorithm\n    }\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Back IAM Roles Anywhere trust anchors with an **AWS Private CA that uses an ML-DSA key algorithm**. For trust anchors backed by an external certificate bundle, ensure the certificates were issued by an ML-DSA CA and re-verify periodically as the cryptographic landscape evolves.",
+      "Url": "https://hub.prowler.com/check/rolesanywhere_trust_anchor_pqc_pki"
+    }
+  },
+  "Categories": [
+    "encryption"
+  ],
+  "DependsOn": [
+    "acmpca_certificate_authority_pqc_key_algorithm"
+  ],
+  "RelatedTo": [],
+  "Notes": "Trust anchors backed by an external CERTIFICATE_BUNDLE cannot be evaluated automatically by this check and are reported as FAIL with guidance to migrate to an AWS Private CA using an ML-DSA key algorithm."
+}
diff --git a/prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki.py b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki.py
new file mode 100644
index 0000000000..495ed4e9c7
--- /dev/null
+++ b/prowler/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki.py
@@ -0,0 +1,79 @@
+from prowler.lib.check.models import Check, Check_Report_AWS
+from prowler.providers.aws.services.acmpca.acmpca_client import acmpca_client
+from prowler.providers.aws.services.rolesanywhere.rolesanywhere_client import (
+    rolesanywhere_client,
+)
+
+PQC_PCA_KEY_ALGORITHMS_DEFAULT = [
+    "ML_DSA_44",
+    "ML_DSA_65",
+    "ML_DSA_87",
+]
+
+
+class rolesanywhere_trust_anchor_pqc_pki(Check):
+    """Verify that IAM Roles Anywhere trust anchors are backed by a post-quantum PKI.
+
+    For trust anchors whose source is ``AWS_ACM_PCA``, the linked Private CA's
+    ``KeyAlgorithm`` is checked against the configured ML-DSA allowlist.
+    Trust anchors backed by an external ``CERTIFICATE_BUNDLE`` are reported as
+    FAIL because their certificate signature algorithm cannot be inspected
+    from the IAM Roles Anywhere API alone.
+    """
+
+    def execute(self) -> list[Check_Report_AWS]:
+        findings = []
+        pqc_algorithms = rolesanywhere_client.audit_config.get(
+            "rolesanywhere_pqc_pca_key_algorithms", PQC_PCA_KEY_ALGORITHMS_DEFAULT
+        )
+        for trust_anchor in rolesanywhere_client.trust_anchors.values():
+            report = Check_Report_AWS(metadata=self.metadata(), resource=trust_anchor)
+            if trust_anchor.source_type == "AWS_ACM_PCA":
+                linked_ca = acmpca_client.certificate_authorities.get(
+                    trust_anchor.acm_pca_arn
+                )
+                if linked_ca and linked_ca.status != "ACTIVE":
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"IAM Roles Anywhere trust anchor {trust_anchor.name} is "
+                        f"backed by Private CA {linked_ca.id}, which is in "
+                        f"{linked_ca.status or '<unknown>'} status and cannot be "
+                        "used as an active post-quantum PKI trust root."
+                    )
+                elif linked_ca and linked_ca.key_algorithm in pqc_algorithms:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"IAM Roles Anywhere trust anchor {trust_anchor.name} is "
+                        f"backed by Private CA {linked_ca.id} using post-quantum "
+                        f"key algorithm {linked_ca.key_algorithm}."
+                    )
+                elif linked_ca:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"IAM Roles Anywhere trust anchor {trust_anchor.name} is "
+                        f"backed by Private CA {linked_ca.id} using key algorithm "
+                        f"{linked_ca.key_algorithm or '<unknown>'}, which is not "
+                        "post-quantum (ML-DSA)."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"IAM Roles Anywhere trust anchor {trust_anchor.name} is "
+                        f"backed by Private CA {trust_anchor.acm_pca_arn}, which "
+                        "could not be inspected (cross-account or missing "
+                        "acm-pca permissions). Verify the CA uses an ML-DSA key "
+                        "algorithm."
+                    )
+            else:
+                source = trust_anchor.source_type or "<none>"
+                report.status = "FAIL"
+                report.status_extended = (
+                    f"IAM Roles Anywhere trust anchor {trust_anchor.name} uses "
+                    f"source type {source}; the certificate signature algorithm "
+                    "cannot be inspected automatically. Migrate to an AWS Private "
+                    "CA using an ML-DSA key algorithm to enable post-quantum "
+                    "evaluation."
+                )
+            findings.append(report)
+
+        return findings
diff --git a/tests/providers/aws/services/rolesanywhere/rolesanywhere_service_test.py b/tests/providers/aws/services/rolesanywhere/rolesanywhere_service_test.py
new file mode 100644
index 0000000000..d21d4e20b7
--- /dev/null
+++ b/tests/providers/aws/services/rolesanywhere/rolesanywhere_service_test.py
@@ -0,0 +1,92 @@
+from unittest.mock import patch
+
+import botocore
+from moto import mock_aws
+
+from prowler.providers.aws.services.rolesanywhere.rolesanywhere_service import (
+    RolesAnywhere,
+    TrustAnchor,
+)
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+TA_ID = "11111111-2222-3333-4444-555555555555"
+TA_ARN = f"arn:aws:rolesanywhere:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:trust-anchor/{TA_ID}"
+PCA_ARN = f"arn:aws:acm-pca:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:certificate-authority/abc"
+
+make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def mock_make_api_call(self, operation_name, kwarg):
+    if operation_name == "ListTrustAnchors":
+        return {
+            "trustAnchors": [
+                {
+                    "trustAnchorArn": TA_ARN,
+                    "trustAnchorId": TA_ID,
+                    "name": "pqc-trust",
+                    "enabled": True,
+                    "source": {
+                        "sourceType": "AWS_ACM_PCA",
+                        "sourceData": {"acmPcaArn": PCA_ARN},
+                    },
+                }
+            ]
+        }
+    if operation_name == "ListTagsForResource":
+        return {"tags": [{"key": "Environment", "value": "test"}]}
+    return make_api_call(self, operation_name, kwarg)
+
+
+def mock_make_api_call_tags_failure(self, operation_name, kwarg):
+    if operation_name == "ListTagsForResource":
+        raise botocore.exceptions.ClientError(
+            {
+                "Error": {
+                    "Code": "AccessDeniedException",
+                    "Message": "Access denied",
+                }
+            },
+            operation_name,
+        )
+    return mock_make_api_call(self, operation_name, kwarg)
+
+
+class Test_RolesAnywhere_Service:
+    @mock_aws
+    def test_service(self):
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        rolesanywhere = RolesAnywhere(aws_provider)
+        assert rolesanywhere.service == "rolesanywhere"
+
+    @patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
+    @mock_aws
+    def test_list_trust_anchors(self):
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        rolesanywhere = RolesAnywhere(aws_provider)
+        assert len(rolesanywhere.trust_anchors) == 1
+        ta = rolesanywhere.trust_anchors[TA_ARN]
+        assert isinstance(ta, TrustAnchor)
+        assert ta.id == TA_ID
+        assert ta.name == "pqc-trust"
+        assert ta.enabled is True
+        assert ta.source_type == "AWS_ACM_PCA"
+        assert ta.acm_pca_arn == PCA_ARN
+        assert ta.region == AWS_REGION_US_EAST_1
+        assert ta.tags == [{"key": "Environment", "value": "test"}]
+
+    @patch(
+        "botocore.client.BaseClient._make_api_call", new=mock_make_api_call_tags_failure
+    )
+    @mock_aws
+    def test_list_trust_anchors_continues_when_tags_fail(self):
+        aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+        rolesanywhere = RolesAnywhere(aws_provider)
+        assert len(rolesanywhere.trust_anchors) == 1
+        ta = rolesanywhere.trust_anchors[TA_ARN]
+        assert isinstance(ta, TrustAnchor)
+        assert ta.id == TA_ID
+        assert ta.tags == []
diff --git a/tests/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki_test.py b/tests/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki_test.py
new file mode 100644
index 0000000000..2038fdde57
--- /dev/null
+++ b/tests/providers/aws/services/rolesanywhere/rolesanywhere_trust_anchor_pqc_pki/rolesanywhere_trust_anchor_pqc_pki_test.py
@@ -0,0 +1,203 @@
+from unittest import mock
+
+from prowler.providers.aws.services.acmpca.acmpca_service import CertificateAuthority
+from prowler.providers.aws.services.rolesanywhere.rolesanywhere_service import (
+    TrustAnchor,
+)
+from tests.providers.aws.utils import (
+    AWS_ACCOUNT_NUMBER,
+    AWS_REGION_US_EAST_1,
+    set_mocked_aws_provider,
+)
+
+TA_ID = "11111111-2222-3333-4444-555555555555"
+TA_NAME = "pqc-trust"
+TA_ARN = f"arn:aws:rolesanywhere:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:trust-anchor/{TA_ID}"
+PCA_ID = "12345678-1234-1234-1234-123456789012"
+PCA_ARN = f"arn:aws:acm-pca:{AWS_REGION_US_EAST_1}:{AWS_ACCOUNT_NUMBER}:certificate-authority/{PCA_ID}"
+
+
+def _trust_anchor(*, source_type: str, acm_pca_arn: str = ""):
+    return TrustAnchor(
+        arn=TA_ARN,
+        id=TA_ID,
+        name=TA_NAME,
+        region=AWS_REGION_US_EAST_1,
+        enabled=True,
+        source_type=source_type,
+        acm_pca_arn=acm_pca_arn,
+    )
+
+
+def _ca(key_algorithm: str, status: str = "ACTIVE"):
+    return CertificateAuthority(
+        arn=PCA_ARN,
+        id=PCA_ID,
+        region=AWS_REGION_US_EAST_1,
+        status=status,
+        type="SUBORDINATE",
+        usage_mode="GENERAL_PURPOSE",
+        key_algorithm=key_algorithm,
+        signing_algorithm=(
+            key_algorithm if "ML_DSA" in key_algorithm else "SHA256WITHRSA"
+        ),
+    )
+
+
+def _build_clients(trust_anchors, certificate_authorities=None, audit_config=None):
+    ra_client = mock.MagicMock()
+    ra_client.trust_anchors = trust_anchors
+    ra_client.audit_config = audit_config or {}
+    pca_client = mock.MagicMock()
+    pca_client.certificate_authorities = certificate_authorities or {}
+    return ra_client, pca_client
+
+
+def _patched(ra_client, pca_client):
+    aws_provider = set_mocked_aws_provider([AWS_REGION_US_EAST_1])
+    return [
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=aws_provider,
+        ),
+        mock.patch(
+            "prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_client",
+            new=ra_client,
+        ),
+        mock.patch(
+            "prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki.acmpca_client",
+            new=pca_client,
+        ),
+    ]
+
+
+def _enter(patches):
+    from contextlib import ExitStack
+
+    stack = ExitStack()
+    for p in patches:
+        stack.enter_context(p)
+    return stack
+
+
+class Test_rolesanywhere_trust_anchor_pqc_pki:
+    def test_no_trust_anchors(self):
+        ra_client, pca_client = _build_clients({})
+        with _enter(_patched(ra_client, pca_client)):
+            from prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki import (
+                rolesanywhere_trust_anchor_pqc_pki,
+            )
+
+            result = rolesanywhere_trust_anchor_pqc_pki().execute()
+            assert len(result) == 0
+
+    def test_pca_backed_pqc(self):
+        ra_client, pca_client = _build_clients(
+            {TA_ARN: _trust_anchor(source_type="AWS_ACM_PCA", acm_pca_arn=PCA_ARN)},
+            certificate_authorities={PCA_ARN: _ca("ML_DSA_65")},
+        )
+        with _enter(_patched(ra_client, pca_client)):
+            from prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki import (
+                rolesanywhere_trust_anchor_pqc_pki,
+            )
+
+            result = rolesanywhere_trust_anchor_pqc_pki().execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "ML_DSA_65" in result[0].status_extended
+            assert result[0].resource_id == TA_ID
+            assert result[0].resource_arn == TA_ARN
+
+    def test_pca_backed_custom_allowlist_pqc(self):
+        ra_client, pca_client = _build_clients(
+            {TA_ARN: _trust_anchor(source_type="AWS_ACM_PCA", acm_pca_arn=PCA_ARN)},
+            certificate_authorities={PCA_ARN: _ca("CUSTOM_PQC")},
+            audit_config={"rolesanywhere_pqc_pca_key_algorithms": ["CUSTOM_PQC"]},
+        )
+        with _enter(_patched(ra_client, pca_client)):
+            from prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki import (
+                rolesanywhere_trust_anchor_pqc_pki,
+            )
+
+            result = rolesanywhere_trust_anchor_pqc_pki().execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "CUSTOM_PQC" in result[0].status_extended
+            assert result[0].resource_id == TA_ID
+            assert result[0].resource_arn == TA_ARN
+
+    def test_custom_allowlist_replaces_default(self):
+        ra_client, pca_client = _build_clients(
+            {TA_ARN: _trust_anchor(source_type="AWS_ACM_PCA", acm_pca_arn=PCA_ARN)},
+            certificate_authorities={PCA_ARN: _ca("ML_DSA_65")},
+            audit_config={"rolesanywhere_pqc_pca_key_algorithms": ["ML_DSA_87"]},
+        )
+        with _enter(_patched(ra_client, pca_client)):
+            from prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki import (
+                rolesanywhere_trust_anchor_pqc_pki,
+            )
+
+            result = rolesanywhere_trust_anchor_pqc_pki().execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "ML_DSA_65" in result[0].status_extended
+            assert "not post-quantum (ML-DSA)" in result[0].status_extended
+
+    def test_pca_backed_rsa(self):
+        ra_client, pca_client = _build_clients(
+            {TA_ARN: _trust_anchor(source_type="AWS_ACM_PCA", acm_pca_arn=PCA_ARN)},
+            certificate_authorities={PCA_ARN: _ca("RSA_2048")},
+        )
+        with _enter(_patched(ra_client, pca_client)):
+            from prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki import (
+                rolesanywhere_trust_anchor_pqc_pki,
+            )
+
+            result = rolesanywhere_trust_anchor_pqc_pki().execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "RSA_2048" in result[0].status_extended
+
+    def test_pca_backed_inactive_pqc_ca(self):
+        ra_client, pca_client = _build_clients(
+            {TA_ARN: _trust_anchor(source_type="AWS_ACM_PCA", acm_pca_arn=PCA_ARN)},
+            certificate_authorities={PCA_ARN: _ca("ML_DSA_65", status="DISABLED")},
+        )
+        with _enter(_patched(ra_client, pca_client)):
+            from prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki import (
+                rolesanywhere_trust_anchor_pqc_pki,
+            )
+
+            result = rolesanywhere_trust_anchor_pqc_pki().execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "DISABLED status" in result[0].status_extended
+
+    def test_pca_not_in_inventory(self):
+        ra_client, pca_client = _build_clients(
+            {TA_ARN: _trust_anchor(source_type="AWS_ACM_PCA", acm_pca_arn=PCA_ARN)},
+            certificate_authorities={},
+        )
+        with _enter(_patched(ra_client, pca_client)):
+            from prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki import (
+                rolesanywhere_trust_anchor_pqc_pki,
+            )
+
+            result = rolesanywhere_trust_anchor_pqc_pki().execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "could not be inspected" in result[0].status_extended
+
+    def test_certificate_bundle_source(self):
+        ra_client, pca_client = _build_clients(
+            {TA_ARN: _trust_anchor(source_type="CERTIFICATE_BUNDLE")},
+        )
+        with _enter(_patched(ra_client, pca_client)):
+            from prowler.providers.aws.services.rolesanywhere.rolesanywhere_trust_anchor_pqc_pki.rolesanywhere_trust_anchor_pqc_pki import (
+                rolesanywhere_trust_anchor_pqc_pki,
+            )
+
+            result = rolesanywhere_trust_anchor_pqc_pki().execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "CERTIFICATE_BUNDLE" in result[0].status_extended

From b6caaa42684caf18d4c755f3a496080d0b253179 Mon Sep 17 00:00:00 2001
From: Nikhil Kumar <120698682+Nikhilkumar2311@users.noreply.github.com>
Date: Tue, 23 Jun 2026 00:09:39 +0530
Subject: [PATCH 122/126] feat(kubernetes): checks for memory limits, memory
 requests, and image tag (#11373)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../core/core_cpu_limits_set/__init__.py      |   0
 .../core_cpu_limits_set.metadata.json         |  35 ++
 .../core_cpu_limits_set.py                    |  35 ++
 .../core/core_cpu_requests_set/__init__.py    |   0
 .../core_cpu_requests_set.metadata.json       |  35 ++
 .../core_cpu_requests_set.py                  |  39 ++
 .../core/core_image_tag_fixed/__init__.py     |   0
 .../core_image_tag_fixed.metadata.json        |  37 ++
 .../core_image_tag_fixed.py                   |  50 ++
 .../__init__.py                               |   0
 ...re_liveness_probe_configured.metadata.json |  36 ++
 .../core_liveness_probe_configured.py         |  28 +
 .../core/core_memory_limits_set/__init__.py   |   0
 .../core_memory_limits_set.metadata.json      |  37 ++
 .../core_memory_limits_set.py                 |  39 ++
 .../core/core_memory_requests_set/__init__.py |   0
 .../core_memory_requests_set.metadata.json    |  37 ++
 .../core_memory_requests_set.py               |  39 ++
 .../__init__.py                               |   0
 ...e_readiness_probe_configured.metadata.json |  35 ++
 .../core_readiness_probe_configured.py        |  28 +
 .../kubernetes/services/core/core_service.py  |  90 +--
 .../kubernetes/services/core/conftest.py      |  74 +++
 .../core_cpu_limits_set_test.py               |  82 +++
 .../core_cpu_requests_set_test.py             |  80 +++
 .../core_image_tag_fixed_test.py              | 572 ++++++++++++++++++
 .../core_liveness_probe_configured_test.py    |  83 +++
 .../core_memory_limits_set_test.py            | 313 ++++++++++
 .../core_memory_requests_set_test.py          | 313 ++++++++++
 .../core_readiness_probe_configured_test.py   |  83 +++
 31 files changed, 2163 insertions(+), 38 deletions(-)
 create mode 100644 prowler/providers/kubernetes/services/core/core_cpu_limits_set/__init__.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set.metadata.json
 create mode 100644 prowler/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_cpu_requests_set/__init__.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set.metadata.json
 create mode 100644 prowler/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_image_tag_fixed/__init__.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed.metadata.json
 create mode 100644 prowler/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_liveness_probe_configured/__init__.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured.metadata.json
 create mode 100644 prowler/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_memory_limits_set/__init__.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set.metadata.json
 create mode 100644 prowler/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_memory_requests_set/__init__.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set.metadata.json
 create mode 100644 prowler/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_readiness_probe_configured/__init__.py
 create mode 100644 prowler/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured.metadata.json
 create mode 100644 prowler/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured.py
 create mode 100644 tests/providers/kubernetes/services/core/conftest.py
 create mode 100644 tests/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set_test.py
 create mode 100644 tests/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set_test.py
 create mode 100644 tests/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed_test.py
 create mode 100644 tests/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured_test.py
 create mode 100644 tests/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set_test.py
 create mode 100644 tests/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set_test.py
 create mode 100644 tests/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 94e947dd7a..81ef417ed9 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -50,6 +50,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `transfer_server_pqc_ssh_kex_enabled` check for AWS provider to verify Transfer Family servers use a post-quantum hybrid SSH key exchange security policy [(#11315)](https://github.com/prowler-cloud/prowler/pull/11315)
 - `acmpca_certificate_authority_pqc_key_algorithm` check and new `acmpca` service for AWS provider to verify AWS Private CA certificate authorities use a post-quantum (ML-DSA) key algorithm [(#11318)](https://github.com/prowler-cloud/prowler/pull/11318)
 - `rolesanywhere_trust_anchor_pqc_pki` check and new `rolesanywhere` service for AWS provider to verify IAM Roles Anywhere trust anchors are backed by a post-quantum (ML-DSA) PKI [(#11319)](https://github.com/prowler-cloud/prowler/pull/11319)
+- Kubernetes core checks for container CPU limits, CPU requests, memory limits, memory requests, fixed image tags, liveness probes, and readiness probes [(#11373)](https://github.com/prowler-cloud/prowler/pull/11373)
 
 ### 🔄 Changed
 
diff --git a/prowler/providers/kubernetes/services/core/core_cpu_limits_set/__init__.py b/prowler/providers/kubernetes/services/core/core_cpu_limits_set/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set.metadata.json b/prowler/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set.metadata.json
new file mode 100644
index 0000000000..5831cb2abd
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set.metadata.json
@@ -0,0 +1,35 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "core_cpu_limits_set",
+  "CheckTitle": "Pod containers have CPU limits set",
+  "CheckType": [],
+  "ServiceName": "core",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesPod",
+  "Description": "Ensure CPU limits are set for containers to prevent noisy neighbors and resource exhaustion.",
+  "Risk": "Missing CPU limits can allow containers to consume unbounded CPU leading to performance issues.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "kubectl set resources deployment/<name> -n <namespace> --containers=<container> --limits=cpu=500m",
+      "NativeIaC": "# Example: set cpu limits in container resources\nresources:\n  limits:\n    cpu: \"500m\"",
+      "Other": "1. Edit the Pod/Deployment manifest and set `resources.limits.cpu` for each container.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Define CPU limits to bound a container's CPU usage and protect node stability.",
+      "Url": "https://hub.prowler.com/check/core_cpu_limits_set"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Limits should be tuned per workload and monitored."
+}
diff --git a/prowler/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set.py b/prowler/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set.py
new file mode 100644
index 0000000000..8f22fa6b28
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set.py
@@ -0,0 +1,35 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.core.core_client import core_client
+
+
+class core_cpu_limits_set(Check):
+    """Check whether regular pod containers have CPU limits configured."""
+
+    def execute(self) -> list[Check_Report_Kubernetes]:
+        """Execute the Kubernetes pod CPU limits check.
+
+        Returns:
+            List of check reports for Kubernetes pods.
+        """
+        findings = []
+        for pod in core_client.pods.values():
+            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
+            report.status = "PASS"
+            report.status_extended = (
+                f"Pod {pod.name} regular containers have CPU limits configured."
+            )
+
+            for container in (pod.containers or {}).values():
+                resources = container.resources or {}
+                limits = (
+                    resources.get("limits") if isinstance(resources, dict) else None
+                )
+                cpu = limits.get("cpu") if limits and isinstance(limits, dict) else None
+                if not cpu:
+                    report.status = "FAIL"
+                    report.status_extended = f"Pod {pod.name} container {container.name} does not have a CPU limit configured."
+                    break
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/kubernetes/services/core/core_cpu_requests_set/__init__.py b/prowler/providers/kubernetes/services/core/core_cpu_requests_set/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set.metadata.json b/prowler/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set.metadata.json
new file mode 100644
index 0000000000..9f3972e271
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set.metadata.json
@@ -0,0 +1,35 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "core_cpu_requests_set",
+  "CheckTitle": "Pod containers have CPU requests set",
+  "CheckType": [],
+  "ServiceName": "core",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesPod",
+  "Description": "Ensure CPU requests are set for containers to enable proper scheduling and resource guarantees.",
+  "Risk": "Missing CPU requests can lead to scheduling and resource contention issues.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "kubectl set resources deployment/<name> -n <namespace> --containers=<container> --requests=cpu=100m",
+      "NativeIaC": "# Example: set cpu requests in container resources\nresources:\n  requests:\n    cpu: \"100m\"",
+      "Other": "1. Edit the Pod/Deployment manifest and set `resources.requests.cpu` for each container.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Define sensible CPU requests to enable efficient scheduling and fair resource allocation.",
+      "Url": "https://hub.prowler.com/check/core_cpu_requests_set"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Requests should be tuned per workload and cluster capacity."
+}
diff --git a/prowler/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set.py b/prowler/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set.py
new file mode 100644
index 0000000000..6e7f9f8020
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set.py
@@ -0,0 +1,39 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.core.core_client import core_client
+
+
+class core_cpu_requests_set(Check):
+    """Check whether regular pod containers have CPU requests configured."""
+
+    def execute(self) -> list[Check_Report_Kubernetes]:
+        """Execute the Kubernetes pod CPU requests check.
+
+        Returns:
+            List of check reports for Kubernetes pods.
+        """
+        findings = []
+        for pod in core_client.pods.values():
+            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
+            report.status = "PASS"
+            report.status_extended = (
+                f"Pod {pod.name} regular containers have CPU requests configured."
+            )
+
+            for container in (pod.containers or {}).values():
+                resources = container.resources or {}
+                requests = (
+                    resources.get("requests") if isinstance(resources, dict) else None
+                )
+                cpu = (
+                    requests.get("cpu")
+                    if requests and isinstance(requests, dict)
+                    else None
+                )
+                if not cpu:
+                    report.status = "FAIL"
+                    report.status_extended = f"Pod {pod.name} container {container.name} does not have a CPU request configured."
+                    break
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/kubernetes/services/core/core_image_tag_fixed/__init__.py b/prowler/providers/kubernetes/services/core/core_image_tag_fixed/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed.metadata.json b/prowler/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed.metadata.json
new file mode 100644
index 0000000000..3a395caad1
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "core_image_tag_fixed",
+  "CheckTitle": "Container images use fixed tags",
+  "CheckType": [],
+  "ServiceName": "core",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Pod",
+  "ResourceGroup": "container",
+  "Description": "**Kubernetes Pods** are evaluated for containers using images without a **fixed version tag**, such as `latest` or no tag at all, which results in unpredictable image versions being pulled.",
+  "Risk": "Using **`latest` or untagged images** breaks reproducibility and introduces risk:\n- Deployments may pull different image versions across nodes (integrity)\n- Rollbacks become unreliable when the exact image is unknown\n- Supply-chain attacks can inject malicious code via mutable tags\nCompromised or unexpected images can lead to **data breaches**, **lateral movement**, and **service disruption**.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://kubernetes.io/docs/concepts/containers/images/",
+    "https://kubernetes.io/docs/concepts/configuration/overview/#container-images"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "kubectl set image deployment/<workload-name> <container-name>=<image>:<fixed-version> -n <namespace>\n# Example: kubectl set image deployment/nginx nginx=nginx:1.25.3 -n default\n# For maximum immutability, use an image digest instead: <image>@sha256:<digest>",
+      "NativeIaC": "",
+      "Other": "1. Open your Kubernetes UI (e.g., cloud provider console or Dashboard)\n2. Navigate to the failing workload (Deployment/StatefulSet/DaemonSet) or Pod and choose Edit YAML/Manifest\n3. Update the image field for each affected container to include a specific version tag or digest:\n   - Example: change `nginx` or `nginx:latest` to `nginx:1.25.3` or `nginx@sha256:<digest>`\n4. Save changes (controllers will roll out new Pods). If it is a standalone Pod, delete and recreate it to apply the change",
+      "Terraform": "```hcl\nresource \"kubernetes_pod\" \"<example_resource_name>\" {\n  metadata { name = \"<example_resource_name>\" }\n  spec {\n    container {\n      name  = \"<example_resource_name>\"\n      image = \"nginx:1.25.3\" # Critical: use a fixed version tag, never 'latest' or untagged\n    }\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Pin all container images to a **specific version tag** or **digest** (`@sha256:...`) to ensure reproducible, auditable deployments.\n\n- Avoid `latest` and untagged images in production\n- Use **image digests** for maximum immutability\n- Enforce tag policies with **admission controllers** (e.g., OPA Gatekeeper, Kyverno)\n- Integrate image scanning into CI/CD pipelines for **defense in depth**",
+      "Url": "https://hub.prowler.com/check/core_image_tag_fixed"
+    }
+  },
+  "Categories": [
+    "container-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Using fixed image tags ensures reproducible deployments and reduces supply-chain attack surface."
+}
diff --git a/prowler/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed.py b/prowler/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed.py
new file mode 100644
index 0000000000..5167d09f2c
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed.py
@@ -0,0 +1,50 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.core.core_client import core_client
+
+
+def _has_fixed_image_tag(image: str) -> bool:
+    if "@" in image:
+        return True
+
+    image_name = image.rsplit("/", 1)[-1]
+    if ":" not in image_name:
+        return False
+
+    tag = image_name.rsplit(":", 1)[-1]
+    return bool(tag) and tag.lower() != "latest"
+
+
+class core_image_tag_fixed(Check):
+    """Ensure that image tag is not set to latest or blank."""
+
+    def execute(self) -> list[Check_Report_Kubernetes]:
+        """Execute the check logic.
+
+        Returns:
+            A list of reports containing the result of the check.
+        """
+        findings = []
+        for pod in core_client.pods.values():
+            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
+            report.status = "PASS"
+            report.status_extended = (
+                f"Pod {pod.name} has fixed image tags on all containers."
+            )
+
+            for containers in (
+                pod.containers,
+                pod.init_containers,
+                pod.ephemeral_containers,
+            ):
+                for container in (containers or {}).values():
+                    image = container.image
+                    if not _has_fixed_image_tag(image):
+                        report.status = "FAIL"
+                        report.status_extended = f"Pod {pod.name} has container {container.name} with image '{image}' that does not use a fixed tag."
+                        break
+                if report.status == "FAIL":
+                    break
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/kubernetes/services/core/core_liveness_probe_configured/__init__.py b/prowler/providers/kubernetes/services/core/core_liveness_probe_configured/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured.metadata.json b/prowler/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured.metadata.json
new file mode 100644
index 0000000000..668551bca4
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured.metadata.json
@@ -0,0 +1,36 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "core_liveness_probe_configured",
+  "CheckTitle": "Pod containers have liveness probes configured",
+  "CheckType": [],
+  "ServiceName": "core",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesPod",
+  "Description": "Ensure each regular pod container has a liveness probe configured to detect and restart unhealthy containers.",
+  "Risk": "Without liveness probes, failed containers may remain running causing degraded service or resource waste.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/",
+    "https://sre.google/workbook/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "kubectl patch deployment/<name> -n <namespace> --type='json' -p='[{\"op\":\"add\",\"path\":\"/spec/template/spec/containers/0/livenessProbe\",\"value\":{\"httpGet\":{\"path\":\"/healthz\",\"port\":8080},\"initialDelaySeconds\":10,\"periodSeconds\":10}}]'",
+      "NativeIaC": "# Example: add a livenessProbe to your container spec\nlivenessProbe:\n  httpGet:\n    path: /healthz\n    port: 8080\n  initialDelaySeconds: 10\n  periodSeconds: 10",
+      "Other": "1. Edit the Pod/Deployment manifest and add a `livenessProbe` to each container.\n2. Tune `initialDelaySeconds`, `periodSeconds` and failure thresholds to your app.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Add and tune liveness probes for containers to allow Kubernetes to detect and restart unhealthy containers.",
+      "Url": "https://hub.prowler.com/check/core_liveness_probe_configured"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Presence of a probe is checked; adjust thresholds for app behavior to avoid false positives."
+}
diff --git a/prowler/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured.py b/prowler/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured.py
new file mode 100644
index 0000000000..0bfbc618d2
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured.py
@@ -0,0 +1,28 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.core.core_client import core_client
+
+
+class core_liveness_probe_configured(Check):
+    """Check whether regular pod containers have liveness probes configured."""
+
+    def execute(self) -> list[Check_Report_Kubernetes]:
+        """Execute the Kubernetes pod liveness probe check.
+
+        Returns:
+            List of check reports for Kubernetes pods.
+        """
+        findings = []
+        for pod in core_client.pods.values():
+            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
+            report.status = "PASS"
+            report.status_extended = f"Pod {pod.name} has liveness probes configured for all regular containers."
+
+            for container in (pod.containers or {}).values():
+                if not container.liveness_probe:
+                    report.status = "FAIL"
+                    report.status_extended = f"Pod {pod.name} container {container.name} does not have a liveness probe configured."
+                    break
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/kubernetes/services/core/core_memory_limits_set/__init__.py b/prowler/providers/kubernetes/services/core/core_memory_limits_set/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set.metadata.json b/prowler/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set.metadata.json
new file mode 100644
index 0000000000..8b9a121bf2
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "core_memory_limits_set",
+  "CheckTitle": "Container memory limits are configured",
+  "CheckType": [],
+  "ServiceName": "core",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Pod",
+  "ResourceGroup": "container",
+  "Description": "**Kubernetes Pods** are evaluated for containers without **memory limits** configured in `resources.limits.memory`, indicating unbounded memory consumption is permitted.",
+  "Risk": "Without **memory limits**, a single container can consume all available node memory, causing:\n- **OOM kills** of other workloads (availability)\n- Node instability and cascading failures\n- Noisy-neighbor problems in multi-tenant clusters\nAttackers exploiting a vulnerability can amplify impact by exhausting node resources, enabling **denial of service** across co-located workloads.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
+    "https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/memory-default-namespace/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "kubectl set resources deployment/<workload-name> -c <container-name> --limits=memory=<memory-limit> -n <namespace>\n# Example: kubectl set resources deployment/nginx -c nginx --limits=memory=128Mi -n default",
+      "NativeIaC": "",
+      "Other": "1. Open your Kubernetes UI (e.g., cloud provider console or Dashboard)\n2. Navigate to the failing workload (Deployment/StatefulSet/DaemonSet) or Pod and choose Edit YAML/Manifest\n3. Set resources.limits.memory for each affected container:\n   - For controllers: spec.template.spec.containers[].resources.limits.memory\n   - For standalone Pods: spec.containers[].resources.limits.memory\n4. Save changes (controllers will roll out new Pods). If it is a standalone Pod, delete and recreate it to apply the change",
+      "Terraform": "```hcl\nresource \"kubernetes_pod\" \"<example_resource_name>\" {\n  metadata { name = \"<example_resource_name>\" }\n  spec {\n    container {\n      name  = \"<example_resource_name>\"\n      image = \"<IMAGE>\"\n      resources {\n        limits = {\n          memory = \"128Mi\" # Critical: sets a memory ceiling to prevent unbounded consumption\n        }\n      }\n    }\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Set **memory limits** on every container to prevent unbounded consumption and protect node stability.\n\n- Start with observed usage plus headroom; tune with **VPA** recommendations\n- Combine with **LimitRanges** and **ResourceQuotas** at the namespace level for **defense in depth**\n- Monitor memory usage and OOMKill events to right-size limits over time",
+      "Url": "https://hub.prowler.com/check/core_memory_limits_set"
+    }
+  },
+  "Categories": [
+    "container-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Memory limits prevent containers from consuming unbounded memory and protect node stability."
+}
diff --git a/prowler/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set.py b/prowler/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set.py
new file mode 100644
index 0000000000..2fd623c8d5
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set.py
@@ -0,0 +1,39 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.core.core_client import core_client
+
+
+class core_memory_limits_set(Check):
+    """Ensure that memory limits are set on all containers."""
+
+    def execute(self) -> list[Check_Report_Kubernetes]:
+        """Execute the check logic.
+
+        Returns:
+            A list of reports containing the result of the check.
+        """
+        findings = []
+        for pod in core_client.pods.values():
+            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
+            report.status = "PASS"
+            report.status_extended = (
+                f"Pod {pod.name} has memory limits set on all containers."
+            )
+
+            for container in (pod.containers or {}).values():
+                resources = container.resources or {}
+                limits = (
+                    resources.get("limits") if isinstance(resources, dict) else None
+                )
+                memory = (
+                    limits.get("memory")
+                    if limits and isinstance(limits, dict)
+                    else None
+                )
+                if not memory:
+                    report.status = "FAIL"
+                    report.status_extended = f"Pod {pod.name} does not have memory limits set on container {container.name}."
+                    break
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/kubernetes/services/core/core_memory_requests_set/__init__.py b/prowler/providers/kubernetes/services/core/core_memory_requests_set/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set.metadata.json b/prowler/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set.metadata.json
new file mode 100644
index 0000000000..1871884621
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "core_memory_requests_set",
+  "CheckTitle": "Container memory requests are configured",
+  "CheckType": [],
+  "ServiceName": "core",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "Pod",
+  "ResourceGroup": "container",
+  "Description": "**Kubernetes Pods** are evaluated for containers without **memory requests** configured in `resources.requests.memory`, indicating the scheduler cannot guarantee memory allocation.",
+  "Risk": "Without **memory requests**, the scheduler cannot make informed placement decisions, leading to:\n- Overcommitted nodes that trigger **OOM kills** (availability)\n- Unpredictable performance under load\n- Inability to enforce **ResourceQuotas** effectively\nMissing requests weaken cluster stability and make capacity planning unreliable, increasing blast radius during incidents.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
+    "https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/memory-default-namespace/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "kubectl set resources deployment/<workload-name> -c <container-name> --requests=memory=<memory-request> -n <namespace>\n# Example: kubectl set resources deployment/nginx -c nginx --requests=memory=64Mi -n default",
+      "NativeIaC": "",
+      "Other": "1. Open your Kubernetes UI (e.g., cloud provider console or Dashboard)\n2. Navigate to the failing workload (Deployment/StatefulSet/DaemonSet) or Pod and choose Edit YAML/Manifest\n3. Set resources.requests.memory for each affected container:\n   - For controllers: spec.template.spec.containers[].resources.requests.memory\n   - For standalone Pods: spec.containers[].resources.requests.memory\n4. Save changes (controllers will roll out new Pods). If it is a standalone Pod, delete and recreate it to apply the change",
+      "Terraform": "```hcl\nresource \"kubernetes_pod\" \"<example_resource_name>\" {\n  metadata { name = \"<example_resource_name>\" }\n  spec {\n    container {\n      name  = \"<example_resource_name>\"\n      image = \"<IMAGE>\"\n      resources {\n        requests = {\n          memory = \"64Mi\" # Critical: guarantees memory for the scheduler to make informed placement\n        }\n      }\n    }\n  }\n}\n```"
+    },
+    "Recommendation": {
+      "Text": "Set **memory requests** on every container so the scheduler can guarantee memory allocation and place pods effectively.\n\n- Base requests on observed steady-state usage; use **VPA** for data-driven sizing\n- Enforce minimum requests via **LimitRanges** at the namespace level\n- Combine with **ResourceQuotas** for **defense in depth** against overcommitment",
+      "Url": "https://hub.prowler.com/check/core_memory_requests_set"
+    }
+  },
+  "Categories": [
+    "container-security"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Memory requests enable the scheduler to guarantee memory allocation and prevent overcommitment."
+}
diff --git a/prowler/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set.py b/prowler/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set.py
new file mode 100644
index 0000000000..a560365e32
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set.py
@@ -0,0 +1,39 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.core.core_client import core_client
+
+
+class core_memory_requests_set(Check):
+    """Ensure that memory requests are set on all containers."""
+
+    def execute(self) -> list[Check_Report_Kubernetes]:
+        """Execute the check logic.
+
+        Returns:
+            A list of reports containing the result of the check.
+        """
+        findings = []
+        for pod in core_client.pods.values():
+            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
+            report.status = "PASS"
+            report.status_extended = (
+                f"Pod {pod.name} has memory requests set on all containers."
+            )
+
+            for container in (pod.containers or {}).values():
+                resources = container.resources or {}
+                requests = (
+                    resources.get("requests") if isinstance(resources, dict) else None
+                )
+                memory = (
+                    requests.get("memory")
+                    if requests and isinstance(requests, dict)
+                    else None
+                )
+                if not memory:
+                    report.status = "FAIL"
+                    report.status_extended = f"Pod {pod.name} does not have memory requests set on container {container.name}."
+                    break
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/kubernetes/services/core/core_readiness_probe_configured/__init__.py b/prowler/providers/kubernetes/services/core/core_readiness_probe_configured/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured.metadata.json b/prowler/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured.metadata.json
new file mode 100644
index 0000000000..5c61381064
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured.metadata.json
@@ -0,0 +1,35 @@
+{
+  "Provider": "kubernetes",
+  "CheckID": "core_readiness_probe_configured",
+  "CheckTitle": "Regular pod containers have readiness probes configured",
+  "CheckType": [],
+  "ServiceName": "core",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "KubernetesPod",
+  "Description": "Ensure each regular pod container has a readiness probe configured to signal when it is ready to serve traffic.",
+  "Risk": "Without readiness probes, services may receive traffic before containers are ready, causing errors.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "kubectl patch deployment/<name> -n <namespace> --type='json' -p='[{\"op\":\"add\",\"path\":\"/spec/template/spec/containers/0/readinessProbe\",\"value\":{\"httpGet\":{\"path\":\"/ready\",\"port\":8080},\"initialDelaySeconds\":5,\"periodSeconds\":5}}]'",
+      "NativeIaC": "# Example readiness probe\nreadinessProbe:\n  httpGet:\n    path: /ready\n    port: 8080\n  initialDelaySeconds: 5\n  periodSeconds: 5",
+      "Other": "1. Add a `readinessProbe` to the container spec in Deployments/Pods.\n2. Ensure the probe accurately reflects service readiness.",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Add readiness probes to prevent routing traffic to unready containers.",
+      "Url": "https://hub.prowler.com/check/core_readiness_probe_configured"
+    }
+  },
+  "Categories": [
+    "resilience"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "Readiness and liveness probes serve different purposes; implement both where appropriate."
+}
diff --git a/prowler/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured.py b/prowler/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured.py
new file mode 100644
index 0000000000..847f9b4b97
--- /dev/null
+++ b/prowler/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured.py
@@ -0,0 +1,28 @@
+from prowler.lib.check.models import Check, Check_Report_Kubernetes
+from prowler.providers.kubernetes.services.core.core_client import core_client
+
+
+class core_readiness_probe_configured(Check):
+    """Check whether regular pod containers have readiness probes configured."""
+
+    def execute(self) -> list[Check_Report_Kubernetes]:
+        """Execute the Kubernetes pod readiness probe check.
+
+        Returns:
+            List of check reports for Kubernetes pods.
+        """
+        findings = []
+        for pod in core_client.pods.values():
+            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
+            report.status = "PASS"
+            report.status_extended = f"Pod {pod.name} has readiness probes configured for all regular containers."
+
+            for container in (pod.containers or {}).values():
+                if not container.readiness_probe:
+                    report.status = "FAIL"
+                    report.status_extended = f"Pod {pod.name} container {container.name} does not have a readiness probe configured."
+                    break
+
+            findings.append(report)
+
+        return findings
diff --git a/prowler/providers/kubernetes/services/core/core_service.py b/prowler/providers/kubernetes/services/core/core_service.py
index e685140a87..b53a81779c 100644
--- a/prowler/providers/kubernetes/services/core/core_service.py
+++ b/prowler/providers/kubernetes/services/core/core_service.py
@@ -27,45 +27,11 @@ class Core(KubernetesService):
             for namespace in self.namespaces:
                 pods = self.client.list_namespaced_pod(namespace)
                 for pod in pods.items:
-                    pod_containers = {}
-                    containers = pod.spec.containers if pod.spec.containers else []
-                    init_containers = (
-                        pod.spec.init_containers if pod.spec.init_containers else []
-                    )
-                    ephemeral_containers = (
+                    containers = self._build_containers(pod.spec.containers)
+                    init_containers = self._build_containers(pod.spec.init_containers)
+                    ephemeral_containers = self._build_containers(
                         pod.spec.ephemeral_containers
-                        if pod.spec.ephemeral_containers
-                        else []
                     )
-                    for container in (
-                        containers + init_containers + ephemeral_containers
-                    ):
-                        pod_containers[container.name] = Container(
-                            name=container.name,
-                            image=container.image,
-                            command=container.command if container.command else None,
-                            ports=(
-                                [
-                                    {"containerPort": port.container_port}
-                                    for port in container.ports
-                                ]
-                                if container.ports
-                                else None
-                            ),
-                            env=(
-                                [
-                                    {"name": env.name, "value": env.value}
-                                    for env in container.env
-                                ]
-                                if container.env
-                                else None
-                            ),
-                            security_context=(
-                                container.security_context.to_dict()
-                                if container.security_context
-                                else {}
-                            ),
-                        )
                     self.pods[pod.metadata.uid] = Pod(
                         name=pod.metadata.name,
                         uid=pod.metadata.uid,
@@ -85,13 +51,56 @@ class Core(KubernetesService):
                             if pod.spec.security_context
                             else {}
                         ),
-                        containers=pod_containers,
+                        containers=containers,
+                        init_containers=init_containers,
+                        ephemeral_containers=ephemeral_containers,
                     )
         except Exception as error:
             logger.error(
                 f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )
 
+    @staticmethod
+    def _build_containers(containers) -> dict:
+        pod_containers = {}
+        for container in containers or []:
+            pod_containers[container.name] = Container(
+                name=container.name,
+                image=container.image,
+                command=container.command if container.command else None,
+                ports=(
+                    [{"containerPort": port.container_port} for port in container.ports]
+                    if container.ports
+                    else None
+                ),
+                env=(
+                    [{"name": env.name, "value": env.value} for env in container.env]
+                    if container.env
+                    else None
+                ),
+                security_context=(
+                    container.security_context.to_dict()
+                    if container.security_context
+                    else {}
+                ),
+                resources=(
+                    container.resources.to_dict()
+                    if getattr(container, "resources", None)
+                    else None
+                ),
+                liveness_probe=(
+                    container.liveness_probe.to_dict()
+                    if getattr(container, "liveness_probe", None)
+                    else None
+                ),
+                readiness_probe=(
+                    container.readiness_probe.to_dict()
+                    if getattr(container, "readiness_probe", None)
+                    else None
+                ),
+            )
+        return pod_containers
+
     def _list_config_maps(self):
         try:
             response = self.client.list_config_map_for_all_namespaces()
@@ -156,6 +165,9 @@ class Container(BaseModel):
     ports: Optional[List[dict]]
     env: Optional[List[dict]]
     security_context: dict
+    resources: Optional[dict] = None
+    liveness_probe: Optional[dict] = None
+    readiness_probe: Optional[dict] = None
 
 
 class Pod(BaseModel):
@@ -174,6 +186,8 @@ class Pod(BaseModel):
     host_network: Optional[bool]
     security_context: Optional[dict]
     containers: Optional[dict]
+    init_containers: Optional[dict] = None
+    ephemeral_containers: Optional[dict] = None
 
 
 class ConfigMap(BaseModel):
diff --git a/tests/providers/kubernetes/services/core/conftest.py b/tests/providers/kubernetes/services/core/conftest.py
new file mode 100644
index 0000000000..9b0becd33c
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/conftest.py
@@ -0,0 +1,74 @@
+import importlib
+from unittest import mock
+
+from prowler.providers.kubernetes.services.core.core_service import Container, Pod
+from tests.providers.kubernetes.kubernetes_fixtures import (
+    set_mocked_kubernetes_provider,
+)
+
+
+def make_container(
+    name="app",
+    image="nginx:1.25",
+    resources=None,
+    liveness_probe=None,
+    readiness_probe=None,
+):
+    return Container(
+        name=name,
+        image=image,
+        command=None,
+        ports=None,
+        env=None,
+        security_context={},
+        resources=resources,
+        liveness_probe=liveness_probe,
+        readiness_probe=readiness_probe,
+    )
+
+
+def make_pod(
+    containers=None,
+    init_containers=None,
+    ephemeral_containers=None,
+    name="test-pod",
+    uid="test-pod-uid",
+):
+    return Pod(
+        name=name,
+        uid=uid,
+        namespace="default",
+        labels=None,
+        annotations=None,
+        node_name=None,
+        service_account=None,
+        status_phase="Running",
+        pod_ip="10.0.0.1",
+        host_ip="192.168.1.1",
+        host_pid=False,
+        host_ipc=False,
+        host_network=False,
+        security_context={},
+        containers=containers or {},
+        init_containers=init_containers or {},
+        ephemeral_containers=ephemeral_containers or {},
+    )
+
+
+def make_core_client(pods):
+    core_client = mock.MagicMock()
+    core_client.pods = pods
+    return core_client
+
+
+def run_check(module_path, class_name, core_client):
+    with (
+        mock.patch(
+            "prowler.providers.common.provider.Provider.get_global_provider",
+            return_value=set_mocked_kubernetes_provider(),
+        ),
+        mock.patch(f"{module_path}.core_client", new=core_client),
+    ):
+        check_module = importlib.import_module(module_path)
+        check = getattr(check_module, class_name)()
+        return check.execute()
diff --git a/tests/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set_test.py b/tests/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set_test.py
new file mode 100644
index 0000000000..41663daab3
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_cpu_limits_set/core_cpu_limits_set_test.py
@@ -0,0 +1,82 @@
+from tests.providers.kubernetes.services.core.conftest import (
+    make_container,
+    make_core_client,
+    make_pod,
+    run_check,
+)
+
+MODULE = (
+    "prowler.providers.kubernetes.services.core.core_cpu_limits_set.core_cpu_limits_set"
+)
+CLASS = "core_cpu_limits_set"
+
+
+class TestCoreCpuLimitsSet:
+    def test_no_resources(self):
+        result = run_check(MODULE, CLASS, make_core_client({}))
+
+        assert len(result) == 0
+
+    def test_cpu_limit_set_pass(self):
+        pod = make_pod(
+            containers={"app": make_container(resources={"limits": {"cpu": "500m"}})}
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "PASS"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod regular containers have CPU limits configured."
+        )
+
+    def test_cpu_limit_missing_fail(self):
+        pod = make_pod(containers={"app": make_container(resources=None)})
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container app does not have a CPU limit configured."
+        )
+
+    def test_empty_cpu_limit_fail(self):
+        pod = make_pod(
+            containers={"app": make_container(resources={"limits": {"cpu": ""}})}
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+
+    def test_mixed_regular_containers_fail(self):
+        pod = make_pod(
+            containers={
+                "app": make_container(
+                    name="app", resources={"limits": {"cpu": "500m"}}
+                ),
+                "sidecar": make_container(name="sidecar", resources={"limits": {}}),
+            }
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container sidecar does not have a CPU limit configured."
+        )
+
+    def test_init_and_ephemeral_containers_ignored(self):
+        pod = make_pod(
+            containers={"app": make_container(resources={"limits": {"cpu": "500m"}})},
+            init_containers={"init": make_container(name="init", resources=None)},
+            ephemeral_containers={
+                "debug": make_container(name="debug", resources=None)
+            },
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "PASS"
diff --git a/tests/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set_test.py b/tests/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set_test.py
new file mode 100644
index 0000000000..47fcec1b1e
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_cpu_requests_set/core_cpu_requests_set_test.py
@@ -0,0 +1,80 @@
+from tests.providers.kubernetes.services.core.conftest import (
+    make_container,
+    make_core_client,
+    make_pod,
+    run_check,
+)
+
+MODULE = "prowler.providers.kubernetes.services.core.core_cpu_requests_set.core_cpu_requests_set"
+CLASS = "core_cpu_requests_set"
+
+
+class TestCoreCpuRequestsSet:
+    def test_no_resources(self):
+        result = run_check(MODULE, CLASS, make_core_client({}))
+
+        assert len(result) == 0
+
+    def test_cpu_request_set_pass(self):
+        pod = make_pod(
+            containers={"app": make_container(resources={"requests": {"cpu": "100m"}})}
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "PASS"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod regular containers have CPU requests configured."
+        )
+
+    def test_cpu_request_missing_fail(self):
+        pod = make_pod(containers={"app": make_container(resources={})})
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container app does not have a CPU request configured."
+        )
+
+    def test_empty_cpu_request_fail(self):
+        pod = make_pod(
+            containers={"app": make_container(resources={"requests": {"cpu": ""}})}
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+
+    def test_mixed_regular_containers_fail(self):
+        pod = make_pod(
+            containers={
+                "app": make_container(
+                    name="app", resources={"requests": {"cpu": "100m"}}
+                ),
+                "sidecar": make_container(name="sidecar", resources=None),
+            }
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container sidecar does not have a CPU request configured."
+        )
+
+    def test_init_and_ephemeral_containers_ignored(self):
+        pod = make_pod(
+            containers={"app": make_container(resources={"requests": {"cpu": "100m"}})},
+            init_containers={"init": make_container(name="init", resources=None)},
+            ephemeral_containers={
+                "debug": make_container(name="debug", resources=None)
+            },
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "PASS"
diff --git a/tests/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed_test.py b/tests/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed_test.py
new file mode 100644
index 0000000000..a5e62e8157
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_image_tag_fixed/core_image_tag_fixed_test.py
@@ -0,0 +1,572 @@
+from unittest import mock
+
+from prowler.providers.kubernetes.services.core.core_service import Container, Pod
+from tests.providers.kubernetes.kubernetes_fixtures import (
+    set_mocked_kubernetes_provider,
+)
+from tests.providers.kubernetes.services.core.conftest import (
+    make_container,
+    make_core_client,
+    make_pod,
+    run_check,
+)
+
+MODULE = "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed"
+CLASS = "core_image_tag_fixed"
+
+
+class Test_core_image_tag_fixed:
+    def test_no_pods(self):
+        core_client = mock.MagicMock()
+        core_client.pods = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_image_tag_fixed(self):
+        container = Container(
+            name="test-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                "Pod test-pod has fixed image tags on all containers."
+            )
+            assert result[0].resource_id == "test-uid-1234"
+            assert result[0].resource_name == "test-pod"
+
+    def test_pod_without_containers(self):
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers=None,
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                "Pod test-pod has fixed image tags on all containers."
+            )
+
+    def test_image_tag_latest(self):
+        container = Container(
+            name="test-container",
+            image="nginx:latest",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "does not use a fixed tag" in result[0].status_extended
+
+    def test_image_tag_blank(self):
+        container = Container(
+            name="test-container",
+            image="nginx",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "does not use a fixed tag" in result[0].status_extended
+
+    def test_image_with_digest(self):
+        container = Container(
+            name="test-container",
+            image="nginx@sha256:abc123def456",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+
+    def test_image_with_registry_port_and_no_tag(self):
+        container = Container(
+            name="test-container",
+            image="localhost:5000/nginx",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "does not use a fixed tag" in result[0].status_extended
+
+    def test_image_tag_uppercase_latest(self):
+        container = Container(
+            name="test-container",
+            image="nginx:Latest",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "does not use a fixed tag" in result[0].status_extended
+
+    def test_image_with_empty_tag(self):
+        container = Container(
+            name="test-container",
+            image="nginx:",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "does not use a fixed tag" in result[0].status_extended
+
+    def test_mixed_containers_fails_on_first_unfixed_image(self):
+        fixed_container = Container(
+            name="fixed-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+        latest_container = Container(
+            name="latest-container",
+            image="busybox:latest",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={
+                "fixed-container": fixed_container,
+                "latest-container": latest_container,
+            },
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_image_tag_fixed.core_image_tag_fixed import (
+                core_image_tag_fixed,
+            )
+
+            check = core_image_tag_fixed()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                "Pod test-pod has container latest-container with image 'busybox:latest' that does not use a fixed tag."
+            )
+
+    def test_init_container_image_tag_latest(self):
+        pod = make_pod(
+            containers={"app": make_container(image="nginx:1.25.3")},
+            init_containers={
+                "init": make_container(name="init", image="busybox:latest")
+            },
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+        assert result[0].status_extended == (
+            "Pod test-pod has container init with image 'busybox:latest' that does not use a fixed tag."
+        )
+
+    def test_ephemeral_container_image_tag_blank(self):
+        pod = make_pod(
+            containers={"app": make_container(image="nginx:1.25.3")},
+            ephemeral_containers={
+                "debug": make_container(name="debug", image="busybox")
+            },
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+        assert result[0].status_extended == (
+            "Pod test-pod has container debug with image 'busybox' that does not use a fixed tag."
+        )
+
+    def test_init_and_ephemeral_image_tags_fixed_without_regular_containers(self):
+        pod = make_pod(
+            containers=None,
+            init_containers={"init": make_container(name="init", image="busybox:1.36")},
+            ephemeral_containers={
+                "debug": make_container(name="debug", image="debug@sha256:abc123")
+            },
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "PASS"
+        assert result[0].status_extended == (
+            "Pod test-pod has fixed image tags on all containers."
+        )
diff --git a/tests/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured_test.py b/tests/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured_test.py
new file mode 100644
index 0000000000..cc2d1915a5
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_liveness_probe_configured/core_liveness_probe_configured_test.py
@@ -0,0 +1,83 @@
+from tests.providers.kubernetes.services.core.conftest import (
+    make_container,
+    make_core_client,
+    make_pod,
+    run_check,
+)
+
+MODULE = "prowler.providers.kubernetes.services.core.core_liveness_probe_configured.core_liveness_probe_configured"
+CLASS = "core_liveness_probe_configured"
+
+
+class TestCoreLivenessProbeConfigured:
+    def test_no_resources(self):
+        result = run_check(MODULE, CLASS, make_core_client({}))
+
+        assert len(result) == 0
+
+    def test_liveness_probe_configured_pass(self):
+        pod = make_pod(
+            containers={"app": make_container(liveness_probe={"http_get": {}})}
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod has liveness probes configured for all regular containers."
+        )
+
+    def test_liveness_probe_missing_fail(self):
+        pod = make_pod(containers={"app": make_container(liveness_probe=None)})
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container app does not have a liveness probe configured."
+        )
+
+    def test_empty_liveness_probe_fail(self):
+        pod = make_pod(containers={"app": make_container(liveness_probe={})})
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container app does not have a liveness probe configured."
+        )
+
+    def test_mixed_regular_containers_fail(self):
+        pod = make_pod(
+            containers={
+                "app": make_container(name="app", liveness_probe={"http_get": {}}),
+                "sidecar": make_container(name="sidecar", liveness_probe=None),
+            }
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container sidecar does not have a liveness probe configured."
+        )
+
+    def test_init_and_ephemeral_containers_ignored(self):
+        pod = make_pod(
+            containers={"app": make_container(liveness_probe={"http_get": {}})},
+            init_containers={"init": make_container(name="init", liveness_probe=None)},
+            ephemeral_containers={
+                "debug": make_container(name="debug", liveness_probe=None)
+            },
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "PASS"
diff --git a/tests/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set_test.py b/tests/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set_test.py
new file mode 100644
index 0000000000..f3e37ae7f7
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_memory_limits_set/core_memory_limits_set_test.py
@@ -0,0 +1,313 @@
+from unittest import mock
+
+from prowler.providers.kubernetes.services.core.core_service import Container, Pod
+from tests.providers.kubernetes.kubernetes_fixtures import (
+    set_mocked_kubernetes_provider,
+)
+
+
+class Test_core_memory_limits_set:
+    def test_no_pods(self):
+        core_client = mock.MagicMock()
+        core_client.pods = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set import (
+                core_memory_limits_set,
+            )
+
+            check = core_memory_limits_set()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_memory_limits_set(self):
+        container = Container(
+            name="test-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources={
+                "limits": {"memory": "128Mi", "cpu": "500m"},
+                "requests": {"memory": "64Mi", "cpu": "250m"},
+            },
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set import (
+                core_memory_limits_set,
+            )
+
+            check = core_memory_limits_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                "Pod test-pod has memory limits set on all containers."
+            )
+            assert result[0].resource_id == "test-uid-1234"
+            assert result[0].resource_name == "test-pod"
+
+    def test_memory_limits_set_with_no_containers(self):
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers=None,
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set import (
+                core_memory_limits_set,
+            )
+
+            check = core_memory_limits_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                "Pod test-pod has memory limits set on all containers."
+            )
+
+    def test_memory_limits_not_set(self):
+        container = Container(
+            name="test-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set import (
+                core_memory_limits_set,
+            )
+
+            check = core_memory_limits_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                "Pod test-pod does not have memory limits set on container test-container."
+            )
+
+    def test_memory_limits_missing_memory_key(self):
+        container = Container(
+            name="test-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources={
+                "limits": {"cpu": "500m"},
+                "requests": {"memory": "64Mi"},
+            },
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set import (
+                core_memory_limits_set,
+            )
+
+            check = core_memory_limits_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+
+    def test_mixed_containers_fails_on_missing_memory_limit(self):
+        limited_container = Container(
+            name="limited-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources={"limits": {"memory": "128Mi"}},
+        )
+        unlimited_container = Container(
+            name="unlimited-container",
+            image="busybox:1.36",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources={"requests": {"memory": "64Mi"}},
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={
+                "limited-container": limited_container,
+                "unlimited-container": unlimited_container,
+            },
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_limits_set.core_memory_limits_set import (
+                core_memory_limits_set,
+            )
+
+            check = core_memory_limits_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                "Pod test-pod does not have memory limits set on container unlimited-container."
+            )
diff --git a/tests/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set_test.py b/tests/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set_test.py
new file mode 100644
index 0000000000..8da3225abd
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_memory_requests_set/core_memory_requests_set_test.py
@@ -0,0 +1,313 @@
+from unittest import mock
+
+from prowler.providers.kubernetes.services.core.core_service import Container, Pod
+from tests.providers.kubernetes.kubernetes_fixtures import (
+    set_mocked_kubernetes_provider,
+)
+
+
+class Test_core_memory_requests_set:
+    def test_no_pods(self):
+        core_client = mock.MagicMock()
+        core_client.pods = {}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set import (
+                core_memory_requests_set,
+            )
+
+            check = core_memory_requests_set()
+            result = check.execute()
+
+            assert len(result) == 0
+
+    def test_memory_requests_set(self):
+        container = Container(
+            name="test-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources={
+                "limits": {"memory": "128Mi", "cpu": "500m"},
+                "requests": {"memory": "64Mi", "cpu": "250m"},
+            },
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set import (
+                core_memory_requests_set,
+            )
+
+            check = core_memory_requests_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                "Pod test-pod has memory requests set on all containers."
+            )
+            assert result[0].resource_id == "test-uid-1234"
+            assert result[0].resource_name == "test-pod"
+
+    def test_memory_requests_set_with_no_containers(self):
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers=None,
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set import (
+                core_memory_requests_set,
+            )
+
+            check = core_memory_requests_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert result[0].status_extended == (
+                "Pod test-pod has memory requests set on all containers."
+            )
+
+    def test_memory_requests_not_set(self):
+        container = Container(
+            name="test-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources=None,
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set import (
+                core_memory_requests_set,
+            )
+
+            check = core_memory_requests_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                "Pod test-pod does not have memory requests set on container test-container."
+            )
+
+    def test_memory_requests_missing_memory_key(self):
+        container = Container(
+            name="test-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources={
+                "limits": {"memory": "128Mi"},
+                "requests": {"cpu": "250m"},
+            },
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={"test-container": container},
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set import (
+                core_memory_requests_set,
+            )
+
+            check = core_memory_requests_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+
+    def test_mixed_containers_fails_on_missing_memory_request(self):
+        requested_container = Container(
+            name="requested-container",
+            image="nginx:1.25.3",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources={"requests": {"memory": "64Mi"}},
+        )
+        unrequested_container = Container(
+            name="unrequested-container",
+            image="busybox:1.36",
+            command=None,
+            ports=None,
+            env=None,
+            security_context={},
+            resources={"limits": {"memory": "128Mi"}},
+        )
+
+        pod = Pod(
+            name="test-pod",
+            uid="test-uid-1234",
+            namespace="default",
+            labels=None,
+            annotations=None,
+            node_name=None,
+            service_account=None,
+            status_phase="Running",
+            pod_ip="10.0.0.1",
+            host_ip="192.168.1.1",
+            host_pid=None,
+            host_ipc=None,
+            host_network=False,
+            security_context={},
+            containers={
+                "requested-container": requested_container,
+                "unrequested-container": unrequested_container,
+            },
+        )
+
+        core_client = mock.MagicMock()
+        core_client.pods = {"test-uid-1234": pod}
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_kubernetes_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set.core_client",
+                new=core_client,
+            ),
+        ):
+            from prowler.providers.kubernetes.services.core.core_memory_requests_set.core_memory_requests_set import (
+                core_memory_requests_set,
+            )
+
+            check = core_memory_requests_set()
+            result = check.execute()
+
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert result[0].status_extended == (
+                "Pod test-pod does not have memory requests set on container unrequested-container."
+            )
diff --git a/tests/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured_test.py b/tests/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured_test.py
new file mode 100644
index 0000000000..ca316545ae
--- /dev/null
+++ b/tests/providers/kubernetes/services/core/core_readiness_probe_configured/core_readiness_probe_configured_test.py
@@ -0,0 +1,83 @@
+from tests.providers.kubernetes.services.core.conftest import (
+    make_container,
+    make_core_client,
+    make_pod,
+    run_check,
+)
+
+MODULE = "prowler.providers.kubernetes.services.core.core_readiness_probe_configured.core_readiness_probe_configured"
+CLASS = "core_readiness_probe_configured"
+
+
+class TestCoreReadinessProbeConfigured:
+    def test_no_resources(self):
+        result = run_check(MODULE, CLASS, make_core_client({}))
+
+        assert len(result) == 0
+
+    def test_readiness_probe_configured_pass(self):
+        pod = make_pod(
+            containers={"app": make_container(readiness_probe={"http_get": {}})}
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert len(result) == 1
+        assert result[0].status == "PASS"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod has readiness probes configured for all regular containers."
+        )
+
+    def test_readiness_probe_missing_fail(self):
+        pod = make_pod(containers={"app": make_container(readiness_probe=None)})
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container app does not have a readiness probe configured."
+        )
+
+    def test_empty_readiness_probe_fail(self):
+        pod = make_pod(containers={"app": make_container(readiness_probe={})})
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert len(result) == 1
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container app does not have a readiness probe configured."
+        )
+
+    def test_mixed_regular_containers_fail(self):
+        pod = make_pod(
+            containers={
+                "app": make_container(name="app", readiness_probe={"http_get": {}}),
+                "sidecar": make_container(name="sidecar", readiness_probe=None),
+            }
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "FAIL"
+        assert (
+            result[0].status_extended
+            == "Pod test-pod container sidecar does not have a readiness probe configured."
+        )
+
+    def test_init_and_ephemeral_containers_ignored(self):
+        pod = make_pod(
+            containers={"app": make_container(readiness_probe={"http_get": {}})},
+            init_containers={"init": make_container(name="init", readiness_probe=None)},
+            ephemeral_containers={
+                "debug": make_container(name="debug", readiness_probe=None)
+            },
+        )
+
+        result = run_check(MODULE, CLASS, make_core_client({pod.uid: pod}))
+
+        assert result[0].status == "PASS"

From a0fdc96649939460739da75aa820899c87ea9d5a Mon Sep 17 00:00:00 2001
From: s1ns3nz0 <s1ns3nz0@gmail.com>
Date: Tue, 23 Jun 2026 03:59:25 +0900
Subject: [PATCH 123/126] feat(azure): add recovery_vault_has_protected_items
 check (#11048)

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>
---
 prowler/CHANGELOG.md                          |   1 +
 .../azure/services/recovery/__init__.py       |   0
 .../__init__.py                               |   0
 ...up_policy_retention_adequate.metadata.json |  37 ++++
 ..._vault_backup_policy_retention_adequate.py |  65 ++++++
 .../__init__.py                               |   0
 ...ry_vault_has_protected_items.metadata.json |  37 ++++
 .../recovery_vault_has_protected_items.py     |  36 ++++
 ...t_backup_policy_retention_adequate_test.py | 191 ++++++++++++++++++
 ...recovery_vault_has_protected_items_test.py | 116 +++++++++++
 10 files changed, 483 insertions(+)
 create mode 100644 prowler/providers/azure/services/recovery/__init__.py
 create mode 100644 prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/__init__.py
 create mode 100644 prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate.metadata.json
 create mode 100644 prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate.py
 create mode 100644 prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/__init__.py
 create mode 100644 prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items.metadata.json
 create mode 100644 prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items.py
 create mode 100644 tests/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate_test.py
 create mode 100644 tests/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items_test.py

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index 81ef417ed9..c61b1ebf8c 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -262,6 +262,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `bedrock_prompt_management_exists` check for AWS provider [(#10878)](https://github.com/prowler-cloud/prowler/pull/10878)
 - 8 Gmail attachment safety and spoofing protection checks for Google Workspace provider using the Cloud Identity Policy API [(#10980)](https://github.com/prowler-cloud/prowler/pull/10980)
 - `bedrock_prompt_encrypted_with_cmk` check for AWS provider [(#10905)](https://github.com/prowler-cloud/prowler/pull/10905)
+- `recovery_vault_has_protected_items` check for Azure provider, verifying that Recovery Services vaults have at least one protected backup item [(#11048)](https://github.com/prowler-cloud/prowler/pull/11048)
 
 ### 🔄 Changed
 
diff --git a/prowler/providers/azure/services/recovery/__init__.py b/prowler/providers/azure/services/recovery/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/__init__.py b/prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate.metadata.json b/prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate.metadata.json
new file mode 100644
index 0000000000..33f8516d1b
--- /dev/null
+++ b/prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "recovery_vault_backup_policy_retention_adequate",
+  "CheckTitle": "Recovery Services backup policy has at least 30 days retention",
+  "CheckType": [],
+  "ServiceName": "recovery",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "NotDefined",
+  "ResourceGroup": "storage",
+  "Description": "**Azure Recovery Services** backup policies are evaluated for adequate **daily retention**. Policies with fewer than 30 days of retention may not provide sufficient recovery points for incident investigation, compliance requirements, or ransomware recovery scenarios.",
+  "Risk": "Short retention periods limit the ability to recover from **delayed-discovery incidents** such as ransomware that encrypts backups over time, data corruption that propagates across backup cycles, or compliance investigations requiring historical data. Insufficient retention may violate regulatory requirements.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/backup/backup-azure-vm-backup-faq",
+    "https://learn.microsoft.com/en-us/azure/backup/backup-azure-backup-faq"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az backup policy set --resource-group <resource-group> --vault-name <vault-name> --name <policy-name> --policy @policy.json",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the Azure portal\n2. Go to Recovery Services vaults and select the vault\n3. Go to Backup policies\n4. Select the policy to modify\n5. Under Retention range, set Daily backup point retention to at least 30 days\n6. Click Save",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Set daily backup retention to at least **30 days**. For production workloads, consider 90+ days. Configure **weekly, monthly, and yearly** retention points for long-term compliance. Use **immutable vaults** to prevent backup deletion by compromised admin accounts.",
+      "Url": "https://hub.prowler.com/check/recovery_vault_backup_policy_retention_adequate"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check evaluates daily retention from the backup policy's retention_policy.daily_schedule.retention_duration.count. Policies without a daily schedule are flagged. The 30-day minimum aligns with common compliance requirements and incident response timelines."
+}
diff --git a/prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate.py b/prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate.py
new file mode 100644
index 0000000000..b770f87a62
--- /dev/null
+++ b/prowler/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate.py
@@ -0,0 +1,65 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.recovery.recovery_client import recovery_client
+
+MINIMUM_RETENTION_DAYS = 30
+
+
+class recovery_vault_backup_policy_retention_adequate(Check):
+    """Check if vault backup policies retain backups for at least 30 days."""
+
+    def execute(self) -> list[Check_Report_Azure]:
+        """Execute the check across Recovery Services vault backup policies."""
+
+        findings = []
+
+        for subscription_name, vaults in recovery_client.vaults.items():
+            for vault in vaults.values():
+                if not vault.backup_policies:
+                    report = Check_Report_Azure(
+                        metadata=self.metadata(), resource=vault
+                    )
+                    report.subscription = subscription_name
+                    report.resource_name = vault.name
+                    report.resource_id = vault.id
+                    report.location = vault.location
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"Recovery vault '{vault.name}' has no backup "
+                        f"policies configured."
+                    )
+                    findings.append(report)
+                    continue
+
+                for policy in vault.backup_policies.values():
+                    report = Check_Report_Azure(
+                        metadata=self.metadata(), resource=vault
+                    )
+                    report.subscription = subscription_name
+                    report.resource_name = f"{vault.name}/{policy.name}"
+                    report.resource_id = policy.id
+                    report.location = vault.location
+
+                    if policy.retention_days is None:
+                        report.status = "FAIL"
+                        report.status_extended = (
+                            f"Backup policy '{policy.name}' in vault "
+                            f"'{vault.name}' has no daily retention configured."
+                        )
+                    elif policy.retention_days < MINIMUM_RETENTION_DAYS:
+                        report.status = "FAIL"
+                        report.status_extended = (
+                            f"Backup policy '{policy.name}' in vault "
+                            f"'{vault.name}' has {policy.retention_days}-day "
+                            f"retention (minimum: {MINIMUM_RETENTION_DAYS})."
+                        )
+                    else:
+                        report.status = "PASS"
+                        report.status_extended = (
+                            f"Backup policy '{policy.name}' in vault "
+                            f"'{vault.name}' has {policy.retention_days}-day "
+                            f"retention."
+                        )
+
+                    findings.append(report)
+
+        return findings
diff --git a/prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/__init__.py b/prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items.metadata.json b/prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items.metadata.json
new file mode 100644
index 0000000000..04e4405851
--- /dev/null
+++ b/prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items.metadata.json
@@ -0,0 +1,37 @@
+{
+  "Provider": "azure",
+  "CheckID": "recovery_vault_has_protected_items",
+  "CheckTitle": "Recovery Services vault has backup protected items configured",
+  "CheckType": [],
+  "ServiceName": "recovery",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "",
+  "Severity": "medium",
+  "ResourceType": "microsoft.recoveryservices/vaults",
+  "ResourceGroup": "storage",
+  "Description": "**Azure Recovery Services** vaults are evaluated for **backup protected items**. A vault with no protected items indicates that no resources (VMs, databases, file shares) are configured for backup through this vault, potentially leaving critical workloads unprotected.",
+  "Risk": "Empty vaults represent a gap in **disaster recovery** coverage. Resources without backup protection face permanent data loss from accidental deletion, ransomware, corruption, or regional outages. The vault may have been provisioned but backup was never configured.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://learn.microsoft.com/en-us/azure/backup/backup-azure-vms-first-look-arm",
+    "https://learn.microsoft.com/en-us/azure/backup/backup-overview"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "az backup protection enable-for-vm --resource-group <rg> --vault-name <vault> --vm <vm_id> --policy-name DefaultPolicy",
+      "NativeIaC": "",
+      "Other": "1. Sign in to the Azure portal\n2. Go to Recovery Services vaults and select the vault\n3. Click + Backup\n4. Select the workload type (Azure VM, SQL, File Share, etc.)\n5. Select the backup policy\n6. Choose the resources to protect\n7. Click Enable Backup",
+      "Terraform": ""
+    },
+    "Recommendation": {
+      "Text": "Configure **backup protection** for critical resources including VMs, databases, and file shares. Use **Azure Backup policies** with appropriate retention and frequency. If the vault is unused, consider deleting it to reduce resource sprawl.",
+      "Url": "https://hub.prowler.com/check/recovery_vault_has_protected_items"
+    }
+  },
+  "Categories": [
+    "forensics-ready"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": "This check reports on each Recovery Services vault individually. An empty vault is not necessarily a security risk if backups are managed through a different vault or Azure Backup center."
+}
diff --git a/prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items.py b/prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items.py
new file mode 100644
index 0000000000..6ebd9e5328
--- /dev/null
+++ b/prowler/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items.py
@@ -0,0 +1,36 @@
+from prowler.lib.check.models import Check, Check_Report_Azure
+from prowler.providers.azure.services.recovery.recovery_client import recovery_client
+
+
+class recovery_vault_has_protected_items(Check):
+    """Check if Recovery Services vaults have protected backup items."""
+
+    def execute(self) -> list[Check_Report_Azure]:
+        """Execute the check across Recovery Services vaults."""
+
+        findings = []
+
+        for subscription_name, vaults in recovery_client.vaults.items():
+            for vault in vaults.values():
+                report = Check_Report_Azure(metadata=self.metadata(), resource=vault)
+                report.subscription = subscription_name
+                report.resource_name = vault.name
+                report.resource_id = vault.id
+                report.location = vault.location
+
+                if vault.backup_protected_items:
+                    report.status = "PASS"
+                    report.status_extended = (
+                        f"Recovery Services vault '{vault.name}' has "
+                        f"{len(vault.backup_protected_items)} protected items."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"Recovery Services vault '{vault.name}' has no "
+                        f"protected items configured."
+                    )
+
+                findings.append(report)
+
+        return findings
diff --git a/tests/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate_test.py b/tests/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate_test.py
new file mode 100644
index 0000000000..56c7e3f5da
--- /dev/null
+++ b/tests/providers/azure/services/recovery/recovery_vault_backup_policy_retention_adequate/recovery_vault_backup_policy_retention_adequate_test.py
@@ -0,0 +1,191 @@
+from unittest import mock
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+VAULT_ID = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg1/providers/Microsoft.RecoveryServices/vaults/test-vault"
+POLICY_ID = f"{VAULT_ID}/backupPolicies/DefaultPolicy"
+
+
+class Test_recovery_vault_backup_policy_retention_adequate:
+    def test_no_subscriptions(self):
+        recovery_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate.recovery_client",
+                new=recovery_client,
+            ),
+        ):
+            from prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate import (
+                recovery_vault_backup_policy_retention_adequate,
+            )
+
+            recovery_client.vaults = {}
+
+            check = recovery_vault_backup_policy_retention_adequate()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_vault_no_policies(self):
+        recovery_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate.recovery_client",
+                new=recovery_client,
+            ),
+        ):
+            from prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate import (
+                recovery_vault_backup_policy_retention_adequate,
+            )
+            from prowler.providers.azure.services.recovery.recovery_service import (
+                BackupVault,
+            )
+
+            vault = BackupVault(
+                id=VAULT_ID,
+                name="test-vault",
+                location="eastus",
+                backup_policies={},
+            )
+            recovery_client.vaults = {AZURE_SUBSCRIPTION_ID: {VAULT_ID: vault}}
+
+            check = recovery_vault_backup_policy_retention_adequate()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "has no backup policies configured" in result[0].status_extended
+
+    def test_policy_adequate_retention(self):
+        recovery_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate.recovery_client",
+                new=recovery_client,
+            ),
+        ):
+            from prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate import (
+                recovery_vault_backup_policy_retention_adequate,
+            )
+            from prowler.providers.azure.services.recovery.recovery_service import (
+                BackupPolicy,
+                BackupVault,
+            )
+
+            vault = BackupVault(
+                id=VAULT_ID,
+                name="test-vault",
+                location="eastus",
+                backup_policies={
+                    POLICY_ID: BackupPolicy(
+                        id=POLICY_ID,
+                        name="DefaultPolicy",
+                        retention_days=90,
+                    )
+                },
+            )
+            recovery_client.vaults = {AZURE_SUBSCRIPTION_ID: {VAULT_ID: vault}}
+
+            check = recovery_vault_backup_policy_retention_adequate()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "90-day" in result[0].status_extended
+
+    def test_policy_insufficient_retention(self):
+        recovery_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate.recovery_client",
+                new=recovery_client,
+            ),
+        ):
+            from prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate import (
+                recovery_vault_backup_policy_retention_adequate,
+            )
+            from prowler.providers.azure.services.recovery.recovery_service import (
+                BackupPolicy,
+                BackupVault,
+            )
+
+            vault = BackupVault(
+                id=VAULT_ID,
+                name="test-vault",
+                location="eastus",
+                backup_policies={
+                    POLICY_ID: BackupPolicy(
+                        id=POLICY_ID,
+                        name="ShortPolicy",
+                        retention_days=7,
+                    )
+                },
+            )
+            recovery_client.vaults = {AZURE_SUBSCRIPTION_ID: {VAULT_ID: vault}}
+
+            check = recovery_vault_backup_policy_retention_adequate()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "7-day" in result[0].status_extended
+            assert "minimum: 30" in result[0].status_extended
+
+    def test_policy_no_retention_configured(self):
+        recovery_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate.recovery_client",
+                new=recovery_client,
+            ),
+        ):
+            from prowler.providers.azure.services.recovery.recovery_vault_backup_policy_retention_adequate.recovery_vault_backup_policy_retention_adequate import (
+                recovery_vault_backup_policy_retention_adequate,
+            )
+            from prowler.providers.azure.services.recovery.recovery_service import (
+                BackupPolicy,
+                BackupVault,
+            )
+
+            vault = BackupVault(
+                id=VAULT_ID,
+                name="test-vault",
+                location="eastus",
+                backup_policies={
+                    POLICY_ID: BackupPolicy(
+                        id=POLICY_ID,
+                        name="NoRetentionPolicy",
+                        retention_days=None,
+                    )
+                },
+            )
+            recovery_client.vaults = {AZURE_SUBSCRIPTION_ID: {VAULT_ID: vault}}
+
+            check = recovery_vault_backup_policy_retention_adequate()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "no daily retention" in result[0].status_extended
diff --git a/tests/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items_test.py b/tests/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items_test.py
new file mode 100644
index 0000000000..c9f8aa27b4
--- /dev/null
+++ b/tests/providers/azure/services/recovery/recovery_vault_has_protected_items/recovery_vault_has_protected_items_test.py
@@ -0,0 +1,116 @@
+from unittest import mock
+
+from tests.providers.azure.azure_fixtures import (
+    AZURE_SUBSCRIPTION_ID,
+    set_mocked_azure_provider,
+)
+
+VAULT_ID = f"/subscriptions/{AZURE_SUBSCRIPTION_ID}/resourceGroups/rg1/providers/Microsoft.RecoveryServices/vaults/test-vault"
+
+
+class Test_recovery_vault_has_protected_items:
+    def test_no_subscriptions(self):
+        recovery_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.recovery.recovery_vault_has_protected_items.recovery_vault_has_protected_items.recovery_client",
+                new=recovery_client,
+            ),
+        ):
+            from prowler.providers.azure.services.recovery.recovery_vault_has_protected_items.recovery_vault_has_protected_items import (
+                recovery_vault_has_protected_items,
+            )
+
+            recovery_client.vaults = {}
+
+            check = recovery_vault_has_protected_items()
+            result = check.execute()
+            assert len(result) == 0
+
+    def test_vault_with_protected_items(self):
+        recovery_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.recovery.recovery_vault_has_protected_items.recovery_vault_has_protected_items.recovery_client",
+                new=recovery_client,
+            ),
+        ):
+            from prowler.providers.azure.services.recovery.recovery_vault_has_protected_items.recovery_vault_has_protected_items import (
+                recovery_vault_has_protected_items,
+            )
+            from prowler.providers.azure.services.recovery.recovery_service import (
+                BackupItem,
+                BackupVault,
+            )
+
+            vault = BackupVault(
+                id=VAULT_ID,
+                name="test-vault",
+                location="eastus",
+                backup_protected_items={
+                    "item1": BackupItem(
+                        id="item1",
+                        name="vm-backup",
+                        workload_type=None,
+                    )
+                },
+            )
+            recovery_client.vaults = {AZURE_SUBSCRIPTION_ID: {VAULT_ID: vault}}
+
+            check = recovery_vault_has_protected_items()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "PASS"
+            assert "1 protected items" in result[0].status_extended
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_id == VAULT_ID
+            assert result[0].resource_name == "test-vault"
+            assert result[0].location == "eastus"
+
+    def test_vault_empty(self):
+        recovery_client = mock.MagicMock()
+
+        with (
+            mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=set_mocked_azure_provider(),
+            ),
+            mock.patch(
+                "prowler.providers.azure.services.recovery.recovery_vault_has_protected_items.recovery_vault_has_protected_items.recovery_client",
+                new=recovery_client,
+            ),
+        ):
+            from prowler.providers.azure.services.recovery.recovery_vault_has_protected_items.recovery_vault_has_protected_items import (
+                recovery_vault_has_protected_items,
+            )
+            from prowler.providers.azure.services.recovery.recovery_service import (
+                BackupVault,
+            )
+
+            vault = BackupVault(
+                id=VAULT_ID,
+                name="empty-vault",
+                location="westeurope",
+                backup_protected_items={},
+            )
+            recovery_client.vaults = {AZURE_SUBSCRIPTION_ID: {VAULT_ID: vault}}
+
+            check = recovery_vault_has_protected_items()
+            result = check.execute()
+            assert len(result) == 1
+            assert result[0].status == "FAIL"
+            assert "no protected items" in result[0].status_extended
+            assert result[0].subscription == AZURE_SUBSCRIPTION_ID
+            assert result[0].resource_id == VAULT_ID
+            assert result[0].resource_name == "empty-vault"
+            assert result[0].location == "westeurope"

From 2afa18d3daa0135eb0242bd3856c2ecd9afa8ad5 Mon Sep 17 00:00:00 2001
From: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
Date: Mon, 22 Jun 2026 20:37:07 +0100
Subject: [PATCH 124/126] fix(changelog): move recovery vault entry to 5.31
 (#11666)

---
 prowler/CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index c61b1ebf8c..dc90541fbe 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -42,6 +42,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `entra_directory_sync_object_takeover_blocked` check for the M365 provider, verifying that hybrid Entra tenants block cloud object takeover through both soft-match and hard-match directory synchronization [(#11098)](https://github.com/prowler-cloud/prowler/pull/11098)
 - `entra_conditional_access_policy_no_deleted_object_references` check for M365 provider [(#11236)](https://github.com/prowler-cloud/prowler/pull/11236)
 - `aks_cluster_defender_enabled` check for Azure provider, verifying that AKS clusters have Microsoft Defender security monitoring enabled [(#11028)](https://github.com/prowler-cloud/prowler/pull/11028)
+- `recovery_vault_has_protected_items` check for Azure provider, verifying that Recovery Services vaults have at least one protected backup item [(#11048)](https://github.com/prowler-cloud/prowler/pull/11048)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the GCP provider, mapping existing GCP checks across the five DORA pillars [(#11642)](https://github.com/prowler-cloud/prowler/pull/11642)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the Cloudflare provider, mapping existing Cloudflare edge/network checks across the applicable DORA pillars [(#11645)](https://github.com/prowler-cloud/prowler/pull/11645)
 - DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) compliance coverage for the AlibabaCloud provider, mapping existing AlibabaCloud checks across the applicable DORA pillars [(#11646)](https://github.com/prowler-cloud/prowler/pull/11646)
@@ -262,7 +263,6 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `bedrock_prompt_management_exists` check for AWS provider [(#10878)](https://github.com/prowler-cloud/prowler/pull/10878)
 - 8 Gmail attachment safety and spoofing protection checks for Google Workspace provider using the Cloud Identity Policy API [(#10980)](https://github.com/prowler-cloud/prowler/pull/10980)
 - `bedrock_prompt_encrypted_with_cmk` check for AWS provider [(#10905)](https://github.com/prowler-cloud/prowler/pull/10905)
-- `recovery_vault_has_protected_items` check for Azure provider, verifying that Recovery Services vaults have at least one protected backup item [(#11048)](https://github.com/prowler-cloud/prowler/pull/11048)
 
 ### 🔄 Changed
 

From 0610866b73d457fadbc22b0fc33d7a9b8204f837 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= <pedromarting3@gmail.com>
Date: Tue, 23 Jun 2026 09:40:32 +0200
Subject: [PATCH 125/126] feat(config): add SDK config's validator (#11518)

Co-authored-by: Pepe Fagoaga <pepe@prowler.com>
---
 docs/developer-guide/configurable-checks.mdx  | 172 +++++++
 .../cli/tutorials/configuration_file.mdx      |   4 +
 prowler/CHANGELOG.md                          |   1 +
 prowler/config/config.py                      |  11 +-
 prowler/config/scan_config_schema.py          | 116 +++++
 prowler/config/schema/__init__.py             |   0
 prowler/config/schema/aws.py                  | 422 ++++++++++++++++++
 prowler/config/schema/azure.py                |  83 ++++
 prowler/config/schema/base.py                 |  17 +
 prowler/config/schema/cloudflare.py           |  24 +
 prowler/config/schema/gcp.py                  |  45 ++
 prowler/config/schema/github.py               |  20 +
 prowler/config/schema/kubernetes.py           |  45 ++
 prowler/config/schema/m365.py                 |  54 +++
 prowler/config/schema/mongodbatlas.py         |  25 ++
 prowler/config/schema/registry.py             |  28 ++
 prowler/config/schema/validator.py            |  66 +++
 prowler/config/schema/validators.py           |  71 +++
 prowler/config/schema/vercel.py               |  68 +++
 tests/config/schema/__init__.py               |   0
 tests/config/schema/aws_schema_test.py        | 222 +++++++++
 tests/config/schema/bounds_test.py            | 398 +++++++++++++++++
 .../config/schema/loader_integration_test.py  | 124 +++++
 .../schema/other_providers_schema_test.py     | 152 +++++++
 tests/config/schema/validator_test.py         | 175 ++++++++
 25 files changed, 2342 insertions(+), 1 deletion(-)
 create mode 100644 prowler/config/scan_config_schema.py
 create mode 100644 prowler/config/schema/__init__.py
 create mode 100644 prowler/config/schema/aws.py
 create mode 100644 prowler/config/schema/azure.py
 create mode 100644 prowler/config/schema/base.py
 create mode 100644 prowler/config/schema/cloudflare.py
 create mode 100644 prowler/config/schema/gcp.py
 create mode 100644 prowler/config/schema/github.py
 create mode 100644 prowler/config/schema/kubernetes.py
 create mode 100644 prowler/config/schema/m365.py
 create mode 100644 prowler/config/schema/mongodbatlas.py
 create mode 100644 prowler/config/schema/registry.py
 create mode 100644 prowler/config/schema/validator.py
 create mode 100644 prowler/config/schema/validators.py
 create mode 100644 prowler/config/schema/vercel.py
 create mode 100644 tests/config/schema/__init__.py
 create mode 100644 tests/config/schema/aws_schema_test.py
 create mode 100644 tests/config/schema/bounds_test.py
 create mode 100644 tests/config/schema/loader_integration_test.py
 create mode 100644 tests/config/schema/other_providers_schema_test.py
 create mode 100644 tests/config/schema/validator_test.py

diff --git a/docs/developer-guide/configurable-checks.mdx b/docs/developer-guide/configurable-checks.mdx
index 76b339601d..760dc80f58 100644
--- a/docs/developer-guide/configurable-checks.mdx
+++ b/docs/developer-guide/configurable-checks.mdx
@@ -40,9 +40,181 @@ When adding a new configurable check to Prowler, update the following files:
   # aws.awslambda_function_vpc_multi_az
   lambda_min_azs: 2
   ```
+- **Provider Schema:** Add the typed field to the provider's Pydantic schema in `prowler/config/schema/<provider>.py`. This is required: the loader validates user configs against these schemas and the shipped `config.yaml` must round-trip with zero warnings. See [Adding a Parameter to the Provider Schema](#adding-a-parameter-to-the-provider-schema) below.
 - **Test Fixtures:** If tests depend on this configuration, add the variable to `tests/config/fixtures/config.yaml`.
 - **Documentation:** Document the new variable in the list of configurable checks in `docs/tutorials/configuration_file.md`.
 
 For a complete list of checks that already support configuration, see the [Configuration File Tutorial](/user-guide/cli/tutorials/configuration_file).
 
+## Adding a Parameter to the Provider Schema
+
+Most providers have a typed Pydantic schema in `prowler/config/schema/`, registered in `prowler/config/schema/registry.py`. When a config is loaded and the provider has a registered schema, `validate_provider_config` checks each user-supplied key against it, logs a warning, and drops any field that fails validation. The consumer's `.get(key, default)` then falls back to the built-in default. Providers without a registered schema are passed through unchanged.
+
+This catches typos in a value (for example, `0.2` typed as `20`, or `"medium"` for an enum that expects `"MEDIUM"`). It does NOT catch typos in a key name: `disalowed_regions` (one `l` missing) is treated as an unknown key and passes through untouched, because third-party check plugins legitimately rely on unknown keys being preserved. Reviewers should still check that any new key the YAML adds is named exactly the same as the field on the schema.
+
+### Where to Add the Field
+
+1. Open `prowler/config/schema/<provider>.py` (for example, `aws.py`).
+2. Add a field on the provider's schema class. Always make it `Optional[...] = None` so the absence of the key is valid.
+3. Apply the tightest type the value allows. Examples below.
+
+If you are introducing an entirely new provider rather than a new parameter, also add an entry mapping the provider name to its schema class in `prowler/config/schema/registry.py`. The loader uses that registry to find the schema for the provider it is loading.
+
+### Choosing the Right Type
+
+| Value kind | Field declaration |
+|---|---|
+| Boolean toggle | `Optional[bool] = None` |
+| Strictly positive integer (days, counts) | `Optional[int] = Field(default=None, gt=0)` |
+| Fraction in 0..1 (threshold) | `Optional[float] = Field(default=None, ge=0.0, le=1.0)` |
+| Closed set of strings | `Optional[Literal["A", "B", "C"]] = None` |
+| Free-form string | `Optional[str] = None` |
+| List of strings or ints | `Optional[list[str]] = None` |
+
+Prefer `Literal[...]` over `str` whenever the value is one of a known set. Prefer `Field(gt=0)` over `int` whenever zero or negative would be nonsensical. The point of the schema is to catch real-world mistakes that previously passed silently.
+
+### Custom Validators (Only When Needed)
+
+If the value has structural rules beyond type and range, add a `field_validator`. Examples already in `aws.py`:
+
+- `_validate_port_range` rejects ports outside `0..65535`.
+- `_validate_account_ids` rejects anything that isn't a 12-digit AWS account ID.
+- `_validate_trusted_ips` rejects entries that aren't a valid IP or CIDR.
+
+Raise `ValueError` from the validator. The framework converts the error into a warning and drops the offending key.
+
+### Example: Adding a New Parameter
+
+Say a new check needs `max_iam_role_session_hours`, a strictly positive integer that defaults to 12 in code.
+
+1. **Schema** (`prowler/config/schema/aws.py`):
+    ```python
+    # IAM
+    max_iam_role_session_hours: Optional[int] = Field(default=None, gt=0)
+    ```
+2. **Shipped config** (`prowler/config/config.yaml`):
+    ```yaml
+    # aws.iam_role_session_duration_within_limit
+    max_iam_role_session_hours: 12
+    ```
+3. **Consumer** (the check):
+    ```python
+    max_hours = iam_client.audit_config.get("max_iam_role_session_hours", 12)
+    ```
+4. **Tests** in `tests/config/schema/aws_schema_test.py`:
+    - one test for a valid value that round-trips,
+    - one test for an invalid value (zero, negative, wrong type) that is dropped.
+
+### What the Loader Guarantees
+
+- **Unknown keys pass through.** Third-party check plugins can introduce arbitrary keys without schema edits; they will not be filtered.
+- **Invalid values never crash the run.** They produce a single warning per field and the key is dropped.
+- **Coerced values are normalized.** A YAML-quoted `"180"` for an `int` field arrives downstream as the integer `180`.
+- **The shipped `config.yaml` must round-trip cleanly.** The integration test `test_shipped_default_config_loads_without_warnings` will fail if a key is added to the YAML without a matching schema field, so the two stay in sync.
+
+## Configuration Value Limits
+
+Configurable thresholds enforce hard limits. A value outside the documented range is **dropped with a warning** and the check falls back to its built-in default (the same as if the key were absent). These bounds are intentionally conservative: they are not the absolute service maxima but the range that still produces a meaningful security check.
+
+Use this section as the reference when upgrading an existing config: if a value you set is being rejected, it is outside the range below.
+
+Only fields with a numeric range, a fixed value set, or a length cap are listed. Fields typed as free-form strings or lists (for example `disallowed_regions`, `secrets_ignore_patterns`, `trusted_account_ids`) have no range limit — they are validated for shape only (a 12-digit account ID, a valid IP/CIDR, a dotted version string), not for magnitude.
+
+### AWS
+
+| Key | Allowed range | Notes |
+|---|---|---|
+| `max_unused_access_keys_days` | `30..180` days | CIS AWS 1.13 recommends 45; NIST IA-5 ≤90 |
+| `max_console_access_days` | `30..180` days | CIS AWS 1.12 recommends 45 |
+| `max_unused_sagemaker_access_days` | `7..180` days | |
+| `max_security_group_rules` | `1..1000` | AWS hard limit is 1000 rules per security group |
+| `max_ec2_instance_age_in_days` | `1..1095` days | 3 years |
+| `ec2_high_risk_ports` | each port `1..65535` | port 0 is reserved |
+| `max_idle_disconnect_timeout_in_seconds` | `60..1800` s | NIST AC-12: cap at 30 min |
+| `max_disconnect_timeout_in_seconds` | `60..3600` s | |
+| `max_session_duration_seconds` | `600..86400` s | 10 min .. 24 h (AppStream per-session hard limit) |
+| `lambda_min_azs` | `1..6` | |
+| `recommended_cdk_bootstrap_version` | `1..100` | |
+| `log_group_retention_days` | one of `1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1096, 1827, 2192, 2557, 2922, 3288, 3653` | only the CloudWatch Logs API-accepted retention values |
+| `threat_detection_privilege_escalation_threshold` | `0.0..1.0` | fraction of suspicious actions |
+| `threat_detection_privilege_escalation_minutes` | `5..43200` min | under 5 min the signal is mostly false positives |
+| `threat_detection_enumeration_threshold` | `0.0..1.0` | |
+| `threat_detection_enumeration_minutes` | `5..43200` min | |
+| `threat_detection_llm_jacking_threshold` | `0.0..1.0` | |
+| `threat_detection_llm_jacking_minutes` | `5..43200` min | |
+| `days_to_expire_threshold` (ACM) | `7..365` days | PCI-DSS 4.2.1.1: alert ≥30 days before expiry |
+| `elb_min_azs` | `1..6` | |
+| `elbv2_min_azs` | `1..6` | |
+| `minimum_snapshot_retention_period` | `1..35` days | ElastiCache service hard limit |
+| `max_days_secret_unused` | `7..365` days | |
+| `max_days_secret_unrotated` | `1..180` days | NIST IA-5: rotate quarterly; CIS ≤90 |
+| `min_kinesis_stream_retention_hours` | `24..8760` h | 1 day .. 1 year |
+| `detect_secrets_plugins[].limit` | `0.0..10.0` | Shannon entropy threshold |
+| `shodan_api_key` | ≤512 chars | |
+
+### Azure
+
+| Key | Allowed range | Notes |
+|---|---|---|
+| `vm_backup_min_daily_retention_days` | `7..9999` days | Azure Backup hard limit; under 7 days defeats DR/ransomware recovery |
+| `apim_threat_detection_llm_jacking_threshold` | `0.0..1.0` | fraction of suspicious actions |
+| `apim_threat_detection_llm_jacking_minutes` | `5..43200` min | under 5 min the signal is mostly false positives |
+| `shodan_api_key` | ≤512 chars | |
+
+### GCP
+
+| Key | Allowed range | Notes |
+|---|---|---|
+| `mig_min_zones` | `1..5` | |
+| `max_snapshot_age_days` | `1..1095` days | 3 years |
+| `max_unused_account_days` | `30..365` days | |
+| `storage_min_retention_days` | `1..3650` days | |
+| `shodan_api_key` | ≤512 chars | |
+
+### Kubernetes
+
+| Key | Allowed range | Notes |
+|---|---|---|
+| `audit_log_maxbackup` | `2..1000` | CIS Kubernetes 1.2.18 recommends ≥10 |
+| `audit_log_maxsize` | `10..10000` MB | CIS Kubernetes 1.2.19 recommends ≥100 MB |
+| `audit_log_maxage` | `7..3650` days | CIS Kubernetes 1.2.17 recommends ≥30 days |
+
+### M365
+
+| Key | Allowed range | Notes |
+|---|---|---|
+| `sign_in_frequency` | `1..168` h | 1 h .. 7 days; Conditional Access baseline for admins ≤24 h |
+| `recommended_mailtips_large_audience_threshold` | `5..10000` | Microsoft default 25 |
+| `audit_log_age` | `30..3650` days | M365 E3 default 90 days; SEC/FINRA require ≥7 years |
+
+### GitHub
+
+| Key | Allowed range | Notes |
+|---|---|---|
+| `inactive_not_archived_days_threshold` | `30..3650` days | CIS GitHub recommends 180 |
+
+### Cloudflare
+
+| Key | Allowed range | Notes |
+|---|---|---|
+| `max_retries` | `0..10` | 0 disables retries |
+
+### MongoDB Atlas
+
+| Key | Allowed range | Notes |
+|---|---|---|
+| `max_service_account_secret_validity_hours` | `1..720` h | 1 h .. 30 days |
+
+### Vercel
+
+| Key | Allowed range | Notes |
+|---|---|---|
+| `days_to_expire_threshold` | `7..365` days | PCI-DSS 4.2.1.1: alert ≥30 days before expiry |
+| `stale_token_threshold_days` | `30..3650` days | NIST AC-2(3) typical window 30..90 days |
+| `stale_invitation_threshold_days` | `7..365` days | |
+| `max_owner_percentage` | `1..50` % | guidance recommends ≤25% |
+| `max_owners` | `1..1000` | absolute cap, overrides percentage for large teams |
+
+These bounds live in the provider schemas under `prowler/config/schema/`; each field's `Field(ge=..., le=...)` (or `field_validator`) is the source of truth and the descriptions there carry the full rationale.
+
 This approach ensures that checks are easily configurable, making Prowler highly adaptable to different environments and requirements.
diff --git a/docs/user-guide/cli/tutorials/configuration_file.mdx b/docs/user-guide/cli/tutorials/configuration_file.mdx
index d695bad7bd..657549f8b0 100644
--- a/docs/user-guide/cli/tutorials/configuration_file.mdx
+++ b/docs/user-guide/cli/tutorials/configuration_file.mdx
@@ -10,6 +10,10 @@ prowler/config/config.yaml
 
 Additionally, you can input a custom configuration file using the `--config-file` argument.
 
+<Note>
+Numeric thresholds enforce hard limits. A value outside the accepted range is dropped with a warning and the check falls back to its built-in default. See [Configuration Value Limits](/developer-guide/configurable-checks#configuration-value-limits) for the exact range of every bounded option (max-days caps, percentages, counts, etc.).
+</Note>
+
 ## AWS
 
 ### Configurable Checks
diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md
index dc90541fbe..3cab5e423c 100644
--- a/prowler/CHANGELOG.md
+++ b/prowler/CHANGELOG.md
@@ -220,6 +220,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
 - `entra_service_principal_no_secrets_for_permanent_tier0_roles` check for M365 provider [(#10788)](https://github.com/prowler-cloud/prowler/pull/10788)
 - `iam_user_access_not_stale_to_sagemaker` check for AWS provider with configurable `max_unused_sagemaker_access_days` (default 90) [(#11000)](https://github.com/prowler-cloud/prowler/pull/11000)
 - `cloudtrail_bedrock_logging_enabled` check for AWS provider [(#10858)](https://github.com/prowler-cloud/prowler/pull/10858)
+- Per-provider scan configuration schema with bounds validation that drops out-of-range values with a warning on config load [(#11518)](https://github.com/prowler-cloud/prowler/pull/11518)
 - Okta provider with OAuth 2.0 authentication and `signon_global_session_idle_timeout_15min` check [(#11079)](https://github.com/prowler-cloud/prowler/pull/11079)
 - `sagemaker_domain_sso_configured` check for AWS provider [(#11094)](https://github.com/prowler-cloud/prowler/pull/11094)
 - Scaleway provider with `iam_api_keys_no_root_owned` check [(#11166)](https://github.com/prowler-cloud/prowler/pull/11166)
diff --git a/prowler/config/config.py b/prowler/config/config.py
index 723a9b67d3..8be31961bd 100644
--- a/prowler/config/config.py
+++ b/prowler/config/config.py
@@ -289,6 +289,11 @@ def load_and_validate_config_file(provider: str, config_file_path: str) -> dict:
     Returns:
         dict: The configuration dictionary for the specified provider.
     """
+    # Imported lazily to avoid an import cycle: schemas may eventually want to
+    # import from prowler.config.config (e.g. for shared constants).
+    from prowler.config.schema.registry import SCHEMAS
+    from prowler.config.schema.validator import validate_provider_config
+
     try:
         with open(config_file_path, "r", encoding=encoding_format_utf_8) as f:
             config_file = yaml.safe_load(f)
@@ -314,7 +319,11 @@ def load_and_validate_config_file(provider: str, config_file_path: str) -> dict:
             else:
                 config = {}
 
-            return config
+            return validate_provider_config(
+                provider=provider,
+                raw=config,
+                schema_cls=SCHEMAS.get(provider),
+            )
 
     except FileNotFoundError as error:
         logger.error(
diff --git a/prowler/config/scan_config_schema.py b/prowler/config/scan_config_schema.py
new file mode 100644
index 0000000000..ac00250c78
--- /dev/null
+++ b/prowler/config/scan_config_schema.py
@@ -0,0 +1,116 @@
+"""Bridge between the Pydantic-based provider schemas in
+`prowler.config.schema` and the Prowler App backend (Django) + UI.
+
+The SDK runtime is intentionally LENIENT: invalid keys are dropped with a
+warning and downstream checks fall back to their defaults
+(`prowler.config.schema.validator.validate_provider_config`).
+
+The Prowler App, however, needs to surface those errors to the user when
+they save a Scan Config from the UI, and to expose the schema as JSON so
+the UI can validate live with `ajv`. This module provides:
+
+- `validate_scan_config(payload)` — STRICT: returns a list of
+  `{path, message}` errors without silently dropping anything. The DRF
+  serializer (`api/.../v1/serializers.py:validate_scan_config_payload`)
+  turns each entry into a `ValidationError`.
+
+- `SCAN_CONFIG_SCHEMA` — aggregated JSON Schema derived from the Pydantic
+  models via `model_json_schema()`. Served by the `/scan-configs/schema`
+  endpoint and consumed by the UI editor for in-editor live validation.
+"""
+
+from typing import Any
+
+from pydantic import ValidationError
+
+from prowler.config.schema.registry import SCHEMAS
+
+
+def _format_loc(loc: tuple) -> str:
+    """Render a Pydantic error location as a dot-separated path.
+
+    Integer elements (array indices) are formatted as `[idx]` appended to the
+    previous component. String elements are joined with dots. An empty location
+    is rendered as `<root>`.
+
+    Examples:
+        ("aws", "regions", 0) -> "aws.regions[0]"
+        ("aws", "threshold") -> "aws.threshold"
+        () -> "<root>"
+    """
+    parts: list[str] = []
+    for piece in loc:
+        if isinstance(piece, int):
+            if parts:
+                parts[-1] = f"{parts[-1]}[{piece}]"
+            else:
+                parts.append(f"[{piece}]")
+        else:
+            parts.append(str(piece))
+    return ".".join(parts) if parts else "<root>"
+
+
+def validate_scan_config(payload: Any) -> list[dict]:
+    """Validate a scan config payload against the registered provider schemas.
+
+    Strict by design: every Pydantic violation surfaces as a `{path, message}`
+    entry so the caller can decide how to present it. Unknown provider
+    sections are accepted (consistent with `additionalProperties: True` at
+    the top level — the SDK simply has no opinion on them).
+    """
+    if not isinstance(payload, dict):
+        return [
+            {
+                "path": "<root>",
+                "message": "Scan config must be a mapping with provider sections.",
+            }
+        ]
+
+    errors: list[dict] = []
+    for provider, section in payload.items():
+        schema_cls = SCHEMAS.get(provider)
+        if schema_cls is None:
+            # Unknown provider type: tolerated. The SDK will simply ignore it.
+            continue
+        if not isinstance(section, dict):
+            errors.append(
+                {
+                    "path": str(provider),
+                    "message": "section must be a mapping.",
+                }
+            )
+            continue
+        try:
+            schema_cls.model_validate(section)
+        except ValidationError as exc:
+            for err in exc.errors():
+                loc = err.get("loc") or ()
+                path = _format_loc((str(provider), *loc))
+                errors.append(
+                    {
+                        "path": path,
+                        "message": err.get("msg", "validation error"),
+                    }
+                )
+    return errors
+
+
+def _build_aggregated_schema() -> dict:
+    """Compose one JSON Schema per provider into a single top-level schema.
+
+    The output mirrors the layout of `prowler/config/config.yaml` (a mapping
+    keyed by provider type) and is what the UI consumes via `ajv`.
+    """
+    properties: dict[str, dict] = {}
+    for provider, schema_cls in SCHEMAS.items():
+        properties[provider] = schema_cls.model_json_schema()
+    return {
+        "$schema": "https://json-schema.org/draft/2020-12/schema",
+        "title": "Prowler Scan Config",
+        "type": "object",
+        "additionalProperties": True,
+        "properties": properties,
+    }
+
+
+SCAN_CONFIG_SCHEMA: dict = _build_aggregated_schema()
diff --git a/prowler/config/schema/__init__.py b/prowler/config/schema/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/prowler/config/schema/aws.py b/prowler/config/schema/aws.py
new file mode 100644
index 0000000000..1a44bb9bcc
--- /dev/null
+++ b/prowler/config/schema/aws.py
@@ -0,0 +1,422 @@
+"""AWS provider config schema.
+
+Bounds on every field are intentionally conservative: they are not the
+absolute service maxima but the values that produce a useful security
+check. A user is free to keep the built-in default by omitting the key —
+out-of-range values are dropped with a warning at SDK runtime, and
+rejected at the Prowler App backend.
+
+Whenever an upper bound is uncertain, the cap is set to a value that
+still keeps the check meaningful (e.g. a 10-year window for date-based
+thresholds) and avoids ints that obviously break downstream maths
+(`min_kinesis_stream_retention_hours = 99999`).
+"""
+
+from typing import Annotated, Literal, Optional
+
+from pydantic import AfterValidator, Field
+
+from prowler.config.schema.base import ProviderConfigBase
+from prowler.config.schema.validators import (
+    make_dotted_version_validator,
+    validate_ip_networks,
+    validate_port_range,
+)
+
+# ---- Reusable constants -----------------------------------------------------
+
+# CloudWatch Logs only accepts these retention values (in days). Anything else
+# is silently coerced to the next valid value by the API — we reject upfront.
+_CLOUDWATCH_RETENTION_DAYS = (
+    1,
+    3,
+    5,
+    7,
+    14,
+    30,
+    60,
+    90,
+    120,
+    150,
+    180,
+    365,
+    400,
+    545,
+    731,
+    1096,
+    1827,
+    2192,
+    2557,
+    2922,
+    3288,
+    3653,
+)
+
+_VALID_CW_RETENTION_LITERAL = Literal[
+    1,
+    3,
+    5,
+    7,
+    14,
+    30,
+    60,
+    90,
+    120,
+    150,
+    180,
+    365,
+    400,
+    545,
+    731,
+    1096,
+    1827,
+    2192,
+    2557,
+    2922,
+    3288,
+    3653,
+]
+
+
+# ---- Custom validators ------------------------------------------------------
+
+
+# Reusable validators shared across providers (see schema/validators.py).
+_validate_port_range = validate_port_range
+_validate_trusted_ips = validate_ip_networks
+# "1.4.0" style strings (used by Fargate platform versions).
+_validate_semver = make_dotted_version_validator(3, 3)
+# "1.28" style strings (EKS minor versions).
+_validate_eks_minor = make_dotted_version_validator(2, 2)
+
+
+def _validate_account_ids(v: Optional[list[str]]) -> Optional[list[str]]:
+    if v is None:
+        return v
+    for account_id in v:
+        if not (account_id.isdigit() and len(account_id) == 12):
+            raise ValueError(
+                f"trusted_account_ids entry {account_id!r} is not a 12-digit AWS account id"
+            )
+    return v
+
+
+# ---- Nested models ----------------------------------------------------------
+
+
+class _DetectSecretsPlugin(ProviderConfigBase):
+    """One entry inside ``detect_secrets_plugins``.
+
+    Only ``name`` is required by the upstream library. ``limit`` is used by
+    the entropy detectors. Any other plugin-specific kwarg is preserved by
+    the ``extra="allow"`` policy inherited from ProviderConfigBase.
+    """
+
+    name: str
+    limit: Optional[float] = Field(
+        default=None,
+        ge=0.0,
+        le=10.0,
+        description=(
+            "Entropy threshold for detect-secrets entropy plugins. Range: 0..10 "
+            "(Shannon entropy is bounded by log2(256)=8; >10 is meaningless)."
+        ),
+    )
+
+
+# ---- Main schema ------------------------------------------------------------
+
+
+class AWSProviderConfig(ProviderConfigBase):
+    # --- IAM ---------------------------------------------------------------
+    mute_non_default_regions: Optional[bool] = None
+    disallowed_regions: Optional[list[str]] = None
+    max_unused_access_keys_days: Optional[int] = Field(
+        default=None,
+        ge=30,
+        le=180,
+        description=(
+            "Days an IAM user access key can stay unused before being flagged. "
+            "Range: 30..180 days (CIS AWS 1.13 recommends 45; NIST IA-5 ≤90)."
+        ),
+    )
+    max_console_access_days: Optional[int] = Field(
+        default=None,
+        ge=30,
+        le=180,
+        description=(
+            "Days an IAM console password can stay unused before being flagged. "
+            "Range: 30..180 days (CIS AWS 1.12 recommends 45)."
+        ),
+    )
+    max_unused_sagemaker_access_days: Optional[int] = Field(
+        default=None,
+        ge=7,
+        le=180,
+        description=(
+            "Days a SageMaker user access key can stay unused. Range: 7..180 "
+            "(SageMaker tokens are usually high-privilege over S3/KMS)."
+        ),
+    )
+
+    # --- EC2 ---------------------------------------------------------------
+    shodan_api_key: Optional[str] = Field(
+        default=None,
+        max_length=512,
+        description="API key for Shodan lookups on EC2 public IPs.",
+    )
+    max_security_group_rules: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=1000,
+        description="Max ingress+egress rules per security group. AWS hard limit is 1000.",
+    )
+    max_ec2_instance_age_in_days: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=1095,
+        description=(
+            "Days an EC2 instance can run before being flagged as old. "
+            "Range: 1..1095 (3 years; instances should be refreshed for patching "
+            "per NIST CM-3 — anything older is a security smell)."
+        ),
+    )
+    ec2_allowed_interface_types: Optional[list[str]] = None
+    ec2_allowed_instance_owners: Optional[list[str]] = None
+    ec2_high_risk_ports: Annotated[
+        Optional[list[int]], AfterValidator(_validate_port_range)
+    ] = Field(
+        default=None,
+        description="TCP/UDP ports considered high-risk when reachable from the Internet (1..65535; port 0 is reserved).",
+    )
+
+    # --- ECS ---------------------------------------------------------------
+    fargate_linux_latest_version: Annotated[
+        Optional[str], AfterValidator(_validate_semver)
+    ] = Field(default=None, description="Fargate Linux platform version (X.Y.Z).")
+    fargate_windows_latest_version: Annotated[
+        Optional[str], AfterValidator(_validate_semver)
+    ] = Field(default=None, description="Fargate Windows platform version (X.Y.Z).")
+
+    # --- Cross-account trust ----------------------------------------------
+    trusted_account_ids: Annotated[
+        Optional[list[str]], AfterValidator(_validate_account_ids)
+    ] = Field(
+        default=None,
+        description="Additional 12-digit AWS account IDs trusted by cross-account checks.",
+    )
+    trusted_ips: Annotated[
+        Optional[list[str]], AfterValidator(_validate_trusted_ips)
+    ] = Field(
+        default=None,
+        description="IPv4/IPv6 addresses or CIDR ranges that are NOT considered public.",
+    )
+
+    # --- CloudWatch / CloudFormation --------------------------------------
+    log_group_retention_days: Optional[_VALID_CW_RETENTION_LITERAL] = Field(
+        default=None,
+        description=(
+            "Required CloudWatch Logs retention in days. Must match one of the "
+            f"values accepted by the AWS API: {list(_CLOUDWATCH_RETENTION_DAYS)}."
+        ),
+    )
+    recommended_cdk_bootstrap_version: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=100,
+        description="Min CDK bootstrap version expected on the account.",
+    )
+
+    # --- AppStream --------------------------------------------------------
+    max_idle_disconnect_timeout_in_seconds: Optional[int] = Field(
+        default=None,
+        ge=60,
+        le=1800,
+        description=(
+            "AppStream idle disconnect timeout (seconds). Range: 60..1800 "
+            "(NIST AC-12: sensitive sessions ≤15 min — cap at 30 min)."
+        ),
+    )
+    max_disconnect_timeout_in_seconds: Optional[int] = Field(
+        default=None,
+        ge=60,
+        le=3600,
+        description="AppStream disconnect timeout (seconds). Range: 60..3600.",
+    )
+    max_session_duration_seconds: Optional[int] = Field(
+        default=None,
+        ge=600,
+        le=86400,
+        description=(
+            "AppStream max session duration (seconds). Range: 600..86400 "
+            "(10 min .. 24 h — AWS AppStream hard limit per session)."
+        ),
+    )
+
+    # --- Lambda -----------------------------------------------------------
+    obsolete_lambda_runtimes: Optional[list[str]] = None
+    lambda_min_azs: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=6,
+        description="Min number of AZs a VPC-bound Lambda must span. Range: 1..6.",
+    )
+
+    # --- Organizations ----------------------------------------------------
+    organizations_enabled_regions: Optional[list[str]] = None
+    organizations_trusted_delegated_administrators: Annotated[
+        Optional[list[str]], AfterValidator(_validate_account_ids)
+    ] = None
+    organizations_trusted_ids: Optional[list[str]] = None
+
+    # --- ECR --------------------------------------------------------------
+    ecr_repository_vulnerability_minimum_severity: Optional[
+        Literal["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFORMATIONAL"]
+    ] = Field(
+        default=None,
+        description="Highest severity tolerated for ECR images.",
+    )
+
+    # --- Trusted Advisor --------------------------------------------------
+    verify_premium_support_plans: Optional[bool] = None
+
+    # --- CloudTrail threat detection: privilege escalation ----------------
+    threat_detection_privilege_escalation_threshold: Optional[float] = Field(
+        default=None,
+        ge=0.0,
+        le=1.0,
+        description="Fraction of suspicious actions that triggers the priv-esc detection.",
+    )
+    threat_detection_privilege_escalation_minutes: Optional[int] = Field(
+        default=None,
+        ge=5,
+        le=43200,
+        description=(
+            "Lookback window (minutes) for priv-esc detection. Range: 5..43200 "
+            "(under 5 min the signal is dominated by false positives)."
+        ),
+    )
+    threat_detection_privilege_escalation_actions: Optional[list[str]] = None
+
+    # --- CloudTrail threat detection: enumeration -------------------------
+    threat_detection_enumeration_threshold: Optional[float] = Field(
+        default=None,
+        ge=0.0,
+        le=1.0,
+        description="Fraction of suspicious actions that triggers the enumeration detection.",
+    )
+    threat_detection_enumeration_minutes: Optional[int] = Field(
+        default=None,
+        ge=5,
+        le=43200,
+        description="Lookback window (minutes) for enumeration detection. Range: 5..43200.",
+    )
+    threat_detection_enumeration_actions: Optional[list[str]] = None
+
+    # --- CloudTrail threat detection: LLM jacking -------------------------
+    threat_detection_llm_jacking_threshold: Optional[float] = Field(
+        default=None,
+        ge=0.0,
+        le=1.0,
+        description="Fraction of suspicious actions that triggers the LLM-jacking detection.",
+    )
+    threat_detection_llm_jacking_minutes: Optional[int] = Field(
+        default=None,
+        ge=5,
+        le=43200,
+        description="Lookback window (minutes) for LLM-jacking detection. Range: 5..43200.",
+    )
+    threat_detection_llm_jacking_actions: Optional[list[str]] = None
+
+    # --- RDS --------------------------------------------------------------
+    check_rds_instance_replicas: Optional[bool] = None
+
+    # --- ACM --------------------------------------------------------------
+    days_to_expire_threshold: Optional[int] = Field(
+        default=None,
+        ge=7,
+        le=365,
+        description=(
+            "Days before certificate expiration to flag. Range: 7..365 "
+            "(PCI-DSS 4.2.1.1: alert ≥30 days before expiry; <7 days is too "
+            "tight to actually act on)."
+        ),
+    )
+    insecure_key_algorithms: Optional[list[str]] = None
+
+    # --- EKS --------------------------------------------------------------
+    eks_required_log_types: Optional[
+        list[
+            Literal[
+                "api",
+                "audit",
+                "authenticator",
+                "controllerManager",
+                "scheduler",
+            ]
+        ]
+    ] = Field(
+        default=None,
+        description="EKS control plane log types that must be enabled.",
+    )
+    eks_cluster_oldest_version_supported: Annotated[
+        Optional[str], AfterValidator(_validate_eks_minor)
+    ] = Field(
+        default=None,
+        description='Minimum supported EKS minor version, expected as "X.Y".',
+    )
+
+    # --- CodeBuild --------------------------------------------------------
+    excluded_sensitive_environment_variables: Optional[list[str]] = None
+    codebuild_github_allowed_organizations: Optional[list[str]] = None
+
+    # --- ELB / ELBv2 ------------------------------------------------------
+    elb_min_azs: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=6,
+        description="Min AZs a Classic ELB must span. Range: 1..6.",
+    )
+    elbv2_min_azs: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=6,
+        description="Min AZs an Application/Network LB must span. Range: 1..6.",
+    )
+
+    # --- ElastiCache -----------------------------------------------------
+    minimum_snapshot_retention_period: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=35,
+        description="Days an ElastiCache backup must be retained. Range: 1..35 (service hard limit).",
+    )
+
+    # --- Secrets ---------------------------------------------------------
+    secrets_ignore_patterns: Optional[list[str]] = None
+    max_days_secret_unused: Optional[int] = Field(
+        default=None,
+        ge=7,
+        le=365,
+        description="Days a Secrets Manager secret can stay unused. Range: 7..365.",
+    )
+    max_days_secret_unrotated: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=180,
+        description=(
+            "Days a Secrets Manager secret can go without rotation. Range: 1..180 "
+            "(NIST IA-5: rotate quarterly; CIS recommends ≤90)."
+        ),
+    )
+
+    # --- Kinesis ---------------------------------------------------------
+    min_kinesis_stream_retention_hours: Optional[int] = Field(
+        default=None,
+        ge=24,
+        le=8760,
+        description="Hours of Kinesis stream retention. Range: 24..8760 (1 day .. 1 year).",
+    )
+
+    # --- detect-secrets plugin list -------------------------------------
+    detect_secrets_plugins: Optional[list[_DetectSecretsPlugin]] = None
diff --git a/prowler/config/schema/azure.py b/prowler/config/schema/azure.py
new file mode 100644
index 0000000000..75954c602b
--- /dev/null
+++ b/prowler/config/schema/azure.py
@@ -0,0 +1,83 @@
+"""Azure provider config schema with safety bounds.
+
+Bounds aim for values that produce a meaningful security check; out-of-range
+values are dropped (SDK runtime) or rejected (Prowler App backend).
+"""
+
+from typing import Annotated, Literal, Optional
+
+from pydantic import AfterValidator, Field
+
+from prowler.config.schema.base import ProviderConfigBase
+from prowler.config.schema.validators import make_dotted_version_validator
+
+# Accept "8.2", "3.12", "17" style version strings. Used by App Service
+# language version fields where the upstream APIs accept either MAJOR or
+# MAJOR.MINOR notation.
+_validate_dotted_version = make_dotted_version_validator(1, 2)
+
+
+class AzureProviderConfig(ProviderConfigBase):
+    # --- Network ---------------------------------------------------------
+    shodan_api_key: Optional[str] = Field(
+        default=None,
+        max_length=512,
+        description="API key for Shodan lookups on Azure public IPs.",
+    )
+
+    # --- Defender --------------------------------------------------------
+    defender_attack_path_minimal_risk_level: Optional[
+        Literal["Low", "Medium", "High", "Critical"]
+    ] = Field(
+        default=None,
+        description="Minimum attack-path risk level worth a notification.",
+    )
+
+    # --- App Service ----------------------------------------------------
+    php_latest_version: Annotated[
+        Optional[str], AfterValidator(_validate_dotted_version)
+    ] = Field(default=None, description='PHP minimum acceptable version, e.g. "8.2".')
+    python_latest_version: Annotated[
+        Optional[str], AfterValidator(_validate_dotted_version)
+    ] = Field(
+        default=None, description='Python minimum acceptable version, e.g. "3.12".'
+    )
+    java_latest_version: Annotated[
+        Optional[str], AfterValidator(_validate_dotted_version)
+    ] = Field(default=None, description='Java minimum acceptable version, e.g. "17".')
+
+    # --- SQL ------------------------------------------------------------
+    recommended_minimal_tls_versions: Optional[list[Literal["1.2", "1.3"]]] = Field(
+        default=None,
+        description="TLS versions accepted on Azure SQL Server.",
+    )
+
+    # --- Virtual Machines -----------------------------------------------
+    desired_vm_sku_sizes: Optional[list[str]] = None
+    vm_backup_min_daily_retention_days: Optional[int] = Field(
+        default=None,
+        ge=7,
+        le=9999,
+        description=(
+            "Min daily backup retention days. Range: 7..9999 "
+            "(Azure Backup hard limit; <7 days defeats DR/ransomware recovery)."
+        ),
+    )
+
+    # --- API Management threat detection (LLM jacking) -----------------
+    apim_threat_detection_llm_jacking_threshold: Optional[float] = Field(
+        default=None,
+        ge=0.0,
+        le=1.0,
+        description="Fraction of suspicious actions that triggers the detection.",
+    )
+    apim_threat_detection_llm_jacking_minutes: Optional[int] = Field(
+        default=None,
+        ge=5,
+        le=43200,
+        description=(
+            "Lookback window (minutes) for LLM-jacking detection. Range: 5..43200 "
+            "(under 5 min the signal is dominated by false positives)."
+        ),
+    )
+    apim_threat_detection_llm_jacking_actions: Optional[list[str]] = None
diff --git a/prowler/config/schema/base.py b/prowler/config/schema/base.py
new file mode 100644
index 0000000000..cc473a4545
--- /dev/null
+++ b/prowler/config/schema/base.py
@@ -0,0 +1,17 @@
+from pydantic import BaseModel, ConfigDict
+
+
+class ProviderConfigBase(BaseModel):
+    """Base for every provider config schema.
+
+    ``extra="allow"`` is REQUIRED for backwards compatibility: third-party
+    check plugins frequently introduce config keys we do not know about,
+    and pre-existing user configs may carry deprecated keys. Validation
+    must never reject these.
+    """
+
+    model_config = ConfigDict(
+        extra="allow",
+        str_strip_whitespace=True,
+        validate_assignment=False,
+    )
diff --git a/prowler/config/schema/cloudflare.py b/prowler/config/schema/cloudflare.py
new file mode 100644
index 0000000000..417092d6df
--- /dev/null
+++ b/prowler/config/schema/cloudflare.py
@@ -0,0 +1,24 @@
+"""Cloudflare provider config schema with safety bounds."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class CloudflareProviderConfig(ProviderConfigBase):
+    """Cloudflare provider configuration schema.
+
+    Defines optional configuration parameters for Cloudflare security checks,
+    including API retry behavior.
+    """
+
+    max_retries: Optional[int] = Field(
+        default=None,
+        ge=0,
+        le=10,
+        description=(
+            "Max retries for Cloudflare API requests. Range: 0..10 (0 disables retries)."
+        ),
+    )
diff --git a/prowler/config/schema/gcp.py b/prowler/config/schema/gcp.py
new file mode 100644
index 0000000000..59e1a162fa
--- /dev/null
+++ b/prowler/config/schema/gcp.py
@@ -0,0 +1,45 @@
+"""GCP provider config schema with safety bounds."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class GCPProviderConfig(ProviderConfigBase):
+    shodan_api_key: Optional[str] = Field(
+        default=None,
+        max_length=512,
+        description="API key for Shodan lookups on GCP public IPs.",
+    )
+    mig_min_zones: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=5,
+        description="Min zones a Managed Instance Group must span. Range: 1..5.",
+    )
+    max_snapshot_age_days: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=1095,
+        description=(
+            "Days a disk snapshot can age before being flagged. Range: 1..1095 "
+            "(3 years; older snapshots typically miss data-class compliance)."
+        ),
+    )
+    max_unused_account_days: Optional[int] = Field(
+        default=None,
+        ge=30,
+        le=365,
+        description=(
+            "Days a service account or user-managed key can stay unused. "
+            "Range: 30..365."
+        ),
+    )
+    storage_min_retention_days: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=3650,
+        description="Min retention period on Cloud Storage buckets. Range: 1..3650.",
+    )
diff --git a/prowler/config/schema/github.py b/prowler/config/schema/github.py
new file mode 100644
index 0000000000..30b5a13b85
--- /dev/null
+++ b/prowler/config/schema/github.py
@@ -0,0 +1,20 @@
+"""GitHub provider config schema with safety bounds."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class GitHubProviderConfig(ProviderConfigBase):
+    inactive_not_archived_days_threshold: Optional[int] = Field(
+        default=None,
+        ge=30,
+        le=3650,
+        description=(
+            "Days a repository can stay inactive without being archived before "
+            "being flagged. Range: 30..3650 (CIS GitHub recommends 180; "
+            "<30 days produces false positives on seasonal projects)."
+        ),
+    )
diff --git a/prowler/config/schema/kubernetes.py b/prowler/config/schema/kubernetes.py
new file mode 100644
index 0000000000..3235971500
--- /dev/null
+++ b/prowler/config/schema/kubernetes.py
@@ -0,0 +1,45 @@
+"""Kubernetes provider config schema with safety bounds."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class KubernetesProviderConfig(ProviderConfigBase):
+    audit_log_maxbackup: Optional[int] = Field(
+        default=None,
+        ge=2,
+        le=1000,
+        description=(
+            "API server audit log file rotations to keep. Range: 2..1000 "
+            "(CIS Kubernetes 1.2.18 recommends ≥10)."
+        ),
+    )
+    audit_log_maxsize: Optional[int] = Field(
+        default=None,
+        ge=10,
+        le=10000,
+        description=(
+            "Max MB per audit log file before rotation. Range: 10..10000 MB "
+            "(CIS Kubernetes 1.2.19 recommends ≥100 MB)."
+        ),
+    )
+    audit_log_maxage: Optional[int] = Field(
+        default=None,
+        ge=7,
+        le=3650,
+        description=(
+            "Days an audit log file is retained. Range: 7..3650 "
+            "(CIS Kubernetes 1.2.17 recommends ≥30 days)."
+        ),
+    )
+    apiserver_strong_ciphers: Optional[list[str]] = Field(
+        default=None,
+        description="Whitelist of strong TLS cipher suites required on the API server.",
+    )
+    kubelet_strong_ciphers: Optional[list[str]] = Field(
+        default=None,
+        description="Whitelist of strong TLS cipher suites required on kubelet.",
+    )
diff --git a/prowler/config/schema/m365.py b/prowler/config/schema/m365.py
new file mode 100644
index 0000000000..ff1ff98285
--- /dev/null
+++ b/prowler/config/schema/m365.py
@@ -0,0 +1,54 @@
+"""M365 provider config schema with safety bounds."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class M365ProviderConfig(ProviderConfigBase):
+    # --- Entra (sign-in policy) ----------------------------------------
+    sign_in_frequency: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=168,
+        description=(
+            "Hours between forced sign-ins for admin users. Range: 1..168 (1 h .. 7 days). "
+            "Microsoft Conditional Access baseline for admin roles is ≤24 h."
+        ),
+    )
+
+    # --- Teams ---------------------------------------------------------
+    allowed_cloud_storage_services: Optional[list[str]] = Field(
+        default=None,
+        description="External cloud storage services allowed in Teams.",
+    )
+
+    # --- Exchange ------------------------------------------------------
+    recommended_mailtips_large_audience_threshold: Optional[int] = Field(
+        default=None,
+        ge=5,
+        le=10000,
+        description=(
+            "Recipient count that should trigger a 'large audience' MailTip. "
+            "Range: 5..10000 (Microsoft default 25)."
+        ),
+    )
+
+    # --- Defender malware policy --------------------------------------
+    default_recommended_extensions: Optional[list[str]] = Field(
+        default=None,
+        description="File extensions blocked by the malware policy.",
+    )
+
+    # --- Mailbox auditing ---------------------------------------------
+    audit_log_age: Optional[int] = Field(
+        default=None,
+        ge=30,
+        le=3650,
+        description=(
+            "Days mailbox audit logs must be retained. Range: 30..3650 "
+            "(M365 E3 default is 90 days; SEC/FINRA require ≥7 years)."
+        ),
+    )
diff --git a/prowler/config/schema/mongodbatlas.py b/prowler/config/schema/mongodbatlas.py
new file mode 100644
index 0000000000..552e0a7bbd
--- /dev/null
+++ b/prowler/config/schema/mongodbatlas.py
@@ -0,0 +1,25 @@
+"""MongoDB Atlas provider config schema with safety bounds."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class MongoDBAtlasProviderConfig(ProviderConfigBase):
+    """MongoDB Atlas provider configuration schema.
+
+    Defines optional configuration parameters for MongoDB Atlas security checks,
+    including service account secret validity constraints.
+    """
+
+    max_service_account_secret_validity_hours: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=720,
+        description=(
+            "Max hours a service account secret can stay valid. "
+            "Range: 1..720 (1 h .. 30 days)."
+        ),
+    )
diff --git a/prowler/config/schema/registry.py b/prowler/config/schema/registry.py
new file mode 100644
index 0000000000..fa31f1e5eb
--- /dev/null
+++ b/prowler/config/schema/registry.py
@@ -0,0 +1,28 @@
+"""Mapping of provider name to its Pydantic schema class.
+
+Kept in its own module so the validator stays free of provider-schema imports
+and callers pay the import cost only when they actually need the registry.
+"""
+
+from prowler.config.schema.aws import AWSProviderConfig
+from prowler.config.schema.azure import AzureProviderConfig
+from prowler.config.schema.base import ProviderConfigBase
+from prowler.config.schema.cloudflare import CloudflareProviderConfig
+from prowler.config.schema.gcp import GCPProviderConfig
+from prowler.config.schema.github import GitHubProviderConfig
+from prowler.config.schema.kubernetes import KubernetesProviderConfig
+from prowler.config.schema.m365 import M365ProviderConfig
+from prowler.config.schema.mongodbatlas import MongoDBAtlasProviderConfig
+from prowler.config.schema.vercel import VercelProviderConfig
+
+SCHEMAS: dict[str, type[ProviderConfigBase]] = {
+    "aws": AWSProviderConfig,
+    "azure": AzureProviderConfig,
+    "gcp": GCPProviderConfig,
+    "kubernetes": KubernetesProviderConfig,
+    "m365": M365ProviderConfig,
+    "github": GitHubProviderConfig,
+    "mongodbatlas": MongoDBAtlasProviderConfig,
+    "cloudflare": CloudflareProviderConfig,
+    "vercel": VercelProviderConfig,
+}
diff --git a/prowler/config/schema/validator.py b/prowler/config/schema/validator.py
new file mode 100644
index 0000000000..8113302855
--- /dev/null
+++ b/prowler/config/schema/validator.py
@@ -0,0 +1,66 @@
+from typing import Any
+
+from pydantic import ValidationError
+
+from prowler.config.schema.base import ProviderConfigBase
+from prowler.lib.logger import logger
+
+
+def validate_provider_config(
+    provider: str,
+    raw: Any,
+    schema_cls: type[ProviderConfigBase] | None,
+) -> dict:
+    """Validate a provider's config dict against its Pydantic schema.
+
+    Behavior is intentionally lenient to preserve backwards compatibility:
+
+    - If ``raw`` is not a dict, return an empty dict (mirrors prior loader).
+    - If no schema is registered for ``provider``, return ``raw`` untouched.
+    - On validation errors, log one WARNING per offending field, DROP those
+      keys from the result, and continue. Consumers fall back to their own
+      hard-coded defaults via ``audit_config.get(key, default)``.
+    - Coerced values (e.g. ``"180"`` -> ``180``) replace the user's input
+      so that downstream checks never receive a wrongly-typed value.
+    """
+    if not isinstance(raw, dict):
+        return {}
+
+    if schema_cls is None:
+        return raw
+
+    try:
+        model = schema_cls.model_validate(raw)
+        return model.model_dump(exclude_unset=True)
+    except ValidationError as exc:
+        bad_keys: set[str] = set()
+        for err in exc.errors():
+            loc = err.get("loc") or ()
+            if not loc:
+                continue
+            key = loc[0]
+            if not isinstance(key, str):
+                continue
+            bad_keys.add(key)
+            logger.warning(
+                f"prowler.config[{provider}.{key}] = {raw.get(key)!r} is invalid "
+                f"({err.get('msg', 'validation error')}); the value will be ignored "
+                f"and the built-in default will be used."
+            )
+
+        cleaned = {k: v for k, v in raw.items() if k not in bad_keys}
+        # Retry validation with the cleaned dict. Dropping invalid keys handles
+        # common field-level mismatches, but revalidation can still fail due to
+        # higher-level structural constraints (e.g. nested validation errors not
+        # captured in the top-level bad_keys). In that case, log and return the
+        # cleaned dict so consumers fall back to their own defaults.
+        try:
+            model = schema_cls.model_validate(cleaned)
+            return model.model_dump(exclude_unset=True)
+        except ValidationError as exc2:
+            logger.error(
+                f"prowler.config[{provider}] could not be revalidated after dropping "
+                f"invalid keys ({bad_keys}); passing through the cleaned dict as-is. "
+                f"Underlying errors: {exc2.errors()}"
+            )
+            return cleaned
diff --git a/prowler/config/schema/validators.py b/prowler/config/schema/validators.py
new file mode 100644
index 0000000000..3c87f532c7
--- /dev/null
+++ b/prowler/config/schema/validators.py
@@ -0,0 +1,71 @@
+"""Reusable field validators shared across provider config schemas.
+
+These are factored out so multiple providers can reuse the same validation
+logic (version strings, port ranges, IP/CIDR entries) instead of duplicating
+it per schema. Each validator accepts ``None`` so optional fields stay valid
+when the key is absent.
+"""
+
+from ipaddress import ip_network
+from typing import Callable, Optional
+
+_VERSION_PART_LABELS = ("X", "Y", "Z", "W")
+
+
+def make_dotted_version_validator(
+    min_parts: int, max_parts: int
+) -> Callable[[Optional[str]], Optional[str]]:
+    """Build a validator for dotted numeric version strings.
+
+    The returned validator accepts ``None`` and strings made of between
+    ``min_parts`` and ``max_parts`` dot-separated numeric components. Anything
+    else raises ``ValueError``.
+
+    Examples:
+        ``make_dotted_version_validator(3, 3)`` accepts ``"1.4.0"`` (semver).
+        ``make_dotted_version_validator(2, 2)`` accepts ``"1.28"`` (EKS minor).
+        ``make_dotted_version_validator(1, 2)`` accepts ``"17"`` or ``"8.2"``.
+    """
+    if min_parts == max_parts:
+        expected = ".".join(_VERSION_PART_LABELS[:min_parts])
+    else:
+        expected = " or ".join(
+            f"'{'.'.join(_VERSION_PART_LABELS[:n])}'"
+            for n in range(min_parts, max_parts + 1)
+        )
+
+    def _validate(v: Optional[str]) -> Optional[str]:
+        if v is None:
+            return v
+        parts = v.split(".")
+        if not (min_parts <= len(parts) <= max_parts) or not all(
+            p.isdigit() for p in parts
+        ):
+            raise ValueError(f"{v!r} is not a valid version (expected {expected})")
+        return v
+
+    return _validate
+
+
+def validate_port_range(v: Optional[list[int]]) -> Optional[list[int]]:
+    """Reject ports outside the valid ``1..65535`` range."""
+    if v is None:
+        return v
+    for port in v:
+        if not 1 <= port <= 65535:
+            raise ValueError(f"port {port} is outside the valid range 1..65535")
+    return v
+
+
+def validate_ip_networks(v: Optional[list[str]]) -> Optional[list[str]]:
+    """Reject entries that are not a valid IP address or CIDR network."""
+    if v is None:
+        return v
+    for entry in v:
+        try:
+            ip_network(entry, strict=False)
+        except ValueError as exc:
+            raise ValueError(
+                f"entry {entry!r} is not a valid IP or CIDR ({exc})"
+            ) from exc
+    return v
diff --git a/prowler/config/schema/vercel.py b/prowler/config/schema/vercel.py
new file mode 100644
index 0000000000..2e466e2049
--- /dev/null
+++ b/prowler/config/schema/vercel.py
@@ -0,0 +1,68 @@
+"""Vercel provider config schema with safety bounds."""
+
+from typing import Optional
+
+from pydantic import Field
+
+from prowler.config.schema.base import ProviderConfigBase
+
+
+class VercelProviderConfig(ProviderConfigBase):
+    """Vercel provider configuration schema.
+
+    Defines optional configuration parameters for Vercel security checks,
+    including deployment branch policies, credential staleness thresholds,
+    RBAC ownership limits, and secret detection patterns.
+    """
+
+    stable_branches: Optional[list[str]] = Field(
+        default=None,
+        description="Branches considered stable for production deployments.",
+    )
+    days_to_expire_threshold: Optional[int] = Field(
+        default=None,
+        ge=7,
+        le=365,
+        description=(
+            "Days before token/certificate expiration to flag. Range: 7..365 "
+            "(PCI-DSS 4.2.1.1: alert ≥30 days before expiry)."
+        ),
+    )
+    stale_token_threshold_days: Optional[int] = Field(
+        default=None,
+        ge=30,
+        le=3650,
+        description=(
+            "Days of inactivity before a token is considered stale. Range: 30..3650 "
+            "(NIST AC-2(3) typical window 30..90 days)."
+        ),
+    )
+    stale_invitation_threshold_days: Optional[int] = Field(
+        default=None,
+        ge=7,
+        le=365,
+        description=(
+            "Days a pending invitation can stay open. Range: 7..365 "
+            "(OWASP ASVS 2.7.1 recommends short-lived invitations)."
+        ),
+    )
+    max_owner_percentage: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=50,
+        description=(
+            "Max percentage of team members that can have the OWNER role. "
+            "Range: 1..50 (PoLP — having >50% of a team as OWNER defeats RBAC; "
+            "industry guidance recommends ≤25%)."
+        ),
+    )
+    max_owners: Optional[int] = Field(
+        default=None,
+        ge=1,
+        le=1000,
+        description="Absolute max owners (overrides percentage for large teams). Range: 1..1000.",
+    )
+    secret_suffixes: Optional[list[str]] = Field(
+        default=None,
+        description="Suffixes that mark a project env var as secret-like.",
+    )
diff --git a/tests/config/schema/__init__.py b/tests/config/schema/__init__.py
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/config/schema/aws_schema_test.py b/tests/config/schema/aws_schema_test.py
new file mode 100644
index 0000000000..ad08e84e3b
--- /dev/null
+++ b/tests/config/schema/aws_schema_test.py
@@ -0,0 +1,222 @@
+"""AWS-specific schema coverage — the biggest provider, with the richest
+constraint surface (CIDRs, account IDs, port ranges, enums, thresholds)."""
+
+import pytest
+
+from prowler.config.schema.aws import AWSProviderConfig
+from prowler.config.schema.validator import validate_provider_config
+
+
+def _validate(raw):
+    return validate_provider_config("aws", raw, AWSProviderConfig)
+
+
+class Test_AWS_Threat_Detection_Thresholds:
+    """All threat detection thresholds are documented as fractions in 0..1.
+    The biggest risk of mistyping them is silently disabling the check."""
+
+    @pytest.mark.parametrize(
+        "key",
+        [
+            "threat_detection_privilege_escalation_threshold",
+            "threat_detection_enumeration_threshold",
+            "threat_detection_llm_jacking_threshold",
+        ],
+    )
+    def test_valid_boundary_values(self, key):
+        assert _validate({key: 0.0}) == {key: 0.0}
+        assert _validate({key: 1.0}) == {key: 1.0}
+        assert _validate({key: 0.5}) == {key: 0.5}
+
+    @pytest.mark.parametrize(
+        "key",
+        [
+            "threat_detection_privilege_escalation_threshold",
+            "threat_detection_enumeration_threshold",
+            "threat_detection_llm_jacking_threshold",
+        ],
+    )
+    def test_invalid_values_are_dropped(self, key):
+        # 20 instead of 0.2 — would never trigger
+        assert _validate({key: 20}) == {}
+        # negative
+        assert _validate({key: -0.1}) == {}
+        # string
+        assert _validate({key: "high"}) == {}
+
+
+class Test_AWS_Trusted_Account_Ids:
+    def test_valid_twelve_digit_ids(self):
+        ids = ["123456789012", "098765432109"]
+        assert _validate({"trusted_account_ids": ids}) == {"trusted_account_ids": ids}
+
+    def test_empty_list_is_valid(self):
+        assert _validate({"trusted_account_ids": []}) == {"trusted_account_ids": []}
+
+    def test_short_id_is_dropped(self):
+        assert _validate({"trusted_account_ids": ["12345"]}) == {}
+
+    def test_non_numeric_id_is_dropped(self):
+        assert _validate({"trusted_account_ids": ["1234abcd5678"]}) == {}
+
+    def test_id_with_dashes_is_dropped(self):
+        # Some users format account IDs as "1234-5678-9012"
+        assert _validate({"trusted_account_ids": ["1234-5678-9012"]}) == {}
+
+
+class Test_AWS_Trusted_Ips:
+    def test_single_ipv4_address(self):
+        assert _validate({"trusted_ips": ["1.2.3.4"]}) == {"trusted_ips": ["1.2.3.4"]}
+
+    def test_ipv4_cidr(self):
+        assert _validate({"trusted_ips": ["10.0.0.0/8"]}) == {
+            "trusted_ips": ["10.0.0.0/8"]
+        }
+
+    def test_ipv6_address(self):
+        assert _validate({"trusted_ips": ["2001:db8::1"]}) == {
+            "trusted_ips": ["2001:db8::1"]
+        }
+
+    def test_ipv6_cidr(self):
+        assert _validate({"trusted_ips": ["2001:db8::/32"]}) == {
+            "trusted_ips": ["2001:db8::/32"]
+        }
+
+    def test_mixed_list(self):
+        ips = ["1.2.3.4", "10.0.0.0/8", "2001:db8::1"]
+        assert _validate({"trusted_ips": ips}) == {"trusted_ips": ips}
+
+    def test_garbage_entry_is_dropped(self):
+        assert _validate({"trusted_ips": ["definitely-not-an-ip"]}) == {}
+
+    def test_cidr_with_host_bits_is_accepted(self):
+        # We use strict=False so "10.0.0.5/8" is accepted. This matches the
+        # behaviour of most security tools and avoids surprising users who
+        # paste real-world allowlists with non-canonical CIDR notation.
+        assert _validate({"trusted_ips": ["10.0.0.5/8"]}) == {
+            "trusted_ips": ["10.0.0.5/8"]
+        }
+
+
+class Test_AWS_Ports:
+    def test_valid_ports_in_range(self):
+        ports = [25, 80, 443, 65535, 1]
+        assert _validate({"ec2_high_risk_ports": ports}) == {
+            "ec2_high_risk_ports": ports
+        }
+
+    def test_port_zero_is_dropped(self):
+        # Port 0 is reserved and not a valid security signal.
+        assert _validate({"ec2_high_risk_ports": [0]}) == {}
+
+    def test_out_of_range_port_is_dropped(self):
+        assert _validate({"ec2_high_risk_ports": [70000]}) == {}
+
+    def test_negative_port_is_dropped(self):
+        assert _validate({"ec2_high_risk_ports": [-1]}) == {}
+
+
+class Test_AWS_Enums:
+    @pytest.mark.parametrize("level", ["CRITICAL", "HIGH", "MEDIUM", "LOW"])
+    def test_valid_severity_levels(self, level):
+        assert _validate({"ecr_repository_vulnerability_minimum_severity": level}) == {
+            "ecr_repository_vulnerability_minimum_severity": level
+        }
+
+    @pytest.mark.parametrize("level", ["critical", "Medium", "ANY", "", "X"])
+    def test_invalid_severity_levels_are_dropped(self, level):
+        assert _validate({"ecr_repository_vulnerability_minimum_severity": level}) == {}
+
+
+class Test_AWS_Detect_Secrets_Plugins:
+    def test_plugin_without_limit(self):
+        out = _validate({"detect_secrets_plugins": [{"name": "AWSKeyDetector"}]})
+        assert out == {"detect_secrets_plugins": [{"name": "AWSKeyDetector"}]}
+
+    def test_plugin_with_limit(self):
+        out = _validate(
+            {
+                "detect_secrets_plugins": [
+                    {"name": "Base64HighEntropyString", "limit": 6.0}
+                ]
+            }
+        )
+        assert out == {
+            "detect_secrets_plugins": [
+                {"name": "Base64HighEntropyString", "limit": 6.0}
+            ]
+        }
+
+    def test_plugin_missing_name_drops_whole_field(self):
+        # ``name`` is required by the upstream library.
+        out = _validate({"detect_secrets_plugins": [{"limit": 6.0}]})
+        assert out == {}
+
+    def test_extra_plugin_kwargs_pass_through(self):
+        # Plugins can have arbitrary extra params (extra="allow" on the
+        # nested model). They must round-trip.
+        out = _validate(
+            {
+                "detect_secrets_plugins": [
+                    {"name": "Custom", "my_param": "abc", "other": 42}
+                ]
+            }
+        )
+        assert out == {
+            "detect_secrets_plugins": [
+                {"name": "Custom", "my_param": "abc", "other": 42}
+            ]
+        }
+
+
+class Test_AWS_Booleans:
+    @pytest.mark.parametrize(
+        "key",
+        [
+            "mute_non_default_regions",
+            "verify_premium_support_plans",
+            "check_rds_instance_replicas",
+        ],
+    )
+    def test_true_and_false_round_trip(self, key):
+        assert _validate({key: True}) == {key: True}
+        assert _validate({key: False}) == {key: False}
+
+    def test_yaml_style_boolean_coercion(self):
+        # YAML can produce Python str "true"/"yes" if the user quoted it.
+        # Pydantic v2 deterministically coerces "yes"/"no"/"true"/"false" to a
+        # real bool in lax mode, so the value is normalized rather than passed
+        # through as a string (which would be dangerous for
+        # verify_premium_support_plans).
+        out = _validate({"verify_premium_support_plans": "yes"})
+        assert "verify_premium_support_plans" in out
+        assert isinstance(out["verify_premium_support_plans"], bool)
+        assert out["verify_premium_support_plans"] is True
+
+
+class Test_AWS_Full_Default_Config_Round_Trips:
+    """Loading the real shipped defaults through the schema must produce
+    exactly the same dict. This is the regression sentinel for backwards
+    compatibility."""
+
+    def test_full_default_config_round_trip(self):
+        # Subset that mirrors the shipped config.yaml semantics.
+        raw = {
+            "mute_non_default_regions": False,
+            "disallowed_regions": ["me-south-1", "me-central-1"],
+            "max_unused_access_keys_days": 45,
+            "max_ec2_instance_age_in_days": 180,
+            "trusted_account_ids": [],
+            "trusted_ips": [],
+            "ecr_repository_vulnerability_minimum_severity": "MEDIUM",
+            "threat_detection_privilege_escalation_threshold": 0.2,
+            "threat_detection_enumeration_threshold": 0.3,
+            "threat_detection_llm_jacking_threshold": 0.4,
+            "ec2_high_risk_ports": [25, 110, 8088],
+            "detect_secrets_plugins": [
+                {"name": "AWSKeyDetector"},
+                {"name": "Base64HighEntropyString", "limit": 6.0},
+            ],
+        }
+        assert _validate(raw) == raw
diff --git a/tests/config/schema/bounds_test.py b/tests/config/schema/bounds_test.py
new file mode 100644
index 0000000000..0e5cad6056
--- /dev/null
+++ b/tests/config/schema/bounds_test.py
@@ -0,0 +1,398 @@
+"""Boundary tests for the safety bounds added on top of the upstream schemas.
+
+Each parametrised case checks (a) the min and max values are accepted and
+(b) one step outside the range is rejected. Custom validators (semver,
+EKS minor, dotted version, port range, account IDs, IPs) get focused
+positive/negative tests.
+
+Tests use the public adapter ``prowler.config.scan_config_schema``: a
+schema violation surfaces as a list of ``{"path", "message"}`` entries.
+This keeps the contract the Prowler App backend depends on under test.
+"""
+
+import pytest
+
+from prowler.config.scan_config_schema import validate_scan_config
+
+
+def _has_error_for(errors: list[dict], path_substr: str) -> bool:
+    return any(path_substr in e["path"] for e in errors)
+
+
+# Each tuple: (provider, key, min_allowed, max_allowed)
+INT_BOUND_CASES = [
+    # AWS
+    ("aws", "max_unused_access_keys_days", 30, 180),
+    ("aws", "max_console_access_days", 30, 180),
+    ("aws", "max_unused_sagemaker_access_days", 7, 180),
+    ("aws", "max_security_group_rules", 1, 1000),
+    ("aws", "max_ec2_instance_age_in_days", 1, 1095),
+    ("aws", "recommended_cdk_bootstrap_version", 1, 100),
+    ("aws", "max_idle_disconnect_timeout_in_seconds", 60, 1800),
+    ("aws", "max_disconnect_timeout_in_seconds", 60, 3600),
+    ("aws", "max_session_duration_seconds", 600, 86400),
+    ("aws", "lambda_min_azs", 1, 6),
+    ("aws", "threat_detection_privilege_escalation_minutes", 5, 43200),
+    ("aws", "threat_detection_enumeration_minutes", 5, 43200),
+    ("aws", "threat_detection_llm_jacking_minutes", 5, 43200),
+    ("aws", "days_to_expire_threshold", 7, 365),
+    ("aws", "elb_min_azs", 1, 6),
+    ("aws", "elbv2_min_azs", 1, 6),
+    ("aws", "minimum_snapshot_retention_period", 1, 35),
+    ("aws", "max_days_secret_unused", 7, 365),
+    ("aws", "max_days_secret_unrotated", 1, 180),
+    ("aws", "min_kinesis_stream_retention_hours", 24, 8760),
+    # Azure
+    ("azure", "vm_backup_min_daily_retention_days", 7, 9999),
+    ("azure", "apim_threat_detection_llm_jacking_minutes", 5, 43200),
+    # GCP
+    ("gcp", "mig_min_zones", 1, 5),
+    ("gcp", "max_snapshot_age_days", 1, 1095),
+    ("gcp", "max_unused_account_days", 30, 365),
+    ("gcp", "storage_min_retention_days", 1, 3650),
+    # Kubernetes
+    ("kubernetes", "audit_log_maxbackup", 2, 1000),
+    ("kubernetes", "audit_log_maxsize", 10, 10000),
+    ("kubernetes", "audit_log_maxage", 7, 3650),
+    # M365
+    ("m365", "sign_in_frequency", 1, 168),
+    ("m365", "recommended_mailtips_large_audience_threshold", 5, 10000),
+    ("m365", "audit_log_age", 30, 3650),
+    # GitHub
+    ("github", "inactive_not_archived_days_threshold", 30, 3650),
+    # MongoDB Atlas
+    ("mongodbatlas", "max_service_account_secret_validity_hours", 1, 720),
+    # Cloudflare
+    ("cloudflare", "max_retries", 0, 10),
+    # Vercel
+    ("vercel", "days_to_expire_threshold", 7, 365),
+    ("vercel", "stale_token_threshold_days", 30, 3650),
+    ("vercel", "stale_invitation_threshold_days", 7, 365),
+    ("vercel", "max_owner_percentage", 1, 50),
+    ("vercel", "max_owners", 1, 1000),
+]
+
+
+FLOAT_THRESHOLD_FIELDS = [
+    ("aws", "threat_detection_privilege_escalation_threshold"),
+    ("aws", "threat_detection_enumeration_threshold"),
+    ("aws", "threat_detection_llm_jacking_threshold"),
+    ("azure", "apim_threat_detection_llm_jacking_threshold"),
+]
+
+
+class TestIntegerBounds:
+    """Each int field accepts both ends of its range and rejects ±1 outside."""
+
+    @pytest.mark.parametrize("provider, key, lo, hi", INT_BOUND_CASES)
+    def test_min_accepted(self, provider, key, lo, hi):
+        assert validate_scan_config({provider: {key: lo}}) == []
+
+    @pytest.mark.parametrize("provider, key, lo, hi", INT_BOUND_CASES)
+    def test_max_accepted(self, provider, key, lo, hi):
+        assert validate_scan_config({provider: {key: hi}}) == []
+
+    @pytest.mark.parametrize("provider, key, lo, hi", INT_BOUND_CASES)
+    def test_below_min_rejected(self, provider, key, lo, hi):
+        errors = validate_scan_config({provider: {key: lo - 1}})
+        assert _has_error_for(errors, f"{provider}.{key}"), errors
+
+    @pytest.mark.parametrize("provider, key, lo, hi", INT_BOUND_CASES)
+    def test_above_max_rejected(self, provider, key, lo, hi):
+        errors = validate_scan_config({provider: {key: hi + 1}})
+        assert _has_error_for(errors, f"{provider}.{key}"), errors
+
+
+class TestFloatThresholds:
+    """Threshold floats must stay within 0..1 inclusive."""
+
+    @pytest.mark.parametrize("provider, key", FLOAT_THRESHOLD_FIELDS)
+    def test_zero_and_one_accepted(self, provider, key):
+        assert validate_scan_config({provider: {key: 0.0}}) == []
+        assert validate_scan_config({provider: {key: 1.0}}) == []
+        assert validate_scan_config({provider: {key: 0.5}}) == []
+
+    @pytest.mark.parametrize("provider, key", FLOAT_THRESHOLD_FIELDS)
+    def test_negative_rejected(self, provider, key):
+        errors = validate_scan_config({provider: {key: -0.01}})
+        assert _has_error_for(errors, f"{provider}.{key}")
+
+    @pytest.mark.parametrize("provider, key", FLOAT_THRESHOLD_FIELDS)
+    def test_above_one_rejected(self, provider, key):
+        errors = validate_scan_config({provider: {key: 1.01}})
+        assert _has_error_for(errors, f"{provider}.{key}")
+
+
+class TestCloudWatchRetention:
+    """`log_group_retention_days` only accepts the AWS-approved enum values."""
+
+    @pytest.mark.parametrize("value", [1, 7, 30, 365, 731, 3653])
+    def test_valid_values_accepted(self, value):
+        assert validate_scan_config({"aws": {"log_group_retention_days": value}}) == []
+
+    @pytest.mark.parametrize("value", [0, 2, 42, 500, 999, 4000])
+    def test_invalid_values_rejected(self, value):
+        errors = validate_scan_config({"aws": {"log_group_retention_days": value}})
+        assert _has_error_for(errors, "aws.log_group_retention_days")
+
+
+class TestSemverValidator:
+    """AWS Fargate platform versions: X.Y.Z."""
+
+    @pytest.mark.parametrize("value", ["1.4.0", "1.0.0", "0.0.1", "10.20.30"])
+    def test_accepts_semver(self, value):
+        assert (
+            validate_scan_config({"aws": {"fargate_linux_latest_version": value}}) == []
+        )
+
+    @pytest.mark.parametrize("value", ["1.4", "1", "v1.4.0", "1.4.0-beta", "a.b.c", ""])
+    def test_rejects_non_semver(self, value):
+        errors = validate_scan_config({"aws": {"fargate_linux_latest_version": value}})
+        assert _has_error_for(errors, "aws.fargate_linux_latest_version")
+
+
+class TestEksVersionValidator:
+    """`eks_cluster_oldest_version_supported` expects MAJOR.MINOR."""
+
+    @pytest.mark.parametrize("value", ["1.28", "1.29", "1.30", "2.0"])
+    def test_accepts_minor(self, value):
+        assert (
+            validate_scan_config(
+                {"aws": {"eks_cluster_oldest_version_supported": value}}
+            )
+            == []
+        )
+
+    @pytest.mark.parametrize("value", ["1.28.0", "v1.28", "1", "1.x", ""])
+    def test_rejects_invalid(self, value):
+        errors = validate_scan_config(
+            {"aws": {"eks_cluster_oldest_version_supported": value}}
+        )
+        assert _has_error_for(errors, "aws.eks_cluster_oldest_version_supported")
+
+
+class TestEksLogTypesEnum:
+    """Only the documented log types are accepted."""
+
+    def test_full_enum_accepted(self):
+        assert (
+            validate_scan_config(
+                {
+                    "aws": {
+                        "eks_required_log_types": [
+                            "api",
+                            "audit",
+                            "authenticator",
+                            "controllerManager",
+                            "scheduler",
+                        ]
+                    }
+                }
+            )
+            == []
+        )
+
+    def test_unknown_type_rejected(self):
+        errors = validate_scan_config(
+            {"aws": {"eks_required_log_types": ["api", "telemetry"]}}
+        )
+        assert _has_error_for(errors, "aws.eks_required_log_types")
+
+
+class TestAzureDottedVersion:
+    """App Service versions accept 'X' and 'X.Y' but not 'X.Y.Z' or junk."""
+
+    @pytest.mark.parametrize("value", ["8.2", "3.12", "17"])
+    def test_accepts(self, value):
+        assert validate_scan_config({"azure": {"php_latest_version": value}}) == []
+        assert validate_scan_config({"azure": {"python_latest_version": value}}) == []
+        assert validate_scan_config({"azure": {"java_latest_version": value}}) == []
+
+    @pytest.mark.parametrize("value", ["8.2.0", "v8", "8.x", ""])
+    def test_rejects(self, value):
+        errors = validate_scan_config({"azure": {"php_latest_version": value}})
+        assert _has_error_for(errors, "azure.php_latest_version")
+
+
+class TestAzureTlsLiteralEnum:
+    """Only TLS 1.2 and 1.3 are tolerated by the recommended list."""
+
+    def test_accepted_versions(self):
+        assert (
+            validate_scan_config(
+                {"azure": {"recommended_minimal_tls_versions": ["1.2", "1.3"]}}
+            )
+            == []
+        )
+
+    @pytest.mark.parametrize("value", ["1.0", "1.1", "2.0", ""])
+    def test_unknown_version_rejected(self, value):
+        errors = validate_scan_config(
+            {"azure": {"recommended_minimal_tls_versions": [value]}}
+        )
+        assert _has_error_for(errors, "azure.recommended_minimal_tls_versions")
+
+
+class TestAzureRiskLevelLiteral:
+    """Defender attack-path risk level is a closed enum."""
+
+    @pytest.mark.parametrize("value", ["Low", "Medium", "High", "Critical"])
+    def test_accepted(self, value):
+        assert (
+            validate_scan_config(
+                {"azure": {"defender_attack_path_minimal_risk_level": value}}
+            )
+            == []
+        )
+
+    @pytest.mark.parametrize("value", ["low", "CRITICAL", "Severe", ""])
+    def test_rejected(self, value):
+        errors = validate_scan_config(
+            {"azure": {"defender_attack_path_minimal_risk_level": value}}
+        )
+        assert _has_error_for(errors, "azure.defender_attack_path_minimal_risk_level")
+
+
+class TestECRSeverityLiteral:
+    """ECR severity is a closed enum (with INFORMATIONAL allowed)."""
+
+    @pytest.mark.parametrize(
+        "value",
+        ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFORMATIONAL"],
+    )
+    def test_accepted(self, value):
+        assert (
+            validate_scan_config(
+                {"aws": {"ecr_repository_vulnerability_minimum_severity": value}}
+            )
+            == []
+        )
+
+    @pytest.mark.parametrize("value", ["URGENT", "low", "Crit", ""])
+    def test_rejected(self, value):
+        errors = validate_scan_config(
+            {"aws": {"ecr_repository_vulnerability_minimum_severity": value}}
+        )
+        assert _has_error_for(
+            errors, "aws.ecr_repository_vulnerability_minimum_severity"
+        )
+
+
+class TestPortRangeValidator:
+    """Each entry of `ec2_high_risk_ports` must be 1..65535 (0 is reserved)."""
+
+    def test_valid_ports(self):
+        assert (
+            validate_scan_config({"aws": {"ec2_high_risk_ports": [1, 22, 8080, 65535]}})
+            == []
+        )
+
+    @pytest.mark.parametrize("value", [-1, 0, 65536, 99999])
+    def test_invalid_port_rejected(self, value):
+        errors = validate_scan_config({"aws": {"ec2_high_risk_ports": [80, value]}})
+        assert _has_error_for(errors, "aws.ec2_high_risk_ports")
+
+
+class TestAccountIdsValidator:
+    """AWS account IDs are 12-digit strings."""
+
+    def test_valid(self):
+        assert (
+            validate_scan_config(
+                {"aws": {"trusted_account_ids": ["123456789012", "098765432109"]}}
+            )
+            == []
+        )
+
+    @pytest.mark.parametrize(
+        "value", ["12345", "12345678901", "1234567890123", "12345678901a"]
+    )
+    def test_invalid_rejected(self, value):
+        errors = validate_scan_config({"aws": {"trusted_account_ids": [value]}})
+        assert _has_error_for(errors, "aws.trusted_account_ids")
+
+
+class TestTrustedIpsValidator:
+    """Trusted IPs accept IPv4, IPv6, and CIDR; reject junk."""
+
+    @pytest.mark.parametrize(
+        "value",
+        ["1.2.3.4", "10.0.0.0/8", "2001:db8::1", "2001:db8::/32"],
+    )
+    def test_valid(self, value):
+        assert validate_scan_config({"aws": {"trusted_ips": [value]}}) == []
+
+    @pytest.mark.parametrize(
+        "value", ["not.an.ip", "1.2.3.300", "10.0.0.0/40", "::ffff:::"]
+    )
+    def test_invalid_rejected(self, value):
+        errors = validate_scan_config({"aws": {"trusted_ips": [value]}})
+        assert _has_error_for(errors, "aws.trusted_ips")
+
+
+class TestDetectSecretsEntropyBound:
+    """`detect_secrets_plugins[].limit` is Shannon entropy: 0..10."""
+
+    @pytest.mark.parametrize("value", [0.0, 3.5, 4.5, 8.0, 10.0])
+    def test_valid(self, value):
+        assert (
+            validate_scan_config(
+                {
+                    "aws": {
+                        "detect_secrets_plugins": [
+                            {"name": "Base64HighEntropyString", "limit": value}
+                        ]
+                    }
+                }
+            )
+            == []
+        )
+
+    @pytest.mark.parametrize("value", [-0.1, 10.01, 50])
+    def test_invalid(self, value):
+        errors = validate_scan_config(
+            {
+                "aws": {
+                    "detect_secrets_plugins": [
+                        {"name": "Base64HighEntropyString", "limit": value}
+                    ]
+                }
+            }
+        )
+        assert _has_error_for(errors, "aws.detect_secrets_plugins")
+
+
+class TestAdapterRobustness:
+    """Top-level adapter behaviour the Prowler App backend depends on."""
+
+    def test_non_dict_payload(self):
+        errors = validate_scan_config([1, 2, 3])
+        assert len(errors) == 1
+        assert errors[0]["path"] == "<root>"
+
+    def test_unknown_provider_section_tolerated(self):
+        # additionalProperties: True at the root level by design.
+        assert validate_scan_config({"newprovider": {"foo": "bar"}}) == []
+
+    def test_unknown_key_tolerated_by_pydantic_extra_allow(self):
+        # ProviderConfigBase has extra="allow" for forward compatibility.
+        assert validate_scan_config({"aws": {"completely_new_knob": 1}}) == []
+
+    def test_provider_section_must_be_mapping(self):
+        errors = validate_scan_config({"aws": "not a mapping"})
+        assert _has_error_for(errors, "aws")
+
+    def test_multiple_errors_surfaced(self):
+        errors = validate_scan_config(
+            {
+                "aws": {
+                    "max_unused_access_keys_days": 5,  # below min 30
+                    "max_security_group_rules": 99999,  # above max 1000
+                    "ec2_high_risk_ports": [80, 70000],  # port out of range
+                }
+            }
+        )
+        # All three should surface independently.
+        assert _has_error_for(errors, "aws.max_unused_access_keys_days")
+        assert _has_error_for(errors, "aws.max_security_group_rules")
+        assert _has_error_for(errors, "aws.ec2_high_risk_ports")
diff --git a/tests/config/schema/loader_integration_test.py b/tests/config/schema/loader_integration_test.py
new file mode 100644
index 0000000000..fa995fb9df
--- /dev/null
+++ b/tests/config/schema/loader_integration_test.py
@@ -0,0 +1,124 @@
+"""End-to-end tests that exercise the real ``load_and_validate_config_file``
+through a temp YAML file. Anything that breaks here would break the actual
+``prowler aws -c …`` code path."""
+
+import logging
+import os
+import pathlib
+from typing import Callable
+
+import pytest
+
+from prowler.config.config import load_and_validate_config_file
+
+
+@pytest.fixture
+def write_config(tmp_path: pathlib.Path) -> Callable[[str], str]:
+    def _write(content: str) -> str:
+        path = tmp_path / "config.yaml"
+        path.write_text(content)
+        return str(path)
+
+    return _write
+
+
+class Test_Loader_With_Schema_Integration:
+    def test_shipped_default_config_loads_without_warnings(self, caplog):
+        """The default ``prowler/config/config.yaml`` must round-trip every
+        provider WITHOUT emitting any schema warnings. If this fails,
+        someone added a key to the YAML without updating the schema."""
+        repo_root = pathlib.Path(os.path.dirname(os.path.realpath(__file__))).parents[2]
+        shipped = repo_root / "prowler" / "config" / "config.yaml"
+        with caplog.at_level(logging.WARNING, logger="prowler"):
+            for provider in [
+                "aws",
+                "azure",
+                "gcp",
+                "kubernetes",
+                "m365",
+                "github",
+                "mongodbatlas",
+                "cloudflare",
+                "vercel",
+            ]:
+                cfg = load_and_validate_config_file(provider, str(shipped))
+                # Provider always exists in the shipped file → non-empty.
+                assert cfg, f"{provider} returned an empty config"
+
+        offending = [
+            r.getMessage()
+            for r in caplog.records
+            if "prowler.config[" in r.getMessage()
+        ]
+        assert not offending, (
+            "Shipped config.yaml triggered schema warnings — schema or YAML out of sync:\n"
+            + "\n".join(offending)
+        )
+
+    def test_user_config_with_bad_threshold_falls_back(self, write_config, caplog):
+        path = write_config(
+            "aws:\n"
+            "  threat_detection_privilege_escalation_threshold: 5.0\n"
+            "  lambda_min_azs: 2\n"
+        )
+        with caplog.at_level(logging.WARNING, logger="prowler"):
+            cfg = load_and_validate_config_file("aws", path)
+        assert cfg == {"lambda_min_azs": 2}
+        assert any(
+            "threat_detection_privilege_escalation_threshold" in r.getMessage()
+            for r in caplog.records
+        )
+
+    def test_old_format_config_still_works(self, write_config):
+        # Old format = flat keys, no provider header.
+        path = write_config(
+            "max_ec2_instance_age_in_days: 90\n"
+            "ecr_repository_vulnerability_minimum_severity: HIGH\n"
+        )
+        cfg = load_and_validate_config_file("aws", path)
+        assert cfg == {
+            "max_ec2_instance_age_in_days": 90,
+            "ecr_repository_vulnerability_minimum_severity": "HIGH",
+        }
+
+    def test_unknown_keys_pass_through_via_loader(self, write_config):
+        path = write_config(
+            "aws:\n" "  third_party_plugin_setting: hello\n" "  lambda_min_azs: 2\n"
+        )
+        cfg = load_and_validate_config_file("aws", path)
+        assert cfg == {
+            "third_party_plugin_setting": "hello",
+            "lambda_min_azs": 2,
+        }
+
+    def test_quoted_numeric_is_coerced_via_loader(self, write_config):
+        # YAML quotes the number: ``"180"`` arrives as a Python str.
+        # The schema must coerce it to int so downstream comparisons work.
+        path = write_config('aws:\n  max_ec2_instance_age_in_days: "180"\n')
+        cfg = load_and_validate_config_file("aws", path)
+        assert cfg == {"max_ec2_instance_age_in_days": 180}
+        assert isinstance(cfg["max_ec2_instance_age_in_days"], int)
+
+    def test_invalid_yaml_shape_list_as_string_drops_key(self, write_config, caplog):
+        path = write_config(
+            "aws:\n"
+            "  disallowed_regions: me-south-1\n"  # forgot list dashes
+            "  lambda_min_azs: 2\n"
+        )
+        with caplog.at_level(logging.WARNING, logger="prowler"):
+            cfg = load_and_validate_config_file("aws", path)
+        assert cfg == {"lambda_min_azs": 2}
+        assert any("disallowed_regions" in r.getMessage() for r in caplog.records)
+
+    def test_other_providers_unaffected_by_aws_block(self, write_config):
+        path = write_config(
+            "aws:\n  max_ec2_instance_age_in_days: 90\n" "gcp:\n  mig_min_zones: 5\n"
+        )
+        assert load_and_validate_config_file("aws", path) == {
+            "max_ec2_instance_age_in_days": 90
+        }
+        assert load_and_validate_config_file("gcp", path) == {"mig_min_zones": 5}
+
+    def test_missing_provider_block_returns_empty(self, write_config):
+        path = write_config("aws:\n  max_ec2_instance_age_in_days: 90\n")
+        assert load_and_validate_config_file("azure", path) == {}
diff --git a/tests/config/schema/other_providers_schema_test.py b/tests/config/schema/other_providers_schema_test.py
new file mode 100644
index 0000000000..f4dc5184ab
--- /dev/null
+++ b/tests/config/schema/other_providers_schema_test.py
@@ -0,0 +1,152 @@
+"""Smaller-provider schema coverage. One happy path + one invalid path
+per field is enough to lock in the contract; the validator behaviour
+itself is covered exhaustively in validator_test.py."""
+
+import pytest
+
+from prowler.config.schema.registry import SCHEMAS
+from prowler.config.schema.validator import validate_provider_config
+
+
+def _validate(provider, raw):
+    return validate_provider_config(provider, raw, SCHEMAS[provider])
+
+
+class Test_Azure_Schema:
+    @pytest.mark.parametrize("level", ["Low", "Medium", "High", "Critical"])
+    def test_defender_risk_level_valid_values(self, level):
+        assert _validate(
+            "azure", {"defender_attack_path_minimal_risk_level": level}
+        ) == {"defender_attack_path_minimal_risk_level": level}
+
+    def test_defender_risk_level_lowercase_dropped(self):
+        # Case matters: the matching check uses Title-case comparison.
+        assert (
+            _validate("azure", {"defender_attack_path_minimal_risk_level": "high"})
+            == {}
+        )
+
+    def test_apim_threshold_in_range(self):
+        out = _validate("azure", {"apim_threat_detection_llm_jacking_threshold": 0.1})
+        assert out == {"apim_threat_detection_llm_jacking_threshold": 0.1}
+
+    def test_apim_threshold_out_of_range(self):
+        out = _validate("azure", {"apim_threat_detection_llm_jacking_threshold": 1.5})
+        assert out == {}
+
+    def test_vm_backup_retention_must_be_positive(self):
+        assert _validate("azure", {"vm_backup_min_daily_retention_days": 7}) == {
+            "vm_backup_min_daily_retention_days": 7
+        }
+        assert _validate("azure", {"vm_backup_min_daily_retention_days": 0}) == {}
+        assert _validate("azure", {"vm_backup_min_daily_retention_days": -1}) == {}
+
+
+class Test_GCP_Schema:
+    def test_valid_values_round_trip(self):
+        raw = {
+            "mig_min_zones": 2,
+            "max_snapshot_age_days": 90,
+            "max_unused_account_days": 180,
+            "storage_min_retention_days": 90,
+        }
+        assert _validate("gcp", raw) == raw
+
+    def test_zero_zone_count_dropped(self):
+        assert _validate("gcp", {"mig_min_zones": 0}) == {}
+
+
+class Test_Kubernetes_Schema:
+    def test_valid_values_round_trip(self):
+        raw = {
+            "audit_log_maxbackup": 10,
+            "audit_log_maxsize": 100,
+            "audit_log_maxage": 30,
+        }
+        assert _validate("kubernetes", raw) == raw
+
+    def test_negative_audit_log_dropped(self):
+        assert _validate("kubernetes", {"audit_log_maxage": -1}) == {}
+
+
+class Test_M365_Schema:
+    def test_valid_values_round_trip(self):
+        raw = {
+            "sign_in_frequency": 4,
+            "recommended_mailtips_large_audience_threshold": 25,
+            "audit_log_age": 90,
+        }
+        assert _validate("m365", raw) == raw
+
+    def test_negative_audit_log_age_dropped(self):
+        assert _validate("m365", {"audit_log_age": -10}) == {}
+
+
+class Test_GitHub_Schema:
+    def test_valid_threshold(self):
+        assert _validate("github", {"inactive_not_archived_days_threshold": 180}) == {
+            "inactive_not_archived_days_threshold": 180
+        }
+
+    def test_zero_threshold_dropped(self):
+        assert _validate("github", {"inactive_not_archived_days_threshold": 0}) == {}
+
+
+class Test_MongoDBAtlas_Schema:
+    def test_valid(self):
+        assert _validate(
+            "mongodbatlas", {"max_service_account_secret_validity_hours": 8}
+        ) == {"max_service_account_secret_validity_hours": 8}
+
+    def test_invalid_negative(self):
+        assert (
+            _validate("mongodbatlas", {"max_service_account_secret_validity_hours": -1})
+            == {}
+        )
+
+
+class Test_Cloudflare_Schema:
+    def test_zero_retries_allowed(self):
+        # 0 is explicitly documented as "disable retries" in config.yaml.
+        assert _validate("cloudflare", {"max_retries": 0}) == {"max_retries": 0}
+
+    def test_positive_retries_allowed(self):
+        assert _validate("cloudflare", {"max_retries": 3}) == {"max_retries": 3}
+
+    def test_negative_retries_dropped(self):
+        assert _validate("cloudflare", {"max_retries": -1}) == {}
+
+
+class Test_Vercel_Schema:
+    def test_owner_percentage_in_range(self):
+        assert _validate("vercel", {"max_owner_percentage": 20}) == {
+            "max_owner_percentage": 20
+        }
+        assert _validate("vercel", {"max_owner_percentage": 1}) == {
+            "max_owner_percentage": 1
+        }
+        assert _validate("vercel", {"max_owner_percentage": 50}) == {
+            "max_owner_percentage": 50
+        }
+
+    def test_owner_percentage_over_max_dropped(self):
+        # Tightened to 1..50 — anything above (incl. previous 100) is dropped.
+        assert _validate("vercel", {"max_owner_percentage": 51}) == {}
+        assert _validate("vercel", {"max_owner_percentage": 150}) == {}
+
+    def test_owner_percentage_zero_or_negative_dropped(self):
+        # 0 is no longer a valid configuration (defeats PoLP signal).
+        assert _validate("vercel", {"max_owner_percentage": 0}) == {}
+        assert _validate("vercel", {"max_owner_percentage": -1}) == {}
+
+    def test_full_default_config_round_trip(self):
+        raw = {
+            "stable_branches": ["main", "master"],
+            "days_to_expire_threshold": 7,
+            "stale_token_threshold_days": 90,
+            "stale_invitation_threshold_days": 30,
+            "max_owner_percentage": 20,
+            "max_owners": 3,
+            "secret_suffixes": ["_KEY", "_SECRET", "_TOKEN"],
+        }
+        assert _validate("vercel", raw) == raw
diff --git a/tests/config/schema/validator_test.py b/tests/config/schema/validator_test.py
new file mode 100644
index 0000000000..398a0d10e8
--- /dev/null
+++ b/tests/config/schema/validator_test.py
@@ -0,0 +1,175 @@
+"""Behavioural tests for ``validate_provider_config``.
+
+The validator is the gatekeeper for every provider schema: its job is to
+keep backwards-compatible behaviour (no exceptions, drop only the bad
+keys) while loudly logging type mistakes.
+"""
+
+import logging
+
+import pytest
+
+from prowler.config.schema.aws import AWSProviderConfig
+from prowler.config.schema.registry import SCHEMAS
+from prowler.config.schema.validator import validate_provider_config
+
+
+class Test_Validate_Provider_Config_Contract:
+    """Generic invariants that must hold for any schema."""
+
+    def test_returns_empty_dict_when_raw_is_not_a_dict(self):
+        assert validate_provider_config("aws", None, AWSProviderConfig) == {}
+        assert validate_provider_config("aws", "string", AWSProviderConfig) == {}
+        assert validate_provider_config("aws", 42, AWSProviderConfig) == {}
+        assert validate_provider_config("aws", [], AWSProviderConfig) == {}
+
+    def test_returns_raw_unchanged_when_no_schema_registered(self):
+        raw = {"anything": "goes", "even": [1, 2, 3]}
+        assert validate_provider_config("mystery_provider", raw, None) == raw
+
+    def test_unknown_keys_pass_through_for_plugin_compatibility(self):
+        # Third-party plugins inject arbitrary keys; the schema must NOT
+        # filter them. This is the contract that lets the plugin ecosystem
+        # keep working when we add validation.
+        raw = {"plugin_custom_key": "foo", "lambda_min_azs": 2}
+        assert validate_provider_config("aws", raw, AWSProviderConfig) == {
+            "plugin_custom_key": "foo",
+            "lambda_min_azs": 2,
+        }
+
+    def test_empty_dict_returns_empty_dict(self):
+        assert validate_provider_config("aws", {}, AWSProviderConfig) == {}
+
+    def test_known_valid_value_passes_through_unchanged(self):
+        raw = {"max_ec2_instance_age_in_days": 180}
+        assert validate_provider_config("aws", raw, AWSProviderConfig) == {
+            "max_ec2_instance_age_in_days": 180
+        }
+
+
+class Test_Validate_Provider_Config_Coercion:
+    """Pydantic v2 coerces common type-mistakes automatically. We want to
+    keep that behaviour so quoted numerics in user configs ``Just Work``."""
+
+    def test_string_numeric_is_coerced_to_int(self):
+        out = validate_provider_config(
+            "aws", {"max_ec2_instance_age_in_days": "180"}, AWSProviderConfig
+        )
+        assert out == {"max_ec2_instance_age_in_days": 180}
+        assert isinstance(out["max_ec2_instance_age_in_days"], int)
+
+    def test_string_numeric_is_coerced_to_float(self):
+        out = validate_provider_config(
+            "aws",
+            {"threat_detection_privilege_escalation_threshold": "0.4"},
+            AWSProviderConfig,
+        )
+        assert out == {"threat_detection_privilege_escalation_threshold": 0.4}
+
+
+class Test_Validate_Provider_Config_Drops_Invalid_Keys:
+    """When a field fails validation, only that key is dropped from the
+    returned dict. The rest of the user's config is preserved so the
+    consumer's ``audit_config.get(key, default)`` falls back to its own
+    built-in default for the offending field and uses user values for
+    everything else."""
+
+    def test_out_of_range_threshold_is_dropped(self, caplog):
+        with caplog.at_level(logging.WARNING):
+            out = validate_provider_config(
+                "aws",
+                {
+                    "threat_detection_privilege_escalation_threshold": 2.0,
+                    "lambda_min_azs": 2,
+                },
+                AWSProviderConfig,
+            )
+        assert out == {"lambda_min_azs": 2}
+        assert any(
+            "threat_detection_privilege_escalation_threshold" in r.getMessage()
+            for r in caplog.records
+        )
+
+    def test_invalid_enum_is_dropped(self):
+        out = validate_provider_config(
+            "aws",
+            {"ecr_repository_vulnerability_minimum_severity": "medum"},
+            AWSProviderConfig,
+        )
+        assert out == {}
+
+    def test_wrong_shape_list_as_string_is_dropped(self):
+        # Classic YAML mistake: ``disallowed_regions: me-south-1`` without dashes.
+        # Pydantic refuses to silently treat a str as a single-element list,
+        # which is exactly the safety guarantee we want.
+        out = validate_provider_config(
+            "aws",
+            {"disallowed_regions": "me-south-1", "lambda_min_azs": 2},
+            AWSProviderConfig,
+        )
+        assert out == {"lambda_min_azs": 2}
+
+    def test_negative_positive_int_is_dropped(self):
+        out = validate_provider_config(
+            "aws", {"max_ec2_instance_age_in_days": -1}, AWSProviderConfig
+        )
+        assert out == {}
+
+    def test_zero_is_dropped_for_strictly_positive_field(self):
+        # max_ec2_instance_age_in_days is gt=0. Zero would silently cause every
+        # instance to FAIL the age check.
+        out = validate_provider_config(
+            "aws", {"max_ec2_instance_age_in_days": 0}, AWSProviderConfig
+        )
+        assert out == {}
+
+    def test_multiple_invalid_keys_yield_multiple_warnings(self, caplog):
+        with caplog.at_level(logging.WARNING):
+            out = validate_provider_config(
+                "aws",
+                {
+                    "max_ec2_instance_age_in_days": "nope",
+                    "ecr_repository_vulnerability_minimum_severity": "medum",
+                    "valid_extra_key": "kept",
+                },
+                AWSProviderConfig,
+            )
+        assert out == {"valid_extra_key": "kept"}
+        messages = " ".join(r.getMessage() for r in caplog.records)
+        assert "max_ec2_instance_age_in_days" in messages
+        assert "ecr_repository_vulnerability_minimum_severity" in messages
+
+    def test_warning_message_includes_provider_and_field(self, caplog):
+        with caplog.at_level(logging.WARNING):
+            validate_provider_config(
+                "aws",
+                {"threat_detection_privilege_escalation_threshold": 5.0},
+                AWSProviderConfig,
+            )
+        assert any(
+            "prowler.config[aws.threat_detection_privilege_escalation_threshold]"
+            in r.getMessage()
+            for r in caplog.records
+        )
+
+
+class Test_Schemas_Registry:
+    """Every provider mentioned in the YAML config must have a schema."""
+
+    @pytest.mark.parametrize(
+        "provider",
+        [
+            "aws",
+            "azure",
+            "gcp",
+            "kubernetes",
+            "m365",
+            "github",
+            "mongodbatlas",
+            "cloudflare",
+            "vercel",
+        ],
+    )
+    def test_schema_registered_for_provider(self, provider):
+        assert provider in SCHEMAS
+        assert SCHEMAS[provider] is not None

From c6c07957a63011b56ae482d715450ce58af3193b Mon Sep 17 00:00:00 2001
From: Alejandro Bailo <59607668+alejandrobailo@users.noreply.github.com>
Date: Tue, 23 Jun 2026 09:52:20 +0200
Subject: [PATCH 126/126] fix(ui): use shared scan launch action errors
 (#11664)

---
 .../organizations/org-launch-scan.test.tsx    | 12 +++-
 .../organizations/org-launch-scan.tsx         |  5 +-
 .../wizard/steps/launch-step.test.tsx         | 46 +++++++++++++++
 .../providers/wizard/steps/launch-step.tsx    | 11 +++-
 .../scans/launch-scan-modal.test.tsx          | 39 +++++++++++++
 ui/components/scans/launch-scan-modal.tsx     |  5 +-
 .../edit-scan-schedule-modal.test.tsx         | 58 +++++++++++++++++++
 .../schedule/edit-scan-schedule-modal.tsx     | 11 ++--
 .../scans/schedule/save-schedule.test.ts      | 40 +++++++++++++
 ui/components/scans/schedule/save-schedule.ts | 12 ++--
 ui/lib/action-errors.test.ts                  | 34 +++++++++++
 ui/lib/action-errors.ts                       | 26 ++++++++-
 12 files changed, 278 insertions(+), 21 deletions(-)

diff --git a/ui/components/providers/organizations/org-launch-scan.test.tsx b/ui/components/providers/organizations/org-launch-scan.test.tsx
index 9d98cef5af..f7f7fb11a3 100644
--- a/ui/components/providers/organizations/org-launch-scan.test.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.test.tsx
@@ -3,6 +3,11 @@ import userEvent from "@testing-library/user-event";
 import type { ComponentProps } from "react";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+import {
+  ACTION_ERROR_API_MESSAGES,
+  ACTION_ERROR_MESSAGES,
+  ACTION_ERROR_STATUS,
+} from "@/lib/action-errors";
 import { useOrgSetupStore } from "@/store/organizations/store";
 import {
   SCAN_JOBS_TAB,
@@ -203,7 +208,10 @@ describe("OrgLaunchScan", () => {
       // Given
       const onClose = vi.fn();
       const onFooterChange = vi.fn();
-      updateSchedulesBulkMock.mockResolvedValue({ error: "Denied" });
+      updateSchedulesBulkMock.mockResolvedValue({
+        error: ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+        status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED,
+      });
 
       render(
         <OrgLaunchScan
@@ -226,6 +234,8 @@ describe("OrgLaunchScan", () => {
           expect.objectContaining({
             variant: "destructive",
             title: "Unable to save scan schedules",
+            description:
+              ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
           }),
         ),
       );
diff --git a/ui/components/providers/organizations/org-launch-scan.tsx b/ui/components/providers/organizations/org-launch-scan.tsx
index 70b0cc46d3..b8fde57c65 100644
--- a/ui/components/providers/organizations/org-launch-scan.tsx
+++ b/ui/components/providers/organizations/org-launch-scan.tsx
@@ -24,6 +24,7 @@ import {
 import { Spinner } from "@/components/shadcn/spinner/spinner";
 import { TreeStatusIcon } from "@/components/shadcn/tree-view/tree-status-icon";
 import { ToastAction, useToast } from "@/components/ui";
+import { getActionErrorMessage, hasActionError } from "@/lib/action-errors";
 import {
   buildScheduleUpdatePayload,
   getScanScheduleCapability,
@@ -169,12 +170,12 @@ export function OrgLaunchScan({
       buildScheduleUpdatePayload(values),
     );
 
-    if (result.error) {
+    if (hasActionError(result)) {
       setIsLaunching(false);
       toast({
         variant: "destructive",
         title: "Unable to save scan schedules",
-        description: String(result.error),
+        description: getActionErrorMessage(result),
       });
       return;
     }
diff --git a/ui/components/providers/wizard/steps/launch-step.test.tsx b/ui/components/providers/wizard/steps/launch-step.test.tsx
index 22802e6424..6cf7d3cfa5 100644
--- a/ui/components/providers/wizard/steps/launch-step.test.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.test.tsx
@@ -3,6 +3,11 @@ import userEvent from "@testing-library/user-event";
 import type { ComponentProps } from "react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
+import {
+  ACTION_ERROR_API_MESSAGES,
+  ACTION_ERROR_MESSAGES,
+  ACTION_ERROR_STATUS,
+} from "@/lib/action-errors";
 import { useProviderWizardStore } from "@/store/provider-wizard/store";
 import { SCAN_JOBS_TAB } from "@/types";
 import {
@@ -376,6 +381,47 @@ describe("LaunchStep", () => {
       expect(onClose).toHaveBeenCalledTimes(1);
     });
 
+    it("uses the shared subscription error copy when a manual scan is blocked", async () => {
+      // Given
+      const onClose = vi.fn();
+      const onFooterChange = vi.fn();
+      const rawError =
+        ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED];
+      seedConnectedProvider();
+      scanOnDemandMock.mockResolvedValue({
+        error: rawError,
+        status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED,
+      });
+
+      render(
+        <LaunchStep
+          onBack={vi.fn()}
+          onClose={onClose}
+          onFooterChange={onFooterChange}
+          capability={SCAN_SCHEDULE_CAPABILITY.MANUAL_ONLY}
+        />,
+      );
+      await waitFor(() => expect(onFooterChange).toHaveBeenCalled());
+
+      // When
+      await act(async () => {
+        lastFooterConfig(onFooterChange)?.onAction?.();
+      });
+
+      // Then
+      await waitFor(() => expect(scanOnDemandMock).toHaveBeenCalledTimes(1));
+      expect(toastMock).toHaveBeenCalledWith(
+        expect.objectContaining({
+          variant: "destructive",
+          title: "Unable to launch scan",
+          description:
+            ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+        }),
+      );
+      expect(toastMock.mock.calls[0]?.[0].description).not.toContain(rawError);
+      expect(onClose).not.toHaveBeenCalled();
+    });
+
     it("disables the action and shows the limit copy when over limit", async () => {
       // Given
       const onFooterChange = vi.fn();
diff --git a/ui/components/providers/wizard/steps/launch-step.tsx b/ui/components/providers/wizard/steps/launch-step.tsx
index 7e2f0348dd..51a5727f63 100644
--- a/ui/components/providers/wizard/steps/launch-step.tsx
+++ b/ui/components/providers/wizard/steps/launch-step.tsx
@@ -24,6 +24,11 @@ import {
 } from "@/components/shared/cloud-feature-badge";
 import { ToastAction, useToast } from "@/components/ui";
 import { EntityInfo } from "@/components/ui/entities";
+import {
+  type ActionErrorResult,
+  getActionErrorMessage,
+  hasActionError,
+} from "@/lib/action-errors";
 import {
   getScanScheduleCapability,
   getScheduleFormDefaults,
@@ -129,7 +134,7 @@ export function LaunchStep({
     }
   }, [isAdvanced, mode]);
 
-  const launchOnDemandScan = async (): Promise<{ error?: unknown } | null> => {
+  const launchOnDemandScan = async (): Promise<ActionErrorResult | null> => {
     if (!providerId || isBlocked) return null;
     const formData = new FormData();
     formData.set("providerId", providerId);
@@ -144,12 +149,12 @@ export function LaunchStep({
     setIsLaunching(true);
     const scanResult = await launchOnDemandScan();
 
-    if (scanResult?.error) {
+    if (hasActionError(scanResult)) {
       setIsLaunching(false);
       toast({
         variant: "destructive",
         title: "Unable to launch scan",
-        description: String(scanResult.error),
+        description: getActionErrorMessage(scanResult),
       });
       return;
     }
diff --git a/ui/components/scans/launch-scan-modal.test.tsx b/ui/components/scans/launch-scan-modal.test.tsx
index bfcfb62c07..73e648a691 100644
--- a/ui/components/scans/launch-scan-modal.test.tsx
+++ b/ui/components/scans/launch-scan-modal.test.tsx
@@ -123,6 +123,11 @@ vi.mock("@/app/(prowler)/_overview/_components/accounts-selector", () => ({
   ),
 }));
 
+import {
+  ACTION_ERROR_API_MESSAGES,
+  ACTION_ERROR_MESSAGES,
+  ACTION_ERROR_STATUS,
+} from "@/lib/action-errors";
 import { SCAN_SCHEDULE_CAPABILITY } from "@/types/schedules";
 
 import { LaunchScanModal } from "./launch-scan-modal";
@@ -334,6 +339,40 @@ describe("LaunchScanModal", () => {
     expect(onOpenChange).not.toHaveBeenCalledWith(false);
   });
 
+  it("maps payment-required scan errors to the shared subscription message", async () => {
+    const user = userEvent.setup();
+    const onOpenChange = vi.fn();
+    scanOnDemandMock.mockResolvedValueOnce({
+      error: ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED,
+    });
+
+    render(
+      <LaunchScanModal
+        open
+        onOpenChange={onOpenChange}
+        providers={[provider]}
+      />,
+    );
+
+    await user.selectOptions(screen.getByLabelText("Providers"), provider.id);
+    await user.click(screen.getByRole("button", { name: /launch scan/i }));
+
+    expect(
+      await screen.findByText(
+        ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      ),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByText(
+        ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      ),
+    ).not.toBeInTheDocument();
+    expect(toastMock).not.toHaveBeenCalled();
+    expect(refreshMock).not.toHaveBeenCalled();
+    expect(onOpenChange).not.toHaveBeenCalledWith(false);
+  });
+
   describe("schedule mode", () => {
     const weeklyScheduleResponse = {
       data: {
diff --git a/ui/components/scans/launch-scan-modal.tsx b/ui/components/scans/launch-scan-modal.tsx
index 62721b9e7a..d3f9993622 100644
--- a/ui/components/scans/launch-scan-modal.tsx
+++ b/ui/components/scans/launch-scan-modal.tsx
@@ -20,6 +20,7 @@ import {
 import { CloudFeatureBadgeLink } from "@/components/shared/cloud-feature-badge";
 import { FormButtons } from "@/components/ui/form";
 import { toast, ToastAction } from "@/components/ui/toast";
+import { getActionErrorMessage, hasActionError } from "@/lib/action-errors";
 import {
   getScanScheduleCapability,
   getScheduleFormDefaults,
@@ -172,8 +173,8 @@ function LaunchScanForm({
 
     const result = await scanOnDemand(formData);
 
-    if (result?.error) {
-      form.setError("root", { message: String(result.error) });
+    if (hasActionError(result)) {
+      form.setError("root", { message: getActionErrorMessage(result) });
       return;
     }
 
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
index a3a715110a..27f5c302de 100644
--- a/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.test.tsx
@@ -80,6 +80,11 @@ vi.mock("@/components/shadcn/modal", () => ({
     ) : null,
 }));
 
+import {
+  ACTION_ERROR_API_MESSAGES,
+  ACTION_ERROR_MESSAGES,
+  ACTION_ERROR_STATUS,
+} from "@/lib/action-errors";
 import type { ScheduleProps } from "@/types/schedules";
 
 import {
@@ -292,6 +297,59 @@ describe("EditScanScheduleModal remove flow", () => {
     );
   });
 
+  it("uses the shared subscription error copy when saving is blocked", async () => {
+    const user = userEvent.setup();
+    updateScheduleMock.mockResolvedValue({
+      error: ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED,
+    });
+
+    renderLoaded();
+
+    await user.click(screen.getByRole("button", { name: "Save" }));
+
+    expect(
+      await screen.findByText(
+        ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      ),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByText(
+        ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      ),
+    ).not.toBeInTheDocument();
+  });
+
+  it("uses the shared subscription error copy when removing is blocked", async () => {
+    const user = userEvent.setup();
+    removeScheduleMock.mockResolvedValue({
+      error: ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED,
+    });
+    renderLoaded();
+
+    await user.click(
+      screen.getByRole("button", { name: /remove scan schedule/i }),
+    );
+    const confirmDialog = screen.getByRole("dialog", {
+      name: "Are you absolutely sure?",
+    });
+    await user.click(
+      within(confirmDialog).getByRole("button", { name: "Remove" }),
+    );
+
+    expect(
+      await screen.findByText(
+        ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      ),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByText(
+        ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      ),
+    ).not.toBeInTheDocument();
+  });
+
   it("shows one logo per selected provider type in bulk mode", () => {
     render(
       <EditScanScheduleModal
diff --git a/ui/components/scans/schedule/edit-scan-schedule-modal.tsx b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
index 5d3690db66..73fd781411 100644
--- a/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
+++ b/ui/components/scans/schedule/edit-scan-schedule-modal.tsx
@@ -20,6 +20,7 @@ import { Modal } from "@/components/shadcn/modal";
 import { EntityInfo } from "@/components/ui/entities";
 import { FormButtons } from "@/components/ui/form";
 import { toast } from "@/components/ui/toast";
+import { getActionErrorMessage, hasActionError } from "@/lib/action-errors";
 import { runWithConcurrencyLimit } from "@/lib/concurrency";
 import {
   buildScheduleUpdatePayload,
@@ -129,8 +130,8 @@ function EditScanScheduleForm({
       ? await updateSchedulesBulk(targetProviderIds, payload)
       : await updateSchedule(targetProviderIds[0], payload);
 
-    if (result?.error) {
-      form.setError("root", { message: String(result.error) });
+    if (hasActionError(result)) {
+      form.setError("root", { message: getActionErrorMessage(result) });
       return;
     }
 
@@ -155,9 +156,9 @@ function EditScanScheduleForm({
     setIsRemoving(false);
     setIsConfirmRemoveOpen(false);
 
-    const failedResult = results.find((result) => result?.error);
-    if (failedResult?.error) {
-      form.setError("root", { message: String(failedResult.error) });
+    const failedResult = results.find(hasActionError);
+    if (failedResult) {
+      form.setError("root", { message: getActionErrorMessage(failedResult) });
       return;
     }
 
diff --git a/ui/components/scans/schedule/save-schedule.test.ts b/ui/components/scans/schedule/save-schedule.test.ts
index cf56f1fb18..5db4ce2491 100644
--- a/ui/components/scans/schedule/save-schedule.test.ts
+++ b/ui/components/scans/schedule/save-schedule.test.ts
@@ -1,5 +1,10 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+import {
+  ACTION_ERROR_API_MESSAGES,
+  ACTION_ERROR_MESSAGES,
+  ACTION_ERROR_STATUS,
+} from "@/lib/action-errors";
 import { SCHEDULE_FREQUENCY, type ScheduleFormValues } from "@/types/schedules";
 
 const { scanOnDemandMock, scheduleDailyMock, updateScheduleMock } = vi.hoisted(
@@ -88,6 +93,24 @@ describe("saveScheduleWithInitialScan", () => {
     expect(scanOnDemandMock).not.toHaveBeenCalled();
   });
 
+  it("maps subscription errors when the schedule save is blocked", async () => {
+    updateScheduleMock.mockResolvedValue({
+      error: ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED,
+    });
+
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values,
+    });
+
+    expect(result).toEqual({
+      status: SAVE_SCHEDULE_STATUS.ERROR,
+      message: ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+    });
+    expect(scanOnDemandMock).not.toHaveBeenCalled();
+  });
+
   it("launches the initial scan when requested", async () => {
     const result = await saveScheduleWithInitialScan({
       providerId: "p1",
@@ -112,4 +135,21 @@ describe("saveScheduleWithInitialScan", () => {
       message: "limit reached",
     });
   });
+
+  it("maps subscription errors when the initial scan is blocked", async () => {
+    scanOnDemandMock.mockResolvedValue({
+      error: ACTION_ERROR_API_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+      status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED,
+    });
+
+    const result = await saveScheduleWithInitialScan({
+      providerId: "p1",
+      values: { ...values, launchInitialScan: true },
+    });
+
+    expect(result).toEqual({
+      status: SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED,
+      message: ACTION_ERROR_MESSAGES[ACTION_ERROR_STATUS.PAYMENT_REQUIRED],
+    });
+  });
 });
diff --git a/ui/components/scans/schedule/save-schedule.ts b/ui/components/scans/schedule/save-schedule.ts
index 7e3cfabb45..fce391bcf9 100644
--- a/ui/components/scans/schedule/save-schedule.ts
+++ b/ui/components/scans/schedule/save-schedule.ts
@@ -1,5 +1,7 @@
 import { scanOnDemand, scheduleDaily } from "@/actions/scans";
 import { updateSchedule } from "@/actions/schedules";
+import type { ActionErrorResult } from "@/lib/action-errors";
+import { getActionErrorMessage, hasActionError } from "@/lib/action-errors";
 import { buildScheduleUpdatePayload } from "@/lib/schedules";
 import type { ScheduleFormValues } from "@/types/schedules";
 
@@ -31,7 +33,7 @@ export async function saveScheduleWithInitialScan({
   values,
   useLegacyDaily = false,
 }: SaveScheduleParams): Promise<SaveScheduleResult> {
-  let scheduleResult: { error?: unknown } | null;
+  let scheduleResult: ActionErrorResult | null;
 
   if (useLegacyDaily) {
     const formData = new FormData();
@@ -44,10 +46,10 @@ export async function saveScheduleWithInitialScan({
     );
   }
 
-  if (scheduleResult?.error) {
+  if (hasActionError(scheduleResult)) {
     return {
       status: SAVE_SCHEDULE_STATUS.ERROR,
-      message: String(scheduleResult.error),
+      message: getActionErrorMessage(scheduleResult),
     };
   }
 
@@ -59,10 +61,10 @@ export async function saveScheduleWithInitialScan({
   formData.set("providerId", providerId);
   const scanResult = await scanOnDemand(formData);
 
-  if (scanResult?.error) {
+  if (hasActionError(scanResult)) {
     return {
       status: SAVE_SCHEDULE_STATUS.SAVED_SCAN_FAILED,
-      message: String(scanResult.error),
+      message: getActionErrorMessage(scanResult),
     };
   }
 
diff --git a/ui/lib/action-errors.test.ts b/ui/lib/action-errors.test.ts
index 5731d90a4c..b770f6b7af 100644
--- a/ui/lib/action-errors.test.ts
+++ b/ui/lib/action-errors.test.ts
@@ -4,6 +4,7 @@ import {
   ACTION_ERROR_MESSAGES,
   ACTION_ERROR_STATUS,
   getActionErrorMessage,
+  hasActionError,
 } from "./action-errors";
 
 describe("getActionErrorMessage", () => {
@@ -69,4 +70,37 @@ describe("getActionErrorMessage", () => {
     // Then
     expect(message).toBe(result.error);
   });
+
+  it("should identify action errors by error payload", () => {
+    // Given
+    const result = { error: "Payment required." };
+
+    // When
+    const hasError = hasActionError(result);
+
+    // Then
+    expect(hasError).toBe(true);
+  });
+
+  it("should identify action errors by HTTP error status", () => {
+    // Given
+    const result = { status: ACTION_ERROR_STATUS.PAYMENT_REQUIRED };
+
+    // When
+    const hasError = hasActionError(result);
+
+    // Then
+    expect(hasError).toBe(true);
+  });
+
+  it("should ignore successful status-only action results", () => {
+    // Given
+    const result = { status: 204 };
+
+    // When
+    const hasError = hasActionError(result);
+
+    // Then
+    expect(hasError).toBe(false);
+  });
 });
diff --git a/ui/lib/action-errors.ts b/ui/lib/action-errors.ts
index 74ae4803fa..46fc3ae4b8 100644
--- a/ui/lib/action-errors.ts
+++ b/ui/lib/action-errors.ts
@@ -13,8 +13,13 @@ export const ACTION_ERROR_MESSAGES = {
     "You don't have permission to perform this action. Ask an administrator to update your role.",
 } as const satisfies Record<ActionErrorStatus, string>;
 
-interface ActionErrorResult {
-  error?: string;
+export const ACTION_ERROR_API_MESSAGES = {
+  [ACTION_ERROR_STATUS.PAYMENT_REQUIRED]:
+    "An active subscription is required to use this API endpoint in Prowler Cloud.",
+} as const satisfies Partial<Record<ActionErrorStatus, string>>;
+
+export interface ActionErrorResult {
+  error?: unknown;
   status?: number;
 }
 
@@ -29,6 +34,17 @@ const isActionErrorStatus = (
   status === ACTION_ERROR_STATUS.PAYMENT_REQUIRED ||
   status === ACTION_ERROR_STATUS.FORBIDDEN;
 
+const isHttpErrorStatus = (status: number | undefined): boolean =>
+  typeof status === "number" && status >= 400;
+
+export const hasActionError = (
+  result: ActionErrorResult | null | undefined,
+): result is ActionErrorResult =>
+  result !== undefined &&
+  result !== null &&
+  ((result.error !== undefined && result.error !== null) ||
+    isHttpErrorStatus(result.status));
+
 export const getActionErrorMessage = (
   result: ActionErrorResult,
   options: GetActionErrorMessageOptions = {},
@@ -39,5 +55,9 @@ export const getActionErrorMessage = (
     );
   }
 
-  return result.error ?? options.fallback ?? "Oops! Something went wrong.";
+  if (result.error !== undefined && result.error !== null) {
+    return String(result.error);
+  }
+
+  return options.fallback ?? "Oops! Something went wrong.";
 };