chore(docker): update docker

fix(ui): bump Next.js to 16.3.6 to patch the next/og RCE advisory (#12922 )
feat(ui): invite a teammate from the AWS connect step (#12917 )
2026-10-04 02:04:06 +00:00 · 2026-10-03 23:18:07 +00:00 · 2026-10-01 11:54:44 +02:00 · 2026-10-01 09:50:10 +02:00 · 2026-09-30 13:00:50 +02:00 · 2026-09-30 12:34:52 +02:00
715 changed files with 51135 additions and 5721 deletions
@@ -110,11 +110,27 @@ DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY=""
 DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN=""

 # The AWS region where your S3 bucket is located (e.g., "us-east-1")
+# Required if the bucket uses SSE-KMS: download URLs are then signed with SigV4, which
+# is scoped to this region, so it must match the bucket's
 DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION=""

 # The name of the S3 bucket where scan output should be stored
 DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET=""

+# The storage endpoint the API and Celery workers use to upload and list scan output
+# (e.g. "http://minio:9000"). Leave empty on AWS S3. Set it when scan output is stored on
+# S3-compatible object storage such as MinIO instead of real S3.
+# If set without DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL below, report download URLs are
+# signed against this internal host, and a browser outside the container network cannot open them.
+DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL=""
+
+# The storage address the browser can reach, used only to sign report download URLs
+# (e.g. "https://storage.example.com"). Leave empty on AWS S3. Set it when storage is
+# only reachable inside the container network, such as MinIO on "http://minio:9000".
+# The reverse proxy in front of it must forward the Host header unchanged: SigV4 signs
+# Host, so rewriting it to the internal name invalidates the signature.
+DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL=""
+
 # Django settings
 DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1,prowler-api
 DJANGO_BIND_ADDRESS=0.0.0.0
@@ -158,7 +174,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=

 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.41.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.45.0

 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
@@ -1,23 +1,23 @@
 # SDK
-/* @prowler-cloud/detection-remediation
-/prowler/ @prowler-cloud/detection-remediation
-/tests/ @prowler-cloud/detection-remediation
-/dashboard/ @prowler-cloud/detection-remediation
-/docs/ @prowler-cloud/detection-remediation
-/examples/ @prowler-cloud/detection-remediation
-/util/ @prowler-cloud/detection-remediation
-/contrib/ @prowler-cloud/detection-remediation
-/permissions/ @prowler-cloud/detection-remediation
-/codecov.yml @prowler-cloud/detection-remediation @prowler-cloud/api
+/* @prowler-cloud/engineering
+/prowler/ @prowler-cloud/engineering
+/tests/ @prowler-cloud/engineering
+/dashboard/ @prowler-cloud/engineering
+/docs/ @prowler-cloud/engineering
+/examples/ @prowler-cloud/engineering
+/util/ @prowler-cloud/engineering
+/contrib/ @prowler-cloud/engineering
+/permissions/ @prowler-cloud/engineering
+/codecov.yml @prowler-cloud/engineering

 # API
-/api/ @prowler-cloud/api
+/api/ @prowler-cloud/engineering

 # UI
-/ui/ @prowler-cloud/ui
+/ui/ @prowler-cloud/engineering

 # AI
-/mcp_server/ @prowler-cloud/detection-remediation
+/mcp_server/ @prowler-cloud/engineering

 # Platform
 /.github/ @prowler-cloud/platform
@@ -46,6 +46,17 @@ runs:
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: |
+        if grep -q "prowler-cloud/prowler" uv.lock; then
+          :
+        else
+          status=$?
+          if [ "$status" -ne 1 ]; then
+            echo "::error::grep failed reading uv.lock (exit code $status)."
+            exit "$status"
+          fi
+          echo "No prowler-cloud/prowler entry in uv.lock, nothing to update."
+          exit 0
+        fi
        LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
          -H "Accept: application/vnd.github+json" \
@@ -66,6 +77,17 @@ runs:
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: |
+        if grep -q "prowler-cloud/prowler" uv.lock; then
+          :
+        else
+          status=$?
+          if [ "$status" -ne 1 ]; then
+            echo "::error::grep failed reading uv.lock (exit code $status)."
+            exit "$status"
+          fi
+          echo "No prowler-cloud/prowler entry in uv.lock, nothing to update."
+          exit 0
+        fi
        LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
          -H "Accept: application/vnd.github+json" \
@@ -451,6 +451,17 @@ modules:
    e2e:
      - ui/tests/home/**

+  - name: ui-registry
+    match:
+      - ui/actions/registry/**
+      - ui/app/**/registry/**
+      - ui/components/registry/**
+      - ui/lib/registry/**
+      - ui/tests/registry/**
+    tests: []
+    e2e:
+      - ui/tests/registry/**
+
  - name: ui-shadcn
    match:
      - ui/components/shadcn/**
@@ -39,7 +39,7 @@ jobs:

      - name: Check labels
        id: label_check
-        uses: agilepathway/label-checker@c3d16ad512e7cea5961df85ff2486bb774caf3c5 # v1.6.65
+        uses: agilepathway/label-checker@c324842522fbd012e4f590afe3b4e591301322ed # v1.6.66
        with:
          allow_failure: true
          prefix_mode: true
@@ -44,7 +44,10 @@ jobs:
          cache: 'pip'

      - name: Install dependencies
-        run: pip install boto3
+        # Pinned to the versions in pyproject.toml: the ISO partitions region
+        # data comes from the endpoints.json bundled with botocore, so the
+        # botocore version is itself a data source and must be deterministic
+        run: pip install boto3==1.40.61 botocore==1.40.61

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
@@ -76,7 +76,7 @@ jobs:

            ### Changes

-            This PR updates the `OCI_COMMERCIAL_REGIONS` dictionary in `prowler/providers/oraclecloud/config.py` with the latest regions fetched from the OCI Identity API (`list_regions()`).
+            This PR updates the `OCI_COMMERCIAL_REGIONS` dictionary in `prowler/providers/oraclecloud/config.py` and the matching list in `ui/lib/provider-credentials/oci-regions.ts` with the latest regions fetched from the OCI Identity API (`list_regions()`).

            - Government regions (`OCI_GOVERNMENT_REGIONS`) are preserved unchanged
            - DOD regions (`OCI_US_DOD_REGIONS`) are preserved unchanged
@@ -10,12 +10,13 @@ on:
      - master
      - "v5.*"
    paths:
-      - '.github/workflows/ui-e2e-tests-v2.yml'
-      - '.github/test-impact.yml'
-      - 'ui/**'
-      - 'api/**'  # API changes can affect UI E2E
-      - '!ui/CHANGELOG.md'
-      - '!api/CHANGELOG.md'
+      - ".github/workflows/ui-e2e-tests-v2.yml"
+      - ".github/workflows/test-impact-analysis.yml"
+      - ".github/test-impact.yml"
+      - "ui/**"
+      - "api/**" # API changes can affect UI E2E
+      - "!ui/CHANGELOG.md"
+      - "!api/CHANGELOG.md"

 concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -40,11 +41,11 @@ jobs:
      (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
    runs-on: ubuntu-latest
    env:
-      AUTH_SECRET: 'fallback-ci-secret-for-testing'
+      AUTH_SECRET: "fallback-ci-secret-for-testing"
      AUTH_TRUST_HOST: true
-      NEXTAUTH_URL: 'http://localhost:3000'
-      AUTH_URL: 'http://localhost:3000'
-      UI_API_BASE_URL: 'http://localhost:8080/api/v1'
+      NEXTAUTH_URL: "http://localhost:3000"
+      AUTH_URL: "http://localhost:3000"
+      UI_API_BASE_URL: "http://localhost:8080/api/v1"
      E2E_ADMIN_USER: ${{ secrets.E2E_ADMIN_USER }}
      E2E_ADMIN_PASSWORD: ${{ secrets.E2E_ADMIN_PASSWORD }}
      E2E_AWS_PROVIDER_ACCOUNT_ID: ${{ secrets.E2E_AWS_PROVIDER_ACCOUNT_ID }}
@@ -60,7 +61,7 @@ jobs:
      E2E_M365_SECRET_ID: ${{ secrets.E2E_M365_SECRET_ID }}
      E2E_M365_TENANT_ID: ${{ secrets.E2E_M365_TENANT_ID }}
      E2E_M365_CERTIFICATE_CONTENT: ${{ secrets.E2E_M365_CERTIFICATE_CONTENT }}
-      E2E_KUBERNETES_CONTEXT: 'kind-kind'
+      E2E_KUBERNETES_CONTEXT: "kind-kind"
      E2E_KUBERNETES_KUBECONFIG_PATH: /home/runner/.kube/config
      E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY: ${{ secrets.E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY }}
      E2E_GCP_PROJECT_ID: ${{ secrets.E2E_GCP_PROJECT_ID }}
@@ -237,8 +238,8 @@ jobs:

      - name: Add AWS credentials for testing
        run: |
-          echo "AWS_ACCESS_KEY_ID=${{ secrets.E2E_AWS_PROVIDER_ACCESS_KEY }}" >> .env
-          echo "AWS_SECRET_ACCESS_KEY=${{ secrets.E2E_AWS_PROVIDER_SECRET_KEY }}" >> .env
+          echo "AWS_ACCESS_KEY_ID=${E2E_AWS_PROVIDER_ACCESS_KEY}" >> .env
+          echo "AWS_SECRET_ACCESS_KEY=${E2E_AWS_PROVIDER_SECRET_KEY}" >> .env

      - name: Build API image from current code
        # docker-compose.yml references prowlercloud/prowler-api:latest from the registry,
@@ -292,7 +293,7 @@ jobs:
      - name: Setup Node.js
        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
        with:
-          node-version-file: 'ui/.nvmrc'
+          node-version-file: "ui/.nvmrc"

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -337,60 +338,59 @@ jobs:
        if: steps.playwright-cache.outputs.cache-hit != 'true'
        run: pnpm run test:e2e:install

-      - name: Run E2E tests
+      - name: Run standard E2E tests
+        id: standard-e2e
        working-directory: ./ui
        run: |
          if [[ "${RUN_ALL_TESTS}" == "true" ]]; then
-            echo "Running ALL E2E tests..."
+            echo "Running all standard E2E tests..."
            pnpm run test:e2e
          else
-            echo "Running targeted E2E tests: ${E2E_TEST_PATHS}"
-            # Convert glob patterns to playwright test paths
-            # e.g., "ui/tests/providers/**" -> "tests/providers"
+            echo "Running targeted standard E2E tests: ${E2E_TEST_PATHS}"
            TEST_PATHS="${E2E_TEST_PATHS}"
-            # Remove ui/ prefix and convert ** to empty (playwright handles recursion)
            TEST_PATHS=$(echo "$TEST_PATHS" | sed 's|ui/||g' | sed 's|\*\*||g' | tr ' ' '\n' | sort -u)
-            # Drop auth setup helpers (not runnable test suites)
-            TEST_PATHS=$(echo "$TEST_PATHS" | grep -v '^tests/setups/')
-            # Safety net: if bare "tests/" appears (from broad patterns like ui/tests/**),
-            # expand to specific subdirs to avoid Playwright discovering setup files
+            TEST_PATHS=$(echo "$TEST_PATHS" | grep -vE '^tests/(setups|registry)/' || true)
+
            if echo "$TEST_PATHS" | grep -qx 'tests/'; then
-              echo "Expanding bare 'tests/' to specific subdirs (excluding setups)..."
              SPECIFIC_DIRS=""
              for dir in tests/*/; do
-                [[ "$dir" == "tests/setups/" ]] && continue
+                [[ "$dir" == "tests/setups/" || "$dir" == "tests/registry/" ]] && continue
                SPECIFIC_DIRS="${SPECIFIC_DIRS}${dir}"$'\n'
              done
-              # Replace "tests/" with specific dirs, keep other paths
-              TEST_PATHS=$(echo "$TEST_PATHS" | grep -vx 'tests/')
+              TEST_PATHS=$(echo "$TEST_PATHS" | grep -vx 'tests/' || true)
              TEST_PATHS="${TEST_PATHS}"$'\n'"${SPECIFIC_DIRS}"
              TEST_PATHS=$(echo "$TEST_PATHS" | grep -v '^$' | sort -u)
            fi
-            if [[ -z "$TEST_PATHS" ]]; then
-              echo "No runnable E2E test paths after filtering setups"
-              exit 0
-            fi
-            # Filter out directories that don't contain any test files
+
            VALID_PATHS=""
-            while IFS= read -r p; do
-              [[ -z "$p" ]] && continue
-              if find "$p" -name '*.spec.ts' -o -name '*.test.ts' 2>/dev/null | head -1 | grep -q .; then
-                VALID_PATHS="${VALID_PATHS}${p}"$'\n'
+            while IFS= read -r path; do
+              [[ -z "$path" ]] && continue
+              if find "$path" -name '*.spec.ts' -o -name '*.test.ts' 2>/dev/null | head -1 | grep -q .; then
+                VALID_PATHS="${VALID_PATHS}${path}"$'\n'
              else
-                echo "Skipping empty test directory: $p"
+                echo "Skipping empty test directory: $path"
              fi
            done <<< "$TEST_PATHS"
            VALID_PATHS=$(echo "$VALID_PATHS" | grep -v '^$' || true)
-            if [[ -z "$VALID_PATHS" ]]; then
-              echo "No test files found in any resolved paths — skipping E2E"
-              exit 0
+
+            if [[ -n "$VALID_PATHS" ]]; then
+              TEST_PATHS=$(echo "$VALID_PATHS" | tr '\n' ' ')
+              echo "Resolved standard test paths: $TEST_PATHS"
+              read -ra test_paths <<< "$TEST_PATHS"
+              pnpm exec playwright test "${test_paths[@]}"
+            else
+              echo "No standard E2E test paths selected."
            fi
-            TEST_PATHS=$(echo "$VALID_PATHS" | tr '\n' ' ')
-            echo "Resolved test paths: $TEST_PATHS"
-            read -ra test_paths <<< "$TEST_PATHS"
-            pnpm exec playwright test "${test_paths[@]}"
          fi

+      - name: Run Registry fixture E2E tests
+        if: |
+          !cancelled() &&
+          (steps.standard-e2e.outcome == 'success' || steps.standard-e2e.outcome == 'failure') &&
+          (env.RUN_ALL_TESTS == 'true' || contains(format(' {0} ', env.E2E_TEST_PATHS), ' ui/tests/registry/'))
+        working-directory: ./ui
+        run: pnpm run test:e2e:registry
+
      - name: Upload test reports
        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
        if: failure()
@@ -17,6 +17,40 @@ ignore:
  - vulnerability: CVE-2026-71556
    package:
      name: github.com/go-git/go-git/v5
+  # CVE-2026-84304 is the same temporary exception documented in .trivyignore.yaml:
+  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.83.1 fix is not in any release.
+  # Prowler only runs `trivy image` / `trivy fs`, never client/server mode, so no gRPC
+  # endpoint exists in the image. Pinned to the embedded version so the rule stops
+  # matching on its own once Trivy bumps grpc. Remove with the Trivy exception by 2026-10-15.
+  # https://github.com/aquasecurity/trivy/pull/11176
+  - vulnerability: CVE-2026-84304
+    package:
+      name: google.golang.org/grpc
+      version: v1.82.1
+  # CVE-2026-84445 is the same temporary exception documented in .trivyignore.yaml:
+  # Trivy 0.74.0 still embeds grpc 1.82.1, while the 1.82.2 / 1.83.2 fix is not in any
+  # release. The panic needs a gRPC server built with `xds.NewGRPCServer()`; Prowler only
+  # runs `trivy image` / `trivy fs`, so the image serves no gRPC at all. Pinned to the
+  # embedded version so the rule stops matching on its own once Trivy bumps grpc. Remove
+  # with the Trivy exception by 2026-10-15.
+  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
+  - vulnerability: CVE-2026-84445
+    package:
+      name: google.golang.org/grpc
+      version: v1.82.1
+  # CVE-2026-56855 / CVE-2026-78662 are the same temporary exception documented in
+  # .trivyignore.yaml: Trivy 0.74.0 still embeds golang.org/x/crypto v0.55.0, while the
+  # 0.56.0 fix (published 2026-09-02) hasn't reached any Trivy release, or even Trivy
+  # main, yet. Pinned to the embedded version so the rule stops matching on its own once
+  # Trivy bumps it. Remove with the Trivy exception by 2026-10-15.
+  - vulnerability: CVE-2026-56855
+    package:
+      name: golang.org/x/crypto
+      version: v0.55.0
+  - vulnerability: CVE-2026-78662
+    package:
+      name: golang.org/x/crypto
+      version: v0.55.0
  - vulnerability: CVE-2026-56852
    package:
      name: golang.org/x/text
@@ -81,3 +115,14 @@ ignore:
  - vulnerability: CVE-2026-9669
    package:
      name: python
+  # CVE-2026-82049 (tarfile data/tar filter bypass via a hard link to a symlink) has no
+  # fixed CPython release on any branch: the fix is merged on main and 3.13 only, and the
+  # 3.12 backport is still open. Grype records 3.14.0b1 as the fix, so only-fixed does not
+  # drop it, yet python:3.12.14-slim-trixie reports it too. Prowler never extracts tar
+  # archives to disk: the ECR image inspection reads members in memory with extractfile().
+  # Remove once the base image ships a 3.12 release that includes the backport.
+  # https://github.com/python/cpython/issues/157190
+  # https://github.com/python/cpython/pull/157454
+  - vulnerability: CVE-2026-82049
+    package:
+      name: python
@@ -68,7 +68,7 @@ vulnerabilities:
    expired_at: 2026-11-30

  # Declared in the SPDX manifest that ships inside PowerShell's MicrosoftTeams module
-  # (Modules/MicrosoftTeams/7.9.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
+  # (Modules/MicrosoftTeams/8.0.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
  # SBOM and reports what it declares, which is not the same as what the image contains:
  # there is no Node runtime and no node_modules anywhere in the image, and the .NET
  # assemblies target net472, a Windows-only framework. Nothing here is reachable, and none
@@ -113,40 +113,86 @@ vulnerabilities:
    purls:
      - "pkg:npm/fast-uri"
    expired_at: 2027-01-31
+  - id: CVE-2026-75899
+    purls:
+      - "pkg:npm/fast-uri"
+    expired_at: 2027-01-31
+  - id: CVE-2026-75975
+    purls:
+      - "pkg:npm/fast-uri"
+    expired_at: 2027-01-31
+  - id: CVE-2026-76172
+    purls:
+      - "pkg:npm/fast-uri"
+    expired_at: 2027-01-31
+  - id: CVE-2026-75931
+    purls:
+      - "pkg:npm/fast-uri"
+    expired_at: 2027-01-31
+  - id: CVE-2026-84292
+    purls:
+      - "pkg:npm/fast-uri"
+    expired_at: 2027-01-31
  - id: CVE-2026-69192
    purls:
      - "pkg:npm/ip-address"
    expired_at: 2027-01-31

-  # CVE-2026-62901 is a DoS in System.Net.WebSockets (unchecked input for loop condition,
-  # CWE-606), fixed in .NET 9.0.19 / 10.0.11 (published 2026-08-11). The vulnerable runtime
-  # ships inside the PowerShell tarball the Dockerfile pins: 7.5.9 is the latest 7.5.x and
-  # bundles .NET 9.0.18; 7.6.4 bundles .NET 10.0.x < 10.0.11, so no published PowerShell
-  # release contains the fix yet. Prowler only invokes pwsh locally to run M365 module
-  # cmdlets; the image does not accept inbound WebSocket connections, so the DoS path is
-  # not reachable from the network. Remove this temporary suppression as soon as a
-  # PowerShell release shipping .NET 9.0.19+ is available.
-  - id: CVE-2026-62901
+  # CVE-2026-84304 is a DoS in grpc-go <= 1.83.0: a peer fragments a gRPC stream into
+  # millions of tiny HTTP/2 DATA frames until the receiver runs out of heap. Fixed in
+  # 1.83.1 (published 2026-09-01). Trivy 0.74.0, the latest published release and the
+  # version the images ship, pins 1.82.1 as an indirect dependency:
+  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
+  # Upstream bump still open: https://github.com/aquasecurity/trivy/pull/11176
+  # Trivy only speaks gRPC in client/server mode (`trivy server`, `--server`). Prowler
+  # invokes it exclusively as `trivy image` and `trivy fs` on a local path, so no gRPC
+  # listener or connection ever exists in the image and the affected path is not
+  # reachable. Remove this temporary suppression as soon as a Trivy release pins
+  # grpc >= 1.83.1.
+  - id: CVE-2026-84304
    purls:
-      - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64"
-      - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64"
-    expired_at: 2026-09-15
+      - "pkg:golang/google.golang.org/grpc"
+    expired_at: 2026-10-15

-  # Modules compiled into the Trivy binary the images ship. The binary is pinned by version
-  # and verified by checksum in the Dockerfile; only a rebuild by its vendor moves these.
-  # CVE-2026-71556 affects go-git worktree operations that can follow symlinks outside a
-  # cloned repository. Trivy 0.73.0, the latest published release and the version the
-  # images ship, still pins that vulnerable version:
-  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
-  # Trivy main already contains the 5.19.2 fix, but no published release includes it yet:
-  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
-  # Prowler invokes Trivy only with `fs` on an existing local path or with `image`; it does
-  # not ask Trivy to clone or mutate a Git worktree, so the affected path is not reachable.
-  # Remove this temporary suppression as soon as a fixed Trivy release is available.
-  - id: CVE-2026-71556
+  # CVE-2026-84445 is a DoS in grpc-go servers built with `xds.NewGRPCServer()`: a request
+  # carrying neither `:authority` nor `Host` reaches the xDS routing interceptor, which
+  # indexes an empty slice of authorities and panics. The per-RPC goroutine does not
+  # recover, so the whole server process dies. Fixed in 1.82.2 and 1.83.2 (published
+  # 2026-09-08). Trivy 0.74.0, the latest published release and the version the images
+  # ship, pins 1.82.1 as an indirect dependency:
+  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
+  # Trivy main already carries 1.83.2, but no published release includes it yet.
+  # The reachability argument is the one made for CVE-2026-84304 above, only narrower:
+  # this panic needs an xDS-managed gRPC server. Prowler invokes Trivy exclusively as
+  # `trivy image` and `trivy fs` on a local path, never `trivy server`, so the image runs
+  # no gRPC server at all, xDS or otherwise. Remove this temporary suppression as soon as
+  # a Trivy release pins grpc >= 1.83.2.
+  # https://github.com/advisories/GHSA-2v4p-qf9q-27wj
+  - id: CVE-2026-84445
    purls:
-      - "pkg:golang/github.com/go-git/go-git/v5"
-    expired_at: 2026-09-15
+      - "pkg:golang/google.golang.org/grpc@v1.82.1"
+    expired_at: 2026-10-15
+
+  # CVE-2026-56855 and CVE-2026-78662 are DoS deadlocks in x/crypto/ssh: a malicious peer
+  # can flood or misuse channel messages (RFC 4254) to block the whole connection.
+  # Fixed in golang.org/x/crypto v0.56.0 (published 2026-09-02). Trivy 0.74.0, the latest
+  # published release and the version the images ship, still pins v0.55.0, and Trivy main
+  # has not bumped it either:
+  # https://github.com/aquasecurity/trivy/blob/v0.74.0/go.mod
+  # x/crypto/ssh is pulled in transitively through go-git's ssh transport, the same
+  # dependency chain as the CVE-2026-71556 entry above. Prowler invokes Trivy only with
+  # `fs` on an existing local path or with `image`; it never asks Trivy to clone over SSH
+  # or to run `trivy server`, so no SSH connection -- as client or server -- ever exists in
+  # the image and the affected code path is not reachable. Remove this temporary
+  # suppression as soon as a fixed Trivy release is available.
+  - id: CVE-2026-56855
+    purls:
+      - "pkg:golang/golang.org/x/crypto@v0.55.0"
+    expired_at: 2026-10-15
+  - id: CVE-2026-78662
+    purls:
+      - "pkg:golang/golang.org/x/crypto@v0.55.0"
+    expired_at: 2026-10-15

  - id: CVE-2026-56852
    purls:
@@ -1,9 +1,9 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.14.7-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d AS build

 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"

-ARG POWERSHELL_VERSION=7.5.9
+ARG POWERSHELL_VERSION=7.5.11
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1
@@ -17,25 +17,30 @@ ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
 ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
 ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0
-ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56
+ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
+ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
 ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d

-# High CVEs fixed in Debian trixie-security but not yet in the pinned base image:
+# High CVEs fixed in Debian trixie but not yet in the pinned base image:
 #   openssl/libssl3t64/openssl-provider-legacy 3.5.7-1~deb13u2  CVE-2026-14456,
 #   -14457, -18798, -54874, -63072, -63073, -63074, -63075, -63076, -75803
-#   (image ships 3.5.6-1~deb13u2)
+#   libsqlite3-0 3.46.1-7+deb13u2  CVE-2026-11822, -11824
+#   gzip 1.13-1+deb13u1  CVE-2026-41992
+#   perl-base 5.40.1-6+deb13u1  CVE-2026-42497, -48962, -57432
+#   libssh2-1t64 1.11.1-1+deb13u2  CVE-2026-58050
+#   libpcre2-8-0 10.46-1~deb13u2  CVE-2026-86145, -89161
 # Taken as a targeted --only-upgrade rather than by moving the digest: the newest
-# published python:3.12-slim-trixie carries the same vulnerable version. The three
-# packages are all built from openssl and are flagged separately, so all are named.
-# Drop them once the base image ships 3.5.7-1~deb13u2 or later.
+# published python:3.12-slim-trixie carries the same vulnerable versions. The three
+# openssl packages are flagged separately, so all are named.
+# Drop each one once the base image ships its fixed version.
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
    wget libicu76 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
    build-essential pkg-config libzstd-dev zlib1g-dev \
    && apt-get install -y --no-install-recommends --only-upgrade \
       util-linux libssl3t64 openssl openssl-provider-legacy \
+       libsqlite3-0 gzip perl-base libssh2-1t64 libpcre2-8-0 \
    && rm -rf /var/lib/apt/lists/*

 # Install PowerShell
@@ -126,12 +126,12 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically

 | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/user-guide/compliance/tutorials/compliance) | [Categories](https://docs.prowler.com/user-guide/cli/tutorials/misc#categories) | Support | Interface |
 |---|---|---|---|---|---|---|
-| AWS | 639 | 86 | 47 | 19 | Official | UI, API, CLI |
-| Azure | 191 | 22 | 21 | 16 | Official | UI, API, CLI |
-| GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |
-| Kubernetes | 92 | 7 | 8 | 11 | Official | UI, API, CLI |
+| AWS | 662 | 86 | 50 | 19 | Official | UI, API, CLI |
+| Azure | 191 | 22 | 25 | 16 | Official | UI, API, CLI |
+| GCP | 110 | 20 | 22 | 12 | Official | UI, API, CLI |
+| Kubernetes | 92 | 7 | 11 | 11 | Official | UI, API, CLI |
 | GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |
-| M365 | 143 | 10 | 6 | 10 | Official | UI, API, CLI |
+| M365 | 144 | 10 | 9 | 10 | Official | UI, API, CLI |
 | OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |
 | Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |
 | Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |
@@ -4,6 +4,57 @@ All notable changes to the **Prowler API** are documented in this file.

 <!-- changelog: release notes start -->

+## [1.45.0] (Prowler v5.44.0)
+
+### 🚀 Added
+
+- Scan output uploads and downloads can now target S3-compatible object storage such as MinIO directly via `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL`, instead of relying on process-wide AWS environment variables that also hijacked unrelated AWS API calls [(#12871)](https://github.com/prowler-cloud/prowler/pull/12871)
+
+### 🔄 Changed
+
+- Unify how every endpoint resolves a provider latest completed scan, so overlapping scans no longer make findings, compliance and mute rules read from different scans [(#12858)](https://github.com/prowler-cloud/prowler/pull/12858)
+
+### 🐞 Fixed
+
+- Celery loggers are now declared explicitly in `custom_logging.py` so fatal worker errors are no longer silenced by `disable_existing_loggers=True`. All long-running services in `docker-compose.yml` now have `restart: unless-stopped` so containers recover automatically after unexpected crashes. [(#12465)](https://github.com/prowler-cloud/prowler/pull/12465)
+- Scan report downloads from an S3 bucket with default SSE-KMS encryption no longer fail with an `InvalidArgument` error: when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is set, presigned download URLs are signed with AWS Signature Version 4 for that region [(#12746)](https://github.com/prowler-cloud/prowler/pull/12746)
+- Adds a periodic sweep that drops orphaned Attack Paths temp Neo4j scan databases left behind when a worker or Neo4j crashes mid-scan, before they accumulate unbounded [(#12832)](https://github.com/prowler-cloud/prowler/pull/12832)
+- Providers whose most recent completed scan has no `completed_at` timestamp are no longer missing from every endpoint that reports a provider's latest scan, which now falls back to scan creation order instead of skipping the provider [(#12858)](https://github.com/prowler-cloud/prowler/pull/12858)
+- Resources no longer keep a stale failed findings count forever when a scoped or imported scan for the same provider completes after a full scan, which used to make the full scan skip its own cleanup [(#12858)](https://github.com/prowler-cloud/prowler/pull/12858)
+- `POST /api/v1/scans` again returns the new scan id in the response `task_args`, which had been empty since the scan broker publish moved to transaction commit [(#12878)](https://github.com/prowler-cloud/prowler/pull/12878)
+- API key authentication no longer locks the key row on every request and now throttles `last_used_at` updates to once per 60 seconds, preventing a hot key from serializing all its requests onto a single locked row [(#12882)](https://github.com/prowler-cloud/prowler/pull/12882)
+- Provider deletion no longer fails when the provider has Attack Paths scans recorded on a sink that is no longer configured, such as Neptune after moving back to Neo4j [(#12894)](https://github.com/prowler-cloud/prowler/pull/12894)
+
+### 🔐 Security
+
+- `DELETE /api/v1/tasks/{id}` requires the permission of the operation that queued the task and rejects provider deletions, and `GET /api/v1/tasks` hides tasks of providers outside the visibility of the role [(#12893)](https://github.com/prowler-cloud/prowler/pull/12893)
+
+---
+
+## [1.44.0] (Prowler v5.43.0)
+
+### 🐞 Fixed
+
+- Report download URLs can be signed against a browser-reachable storage host via `DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL`, so downloads complete on deployments where storage is only reachable inside the container network [(#12552)](https://github.com/prowler-cloud/prowler/pull/12552)
+- A scan report download no longer fails with a server error when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is unset, which is common on storage with no meaningful region [(#12552)](https://github.com/prowler-cloud/prowler/pull/12552)
+- Lapsed pending invitations are reported as expired and no longer block a new invitation for the same email [(#12831)](https://github.com/prowler-cloud/prowler/pull/12831)
+
+### 🔐 Security
+
+- `libsqlite3-0`, `gzip`, `perl-base` and `libpcre2-8-0` upgraded in the API container image, patching high Debian CVEs [(#12804)](https://github.com/prowler-cloud/prowler/pull/12804)
+- PowerShell from 7.5.9 to 7.5.11 in the API container image, bundling .NET runtime 9.0.20 and patching CVE-2026-62901 [(#12811)](https://github.com/prowler-cloud/prowler/pull/12811)
+- Bumped `anyio` to 4.14.2 to resolve CVE-2026-63374 [(#12848)](https://github.com/prowler-cloud/prowler/pull/12848)
+
+---
+
+## [1.43.0] (Prowler v5.42.0)
+
+### 🔄 Changed
+
+- Speed up compliance overview ingestion by reading ThreatScore mappings from the compliance template instead of each finding, generating time-ordered `uuid7` row ids and grouping inserted rows by framework and requirement [(#12738)](https://github.com/prowler-cloud/prowler/pull/12738)
+
+---
+
 ## [1.42.0] (Prowler v5.41.0)

 ### 🚀 Added
@@ -1,8 +1,8 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.14.7-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d AS build

 LABEL maintainer="https://github.com/prowler-cloud/api"

-ARG POWERSHELL_VERSION=7.5.9
+ARG POWERSHELL_VERSION=7.5.11
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1
@@ -16,19 +16,23 @@ ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
 ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
 ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0
-ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56
+ARG POWERSHELL_SHA256_AMD64=82a8b13d92b0f3ae48e56cf2f3f7961679371736ca90145ca71617c2913ba9d8
+ARG POWERSHELL_SHA256_ARM64=830ebda118c731ece3fa7e6b7e8573a21346387cbbca5b2f5e3b9bfe24f96672
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
 ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d

-# High CVEs fixed in Debian trixie-security but not yet in the pinned base image:
+# High CVEs fixed in Debian trixie but not yet in the pinned base image:
 #   openssl/libssl3t64/openssl-provider-legacy 3.5.7-1~deb13u2  CVE-2026-14456,
 #   -14457, -18798, -54874, -63072, -63073, -63074, -63075, -63076, -75803
-#   (image ships 3.5.6-1~deb13u2)
+#   libsqlite3-0 3.46.1-7+deb13u2  CVE-2026-11822, -11824
+#   gzip 1.13-1+deb13u1  CVE-2026-41992
+#   perl-base 5.40.1-6+deb13u1  CVE-2026-42497, -48962, -57432
+#   libssh2-1t64 1.11.1-1+deb13u2  CVE-2026-58050
+#   libpcre2-8-0 10.46-1~deb13u2  CVE-2026-86145, -89161
 # Taken as a targeted --only-upgrade rather than by moving the digest: the newest
-# published python:3.12-slim-trixie carries the same vulnerable version. The three
-# packages are all built from openssl and are flagged separately, so all are named.
-# Drop them once the base image ships 3.5.7-1~deb13u2 or later.
+# published python:3.12-slim-trixie carries the same vulnerable versions. The three
+# openssl packages are flagged separately, so all are named.
+# Drop each one once the base image ships its fixed version.
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
    wget \
@@ -46,6 +50,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    python3-dev \
    && apt-get install -y --no-install-recommends --only-upgrade \
       util-linux libssl3t64 openssl openssl-provider-legacy \
+       libsqlite3-0 gzip perl-base libssh2-1t64 libpcre2-8-0 \
    && rm -rf /var/lib/apt/lists/*

 # Install PowerShell
@@ -0,0 +1 @@
+OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1
@@ -0,0 +1 @@
+`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9
@@ -0,0 +1 @@
+Sentry error events no longer include user identity, IP addresses, cookies, headers or request bodies, which could contain personal data or provider credentials
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.42.0"
+version = "1.46.0"

 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.
@@ -137,7 +137,7 @@ constraint-dependencies = [
  "aliyun-log-fastpb==0.2.0",
  "amqp==5.3.1",
  "annotated-types==0.7.0",
-  "anyio==4.12.1",
+  "anyio==4.14.2",
  "applicationinsights==0.11.10",
  "apscheduler==3.11.2",
  "argcomplete==3.5.3",
@@ -375,7 +375,7 @@ constraint-dependencies = [
  "pydantic-core==2.41.5",
  "pygithub==2.8.0",
  "pygments==2.20.0",
-  "pyjwt==2.13.0",
+  "pyjwt==2.14.0",
  "pylint==3.2.5",
  "pymsalruntime==0.18.1",
  "pynacl==1.6.2",
@@ -476,8 +476,8 @@ constraint-dependencies = [
 # to 1.9.10 until the SDK bump propagates to the pinned master rev.
 #
 # prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
-# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
-# patches PYSEC-2026-179 (HMAC/JWK key-confusion); a constraint cannot satisfy these
+# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.14.0
+# patches GHSA-ffc3-869f-jxw9 (HMAC/PEM key-confusion); a constraint cannot satisfy these
 # against the SDK's hard pins, so override them to the patched versions until the SDK
 # bump propagates to the pinned master rev. pyjwt keeps the [crypto] extra because an
 # override replaces the whole requirement; bare pyjwt would drop it from the consumers
@@ -500,5 +500,5 @@ override-dependencies = [
  "microsoft-kiota-serialization-multipart==1.9.10",
  "microsoft-kiota-serialization-text==1.9.10",
  "dulwich==1.2.5",
-  "pyjwt[crypto]==2.13.0"
+  "pyjwt[crypto]==2.14.0"
 ]
@@ -207,6 +207,11 @@ def drop_database(database: str) -> None:
    sink_module.get_backend().drop_database(database)


+def list_databases() -> list[str]:
+    """List database names on the ingest cluster. Temp scan DBs always live here."""
+    return ingest.list_databases()
+
+
 def drop_subgraph(database: str, provider_id: str) -> int:
    return sink_module.get_backend().drop_subgraph(database, provider_id)

@@ -13,6 +13,7 @@ from api.attack_paths.ingest.driver import (
    get_session,
    get_uri,
    init_driver,
+    list_databases,
    run_cypher,
 )

@@ -25,5 +26,6 @@ __all__ = [
    "get_session",
    "get_uri",
    "init_driver",
+    "list_databases",
    "run_cypher",
 ]
@@ -165,6 +165,14 @@ def drop_database(database: str) -> None:
        session.run(f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA")


+def list_databases() -> list[str]:
+    """List every database name on the Neo4j temp-database cluster."""
+    # A cluster returns one row per hosting server, so dedupe on name
+    with get_session() as session:
+        result = session.run("SHOW DATABASES YIELD name RETURN DISTINCT name")
+        return [record["name"] for record in result]
+
+
 def clear_cache(database: str) -> None:
    """Best-effort cache clear for a Neo4j database."""
    from api.attack_paths.database import GraphDatabaseQueryException
@@ -1,4 +1,5 @@
 import logging
+from datetime import timedelta
 from math import isfinite
 from uuid import UUID

@@ -6,7 +7,7 @@ from api.db_router import MainRouter
 from api.models import TenantAPIKey, TenantAPIKeyManager
 from cryptography.fernet import InvalidToken
 from django.core.exceptions import ObjectDoesNotExist
-from django.db import transaction
+from django.db.models import Q
 from django.utils import timezone
 from drf_simple_apikey.backends import APIKeyAuthentication as BaseAPIKeyAuth
 from drf_simple_apikey.crypto import get_crypto
@@ -18,12 +19,15 @@ from rest_framework_simplejwt.authentication import JWTAuthentication

 logger = logging.getLogger(__name__)

+# Writing on every request makes all requests of a busy key contend on one row
+API_KEY_LAST_USED_AT_THROTTLE_SECONDS = 60
+

 class OrphanedAPIKeyError(Exception):
    """Raised when an API key outlived the user that owns it.

-    Handled by `authenticate`, which commits the revocation written while detecting it
-    and then rejects the request with `AuthenticationFailed`.
+    The revocation is written by a plain `update()` before this is raised, so it is
+    already persisted by the time `authenticate` catches it and rejects the request.
    """


@@ -37,8 +41,9 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
        """
        Override to use admin connection, bypassing RLS during authentication.

-        Returns the validated API key row, locked with `select_for_update`, so callers
-        must run inside `transaction.atomic(using=MainRouter.admin_db)`.
+        Returns the validated API key row from a single read. `authenticate` builds
+        the auth claims from that same row instead of looking it up again, so a key
+        revoked or orphaned right after validation can't still authenticate.
        """
        try:
            payload = self.key_crypto.decrypt(key)
@@ -67,9 +72,11 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
            raise AuthenticationFailed("API Key has already expired.")

        try:
+            # Loading `entity` in the same query keeps a user deleted after this read
+            # from turning the later `api_key.entity` access into a 500
            api_key = (
                self.model.objects.using(MainRouter.admin_db)
-                .select_for_update()
+                .select_related("entity")
                .get(id=api_key_pk)
            )
        except ObjectDoesNotExist:
@@ -85,8 +92,9 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
        # Revoke it as well, so it stops showing up as active and later attempts fail
        # the `revoked` check above like any other revoked key.
        if api_key.entity_id is None:
-            api_key.revoked = True
-            api_key.save(update_fields=["revoked"], using=MainRouter.admin_db)
+            self.model.objects.using(MainRouter.admin_db).filter(
+                id=api_key.id, revoked=False
+            ).update(revoked=True)
            logger.warning(
                "Revoked orphaned API key: prefix=%s tenant=%s",
                api_key.prefix,
@@ -112,34 +120,38 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
        except ValueError:
            raise AuthenticationFailed("Invalid API Key.")

-        # Validation, the `last_used_at` update and the auth claims all read the same
-        # row, locked until the transaction ends. Looking the key up a second time to
-        # build the claims used to leave a window where a key revoked or orphaned right
-        # after passing validation still authenticated.
-        with transaction.atomic(using=MainRouter.admin_db):
-            try:
-                api_key = self._authenticate_credentials(request, key)
-            except OrphanedAPIKeyError:
-                # Rejected below instead of here: leaving the block normally commits
-                # the revocation `_authenticate_credentials` wrote, while raising from
-                # inside would roll it back.
-                pass
-            else:
-                # The prefix used to be checked by the second lookup
-                if api_key.prefix != prefix:
-                    raise AuthenticationFailed("Invalid API Key.")
+        try:
+            api_key = self._authenticate_credentials(request, key)
+        except OrphanedAPIKeyError:
+            raise AuthenticationFailed("No entity matching this api key.")

-                api_key.last_used_at = timezone.now()
-                api_key.save(update_fields=["last_used_at"], using=MainRouter.admin_db)
+        # The prefix used to be checked by the second lookup
+        if api_key.prefix != prefix:
+            raise AuthenticationFailed("Invalid API Key.")

-                entity = api_key.entity
-                return entity, {
-                    "tenant_id": str(api_key.tenant_id),
-                    "sub": str(entity.id),
-                    "api_key_prefix": api_key.prefix,
-                }
+        self._throttled_touch_last_used_at(api_key)

-        raise AuthenticationFailed("No entity matching this api key.")
+        entity = api_key.entity
+        return entity, {
+            "tenant_id": str(api_key.tenant_id),
+            "sub": str(entity.id),
+            "api_key_prefix": api_key.prefix,
+        }
+
+    @staticmethod
+    def _throttled_touch_last_used_at(api_key: TenantAPIKey) -> None:
+        """Write `last_used_at` at most once per throttle interval, without locking the row."""
+        now = timezone.now()
+        stale_before = now - timedelta(seconds=API_KEY_LAST_USED_AT_THROTTLE_SECONDS)
+
+        if api_key.last_used_at is not None and api_key.last_used_at >= stale_before:
+            return
+
+        TenantAPIKey.objects.using(MainRouter.admin_db).filter(
+            id=api_key.id, revoked=False
+        ).filter(
+            Q(last_used_at__isnull=True) | Q(last_used_at__lt=stale_before)
+        ).update(last_used_at=now)


 class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):
@@ -409,7 +409,7 @@ def batch_delete(tenant_id, queryset, batch_size=settings.DJANGO_DELETION_BATCH_

    Args:
        tenant_id (str): Tenant ID the queryset belongs to.
-        queryset (QuerySet): The queryset of objects to delete.
+        queryset: The queryset of objects to delete.
        batch_size (int): The number of objects to delete in each batch.

    Returns:
@@ -1439,8 +1439,20 @@ class InvitationFilter(FilterSet):
    inserted_at = DateFilter(field_name="inserted_at", lookup_expr="date")
    updated_at = DateFilter(field_name="updated_at", lookup_expr="date")
    expires_at = DateFilter(field_name="expires_at", lookup_expr="date")
-    state = ChoiceFilter(choices=Invitation.State.choices)
-    state__in = ChoiceInFilter(choices=Invitation.State.choices, lookup_expr="in")
+    state = ChoiceFilter(choices=Invitation.State.choices, method="filter_state")
+    state__in = ChoiceInFilter(
+        choices=Invitation.State.choices, lookup_expr="in", method="filter_state_in"
+    )
+
+    def filter_state(self, queryset, name, value):
+        return self.filter_state_in(queryset, name, [value])
+
+    def filter_state_in(self, queryset, name, value):
+        lapsed = Invitation.lapsed_q()
+        query = Q(state__in=value) & ~lapsed
+        if Invitation.State.EXPIRED in value:
+            query |= lapsed
+        return queryset.filter(query)

    class Meta:
        model = Invitation
@@ -0,0 +1,116 @@
+import uuid
+
+import api.rls
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("api", "0097_attack_paths_scan_db_defaults"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="TenantOnboardingProfile",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4,
+                        editable=False,
+                        primary_key=True,
+                        serialize=False,
+                    ),
+                ),
+                ("inserted_at", models.DateTimeField(auto_now_add=True)),
+                (
+                    "declared_cloud_accounts",
+                    models.CharField(
+                        blank=True,
+                        choices=[
+                            ("1", "1"),
+                            ("2-10", "2-10"),
+                            ("11-50", "11-50"),
+                            ("51-200", "51-200"),
+                            ("200+", "200+"),
+                        ],
+                        max_length=16,
+                        null=True,
+                    ),
+                ),
+                (
+                    "declared_role",
+                    models.CharField(
+                        blank=True,
+                        choices=[
+                            ("security", "Security"),
+                            ("devops_platform", "DevOps / Platform"),
+                            ("developer", "Developer"),
+                            ("compliance_grc", "Compliance / GRC"),
+                            ("other", "Other"),
+                        ],
+                        max_length=32,
+                        null=True,
+                    ),
+                ),
+                (
+                    "declared_seniority",
+                    models.CharField(
+                        blank=True,
+                        choices=[
+                            ("practitioner", "Practitioner / IC"),
+                            ("lead", "Team lead / Manager"),
+                            ("director", "Director / Head of"),
+                            ("executive", "VP / C-level"),
+                            ("founder", "Founder / Owner"),
+                        ],
+                        max_length=32,
+                        null=True,
+                    ),
+                ),
+                ("skipped", models.BooleanField(default=False)),
+                (
+                    "submitted_by",
+                    models.ForeignKey(
+                        blank=True,
+                        null=True,
+                        on_delete=django.db.models.deletion.SET_NULL,
+                        related_name="tenant_onboarding_profiles",
+                        related_query_name="tenant_onboarding_profile",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+                (
+                    "tenant",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE, to="api.tenant"
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "tenant_onboarding_profiles",
+                "abstract": False,
+            },
+        ),
+        migrations.AddConstraint(
+            model_name="tenantonboardingprofile",
+            constraint=models.UniqueConstraint(
+                fields=("tenant_id",), name="unique_tenant_onboarding_profile"
+            ),
+        ),
+        migrations.AddConstraint(
+            model_name="tenantonboardingprofile",
+            # `statements` written out explicitly: RowLevelSecurityConstraint
+            # .deconstruct() does not serialize it, so an autogenerated
+            # migration falls back to ["SELECT"] and leaves the table without
+            # INSERT/UPDATE/DELETE policies.
+            constraint=api.rls.RowLevelSecurityConstraint(
+                "tenant_id",
+                name="rls_on_tenantonboardingprofile",
+                statements=["SELECT", "INSERT", "UPDATE", "DELETE"],
+            ),
+        ),
+    ]
@@ -0,0 +1,15 @@
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    # The onboarding profile step was reverted after 0098 had been merged, so
+    # the table goes away through a new migration rather than by deleting 0098.
+    dependencies = [
+        ("api", "0098_tenant_onboarding_profile"),
+    ]
+
+    operations = [
+        migrations.DeleteModel(
+            name="TenantOnboardingProfile",
+        ),
+    ]
@@ -0,0 +1,48 @@
+from django.db import migrations
+
+TASK_NAME = "attack-paths-reap-orphaned-tmp-databases"
+INTERVAL_HOURS = 6
+
+
+def create_periodic_task(apps, schema_editor):
+    IntervalSchedule = apps.get_model("django_celery_beat", "IntervalSchedule")
+    PeriodicTask = apps.get_model("django_celery_beat", "PeriodicTask")
+
+    schedule, _ = IntervalSchedule.objects.get_or_create(
+        every=INTERVAL_HOURS,
+        period="hours",
+    )
+
+    PeriodicTask.objects.update_or_create(
+        name=TASK_NAME,
+        defaults={
+            "task": TASK_NAME,
+            "interval": schedule,
+            "enabled": True,
+        },
+    )
+
+
+def delete_periodic_task(apps, schema_editor):
+    IntervalSchedule = apps.get_model("django_celery_beat", "IntervalSchedule")
+    PeriodicTask = apps.get_model("django_celery_beat", "PeriodicTask")
+
+    PeriodicTask.objects.filter(name=TASK_NAME).delete()
+
+    # Clean up the schedule if no other task references it
+    IntervalSchedule.objects.filter(
+        every=INTERVAL_HOURS,
+        period="hours",
+        periodictask__isnull=True,
+    ).delete()
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("api", "0099_delete_tenant_onboarding_profile"),
+        ("django_celery_beat", "0019_alter_periodictasks_options"),
+    ]
+
+    operations = [
+        migrations.RunPython(create_periodic_task, delete_periodic_task),
+    ]
@@ -617,9 +617,66 @@ class Task(RowLevelSecurityProtectedModel):
        resource_name = "tasks"


+class ScanQuerySet(models.QuerySet):
+    """Shared selectors for "the latest scan of a provider".
+
+    The queryset must already be scoped by the caller: manager, tenant, RBAC,
+    providers and database alias.
+    """
+
+    # How "which completed scan is the provider's current one" is ordered.
+    LATEST_ORDER_BY = (
+        models.F("completed_at").desc(nulls_last=True),
+        models.F("inserted_at").desc(),
+        models.F("id").desc(),
+    )
+
+    def _eligible_for_latest(self) -> "ScanQuerySet":
+        """Restrict to the scans that may be a provider's latest.
+
+        Returns:
+            ScanQuerySet: The completed scans.
+        """
+        return self.filter(state=StateChoices.COMPLETED)
+
+    def latest_per_provider(self) -> "ScanQuerySet":
+        """Pick each provider's latest scan with `DISTINCT ON (provider_id)`.
+
+        Returns:
+            ScanQuerySet: One scan per provider, the latest one.
+        """
+        return (
+            self._eligible_for_latest()
+            .order_by("provider_id", *self.LATEST_ORDER_BY)
+            .distinct("provider_id")
+        )
+
+    def latest_ids_per_provider(self) -> list[UUID]:
+        """Evaluate `latest_per_provider` and return the scan ids.
+
+        The ids are materialised so callers can pass them as a literal `IN`
+        list; as a subquery Postgres misestimates the row count and picks a
+        slow nested loop.
+
+        Returns:
+            list[UUID]: The id of each provider's latest scan.
+        """
+        return list(self.latest_per_provider().values_list("id", flat=True))
+
+    def latest_first(self) -> "ScanQuerySet":
+        """Order eligible scans newest first, without deduplicating per provider.
+
+        Expects the queryset to be already filtered to a single provider.
+
+        Returns:
+            ScanQuerySet: The eligible scans, latest first.
+        """
+        return self._eligible_for_latest().order_by(*self.LATEST_ORDER_BY)
+
+
 class Scan(RowLevelSecurityProtectedModel):
-    objects = ActiveProviderManager()
-    all_objects = models.Manager()
+    objects = ActiveProviderManager.from_queryset(ScanQuerySet)()
+    all_objects = ScanQuerySet.as_manager()

    _SCOPING_SCANNER_ARG_KEYS_CACHE: tuple[str, ...] | None = None

@@ -726,6 +783,12 @@ class Scan(RowLevelSecurityProtectedModel):
                name="scans_prov_state_ins_desc_idx",
            ),
            # TODO This might replace `scans_prov_state_ins_desc_idx` completely. Review usage
+            # Since `ScanQuerySet`, no code path reads a provider's
+            # completed scans by `-inserted_at`. The only query left that
+            # matches this index (and `scans_prov_state_ins_desc_idx` above)
+            # is `GET /scans?filter[provider]=…&filter[state]=completed` with
+            # the default sort. Both are candidates to drop in a follow-up
+            # once production `pg_stat_user_indexes.idx_scan` confirms it.
            models.Index(
                fields=["tenant_id", "provider_id", "-inserted_at"],
                condition=Q(state=StateChoices.COMPLETED),
@@ -1380,6 +1443,15 @@ class Invitation(RowLevelSecurityProtectedModel):
            self.email = self.email.strip().lower()
        super().save(*args, **kwargs)

+    @classmethod
+    def lapsed_q(cls):
+        """Pending invitations whose expiry date has already passed."""
+        return Q(state=cls.State.PENDING, expires_at__lte=datetime.now(UTC))
+
+    @property
+    def is_lapsed(self):
+        return self.state == self.State.PENDING and self.expires_at <= datetime.now(UTC)
+
    class Meta(RowLevelSecurityProtectedModel.Meta):
        db_table = "invitations"

@@ -1,7 +1,7 @@
 from enum import Enum

 from api.db_router import MainRouter
-from api.models import Integration, Provider, Role, User
+from api.models import Integration, Provider, Role, Task, User
 from django.db.models import Q, QuerySet
 from rest_framework.exceptions import PermissionDenied
 from rest_framework.permissions import BasePermission
@@ -17,6 +17,50 @@ class Permissions(Enum):
    UNLIMITED_VISIBILITY = "unlimited_visibility"


+# Revoking a task needs the permission of the operation that queued it.
+# None and unmapped names are not revocable; a revoked provider deletion
+# would leave the provider soft-deleted with nothing re-queuing the cleanup.
+TASK_REVOKE_PERMISSIONS: dict[str, list[Permissions] | None] = {
+    "provider-connection-check": [Permissions.MANAGE_PROVIDERS],
+    "provider-deletion": None,
+    "integration-connection-check": [Permissions.MANAGE_INTEGRATIONS],
+    "integration-s3": [Permissions.MANAGE_INTEGRATIONS],
+    "integration-security-hub": [Permissions.MANAGE_INTEGRATIONS],
+    "integration-jira": [Permissions.MANAGE_INTEGRATIONS],
+    "scan-perform": [Permissions.MANAGE_SCANS],
+    "scan-perform-scheduled": [Permissions.MANAGE_SCANS],
+    "scan-compliance-overviews": [Permissions.MANAGE_SCANS],
+    "scan-compliance-reports": [Permissions.MANAGE_SCANS],
+    "scan-finding-group-summaries": [Permissions.MANAGE_SCANS],
+    "scan-report": [Permissions.MANAGE_SCANS],
+    "attack-paths-scan-perform": [Permissions.MANAGE_SCANS],
+    "findings-mute-latest-scans": [Permissions.MANAGE_SCANS],
+    "lighthouse-connection-check": [],
+    "lighthouse-provider-connection-check": [],
+    "lighthouse-provider-models-refresh": [],
+}
+
+
+def get_user_roles(user: User, tenant_id: str) -> list[Role]:
+    """Return every role assigned to the user in the tenant."""
+    return list(
+        User.objects.using(MainRouter.admin_db)
+        .get(id=user.id)
+        .roles.using(MainRouter.admin_db)
+        .filter(tenant_id=tenant_id)
+    )
+
+
+def roles_have_permissions(
+    roles: list[Role], required_permissions: list[Permissions]
+) -> bool:
+    """Return True when every required permission is granted by at least one role."""
+    return all(
+        any(getattr(role, permission.value, False) for role in roles)
+        for permission in required_permissions
+    )
+
+
 class HasPermissions(BasePermission):
    """
    Custom permission to check if the user's role has the required permissions.
@@ -34,19 +78,11 @@ class HasPermissions(BasePermission):
        if not tenant_id:
            return False

-        user_roles = list(
-            User.objects.using(MainRouter.admin_db)
-            .get(id=request.user.id)
-            .roles.using(MainRouter.admin_db)
-            .filter(tenant_id=tenant_id)
-        )
+        user_roles = get_user_roles(request.user, tenant_id)
        if not user_roles:
            return False

-        return all(
-            any(getattr(role, permission.value, False) for role in user_roles)
-            for permission in required_permissions
-        )
+        return roles_have_permissions(user_roles, required_permissions)


 def get_role(user: User, tenant_id: str) -> Role:
@@ -85,6 +121,25 @@ def get_providers(role: Role) -> QuerySet[Provider]:
    ).distinct()


+def get_tasks(role: Role) -> QuerySet[Task]:
+    """Return the tasks visible to the role: tenant-wide ones and those of its providers."""
+    queryset = Task.objects.filter(tenant_id=role.tenant_id)
+    if role.unlimited_visibility:
+        return queryset
+
+    # Task has no provider FK, so match provider ids inside the stored kwargs.
+    # all_objects keeps a soft-deleted provider visible to its own groups, so the
+    # role that queued its deletion can still follow the task.
+    hidden = Q()
+    for provider_id in (
+        Provider.all_objects.filter(tenant_id=role.tenant_id)
+        .exclude(provider_groups__in=role.provider_groups.all())
+        .values_list("id", flat=True)
+    ):
+        hidden |= Q(task_runner_task__task_kwargs__contains=str(provider_id))
+    return queryset.exclude(hidden) if hidden else queryset
+
+
 def get_integrations(
    role: Role, providers: QuerySet[Provider] | None = None
 ) -> QuerySet[Integration]:
@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
  title: Prowler API
-  version: 1.42.0
+  version: 1.46.0
  description: |-
    Prowler API specification.

@@ -14823,7 +14823,9 @@ paths:
    get:
      operationId: api_v1_tasks_list
      description: Retrieve a list of all tasks with options for filtering by name,
-        state, and other criteria.
+        state, and other criteria. Tasks that reference a provider are only returned
+        when the role can access it; tasks without a provider reference are returned
+        for every role.
      summary: List all tasks
      parameters:
      - in: query
@@ -14922,7 +14924,8 @@ paths:
  /api/v1/tasks/{id}:
    get:
      operationId: api_v1_tasks_retrieve
-      description: Fetch detailed information about a specific task by its ID.
+      description: Fetch detailed information about a specific task by its ID. Tasks
+        tied to a provider outside the visibility of the role are not found.
      summary: Retrieve data from a specific task
      parameters:
      - in: query
@@ -14963,7 +14966,9 @@ paths:
    delete:
      operationId: api_v1_tasks_destroy
      description: Try to revoke a task using its ID. Only tasks that are not yet
-        in progress can be revoked.
+        in progress can be revoked, and the caller needs the same permission as the
+        operation that queued the task (for example MANAGE_SCANS for a scan). Provider
+        deletions cannot be revoked.
      summary: Revoke a task
      parameters:
      - in: path
@@ -1,9 +1,9 @@
 import json
-import time
 from datetime import UTC, datetime, timedelta
 from uuid import uuid4

 import pytest
+from api.authentication import API_KEY_LAST_USED_AT_THROTTLE_SECONDS
 from api.db_router import MainRouter
 from api.models import Membership, Role, TenantAPIKey, User, UserRoleRelationship
 from api.signals import revoke_membership_api_keys, revoke_user_api_keys
@@ -11,6 +11,7 @@ from conftest import TEST_PASSWORD, get_api_tokens, get_authorization_header
 from django.db.utils import ConnectionDoesNotExist
 from django.urls import reverse
 from drf_simple_apikey.crypto import get_crypto
+from freezegun import freeze_time
 from rest_framework.test import APIClient
 from rest_framework_simplejwt.token_blacklist.models import (
    BlacklistedToken,
@@ -527,7 +528,7 @@ class TestAPIKeyAuthentication:
    def test_last_used_at_tracking(
        self, create_test_user, tenants_fixture, api_keys_fixture
    ):
-        """Verify last_used_at timestamp updates on each authentication."""
+        """Verify last_used_at timestamp is set on first use and throttled after that."""
        client = APIClient()
        api_key = api_keys_fixture[0]

@@ -536,7 +537,11 @@ class TestAPIKeyAuthentication:

        # Use API key to authenticate
        api_key_headers = get_api_key_header(api_key._raw_key)
-        first_response = client.get(reverse("provider-list"), headers=api_key_headers)
+        start = datetime.now(UTC)
+        with freeze_time(start):
+            first_response = client.get(
+                reverse("provider-list"), headers=api_key_headers
+            )
        assert first_response.status_code == 200

        # Reload from database and check last_used_at is set
@@ -544,17 +549,23 @@ class TestAPIKeyAuthentication:
        first_used_at = api_key.last_used_at
        assert first_used_at is not None

-        # Use the same key again after a small delay
-        time.sleep(0.1)
-
+        # Using the same key again within the throttle interval does not rewrite it
        second_response = client.get(reverse("provider-list"), headers=api_key_headers)
        assert second_response.status_code == 200

-        # Reload and verify last_used_at was updated
        api_key.refresh_from_db()
-        second_used_at = api_key.last_used_at
-        assert second_used_at is not None
-        assert second_used_at > first_used_at
+        assert api_key.last_used_at == first_used_at
+
+        # Past the throttle interval, the next use refreshes it
+        later = start + timedelta(seconds=API_KEY_LAST_USED_AT_THROTTLE_SECONDS + 1)
+        with freeze_time(later):
+            third_response = client.get(
+                reverse("provider-list"), headers=api_key_headers
+            )
+        assert third_response.status_code == 200
+
+        api_key.refresh_from_db()
+        assert api_key.last_used_at > first_used_at


@pytest.mark.django_db
@@ -1441,6 +1452,7 @@ class TestAPIKeyRLSBypass:

        The update to last_used_at during authentication must also use the
        admin database since it occurs before RLS context is established.
+        Past the throttle interval, using the key again refreshes the timestamp.
        """
        client = APIClient()
        api_key = api_keys_fixture[0]
@@ -1448,7 +1460,11 @@ class TestAPIKeyRLSBypass:
        assert api_key.last_used_at is None

        api_key_headers = get_api_key_header(api_key._raw_key)
-        first_response = client.get(reverse("provider-list"), headers=api_key_headers)
+        start = datetime.now(UTC)
+        with freeze_time(start):
+            first_response = client.get(
+                reverse("provider-list"), headers=api_key_headers
+            )

        assert first_response.status_code == 200

@@ -1456,9 +1472,11 @@ class TestAPIKeyRLSBypass:
        first_timestamp = api_key.last_used_at
        assert first_timestamp is not None

-        time.sleep(0.1)
-
-        second_response = client.get(reverse("provider-list"), headers=api_key_headers)
+        later = start + timedelta(seconds=API_KEY_LAST_USED_AT_THROTTLE_SECONDS + 1)
+        with freeze_time(later):
+            second_response = client.get(
+                reverse("provider-list"), headers=api_key_headers
+            )
        assert second_response.status_code == 200

        api_key.refresh_from_db()
@@ -187,6 +187,27 @@ class TestRoutingByDatabasePrefix:
        sink_backend_stub.drop_database.assert_called_once_with("db-tenant-abc")
        mock_ingest.drop_database.assert_not_called()

+    def test_list_databases_always_routes_to_ingest(self, sink_backend_stub):
+        with patch("api.attack_paths.database.ingest") as mock_ingest:
+            mock_ingest.list_databases.return_value = ["db-tmp-scan-uuid-1"]
+
+            assert db_module.list_databases() == ["db-tmp-scan-uuid-1"]
+
+        mock_ingest.list_databases.assert_called_once_with()
+
+    def test_ingest_list_databases_dedupes_cluster_rows(self):
+        from api.attack_paths.ingest import driver as ingest_driver
+
+        with patch.object(ingest_driver, "get_session") as mock_get_session:
+            session = mock_get_session.return_value.__enter__.return_value
+            session.run.return_value = [{"name": "db-tmp-scan-uuid-1"}]
+
+            assert ingest_driver.list_databases() == ["db-tmp-scan-uuid-1"]
+
+        session.run.assert_called_once_with(
+            "SHOW DATABASES YIELD name RETURN DISTINCT name"
+        )
+
    def test_clear_cache_routes_temp_to_ingest(self, sink_backend_stub):
        with patch("api.attack_paths.database.ingest") as mock_ingest:
            db_module.clear_cache("db-tmp-scan-uuid-1")
@@ -5,16 +5,18 @@ from uuid import uuid4

 import pytest
 from api.authentication import (
+    API_KEY_LAST_USED_AT_THROTTLE_SECONDS,
    OrphanedAPIKeyError,
    SSEAuthentication,
    TenantAPIKeyAuthentication,
 )
 from api.db_router import MainRouter
-from api.models import TenantAPIKey
+from api.models import TenantAPIKey, User
 from django.db import connections
 from django.db.models.query import QuerySet
 from django.test import RequestFactory
 from django.test.utils import CaptureQueriesContext
+from freezegun import freeze_time
 from rest_framework.exceptions import AuthenticationFailed


@@ -286,14 +288,15 @@ class TestTenantAPIKeyAuthentication:

        assert str(exc_info.value.detail) == "This API Key has been revoked."

-    def test_authenticate_reads_the_api_key_once_under_a_row_lock(
+    def test_authenticate_reads_the_api_key_once_without_a_row_lock(
        self, auth_backend, api_keys_fixture, request_factory
    ):
-        """Test the API key is read a single time and the row is locked.
+        """Test the API key is read a single time and no row is locked.

        Validation, the `last_used_at` update and the claims must all come from the
-        same authoritative row: a second, unlocked lookup would reopen the window
-        where a key revoked in between still authenticates.
+        same authoritative row: a second lookup would reopen the window where a key
+        revoked in between still authenticates. `SELECT ... FOR UPDATE` serialized
+        every request for a hot key onto one locked row and is not used any more.
        """
        api_key = api_keys_fixture[0]

@@ -310,33 +313,40 @@ class TestTenantAPIKeyAuthentication:
        ]

        assert len(api_key_selects) == 1
-        assert "FOR UPDATE" in api_key_selects[0]
+        assert "FOR UPDATE" not in api_key_selects[0]

-    def test_authenticate_ignores_revocation_after_the_locked_read(
+    def test_authenticate_ignores_revocation_after_the_single_read(
        self, auth_backend, api_keys_fixture, request_factory
    ):
        """Test the claims describe the row that was validated, not a later state.

        Regression test: the key used to be looked up again to build the auth dict,
        without rechecking `revoked` or `entity`. A key revoked or orphaned between
-        both reads still authenticated, and the claims came from that stale row. With
-        a single locked read the write below cannot land mid-authentication, and the
-        revocation only takes effect on the next request.
+        both reads still authenticated, and the claims came from that stale row.
+        There is now only a single read, so this race is closed by construction and
+        the revocation only takes effect on the next request.
        """
        api_key = api_keys_fixture[0]
        entity_at_validation = api_key.entity
-        original_save = TenantAPIKey.save
+        original_authenticate_credentials = (
+            TenantAPIKeyAuthentication._authenticate_credentials
+        )

-        def revoke_and_orphan_before_saving(instance, *args, **kwargs):
-            # Runs after validation, right before the claims are built: the exact
-            # window a concurrent revocation or user deletion used to slip into
+        def revoke_and_orphan_after_reading(self, request, key):
+            # Runs right after the single read `authenticate` will use to build the
+            # claims: the exact window a concurrent revocation used to slip into
+            result = original_authenticate_credentials(self, request, key)
            TenantAPIKey.objects.filter(id=api_key.id).update(revoked=True, entity=None)
-            return original_save(instance, *args, **kwargs)
+            return result

        request = request_factory.get("/")
        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"

-        with patch.object(TenantAPIKey, "save", revoke_and_orphan_before_saving):
+        with patch.object(
+            TenantAPIKeyAuthentication,
+            "_authenticate_credentials",
+            revoke_and_orphan_after_reading,
+        ):
            entity, auth_dict = auth_backend.authenticate(request)

        assert entity == entity_at_validation
@@ -350,6 +360,43 @@ class TestTenantAPIKeyAuthentication:

        assert str(exc_info.value.detail) == "This API Key has been revoked."

+    def test_authenticate_survives_owner_deleted_after_the_single_read(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test a user deleted right after the read does not turn into a 500.
+
+        Without the row lock a concurrent user deletion can land between the read
+        and building the claims. `entity` is loaded by the same query, so no later
+        lookup can raise `DoesNotExist`.
+        """
+        api_key = api_keys_fixture[0]
+        owner_id = api_key.entity_id
+        original_authenticate_credentials = (
+            TenantAPIKeyAuthentication._authenticate_credentials
+        )
+
+        def delete_owner_after_reading(self, request, key):
+            result = original_authenticate_credentials(self, request, key)
+            User.objects.using(MainRouter.admin_db).filter(id=owner_id).delete()
+            return result
+
+        request = request_factory.get("/")
+        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"
+
+        with patch.object(
+            TenantAPIKeyAuthentication,
+            "_authenticate_credentials",
+            delete_owner_after_reading,
+        ):
+            entity, auth_dict = auth_backend.authenticate(request)
+
+        assert auth_dict["sub"] == str(owner_id)
+        assert entity.id == owner_id
+
+        # From the next request on, the orphaned key is rejected with a 401
+        with pytest.raises(AuthenticationFailed):
+            auth_backend.authenticate(request)
+
    def test_authenticate_expired_api_key(
        self, auth_backend, create_test_user, tenants_fixture, request_factory
    ):
@@ -421,24 +468,90 @@ class TestTenantAPIKeyAuthentication:
        if original_last_used:
            assert api_key.last_used_at > original_last_used

-    def test_authenticate_saves_to_admin_database(
+    def test_authenticate_updates_last_used_at_on_admin_database(
        self, auth_backend, api_keys_fixture, request_factory
    ):
-        """Test that the API key save operation uses admin database."""
+        """Test that the `last_used_at` update runs against the admin database."""
        api_key = api_keys_fixture[0]
        raw_key = api_key._raw_key

        request = request_factory.get("/")
        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {raw_key}"

-        # Mock the save method to verify it's called with using='admin'
-        with patch.object(TenantAPIKey, "save") as mock_save:
+        with CaptureQueriesContext(connections[MainRouter.admin_db]) as captured:
            auth_backend.authenticate(request)

-            # Verify save was called with using=admin_db
-            mock_save.assert_called_once_with(
-                update_fields=["last_used_at"], using=MainRouter.admin_db
-            )
+        api_key_updates = [
+            query["sql"]
+            for query in captured.captured_queries
+            if query["sql"].startswith("UPDATE") and '"api_keys"' in query["sql"]
+        ]
+
+        assert len(api_key_updates) == 1
+        assert "last_used_at" in api_key_updates[0]
+
+    def test_authenticate_does_not_rewrite_last_used_at_within_throttle_interval(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test that a second authentication within the throttle interval is a no-op write."""
+        api_key = api_keys_fixture[0]
+        raw_key = api_key._raw_key
+
+        request = request_factory.get("/")
+        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {raw_key}"
+
+        # First call sets last_used_at
+        auth_backend.authenticate(request)
+        api_key.refresh_from_db()
+        first_used_at = api_key.last_used_at
+        assert first_used_at is not None
+
+        # Second call, still within the throttle interval, must issue no UPDATE
+        with CaptureQueriesContext(connections[MainRouter.admin_db]) as captured:
+            auth_backend.authenticate(request)
+
+        api_key_updates = [
+            query["sql"]
+            for query in captured.captured_queries
+            if query["sql"].startswith("UPDATE") and '"api_keys"' in query["sql"]
+        ]
+        assert api_key_updates == []
+
+        api_key.refresh_from_db()
+        assert api_key.last_used_at == first_used_at
+
+    def test_authenticate_rewrites_last_used_at_after_throttle_interval(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test that `last_used_at` is refreshed once it is older than the throttle interval."""
+        api_key = api_keys_fixture[0]
+        raw_key = api_key._raw_key
+
+        request = request_factory.get("/")
+        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {raw_key}"
+
+        start = datetime.now(UTC)
+        with freeze_time(start):
+            auth_backend.authenticate(request)
+
+        api_key.refresh_from_db()
+        first_used_at = api_key.last_used_at
+        assert first_used_at is not None
+
+        later = start + timedelta(seconds=API_KEY_LAST_USED_AT_THROTTLE_SECONDS + 1)
+        with freeze_time(later):
+            with CaptureQueriesContext(connections[MainRouter.admin_db]) as captured:
+                auth_backend.authenticate(request)
+
+        api_key_updates = [
+            query["sql"]
+            for query in captured.captured_queries
+            if query["sql"].startswith("UPDATE") and '"api_keys"' in query["sql"]
+        ]
+        assert len(api_key_updates) == 1
+
+        api_key.refresh_from_db()
+        assert api_key.last_used_at > first_used_at

    def test_authenticate_returns_correct_auth_dict(
        self, auth_backend, api_keys_fixture, request_factory
@@ -1,14 +1,16 @@
-from datetime import UTC, datetime
+from datetime import UTC, datetime, timedelta

 import pytest
 from allauth.socialaccount.models import SocialApp
 from api.db_router import MainRouter
 from api.models import (
+    Provider,
    ProviderComplianceScore,
    Resource,
    ResourceTag,
    SAMLConfiguration,
    SAMLDomainIndex,
+    Scan,
    StateChoices,
    StatusChoices,
    TenantComplianceSummary,
@@ -524,3 +526,226 @@ class TestTenantComplianceSummaryModel:

        assert summary1.id != summary2.id
        assert summary1.requirements_passed != summary2.requirements_passed
+
+
+def _latest_scan_fixture(tenant, provider, *, completed_at, inserted_at=None, **kwargs):
+    scan = Scan.objects.create(
+        tenant_id=tenant.id,
+        provider=provider,
+        trigger=kwargs.pop("trigger", Scan.TriggerChoices.MANUAL),
+        state=kwargs.pop("state", StateChoices.COMPLETED),
+        completed_at=completed_at,
+        **kwargs,
+    )
+    if inserted_at is not None:
+        # `inserted_at` is auto_now_add, so it has to be forced after the fact.
+        Scan.all_objects.filter(pk=scan.pk).update(inserted_at=inserted_at)
+        scan.refresh_from_db()
+    return scan
+
+
+@pytest.mark.django_db
+class TestScanQuerySetOrdering:
+    def test_completed_later_wins_over_inserted_later(
+        self, tenants_fixture, aws_provider
+    ):
+        """The scan that FINISHED last is current, not the one that started last."""
+        tenant, *_ = tenants_fixture
+        now = datetime.now(UTC)
+
+        finished_last = _latest_scan_fixture(
+            tenant,
+            aws_provider,
+            inserted_at=now - timedelta(hours=3),
+            completed_at=now,
+        )
+        _latest_scan_fixture(
+            tenant,
+            aws_provider,
+            inserted_at=now - timedelta(hours=1),
+            completed_at=now - timedelta(hours=1),
+        )
+
+        assert Scan.all_objects.filter(
+            tenant_id=tenant.id
+        ).latest_ids_per_provider() == [finished_last.id]
+
+    def test_null_completed_at_provider_is_still_returned(
+        self, tenants_fixture, aws_provider
+    ):
+        """NULLS LAST, not `completed_at__isnull=False`.
+
+        Excluding NULL `completed_at` would drop the provider from every
+        "latest" endpoint instead of falling back to `inserted_at`.
+        """
+        tenant, *_ = tenants_fixture
+        only_scan = _latest_scan_fixture(tenant, aws_provider, completed_at=None)
+
+        assert Scan.all_objects.filter(
+            tenant_id=tenant.id
+        ).latest_ids_per_provider() == [only_scan.id]
+
+    def test_null_completed_at_never_outranks_a_finished_scan(
+        self, tenants_fixture, aws_provider
+    ):
+        """Postgres sorts NULLs first under DESC; NULLS LAST is what fixes it."""
+        tenant, *_ = tenants_fixture
+        now = datetime.now(UTC)
+
+        finished = _latest_scan_fixture(
+            tenant,
+            aws_provider,
+            inserted_at=now - timedelta(hours=2),
+            completed_at=now - timedelta(hours=2),
+        )
+        _latest_scan_fixture(
+            tenant,
+            aws_provider,
+            inserted_at=now,
+            completed_at=None,
+        )
+
+        assert Scan.all_objects.filter(
+            tenant_id=tenant.id
+        ).latest_ids_per_provider() == [finished.id]
+
+    def test_id_breaks_an_exact_timestamp_tie_deterministically(
+        self, tenants_fixture, aws_provider
+    ):
+        tenant, *_ = tenants_fixture
+        now = datetime.now(UTC)
+
+        scans = [
+            _latest_scan_fixture(
+                tenant, aws_provider, inserted_at=now, completed_at=now
+            )
+            for _ in range(3)
+        ]
+        expected = max(scan.id for scan in scans)
+
+        picks = {
+            Scan.all_objects.filter(tenant_id=tenant.id).latest_ids_per_provider()[0]
+            for _ in range(5)
+        }
+        assert picks == {expected}
+
+
+@pytest.mark.django_db
+class TestScanQuerySetEligibility:
+    def test_unfinished_scans_are_excluded(self, tenants_fixture, aws_provider):
+        tenant, *_ = tenants_fixture
+        _latest_scan_fixture(
+            tenant,
+            aws_provider,
+            completed_at=None,
+            state=StateChoices.EXECUTING,
+        )
+        assert (
+            Scan.all_objects.filter(tenant_id=tenant.id).latest_ids_per_provider() == []
+        )
+
+
+@pytest.mark.django_db
+class TestScanQuerySetManagerChoice:
+    def test_active_manager_hides_soft_deleted_providers(
+        self, tenants_fixture, aws_provider
+    ):
+        """`Scan.objects` drops soft-deleted providers, `all_objects` keeps them.
+
+        The queryset must not decide this for the caller.
+        """
+        tenant, *_ = tenants_fixture
+        scan = _latest_scan_fixture(
+            tenant, aws_provider, completed_at=datetime.now(UTC)
+        )
+
+        Provider.all_objects.filter(pk=aws_provider.pk).update(is_deleted=True)
+
+        assert Scan.all_objects.filter(
+            tenant_id=tenant.id
+        ).latest_ids_per_provider() == [scan.id]
+        assert Scan.objects.filter(tenant_id=tenant.id).latest_ids_per_provider() == []
+
+
+@pytest.mark.django_db
+class TestScanQuerySetPerProviderScoping:
+    def test_one_scan_per_provider(self, tenants_fixture, aws_provider_pair):
+        tenant, *_ = tenants_fixture
+        provider_one, provider_two = aws_provider_pair
+        now = datetime.now(UTC)
+
+        newest_one = _latest_scan_fixture(tenant, provider_one, completed_at=now)
+        _latest_scan_fixture(tenant, provider_one, completed_at=now - timedelta(days=1))
+        newest_two = _latest_scan_fixture(tenant, provider_two, completed_at=now)
+
+        assert set(
+            Scan.all_objects.filter(tenant_id=tenant.id).latest_ids_per_provider()
+        ) == {newest_one.id, newest_two.id}
+
+    def test_caller_filters_are_preserved(self, tenants_fixture, aws_provider_pair):
+        tenant, *_ = tenants_fixture
+        provider_one, provider_two = aws_provider_pair
+        now = datetime.now(UTC)
+
+        scan_one = _latest_scan_fixture(tenant, provider_one, completed_at=now)
+        _latest_scan_fixture(tenant, provider_two, completed_at=now)
+
+        assert Scan.all_objects.filter(
+            tenant_id=tenant.id, provider__in=[provider_one]
+        ).latest_ids_per_provider() == [scan_one.id]
+
+    def test_latest_first_is_ordered_not_deduplicated(
+        self, tenants_fixture, aws_provider
+    ):
+        tenant, *_ = tenants_fixture
+        now = datetime.now(UTC)
+
+        newest = _latest_scan_fixture(tenant, aws_provider, completed_at=now)
+        older = _latest_scan_fixture(
+            tenant, aws_provider, completed_at=now - timedelta(days=1)
+        )
+
+        ordered = list(
+            Scan.all_objects.filter(
+                tenant_id=tenant.id, provider_id=aws_provider.id
+            ).latest_first()
+        )
+        assert [scan.id for scan in ordered] == [newest.id, older.id]
+
+    def test_tenant_isolation(self, tenants_fixture, aws_provider):
+        tenant, other_tenant, *_ = tenants_fixture
+        _latest_scan_fixture(tenant, aws_provider, completed_at=datetime.now(UTC))
+
+        assert (
+            Scan.all_objects.filter(tenant_id=other_tenant.id).latest_ids_per_provider()
+            == []
+        )
+
+    def test_empty_queryset_returns_empty_list(self, tenants_fixture):
+        tenant, *_ = tenants_fixture
+        assert (
+            Scan.all_objects.filter(tenant_id=tenant.id).latest_ids_per_provider() == []
+        )
+
+
+@pytest.mark.django_db
+class TestScanQuerySetPerProviderQuerysetShape:
+    def test_returns_a_queryset_not_a_list(self, tenants_fixture, aws_provider):
+        tenant, *_ = tenants_fixture
+        _latest_scan_fixture(tenant, aws_provider, completed_at=datetime.now(UTC))
+
+        qs = Scan.all_objects.filter(tenant_id=tenant.id).latest_per_provider()
+        # Callers chain .values(...) / .values_list(...) onto this.
+        assert qs.values_list("provider_id", flat=True).count() == 1
+
+
+@pytest.mark.django_db
+class TestScanQuerySetRelatedManager:
+    def test_reverse_relation_exposes_the_methods(self, tenants_fixture, aws_provider):
+        tenant, *_ = tenants_fixture
+        now = datetime.now(UTC)
+
+        newest = _latest_scan_fixture(tenant, aws_provider, completed_at=now)
+        _latest_scan_fixture(tenant, aws_provider, completed_at=now - timedelta(days=1))
+
+        assert aws_provider.scans.latest_first().first().id == newest.id
@@ -30,6 +30,21 @@ def test_initialize_sentry_uses_configured_dsn():
    assert mock_init.call_args.kwargs["before_send"] is sentry_settings.before_send


+def test_initialize_sentry_sends_no_personal_data():
+    with (
+        patch.object(
+            sentry_settings.env,
+            "str",
+            return_value="https://fake-public-key@sentry.example.invalid/1",
+        ),
+        patch.object(sentry_settings.sentry_sdk, "init") as mock_init,
+    ):
+        sentry_settings.initialize_sentry()
+
+    assert mock_init.call_args.kwargs["send_default_pii"] is False
+    assert mock_init.call_args.kwargs["max_request_body_size"] == "never"
+
+
 def _make_log_record(msg, level=logging.ERROR, name="test", args=None):
    """Build a real LogRecord so getMessage() works like in production."""
    record = logging.LogRecord(
@@ -215,36 +215,34 @@ class TestOracleCloudProviderSecret:
        assert serializer.is_valid(), serializer.errors
        assert "region" not in serializer.validated_data

-    def test_accepts_and_ignores_region_field(self):
-        secret = self.valid_secret(region="us-phoenix-1")
-        serializer = OracleCloudProviderSecret(data=secret)
-
-        assert serializer.is_valid(), serializer.errors
-
-        assert "region" not in serializer.validated_data
-
-    @pytest.mark.parametrize(
-        "legacy_field, legacy_value",
-        [
-            ("region", None),
-            ("region", ""),
-            ("region", {"name": "us-ashburn-1"}),
-        ],
-    )
-    def test_accepts_and_ignores_any_legacy_region_value(
-        self, legacy_field, legacy_value
-    ):
+    def test_keeps_region_as_home_region(self):
        serializer = OracleCloudProviderSecret(
-            data=self.valid_secret(**{legacy_field: legacy_value})
+            data=self.valid_secret(region=" me-abudhabi-1 ")
        )

        assert serializer.is_valid(), serializer.errors
+        assert serializer.validated_data["region"] == "me-abudhabi-1"

-        assert legacy_field not in serializer.validated_data
+    def test_rejects_unknown_region(self):
+        serializer = OracleCloudProviderSecret(
+            data=self.valid_secret(region="mars-north-1")
+        )
+
+        assert not serializer.is_valid()
+        assert "region" in serializer.errors
+
+    @pytest.mark.parametrize("legacy_value", [None, "", {"name": "us-ashburn-1"}])
+    def test_drops_blank_or_non_string_region(self, legacy_value):
+        serializer = OracleCloudProviderSecret(
+            data=self.valid_secret(region=legacy_value)
+        )
+
+        assert serializer.is_valid(), serializer.errors
+        assert "region" not in serializer.validated_data


 class TestProviderSecretFieldSchema:
-    def test_oraclecloud_schema_includes_legacy_region_field(self):
+    def test_oraclecloud_schema_region_is_not_deprecated(self):
        schema = ProviderSecretField._spectacular_annotation["field"]
        oraclecloud_schema = next(
            credential_schema
@@ -253,7 +251,7 @@ class TestProviderSecretFieldSchema:
            == "Oracle Cloud Infrastructure (OCI) API Key Credentials"
        )

-        assert oraclecloud_schema["properties"]["region"]["deprecated"] is True
+        assert "deprecated" not in oraclecloud_schema["properties"]["region"]


 class TestKubernetesProviderSecret:
@@ -172,7 +172,7 @@ class TestInitializeProwlerProvider:
        )

    @patch("api.utils.return_prowler_provider")
-    def test_initialize_oraclecloud_provider_removes_region_string(
+    def test_initialize_oraclecloud_provider_passes_region_as_home_region(
        self, mock_return_prowler_provider
    ):
        provider = MagicMock()
@@ -182,7 +182,7 @@ class TestInitializeProwlerProvider:
            "fingerprint": "00:11:22:33:44:55:66:77",
            "key_content": "fake-base64-key-content",
            "tenancy": "ocid1.tenancy.oc1..fake",
-            "region": "us-ashburn-1",
+            "region": "me-abudhabi-1",
        }
        mock_return_prowler_provider.return_value = MagicMock()

@@ -193,6 +193,7 @@ class TestInitializeProwlerProvider:
            fingerprint="00:11:22:33:44:55:66:77",
            key_content="fake-base64-key-content",
            tenancy="ocid1.tenancy.oc1..fake",
+            home_region="me-abudhabi-1",
        )

    @patch("api.utils.return_prowler_provider")
@@ -254,11 +255,35 @@ class TestProwlerProviderConnectionTest:
            fingerprint="00:11:22:33:44:55:66:77",
            key_content="fake-base64-key-content",
            tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
-            region=getattr(
-                OraclecloudProvider,
-                "_bootstrap_region",
-                OraclecloudProvider._home_region,
-            ),
+            region=OraclecloudProvider._bootstrap_region,
+            provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
+            raise_on_exception=False,
+        )
+
+    @patch("api.utils.return_prowler_provider")
+    def test_oraclecloud_connection_test_uses_stored_region_for_identity(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.uid = "ocid1.tenancy.oc1..aaaaaaaexample"
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret.secret = {
+            "user": "ocid1.user.oc1..aaaaaaaexample",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+            "region": "me-abudhabi-1",
+        }
+        mock_return_prowler_provider.return_value = MagicMock()
+
+        prowler_provider_connection_test(provider)
+
+        mock_return_prowler_provider.return_value.test_connection.assert_called_once_with(
+            user="ocid1.user.oc1..aaaaaaaexample",
+            fingerprint="00:11:22:33:44:55:66:77",
+            key_content="fake-base64-key-content",
+            tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
+            region="me-abudhabi-1",
            provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
            raise_on_exception=False,
        )
@@ -434,7 +459,7 @@ class TestGetProwlerProviderKwargs:
        expected_result = {**secret_dict, **expected_extra_kwargs}
        assert result == expected_result

-    def test_get_prowler_provider_kwargs_oraclecloud_removes_region(
+    def test_get_prowler_provider_kwargs_oraclecloud_maps_region_to_home_region(
        self,
    ):
        secret_dict = {
@@ -461,6 +486,7 @@ class TestGetProwlerProviderKwargs:
            "key_content": "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----",
            "tenancy": "ocid1.tenancy.oc1..fake",
            "pass_phrase": "fake-passphrase",
+            "home_region": "us-ashburn-1",
        }

    def test_get_prowler_provider_kwargs_with_mutelist(self):
@@ -60,6 +60,7 @@ from api.models import (
    User,
    UserRoleRelationship,
 )
+from api.rbac.permissions import TASK_REVOKE_PERMISSIONS
 from api.rls import Tenant
 from api.uuid_utils import datetime_to_uuid7
 from api.v1.views import (
@@ -82,7 +83,7 @@ from django.db import close_old_connections, connection, connections
 from django.db.models import Count
 from django.db.models.signals import pre_delete
 from django.http import JsonResponse
-from django.test import RequestFactory
+from django.test import RequestFactory, override_settings
 from django.test.utils import CaptureQueriesContext
 from django.urls import reverse
 from django_celery_results.models import TaskResult
@@ -3362,7 +3363,7 @@ current-context: test-context
        provider_secret = ProviderSecret.objects.get()
        assert "region" not in provider_secret.secret

-    def test_provider_secrets_create_oraclecloud_accepts_and_ignores_region(
+    def test_provider_secrets_create_oraclecloud_stores_region(
        self,
        authenticated_client,
        oraclecloud_provider,
@@ -3371,14 +3372,14 @@ current-context: test-context
            authenticated_client,
            oraclecloud_provider,
            self._oraclecloud_secret(
-                key_content="  test-key-content  ", region=" us-ashburn-1 "
+                key_content="  test-key-content  ", region=" me-abudhabi-1 "
            ),
        )

        assert response.status_code == status.HTTP_201_CREATED
        provider_secret = ProviderSecret.objects.get()
        assert provider_secret.secret["key_content"] == "test-key-content"
-        assert "region" not in provider_secret.secret
+        assert provider_secret.secret["region"] == "me-abudhabi-1"

    def test_provider_secrets_update_oraclecloud_without_region_stores_no_region(
        self,
@@ -3411,7 +3412,7 @@ current-context: test-context
        provider_secret.refresh_from_db()
        assert "region" not in provider_secret.secret

-    def test_provider_secrets_update_oraclecloud_accepts_and_ignores_region(
+    def test_provider_secrets_update_oraclecloud_stores_region(
        self,
        authenticated_client,
        oraclecloud_provider,
@@ -3429,7 +3430,7 @@ current-context: test-context
                "type": "provider-secrets",
                "id": str(provider_secret.id),
                "attributes": {
-                    "secret": self._oraclecloud_secret(region=" us-ashburn-1 ")
+                    "secret": self._oraclecloud_secret(region=" me-abudhabi-1 ")
                },
            }
        }
@@ -3442,7 +3443,7 @@ current-context: test-context

        assert response.status_code == status.HTTP_200_OK
        provider_secret.refresh_from_db()
-        assert "region" not in provider_secret.secret
+        assert provider_secret.secret["region"] == "me-abudhabi-1"

    @pytest.mark.parametrize(
        "attributes, error_code, error_pointer",
@@ -3951,6 +3952,43 @@ class TestScanViewSet:
        mock_enqueue_scan_execution.assert_called_once()
        # assert scan.scanner_args == expected_scanner_args

+    @patch("api.v1.views.enqueue_scan_execution_on_commit")
+    def test_scans_create_returns_the_scan_id_in_task_args(
+        self,
+        mock_enqueue_scan_execution,
+        authenticated_client,
+        okta_provider,
+    ):
+        """The 202 is a task, so `task_args` is the only place the scan id is.
+
+        It is serialized before the on_commit publish that would otherwise fill
+        the kwargs, so the record has to carry them from the start.
+        """
+        payload = {
+            "data": {
+                "type": "scans",
+                "attributes": {"name": "New Scan"},
+                "relationships": {
+                    "provider": {
+                        "data": {"type": "providers", "id": str(okta_provider.id)}
+                    }
+                },
+            }
+        }
+
+        response = authenticated_client.post(
+            reverse("scan-list"),
+            data=payload,
+            content_type=API_JSON_CONTENT_TYPE,
+        )
+
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        scan = Scan.objects.get()
+        assert response.json()["data"]["attributes"]["task_args"] == {
+            "scan_id": str(scan.id),
+            "provider_id": str(okta_provider.id),
+        }
+
    @patch("tasks.tasks.perform_scan_task.apply_async")
    def test_scans_create_queues_scan_when_provider_has_active_scan(
        self,
@@ -4540,6 +4578,52 @@ class TestScanViewSet:
        assert response.status_code == status.HTTP_302_FOUND
        assert response["Location"] == presigned_url

+    @override_settings(
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="https://storage.example.com",
+        DJANGO_OUTPUT_S3_AWS_ACCESS_KEY_ID="access-key",
+        DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY="secret-key",
+        DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN="",
+        DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION="eu-west-1",
+    )
+    def test_report_s3_redirects_to_the_public_storage_host(
+        self, authenticated_client, scans_fixture, monkeypatch
+    ):
+        """The object is looked up internally but the redirect the browser follows is public."""
+        scan = scans_fixture[0]
+        bucket = "test-bucket"
+        key = "report.zip"
+        scan.output_location = f"s3://{bucket}/{key}"
+        scan.state = StateChoices.COMPLETED
+        scan.save()
+
+        monkeypatch.setattr(
+            "api.v1.views.env",
+            type("env", (), {"str": lambda self, *_args, **_kwargs: bucket})(),
+        )
+
+        head_calls = []
+
+        class InternalS3Client:
+            def head_object(self, Bucket, Key):
+                head_calls.append((Bucket, Key))
+                return {}
+
+            def generate_presigned_url(self, *_args, **_kwargs):
+                raise AssertionError("the internal client must not sign the redirect")
+
+        monkeypatch.setattr("api.v1.views.get_s3_client", lambda: InternalS3Client())
+
+        url = reverse("scan-report", kwargs={"pk": scan.id})
+        response = authenticated_client.get(url)
+
+        assert response.status_code == status.HTTP_302_FOUND
+        assert head_calls == [(bucket, key)]
+
+        location = urlparse(response["Location"])
+        assert location.netloc == "storage.example.com"
+        assert location.path == f"/{bucket}/{key}"
+        assert "X-Amz-Signature" in parse_qs(location.query)
+
    def test_report_s3_success_no_local_files(
        self, authenticated_client, scans_fixture, monkeypatch
    ):
@@ -5156,6 +5240,7 @@ class TestTaskViewSet:
    @patch("api.v1.views.AsyncResult", return_value=Mock())
    def test_tasks_revoke(self, mock_async_result, authenticated_client, tasks_fixture):
        _, task2 = tasks_fixture
+        self._set_task_name(task2, "scan-perform")
        response = authenticated_client.delete(
            reverse("task-detail", kwargs={"pk": task2.id})
        )
@@ -5171,12 +5256,311 @@ class TestTaskViewSet:

    def test_tasks_revoke_invalid_status(self, authenticated_client, tasks_fixture):
        task1, _ = tasks_fixture
+        self._set_task_name(task1, "scan-perform")
        response = authenticated_client.delete(
            reverse("task-detail", kwargs={"pk": task1.id})
        )
        # Task status is SUCCESS
        assert response.status_code == status.HTTP_400_BAD_REQUEST

+    @staticmethod
+    def _set_task_name(task, name):
+        task.task_runner_task.task_name = name
+        task.task_runner_task.save(update_fields=["task_name"])
+
+    @staticmethod
+    def _set_task_kwargs(task, kwargs):
+        task.task_runner_task.task_kwargs = json.dumps(repr(kwargs))
+        task.task_runner_task.save(update_fields=["task_kwargs"])
+
+    @staticmethod
+    def _client_with_role(tenant, factory, **permissions):
+        user = User.objects.create_user(
+            name=f"revoker-{uuid4()}",
+            email=f"revoker-{uuid4()}@prowler.com",
+            password=TEST_PASSWORD,
+        )
+        Membership.objects.create(
+            user=user, tenant=tenant, role=Membership.RoleChoices.MEMBER
+        )
+        flags = {
+            "manage_users": False,
+            "manage_account": False,
+            "manage_billing": False,
+            "manage_providers": False,
+            "manage_integrations": False,
+            "manage_scans": False,
+            "unlimited_visibility": True,
+            **permissions,
+        }
+        role = Role.objects.create(
+            name=f"revoker-{uuid4()}", tenant_id=tenant.id, **flags
+        )
+        UserRoleRelationship.objects.create(user=user, role=role, tenant_id=tenant.id)
+        return factory(user, tenant)
+
+    @patch("api.v1.views.AsyncResult")
+    def test_tasks_revoke_without_permission_is_forbidden(
+        self, mock_async_result, authenticated_client_no_permissions_rbac, tasks_fixture
+    ):
+        _, pending_task = tasks_fixture
+        self._set_task_name(pending_task, "provider-connection-check")
+
+        response = authenticated_client_no_permissions_rbac.delete(
+            reverse("task-detail", kwargs={"pk": pending_task.id})
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+        mock_async_result.return_value.revoke.assert_not_called()
+
+    @pytest.mark.parametrize(
+        "task_name, permissions, expected_status",
+        [
+            (
+                "provider-connection-check",
+                {"manage_providers": True},
+                status.HTTP_202_ACCEPTED,
+            ),
+            (
+                "provider-connection-check",
+                {"manage_scans": True},
+                status.HTTP_403_FORBIDDEN,
+            ),
+            ("scan-perform", {"manage_scans": True}, status.HTTP_202_ACCEPTED),
+            (
+                "scan-perform-scheduled",
+                {"manage_providers": True},
+                status.HTTP_403_FORBIDDEN,
+            ),
+            (
+                "integration-jira",
+                {"manage_integrations": True},
+                status.HTTP_202_ACCEPTED,
+            ),
+            ("integration-jira", {"manage_providers": True}, status.HTTP_403_FORBIDDEN),
+            ("lighthouse-connection-check", {}, status.HTTP_202_ACCEPTED),
+        ],
+    )
+    @patch("api.v1.views.AsyncResult")
+    def test_tasks_revoke_requires_originating_operation_permission(
+        self,
+        mock_async_result,
+        authenticated_client_for_tenant_factory,
+        tenants_fixture,
+        tasks_fixture,
+        task_name,
+        permissions,
+        expected_status,
+    ):
+        tenant, *_ = tenants_fixture
+        _, pending_task = tasks_fixture
+        self._set_task_name(pending_task, task_name)
+        client = self._client_with_role(
+            tenant, authenticated_client_for_tenant_factory, **permissions
+        )
+
+        response = client.delete(reverse("task-detail", kwargs={"pk": pending_task.id}))
+
+        assert response.status_code == expected_status
+        if expected_status == status.HTTP_202_ACCEPTED:
+            mock_async_result.return_value.revoke.assert_called_once()
+        else:
+            mock_async_result.return_value.revoke.assert_not_called()
+
+    @patch("api.v1.views.AsyncResult")
+    def test_tasks_revoke_provider_deletion_is_forbidden_even_for_admin(
+        self, mock_async_result, authenticated_client, tasks_fixture
+    ):
+        _, pending_task = tasks_fixture
+        self._set_task_name(pending_task, "provider-deletion")
+
+        response = authenticated_client.delete(
+            reverse("task-detail", kwargs={"pk": pending_task.id})
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+        mock_async_result.return_value.revoke.assert_not_called()
+
+    @patch("api.v1.views.AsyncResult")
+    def test_tasks_revoke_unmapped_task_is_forbidden(
+        self, mock_async_result, authenticated_client, tasks_fixture
+    ):
+        _, pending_task = tasks_fixture
+        assert pending_task.task_runner_task.task_name not in TASK_REVOKE_PERMISSIONS
+
+        response = authenticated_client.delete(
+            reverse("task-detail", kwargs={"pk": pending_task.id})
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+        mock_async_result.return_value.revoke.assert_not_called()
+
+    def test_every_rls_task_has_revoke_permissions(self):
+        from config.celery import RLSTask, celery_app
+
+        rls_task_names = {
+            name for name, task in celery_app.tasks.items() if isinstance(task, RLSTask)
+        }
+        assert rls_task_names
+        assert rls_task_names <= set(TASK_REVOKE_PERMISSIONS)
+
+    @patch("api.v1.views.AsyncResult")
+    def test_tasks_hidden_for_providers_outside_role_visibility(
+        self,
+        mock_async_result,
+        authenticated_client_no_permissions_rbac,
+        tasks_fixture,
+        aws_provider_pair,
+    ):
+        client = authenticated_client_no_permissions_rbac
+        limited_user = client.user
+        tenant = Membership.objects.filter(user=limited_user).first().tenant
+        allowed_provider, denied_provider = aws_provider_pair
+        allowed_task, denied_task = tasks_fixture
+        self._set_task_kwargs(
+            allowed_task,
+            {"tenant_id": str(tenant.id), "provider_id": str(allowed_provider.id)},
+        )
+        self._set_task_name(denied_task, "provider-deletion")
+        self._set_task_kwargs(
+            denied_task,
+            {"tenant_id": str(tenant.id), "provider_id": str(denied_provider.id)},
+        )
+        provider_group = ProviderGroup.objects.create(
+            name="limited-task-group", tenant_id=tenant.id
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id,
+            provider_group=provider_group,
+            provider=allowed_provider,
+        )
+        RoleProviderGroupRelationship.objects.create(
+            tenant_id=tenant.id,
+            role=limited_user.roles.first(),
+            provider_group=provider_group,
+        )
+
+        response = client.get(reverse("task-list"))
+        assert response.status_code == status.HTTP_200_OK
+        assert [item["id"] for item in response.json()["data"]] == [
+            str(allowed_task.id)
+        ]
+
+        response = client.get(reverse("task-detail", kwargs={"pk": denied_task.id}))
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+        response = client.delete(reverse("task-detail", kwargs={"pk": denied_task.id}))
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+        mock_async_result.return_value.revoke.assert_not_called()
+
+    @patch("api.v1.views.AsyncResult")
+    def test_tasks_of_soft_deleted_provider_stay_visible_to_its_groups(
+        self,
+        mock_async_result,
+        authenticated_client_for_tenant_factory,
+        tenants_fixture,
+        tasks_fixture,
+        aws_provider_pair,
+    ):
+        tenant, *_ = tenants_fixture
+        provider, _ = aws_provider_pair
+        finished_task, pending_task = tasks_fixture
+        client = self._client_with_role(
+            tenant,
+            authenticated_client_for_tenant_factory,
+            manage_providers=True,
+            unlimited_visibility=False,
+        )
+        provider_group = ProviderGroup.objects.create(
+            name="own-group", tenant_id=tenant.id
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=tenant.id, provider_group=provider_group, provider=provider
+        )
+        RoleProviderGroupRelationship.objects.create(
+            tenant_id=tenant.id,
+            role=client.user.roles.first(),
+            provider_group=provider_group,
+        )
+        for task, name in (
+            (finished_task, "provider-deletion"),
+            (pending_task, "provider-connection-check"),
+        ):
+            self._set_task_name(task, name)
+            self._set_task_kwargs(
+                task, {"tenant_id": str(tenant.id), "provider_id": str(provider.id)}
+            )
+        provider.is_deleted = True
+        provider.save()
+
+        response = client.get(reverse("task-detail", kwargs={"pk": finished_task.id}))
+        assert response.status_code == status.HTTP_200_OK
+
+        response = client.delete(reverse("task-detail", kwargs={"pk": pending_task.id}))
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        mock_async_result.return_value.revoke.assert_called_once()
+
+    def test_tasks_without_provider_stay_visible_for_limited_roles(
+        self, authenticated_client_no_permissions_rbac, tasks_fixture, aws_provider_pair
+    ):
+        response = authenticated_client_no_permissions_rbac.get(reverse("task-list"))
+        assert response.status_code == status.HTTP_200_OK
+        assert len(response.json()["data"]) == len(tasks_fixture)
+
+    def test_tasks_list_without_role_is_forbidden(
+        self, authenticated_client_rbac_noroles, tasks_fixture
+    ):
+        response = authenticated_client_rbac_noroles.get(reverse("task-list"))
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
+    def test_tasks_revoke_without_permission_hides_task_status(
+        self, authenticated_client_no_permissions_rbac, tasks_fixture
+    ):
+        finished_task, _ = tasks_fixture
+        self._set_task_name(finished_task, "provider-connection-check")
+
+        response = authenticated_client_no_permissions_rbac.delete(
+            reverse("task-detail", kwargs={"pk": finished_task.id})
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+
+    @patch("api.v1.views.AsyncResult")
+    def test_tasks_revoke_unauthenticated_returns_401(
+        self, mock_async_result, tasks_fixture
+    ):
+        from rest_framework.test import APIClient
+
+        _, pending_task = tasks_fixture
+        self._set_task_name(pending_task, "scan-perform")
+
+        response = APIClient().delete(
+            reverse("task-detail", kwargs={"pk": pending_task.id})
+        )
+
+        assert response.status_code == status.HTTP_401_UNAUTHORIZED
+        mock_async_result.return_value.revoke.assert_not_called()
+
+    @patch("api.v1.views.AsyncResult")
+    def test_tasks_revoke_foreign_tenant_task_returns_404(
+        self,
+        mock_async_result,
+        authenticated_client_for_tenant_factory,
+        tenants_fixture,
+        tasks_fixture,
+    ):
+        _, foreign_tenant, *_ = tenants_fixture
+        _, pending_task = tasks_fixture
+        self._set_task_name(pending_task, "scan-perform")
+        client = self._client_with_role(
+            foreign_tenant, authenticated_client_for_tenant_factory, manage_scans=True
+        )
+
+        response = client.delete(reverse("task-detail", kwargs={"pk": pending_task.id}))
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+        mock_async_result.return_value.revoke.assert_not_called()
+

@pytest.mark.django_db
 class TestAttackPathsScanViewSet:
@@ -8784,6 +9168,190 @@ class TestInvitationViewSet:
            user.id
        )

+    @staticmethod
+    def _invitation_create_payload(email, role):
+        return json.dumps(
+            {
+                "data": {
+                    "type": "invitations",
+                    "attributes": {"email": email},
+                    "relationships": {
+                        "roles": {"data": [{"type": "roles", "id": str(role.id)}]}
+                    },
+                }
+            }
+        )
+
+    @staticmethod
+    def _create_lapsed_invitation(email, tenant, inviter):
+        return Invitation.objects.create(
+            email=email,
+            state=Invitation.State.PENDING,
+            expires_at=datetime.now(UTC) - timedelta(days=1),
+            inviter=inviter,
+            tenant=tenant,
+        )
+
+    def test_invitations_create_with_lapsed_pending_invitation_for_same_email(
+        self,
+        authenticated_client,
+        create_test_user,
+        tenants_fixture,
+        invitations_fixture,
+        roles_fixture,
+    ):
+        lapsed_invitation, expired_invitation = invitations_fixture
+        lapsed_invitation.expires_at = datetime.now(UTC) - timedelta(days=1)
+        lapsed_invitation.save()
+        other_email_lapsed_invitation = self._create_lapsed_invitation(
+            "other@prowler.com", tenants_fixture[0], create_test_user
+        )
+
+        response = authenticated_client.post(
+            reverse("invitation-list"),
+            data=self._invitation_create_payload(
+                lapsed_invitation.email, roles_fixture[0]
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        new_invitation = Invitation.objects.get(id=response.json()["data"]["id"])
+        assert new_invitation.email == lapsed_invitation.email
+        assert new_invitation.state == Invitation.State.PENDING
+        lapsed_invitation.refresh_from_db()
+        assert lapsed_invitation.state == Invitation.State.EXPIRED
+        expired_invitation.refresh_from_db()
+        assert expired_invitation.state == Invitation.State.EXPIRED
+        other_email_lapsed_invitation.refresh_from_db()
+        assert other_email_lapsed_invitation.state == Invitation.State.PENDING
+
+    def test_invitations_create_with_active_pending_invitation_for_same_email(
+        self,
+        authenticated_client,
+        create_test_user,
+        tenants_fixture,
+        invitations_fixture,
+        roles_fixture,
+    ):
+        active_invitation, _ = invitations_fixture
+        self._create_lapsed_invitation(
+            active_invitation.email, tenants_fixture[0], create_test_user
+        )
+        invitation_count = Invitation.objects.count()
+
+        response = authenticated_client.post(
+            reverse("invitation-list"),
+            data=self._invitation_create_payload(
+                active_invitation.email, roles_fixture[0]
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert (
+            response.json()["errors"][0]["source"]["pointer"]
+            == "/data/attributes/email"
+        )
+        assert Invitation.objects.count() == invitation_count
+        active_invitation.refresh_from_db()
+        assert active_invitation.state == Invitation.State.PENDING
+
+    def test_invitations_create_ignores_pending_invitations_from_other_tenants(
+        self, authenticated_client, create_test_user, tenants_fixture, roles_fixture
+    ):
+        email = "cross_tenant@prowler.com"
+        other_tenant = tenants_fixture[1]
+        other_tenant_lapsed_invitation = self._create_lapsed_invitation(
+            email, other_tenant, create_test_user
+        )
+        Invitation.objects.create(
+            email=email, inviter=create_test_user, tenant=other_tenant
+        )
+
+        response = authenticated_client.post(
+            reverse("invitation-list"),
+            data=self._invitation_create_payload(email, roles_fixture[0]),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        other_tenant_lapsed_invitation.refresh_from_db()
+        assert other_tenant_lapsed_invitation.state == Invitation.State.PENDING
+
+    def test_invitations_report_lapsed_pending_invitation_as_expired(
+        self,
+        authenticated_client,
+        create_test_user,
+        tenants_fixture,
+        invitations_fixture,
+    ):
+        active_invitation, expired_invitation = invitations_fixture
+        lapsed_invitation = self._create_lapsed_invitation(
+            "lapsed@prowler.com", tenants_fixture[0], create_test_user
+        )
+
+        list_response = authenticated_client.get(reverse("invitation-list"))
+        retrieve_response = authenticated_client.get(
+            reverse("invitation-detail", kwargs={"pk": lapsed_invitation.id})
+        )
+
+        assert list_response.status_code == status.HTTP_200_OK
+        assert retrieve_response.status_code == status.HTTP_200_OK
+        assert {
+            invitation["id"]: invitation["attributes"]["state"]
+            for invitation in list_response.json()["data"]
+        } == {
+            str(active_invitation.id): Invitation.State.PENDING.value,
+            str(expired_invitation.id): Invitation.State.EXPIRED.value,
+            str(lapsed_invitation.id): Invitation.State.EXPIRED.value,
+        }
+        assert (
+            retrieve_response.json()["data"]["attributes"]["state"]
+            == Invitation.State.EXPIRED.value
+        )
+
+    @pytest.mark.parametrize(
+        "filter_name, filter_value, expected_invitations",
+        [
+            ("state", "pending", {"active"}),
+            ("state", "expired", {"expired", "lapsed"}),
+            ("state", "accepted", set()),
+            ("state__in", "pending", {"active"}),
+            ("state__in", "expired", {"expired", "lapsed"}),
+            ("state__in", "pending,expired", {"active", "expired", "lapsed"}),
+            ("state__in", "accepted,revoked", set()),
+        ],
+    )
+    def test_invitations_filter_state_treats_lapsed_pending_as_expired(
+        self,
+        authenticated_client,
+        create_test_user,
+        tenants_fixture,
+        invitations_fixture,
+        filter_name,
+        filter_value,
+        expected_invitations,
+    ):
+        active_invitation, expired_invitation = invitations_fixture
+        lapsed_invitation = self._create_lapsed_invitation(
+            "lapsed@prowler.com", tenants_fixture[0], create_test_user
+        )
+        invitation_ids = {
+            "active": str(active_invitation.id),
+            "expired": str(expired_invitation.id),
+            "lapsed": str(lapsed_invitation.id),
+        }
+
+        response = authenticated_client.get(
+            reverse("invitation-list"), {f"filter[{filter_name}]": filter_value}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert {invitation["id"] for invitation in response.json()["data"]} == {
+            invitation_ids[name] for name in expected_invitations
+        }
+
    @pytest.mark.parametrize(
        "email",
        [
@@ -8791,8 +9359,10 @@ class TestInvitationViewSet:
            "invalid_email@",
            # There is a pending invitation with this email
            "testing@prowler.com",
+            "TESTING@prowler.com",
            # User is already a member of the tenant
            TEST_USER,
+            TEST_USER.upper(),
        ],
    )
    def test_invitations_create_invalid_email(
@@ -9047,6 +9617,56 @@ class TestInvitationViewSet:
            == "This invitation cannot be revoked."
        )

+    def test_invitations_delete_lapsed_invitation(
+        self, authenticated_client, invitations_fixture
+    ):
+        invitation, *_ = invitations_fixture
+        invitation.expires_at = datetime.now(UTC) - timedelta(days=1)
+        invitation.save()
+
+        response = authenticated_client.delete(
+            reverse("invitation-detail", kwargs={"pk": str(invitation.id)})
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert (
+            response.json()["errors"][0]["detail"]
+            == "This invitation cannot be revoked."
+        )
+        invitation.refresh_from_db()
+        assert invitation.state == Invitation.State.PENDING
+
+    def test_invitations_partial_update_lapsed_invitation(
+        self, authenticated_client, invitations_fixture
+    ):
+        invitation, *_ = invitations_fixture
+        invitation.expires_at = datetime.now(UTC) - timedelta(days=1)
+        invitation.save()
+        data = {
+            "data": {
+                "id": str(invitation.id),
+                "type": "invitations",
+                "attributes": {
+                    "email": invitation.email,
+                    "expires_at": self.TOMORROW_ISO,
+                },
+            }
+        }
+
+        response = authenticated_client.patch(
+            reverse("invitation-detail", kwargs={"pk": str(invitation.id)}),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert (
+            response.json()["errors"][0]["detail"]
+            == "This invitation cannot be updated."
+        )
+        invitation.refresh_from_db()
+        assert invitation.is_lapsed
+
    def test_invitations_accept_invitation_new_user(self, client, invitations_fixture):
        invitation, *_ = invitations_fixture

@@ -302,17 +302,26 @@ def get_prowler_provider_kwargs(
 def _normalize_oraclecloud_provider_kwargs(secret: dict) -> dict:
    """Normalize external OCI secret fields into SDK provider kwargs."""
    prowler_provider_kwargs = secret.copy()
-    prowler_provider_kwargs.pop("region", None)
+    home_region = _oraclecloud_home_region(prowler_provider_kwargs.pop("region", None))
+    if home_region:
+        prowler_provider_kwargs["home_region"] = home_region

    return prowler_provider_kwargs


+def _oraclecloud_home_region(region) -> str | None:
+    """Return the stored OCI region as a home region, ignoring blank or non-string legacy values."""
+    if isinstance(region, str) and region.strip():
+        return region.strip()
+    return None
+
+
 def _normalize_oraclecloud_connection_test_kwargs(secret: dict) -> dict:
    """Normalize external OCI secret fields into test_connection kwargs."""
    from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvider

    prowler_provider_kwargs = secret.copy()
-    prowler_provider_kwargs.pop("region", None)
+    home_region = _oraclecloud_home_region(prowler_provider_kwargs.pop("region", None))

    if (
        prowler_provider_kwargs.get("user")
@@ -323,11 +332,9 @@ def _normalize_oraclecloud_connection_test_kwargs(secret: dict) -> dict:
            or prowler_provider_kwargs.get("key_file")
        )
    ):
-        # Connection validation needs one OCI endpoint, but scans remain unfiltered.
-        prowler_provider_kwargs["region"] = getattr(
-            OraclecloudProvider,
-            "_bootstrap_region",
-            OraclecloudProvider._home_region,
+        # Identity calls only succeed in a region the tenancy is subscribed to.
+        prowler_provider_kwargs["region"] = (
+            home_region or OraclecloudProvider._bootstrap_region
        )

    return prowler_provider_kwargs
@@ -301,8 +301,7 @@ from rest_framework_json_api import serializers
                    },
                    "region": {
                        "type": "string",
-                        "deprecated": True,
-                        "description": "Legacy OCI region field accepted for backwards compatibility but ignored; OCI scans all regions.",
+                        "description": "Optional OCI home region (or any region the tenancy is subscribed to) used to validate the credentials. It does not filter the scan, which covers all subscribed regions. Defaults to us-ashburn-1.",
                    },
                },
                "required": ["user", "fingerprint", "tenancy"],
@@ -71,6 +71,7 @@ from django.db import IntegrityError, transaction
 from drf_spectacular.utils import extend_schema_field
 from jwt.exceptions import InvalidKeyError
 from prowler.lib.mutelist.mutelist import Mutelist
+from prowler.providers.oraclecloud.config import OCI_REGIONS
 from rest_framework.reverse import reverse
 from rest_framework.validators import UniqueTogetherValidator
 from rest_framework_json_api import serializers
@@ -1917,9 +1918,16 @@ class IacProviderSecret(serializers.Serializer):
        resource_name = "provider-secrets"


-class LegacyOCIRegionField(serializers.Field):
+class OCIHomeRegionField(serializers.Field):
+    """Optional OCI home region; blank or non-string legacy values are dropped."""
+
    def to_internal_value(self, data):
-        return data
+        if not isinstance(data, str) or not data.strip():
+            return None
+        region = data.strip()
+        if region not in OCI_REGIONS:
+            raise serializers.ValidationError(f"Invalid OCI region: {region}")
+        return region

    def to_representation(self, value):
        return value
@@ -1932,10 +1940,11 @@ class OracleCloudProviderSecret(serializers.Serializer):
    key_content = serializers.CharField(required=False)
    tenancy = serializers.CharField()
    pass_phrase = serializers.CharField(required=False)
-    region = LegacyOCIRegionField(required=False, allow_null=True)
+    region = OCIHomeRegionField(required=False, allow_null=True)

    def validate(self, attrs):
-        attrs.pop("region", None)
+        if not attrs.get("region"):
+            attrs.pop("region", None)

        if "key_file" not in attrs and "key_content" not in attrs:
            raise serializers.ValidationError(
@@ -2149,6 +2158,12 @@ class InvitationSerializer(RLSSerializer):
        if tenant_id is not None:
            self.fields["roles"].queryset = Role.objects.filter(tenant_id=tenant_id)

+    def to_representation(self, instance):
+        data = super().to_representation(instance)
+        if instance.is_lapsed:
+            data["state"] = Invitation.State.EXPIRED.value
+        return data
+
    class Meta:
        model = Invitation
        fields = [
@@ -2175,6 +2190,7 @@ class InvitationBaseWriteSerializer(BaseWriteSerializer):
            self.fields["roles"].queryset = Role.objects.filter(tenant_id=tenant_id)

    def validate_email(self, value):
+        value = value.strip().lower()
        user = User.objects.filter(email=value).first()
        tenant_id = self.context["tenant_id"]
        if user and Membership.objects.filter(user=user, tenant=tenant_id).exists():
@@ -2182,9 +2198,13 @@ class InvitationBaseWriteSerializer(BaseWriteSerializer):
                "The user may already be a member of the tenant or there was an issue with the "
                "email provided."
            )
-        if Invitation.objects.filter(
-            email=value, state=Invitation.State.PENDING
-        ).exists():
+        pending_invitations = Invitation.objects.filter(
+            tenant_id=tenant_id, email=value, state=Invitation.State.PENDING
+        )
+        pending_invitations.filter(Invitation.lapsed_q()).update(
+            state=Invitation.State.EXPIRED
+        )
+        if pending_invitations.filter(expires_at__gt=datetime.now(UTC)).exists():
            raise ValidationError(
                "Unable to process your request. Please check the information provided and "
                "try again."
@@ -125,10 +125,14 @@ from api.models import (
 )
 from api.pagination import ComplianceOverviewPagination
 from api.rbac.permissions import (
+    TASK_REVOKE_PERMISSIONS,
    Permissions,
    get_integrations,
    get_providers,
    get_role,
+    get_tasks,
+    get_user_roles,
+    roles_have_permissions,
 )
 from api.renderers import APIJSONRenderer, PlainTextRenderer
 from api.rls import Tenant
@@ -326,7 +330,7 @@ from rest_framework_simplejwt.token_blacklist.models import (
 )
 from tasks.beat import schedule_provider_scan
 from tasks.jobs.attack_paths import db_utils as attack_paths_db_utils
-from tasks.jobs.export import get_s3_client
+from tasks.jobs.export import get_s3_client, get_s3_presign_client
 from tasks.tasks import (
    QUEUED_SCAN_TASK_STATE,
    backfill_compliance_summaries_task,
@@ -2407,7 +2411,8 @@ class ScanViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
            }
            if content_type:
                params["ResponseContentType"] = content_type
-            url = client.generate_presigned_url(
+            # The browser follows this URL, so it is signed against the public host.
+            url = (get_s3_presign_client() or client).generate_presigned_url(
                "get_object",
                Params=params,
                ExpiresIn=300,
@@ -2821,6 +2826,15 @@ class ScanViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
                tenant_id=self.request.tenant_id,
                task_id=pre_task_id,
                task_status=(QUEUED_SCAN_TASK_STATE if active_scan else None),
+                # This response is serialized before the on_commit publish,
+                # so without these the caller gets a task id and no scan id.
+                # Kept in step with what `enqueue_scan_execution_on_commit`
+                # publishes below.
+                task_kwargs={
+                    "tenant_id": str(self.request.tenant_id),
+                    "scan_id": str(scan.id),
+                    "provider_id": str(scan.provider_id),
+                },
            )

            if not active_scan:
@@ -2848,17 +2862,29 @@ class ScanViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
    list=extend_schema(
        tags=["Task"],
        summary="List all tasks",
-        description="Retrieve a list of all tasks with options for filtering by name, state, and other criteria.",
+        description=(
+            "Retrieve a list of all tasks with options for filtering by name, state, and other "
+            "criteria. Tasks that reference a provider are only returned when the role can "
+            "access it; tasks without a provider reference are returned for every role."
+        ),
    ),
    retrieve=extend_schema(
        tags=["Task"],
        summary="Retrieve data from a specific task",
-        description="Fetch detailed information about a specific task by its ID.",
+        description=(
+            "Fetch detailed information about a specific task by its ID. Tasks tied to a provider "
+            "outside the visibility of the role are not found."
+        ),
    ),
    destroy=extend_schema(
        tags=["Task"],
        summary="Revoke a task",
-        description="Try to revoke a task using its ID. Only tasks that are not yet in progress can be revoked.",
+        description=(
+            "Try to revoke a task using its ID. Only tasks that are not yet in progress can be "
+            "revoked, and the caller needs the same permission as the operation that queued "
+            "the task (for example MANAGE_SCANS for a scan). Provider deletions cannot be "
+            "revoked."
+        ),
        responses={202: OpenApiResponse(response=TaskSerializer)},
    ),
 )
@@ -2874,13 +2900,26 @@ class TaskViewSet(BaseRLSViewSet):
    required_permissions = []

    def get_queryset(self):
-        return Task.objects.annotate(
-            name=F("task_runner_task__task_name"),
-            state=F("task_runner_task__status"),
-        ).select_related("task_runner_task")
+        return (
+            get_tasks(self.user_role)
+            .annotate(
+                name=F("task_runner_task__task_name"),
+                state=F("task_runner_task__status"),
+            )
+            .select_related("task_runner_task")
+        )

    def destroy(self, request, *args, pk=None, **kwargs):
-        task = get_object_or_404(Task, pk=pk)
+        task = self.get_object()
+        required_permissions = TASK_REVOKE_PERMISSIONS.get(
+            task.task_runner_task.task_name
+        )
+        # Same multi-role semantics as HasPermissions.
+        if required_permissions is None or not roles_have_permissions(
+            get_user_roles(request.user, request.tenant_id), required_permissions
+        ):
+            raise PermissionDenied("You do not have permission to revoke this task.")
+
        if task.task_runner_task.status not in ["PENDING", "RECEIVED"]:
            serializer = TaskSerializer(task)
            return Response(
@@ -3477,12 +3516,8 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
        filtered_queryset = self.filter_queryset(self.get_queryset())

        latest_scans = (
-            Scan.all_objects.filter(
-                tenant_id=tenant_id,
-                state=StateChoices.COMPLETED,
-            )
-            .order_by("provider_id", "-inserted_at")
-            .distinct("provider_id")
+            Scan.all_objects.filter(tenant_id=tenant_id)
+            .latest_per_provider()
            .values("provider_id")
        )

@@ -3614,11 +3649,9 @@ class ResourceViewSet(PaginateByPkMixin, BaseRLSViewSet):
        tenant_id = request.tenant_id
        query_params = request.query_params

-        latest_scans_queryset = (
-            Scan.all_objects.filter(tenant_id=tenant_id, state=StateChoices.COMPLETED)
-            .order_by("provider_id", "-inserted_at")
-            .distinct("provider_id")
-        )
+        latest_scans_queryset = Scan.all_objects.filter(
+            tenant_id=tenant_id
+        ).latest_per_provider()

        queryset = ResourceScanSummary.objects.filter(
            tenant_id=tenant_id,
@@ -4205,12 +4238,9 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
        tenant_id = request.tenant_id
        filtered_queryset = self.filter_queryset(self.get_queryset())

-        latest_scan_ids = list(
-            Scan.all_objects.filter(tenant_id=tenant_id, state=StateChoices.COMPLETED)
-            .order_by("provider_id", "-inserted_at")
-            .distinct("provider_id")
-            .values_list("id", flat=True)
-        )
+        latest_scan_ids = Scan.all_objects.filter(
+            tenant_id=tenant_id
+        ).latest_ids_per_provider()
        filtered_queryset = filtered_queryset.filter(
            tenant_id=tenant_id, scan_id__in=latest_scan_ids
        )
@@ -4233,11 +4263,9 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
        tenant_id = request.tenant_id
        query_params = request.query_params

-        latest_scans_queryset = (
-            Scan.all_objects.filter(tenant_id=tenant_id, state=StateChoices.COMPLETED)
-            .order_by("provider_id", "-inserted_at")
-            .distinct("provider_id")
-        )
+        latest_scans_queryset = Scan.all_objects.filter(
+            tenant_id=tenant_id
+        ).latest_per_provider()
        raw_latest_scans_ids = list(
            latest_scans_queryset.values_list("id", "unique_resource_count")
        )
@@ -4471,7 +4499,7 @@ class InvitationViewSet(BaseRLSViewSet):

    def partial_update(self, request, *args, **kwargs):
        instance = self.get_object()
-        if instance.state != Invitation.State.PENDING:
+        if instance.state != Invitation.State.PENDING or instance.is_lapsed:
            raise ValidationError(detail="This invitation cannot be updated.")
        serializer = self.get_serializer(
            instance,
@@ -4485,7 +4513,7 @@ class InvitationViewSet(BaseRLSViewSet):

    def destroy(self, request, *args, **kwargs):
        instance = self.get_object()
-        if instance.state != Invitation.State.PENDING:
+        if instance.state != Invitation.State.PENDING or instance.is_lapsed:
            raise ValidationError(detail="This invitation cannot be revoked.")
        instance.state = Invitation.State.REVOKED
        instance.save()
@@ -4978,11 +5006,7 @@ class ComplianceOverviewViewSet(
        if provider_filters:
            scans = scans.filter(**provider_filters)

-        return list(
-            scans.order_by("provider_id", "-inserted_at")
-            .distinct("provider_id")
-            .values_list("id", flat=True)
-        )
+        return scans.latest_ids_per_provider()

    def _filtered_queryset_for_latest_provider_scans(self, latest_scan_ids=None):
        if latest_scan_ids is None:
@@ -5724,14 +5748,9 @@ class OverviewViewSet(ProviderFilterParamsMixin, BaseRLSViewSet):
            else {}
        )

-        latest_scan_ids = (
-            Scan.all_objects.filter(
-                tenant_id=tenant_id, state=StateChoices.COMPLETED, **provider_filter
-            )
-            .order_by("provider_id", "-inserted_at")
-            .distinct("provider_id")
-            .values_list("id", flat=True)
-        )
+        latest_scan_ids = Scan.all_objects.filter(
+            tenant_id=tenant_id, **provider_filter
+        ).latest_ids_per_provider()

        return filtered_queryset.filter(
            tenant_id=tenant_id, scan_id__in=latest_scan_ids
@@ -5758,16 +5777,10 @@ class OverviewViewSet(ProviderFilterParamsMixin, BaseRLSViewSet):

    def _latest_scan_ids_for_allowed_providers(self, tenant_id, provider_filters=None):
        provider_filter = self._get_provider_filter()
-        queryset = Scan.all_objects.filter(
-            tenant_id=tenant_id, state=StateChoices.COMPLETED, **provider_filter
-        )
+        queryset = Scan.all_objects.filter(tenant_id=tenant_id, **provider_filter)
        if provider_filters:
            queryset = queryset.filter(**provider_filters)
-        return (
-            queryset.order_by("provider_id", "-inserted_at")
-            .distinct("provider_id")
-            .values_list("id", flat=True)
-        )
+        return queryset.latest_ids_per_provider()

    @action(detail=False, methods=["get"], url_name="providers")
    def providers(self, request):
@@ -5779,14 +5792,9 @@ class OverviewViewSet(ProviderFilterParamsMixin, BaseRLSViewSet):
            else {}
        )

-        latest_scan_ids = (
-            Scan.all_objects.filter(
-                tenant_id=tenant_id, state=StateChoices.COMPLETED, **provider_filter
-            )
-            .order_by("provider_id", "-inserted_at")
-            .distinct("provider_id")
-            .values_list("id", flat=True)
-        )
+        latest_scan_ids = Scan.all_objects.filter(
+            tenant_id=tenant_id, **provider_filter
+        ).latest_ids_per_provider()

        findings_aggregated = (
            queryset.filter(scan_id__in=latest_scan_ids)
@@ -7933,18 +7941,13 @@ class FindingGroupViewSet(JsonApiFilterMixin, BaseRLSViewSet):

    def _get_latest_findings_per_provider(self, filtered_queryset):
        """Keep only findings from each provider's most recent completed scan."""
-        # Materialize to a literal IN list. Left as a subquery, Postgres can't
-        # estimate the match count and picks a serial nested loop on
-        # resource_finding_mappings when one scan dominates findings
-        latest_scan_ids = list(
-            Scan.objects.filter(
-                tenant_id=self.request.tenant_id,
-                state=StateChoices.COMPLETED,
-            )
-            .order_by("provider_id", "-completed_at", "-inserted_at")
-            .distinct("provider_id")
-            .values_list("id", flat=True)
-        )
+        # `latest_ids_per_provider` materializes to a literal IN list.
+        # Left as a subquery, Postgres can't estimate the match count and picks
+        # a serial nested loop on resource_finding_mappings when one scan
+        # dominates findings
+        latest_scan_ids = Scan.objects.filter(
+            tenant_id=self.request.tenant_id
+        ).latest_ids_per_provider()
        return filtered_queryset.filter(scan_id__in=latest_scan_ids)

    def _post_process_aggregation(self, aggregated_data):
@@ -8890,16 +8893,14 @@ class FindingGroupViewSet(JsonApiFilterMixin, BaseRLSViewSet):
        tenant_id = request.tenant_id
        queryset = self._get_finding_queryset()

-        # Order by -completed_at (matching the /latest summary path and the
-        # daily summary upsert keyed on midnight(completed_at)) so that
-        # overlapping scans do not make /resources and /latest read from
-        # different scans and report diverging counts.
-        latest_scan_ids = (
-            Scan.objects.filter(tenant_id=tenant_id, state=StateChoices.COMPLETED)
-            .order_by("provider_id", "-completed_at", "-inserted_at")
-            .distinct("provider_id")
-            .values_list("id", flat=True)
-        )
+        # The shared selector orders by -completed_at (matching the /latest
+        # summary path and the daily summary upsert keyed on
+        # midnight(completed_at)) so that overlapping scans do not make
+        # /resources and /latest read from different scans and report
+        # diverging counts.
+        latest_scan_ids = Scan.objects.filter(
+            tenant_id=tenant_id
+        ).latest_ids_per_provider()

        normalized_params = self._normalize_jsonapi_params(request.query_params)
        # Remove date filters since we're using latest
@@ -231,6 +231,62 @@ LOGGING = {
            "level": LEVEL,
            "propagate": False,
        },
+        # Celery loggers must be declared explicitly because
+        # disable_existing_loggers=True silences any logger that exists at
+        # dictConfig time but is not named here. Without these, fatal worker
+        # errors (e.g. celery.worker CRITICAL) produce no output.
+        # "celery" must keep propagating: get_task_logger() parents task
+        # loggers under celery.task, so blocking here hides them from root.
+        "celery": {
+            "level": LEVEL,
+            "propagate": True,
+        },
+        "celery.worker": {
+            "handlers": ["tasks_console"],
+            "level": LEVEL,
+            "propagate": False,
+        },
+        "celery.worker.consumer": {
+            "handlers": ["tasks_console"],
+            "level": LEVEL,
+            "propagate": False,
+        },
+        "celery.worker.consumer.consumer": {
+            "handlers": ["tasks_console"],
+            "level": LEVEL,
+            "propagate": False,
+        },
+        "kombu": {
+            "handlers": ["tasks_console"],
+            "level": LEVEL,
+            "propagate": False,
+        },
+        "kombu.transport.redis": {
+            "handlers": ["tasks_console"],
+            "level": LEVEL,
+            "propagate": False,
+        },
+        "billiard": {
+            "handlers": ["tasks_console"],
+            "level": LEVEL,
+            "propagate": False,
+        },
+        "amqp": {
+            "handlers": ["tasks_console"],
+            "level": LEVEL,
+            "propagate": False,
+        },
+        # WARNING keeps task failures but skips one "succeeded" line per task.
+        "celery.app.trace": {
+            "handlers": ["tasks_console"],
+            "level": "WARNING",
+            "propagate": False,
+        },
+        "celery.beat": {
+            "handlers": ["tasks_console"],
+            "level": LEVEL,
+            "propagate": False,
+        },
    },
    # Gunicorn required configuration
    "root": {
@@ -7,6 +7,7 @@ from config.settings.eventstream import *  # noqa
 from config.settings.partitions import *  # noqa
 from config.settings.sentry import *  # noqa
 from config.settings.social_login import *  # noqa
+from django.core.exceptions import ImproperlyConfigured

 SECRET_KEY = env("SECRET_KEY", default="secret")
 DEBUG = env.bool("DJANGO_DEBUG", default=False)
@@ -295,6 +296,14 @@ DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY = env.str(
 )
 DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN = env.str("DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN", "")
 DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION = env.str("DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION", "")
+# Storage endpoint the API and Celery workers use to talk to S3-compatible object storage
+# such as MinIO. Empty means the real AWS S3 endpoint, which is unaffected.
+DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL = env.str("DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL", "")
+# Browser-reachable storage host used to sign download URLs. Empty means sign against the
+# same endpoint the API talks to, which is what Prowler Cloud on S3 does.
+DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL = env.str(
+    "DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL", ""
+)

 # HTTP Security Headers
 SECURE_CONTENT_TYPE_NOSNIFF = True
@@ -320,6 +329,17 @@ ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES = env.int(
    "ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES", 960
 )  # 16h

+# Minimum age (of the scan row, or of the scan id itself when the row is gone) before
+# the periodic reaper will drop an orphaned temp Neo4j database. Keeps a scan that is
+# still legitimately in flight from ever losing its staging database mid-run.
+ATTACK_PATHS_TMP_DB_REAP_SAFETY_MARGIN_HOURS = env.int(
+    "ATTACK_PATHS_TMP_DB_REAP_SAFETY_MARGIN_HOURS", 6
+)
+if ATTACK_PATHS_TMP_DB_REAP_SAFETY_MARGIN_HOURS <= 0:
+    raise ImproperlyConfigured(
+        "ATTACK_PATHS_TMP_DB_REAP_SAFETY_MARGIN_HOURS must be a positive number of hours"
+    )
+
 # Selects where the persistent attack-paths graph is stored. The scan
 # temporary database is always Neo4j; only the sink is configurable.
 # Valid values: "neo4j" (default, OSS and local dev), "neptune" (hosted).
@@ -193,10 +193,10 @@ def initialize_sentry():

    sentry_sdk.init(
        dsn=sentry_dsn,
-        # Add data like request headers and IP for users,
-        # see https://docs.sentry.io/platforms/python/data-management/data-collected/ for more info
        before_send=before_send,
-        send_default_pii=True,
+        # No user identity, IPs, cookies, headers or request bodies: bodies carry emails and provider details.
+        send_default_pii=False,
+        max_request_body_size="never",
        traces_sample_rate=env.float("DJANGO_SENTRY_TRACES_SAMPLE_RATE", default=0.02),
        _experiments={
            # Set continuous_profiling_auto_start to True
@@ -0,0 +1,107 @@
+"""Periodic reaper for orphaned temp Neo4j scan databases.
+
+`scan.py` creates a throw-away `db-tmp-scan-<attack_paths_scan_id>` database per
+scan and drops it once the scan finishes, success or failure. When the worker
+or Neo4j itself dies mid-scan, that drop never runs and nothing else ever
+revisits the database - it sits there forever. This sweep lists every temp
+database on the ingest cluster and drops the ones whose scan is gone or has
+been finished for longer than the configured safety margin.
+"""
+
+from datetime import UTC, datetime, timedelta
+
+from api.attack_paths import database as graph_database
+from api.db_router import MainRouter
+from api.models import AttackPathsScan, StateChoices
+from api.uuid_utils import datetime_from_uuid7
+from celery.utils.log import get_task_logger
+from config.django.base import ATTACK_PATHS_TMP_DB_REAP_SAFETY_MARGIN_HOURS
+from uuid6 import UUID as UUID7
+
+logger = get_task_logger(__name__)
+
+TERMINAL_STATES = (
+    StateChoices.COMPLETED,
+    StateChoices.FAILED,
+    StateChoices.CANCELLED,
+)
+
+
+def reap_orphaned_tmp_databases() -> dict:
+    """Drop temp Neo4j scan databases whose scan is gone or long finished.
+
+    A failure listing databases aborts the whole sweep (nothing to iterate).
+    A failure reaping one database is logged and skipped so the rest of the
+    sweep still runs.
+    """
+    now = datetime.now(tz=UTC)
+    safety_margin = timedelta(hours=ATTACK_PATHS_TMP_DB_REAP_SAFETY_MARGIN_HOURS)
+
+    try:
+        databases = graph_database.list_databases()
+    except Exception:
+        logger.exception("Failed to list ingest Neo4j databases for temp-db reap")
+        return {"dropped_count": 0, "databases": []}
+
+    tmp_databases = [
+        name for name in databases if name.startswith(graph_database.TEMP_DB_PREFIX)
+    ]
+
+    dropped: list[str] = []
+    for database in tmp_databases:
+        try:
+            if _is_orphaned(database, now, safety_margin):
+                graph_database.drop_database(database)
+                dropped.append(database)
+                logger.info(f"Dropped orphaned temp Neo4j database `{database}`")
+        except Exception:
+            logger.exception(f"Failed to reap temp Neo4j database `{database}`")
+
+    logger.info(f"Temp Neo4j database reap: {len(dropped)} dropped")
+    return {"dropped_count": len(dropped), "databases": dropped}
+
+
+def _is_orphaned(database: str, now: datetime, safety_margin: timedelta) -> bool:
+    """Decide whether a temp database is safe to drop.
+
+    No scan row: the row was hard-deleted (tenant/provider cleanup) or was
+    never created. Falls back to the scan id's own UUIDv7 timestamp so a
+    database created moments ago is never touched even without a row to check.
+
+    Scan row present: only reapable once it reached a terminal state and has
+    been finished for longer than the safety margin, so a scan still
+    legitimately executing is never touched.
+    """
+    scan_id = database[len(graph_database.TEMP_DB_PREFIX) :]
+
+    try:
+        scan_uuid = UUID7(scan_id)
+    except ValueError:
+        logger.warning(
+            f"Temp database `{database}` has an unparseable scan id, skipping"
+        )
+        return False
+
+    # Global sweep with no tenant context: admin_db bypasses RLS on purpose, the same
+    # way cleanup_stale_attack_paths_scans finds stale scans across every tenant.
+    scan = (
+        AttackPathsScan.all_objects.using(MainRouter.admin_db)
+        .filter(id=scan_uuid)
+        .first()
+    )
+
+    if scan is None:
+        if scan_uuid.version != 7:
+            logger.warning(
+                f"Temp database `{database}` has no scan row and a non-UUIDv7 id, "
+                "skipping"
+            )
+            return False
+        return now - datetime_from_uuid7(scan_uuid) >= safety_margin
+
+    if scan.state not in TERMINAL_STATES:
+        return False
+
+    # `mark_scan_finished` does not touch `updated_at`, so prefer `completed_at`
+    finished_at = scan.completed_at or scan.updated_at
+    return now - finished_at >= safety_margin
@@ -499,10 +499,13 @@ def backfill_provider_compliance_scores(tenant_id: str) -> dict:
                provider_id__in=existing_providers
            )

+        # `completed_scans` keeps its own `completed_at__isnull=False`: this
+        # task writes a *dated* ProviderComplianceScore row, so unlike the read
+        # paths it genuinely cannot use a scan without a `completed_at`.
        scan_info = list(
-            completed_scans.order_by("provider_id", "-completed_at")
-            .distinct("provider_id")
-            .values("id", "provider_id", "completed_at")
+            completed_scans.latest_per_provider().values(
+                "id", "provider_id", "completed_at"
+            )
        )

        if not scan_info:
@@ -13,6 +13,7 @@ from api.models import (
    Tenant,
 )
 from celery.utils.log import get_task_logger
+from django.conf import settings
 from django.db import DatabaseError
 from tasks.jobs.queries import (
    COMPLIANCE_DELETE_EMPTY_TENANT_SUMMARY_SQL,
@@ -106,9 +107,19 @@ def delete_provider(tenant_id: str, pk: str):
    try:
        if attack_paths_sink_backends:
            for sink_backend in attack_paths_sink_backends:
-                sink_module.get_backend_for_name(sink_backend).drop_subgraph(
-                    tenant_database_name, str(pk)
-                )
+                try:
+                    backend = sink_module.get_backend_for_name(sink_backend)
+
+                except RuntimeError as sink_error:
+                    # A retired sink has no connection settings left, and no graph left to drop
+                    if sink_backend == settings.ATTACK_PATHS_SINK_DATABASE.lower():
+                        raise
+                    logger.warning(
+                        f"Skipping graph cleanup on unconfigured sink {sink_backend}: {sink_error}"
+                    )
+                    continue
+
+                backend.drop_subgraph(tenant_database_name, str(pk))
        else:
            graph_database.drop_subgraph(tenant_database_name, str(pk))

@@ -6,6 +6,7 @@ import boto3
 import config.django.base as base
 from api.db_utils import rls_transaction
 from api.models import Scan
+from botocore.config import Config
 from botocore.exceptions import ClientError, NoCredentialsError, ParamValidationError
 from celery.utils.log import get_task_logger
 from django.conf import settings
@@ -206,15 +207,21 @@ def get_s3_client():
    This function attempts to initialize an S3 client by reading the AWS access key, secret key,
    session token, and region from environment variables. It then validates the client by listing
    available S3 buckets. If an error occurs during this process (for example, due to missing or
-    invalid credentials), it falls back to creating an S3 client without explicitly provided credentials,
-    which may rely on other configuration sources (e.g., IAM roles).
+    invalid credentials), it falls back to creating an S3 client without explicitly provided
+    credentials, which may rely on other configuration sources (e.g., IAM roles).
+
+    That fallback is only safe when no explicit endpoint is configured: with an endpoint set, the
+    explicit client already targets the intended S3-compatible storage, and the fallback client
+    would go to the AWS default provider chain instead, an unrelated real-AWS account reachable
+    from the host. So when an endpoint is configured, the original error propagates instead.

    Returns:
        boto3.client: A configured S3 client instance.

    Raises:
-        ClientError, NoCredentialsError, or ParamValidationError if both attempts to create a client fail.
+        ClientError, NoCredentialsError, or ParamValidationError if the client cannot be created.
    """
+    endpoint = settings.DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL
    s3_client = None
    try:
        s3_client = boto3.client(
@@ -222,16 +229,68 @@ def get_s3_client():
            aws_access_key_id=settings.DJANGO_OUTPUT_S3_AWS_ACCESS_KEY_ID,
            aws_secret_access_key=settings.DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY,
            aws_session_token=settings.DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN,
-            region_name=settings.DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION,
+            # Storage that has no meaningful region, MinIO among it, is usually configured
+            # without one, and botocore rejects an empty region before any request is made.
+            region_name=settings.DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION or "us-east-1",
+            endpoint_url=endpoint or None,
        )
        s3_client.list_buckets()
    except (ClientError, NoCredentialsError, ParamValidationError, ValueError):
+        if endpoint:
+            raise
        s3_client = boto3.client("s3")
        s3_client.list_buckets()

    return s3_client


+def get_s3_presign_client():
+    """Return a client that signs download URLs with SigV4.
+
+    It is used when a public or internal storage host is configured, or when the bucket's
+    region is: boto3 otherwise presigns S3 URLs with SigV2, which S3 rejects for SSE-KMS
+    objects. None means none of those is set and the caller should presign with its own
+    client, which leaves those deployments with the URL they get today.
+
+    The public endpoint wins when both are set: the internal endpoint may only be reachable
+    from inside the cluster, and a URL signed against it would not open in a browser.
+    """
+    endpoint = (
+        settings.DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL
+        or settings.DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL
+    )
+    if not endpoint and not settings.DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION:
+        return None
+
+    # Blank keys are signed as-is (empty credential scope) instead of deferring to the
+    # provider chain, so static credentials are only passed when they are set.
+    credentials = {}
+    if (
+        settings.DJANGO_OUTPUT_S3_AWS_ACCESS_KEY_ID
+        and settings.DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY
+    ):
+        credentials = {
+            "aws_access_key_id": settings.DJANGO_OUTPUT_S3_AWS_ACCESS_KEY_ID,
+            "aws_secret_access_key": settings.DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY,
+            # An empty string is a token as far as botocore is concerned: it appends an
+            # empty X-Amz-Security-Token that storage counts when it recomputes the signature.
+            "aws_session_token": settings.DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN or None,
+        }
+
+    return boto3.client(
+        "s3",
+        **credentials,
+        # SigV4 puts the region in the credential scope, and MinIO answers to us-east-1
+        # unless it was told otherwise, so an empty region would sign an unusable URL.
+        region_name=settings.DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION or "us-east-1",
+        endpoint_url=endpoint or None,
+        # The signature covers the host, so the addressing style has to be pinned rather
+        # than guessed from the endpoint: MinIO serves path-style, and on AWS it keeps the
+        # regional host instead of the global one, which redirects for new buckets.
+        config=Config(signature_version="s3v4", s3={"addressing_style": "path"}),
+    )
+
+
 def _upload_to_s3(
    tenant_id: str, scan_id: str, local_path: str, relative_key: str
 ) -> str | None:
@@ -1,7 +1,7 @@
 from collections.abc import Iterable

 from api.db_utils import rls_transaction
-from api.models import Finding, MuteRule, Scan, StateChoices
+from api.models import Finding, MuteRule, Scan
 from celery.utils.log import get_task_logger

 logger = get_task_logger(__name__)
@@ -39,17 +39,9 @@ def mute_findings_in_latest_scans(

    with rls_transaction(tenant_id):
        mute_rule = MuteRule.objects.get(id=mute_rule_id, tenant_id=tenant_id)
-        latest_scans = list(
-            Scan.objects.filter(
-                tenant_id=tenant_id,
-                provider_id__in=provider_ids,
-                state=StateChoices.COMPLETED,
-                completed_at__isnull=False,
-            )
-            .order_by("provider_id", "-completed_at", "-inserted_at", "-id")
-            .distinct("provider_id")
-            .values_list("id", flat=True)
-        )
+        latest_scans = Scan.objects.filter(
+            tenant_id=tenant_id, provider_id__in=provider_ids
+        ).latest_ids_per_provider()

        changed_scan_ids = []
        findings_muted = 0
@@ -84,6 +84,7 @@ _SKIP_RECOVERY = {
    "scan-perform-scheduled",
    "attack-paths-scan-perform",
    "attack-paths-cleanup-stale-scans",
+    "attack-paths-reap-orphaned-tmp-databases",
    "reconcile-orphan-tasks",
 }

@@ -5,7 +5,6 @@ import json
 import random
 import re
 import time
-import uuid
 from collections import defaultdict
 from collections.abc import Callable, Iterable
 from datetime import UTC, datetime
@@ -73,6 +72,7 @@ from tasks.jobs.queries import (
    COMPLIANCE_UPSERT_TENANT_SUMMARY_SQL,
 )
 from tasks.utils import CustomEncoder, batched
+from uuid6 import uuid7

 logger = get_task_logger(__name__)

@@ -1756,32 +1756,27 @@ def aggregate_findings(tenant_id: str, scan_id: str):


 def _aggregate_findings_by_region(
-    tenant_id: str, scan_id: str, modeled_threatscore_compliance_id: str
+    tenant_id: str,
+    scan_id: str,
+    normalized_threatscore_id: str,
+    threatscore_requirements_by_check: dict[str, list[str]],
 ) -> tuple[dict, dict]:
    """
    Aggregate findings by region using streaming, column-scoped ORM reads.

    Reads only the consumed columns as tuples via ``values_list`` and streams
    them with ``.iterator()``, using the denormalized ``resource_regions`` array
-    instead of ``prefetch_related("resources")``. ``resource_regions`` mirrors the
-    regions of a finding's related resources, so it yields the same per-region
-    tally without joining the resource table.
-
-    Args:
-        tenant_id: Tenant UUID
-        scan_id: Scan UUID
-        modeled_threatscore_compliance_id: ID for ThreatScore compliance framework
+    instead of ``prefetch_related("resources")``. ThreatScore requirement ids
+    are resolved per ``check_id`` from ``threatscore_requirements_by_check``.

    Returns:
        tuple: (check_status_by_region, findings_count_by_compliance)
            - check_status_by_region: {region: {check_id: status}}
-            - findings_count_by_compliance: {region: {normalized_id: {requirement_id: {total, pass}}}}
+            - findings_count_by_compliance: {region: {normalized_threatscore_id: {requirement_id: {total, pass}}}}
    """
    check_status_by_region: dict = {}
    findings_count_by_compliance: dict = {}

-    normalized_id = re.sub(r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower())
-
    with rls_transaction(tenant_id, using=READ_REPLICA_ALIAS):
        findings = (
            Finding.all_objects.filter(
@@ -1790,14 +1785,12 @@ def _aggregate_findings_by_region(
                muted=False,
                status__in=["PASS", "FAIL"],
            )
-            .values_list("check_id", "status", "resource_regions", "compliance")
+            .values_list("check_id", "status", "resource_regions")
            .iterator(chunk_size=DJANGO_FINDINGS_BATCH_SIZE)
        )

-        for check_id, status, resource_regions, compliance in findings:
-            threatscore_requirements = (compliance or {}).get(
-                modeled_threatscore_compliance_id
-            )
+        for check_id, status, resource_regions in findings:
+            threatscore_requirements = threatscore_requirements_by_check.get(check_id)

            for region in resource_regions or ():
                # Priority: FAIL > any other status
@@ -1809,7 +1802,7 @@ def _aggregate_findings_by_region(
                if threatscore_requirements:
                    compliance_key = findings_count_by_compliance.setdefault(
                        region, {}
-                    ).setdefault(normalized_id, {})
+                    ).setdefault(normalized_threatscore_id, {})

                    for requirement_id in threatscore_requirements:
                        requirement_stats = compliance_key.setdefault(
@@ -1848,15 +1841,28 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
        compliance_template = PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE[
            provider_instance.provider
        ]
-        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+        normalized_threatscore_id = _normalized_compliance_key(
+            "ProwlerThreatScore", "1.0"
+        )

        requirement_lookup: dict[str, list[tuple[str, str]]] = {}
+        threatscore_requirements_by_check: dict[str, list[str]] = {}
        for compliance_id, compliance in compliance_template.items():
+            is_threatscore = (
+                _normalized_compliance_key(
+                    compliance["framework"], compliance["version"]
+                )
+                == normalized_threatscore_id
+            )
            for requirement_id, requirement in compliance["requirements"].items():
                for check_id in requirement["checks"].keys():
                    requirement_lookup.setdefault(check_id, []).append(
                        (compliance_id, requirement_id)
                    )
+                    if is_threatscore:
+                        threatscore_requirements_by_check.setdefault(
+                            check_id, []
+                        ).append(requirement_id)

        regions = []
        requirements_created = 0
@@ -1869,7 +1875,10 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
            # Aggregate findings by region using SQL for optimal performance
            check_status_by_region, findings_count_by_compliance = (
                _aggregate_findings_by_region(
-                    tenant_id, scan_id, modeled_threatscore_compliance_id
+                    tenant_id,
+                    scan_id,
+                    normalized_threatscore_id,
+                    threatscore_requirements_by_check,
                )
            )

@@ -1934,23 +1943,35 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
            # Yield rows lazily (consumed batch-by-batch by COPY) so peak memory
            # stays bounded; tally requirement_statuses in the same pass. The
            # ORM fallback re-iterates from scratch, so the tally resets first.
+            # Region is the innermost loop so consecutive rows share the leading
+            # columns of the table's secondary indexes.
            def _iter_compliance_requirement_rows():
                requirement_statuses.clear()
-                for region in regions:
-                    region_stats = region_requirement_stats.get(region, {})
-                    region_findings = findings_count_by_compliance.get(region, {})
-                    for (
-                        compliance_id,
-                        framework,
-                        version,
-                        modeled_compliance_id,
-                        requirements,
-                    ) in compliance_plan:
-                        compliance_stats = region_stats.get(compliance_id, {})
-                        compliance_findings = region_findings.get(
-                            modeled_compliance_id, {}
+                for (
+                    compliance_id,
+                    framework,
+                    version,
+                    modeled_compliance_id,
+                    requirements,
+                ) in compliance_plan:
+                    stats_by_region = [
+                        (
+                            region,
+                            region_requirement_stats.get(region, {}).get(
+                                compliance_id, {}
+                            ),
+                            findings_count_by_compliance.get(region, {}).get(
+                                modeled_compliance_id, {}
+                            ),
                        )
-                        for requirement_id, description, total_checks in requirements:
+                        for region in regions
+                    ]
+                    for requirement_id, description, total_checks in requirements:
+                        for (
+                            region,
+                            compliance_stats,
+                            compliance_findings,
+                        ) in stats_by_region:
                            stats = compliance_stats.get(requirement_id)
                            if stats:
                                passed_checks = stats["passed_checks"]
@@ -1981,7 +2002,7 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                                requirement_statuses[key]["pass_count"] += 1

                            yield {
-                                "id": uuid.uuid4(),
+                                "id": uuid7(),
                                "tenant_id": tenant_id_str,
                                "inserted_at": utc_datetime_now,
                                "compliance_id": compliance_id,
@@ -2092,7 +2113,9 @@ def aggregate_attack_surface(tenant_id: str, scan_id: str):
            .annotate(
                total=Count("id"),
                failed=Count("id", filter=Q(status="FAIL", muted=False)),
-                muted=Count("id", filter=Q(status="FAIL", muted=True)),
+                # Not `muted`: an annotation named after a model field comes
+                # back as `muted_new` from the psqlextra queryset.
+                muted_count=Count("id", filter=Q(status="FAIL", muted=True)),
            )
        )

@@ -2103,7 +2126,7 @@ def aggregate_attack_surface(tenant_id: str, scan_id: str):

            aggregated_counts[attack_surface_type]["total"] += stats["total"] or 0
            aggregated_counts[attack_surface_type]["failed"] += stats["failed"] or 0
-            aggregated_counts[attack_surface_type]["muted"] += stats["muted"] or 0
+            aggregated_counts[attack_surface_type]["muted"] += stats["muted_count"] or 0

    overview_objects = []
    for attack_surface_type, counts in aggregated_counts.items():
@@ -2679,20 +2702,37 @@ def reset_ephemeral_resource_findings_count(tenant_id: str, scan_id: str) -> dic
    # refreshed). Wiping based on the older scan would zero counts the newer
    # scan just set. Skip and let the newer scan's reset task do the work; if
    # this task was delayed in the queue, that's the correct outcome.
-    # `completed_at__isnull=False` is required: Postgres orders NULL first in
-    # DESC, so a sibling COMPLETED scan with a missing completed_at would sort
-    # as "newest" and incorrectly cause us to skip.
+    #
+    # The comparison must be against the newest *full-scope* scan, which is
+    # what this variable has always been named after but did not use to be:
+    # the query filtered nothing about scope, so any newer scan that is not
+    # full-scope (an imported one, for instance) made the full-scope scan
+    # skip its own cleanup and leave ephemeral resources with a stale
+    # failed_findings_count permanently.
+    #
+    # `is_full_scope()` reads `trigger` plus the scoping keys inside
+    # `scanner_args`, which is not expressible as a WHERE clause, so the
+    # candidates are walked newest-first in Python until the first full-scope
+    # one. The walk needs no cap: `scan` is itself a full-scope candidate, so
+    # it stops at `scan` at the latest, after reading only the scans newer than
+    # it. A fixed window would return None once more newer scoped scans had
+    # landed than it inspected, and skip the cleanup exactly like the bug above.
+    #
+    # NULL `completed_at` no longer needs an explicit filter here: the shared
+    # ordering in `ScanQuerySet.LATEST_ORDER_BY` sorts NULLs last
+    # rather than excluding them, which also fixes the case where a provider
+    # whose completed scans all have a NULL `completed_at` resolved to None and
+    # therefore never ran the reset at all.
    with rls_transaction(tenant_id):
-        latest_full_scope_scan_id = (
-            Scan.objects.filter(
-                tenant_id=tenant_id,
-                provider_id=scan.provider_id,
-                state=StateChoices.COMPLETED,
-                completed_at__isnull=False,
-            )
-            .order_by("-completed_at", "-inserted_at")
-            .values_list("id", flat=True)
-            .first()
+        candidates = (
+            Scan.objects.filter(tenant_id=tenant_id, provider_id=scan.provider_id)
+            .latest_first()
+            .only("id", "trigger", "scanner_args")
+            .iterator(chunk_size=100)
+        )
+        latest_full_scope_scan_id = next(
+            (candidate.id for candidate in candidates if candidate.is_full_scope()),
+            None,
        )
    if latest_full_scope_scan_id != scan.id:
        logger.info(
@@ -1,3 +1,4 @@
+import json
 import os
 from datetime import UTC, datetime, timedelta
 from pathlib import Path
@@ -42,6 +43,7 @@ from tasks.jobs.attack_paths import (
 )
 from tasks.jobs.attack_paths import db_utils as attack_paths_db_utils
 from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
+from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
 from tasks.jobs.backfill import (
    aggregate_scan_category_summaries,
    aggregate_scan_resource_group_summaries,
@@ -163,13 +165,28 @@ def create_scan_task_record(
    task_id: str,
    task_name: str = "scan-perform",
    task_status: str | None = states.PENDING,
+    task_kwargs: dict | None = None,
 ) -> Task:
+    """Pre-create the TaskResult + Task rows for a pre-generated task id.
+
+    Pass ``task_kwargs`` when the response built from this record is serialized
+    before the broker publish. ``task_kwargs`` is otherwise only written by the
+    ``before_task_publish`` signal (``api/signals.py``), and the scan publish is
+    deferred to ``on_commit``, so the 202 would carry an empty ``task_args`` and
+    the caller would have no way to learn the scan id it was just handed a task
+    for. The publish later overwrites the field with the same kwargs as a Python
+    repr; both forms decode to the same dict (``decode_celery_field``).
+    """
    if task_status is None:
        task_status = states.PENDING

+    defaults = {"status": task_status, "task_name": task_name}
+    if task_kwargs is not None:
+        defaults["task_kwargs"] = json.dumps(task_kwargs)
+
    task_result, _ = TaskResult.objects.update_or_create(
        task_id=str(task_id),
-        defaults={"status": task_status, "task_name": task_name},
+        defaults=defaults,
    )
    prowler_task, _ = Task.objects.update_or_create(
        id=str(task_id),
@@ -711,6 +728,13 @@ def cleanup_stale_attack_paths_scans_task():
    return cleanup_stale_attack_paths_scans()


+@shared_task(
+    name="attack-paths-reap-orphaned-tmp-databases", queue="attack-paths-scans"
+)
+def reap_orphaned_attack_paths_tmp_databases_task():
+    return reap_orphaned_tmp_databases()
+
+
@shared_task(name="reconcile-orphan-tasks", queue="celery")
 def reconcile_orphan_tasks_task():
    """Periodic watchdog: recover tasks whose worker is gone (deploys, crashes)."""
@@ -0,0 +1,286 @@
+from datetime import UTC, datetime, timedelta
+from unittest.mock import patch
+from uuid import uuid4
+
+import pytest
+from api.attack_paths.database import TEMP_DB_PREFIX
+from api.models import AttackPathsScan, StateChoices
+from api.uuid_utils import datetime_to_uuid7
+from config.django.base import ATTACK_PATHS_TMP_DB_REAP_SAFETY_MARGIN_HOURS
+
+MARGIN = timedelta(hours=ATTACK_PATHS_TMP_DB_REAP_SAFETY_MARGIN_HOURS)
+
+
+def _tmp_db_name(scan_uuid) -> str:
+    return f"{TEMP_DB_PREFIX}{scan_uuid}"
+
+
+@pytest.mark.django_db
+class TestReapOrphanedTmpDatabases:
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_ignores_databases_without_the_temp_prefix(self, mock_list, mock_drop):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        mock_list.return_value = ["db-tenant-abc123", "system", "neo4j"]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 0, "databases": []}
+        mock_drop.assert_not_called()
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_drops_temp_db_with_no_scan_row_past_safety_margin(
+        self, mock_list, mock_drop
+    ):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        old_scan_id = datetime_to_uuid7(
+            datetime.now(tz=UTC) - MARGIN - timedelta(hours=1)
+        )
+        database = _tmp_db_name(old_scan_id)
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 1, "databases": [database]}
+        mock_drop.assert_called_once_with(database)
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_preserves_temp_db_with_no_scan_row_inside_safety_margin(
+        self, mock_list, mock_drop
+    ):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        recent_scan_id = datetime_to_uuid7(datetime.now(tz=UTC) - timedelta(minutes=5))
+        database = _tmp_db_name(recent_scan_id)
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 0, "databases": []}
+        mock_drop.assert_not_called()
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_preserves_temp_db_with_unparseable_scan_id(self, mock_list, mock_drop):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        database = f"{TEMP_DB_PREFIX}not-a-uuid"
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 0, "databases": []}
+        mock_drop.assert_not_called()
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_drops_terminal_scan_past_safety_margin(
+        self, mock_list, mock_drop, tenants_fixture, aws_provider
+    ):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        tenant = tenants_fixture[0]
+        old_updated_at = datetime.now(tz=UTC) - MARGIN - timedelta(hours=1)
+        scan = AttackPathsScan.objects.create(
+            tenant_id=tenant.id,
+            provider=aws_provider,
+            state=StateChoices.COMPLETED,
+        )
+        AttackPathsScan.objects.filter(id=scan.id).update(updated_at=old_updated_at)
+
+        database = _tmp_db_name(scan.id)
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 1, "databases": [database]}
+        mock_drop.assert_called_once_with(database)
+
+    @pytest.mark.parametrize(
+        "state",
+        [StateChoices.FAILED, StateChoices.CANCELLED],
+    )
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_drops_other_terminal_states_past_safety_margin(
+        self, mock_list, mock_drop, tenants_fixture, aws_provider, state
+    ):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        tenant = tenants_fixture[0]
+        old_updated_at = datetime.now(tz=UTC) - MARGIN - timedelta(hours=1)
+        scan = AttackPathsScan.objects.create(
+            tenant_id=tenant.id,
+            provider=aws_provider,
+            state=state,
+        )
+        AttackPathsScan.objects.filter(id=scan.id).update(updated_at=old_updated_at)
+
+        database = _tmp_db_name(scan.id)
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result["dropped_count"] == 1
+        mock_drop.assert_called_once_with(database)
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_preserves_terminal_scan_inside_safety_margin(
+        self, mock_list, mock_drop, tenants_fixture, aws_provider
+    ):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        tenant = tenants_fixture[0]
+        scan = AttackPathsScan.objects.create(
+            tenant_id=tenant.id,
+            provider=aws_provider,
+            state=StateChoices.COMPLETED,
+        )
+
+        database = _tmp_db_name(scan.id)
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 0, "databases": []}
+        mock_drop.assert_not_called()
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_margin_counts_from_completed_at_not_updated_at(
+        self, mock_list, mock_drop, tenants_fixture, aws_provider
+    ):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        tenant = tenants_fixture[0]
+        old = datetime.now(tz=UTC) - MARGIN - timedelta(hours=1)
+        scan = AttackPathsScan.objects.create(
+            tenant_id=tenant.id,
+            provider=aws_provider,
+            state=StateChoices.COMPLETED,
+        )
+        AttackPathsScan.objects.filter(id=scan.id).update(
+            updated_at=old, completed_at=datetime.now(tz=UTC)
+        )
+
+        database = _tmp_db_name(scan.id)
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 0, "databases": []}
+        mock_drop.assert_not_called()
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_drops_scan_completed_past_safety_margin(
+        self, mock_list, mock_drop, tenants_fixture, aws_provider
+    ):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        tenant = tenants_fixture[0]
+        old = datetime.now(tz=UTC) - MARGIN - timedelta(hours=1)
+        scan = AttackPathsScan.objects.create(
+            tenant_id=tenant.id,
+            provider=aws_provider,
+            state=StateChoices.FAILED,
+        )
+        AttackPathsScan.objects.filter(id=scan.id).update(
+            updated_at=old, completed_at=old
+        )
+
+        database = _tmp_db_name(scan.id)
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 1, "databases": [database]}
+        mock_drop.assert_called_once_with(database)
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_never_drops_an_executing_scan_regardless_of_age(
+        self, mock_list, mock_drop, tenants_fixture, aws_provider
+    ):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        tenant = tenants_fixture[0]
+        very_old = datetime.now(tz=UTC) - timedelta(days=30)
+        scan = AttackPathsScan.objects.create(
+            tenant_id=tenant.id,
+            provider=aws_provider,
+            state=StateChoices.EXECUTING,
+        )
+        AttackPathsScan.objects.filter(id=scan.id).update(updated_at=very_old)
+
+        database = _tmp_db_name(scan.id)
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 0, "databases": []}
+        mock_drop.assert_not_called()
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_one_failed_drop_does_not_stop_the_rest_of_the_sweep(
+        self, mock_list, mock_drop
+    ):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        old_time = datetime.now(tz=UTC) - MARGIN - timedelta(hours=1)
+        failing_scan_id = datetime_to_uuid7(old_time)
+        succeeding_scan_id = datetime_to_uuid7(old_time)
+        failing_db = _tmp_db_name(failing_scan_id)
+        succeeding_db = _tmp_db_name(succeeding_scan_id)
+        mock_list.return_value = [failing_db, succeeding_db]
+        mock_drop.side_effect = [Exception("boom"), None]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 1, "databases": [succeeding_db]}
+        assert mock_drop.call_count == 2
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_returns_empty_result_when_listing_databases_fails(self, mock_list):
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        mock_list.side_effect = Exception("neo4j unreachable")
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 0, "databases": []}
+
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.drop_database")
+    @patch("tasks.jobs.attack_paths.tmp_db_reaper.graph_database.list_databases")
+    def test_preserves_temp_db_with_random_uuid_and_no_row(self, mock_list, mock_drop):
+        """A non-UUIDv7 id with no matching row has no reliable timestamp, so it
+        must be left alone rather than guessed at."""
+        from tasks.jobs.attack_paths.tmp_db_reaper import reap_orphaned_tmp_databases
+
+        database = _tmp_db_name(uuid4())
+        mock_list.return_value = [database]
+
+        result = reap_orphaned_tmp_databases()
+
+        assert result == {"dropped_count": 0, "databases": []}
+        mock_drop.assert_not_called()
+
+
+class TestReapOrphanedTmpDatabasesTask:
+    @patch(
+        "tasks.tasks.reap_orphaned_tmp_databases",
+        return_value={"dropped_count": 2, "databases": ["db-tmp-scan-a"]},
+    )
+    def test_task_invokes_the_reaper(self, mock_reap):
+        from tasks.tasks import reap_orphaned_attack_paths_tmp_databases_task
+
+        result = reap_orphaned_attack_paths_tmp_databases_task.run()
+
+        assert result == {"dropped_count": 2, "databases": ["db-tmp-scan-a"]}
+        mock_reap.assert_called_once_with()
@@ -4,6 +4,7 @@ import pytest
 from api.attack_paths import database as graph_database
 from api.models import Provider, Tenant, TenantComplianceSummary
 from django.core.exceptions import ObjectDoesNotExist
+from django.test import override_settings
 from tasks.jobs.deletion import delete_provider, delete_tenant


@@ -123,6 +124,60 @@ class TestDeleteProvider:
            "tenant-db", str(instance.id)
        )

+    @override_settings(ATTACK_PATHS_SINK_DATABASE="neo4j")
+    def test_delete_provider_skips_unconfigured_retired_sink(
+        self, aws_provider, create_attack_paths_scan
+    ):
+        instance = aws_provider
+        tenant_id = str(instance.tenant_id)
+        create_attack_paths_scan(instance, sink_backend="neo4j")
+        create_attack_paths_scan(instance, sink_backend="neptune")
+        neo4j_backend = MagicMock()
+
+        def get_backend_for_name(name):
+            if name == "neptune":
+                raise RuntimeError("NEPTUNE_WRITER_ENDPOINT and AWS_REGION must be set")
+            return neo4j_backend
+
+        with (
+            patch(
+                "tasks.jobs.deletion.graph_database.get_database_name",
+                return_value="tenant-db",
+            ),
+            patch(
+                "tasks.jobs.deletion.sink_module.get_backend_for_name",
+                side_effect=get_backend_for_name,
+            ),
+            patch("tasks.jobs.deletion.graph_database.drop_database"),
+        ):
+            result = delete_provider(tenant_id, instance.id)
+
+        assert result
+        assert not Provider.all_objects.filter(pk=instance.id).exists()
+        neo4j_backend.drop_subgraph.assert_called_once_with(
+            "tenant-db", str(instance.id)
+        )
+
+    @override_settings(ATTACK_PATHS_SINK_DATABASE="neo4j")
+    def test_delete_provider_raises_when_active_sink_unconfigured(
+        self, aws_provider, create_attack_paths_scan
+    ):
+        instance = aws_provider
+        tenant_id = str(instance.tenant_id)
+        create_attack_paths_scan(instance, sink_backend="neo4j")
+
+        with (
+            patch(
+                "tasks.jobs.deletion.sink_module.get_backend_for_name",
+                side_effect=RuntimeError("NEO4J_HOST / NEO4J_PORT must be set"),
+            ),
+            patch("tasks.jobs.deletion.graph_database.drop_database"),
+            pytest.raises(RuntimeError),
+        ):
+            delete_provider(tenant_id, instance.id)
+
+        assert Provider.all_objects.filter(pk=instance.id).exists()
+
    def test_delete_provider_continues_when_temp_db_drop_fails(
        self, aws_provider, create_attack_paths_scan
    ):
@@ -149,10 +204,10 @@ class TestDeleteProvider:
        assert result
        assert not Provider.all_objects.filter(pk=instance.id).exists()

+    @pytest.mark.usefixtures("provider_compliance_scores_fixture")
    def test_delete_provider_recalculates_tenant_compliance_summary(
        self,
        aws_provider_pair,
-        provider_compliance_scores_fixture,
    ):
        instance = aws_provider_pair[0]
        tenant_id = instance.tenant_id
@@ -3,16 +3,20 @@ import uuid
 import zipfile
 from datetime import datetime
 from pathlib import Path
-from unittest.mock import MagicMock, patch
+from unittest.mock import MagicMock, call, patch
+from urllib.parse import parse_qs, urlparse

+import boto3
 import pytest
 from botocore.exceptions import ClientError
+from django.test import override_settings
 from tasks.jobs.export import (
    _compress_output_files,
    _generate_compliance_output_directory,
    _generate_output_directory,
    _upload_to_s3,
    get_s3_client,
+    get_s3_presign_client,
 )


@@ -47,15 +51,59 @@ class TestOutputs:
        assert client is not None
        client_mock.list_buckets.assert_called()

+    @patch("tasks.jobs.export.boto3.client")
+    @override_settings(
+        DJANGO_OUTPUT_S3_AWS_ACCESS_KEY_ID="access-key",
+        DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY="secret-key",
+        DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN="",
+        DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION="",
+    )
+    def test_get_s3_client_without_a_region_uses_a_default(self, mock_boto_client):
+        """botocore rejects an empty region up front, and the download views do not catch it."""
+        get_s3_client()
+
+        assert mock_boto_client.call_args.kwargs["region_name"] == "us-east-1"
+
+    @patch("tasks.jobs.export.boto3.client")
+    @override_settings(DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL="http://minio:9000")
+    def test_get_s3_client_passes_the_endpoint_when_set(self, mock_boto_client):
+        get_s3_client()
+
+        assert mock_boto_client.call_args.kwargs["endpoint_url"] == "http://minio:9000"
+
+    @patch("tasks.jobs.export.boto3.client")
+    @override_settings(DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL="")
+    def test_get_s3_client_endpoint_empty_by_default(self, mock_boto_client):
+        """Empty keeps today's behavior: no endpoint override, real S3 is used."""
+        get_s3_client()
+
+        assert mock_boto_client.call_args.kwargs["endpoint_url"] is None
+
+    @patch("tasks.jobs.export.boto3.client")
+    @override_settings(DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL="http://minio:9000")
+    def test_get_s3_client_does_not_fall_back_when_endpoint_set(self, mock_boto_client):
+        """A configured endpoint means the explicit client failed talking to it. The fallback
+        goes to the default provider chain (e.g. an EC2 instance role) against real AWS, so it
+        must not be used: the original error propagates instead."""
+        error = ClientError({"Error": {"Code": "403"}}, "ListBuckets")
+        mock_boto_client.side_effect = error
+
+        with pytest.raises(ClientError):
+            get_s3_client()
+
+        mock_boto_client.assert_called_once()
+
    @patch("tasks.jobs.export.boto3.client")
    @patch("tasks.jobs.export.settings")
    def test_get_s3_client_fallback(self, mock_settings, mock_boto_client):
+        mock_settings.DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL = ""
        mock_boto_client.side_effect = [
            ClientError({"Error": {"Code": "403"}}, "ListBuckets"),
            MagicMock(),
        ]
        client = get_s3_client()
        assert client is not None
+        assert mock_boto_client.call_args_list[1] == call("s3")

    @patch("tasks.jobs.export.get_s3_client")
    @patch("tasks.jobs.export.base")
@@ -243,3 +291,167 @@ class TestOutputs:
        assert os.path.isdir(os.path.dirname(ens))
        assert threatscore.endswith(f"aws-test-check-{expected_timestamp}")
        assert ens.endswith(f"aws-test-check-{expected_timestamp}")
+
+
+PRESIGN_SETTINGS = {
+    "DJANGO_OUTPUT_S3_AWS_ACCESS_KEY_ID": "access-key",
+    "DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY": "secret-key",
+    "DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN": "",
+    "DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION": "eu-west-1",
+}
+
+
+def _presign(client):
+    return client.generate_presigned_url(
+        "get_object",
+        Params={"Bucket": "output-bucket", "Key": "tenant/scan/report.zip"},
+        ExpiresIn=300,
+    )
+
+
+class TestS3PresignClient:
+    @override_settings(
+        **{**PRESIGN_SETTINGS, "DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION": ""},
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="",
+    )
+    def test_no_public_endpoint_and_no_region_returns_none(self):
+        # Without a region, SigV4 would have to guess one and break other regions.
+        assert get_s3_presign_client() is None
+
+    @override_settings(**PRESIGN_SETTINGS, DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="")
+    def test_region_without_public_endpoint_signs_sigv4_on_the_regional_host(self):
+        # SSE-KMS objects reject the SigV2 URLs boto3 presigns by default, and the
+        # global host redirects for new buckets, which breaks a SigV4 signature.
+        url = urlparse(_presign(get_s3_presign_client()))
+        query = parse_qs(url.query)
+
+        assert url.netloc == "s3.eu-west-1.amazonaws.com"
+        assert url.path == "/output-bucket/tenant/scan/report.zip"
+        assert query["X-Amz-Algorithm"] == ["AWS4-HMAC-SHA256"]
+        assert "/eu-west-1/s3/aws4_request" in query["X-Amz-Credential"][0]
+
+    @override_settings(
+        **{
+            **PRESIGN_SETTINGS,
+            "DJANGO_OUTPUT_S3_AWS_ACCESS_KEY_ID": "",
+            "DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY": "",
+        },
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="",
+    )
+    def test_region_without_static_keys_signs_with_the_default_chain(self, monkeypatch):
+        # An ECS task role reaches boto3 through the default chain, like the env here.
+        # A fresh default session keeps these keys from being cached for later tests.
+        monkeypatch.setattr(boto3, "DEFAULT_SESSION", None)
+        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "role-access-key")
+        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "role-secret-key")
+        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
+
+        query = parse_qs(urlparse(_presign(get_s3_presign_client())).query)
+
+        assert query["X-Amz-Credential"][0].startswith("role-access-key/")
+        assert "/eu-west-1/s3/aws4_request" in query["X-Amz-Credential"][0]
+
+    @override_settings(
+        **{**PRESIGN_SETTINGS, "DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION": ""},
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="",
+        DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL="http://minio:9000",
+    )
+    def test_internal_endpoint_without_public_endpoint_signs_against_it(self):
+        # No browser-reachable host was configured, so the internal one is the best
+        # available target instead of falling through to the real AWS host.
+        url = urlparse(_presign(get_s3_presign_client()))
+
+        assert url.netloc == "minio:9000"
+        assert url.path == "/output-bucket/tenant/scan/report.zip"
+
+    @override_settings(
+        **PRESIGN_SETTINGS,
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="https://storage.example.com",
+        DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL="http://minio:9000",
+    )
+    def test_public_endpoint_wins_over_the_internal_endpoint(self):
+        url = urlparse(_presign(get_s3_presign_client()))
+
+        assert url.netloc == "storage.example.com"
+
+    @override_settings(
+        **PRESIGN_SETTINGS,
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="https://storage.example.com",
+    )
+    def test_url_targets_the_public_host_in_path_style(self):
+        url = urlparse(_presign(get_s3_presign_client()))
+
+        assert url.netloc == "storage.example.com"
+        assert url.path == "/output-bucket/tenant/scan/report.zip"
+
+    @override_settings(
+        **PRESIGN_SETTINGS,
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="https://storage.example.com",
+    )
+    def test_signature_covers_the_public_host(self):
+        query = parse_qs(urlparse(_presign(get_s3_presign_client())).query)
+
+        assert query["X-Amz-SignedHeaders"] == ["host"]
+        assert "/eu-west-1/s3/aws4_request" in query["X-Amz-Credential"][0]
+
+    @override_settings(
+        **PRESIGN_SETTINGS,
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="https://storage.example.com",
+    )
+    def test_signature_is_bound_to_the_host_it_was_signed_against(self):
+        """Rewriting the host afterwards cannot work, which is why the endpoint is a setting."""
+        public = parse_qs(urlparse(_presign(get_s3_presign_client())).query)
+
+        with override_settings(
+            DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="http://minio:9000"
+        ):
+            internal = parse_qs(urlparse(_presign(get_s3_presign_client())).query)
+
+        assert public["X-Amz-Signature"] != internal["X-Amz-Signature"]
+
+    @override_settings(
+        **{**PRESIGN_SETTINGS, "DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION": ""},
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="https://storage.example.com",
+    )
+    def test_region_falls_back_to_the_minio_default(self):
+        query = parse_qs(urlparse(_presign(get_s3_presign_client())).query)
+
+        assert "/us-east-1/s3/aws4_request" in query["X-Amz-Credential"][0]
+
+    @override_settings(
+        **PRESIGN_SETTINGS,
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="https://storage.example.com",
+    )
+    def test_unset_session_token_is_left_out_of_the_url(self):
+        """An empty token still reaches the URL as a blank param that storage signs over."""
+        url = _presign(get_s3_presign_client())
+        query = parse_qs(urlparse(url).query, keep_blank_values=True)
+
+        assert "X-Amz-Security-Token" not in query
+
+    @override_settings(
+        **{**PRESIGN_SETTINGS, "DJANGO_OUTPUT_S3_AWS_SESSION_TOKEN": "session-token"},
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="https://storage.example.com",
+    )
+    def test_session_token_is_forwarded_when_set(self):
+        query = parse_qs(urlparse(_presign(get_s3_presign_client())).query)
+
+        assert query["X-Amz-Security-Token"] == ["session-token"]
+
+    @override_settings(
+        **{
+            **PRESIGN_SETTINGS,
+            "DJANGO_OUTPUT_S3_AWS_ACCESS_KEY_ID": "",
+            "DJANGO_OUTPUT_S3_AWS_SECRET_ACCESS_KEY": "",
+        },
+        DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL="https://storage.example.com",
+    )
+    def test_blank_static_credentials_defer_to_the_provider_chain(self, monkeypatch):
+        """Empty keys would otherwise be signed as-is, yielding a blank credential scope."""
+        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "chain-key")
+        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "chain-secret")
+        monkeypatch.delenv("AWS_SESSION_TOKEN", raising=False)
+
+        query = parse_qs(urlparse(_presign(get_s3_presign_client())).query)
+
+        assert query["X-Amz-Credential"][0].startswith("chain-key/")
@@ -1,6 +1,5 @@
 import csv
 import json
-import re
 import uuid
 from collections.abc import MutableMapping
 from contextlib import contextmanager
@@ -10,8 +9,10 @@ from unittest.mock import MagicMock, patch

 import pytest
 from api.db_router import MainRouter
+from api.db_utils import rls_transaction
 from api.exceptions import ProviderConnectionError, ProviderDeletedException
 from api.models import (
+    AttackSurfaceOverview,
    Finding,
    MuteRule,
    Provider,
@@ -2795,6 +2796,167 @@ class TestCreateComplianceRequirements:

        assert count_after_first > 0
        assert count_after_second == count_after_first
+        with rls_transaction(tenant_id):
+            row_versions = {
+                row_id.version
+                for row_id in ComplianceRequirementOverview.objects.filter(
+                    scan_id=scan_id
+                ).values_list("id", flat=True)
+            }
+        assert row_versions == {7}
+
+    def test_create_compliance_requirements_threatscore_counts_from_template(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        aws_provider,
+        findings_fixture,
+    ):
+        """ThreatScore finding counts are derived from the template mapping,
+        not from each finding's stored ``compliance`` payload."""
+        from api.models import ComplianceRequirementOverview
+
+        with patch(
+            "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+        ) as mock_compliance_template:
+            tenant_id = str(tenants_fixture[0].id)
+            scan_id = str(scans_fixture[0].id)
+
+            mock_compliance_template.__getitem__.return_value = {
+                "prowler_threatscore_aws": {
+                    "framework": "ProwlerThreatScore",
+                    "version": "1.0",
+                    "requirements": {
+                        "1.1.1": {
+                            "description": "ThreatScore requirement",
+                            "checks": {"test_check_id": None},
+                        },
+                        "1.1.2": {
+                            "description": "Unrelated requirement",
+                            "checks": {"other_check_id": None},
+                        },
+                    },
+                },
+                "other_framework": {
+                    "framework": "Other",
+                    "version": "2.0",
+                    "requirements": {
+                        "a": {
+                            "description": "Same check, other framework",
+                            "checks": {"test_check_id": None},
+                        },
+                    },
+                },
+            }
+
+            create_compliance_requirements(tenant_id, scan_id)
+
+        with rls_transaction(tenant_id):
+            counted = sum(
+                len(finding.resource_regions or [])
+                for finding in Finding.all_objects.filter(
+                    scan_id=scan_id,
+                    muted=False,
+                    status__in=["PASS", "FAIL"],
+                    check_id="test_check_id",
+                )
+            )
+            rows = list(
+                ComplianceRequirementOverview.objects.filter(
+                    scan_id=scan_id
+                ).values_list("compliance_id", "requirement_id", "total_findings")
+            )
+        assert counted > 0
+        assert (
+            sum(
+                total
+                for compliance_id, requirement_id, total in rows
+                if (compliance_id, requirement_id)
+                == ("prowler_threatscore_aws", "1.1.1")
+            )
+            == counted
+        )
+        assert all(
+            total == 0
+            for compliance_id, requirement_id, total in rows
+            if (compliance_id, requirement_id) == ("prowler_threatscore_aws", "1.1.2")
+        )
+        assert all(
+            total == 0
+            for compliance_id, _, total in rows
+            if compliance_id == "other_framework"
+        )
+
+    def test_create_compliance_requirements_rows_across_regions_and_frameworks(
+        self,
+        tenants_fixture,
+        scans_fixture,
+        aws_provider,
+    ):
+        from api.models import ComplianceRequirementOverview
+
+        tenant_id = str(tenants_fixture[0].id)
+        scan_id = str(scans_fixture[0].id)
+        check_status_by_region = {
+            "us-east-1": {"check_a": "FAIL", "check_b": "PASS"},
+            "eu-west-1": {"check_a": "PASS"},
+        }
+        template = {
+            "fw_one": {
+                "framework": "One",
+                "version": "1",
+                "requirements": {
+                    "r1": {"description": "a", "checks": {"check_a": None}},
+                    "r2": {
+                        "description": "a+b",
+                        "checks": {"check_a": None, "check_b": None},
+                    },
+                },
+            },
+            "fw_two": {
+                "framework": "Two",
+                "version": "2",
+                "requirements": {
+                    "m1": {"description": "manual", "checks": {}},
+                },
+            },
+        }
+
+        with (
+            patch(
+                "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
+            ) as mock_compliance_template,
+            patch(
+                "tasks.jobs.scan._aggregate_findings_by_region",
+                return_value=(check_status_by_region, {}),
+            ),
+        ):
+            mock_compliance_template.__getitem__.return_value = template
+            result = create_compliance_requirements(tenant_id, scan_id)
+
+        assert result["requirements_created"] == 6
+        with rls_transaction(tenant_id):
+            rows = set(
+                ComplianceRequirementOverview.objects.filter(
+                    scan_id=scan_id
+                ).values_list(
+                    "compliance_id",
+                    "requirement_id",
+                    "region",
+                    "requirement_status",
+                    "passed_checks",
+                    "failed_checks",
+                    "total_checks",
+                )
+            )
+        assert rows == {
+            ("fw_one", "r1", "us-east-1", "FAIL", 0, 1, 1),
+            ("fw_one", "r1", "eu-west-1", "PASS", 1, 0, 1),
+            ("fw_one", "r2", "us-east-1", "FAIL", 1, 1, 2),
+            ("fw_one", "r2", "eu-west-1", "PASS", 1, 0, 2),
+            ("fw_two", "m1", "us-east-1", "MANUAL", 0, 0, 0),
+            ("fw_two", "m1", "eu-west-1", "MANUAL", 0, 0, 0),
+        }

    def test_create_compliance_requirements_kubernetes_provider(
        self,
@@ -4723,17 +4885,11 @@ class TestAggregateFindingsByRegion:
        """Test function returns correct data structure."""
        tenant_id = str(uuid.uuid4())
        scan_id = str(uuid.uuid4())
-        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+        normalized_id = "prowlerthreatscore10"

-        # (check_id, status, resource_regions, compliance) tuples
-        finding_rows = [
-            (
-                "check1",
-                "FAIL",
-                ["us-east-1"],
-                {modeled_threatscore_compliance_id: ["req1", "req2"]},
-            )
-        ]
+        # (check_id, status, resource_regions) tuples
+        finding_rows = [("check1", "FAIL", ["us-east-1"])]
+        threatscore_by_check = {"check1": ["req1", "req2"]}

        mock_queryset = MagicMock()
        mock_queryset.values_list.return_value = mock_queryset
@@ -4747,13 +4903,16 @@ class TestAggregateFindingsByRegion:

        check_status_by_region, findings_count_by_compliance = (
            _aggregate_findings_by_region(
-                tenant_id, scan_id, modeled_threatscore_compliance_id
+                tenant_id,
+                scan_id,
+                normalized_id,
+                threatscore_by_check,
            )
        )

        # Streaming query contract: column-scoped values_list + iterator
        mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions", "compliance"
+            "check_id", "status", "resource_regions"
        )
        mock_queryset.iterator.assert_called_once()

@@ -4774,13 +4933,14 @@ class TestAggregateFindingsByRegion:
        """Test that FAIL status takes priority over other statuses."""
        tenant_id = str(uuid.uuid4())
        scan_id = str(uuid.uuid4())
-        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+        normalized_id = "prowlerthreatscore10"

        # Same check/region: PASS first, then FAIL — FAIL must win
        finding_rows = [
-            ("check1", "PASS", ["us-east-1"], {}),
-            ("check1", "FAIL", ["us-east-1"], {}),
+            ("check1", "PASS", ["us-east-1"]),
+            ("check1", "FAIL", ["us-east-1"]),
        ]
+        threatscore_by_check = {}

        mock_queryset = MagicMock()
        mock_queryset.values_list.return_value = mock_queryset
@@ -4793,12 +4953,15 @@ class TestAggregateFindingsByRegion:
        mock_findings_filter.return_value = mock_queryset

        check_status_by_region, _ = _aggregate_findings_by_region(
-            tenant_id, scan_id, modeled_threatscore_compliance_id
+            tenant_id,
+            scan_id,
+            normalized_id,
+            threatscore_by_check,
        )

        # Streaming query contract: column-scoped values_list + iterator
        mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions", "compliance"
+            "check_id", "status", "resource_regions"
        )
        mock_queryset.iterator.assert_called_once()

@@ -4813,8 +4976,9 @@ class TestAggregateFindingsByRegion:
        """Test that muted findings are filtered out (muted=False in query)."""
        tenant_id = str(uuid.uuid4())
        scan_id = str(uuid.uuid4())
-        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+        normalized_id = "prowlerthreatscore10"

+        threatscore_by_check = {}
        mock_queryset = MagicMock()
        mock_queryset.values_list.return_value = mock_queryset
        mock_queryset.iterator.return_value = []
@@ -4826,12 +4990,15 @@ class TestAggregateFindingsByRegion:
        mock_findings_filter.return_value = mock_queryset

        _aggregate_findings_by_region(
-            tenant_id, scan_id, modeled_threatscore_compliance_id
+            tenant_id,
+            scan_id,
+            normalized_id,
+            threatscore_by_check,
        )

        # Streaming query contract: column-scoped values_list + iterator
        mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions", "compliance"
+            "check_id", "status", "resource_regions"
        )
        mock_queryset.iterator.assert_called_once()

@@ -4851,23 +5018,14 @@ class TestAggregateFindingsByRegion:
        """Test that ThreatScore compliance counts are processed correctly."""
        tenant_id = str(uuid.uuid4())
        scan_id = str(uuid.uuid4())
-        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+        normalized_id = "prowlerthreatscore10"

        # PASS and FAIL findings mapped to the same ThreatScore requirement
        finding_rows = [
-            (
-                "check1",
-                "PASS",
-                ["us-east-1"],
-                {modeled_threatscore_compliance_id: ["req1"]},
-            ),
-            (
-                "check2",
-                "FAIL",
-                ["us-east-1"],
-                {modeled_threatscore_compliance_id: ["req1"]},
-            ),
+            ("check1", "PASS", ["us-east-1"]),
+            ("check2", "FAIL", ["us-east-1"]),
        ]
+        threatscore_by_check = {"check1": ["req1"], "check2": ["req1"]}

        mock_queryset = MagicMock()
        mock_queryset.values_list.return_value = mock_queryset
@@ -4880,19 +5038,19 @@ class TestAggregateFindingsByRegion:
        mock_findings_filter.return_value = mock_queryset

        _, findings_count_by_compliance = _aggregate_findings_by_region(
-            tenant_id, scan_id, modeled_threatscore_compliance_id
+            tenant_id,
+            scan_id,
+            normalized_id,
+            threatscore_by_check,
        )

        # Streaming query contract: column-scoped values_list + iterator
        mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions", "compliance"
+            "check_id", "status", "resource_regions"
        )
        mock_queryset.iterator.assert_called_once()

        # Verify compliance counts
-        normalized_id = re.sub(
-            r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
-        )
        assert "us-east-1" in findings_count_by_compliance
        assert normalized_id in findings_count_by_compliance["us-east-1"]
        assert "req1" in findings_count_by_compliance["us-east-1"][normalized_id]
@@ -4909,13 +5067,14 @@ class TestAggregateFindingsByRegion:
        """Test aggregation across multiple regions."""
        tenant_id = str(uuid.uuid4())
        scan_id = str(uuid.uuid4())
-        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+        normalized_id = "prowlerthreatscore10"

        # One finding per region
        finding_rows = [
-            ("check1", "FAIL", ["us-east-1"], {}),
-            ("check1", "PASS", ["us-west-2"], {}),
+            ("check1", "FAIL", ["us-east-1"]),
+            ("check1", "PASS", ["us-west-2"]),
        ]
+        threatscore_by_check = {}

        mock_queryset = MagicMock()
        mock_queryset.values_list.return_value = mock_queryset
@@ -4928,12 +5087,15 @@ class TestAggregateFindingsByRegion:
        mock_findings_filter.return_value = mock_queryset

        check_status_by_region, _ = _aggregate_findings_by_region(
-            tenant_id, scan_id, modeled_threatscore_compliance_id
+            tenant_id,
+            scan_id,
+            normalized_id,
+            threatscore_by_check,
        )

        # Streaming query contract: column-scoped values_list + iterator
        mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions", "compliance"
+            "check_id", "status", "resource_regions"
        )
        mock_queryset.iterator.assert_called_once()

@@ -4951,16 +5113,10 @@ class TestAggregateFindingsByRegion:
        """A finding with multiple resource_regions is tallied in every region."""
        tenant_id = str(uuid.uuid4())
        scan_id = str(uuid.uuid4())
-        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+        normalized_id = "prowlerthreatscore10"

-        finding_rows = [
-            (
-                "check1",
-                "FAIL",
-                ["us-east-1", "eu-west-1"],
-                {modeled_threatscore_compliance_id: ["req1"]},
-            )
-        ]
+        finding_rows = [("check1", "FAIL", ["us-east-1", "eu-west-1"])]
+        threatscore_by_check = {"check1": ["req1"]}

        mock_queryset = MagicMock()
        mock_queryset.values_list.return_value = mock_queryset
@@ -4974,19 +5130,19 @@ class TestAggregateFindingsByRegion:

        check_status_by_region, findings_count_by_compliance = (
            _aggregate_findings_by_region(
-                tenant_id, scan_id, modeled_threatscore_compliance_id
+                tenant_id,
+                scan_id,
+                normalized_id,
+                threatscore_by_check,
            )
        )

        # Streaming query contract: column-scoped values_list + iterator
        mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions", "compliance"
+            "check_id", "status", "resource_regions"
        )
        mock_queryset.iterator.assert_called_once()

-        normalized_id = re.sub(
-            r"[^a-z0-9]", "", modeled_threatscore_compliance_id.lower()
-        )
        for region in ("us-east-1", "eu-west-1"):
            assert check_status_by_region[region]["check1"] == "FAIL"
            req_stats = findings_count_by_compliance[region][normalized_id]["req1"]
@@ -5000,12 +5156,13 @@ class TestAggregateFindingsByRegion:
        """A finding with no denormalized regions contributes nothing."""
        tenant_id = str(uuid.uuid4())
        scan_id = str(uuid.uuid4())
-        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+        normalized_id = "prowlerthreatscore10"

        finding_rows = [
-            ("check1", "FAIL", [], {modeled_threatscore_compliance_id: ["req1"]}),
-            ("check2", "PASS", None, {}),
+            ("check1", "FAIL", []),
+            ("check2", "PASS", None),
        ]
+        threatscore_by_check = {"check1": ["req1"]}

        mock_queryset = MagicMock()
        mock_queryset.values_list.return_value = mock_queryset
@@ -5019,13 +5176,16 @@ class TestAggregateFindingsByRegion:

        check_status_by_region, findings_count_by_compliance = (
            _aggregate_findings_by_region(
-                tenant_id, scan_id, modeled_threatscore_compliance_id
+                tenant_id,
+                scan_id,
+                normalized_id,
+                threatscore_by_check,
            )
        )

        # Streaming query contract: column-scoped values_list + iterator
        mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions", "compliance"
+            "check_id", "status", "resource_regions"
        )
        mock_queryset.iterator.assert_called_once()

@@ -5040,8 +5200,9 @@ class TestAggregateFindingsByRegion:
        """Test with no findings - should return empty dicts."""
        tenant_id = str(uuid.uuid4())
        scan_id = str(uuid.uuid4())
-        modeled_threatscore_compliance_id = "ProwlerThreatScore-1.0"
+        normalized_id = "prowlerthreatscore10"

+        threatscore_by_check = {}
        mock_queryset = MagicMock()
        mock_queryset.values_list.return_value = mock_queryset
        mock_queryset.iterator.return_value = []
@@ -5054,13 +5215,16 @@ class TestAggregateFindingsByRegion:

        check_status_by_region, findings_count_by_compliance = (
            _aggregate_findings_by_region(
-                tenant_id, scan_id, modeled_threatscore_compliance_id
+                tenant_id,
+                scan_id,
+                normalized_id,
+                threatscore_by_check,
            )
        )

        # Streaming query contract: column-scoped values_list + iterator
        mock_queryset.values_list.assert_called_once_with(
-            "check_id", "status", "resource_regions", "compliance"
+            "check_id", "status", "resource_regions"
        )
        mock_queryset.iterator.assert_called_once()

@@ -5164,8 +5328,13 @@ class TestAggregateAttackSurface:
        mock_queryset = MagicMock()
        mock_queryset.values.return_value = mock_queryset
        mock_queryset.annotate.return_value = [
-            {"check_id": "check_internet_1", "total": 10, "failed": 3, "muted": 1},
-            {"check_id": "check_secrets_1", "total": 5, "failed": 2, "muted": 0},
+            {
+                "check_id": "check_internet_1",
+                "total": 10,
+                "failed": 3,
+                "muted_count": 1,
+            },
+            {"check_id": "check_secrets_1", "total": 5, "failed": 2, "muted_count": 0},
        ]

        ctx = MagicMock()
@@ -5214,7 +5383,7 @@ class TestAggregateAttackSurface:
        mock_queryset = MagicMock()
        mock_queryset.values.return_value = mock_queryset
        mock_queryset.annotate.return_value = [
-            {"check_id": "check_internet_1", "total": 5, "failed": 1, "muted": 0},
+            {"check_id": "check_internet_1", "total": 5, "failed": 1, "muted_count": 0},
        ]

        ctx = MagicMock()
@@ -5297,8 +5466,13 @@ class TestAggregateAttackSurface:
        mock_queryset = MagicMock()
        mock_queryset.values.return_value = mock_queryset
        mock_queryset.annotate.return_value = [
-            {"check_id": "check_internet_1", "total": 10, "failed": 3, "muted": 1},
-            {"check_id": "check_internet_2", "total": 5, "failed": 2, "muted": 0},
+            {
+                "check_id": "check_internet_1",
+                "total": 10,
+                "failed": 3,
+                "muted_count": 1,
+            },
+            {"check_id": "check_internet_2", "total": 5, "failed": 2, "muted_count": 0},
        ]

        ctx = MagicMock()
@@ -5319,6 +5493,62 @@ class TestAggregateAttackSurface:
        assert overview.failed_findings == 5  # 3 + 2
        assert overview.muted_failed_findings == 1  # 1 + 0

+    @patch("tasks.jobs.scan._get_attack_surface_mapping_from_provider")
+    def test_aggregate_attack_surface_counts_real_findings(
+        self, mock_get_mapping, tenants_fixture, scans_fixture
+    ):
+        """Run the aggregation query against real Finding rows.
+
+        The other tests mock the queryset, so they never execute the real
+        `annotate`. This one guards the row keys the query returns."""
+        tenant = tenants_fixture[0]
+        scan = scans_fixture[0]
+
+        mock_get_mapping.return_value = {
+            "privilege-escalation": {"check_privesc_1"},
+            "secrets": {"check_secrets_1"},
+        }
+
+        def create_finding(uid, check_id, status, muted):
+            Finding.objects.create(
+                tenant_id=tenant.id,
+                uid=uid,
+                scan=scan,
+                status=status,
+                status_extended="status extended",
+                impact=Severity.high,
+                severity=Severity.high,
+                raw_result={"status": status},
+                check_id=check_id,
+                check_metadata={"CheckId": check_id},
+                muted=muted,
+                first_seen_at="2024-01-02T00:00:00Z",
+            )
+
+        create_finding("privesc_fail", "check_privesc_1", Status.FAIL, False)
+        create_finding("privesc_fail_2", "check_privesc_1", Status.FAIL, False)
+        create_finding("privesc_fail_muted", "check_privesc_1", Status.FAIL, True)
+        create_finding("privesc_pass", "check_privesc_1", Status.PASS, False)
+        create_finding("secrets_pass_muted", "check_secrets_1", Status.PASS, True)
+        create_finding("unmapped_fail", "check_unmapped", Status.FAIL, False)
+
+        aggregate_attack_surface(str(tenant.id), str(scan.id))
+
+        overviews = {
+            overview.attack_surface_type: overview
+            for overview in AttackSurfaceOverview.objects.filter(
+                tenant_id=tenant.id, scan_id=scan.id
+            )
+        }
+
+        assert set(overviews) == {"privilege-escalation", "secrets"}
+        assert overviews["privilege-escalation"].total_findings == 4
+        assert overviews["privilege-escalation"].failed_findings == 2
+        assert overviews["privilege-escalation"].muted_failed_findings == 1
+        assert overviews["secrets"].total_findings == 1
+        assert overviews["secrets"].failed_findings == 0
+        assert overviews["secrets"].muted_failed_findings == 0
+
    @patch("tasks.jobs.scan.Scan.all_objects.select_related")
    @patch("tasks.jobs.scan.rls_transaction")
    def test_aggregate_attack_surface_uses_select_related(
@@ -5804,6 +6034,112 @@ class TestResetEphemeralResourceFindingsCount:
        resource2.refresh_from_db()
        assert resource2.failed_findings_count == 5

+    def test_runs_when_newer_scan_is_not_full_scope(
+        self, tenants_fixture, scans_fixture, aws_provider, resources_fixture
+    ):
+        """A newer scoped scan must not block the full-scope scan's cleanup.
+
+        The race guard used to pick the newest COMPLETED scan of any scope
+        despite being named after full-scope ones, so a single scoped scan
+        landing after a complete one made the complete scan skip its cleanup
+        and leave ephemeral resources with a stale count permanently.
+        """
+        from datetime import timedelta
+
+        tenant, *_ = tenants_fixture
+        scan1, *_ = scans_fixture
+        resource1, resource2, _ = resources_fixture
+
+        Resource.objects.filter(id=resource2.id).update(failed_findings_count=5)
+        self._make_scan_summary(tenant.id, scan1.id, resource1)
+
+        newer_completed_at = scan1.completed_at + timedelta(minutes=5)
+        Scan.objects.create(
+            name="Newer scoped scan",
+            provider=aws_provider,
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.COMPLETED,
+            tenant_id=tenant.id,
+            started_at=newer_completed_at,
+            completed_at=newer_completed_at,
+            scanner_args={"checks": ["check1"]},
+        )
+
+        result = reset_ephemeral_resource_findings_count(
+            tenant_id=str(tenant.id), scan_id=str(scan1.id)
+        )
+
+        assert result["status"] == "completed"
+
+        resource2.refresh_from_db()
+        assert resource2.failed_findings_count == 0
+
+    def test_runs_when_many_newer_scans_are_not_full_scope(
+        self, tenants_fixture, scans_fixture, aws_provider, resources_fixture
+    ):
+        """The walk must not give up before it reaches the full-scope scan.
+
+        A fixed look-back window returned None once more newer scoped scans
+        had landed than it inspected, and skipped the cleanup exactly like the
+        original bug did with one.
+        """
+        from datetime import timedelta
+
+        tenant, *_ = tenants_fixture
+        scan1, *_ = scans_fixture
+        resource1, resource2, _ = resources_fixture
+
+        Resource.objects.filter(id=resource2.id).update(failed_findings_count=5)
+        self._make_scan_summary(tenant.id, scan1.id, resource1)
+
+        for minutes in range(1, 41):
+            newer_completed_at = scan1.completed_at + timedelta(minutes=minutes)
+            Scan.objects.create(
+                name=f"Newer scoped scan {minutes}",
+                provider=aws_provider,
+                trigger=Scan.TriggerChoices.MANUAL,
+                state=StateChoices.COMPLETED,
+                tenant_id=tenant.id,
+                started_at=newer_completed_at,
+                completed_at=newer_completed_at,
+                scanner_args={"checks": ["check1"]},
+            )
+
+        result = reset_ephemeral_resource_findings_count(
+            tenant_id=str(tenant.id), scan_id=str(scan1.id)
+        )
+
+        assert result["status"] == "completed"
+
+        resource2.refresh_from_db()
+        assert resource2.failed_findings_count == 0
+
+    def test_runs_when_completed_at_is_null(
+        self, tenants_fixture, scans_fixture, aws_provider, resources_fixture
+    ):
+        """NULL `completed_at` used to make the reset never run at all.
+
+        The old guard filtered `completed_at__isnull=False`, so a provider
+        whose completed scans all had a NULL `completed_at` resolved the
+        "latest" scan to None, which never equals `scan.id`.
+        """
+        tenant, *_ = tenants_fixture
+        scan1, *_ = scans_fixture
+        resource1, resource2, _ = resources_fixture
+
+        Scan.all_objects.filter(id=scan1.id).update(completed_at=None)
+        Resource.objects.filter(id=resource2.id).update(failed_findings_count=5)
+        self._make_scan_summary(tenant.id, scan1.id, resource1)
+
+        result = reset_ephemeral_resource_findings_count(
+            tenant_id=str(tenant.id), scan_id=str(scan1.id)
+        )
+
+        assert result["status"] == "completed"
+
+        resource2.refresh_from_db()
+        assert resource2.failed_findings_count == 0
+
    def test_does_not_touch_other_providers_resources(
        self, tenants_fixture, scans_fixture, aws_provider, resources_fixture
    ):
@@ -1,3 +1,4 @@
+import json
 import uuid
 from contextlib import contextmanager
 from datetime import UTC, datetime
@@ -14,6 +15,7 @@ from api.models import (
    StateChoices,
    Task,
 )
+from api.v1.serializers import TaskSerializer
 from botocore.exceptions import ClientError
 from celery import states
 from django_celery_beat.models import IntervalSchedule, PeriodicTask
@@ -32,6 +34,7 @@ from tasks.tasks import (
    _scan_tmp_output_directory,
    check_integrations_task,
    check_lighthouse_provider_connection_task,
+    create_scan_task_record,
    generate_outputs_task,
    mute_findings_in_latest_scans_task,
    perform_attack_paths_scan_task,
@@ -3384,3 +3387,79 @@ class TestTaskTimeLimits:
            "lighthouse-provider-connection-check",
        ):
            assert celery_app.tasks[name].time_limit < default
+
+
+@pytest.mark.django_db
+class TestCreateScanTaskRecord:
+    """`task_kwargs` is what a response built before the publish can report."""
+
+    def _scan(self, tenant, provider):
+        """A manual scan, like the one `POST /api/v1/scans` creates."""
+        return Scan.objects.create(
+            tenant_id=tenant.id,
+            provider=provider,
+            name="Manual scan",
+            trigger=Scan.TriggerChoices.MANUAL,
+            state=StateChoices.AVAILABLE,
+        )
+
+    def _publish_kwargs(self, tenant, scan):
+        """What `enqueue_scan_execution_on_commit` publishes for this scan."""
+        return {
+            "tenant_id": str(tenant.id),
+            "scan_id": str(scan.id),
+            "provider_id": str(scan.provider_id),
+        }
+
+    def _task_args(self, task):
+        """Read the record back the way `TaskSerializer` does."""
+        return TaskSerializer(task).data["task_args"]
+
+    def test_the_stored_kwargs_are_the_ones_the_publish_would_send(
+        self, tenants_fixture, aws_provider
+    ):
+        """The 202 reports what is stored here, so it has to be the dispatch kwargs."""
+        tenant = tenants_fixture[0]
+        scan = self._scan(tenant, aws_provider)
+
+        task = create_scan_task_record(
+            tenant_id=str(tenant.id),
+            task_id=str(uuid.uuid4()),
+            task_kwargs=self._publish_kwargs(tenant, scan),
+        )
+
+        assert self._task_args(task) == {
+            "scan_id": str(scan.id),
+            "provider_id": str(aws_provider.id),
+        }
+
+    def test_a_record_created_without_kwargs_reports_none(self, tenants_fixture):
+        """The argument is optional, so the other callers keep their behaviour."""
+        task = create_scan_task_record(
+            tenant_id=str(tenants_fixture[0].id),
+            task_id=str(uuid.uuid4()),
+        )
+
+        assert self._task_args(task) == {}
+
+    def test_the_publish_can_overwrite_the_stored_kwargs(
+        self, tenants_fixture, aws_provider
+    ):
+        """django-celery-results stores a Python repr; both must decode alike."""
+        tenant = tenants_fixture[0]
+        scan = self._scan(tenant, aws_provider)
+        task_id = str(uuid.uuid4())
+        kwargs = self._publish_kwargs(tenant, scan)
+
+        task = create_scan_task_record(
+            tenant_id=str(tenant.id), task_id=task_id, task_kwargs=kwargs
+        )
+        before = self._task_args(task)
+
+        # What `before_task_publish` writes once the task reaches the broker.
+        task_result = TaskResult.objects.get(task_id=task_id)
+        task_result.task_kwargs = json.dumps(repr(kwargs))
+        task_result.save(update_fields=["task_kwargs"])
+        task.refresh_from_db()
+
+        assert self._task_args(task) == before
@@ -53,7 +53,7 @@ constraints = [
    { name = "aliyun-log-fastpb", specifier = "==0.2.0" },
    { name = "amqp", specifier = "==5.3.1" },
    { name = "annotated-types", specifier = "==0.7.0" },
-    { name = "anyio", specifier = "==4.12.1" },
+    { name = "anyio", specifier = "==4.14.2" },
    { name = "applicationinsights", specifier = "==0.11.10" },
    { name = "apscheduler", specifier = "==3.11.2" },
    { name = "argcomplete", specifier = "==3.5.3" },
@@ -291,7 +291,7 @@ constraints = [
    { name = "pydantic-core", specifier = "==2.41.5" },
    { name = "pygithub", specifier = "==2.8.0" },
    { name = "pygments", specifier = "==2.20.0" },
-    { name = "pyjwt", specifier = "==2.13.0" },
+    { name = "pyjwt", specifier = "==2.14.0" },
    { name = "pylint", specifier = "==3.2.5" },
    { name = "pymsalruntime", specifier = "==0.18.1" },
    { name = "pynacl", specifier = "==1.6.2" },
@@ -387,7 +387,7 @@ overrides = [
    { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.10" },
    { name = "microsoft-kiota-serialization-text", specifier = "==1.9.10" },
    { name = "okta", specifier = "==3.4.2" },
-    { name = "pyjwt", extras = ["crypto"], specifier = "==2.13.0" },
+    { name = "pyjwt", extras = ["crypto"], specifier = "==2.14.0" },
 ]

 [[package]]
@@ -969,15 +969,15 @@ wheels = [

 [[package]]
 name = "anyio"
-version = "4.12.1"
+version = "4.14.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "idna" },
    { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/96/f0/5eb65b2bb0d09ac6776f2eb54adee6abe8228ea05b20a5ad0e4945de8aac/anyio-4.12.1.tar.gz", hash = "sha256:41cfcc3a4c85d3f05c932da7c26d0201ac36f72abd4435ba90d0464a3ffed703", size = 228685, upload-time = "2026-01-06T11:45:21.246Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/38/0e/27be9fdef66e72d64c0cdc3cc2823101b80585f8119b5c112c2e8f5f7dab/anyio-4.12.1-py3-none-any.whl", hash = "sha256:d405828884fc140aa80a3c667b8beed277f1dfedec42ba031bd6ac3db606ab6c", size = 113592, upload-time = "2026-01-06T11:45:19.497Z" },
+    { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" },
 ]

 [[package]]
@@ -4938,7 +4938,7 @@ dependencies = [

 [[package]]
 name = "prowler-api"
-version = "1.42.0"
+version = "1.46.0"
 source = { virtual = "." }
 dependencies = [
    { name = "cartography" },
@@ -5332,11 +5332,11 @@ wheels = [

 [[package]]
 name = "pyjwt"
-version = "2.13.0"
+version = "2.14.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/af/c3/8a3b59c25070cc61dc517fbdfa5dc0904670c96f605cc69759dc09166b99/pyjwt-2.14.0.tar.gz", hash = "sha256:77283c83fb56ecf566a886c757a714bc83668e38156de2cce8263302f42e0b86", size = 113177, upload-time = "2026-09-11T13:11:54.638Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/97/672cb32ce0dfea44b740cb7b4f97038463b9cf7c0ead1aacf595572851d6/pyjwt-2.14.0-py3-none-any.whl", hash = "sha256:ad0cef71c756a56e74863c2919cf0985f72decbcfcb550ee2f422e7c62b5eedc", size = 32896, upload-time = "2026-09-11T13:11:53.409Z" },
 ]

 [package.optional-dependencies]
@@ -212,6 +212,14 @@ mainConfig:
    # MEDIUM
    ecr_repository_vulnerability_minimum_severity: "MEDIUM"

+    # AWS Inspector2
+    # aws.inspector2_coverage_recently_scanned
+    # Maximum days since Inspector2 last scanned an actively covered resource
+    inspector2_max_days_since_last_scan: 3
+    # aws.inspector2_active_findings_within_max_age
+    # Maximum days an Inspector2 finding can stay active since it was first observed
+    inspector2_active_finding_max_age_days: 192
+
    # AWS Trusted Advisor
    # aws.trustedadvisor_premium_support_plan_subscribed
    verify_premium_support_plans: True
@@ -1,46 +0,0 @@
-import warnings
-
-from dashboard.common_methods import get_section_containers_cis
-
-warnings.filterwarnings("ignore")
-
-
-def get_table(data):
-    aux = data[
-        [
-            "REQUIREMENTS_ID",
-            "REQUIREMENTS_DESCRIPTION",
-            "REQUIREMENTS_ATTRIBUTES_SECTION",
-            "CHECKID",
-            "STATUS",
-            "REGION",
-            "ACCOUNTID",
-            "RESOURCEID",
-        ]
-    ].copy()
-
-    # Shorten the long FedRAMP KSI descriptions for better display
-    ksi_short_names = {
-        "A secure cloud service offering will protect user data, control access, and apply zero trust principles": "Identity and Access Management",
-        "A secure cloud service offering will use cloud native architecture and design principles to enforce and enhance the Confidentiality, Integrity and Availability of the system": "Cloud Native Architecture",
-        "A secure cloud service provider will ensure that all system changes are properly documented and configuration baselines are updated accordingly": "Change Management",
-        "A secure cloud service provider will continuously educate their employees on cybersecurity measures, testing them regularly": "Cybersecurity Education",
-        "A secure cloud service offering will document, report, and analyze security incidents to ensure regulatory compliance and continuous security improvement": "Incident Reporting",
-        "A secure cloud service offering will monitor, log, and audit all important events, activity, and changes": "Monitoring, Logging, and Auditing",
-        "A secure cloud service offering will have intentional, organized, universal guidance for how every information resource, including personnel, is secured": "Policy and Inventory",
-        "A secure cloud service offering will define, maintain, and test incident response plan(s) and recovery capabilities to ensure minimal service disruption and data loss": "Recovery Planning",
-        "A secure cloud service offering will follow FedRAMP encryption policies, continuously verify information resource integrity, and restrict access to third-party information resources": "Service Configuration",
-        "A secure cloud service offering will understand, monitor, and manage supply chain risks from third-party information resources": "Third-Party Information Resources",
-    }
-
-    # Replace long descriptions with short names - use contains for partial matching
-    if not aux.empty:
-        for long_desc, short_name in ksi_short_names.items():
-            mask = aux["REQUIREMENTS_DESCRIPTION"].str.contains(
-                long_desc, na=False, regex=False
-            )
-            aux.loc[mask, "REQUIREMENTS_DESCRIPTION"] = short_name
-
-    return get_section_containers_cis(
-        aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION"
-    )
@@ -1,46 +0,0 @@
-import warnings
-
-from dashboard.common_methods import get_section_containers_cis
-
-warnings.filterwarnings("ignore")
-
-
-def get_table(data):
-    aux = data[
-        [
-            "REQUIREMENTS_ID",
-            "REQUIREMENTS_DESCRIPTION",
-            "REQUIREMENTS_ATTRIBUTES_SECTION",
-            "CHECKID",
-            "STATUS",
-            "REGION",
-            "ACCOUNTID",
-            "RESOURCEID",
-        ]
-    ].copy()
-
-    # Shorten the long FedRAMP KSI descriptions for better display
-    ksi_short_names = {
-        "A secure cloud service offering will protect user data, control access, and apply zero trust principles": "Identity and Access Management",
-        "A secure cloud service offering will use cloud native architecture and design principles to enforce and enhance the Confidentiality, Integrity and Availability of the system": "Cloud Native Architecture",
-        "A secure cloud service provider will ensure that all system changes are properly documented and configuration baselines are updated accordingly": "Change Management",
-        "A secure cloud service provider will continuously educate their employees on cybersecurity measures, testing them regularly": "Cybersecurity Education",
-        "A secure cloud service offering will document, report, and analyze security incidents to ensure regulatory compliance and continuous security improvement": "Incident Reporting",
-        "A secure cloud service offering will monitor, log, and audit all important events, activity, and changes": "Monitoring, Logging, and Auditing",
-        "A secure cloud service offering will have intentional, organized, universal guidance for how every information resource, including personnel, is secured": "Policy and Inventory",
-        "A secure cloud service offering will define, maintain, and test incident response plan(s) and recovery capabilities to ensure minimal service disruption and data loss": "Recovery Planning",
-        "A secure cloud service offering will follow FedRAMP encryption policies, continuously verify information resource integrity, and restrict access to third-party information resources": "Service Configuration",
-        "A secure cloud service offering will understand, monitor, and manage supply chain risks from third-party information resources": "Third-Party Information Resources",
-    }
-
-    # Replace long descriptions with short names - use contains for partial matching
-    if not aux.empty:
-        for long_desc, short_name in ksi_short_names.items():
-            mask = aux["REQUIREMENTS_DESCRIPTION"].str.contains(
-                long_desc, na=False, regex=False
-            )
-            aux.loc[mask, "REQUIREMENTS_DESCRIPTION"] = short_name
-
-    return get_section_containers_cis(
-        aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION"
-    )
@@ -1,46 +0,0 @@
-import warnings
-
-from dashboard.common_methods import get_section_containers_cis
-
-warnings.filterwarnings("ignore")
-
-
-def get_table(data):
-    aux = data[
-        [
-            "REQUIREMENTS_ID",
-            "REQUIREMENTS_DESCRIPTION",
-            "REQUIREMENTS_ATTRIBUTES_SECTION",
-            "CHECKID",
-            "STATUS",
-            "REGION",
-            "ACCOUNTID",
-            "RESOURCEID",
-        ]
-    ].copy()
-
-    # Shorten the long FedRAMP KSI descriptions for better display
-    ksi_short_names = {
-        "A secure cloud service offering will protect user data, control access, and apply zero trust principles": "Identity and Access Management",
-        "A secure cloud service offering will use cloud native architecture and design principles to enforce and enhance the Confidentiality, Integrity and Availability of the system": "Cloud Native Architecture",
-        "A secure cloud service provider will ensure that all system changes are properly documented and configuration baselines are updated accordingly": "Change Management",
-        "A secure cloud service provider will continuously educate their employees on cybersecurity measures, testing them regularly": "Cybersecurity Education",
-        "A secure cloud service offering will document, report, and analyze security incidents to ensure regulatory compliance and continuous security improvement": "Incident Reporting",
-        "A secure cloud service offering will monitor, log, and audit all important events, activity, and changes": "Monitoring, Logging, and Auditing",
-        "A secure cloud service offering will have intentional, organized, universal guidance for how every information resource, including personnel, is secured": "Policy and Inventory",
-        "A secure cloud service offering will define, maintain, and test incident response plan(s) and recovery capabilities to ensure minimal service disruption and data loss": "Recovery Planning",
-        "A secure cloud service offering will follow FedRAMP encryption policies, continuously verify information resource integrity, and restrict access to third-party information resources": "Service Configuration",
-        "A secure cloud service offering will understand, monitor, and manage supply chain risks from third-party information resources": "Third-Party Information Resources",
-    }
-
-    # Replace long descriptions with short names - use contains for partial matching
-    if not aux.empty:
-        for long_desc, short_name in ksi_short_names.items():
-            mask = aux["REQUIREMENTS_DESCRIPTION"].str.contains(
-                long_desc, na=False, regex=False
-            )
-            aux.loc[mask, "REQUIREMENTS_DESCRIPTION"] = short_name
-
-    return get_section_containers_cis(
-        aux, "REQUIREMENTS_ID", "REQUIREMENTS_ATTRIBUTES_SECTION"
-    )
@@ -1,6 +1,6 @@
 services:
  api-dev-init:
-    image: busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
+    image: busybox:1.38.0@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
    volumes:
      - ./_data/api:/data
    command: ["sh", "-c", "chown -R 1000:1000 /data"]
@@ -64,7 +64,7 @@ services:
        condition: service_healthy

  postgres:
-    image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+    image: postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
    hostname: "postgres-db"
    volumes:
      - ./_data/postgres:/var/lib/postgresql/data
@@ -88,7 +88,7 @@ services:
      retries: 5

  valkey:
-    image: valkey/valkey:8-alpine@sha256:a038175878d66b9d274fbf8be73c0305e93798b83917647f167e18cef3c71eec
+    image: valkey/valkey:8-alpine@sha256:081c2f5cb575efc901aa80ff9cdbd1ec6a301682fd35e1ebb4b0990a4a4a8507
    hostname: "valkey"
    volumes:
      - ./_data/valkey:/data
@@ -6,7 +6,7 @@
 #
 services:
  api-init:
-    image: busybox:1.37.0@sha256:9532d8c39891ca2ecde4d30d7710e01fb739c87a8b9299685c63704296b16028
+    image: busybox:1.38.0@sha256:fd7dc98638c8e305f4dc34e979f1c0fdfdcaeb0fbf8fcff77ae834b6da3d7e6e
    volumes:
      - ./_data/api:/data
    command: ["sh", "-c", "chown -R 1000:1000 /data"]
@@ -15,6 +15,7 @@ services:
  api:
    hostname: "prowler-api"
    image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
+    restart: unless-stopped
    env_file:
      - path: .env
        required: false
@@ -44,6 +45,7 @@ services:

  ui:
    image: prowlercloud/prowler-ui:${PROWLER_UI_VERSION:-stable}
+    restart: unless-stopped
    env_file:
      - path: .env
        required: false
@@ -60,7 +62,8 @@ services:
      start_period: 60s

  postgres:
-    image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
+    image: postgres:16-alpine@sha256:721873c34ceb9f8d8fc265984940dc982404c105f19ad51be9fdc5970a6080ea
+    restart: unless-stopped
    hostname: "postgres-db"
    volumes:
      - ./_data/postgres:/var/lib/postgresql/data
@@ -80,7 +83,8 @@ services:
      retries: 5

  valkey:
-    image: valkey/valkey:8-alpine@sha256:a038175878d66b9d274fbf8be73c0305e93798b83917647f167e18cef3c71eec
+    image: valkey/valkey:8-alpine@sha256:081c2f5cb575efc901aa80ff9cdbd1ec6a301682fd35e1ebb4b0990a4a4a8507
+    restart: unless-stopped
    hostname: "valkey"
    volumes:
      - ./_data/valkey:/data
@@ -97,6 +101,7 @@ services:

  neo4j:
    image: graphstack/dozerdb:5.26.27.0@sha256:9b54d6b3a98a76c00bd23e8e78d8c82081ff168162aebd47b25c234e092cb0a0
+    restart: unless-stopped
    hostname: "neo4j"
    volumes:
      - ./_data/neo4j:/data
@@ -129,6 +134,7 @@ services:

  worker:
    image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
+    restart: unless-stopped
    # Give Celery soft shutdown time to drain/re-queue in-flight tasks on stop.
    stop_grace_period: 120s
    env_file:
@@ -149,6 +155,7 @@ services:

  worker-beat:
    image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
+    restart: unless-stopped
    env_file:
      - path: ./.env
        required: false
@@ -165,6 +172,7 @@ services:

  mcp-server:
    image: prowlercloud/prowler-mcp:${PROWLER_MCP_VERSION:-stable}
+    restart: unless-stopped
    environment:
      - PROWLER_MCP_TRANSPORT_MODE=http
    env_file:
@@ -4,6 +4,194 @@ description: "New features and improvements in each Prowler release"
 rss: true
 ---

+<Update label="v5.44.0" description="September 29, 2026">
+  ### 🔁 Findings — Re-check a Resource with a Partial Scan
+
+  <Note>
+  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
+  </Note>
+
+  A resource that has just been fixed can be confirmed from the Findings page without waiting for the next full scan. **Re-check resource** is available in the actions menu of every resource row and in the resource detail drawer, and a hint icon next to **Last seen** opens it directly. It launches a partial scan that runs again only the checks that last reported on that resource; its findings update when the scan completes, and every other resource keeps the results of the latest full scan. Roles need the Manage Scans permission, and a re-check is refused while the provider has a scan running or queued.
+
+  Re-checked resources that now pass drop out of the finding groups list and its drill-down instead of opening a detail panel that still reports `FAIL`. Partial scans do not change overviews or compliance until the next full scan and produce no report files, so the Scans table marks them as **Partial**, offers no report download for them, and the per-scan Compliance selector leaves them out.
+
+  Partial scans can also be launched outside the Findings page:
+
+  - **API:** `POST /api/v1/scans` accepts up to 10 resources in `resource_uids`, and scans expose `is_partial` with a `filter[is_partial]` filter.
+  - **MCP Server:** `prowler_trigger_scan` takes a `resource_uids` argument, and `prowler_list_scans` and `prowler_get_scan` return `is_partial`, with an `is_partial` filter on `prowler_list_scans`.
+  - **Lighthouse AI:** can launch a partial scan to re-check specific resources, such as confirming a remediation.
+
+  ### ☁️ AWS — Connect an Account in One Step
+
+  The Add Provider wizard connects an AWS account in a single step. The account ID is read from the role ARN (or typed when using static access keys), the role is assumed with Prowler's own credentials, and the account, its credentials and the connection test are handled by one submit. A confirmed connection goes straight to the launch step. A refused connection stays on the form with the reason the API returned, so the fields can be fixed and retried without registering the account twice.
+
+  New tenants without providers now land on this wizard on their first sign-in instead of a welcome modal, and the sidebar action reads **Add Provider** until the first provider is connected.
+
+  Read more in the [Getting Started with AWS documentation](https://docs.prowler.com/user-guide/providers/aws/getting-started-aws).
+
+  ### 🔌 Connection Tests No Longer Give Up Early
+
+  The provider connection test no longer reports `Max retries exceeded` for checks that take longer than 30 seconds, such as networks where some AWS endpoints are unreachable. The UI now waits for the full time limit of the backend task, and if that is still exhausted it shows the provider's current connection state instead of a failure.
+
+  On the SDK side, STS calls after a role assumption reuse the region that answered, so an unreachable partition region is waited on once instead of twice. The new `PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS` environment variable sets the Boto3 retries for deployments that build the AWS provider without CLI flags, next to the existing timeout variables; `0` disables retries.
+
+  Read more in the [Boto3 configuration documentation](https://docs.prowler.com/user-guide/providers/aws/boto3-configuration#retries-configuration).
+
+  ### 🗄️ Self-Hosted — S3-Compatible Storage and Air-Gapped Deployments
+
+  - `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL` points scan output uploads and downloads at S3-compatible object storage such as MinIO. Previously the only way to reach it was exporting process-wide AWS environment variables, which also hijacked unrelated AWS API calls such as role assumption for AWS providers.
+  - Report downloads from a bucket with default SSE-KMS encryption no longer fail with `InvalidArgument`: when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is set, download URLs are signed with Signature Version 4 for that region.
+  - Icons ship in the UI bundle instead of being fetched from `api.iconify.design`, so pages render correctly without internet access.
+  - Celery worker fatal errors are logged instead of silenced, and every long-running service in `docker-compose.yml` restarts automatically after an unexpected crash.
+
+  ### 📊 Consistent Latest Scan Across Endpoints
+
+  Every endpoint now resolves a provider's latest completed scan the same way, so overlapping scans no longer make findings, compliance and mute rules read from different scans. Providers whose latest completed scan has no `completed_at` timestamp are no longer missing from those endpoints, and resources no longer keep a stale failed findings count when a scoped or imported scan completes after a full scan.
+
+  ### 🛠️ Prowler App Fixes
+
+  - API key authentication no longer locks the key row on every request, so a heavily used key no longer serializes all its requests; `last_used_at` is updated at most once per minute.
+  - `POST /api/v1/scans` returns the new scan ID in `task_args` again.
+  - Provider deletion no longer fails when the provider has Attack Paths scans recorded on a sink that is no longer configured, such as Neptune after moving back to Neo4j.
+  - A periodic sweep drops orphaned Attack Paths temporary Neo4j databases left behind when a worker or Neo4j crashes mid-scan.
+  - **Prowler Cloud:** imported findings no longer stay stuck in `pending` when the ingestion worker picks up the job before it is committed, and a failed enqueue marks the ingestion as failed.
+  - **Prowler Cloud:** the Lighthouse AI connection check reports a network failure as one, naming the endpoint it could not reach, instead of hitting a time limit that looked the same as a bad key.
+  - **Prowler Cloud:** the finding groups endpoints no longer query Manual Pass triages once per finding, and skip that overlay for tenants with no active Manual Pass.
+  - The Findings page renders a skeleton at once and streams the table before the filters, and the **Finding Group** options load when the dropdown opens.
+  - Mute rule creation errors show the API error message instead of the raw response body.
+  - The sidebar no longer throws a hydration error on full page loads for users who last used the chat mode.
+
+  ### 🔐 Security Updates
+
+  - `DELETE /api/v1/tasks/{id}` requires the permission of the operation that queued the task and rejects provider deletions, and `GET /api/v1/tasks` hides tasks of providers outside the role's visibility.
+  - The UI E2E workflow receives its AWS credentials through environment variables instead of template expansion.
+
+  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.44.0) for the complete list of changes.
+</Update>
+
+<Update label="v5.43.0" description="September 21, 2026">
+  ### 🏛️ Compliance — FedRAMP 20x Consolidated Rules 2026
+
+  The FedRAMP 20x Phase One pilot frameworks (`fedramp_20x_ksi_low_aws`, `fedramp_20x_ksi_low_azure` and `fedramp_20x_ksi_low_gcp`) are replaced by two universal frameworks built from the FedRAMP Consolidated Rules for 2026, each covering AWS, Azure, GCP, Kubernetes and Microsoft 365 from a single definition:
+
+  - **FedRAMP 20x KSI** (`fedramp_20x_ksi_2026`): the 46 Key Security Indicators across 10 themes. There is one indicator catalog for every class instead of a separate Low fork; each indicator carries its class applicability and NIST SP 800-53 controls.
+  - **FedRAMP 20x Class C FRR** (`fedramp_20x_frr_class_c_2026`): the 158 FedRAMP Rules of the Class C ruleset that bind cloud service providers. Most are program obligations (reports, notifications, certification package) and stay manual; checks are mapped only where they evidence part of the rule text. Configurable checks carry configuration requirements, so a relaxed `audit_config` cannot turn a requirement green.
+
+  Automation or stored results that reference the pilot framework IDs need to move to `fedramp_20x_ksi_2026`. In Prowler App, both frameworks show the per-provider breakdown in the cross-provider compliance view and can be downloaded as OCSF.
+
+  Read more in the [Compliance documentation](https://docs.prowler.com/user-guide/compliance/tutorials/compliance).
+
+  ### 🔎 AWS — Inspector Coverage, CISA KEV and FIPS Checks
+
+  Seven new AWS checks back the vulnerability detection and cryptography rules of FedRAMP 20x Class C:
+
+  - `inspector2_coverage_scan_status_active` and `inspector2_coverage_recently_scanned` report resources Amazon Inspector is not scanning, or last scanned more than `inspector2_max_days_since_last_scan` days ago (default 3).
+  - `inspector2_active_findings_no_known_exploited_vulnerabilities` and `inspector2_active_findings_kev_within_due_date` report active findings whose CVE is in the CISA Known Exploited Vulnerabilities catalog, and those still open past the CISA due date. The KEV data comes from Inspector itself through `inspector2:BatchGetFindingDetails`, so no external feed is needed.
+  - `inspector2_active_findings_within_max_age` reports active findings first observed more than `inspector2_active_finding_max_age_days` days ago (default 192).
+  - `elbv2_listener_fips_tls_enabled` and `transfer_server_fips_security_policy_enabled` report HTTPS/TLS load balancer listeners and Transfer Family servers without a FIPS security policy.
+
+  `inspector2:BatchGetFindingDetails` is not part of `SecurityAudit`, so it is now included in the Prowler additions policy and the CloudFormation scan role. Without it, the KEV checks report `MANUAL` naming the missing permission instead of a false `FAIL`.
+
+  Explore all AWS checks at [Prowler Hub](https://hub.prowler.com/check?provider=aws).
+
+  ### ☁️ AWS — Partition Bootstrap Failover
+
+  When `PROWLER_AWS_PARTITION` is set, the bootstrap STS calls (validating credentials, assuming a role and getting an MFA session token) now try up to two more regions of the partition if the first one cannot be reached. A GovCloud host whose configured region belongs to another partition was still sent to `us-gov-east-1`, and on a network that routes only to `us-gov-west-1` the connection check and the scan failed on perfectly valid credentials. Only connection errors and timeouts move on to the next region; credential errors are reported from the first one as before. Later STS calls reuse the region that answered, and nothing changes when `PROWLER_AWS_PARTITION` is unset.
+
+  Read more in the [AWS Regions and Partitions documentation](https://docs.prowler.com/user-guide/providers/aws/regions-and-partitions).
+
+  ### 🌐 Azure — Sovereign Cloud Endpoints for Defender and Key Vault
+
+  Defender security contacts and Key Vault key rotation policies now use the endpoints of the cloud selected with `--azure-region` instead of the hardcoded `management.azure.com` and `vault.azure.net` hosts, so both work on `AzureUSGovernment` and `AzureChinaCloud`. Key Vault clients are built from the vault URI that Azure returns for each vault.
+
+  Read more in the [Azure non-default cloud documentation](https://docs.prowler.com/user-guide/providers/azure/use-non-default-cloud).
+
+  ### ✉️ Invitations — Expired Invitations No Longer Block Re-Invites
+
+  A pending invitation past its expiry date is now reported as expired, and inviting the same email again marks it as expired and creates the new invitation instead of returning a generic error. The Invitations table disables Edit and Revoke on expired and revoked invitations, and `filter[state__in]` on the invitations endpoint no longer returns a server error.
+
+  In Prowler Cloud, new organizations are offered an **Invite your team** step once the first provider is connected, and Prowler Private Cloud deployments can set `UI_SELF_REGISTRATION_ENABLED=false` to make sign-up invitation-only.
+
+  Read more in the [Invitations documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-rbac#invitations).
+
+  ### 📄 Reports — Downloads on Self-Hosted Storage
+
+  Report downloads no longer depend on the storage host being the same inside and outside the container network. `DJANGO_OUTPUT_S3_AWS_PUBLIC_ENDPOINT_URL` signs the download URL against a browser-reachable host, so a deployment whose object storage answers only on an internal address serves the file instead of a link the browser cannot open. Leaving `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` unset, common on S3-compatible storage with no meaningful region, no longer makes the download fail with a server error.
+
+  ### 🔍 Checks
+
+  - **Huawei Cloud:** new `smn_topic_subscriptions` check reports SMN topics without any subscription.
+  - **Cloudflare:** the API token links in the provider wizard request the SSL and Certificates, Bot Management and Zone WAF read permissions the checks need, so a token created from the wizard no longer produces failures on permissions it was never granted.
+  - **Microsoft 365:** five Defender malware, anti-phishing and inbound anti-spam checks no longer fail with `KeyError` on tenants that use the Standard or Strict preset security policies, which dropped every finding of those checks. Preset policies are covered by `defender_strict_preset_security_policy_enabled`.
+  - **Google Workspace:** `security_2sv_enforced` reports domain-wide 2-Step Verification failures as `FAIL` even when every failing setting is overridden for a group or organizational unit.
+
+  Explore all checks at [Prowler Hub](https://hub.prowler.com/check).
+
+  ### 🔐 Security Updates
+
+  - `libsqlite3-0`, `gzip`, `perl-base`, `libssh2-1t64` and `libpcre2-8-0` upgraded in the SDK and API container images, patching high-severity Debian CVEs.
+  - PowerShell upgraded to 7.5.11 in the SDK and API container images, bundling .NET runtime 9.0.20 and patching CVE-2026-62901.
+  - `anyio` upgraded to 4.14.2 in the SDK, the API and the MCP Server, patching CVE-2026-63374.
+
+  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.43.0) for the complete list of changes.
+</Update>
+
+<Update label="v5.42.0" description="September 11, 2026">
+  ### ☁️ AWS — ISO Partitions
+
+  Prowler now resolves regions and services for the AWS ISO partitions (`aws-iso`, `aws-iso-b`, `aws-iso-e` and `aws-iso-f`) the same way it does for the commercial, China, European Sovereign Cloud and GovCloud partitions. The region matrix is filled from the endpoint metadata bundled with botocore, which needs no credentials or network access, so it covers partitions that are air-gapped from the internet. Scanning them no longer requires a hand-edited `aws_regions_by_service.json`: ISO regions such as `us-isob-east-1` are accepted by `--region` and `--excluded-region`.
+
+  Deployments that declare `PROWLER_AWS_PARTITION` also keep their bootstrap STS calls in the configured region when it belongs to that partition. An install in `us-gov-west-1` that reaches AWS only through its own VPC endpoints is no longer sent to `us-gov-east-1`, where the connection check and the scan used to time out.
+
+  Read more in the [AWS Regions and Partitions documentation](https://docs.prowler.com/user-guide/providers/aws/regions-and-partitions).
+
+  ### ⏱️ AWS — Configurable Timeouts for Restricted Networks
+
+  Scans from networks with restricted egress (VPC endpoints for only some services, GovCloud or private deployments) could take hours: Boto3 waits 60 seconds to connect by default and retries connection errors, so every service without a reachable endpoint cost up to four 60-second attempts in every region. Prowler now lowers the default connect timeout to 10 seconds, keeps the read timeout at 60 seconds, and exposes both through `--aws-connect-timeout` and `--aws-read-timeout`, or through the `PROWLER_AWS_BOTO3_CONNECT_TIMEOUT` and `PROWLER_AWS_BOTO3_READ_TIMEOUT` environment variables for deployments without a CLI. `--aws-retries-max-attempts 0` now disables retries instead of silently falling back to three, leaving a single attempt per call.
+
+  Read more in the [Boto3 configuration documentation](https://docs.prowler.com/user-guide/providers/aws/boto3-configuration).
+
+  ### 🐳 Image Provider — Reusable Vulnerability Database
+
+  The Image provider now honors `TRIVY_CACHE_DIR`. When the variable names a directory, Trivy keeps its vulnerability database there and Prowler leaves the directory in place after the scan, so the database is downloaded once instead of on every scan. Hosts without internet access can now scan images by pointing `TRIVY_CACHE_DIR` at a pre-populated database and setting `TRIVY_SKIP_DB_UPDATE=true`. Without the variable, the temporary cache is created and removed as before.
+
+  Read more in the [Image provider documentation](https://docs.prowler.com/user-guide/providers/image/getting-started-image#vulnerability-database-cache).
+
+  ### 🎫 Jira Integration — Faster Connection Test
+
+  Testing a Jira integration no longer reports a false failure on accounts with many projects. The connection test fetched the issue types of every project one request at a time, which could outlast the wait in the UI even when the check was about to succeed. Issue types are now fetched concurrently, a project whose issue types the integration user cannot see is no longer logged as an error, and the Integrations page keeps following the connection test instead of giving up after about a minute.
+
+  Read more in the [Jira integration documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-jira-integration).
+
+  ### 📚 Compliance — Catalog Integrity Fixes
+
+  A new integrity test runs over every compliance framework, asserting unique requirement IDs, no check listed twice within a requirement, and that every referenced check exists for its provider. The fixes it drove span 42 frameworks across AWS, Azure, GCP, GitHub, Kubernetes and Microsoft 365:
+
+  - **Duplicate requirement IDs:** identical copies are removed, and distinct requirements that shared an ID get their own, such as `1.10` in CIS AWS 5.0 and `rc_rp_1` for RC.RP-1 in NIST CSF 1.1. In Prowler ThreatScore for Azure, SQL auditing retention moves from `3.2.1` to `3.2.4`, and requirement `1.2.1` of Prowler ThreatScore for GCP now points to `iam_sa_no_user_managed_keys`.
+  - **Stale check references:** checks that no longer exist are replaced with their current name when there is a direct equivalent, or removed so the requirement reports as manual. Most of these were in the FedRAMP 20x KSI frameworks.
+
+  Renamed requirement IDs appear as new requirements for scans run after the upgrade.
+
+  The compliance overview task that runs after every scan is also faster: ThreatScore mappings are read once from the compliance template instead of from every finding, and rows are inserted with time-ordered `uuid7` IDs grouped by framework and requirement.
+
+  Read more in the [Compliance documentation](https://docs.prowler.com/user-guide/compliance/tutorials/compliance).
+
+  ### 🔍 Checks
+
+  `rolesanywhere_profile_restricts_session_permissions`, `iam_role_service_trust_restricts_source_to_account` and `codebuild_project_uses_allowed_github_organizations` no longer crash with `TypeError` when the scanning role is denied `iam:ListRoles`, which dropped every finding of those checks for the account. Without the role inventory, an enabled IAM Roles Anywhere profile without session scoping reports `MANUAL`, and CodeBuild projects whose service role cannot be resolved are skipped.
+
+  Explore all AWS checks at [Prowler Hub](https://hub.prowler.com/check?provider=aws).
+
+  ### 🔐 Security Updates
+
+  - `next` upgraded to 16.3.3 in the UI, patching unauthenticated remote code execution through AVIF image optimization ([GHSA-2xp9-vwfh-vxw4](https://github.com/advisories/GHSA-2xp9-vwfh-vxw4)) and on Windows-hosted servers ([GHSA-p293-qw3h-jr36](https://github.com/advisories/GHSA-p293-qw3h-jr36)).
+  - `sharp` upgraded to 0.35.4 in the UI, patching libheif image-decoding vulnerabilities ([GHSA-rgj7-g3m4-5g8c](https://github.com/advisories/GHSA-rgj7-g3m4-5g8c)).
+  - `nanoid`, `js-yaml` and `postcss`, plus eleven transitive UI dependencies, upgraded to patched versions, resolving 40 npm audit advisories (21 high, 15 moderate, 4 low).
+  - `libuuid` upgraded to 2.41.6-r1 in the MCP Server image, patching CVE-2026-53612, CVE-2026-53613, CVE-2026-53614, CVE-2026-76642, CVE-2026-78408 and CVE-2026-78410.
+
+  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.42.0) for the complete list of changes.
+</Update>
+
 <Update label="v5.41.0" description="September 2, 2026">
  ### 📥 Scans — Import Findings from the Browser

@@ -154,6 +154,8 @@ Only fields with a numeric range, a fixed value set, or a length cap are listed.
 | `max_days_secret_unused` | `7..365` days | |
 | `max_days_secret_unrotated` | `1..180` days | NIST IA-5: rotate quarterly; CIS ≤90 |
 | `min_kinesis_stream_retention_hours` | `24..8760` h | 1 day .. 1 year |
+| `inspector2_max_days_since_last_scan` | `1..90` days | |
+| `inspector2_active_finding_max_age_days` | `1..365` days | Default `192` matches the FedRAMP 20x rule that marks vulnerabilities still open after 192 days as accepted |
 | `shodan_api_key` | ≤512 chars | |

 ### Azure
@@ -40,6 +40,19 @@ The former build-time variables map to the new runtime variables as follows:

 `UI_CLOUD_ENABLED` is a plain runtime boolean flag that enables Prowler Cloud behavior when set to the exact string `"true"` and defaults to off; unlike the other renamed variables it has no legacy fallback, so `NEXT_PUBLIC_IS_CLOUD_ENV` is no longer read.

+`UI_SELF_REGISTRATION_ENABLED` is a runtime opt-out flag that Prowler Local Server reads only when `UI_CLOUD_ENABLED` is `"true"`. It defaults to on and turns off when set to `"false"`, matched case-insensitively so the same value can be shared with a backend setting written `False`. When it is off, the sign-up page only opens with an invitation token, the sign-in page drops its "Sign up" link, and the profile hides "Create organization"; invited users can still complete their registration. Outside a Prowler Cloud deployment the flag is ignored and account creation stays open.
+## Registry UI Rollout and Rollback
+
+`UI_REGISTRY_ENABLED` is an optional runtime flag for Prowler Cloud and Private Cloud. Registry is eligible only when both `UI_CLOUD_ENABLED` and `UI_REGISTRY_ENABLED` are the exact string `"true"` and the current user has the backend-authorized `manage_registry` permission. Unset, `"false"`, or malformed values fail closed. The flag defaults to off and is not a replacement for backend authorization. Registry access is independent of billing; Private Cloud can use it with `CLOUD_BILLING_ENABLED=false`.
+
+Roll out Registry only after the Registry backend dependency is deployed, intended roles have `manage_registry`, and acceptance with real credentials has exercised installation, provider account creation, credentials, connection, and scan launch. Deploy the UI with `UI_REGISTRY_ENABLED` unset or `"false"`; set it to `"true"` only in the prepared process environment, then restart or otherwise apply the environment update required by the platform. A Registry key must belong to the configured Registry environment; a production key does not authenticate against a development Registry.
+
+The Registry links read `PROWLER_REGISTRY_INDEX_URL`, the same base URL the backend installs artifacts from. The Registry page and the credential banner link to it, and its origin is allowed for images. `UI_REGISTRY_MEDIA_URL` adds the Registry media service origin so artifact logos load. When `PROWLER_REGISTRY_INDEX_URL` is unset or invalid, the links are hidden instead of pointing to the public Prowler Registry, which keeps private and air-gapped deployments from sending users to an unreachable host. `UI_REGISTRY_URL` is no longer read.
+
+The catalog displays all artifacts, including built-ins and packages containing only checks or compliance frameworks. Only external provider artifacts support Add. After confirmed installation, open Providers and select the option labeled Registry to configure an account. Creating accounts and running scans also require the corresponding provider and scan permissions. Removing an artifact keeps existing provider accounts, but future connections or scans can fail until the artifact is installed again.
+
+To roll back, set `UI_REGISTRY_ENABLED=false` or remove it and apply the environment update. Proxy, page, and action checks deny on their next request. Navigation refreshes from server-authorized access when the page is requested again. Rollback does not delete Registry credentials, tenant artifact records, or provider accounts.
+
 The build-time-only Sentry variables used for source-map upload — `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_AUTH_TOKEN`, and `SENTRY_RELEASE` — keep their names, as they are not part of Prowler Local Server's runtime configuration.

 ## Enabling Third-Party Integrations
@@ -2,6 +2,8 @@
 title: 'Basic Usage'
 ---

+import { VersionBadge } from "/snippets/version-badge.mdx"
+
 ## Running Prowler

 Running Prowler requires specifying the provider (e.g. `aws`, `gcp`, `azure`, `kubernetes`, `m365`, `github`, `iac` or `mongodbatlas`):
@@ -91,6 +93,18 @@ By default, `prowler` will scan all AWS regions.
 </Note>
 See more details about AWS Authentication in the [Authentication Section](/user-guide/providers/aws/authentication) section.

+- **AWS Retrier and Timeout Configuration**
+
+    <VersionBadge version="5.42.0" />
+
+    Tune the Boto3 standard retrier and the endpoint timeouts when AWS throttles the scan or when some endpoints are unreachable from the network Prowler runs in:
+
+    ```console
+    prowler aws --aws-retries-max-attempts 5 --aws-connect-timeout 5 --aws-read-timeout 30
+    ```
+
+    See the [Boto3 configuration](/user-guide/providers/aws/boto3-configuration) page for defaults and environment variables.
+
 ## Azure

 Azure requires specifying the auth method:
@@ -128,8 +128,8 @@ To update the environment file:
 Edit the `.env` file and change version values:

 ```env
-PROWLER_UI_VERSION="5.40.0"
-PROWLER_API_VERSION="5.40.0"
+PROWLER_UI_VERSION="5.44.0"
+PROWLER_API_VERSION="5.44.0"
 ```

 <Note>
@@ -71,7 +71,7 @@ Prowler supports a wide range of providers organized by category:
 | [LLM](/user-guide/providers/llm/getting-started-llm)                                     | Official | Models                       | CLI          |
 | [M365](/user-guide/providers/microsoft365/getting-started-m365)                           | Official | Tenants                      | UI, API, CLI |
 | [MongoDB Atlas](/user-guide/providers/mongodbatlas/getting-started-mongodbatlas)           | Official | Organizations                | UI, API, CLI |
-| [Okta](/user-guide/providers/okta/getting-started-okta)                                   | Official | Organizations                | CLI          |
+| [Okta](/user-guide/providers/okta/getting-started-okta)                                   | Official | Organizations                | UI, API, CLI |
 | [Vercel](/user-guide/providers/vercel/getting-started-vercel)                             | Official | Teams / Projects             | UI, API, CLI |

 ### Kubernetes
@@ -91,6 +91,8 @@ The following list includes all the AWS checks with configurable variables that
 | `iam_user_access_not_stale_to_sagemaker`                               | `max_unused_sagemaker_access_days`                | Integer         | `90`                                                                                                                                 |
 | `iam_user_accesskey_unused`                                            | `max_unused_access_keys_days`                     | Integer         | `45`                                                                                                                                 |
 | `iam_user_console_access_unused`                                       | `max_console_access_days`                         | Integer         | `45`                                                                                                                                 |
+| `inspector2_active_findings_within_max_age`                            | `inspector2_active_finding_max_age_days`          | Integer         | `192`                                                                                                                                |
+| `inspector2_coverage_recently_scanned`                                 | `inspector2_max_days_since_last_scan`             | Integer         | `3`                                                                                                                                  |
 | `kinesis_stream_data_retention_period`                                 | `min_kinesis_stream_retention_hours`              | Integer         | `168`                                                                                                                                |
 | `neptune_cluster_backup_enabled`                                       | `minimum_backup_retention_period`                 | Integer         | `7`                                                                                                                                  |
 | `opensearch_service_domains_not_publicly_accessible`                   | `trusted_ips`                                     | List of Strings | `[]`                                                                                                                                 |
@@ -490,6 +492,14 @@ aws:
  # MEDIUM
  ecr_repository_vulnerability_minimum_severity: "MEDIUM"

+  # AWS Inspector2
+  # aws.inspector2_coverage_recently_scanned
+  # Maximum days since Inspector2 last scanned an actively covered resource
+  inspector2_max_days_since_last_scan: 3
+  # aws.inspector2_active_findings_within_max_age
+  # Maximum days an Inspector2 finding can stay active since it was first observed
+  inspector2_active_finding_max_age_days: 192
+
  # AWS Trusted Advisor
  # aws.trustedadvisor_premium_support_plan_subscribed
  verify_premium_support_plans: True
@@ -1,14 +1,55 @@
 ---
-title: "Boto3 Retrier Configuration in Prowler"
+title: "Boto3 Retrier and Timeout Configuration in Prowler"
 ---

+import { VersionBadge } from "/snippets/version-badge.mdx"
+
 Prowler's AWS Provider leverages Boto3's [Standard](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/retries.html) retry mode to automatically retry client calls to AWS services when encountering errors or exceptions.

+## Timeout Configuration
+
+<VersionBadge version="5.42.0" />
+
+Every AWS API call is bounded by two timeouts:
+
+- Connect timeout: seconds to wait to establish a connection (TCP, proxy tunnel and TLS handshake) to the AWS endpoint. Prowler's default is 10 seconds, configurable via `--aws-connect-timeout 5`.
+- Read timeout: seconds to wait for a response once connected. Prowler's default is 60 seconds, configurable via `--aws-read-timeout 30`.
+
+Both timeouts can also be set through environment variables, which is the way to tune them in Prowler Cloud and other deployments without a CLI:
+
+```console
+export PROWLER_AWS_BOTO3_CONNECT_TIMEOUT=5
+export PROWLER_AWS_BOTO3_READ_TIMEOUT=30
+```
+
+CLI flags take precedence over the environment variables. Prowler sets both timeouts explicitly, so `AWS_DEFAULTS_MODE` and a `connect_timeout` in `~/.aws/config` are ignored; use the flag or the environment variable instead.
+
+<Note>
+Boto3 defaults both timeouts to 60 seconds. In networks with restricted egress (for example VPC endpoints for a subset of services, GovCloud or private deployments), every AWS service without a reachable endpoint used to cost up to 4 attempts × 60 seconds (the first call plus the 3 retries) for each region. Prowler lowers the connect timeout to 10 seconds so unreachable endpoints fail fast; lower it further together with `--aws-retries-max-attempts 0`, which disables retries and leaves a single attempt per call, if a scan still spends most of its time waiting on unreachable services.
+
+</Note>
+
+## Retries Configuration
+
+<VersionBadge version="5.44.0" />
+
+The number of retries is set with `--aws-retries-max-attempts`, where `0` disables retries. It can also be set through an environment variable, which is the way to tune it in Prowler Cloud and other deployments without a CLI:
+
+```console
+export PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS=0
+```
+
+The CLI flag takes precedence over the environment variable. The value must be a non-negative integer; when neither is set, Prowler uses 3 retries.
+
+<Warning>
+The environment variable is process-wide: it applies to every AWS provider built in the process where it is set, not only to a connection check. A scan started in that same process picks it up too. Boto3's Standard retry mode, which Prowler uses, also retries service-side throttling responses (see the errors listed below), so `0` disables retries for those as well. On a large account a scan can hit throttling under normal load, and with retries disabled that throttling becomes a hard failure instead of a retried call. Set the variable only on the processes that run connection checks; leave scan workers on the default, or raise their retry count instead of lowering it.
+</Warning>
+
 ## Retry Behavior Overview

 Boto3's Standard retry mode includes the following mechanisms:

- Maximum Retry Attempts: Default value set to 3, configurable via the `--aws-retries-max-attempts 5` argument.
+- Maximum Retry Attempts: Default value set to 3, configurable via the `--aws-retries-max-attempts 5` argument. `0` disables retries.

 - Expanded Error Handling: Retries occur for a comprehensive set of errors.

@@ -21,10 +21,30 @@ When scanning the China (`aws-cn`), European Sovereign Cloud (`aws-eusc`) or Gov

 - Specify the regions to audit within that partition using the `-f/--region` flag.

+- Declare the partition with the `PROWLER_AWS_PARTITION` environment variable, set to `aws`, `aws-cn`, `aws-eusc` or `aws-us-gov`.
+
 <Note>
 Refer to: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html#configuring-credentials for more information about the AWS credential configuration.

 </Note>
+### Declaring the Partition
+
+`PROWLER_AWS_PARTITION` tells Prowler which partition the scan runs against, without relying on a region being configured:
+
+```bash
+export PROWLER_AWS_PARTITION="aws-us-gov"
+```
+
+It matters most where nothing else says. Resolving an identity means calling STS before anything is known about the credentials, and with no region configured Prowler would otherwise start from the commercial endpoints. Declaring the partition makes that first call go to the right place, which is the difference between a scan that starts and one that fails on an endpoint the credentials cannot use.
+
+A region configured for the session still wins when it belongs to the declared partition, so a deployment in `us-gov-west-1` is not sent to `us-gov-east-1`. A region belonging to a different partition is ignored, since a partition that has been declared explicitly is the more deliberate statement of the two.
+
+When no configured region says which one to prefer, the first region of the partition is tried, and up to two more follow if it cannot be reached. A network that routes to only one region of its partition therefore works without having to declare which one that is. Only a connection failure moves on to the next region: a credential error is reported from the first, since it would be the same everywhere. A region excluded from the scan is tried last, so it is avoided whenever another region of the partition answers.
+
+<Note>
+Set it wherever the scan runs. For deployments that scan from containers, that means the environment of the containers doing the scanning, not only the one accepting the request.
+</Note>
+
 ### Scanning Specific Regions

 To scan a particular AWS region with Prowler, use:
@@ -22,9 +22,12 @@ Prowler requires read-only access to Cloudflare zones and their settings. The fo
 | Resource | Permission | Access | Description |
 |----------|------------|--------|-------------|
 | `Account` | `Account Settings` | `Read` | Required to list accounts and verify user identity |
-| `Zone` | `Zone` | `Read` | Required to list zones, rulesets, bot management, and SSL settings |
-| `Zone` | `Zone Settings` | `Read` | Required to read zone security settings (TLS, HSTS, WAF, etc.) |
-| `Zone` | `DNS` | `Read` | Required to read DNS records and DNSSEC status |
+| `Zone` | `Zone` | `Read` | Required to list zones |
+| `Zone` | `Zone Settings` | `Read` | Required to read zone security settings (SSL/TLS mode, TLS versions, HSTS, Always Use HTTPS, WAF, etc.) |
+| `Zone` | `DNS` | `Read` | Required to read DNS records (SPF, DMARC, DKIM, CAA) and DNSSEC status |
+| `Zone` | `SSL and Certificates` | `Read` | Required to read Universal SSL settings |
+| `Zone` | `Bot Management` | `Read` | Required to read Bot Fight Mode |
+| `Zone` | `Zone WAF` | `Read` | Required to read WAF custom, rate limiting, and managed rulesets |

 <Warning>
 Ensure the API Token has access to all zones targeted for scanning. Missing permissions may cause some checks to fail or return incomplete results.
@@ -46,8 +49,8 @@ Create a **User API Token**, not an Account API Token. User API Tokens are creat

 **Quick Setup:** Use these pre-configured links to open the Cloudflare Dashboard with the required permissions already selected:

- [Create User API Token](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner) — creates a **User API Token** (recommended). Opens the **Create Custom Token** form prefilled with the four required read-only scopes (`Account Settings`, `Zone`, `Zone Settings`, `DNS`) and the name `Prowler Security Scanner`. Adjust **Account Resources** and **Zone Resources** to match the accounts and zones you want to scan, then click **Create Token**.
- [Create Account-Owned API Token](https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&name=Prowler%20Security%20Scanner) — creates an [account-owned token](https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/) instead. Use this for automation or CI/CD where the token should not depend on a specific user account remaining active. Requires the **Super Administrator** or **Administrator** role on the account.
+- [Create User API Token](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22bot_management%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_waf%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner) — creates a **User API Token** (recommended). Opens the **Create Custom Token** form prefilled with the seven required read-only scopes (`Account Settings`, `Zone`, `Zone Settings`, `DNS`, `SSL and Certificates`, `Bot Management`, `Zone WAF`) and the name `Prowler Security Scanner`. Adjust **Account Resources** and **Zone Resources** to match the accounts and zones you want to scan, then click **Create Token**.
+- [Create Account-Owned API Token](https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22bot_management%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_waf%22%2C%22type%22%3A%22read%22%7D%5D&name=Prowler%20Security%20Scanner) — creates an [account-owned token](https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/) instead. Use this for automation or CI/CD where the token should not depend on a specific user account remaining active. Requires the **Super Administrator** or **Administrator** role on the account.

 <Note>
 Template URLs only pre-fill the token creation form. Review the permissions, configure resources, and click **Create Token** to complete the process.
@@ -66,6 +69,9 @@ Template URLs only pre-fill the token creation form. Review the permissions, con
     - `Zone` — `Zone` — `Read`
     - `Zone` — `Zone Settings` — `Read`
     - `Zone` — `DNS` — `Read`
+     - `Zone` — `SSL and Certificates` — `Read`
+     - `Zone` — `Bot Management` — `Read`
+     - `Zone` — `Zone WAF` — `Read`
   - **Zone Resources:** Select either:
     - **Include → All zones** (to scan all zones in the account)
     - **Include → Specific zone** (to limit access to specific zones)
@@ -11,16 +11,16 @@ Prowler for Cloudflare scans zones for security misconfigurations, including SSL
 Set up authentication for Cloudflare with the [Cloudflare Authentication](/user-guide/providers/cloudflare/authentication) guide before starting either path:

 - Create a Cloudflare User API Token (recommended) or locate the Global API Key
- Grant the required read-only permissions (`Account Settings:Read`, `Zone:Read`, `Zone Settings:Read`, `DNS:Read`)
+- Grant the required read-only permissions (`Account Settings:Read`, `Zone:Read`, `Zone Settings:Read`, `DNS:Read`, `SSL and Certificates:Read`, `Bot Management:Read`, `Zone WAF:Read`)
 - Identify the Cloudflare Account ID to use as the provider identifier

 <Note>
 **Quick Setup:** Use these pre-configured links to create a token with the required permissions already selected:

- [Create User API Token](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner) — creates a User API Token (recommended).
- [Create Account-Owned API Token](https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%5D&name=Prowler%20Security%20Scanner) — creates an [account-owned token](https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/), better suited for automation and CI/CD.
+- [Create User API Token](https://dash.cloudflare.com/profile/api-tokens?permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22bot_management%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_waf%22%2C%22type%22%3A%22read%22%7D%5D&accountId=%2A&zoneId=all&name=Prowler%20Security%20Scanner) — creates a User API Token (recommended).
+- [Create Account-Owned API Token](https://dash.cloudflare.com/?to=/:account/api-tokens&permissionGroupKeys=%5B%7B%22key%22%3A%22account_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_settings%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22dns%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22ssl_and_certificates%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22bot_management%22%2C%22type%22%3A%22read%22%7D%2C%7B%22key%22%3A%22zone_waf%22%2C%22type%22%3A%22read%22%7D%5D&name=Prowler%20Security%20Scanner) — creates an [account-owned token](https://developers.cloudflare.com/fundamentals/api/how-to/account-owned-token-template/), better suited for automation and CI/CD.

-Both links open the Cloudflare Dashboard with the four required read-only scopes (`Account Settings`, `Zone`, `Zone Settings`, `DNS`) and the name `Prowler Security Scanner` prefilled. See [Cloudflare Authentication](/user-guide/providers/cloudflare/authentication#api-token-recommended) for the equivalent manual steps.
+Both links open the Cloudflare Dashboard with the seven required read-only scopes (`Account Settings`, `Zone`, `Zone Settings`, `DNS`, `SSL and Certificates`, `Bot Management`, `Zone WAF`) and the name `Prowler Security Scanner` prefilled. See [Cloudflare Authentication](/user-guide/providers/cloudflare/authentication#api-token-recommended) for the equivalent manual steps.
 </Note>

 <CardGroup cols={2}>
@@ -96,6 +96,29 @@ Install Trivy using one of the following methods:

 For additional installation methods, see the [Trivy installation guide](https://trivy.dev/latest/getting-started/installation/).

+### Vulnerability Database Cache
+
+<VersionBadge version="5.42.0" />
+
+Trivy keeps its vulnerability database in a cache directory. By default Prowler gives it a temporary one and removes it when the scan ends, so the database is downloaded again for every scan.
+
+Set `TRIVY_CACHE_DIR` to a directory that persists and the database is downloaded once and reused:
+
+```bash
+export TRIVY_CACHE_DIR="$HOME/.cache/trivy"
+prowler image --image <image>
+```
+
+Prowler never deletes a directory you supply. Trivy still creates and updates its cache and database files inside it.
+
+<Note>
+A host with no internet access needs a pre-populated vulnerability database in a persistent directory, with `TRIVY_CACHE_DIR` pointing at it. Populate the directory on a machine that does have access and copy it across.
+
+Trivy tries to refresh the database when it considers it stale, and that download fails without network access. Set `TRIVY_SKIP_DB_UPDATE=true` (and `TRIVY_SKIP_JAVA_DB_UPDATE=true` if Java scanning is enabled) so it uses the supplied database as is.
+
+The database ages. A scan run against an old one reports only the vulnerabilities known when it was built, and nothing in the output says so, so keep track of when it was last refreshed.
+</Note>
+

 ### Supported Scanners

@@ -12,7 +12,7 @@ The following steps apply to Prowler Cloud and Prowler Local Server.
 1. Sign in to the [OCI Console](https://cloud.oracle.com/) and open **Tenancy Details** to copy the Tenancy OCID.
 2. Go to **Identity & Security** → **Users**, select the principal that owns the API key, and copy the **User OCID**.
 3. Generate or locate the API key fingerprint and private key for that user. Follow the [Config File Authentication steps](/user-guide/providers/oci/authentication#config-file-authentication-manual-api-key-setup) to create or rotate the key pair and copy the fingerprint.
-4. Note the **Region** identifier to scan (for example, `us-ashburn-1`).
+4. In **Tenancy Details**, note the **Home Region** identifier (for example, `me-abudhabi-1`). Any other region the tenancy is subscribed to also works.

 ### Step 2: Access Prowler Cloud
 1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
@@ -26,12 +26,18 @@ Prowler Cloud connects to OCI with API key credentials. Provide:

 - **User OCID** for the API key owner
 - **Fingerprint** of the API key
- **Region** (for example, `us-ashburn-1`)
+- **Home Region**: select it from the list (for example, `me-abudhabi-1`)
 - **Private Key Content** (paste the full PEM value)
 - **Passphrase (Optional)** if the private key is encrypted

 Select **Next**, then **Launch Scan** to validate the connection and start the first OCI scan. The private key content is encoded for secure transmission.

+<Note>
+The home region is used only to validate the credentials and discover the regions the tenancy is subscribed to. It does not limit the scan: Prowler audits every subscribed region. OCI Identity and Access Management (IAM) only answers in subscribed regions, so a tenancy that is not subscribed to the selected region cannot be validated.
+</Note>
+
+Providers created without a region keep using `us-ashburn-1` for validation. If such a provider fails with `401 NotAuthenticated`, update its credentials and select the home region.
+
 ![Add OCI API Key Credentials](./images/oci-add-api-key-credentials.png)

 ---
@@ -334,6 +340,11 @@ prowler oci \

 #### Region Issues

+**Error: "OCI credential validation failed" with `401 NotAuthenticated` on `get_tenancy`**
+- The tenancy is not subscribed to the region used for validation (by default `us-ashburn-1`)
+- In Prowler Cloud or Prowler Local Server, update the provider credentials and select the tenancy home region
+- In Prowler CLI, set `region` in `~/.oci/config` to the home region. All subscribed regions are still scanned; `--region` also works but limits the scan to that region
+
 **Error: "Invalid region"**
 - Check available regions: `prowler oci --list-regions`
 - Verify your tenancy is subscribed to the region
@@ -241,7 +241,7 @@ steps:

 ### Cloudflare

-Create a Cloudflare API Token with `Zone:Read`, `Zone Settings:Read`, and `DNS:Read` permissions ([provider auth docs](/user-guide/providers/cloudflare/authentication)). Then:
+Create a Cloudflare API Token with the `Account Settings:Read`, `Zone:Read`, `Zone Settings:Read`, `DNS:Read`, `SSL and Certificates:Read`, `Bot Management:Read`, and `Zone WAF:Read` permissions ([provider auth docs](/user-guide/providers/cloudflare/authentication)). Then:

 ```yaml
 - uses: prowler-cloud/prowler@5.25
@@ -148,6 +148,12 @@ New roles have no provider visibility by default. Assign at least one Provider G

 Integrations follow the visibility of the providers attached to them: a role can see an integration when it can access at least one of its providers, and only the providers visible to that role are listed on the integration. Editing or deleting an integration attached to providers outside the visibility of the role is not allowed. Integrations that are not attached to any provider, such as Jira, are tenant-wide and remain available to every role with the **Manage Integrations** permission.

+#### Task Visibility and Revocation
+
+<VersionBadge version="5.44.0" />
+
+Background tasks, such as provider deletions, connection checks and scans, follow the visibility of the provider they belong to: a role can see a task when it can access its provider. Tasks that carry no provider reference are treated as tenant-wide and are visible to every role. Revoking a pending task requires the same permission as the operation that queued it, for example **Manage Scans** for a scan. Provider deletions cannot be revoked.
+
 #### Creating a Provider Group

 Follow these steps to create a provider group in your account:
@@ -89,6 +89,14 @@ After adding your cloud account credentials, click the `Check connection` button

 <img src="/images/test-connection-button.png" alt="Test Connection" width="700" />

+<Note>
+For a single AWS account, Prowler tests the connection as part of the `Connect account` step, so the wizard moves straight to launching the scan.
+</Note>
+
+<Note>
+To delegate the AWS connection, select `I don't have access, invite a teammate` on the same step when you cannot create the IAM role or do not have the account credentials. Prowler App sends the invitation to the tenant and shows the link to share. Prowler Cloud also emails it. This option is available to users who can manage the account.
+</Note>
+
 ## Step 6: Scan Started
 After the connection check succeeds, save the provider and start your first scan with the `Launch Scan` button. The `Scans` section shows the scan in progress:

@@ -4,6 +4,22 @@ All notable changes to the **Prowler MCP Server** are documented in this file.

 <!-- changelog: release notes start -->

+## [0.12.2] (Prowler v5.43.0)
+
+### 🔐 Security
+
+- Bumped `anyio` to 4.14.2 to resolve CVE-2026-63374 [(#12848)](https://github.com/prowler-cloud/prowler/pull/12848)
+
+---
+
+## [0.12.1] (Prowler v5.42.0)
+
+### 🔐 Security
+
+- `libuuid` upgraded to 2.41.6-r1 in the container image, patching CVE-2026-53612, CVE-2026-53613, CVE-2026-53614, CVE-2026-76642, CVE-2026-78408 and CVE-2026-78410 [(#12780)](https://github.com/prowler-cloud/prowler/pull/12780)
+
+---
+
 ## [0.12.0] (Prowler v5.41.0)

 ### 🚀 Added
@@ -25,13 +25,15 @@ RUN --mount=type=cache,target=/root/.cache/uv \
 # =============================================================================
 # Final stage - Minimal runtime environment
 # =============================================================================
-FROM python:3.13.14-alpine3.23@sha256:9fdbf2e3e82628351513560b121e2ee6ce31cac212be9e070c5a5e2769fb5e76
+FROM python:3.14.7-alpine3.23@sha256:218761489de417a6eb0808e264cbdd7043ec6659fe5a61898815e9848536541d

 LABEL maintainer="https://github.com/prowler-cloud"

 # High CVEs fixed in Alpine 3.23 but not yet in the pinned base image:
 #   sqlite-libs 3.53.4-r0  CVE-2026-11822, CVE-2026-11824  (image ships 3.51.2-r0)
 #   libcrypto3/libssl3 3.5.8-r0  CVE-2026-14456            (image ships 3.5.7-r0)
+#   libuuid 2.41.6-r1  CVE-2026-53612, -53613, -53614, -76642, -78408, -78410
+#     (image ships 2.41.4-r0; -78408 is the one that needs -r1 rather than -r0)
 # The base image pins python 3.13.14, which has not been rebuilt since those
 # packages were published, so the upgrade is taken here rather than by moving
 # the pin -- the newest published python:3.13-alpine3.23 carries the same
@@ -43,7 +45,8 @@ LABEL maintainer="https://github.com/prowler-cloud"
 RUN apk add --no-cache --upgrade \
    "sqlite-libs>=3.53.4-r0" \
    "libcrypto3>=3.5.8-r0" \
-    "libssl3>=3.5.8-r0"
+    "libssl3>=3.5.8-r0" \
+    "libuuid>=2.41.6-r1"

 # Create non-root user for security
 # Using specific UID/GID for consistency across environments
@@ -0,0 +1 @@
+`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9
@@ -81,5 +81,6 @@ constraint-dependencies = [
  "cryptography==50.0.0",
  "joserfc==1.6.8",
  "mcp==1.28.1",
+  "pyjwt==2.14.0",
  "python-multipart==0.0.30"
 ]
@@ -13,6 +13,7 @@ constraints = [
    { name = "cryptography", specifier = "==50.0.0" },
    { name = "joserfc", specifier = "==1.6.8" },
    { name = "mcp", specifier = "==1.28.1" },
+    { name = "pyjwt", specifier = "==2.14.0" },
    { name = "python-multipart", specifier = "==0.0.30" },
 ]

@@ -39,15 +40,15 @@ wheels = [

 [[package]]
 name = "anyio"
-version = "4.13.0"
+version = "4.14.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "idna" },
    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/19/14/2c5dd9f512b66549ae92767a9c7b330ae88e1932ca57876909410251fe13/anyio-4.13.0.tar.gz", hash = "sha256:334b70e641fd2221c1505b3890c69882fe4a2df910cba14d97019b90b24439dc", size = 231622, upload-time = "2026-03-24T12:59:09.671Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/61/cc/a381afa6efea9f496eff839d4a6a1aed3bfafc7b3ab4b0d1b243a12573dd/anyio-4.14.2.tar.gz", hash = "sha256:cfa139f3ed1a23ee8f88a145ddb5ac7605b8bbfd8592baacd7ce3d8bb4313c7f", size = 260176, upload-time = "2026-07-12T20:29:07.082Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/da/42/e921fccf5015463e32a3cf6ee7f980a6ed0f395ceeaa45060b61d86486c2/anyio-4.13.0-py3-none-any.whl", hash = "sha256:08b310f9e24a9594186fd75b4f73f4a4152069e3853f1ed8bfbf58369f4ad708", size = 114353, upload-time = "2026-03-24T12:59:08.246Z" },
+    { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" },
 ]

 [[package]]
@@ -977,11 +978,11 @@ wheels = [

 [[package]]
 name = "pyjwt"
-version = "2.13.0"
+version = "2.14.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/af/c3/8a3b59c25070cc61dc517fbdfa5dc0904670c96f605cc69759dc09166b99/pyjwt-2.14.0.tar.gz", hash = "sha256:77283c83fb56ecf566a886c757a714bc83668e38156de2cce8263302f42e0b86", size = 113177, upload-time = "2026-09-11T13:11:54.638Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/97/672cb32ce0dfea44b740cb7b4f97038463b9cf7c0ead1aacf595572851d6/pyjwt-2.14.0-py3-none-any.whl", hash = "sha256:ad0cef71c756a56e74863c2919cf0985f72decbcfcb550ee2f422e7c62b5eedc", size = 32896, upload-time = "2026-09-11T13:11:53.409Z" },
 ]

 [package.optional-dependencies]
@@ -1292,8 +1293,8 @@ name = "secretstorage"
 version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "cryptography" },
-    { name = "jeepney" },
+    { name = "cryptography", marker = "sys_platform != 'win32'" },
+    { name = "jeepney", marker = "sys_platform != 'win32'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" }
 wheels = [
@@ -38,6 +38,7 @@
        "glue:GetSecurityConfiguration*",
        "glue:SearchTables",
        "glue:GetMLTransforms",
+        "inspector2:BatchGetFindingDetails",
        "lambda:GetFunction*",
        "lambda:GetLayerVersion",
        "logs:FilterLogEvents",
@@ -210,6 +210,7 @@ Resources:
                  - "glue:GetSecurityConfiguration*"
                  - "glue:SearchTables"
                  - "glue:GetMLTransforms"
+                  - "inspector2:BatchGetFindingDetails"
                  - "lambda:GetFunction*"
                  - "logs:FilterLogEvents"
                  - "lightsail:GetRelationalDatabases"
@@ -479,6 +480,7 @@ Resources:
                          - "glue:GetSecurityConfiguration*"
                          - "glue:SearchTables"
                          - "glue:GetMLTransforms"
+                          - "inspector2:BatchGetFindingDetails"
                          - "lambda:GetFunction*"
                          - "logs:FilterLogEvents"
                          - "lightsail:GetRelationalDatabases"
@@ -4,6 +4,77 @@ All notable changes to the **Prowler SDK** are documented in this file.

 <!-- changelog: release notes start -->

+## [5.44.0] (Prowler v5.44.0)
+
+### 🚀 Added
+
+- `PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS` environment variable to set the Boto3 retries for deployments without CLI flags [(#12870)](https://github.com/prowler-cloud/prowler/pull/12870)
+
+### 🐞 Fixed
+
+- STS calls after role assumption use the answering region, avoiding a second wait for an unreachable partition region [(#12870)](https://github.com/prowler-cloud/prowler/pull/12870)
+
+### 🔐 Security
+
+- Pass the E2E AWS credentials to the UI E2E workflow through environment variables instead of template expansion [(#12864)](https://github.com/prowler-cloud/prowler/pull/12864)
+
+---
+
+## [5.43.0] (Prowler v5.43.0)
+
+### 🚀 Added
+
+- `FedRAMP-20x-KSI` universal compliance framework (`fedramp_20x_ksi_2026`) with the 46 Key Security Indicators from the FedRAMP Consolidated Rules 2026 mapped for AWS, Azure, GCP, Kubernetes and M365 [(#11701)](https://github.com/prowler-cloud/prowler/pull/11701)
+- `smn_topic_subscriptions` check for Huawei Cloud provider: SMN topics have at least one subscription configured [(#12186)](https://github.com/prowler-cloud/prowler/pull/12186)
+- `inspector2_coverage_scan_status_active`, `inspector2_coverage_recently_scanned`, `inspector2_active_findings_no_known_exploited_vulnerabilities`, `inspector2_active_findings_kev_within_due_date`, `inspector2_active_findings_within_max_age`, `elbv2_listener_fips_tls_enabled` and `transfer_server_fips_security_policy_enabled` checks for AWS provider, covering FedRAMP 20x Class C vulnerability detection, CISA KEV remediation and FIPS cryptography rules; the KEV checks require `inspector2:BatchGetFindingDetails`, now in the Prowler additions policy [(#12808)](https://github.com/prowler-cloud/prowler/pull/12808)
+- `FedRAMP-20x-FRR-Class-C` universal compliance framework (`fedramp_20x_frr_class_c_2026`) with the 158 provider rules of the FedRAMP 20x Class C ruleset from the FedRAMP Consolidated Rules 2026 for AWS, Azure, GCP, Kubernetes and M365 [(#12808)](https://github.com/prowler-cloud/prowler/pull/12808)
+
+### 🔄 Changed
+
+- FedRAMP 20x Phase One pilot frameworks `fedramp_20x_ksi_low_aws`, `fedramp_20x_ksi_low_azure` and `fedramp_20x_ksi_low_gcp` replaced by `fedramp_20x_ksi_2026` [(#12855)](https://github.com/prowler-cloud/prowler/pull/12855)
+
+### 🐞 Fixed
+
+- `security_2sv_enforced` reports domain-wide 2-Step Verification failures as FAIL even when every failing setting is overridden for a group or organizational unit [(#12700)](https://github.com/prowler-cloud/prowler/pull/12700)
+- Bootstrap STS calls now try up to two more regions of the partition declared in `PROWLER_AWS_PARTITION` when the first one cannot be reached, so a deployment that routes to only one region of its partition no longer fails on an endpoint it has no path to. This covers validating credentials, assuming a role and getting an MFA session token [(#12799)](https://github.com/prowler-cloud/prowler/pull/12799)
+- `KeyError` in M365 Defender malware, anti-phishing and inbound anti-spam checks when the tenant has Standard or Strict preset security policies [(#12809)](https://github.com/prowler-cloud/prowler/pull/12809)
+- Azure Defender security contacts and Key Vault key rotation policies now use the endpoints of the selected cloud (`--azure-region`) instead of the hardcoded `management.azure.com` and `vault.azure.net` hosts, so both work on `AzureUSGovernment` and `AzureChinaCloud` [(#12813)](https://github.com/prowler-cloud/prowler/pull/12813)
+
+### 🔐 Security
+
+- `libsqlite3-0`, `gzip`, `perl-base`, `libssh2-1t64` and `libpcre2-8-0` upgraded in the SDK container image, patching nine high Debian CVEs [(#12804)](https://github.com/prowler-cloud/prowler/pull/12804)
+- PowerShell from 7.5.9 to 7.5.11 in the SDK container image, bundling .NET runtime 9.0.20 and patching CVE-2026-62901 [(#12811)](https://github.com/prowler-cloud/prowler/pull/12811)
+- Bumped `anyio` to 4.14.2 to resolve CVE-2026-63374 [(#12848)](https://github.com/prowler-cloud/prowler/pull/12848)
+
+---
+
+## [5.42.0] (Prowler v5.42.0)
+
+### 🚀 Added
+
+- AWS ISO partitions (`aws-iso`, `aws-iso-b`, `aws-iso-e` and `aws-iso-f`) to the AWS service region matrix, generated from the endpoints data bundled with botocore [(#12759)](https://github.com/prowler-cloud/prowler/pull/12759)
+- `--aws-connect-timeout` and `--aws-read-timeout` CLI flags, plus `PROWLER_AWS_BOTO3_CONNECT_TIMEOUT` and `PROWLER_AWS_BOTO3_READ_TIMEOUT` environment variables, to bound how long each AWS API call waits for an endpoint [(#12774)](https://github.com/prowler-cloud/prowler/pull/12774)
+
+### 🔄 Changed
+
+- AWS provider default Boto3 connect timeout lowered from 60 to 10 seconds, so scans in restricted-egress networks (VPC endpoints for a subset of services, GovCloud, private deployments) no longer spend 4 minutes per region on every service whose endpoint is unreachable [(#12774)](https://github.com/prowler-cloud/prowler/pull/12774)
+
+### 🐞 Fixed
+
+- Duplicate requirement ids, checks listed twice in a requirement and references to non-existent checks across compliance frameworks, now guarded by a catalog integrity test [(#12717)](https://github.com/prowler-cloud/prowler/pull/12717)
+- Duplicate requirement `3.2.1` in ProwlerThreatScore for Azure (SQL auditing retention is now `3.2.4`) and doubled check id in requirement `1.2.1` of ProwlerThreatScore for GCP [(#12717)](https://github.com/prowler-cloud/prowler/pull/12717)
+- Jira connection checks no longer log an error when a single project has no issue types visible to the integration user (typically a missing "create issue" permission on that project), a case the caller already treats as non-fatal [(#12742)](https://github.com/prowler-cloud/prowler/pull/12742)
+- `Jira.test_connection()` now fetches each project's issue types concurrently instead of one request at a time, so accounts with many Jira projects no longer take tens of seconds (unbounded, scaling with the project count) to verify the connection [(#12742)](https://github.com/prowler-cloud/prowler/pull/12742)
+- `AwsProvider.get_available_aws_service_regions()` now returns an empty set for an unknown service or partition instead of raising `KeyError`, so a service unavailable in the audited partition is skipped [(#12759)](https://github.com/prowler-cloud/prowler/pull/12759)
+- `AwsProvider.generate_regional_clients()` now returns an empty dict instead of `None` when the regional clients cannot be built, a failure that surfaced later as `AttributeError: 'NoneType' object has no attribute 'values'` [(#12759)](https://github.com/prowler-cloud/prowler/pull/12759)
+- `AwsProvider.get_global_region()` now returns a real region for each ISO partition instead of the `aws-iso-global` pseudo endpoint, which collapsed the four partitions into one answer [(#12759)](https://github.com/prowler-cloud/prowler/pull/12759)
+- Bootstrap STS calls now use the session region when `PROWLER_AWS_PARTITION` is set and the region belongs to that partition, instead of always going to the partition's global STS region, which a deployment reached only through its own region's VPC endpoints cannot route to [(#12764)](https://github.com/prowler-cloud/prowler/pull/12764)
+- The Image provider now uses the directory named by `TRIVY_CACHE_DIR` when one is set, instead of a fresh temporary directory it deletes afterwards, so a deployment can supply a vulnerability database it already holds and one with network access stops re-downloading the database for every image it scans [(#12773)](https://github.com/prowler-cloud/prowler/pull/12773)
+- `--aws-retries-max-attempts 0` now disables Boto3 retries instead of being silently ignored in favour of the default of 3 [(#12774)](https://github.com/prowler-cloud/prowler/pull/12774)
+- `rolesanywhere_profile_restricts_session_permissions`, `iam_role_service_trust_restricts_source_to_account` and `codebuild_project_uses_allowed_github_organizations` crashing with `TypeError` when `iam:ListRoles` is denied [(#12785)](https://github.com/prowler-cloud/prowler/pull/12785)
+
+---
+
 ## [5.41.0] (Prowler v5.41.0)

 ### 🚀 Added
@@ -0,0 +1 @@
+OCI API key credentials accept a home region to bootstrap identity calls, so tenancies not subscribed to us-ashburn-1 can connect
@@ -0,0 +1 @@
+`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9
@@ -277,7 +277,6 @@
        }
      ],
      "Checks": [
-        "guardduty_is_enabled",
        "guardduty_is_enabled"
      ],
      "ConfigRequirements": [
@@ -497,7 +496,7 @@
      "Checks": []
    },
    {
-      "Id": "Create Cost Anomaly Detection monitors to alert spending anomalies",
+      "Id": "Create Cost Anomaly Detection monitors to alert spending anomalies (Prod)",
      "Description": "Develop monitoring systems for detecting cost anomalies and generating alerts for irregular spending patterns.",
      "Attributes": [
        {
@@ -510,7 +509,7 @@
      "Checks": []
    },
    {
-      "Id": "Create Cost Anomaly Detection monitors to alert spending anomalies",
+      "Id": "Create Cost Anomaly Detection monitors to alert spending anomalies (QA)",
      "Description": "Establish monitoring systems for cost anomaly detection to promptly notify about unusual spending patterns.",
      "Attributes": [
        {
@@ -618,7 +617,7 @@
      ]
    },
    {
-      "Id": "Export scan results as metrics in centralized collector",
+      "Id": "Export scan results as metrics in centralized collector (EC2)",
      "Description": "Export scan results as metrics to a centralized collector.",
      "Attributes": [
        {
@@ -667,7 +666,7 @@
      ]
    },
    {
-      "Id": "Export scan results as metrics in centralized collector",
+      "Id": "Export scan results as metrics in centralized collector (ECR)",
      "Description": "Generate metric data from scan results and store it in a centralized collector.",
      "Attributes": [
        {
@@ -1189,7 +1188,7 @@
      ]
    },
    {
-      "Id": "Export metrics in centralized collector",
+      "Id": "Export metrics in centralized collector (Shield Advanced)",
      "Description": "Exporting metrics to a centralized collector for data aggregation and analysis.",
      "Attributes": [
        {
@@ -1367,7 +1366,7 @@
      "Checks": []
    },
    {
-      "Id": "Export metrics in centralized collector",
+      "Id": "Export metrics in centralized collector (WAFv2)",
      "Description": "Exporting metrics to a centralized collector for comprehensive data aggregation.",
      "Attributes": [
        {
@@ -334,7 +334,6 @@
        "iam_role_cross_service_confused_deputy_prevention",
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
-        "iam_root_hardware_mfa_enabled",
        "iam_user_hardware_mfa_enabled",
        "iam_user_mfa_enabled_console_access",
        "iam_administrator_access_with_mfa"
@@ -472,11 +472,9 @@
        "emr_cluster_publicly_accesible",
        "glacier_vaults_policy_public_access",
        "awslambda_function_not_publicly_accessible",
-        "awslambda_function_not_publicly_accessible",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
        "kms_key_not_publicly_accessible",
-        "opensearch_service_domains_not_publicly_accessible",
        "redshift_cluster_public_access",
        "s3_account_level_public_access_blocks",
        "s3_bucket_public_access",
@@ -493,7 +491,6 @@
        "eks_cluster_not_publicly_accessible",
        "elb_internet_facing",
        "elbv2_internet_facing",
-        "s3_account_level_public_access_blocks",
        "sns_topics_not_publicly_accessible",
        "sqs_queues_not_publicly_accessible",
        "ssm_documents_set_as_public",
@@ -553,7 +550,6 @@
        "awslambda_function_invoke_api_operations_cloudtrail_logging_enabled",
        "cloudfront_distributions_logging_enabled",
        "cloudtrail_bedrock_logging_enabled",
-        "cloudtrail_cloudwatch_logging_enabled",
        "cloudtrail_logs_s3_bucket_access_logging_enabled",
        "directoryservice_directory_log_forwarding_enabled",
        "eks_control_plane_logging_all_types_enabled",
@@ -771,7 +767,6 @@
        "ec2_securitygroup_not_used",
        "ec2_securitygroup_with_many_ingress_egress_rules",
        "elbv2_desync_mitigation_mode",
-        "elbv2_desync_mitigation_mode",
        "route53_domains_privacy_protection_enabled",
        "route53_domains_transferlock_enabled",
        "shield_advanced_protection_in_associated_elastic_ips",
@@ -268,7 +268,6 @@
        "iam_role_administratoraccess_policy",
        "iam_aws_attached_policy_no_administrative_privileges",
        "iam_customer_unattached_policy_no_administrative_privileges",
-        "iam_role_administratoraccess_policy",
        "iam_user_administrator_access_policy",
        "organizations_delegated_administrators",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
@@ -1936,9 +1935,7 @@
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "cloudwatch_changes_to_network_gateways_alarm_configured",
        "cloudwatch_changes_to_network_route_tables_alarm_configured",
-        "cloudwatch_changes_to_vpcs_alarm_configured",
-        "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled",
-        "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled"
+        "cloudwatch_changes_to_vpcs_alarm_configured"
      ]
    },
    {
@@ -3866,7 +3863,6 @@
        }
      ],
      "Checks": [
-        "acm_certificates_transparency_logs_enabled",
        "acm_certificates_transparency_logs_enabled",
        "apigateway_restapi_logging_enabled",
        "apigatewayv2_api_access_logging_enabled",
@@ -3945,7 +3941,6 @@
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_user_hardware_mfa_enabled",
-        "iam_user_mfa_enabled_console_access",
        "s3_bucket_no_mfa_delete"
      ]
    },
@@ -5219,8 +5214,6 @@
        "iam_customer_unattached_policy_no_administrative_privileges",
        "iam_group_administrator_access_policy",
        "iam_inline_policy_no_administrative_privileges",
-        "iam_policy_cloudshell_admin_not_attached",
-        "iam_role_administratoraccess_policy",
        "iam_user_administrator_access_policy",
        "organizations_delegated_administrators",
        "rds_cluster_default_admin",
@@ -5291,8 +5284,6 @@
        "iam_customer_unattached_policy_no_administrative_privileges",
        "iam_group_administrator_access_policy",
        "iam_inline_policy_no_administrative_privileges",
-        "iam_policy_cloudshell_admin_not_attached",
-        "iam_role_administratoraccess_policy",
        "iam_user_administrator_access_policy",
        "organizations_delegated_administrators",
        "rds_cluster_default_admin",
@@ -6357,8 +6348,7 @@
      ],
      "Checks": [
        "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts",
-        "cognito_user_pool_blocks_potential_malicious_sign_in_attempts",
-        "cognito_user_pool_blocks_compromised_credentials_sign_in_attempts"
+        "cognito_user_pool_blocks_potential_malicious_sign_in_attempts"
      ]
    },
    {
@@ -6670,7 +6660,6 @@
        "sagemaker_training_jobs_intercontainer_encryption_enabled",
        "sagemaker_training_jobs_volume_and_output_encryption_enabled",
        "sns_topics_kms_encryption_at_rest_enabled",
-        "sqs_queues_server_side_encryption_enabled",
        "storagegateway_fileshare_encryption_enabled",
        "transfer_server_in_transit_encryption_enabled",
        "workspaces_volume_encryption_enabled"
@@ -7696,13 +7685,11 @@
        "dynamodb_accelerator_cluster_in_transit_encryption_enabled",
        "transfer_server_in_transit_encryption_enabled",
        "dms_endpoint_redis_in_transit_encryption_enabled",
-        "dynamodb_accelerator_cluster_in_transit_encryption_enabled",
        "ec2_transitgateway_auto_accept_vpc_attachments",
        "elasticache_redis_cluster_in_transit_encryption_enabled",
        "kafka_cluster_in_transit_encryption_enabled",
        "kafka_connector_in_transit_encryption_enabled",
-        "redshift_cluster_in_transit_encryption_enabled",
-        "transfer_server_in_transit_encryption_enabled"
+        "redshift_cluster_in_transit_encryption_enabled"
      ]
    },
    {
@@ -10967,7 +10954,6 @@
        "kms_cmk_not_multi_region",
        "cloudfront_distributions_geo_restrictions_enabled",
        "cloudtrail_multi_region_enabled_logging_management_events",
-        "kms_cmk_not_multi_region",
        "organizations_scp_check_deny_regions",
        "s3_multi_region_access_point_public_access_block"
      ]
@@ -204,7 +204,7 @@
      ]
    },
    {
-      "Id": "1.1",
+      "Id": "1.10",
      "Description": "Do not create access keys during initial setup for IAM users with a console password",
      "Checks": [
        "iam_user_no_setup_initial_access_key"
@@ -58,14 +58,12 @@
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
-        "cloudtrail_multi_region_enabled",
        "cloudtrail_kms_encryption_enabled",
        "cloudtrail_log_file_validation_enabled",
        "codebuild_project_user_controlled_buildspec",
        "dynamodb_accelerator_cluster_encryption_enabled",
        "dynamodb_tables_kms_cmk_encryption_enabled",
        "dynamodb_tables_pitr_enabled",
-        "dynamodb_tables_pitr_enabled",
        "ec2_ebs_volume_encryption",
        "ec2_ebs_public_snapshot",
        "ec2_ebs_default_encryption",
@@ -85,7 +83,6 @@
        "iam_password_policy_minimum_length_14",
        "iam_password_policy_lowercase",
        "iam_password_policy_number",
-        "iam_password_policy_number",
        "iam_password_policy_symbol",
        "iam_password_policy_uppercase",
        "iam_no_custom_policy_permissive_role_assumption",
@@ -97,23 +94,18 @@
        "iam_no_root_access_key",
        "iam_rotate_access_key_90_days",
        "iam_user_mfa_enabled_console_access",
-        "iam_user_mfa_enabled_console_access",
        "iam_user_accesskey_unused",
        "iam_user_console_access_unused",
        "kms_cmk_rotation_enabled",
        "awslambda_function_not_publicly_accessible",
-        "awslambda_function_not_publicly_accessible",
-        "cloudwatch_log_group_kms_encryption_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_enhanced_monitoring_enabled",
        "rds_instance_backup_enabled",
        "rds_instance_deletion_protection",
        "rds_instance_storage_encrypted",
-        "rds_instance_backup_enabled",
        "rds_instance_integration_cloudwatch_logs",
        "rds_instance_multi_az",
        "rds_instance_no_public_access",
-        "rds_instance_storage_encrypted",
        "rds_snapshots_public_access",
        "redshift_cluster_automated_snapshot",
        "redshift_cluster_audit_logging",
@@ -125,7 +117,6 @@
        "s3_bucket_policy_public_write_access",
        "s3_bucket_object_versioning",
        "s3_account_level_public_access_blocks",
-        "s3_bucket_public_access",
        "sagemaker_training_jobs_volume_and_output_encryption_enabled",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "sagemaker_notebook_instance_encryption_enabled",
@@ -222,7 +213,6 @@
        "iam_password_policy_minimum_length_14",
        "iam_password_policy_lowercase",
        "iam_password_policy_number",
-        "iam_password_policy_number",
        "iam_password_policy_symbol",
        "iam_password_policy_uppercase"
      ]
@@ -246,7 +236,6 @@
        "ec2_ebs_default_encryption",
        "opensearch_service_domains_encryption_at_rest_enabled",
        "rds_instance_storage_encrypted",
-        "rds_instance_storage_encrypted",
        "redshift_cluster_audit_logging",
        "s3_bucket_default_encryption",
        "sagemaker_training_jobs_volume_and_output_encryption_enabled",
@@ -273,7 +262,6 @@
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
-        "cloudtrail_multi_region_enabled",
        "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled",
        "cloudwatch_log_group_kms_encryption_enabled",
        "dynamodb_tables_kms_cmk_encryption_enabled",
@@ -289,18 +277,14 @@
        "opensearch_service_domains_cloudwatch_logging_enabled",
        "opensearch_service_domains_node_to_node_encryption_enabled",
        "awslambda_function_not_publicly_accessible",
-        "awslambda_function_not_publicly_accessible",
-        "cloudwatch_log_group_kms_encryption_enabled",
        "rds_instance_storage_encrypted",
        "rds_instance_integration_cloudwatch_logs",
        "rds_instance_no_public_access",
        "rds_snapshots_public_access",
-        "rds_snapshots_public_access",
        "redshift_cluster_audit_logging",
        "redshift_cluster_public_access",
        "s3_bucket_default_encryption",
        "s3_bucket_secure_transport_policy",
-        "redshift_cluster_public_access",
        "s3_bucket_server_access_logging_enabled",
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
@@ -349,7 +333,6 @@
        "elbv2_deletion_protection",
        "rds_instance_backup_enabled",
        "rds_instance_deletion_protection",
-        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
@@ -409,11 +392,9 @@
        }
      ],
      "Checks": [
-        "dynamodb_tables_pitr_enabled",
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
-        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
@@ -432,8 +413,7 @@
      "Checks": [
        "iam_user_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
-        "iam_user_mfa_enabled_console_access",
-        "iam_user_hardware_mfa_enabled"
+        "iam_user_mfa_enabled_console_access"
      ]
    },
    {
@@ -1,397 +0,0 @@
-{
-  "Framework": "FedRAMP-20x-KSI-Low",
-  "Name": "FedRAMP 20x Key Security Indicators (KSIs) - Low Impact Level v25.05C",
-  "Version": "25.05C",
-  "Provider": "AWS",
-  "Description": "FedRAMP 20x Key Security Indicators (KSIs) Low Impact Level represent core security indicators for cloud service providers, focusing on automation, continuous monitoring, and cloud-native security principles per FedRAMP 20x Phase One pilot requirements for Low impact systems.",
-  "Requirements": [
-    {
-      "Id": "ksi-cmt",
-      "Name": "KSI-CMT: Change Management",
-      "Description": "A secure cloud service provider will ensure that all system changes are properly documented and configuration baselines are updated accordingly",
-      "Attributes": [
-        {
-          "ItemId": "ksi-cmt",
-          "Section": "Change Management",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "cloudtrail_multi_region_enabled",
-        "cloudtrail_log_file_validation_enabled",
-        "cloudtrail_s3_dataevents_read_enabled",
-        "cloudtrail_s3_dataevents_write_enabled",
-        "cloudwatch_changes_to_network_acls_alarm_configured",
-        "cloudwatch_changes_to_network_gateways_alarm_configured",
-        "cloudwatch_changes_to_network_route_tables_alarm_configured",
-        "cloudwatch_changes_to_vpcs_alarm_configured",
-        "cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled",
-        "cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled",
-        "cloudwatch_log_metric_filter_aws_organizations_changes",
-        "cloudwatch_log_metric_filter_for_s3_bucket_policy_changes",
-        "cloudwatch_log_metric_filter_policy_changes",
-        "cloudwatch_log_metric_filter_security_group_changes",
-        "config_recorder_all_regions_enabled",
-        "ec2_instance_managed_by_ssm",
-        "ec2_instance_older_than_specific_days",
-        "ssm_managed_compliant_patching",
-        "ssm_managed_instance_compliance_association_compliant",
-        "ssm_managed_instance_compliance_patch_compliant"
-      ],
-      "ConfigRequirements": [
-        {
-          "Check": "config_recorder_all_regions_enabled",
-          "ConfigKey": "mute_non_default_regions",
-          "Operator": "eq",
-          "Value": false
-        }
-      ]
-    },
-    {
-      "Id": "ksi-cna",
-      "Name": "KSI-CNA: Cloud Native Architecture",
-      "Description": "A secure cloud service offering will use cloud native architecture and design principles to enforce and enhance the Confidentiality, Integrity and Availability of the system",
-      "Attributes": [
-        {
-          "ItemId": "ksi-cna",
-          "Section": "Cloud Native Architecture",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "autoscaling_group_multiple_az",
-        "autoscaling_group_multiple_instance_types",
-        "autoscaling_group_capacity_rebalance_enabled",
-        "dynamodb_tables_pitr_enabled",
-        "dynamodb_tables_deletion_protection_enabled",
-        "ec2_instance_imdsv2_enabled",
-        "ec2_networkacl_allow_ingress_any_port",
-        "ec2_securitygroup_default_restrict_traffic",
-        "ec2_securitygroup_allow_ingress_from_internet_to_any_port",
-        "eks_cluster_network_policy_enabled",
-        "eks_cluster_not_publicly_accessible",
-        "eks_cluster_private_nodes_enabled",
-        "eks_cluster_uses_a_supported_version",
-        "elb_cross_zone_load_balancing_enabled",
-        "elbv2_alb_multi_az_scheme",
-        "elbv2_waf_acl_attached",
-        "rds_instance_multi_az",
-        "rds_cluster_multi_az",
-        "vpc_subnet_auto_assign_public_ip_disabled",
-        "vpc_default_security_group_restricts_traffic",
-        "vpc_peering_connection_routing_tables_with_least_privilege",
-        "ec2_confidential_workload_host_imdsv2_not_enforced"
-      ]
-    },
-    {
-      "Id": "ksi-iam",
-      "Name": "KSI-IAM: Identity and Access Management",
-      "Description": "A secure cloud service offering will protect user data, control access, and apply zero trust principles",
-      "Attributes": [
-        {
-          "ItemId": "ksi-iam",
-          "Section": "Identity and Access Management",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "iam_inline_policy_no_wildcard_marketplace_subscribe",
-        "iam_policy_no_wildcard_marketplace_subscribe",
-        "iam_administrator_access_with_mfa",
-        "iam_aws_attached_policy_no_administrative_privileges",
-        "iam_customer_attached_policy_no_administrative_privileges",
-        "iam_inline_policy_no_administrative_privileges",
-        "iam_no_custom_policy_permissive_role_assumption",
-        "iam_no_root_access_key",
-        "iam_password_policy_expires_passwords_within_90_days_or_less",
-        "iam_password_policy_lowercase",
-        "iam_password_policy_minimum_length_14",
-        "iam_password_policy_number",
-        "iam_password_policy_reuse_24",
-        "iam_password_policy_symbol",
-        "iam_password_policy_uppercase",
-        "iam_policy_attached_only_to_group_or_roles",
-        "iam_policy_no_full_access_to_cloudtrail",
-        "iam_policy_no_full_access_to_kms",
-        "iam_root_hardware_mfa_enabled",
-        "iam_root_mfa_enabled",
-        "iam_rotate_access_key_90_days",
-        "iam_role_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_sagemaker",
-        "iam_user_accesskey_unused",
-        "iam_user_console_access_unused",
-        "iam_user_hardware_mfa_enabled",
-        "iam_user_mfa_enabled_console_access",
-        "iam_user_two_active_access_key",
-        "organizations_scp_check_deny_regions",
-        "organizations_opt_out_ai_services_policy"
-      ]
-    },
-    {
-      "Id": "ksi-inr",
-      "Name": "KSI-INR: Incident Response",
-      "Description": "A secure cloud service offering will respond to incidents according to FedRAMP requirements and cloud service provider policies",
-      "Attributes": [
-        {
-          "ItemId": "ksi-inr",
-          "Section": "Incident Response",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "guardduty_centrally_managed",
-        "guardduty_ec2_malware_protection_enabled",
-        "guardduty_eks_audit_log_enabled",
-        "guardduty_eks_protection_enabled",
-        "guardduty_eks_runtime_monitoring_enabled",
-        "guardduty_is_enabled",
-        "guardduty_lambda_protection_enabled",
-        "guardduty_malware_protection_enabled",
-        "guardduty_no_high_severity_findings",
-        "guardduty_rds_protection_enabled",
-        "guardduty_s3_protection_enabled",
-        "inspector2_is_enabled",
-        "inspector2_active_findings_exist",
-        "securityhub_enabled",
-        "sns_topics_kms_encryption_at_rest_enabled"
-      ],
-      "ConfigRequirements": [
-        {
-          "Check": "guardduty_is_enabled",
-          "ConfigKey": "mute_non_default_regions",
-          "Operator": "eq",
-          "Value": false
-        },
-        {
-          "Check": "securityhub_enabled",
-          "ConfigKey": "mute_non_default_regions",
-          "Operator": "eq",
-          "Value": false
-        }
-      ]
-    },
-    {
-      "Id": "ksi-mla",
-      "Name": "KSI-MLA: Monitoring, Logging, and Auditing",
-      "Description": "A secure cloud service offering will monitor, log, and audit all important events, activity, and changes",
-      "Attributes": [
-        {
-          "ItemId": "ksi-mla",
-          "Section": "Monitoring, Logging, and Auditing",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "apigateway_restapi_logging_enabled",
-        "cloudtrail_cloudwatch_logging_enabled",
-        "cloudtrail_kms_encryption_enabled",
-        "cloudtrail_log_file_validation_enabled",
-        "cloudtrail_multi_region_enabled",
-        "cloudtrail_s3_dataevents_read_enabled",
-        "cloudtrail_s3_dataevents_write_enabled",
-        "cloudwatch_log_group_kms_encryption_enabled",
-        "cloudwatch_log_group_retention_policy_specific_days_enabled",
-        "ecs_cluster_container_insights_enabled",
-        "eks_cluster_control_plane_audit_logging_enabled",
-        "elb_logging_enabled",
-        "elbv2_logging_enabled",
-        "inspector2_is_enabled",
-        "opensearch_service_domains_cloudwatch_logging_enabled",
-        "rds_instance_enhanced_monitoring_enabled",
-        "rds_instance_integration_cloudwatch_logs",
-        "redshift_cluster_audit_logging",
-        "s3_bucket_server_access_logging_enabled",
-        "vpc_flow_logs_enabled",
-        "wafv2_webacl_logging_enabled",
-        "kms_key_enclave_debug_attestation_detected",
-        "kms_key_enclave_attestation_unknown_image"
-      ]
-    },
-    {
-      "Id": "ksi-piy",
-      "Name": "KSI-PIY: Policy and Inventory",
-      "Description": "A secure cloud service offering will have intentional, organized, universal guidance for how every information resource, including personnel, is secured",
-      "Attributes": [
-        {
-          "ItemId": "ksi-piy",
-          "Section": "Policy and Inventory",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "config_recorder_all_regions_enabled",
-        "config_recorder_using_aws_service_role",
-        "ec2_instance_managed_by_ssm",
-        "organizations_account_part_of_organizations",
-        "organizations_delegated_administrators",
-        "organizations_scp_check_deny_regions",
-        "organizations_tags_policies_enabled_and_attached",
-        "resourceexplorer_indexes_found",
-        "ssm_managed_instance_compliance_association_compliant",
-        "trustedadvisor_premium_support_plan_subscribed"
-      ],
-      "ConfigRequirements": [
-        {
-          "Check": "config_recorder_all_regions_enabled",
-          "ConfigKey": "mute_non_default_regions",
-          "Operator": "eq",
-          "Value": false
-        }
-      ]
-    },
-    {
-      "Id": "ksi-rpl",
-      "Name": "KSI-RPL: Recovery Planning",
-      "Description": "A secure cloud service offering will define, maintain, and test incident response plan(s) and recovery capabilities to ensure minimal service disruption and data loss",
-      "Attributes": [
-        {
-          "ItemId": "ksi-rpl",
-          "Section": "Recovery Planning",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "backup_plans_exist",
-        "backup_reportplans_exist",
-        "backup_vaults_exist",
-        "backup_vaults_encrypted",
-        "backup_recovery_point_encrypted",
-        "backup_recovery_point_manual_deletion_disabled",
-        "backup_recovery_point_minimum_retention_days",
-        "dlm_ebs_snapshot_lifecycle_policy_exists",
-        "dynamodb_tables_pitr_enabled",
-        "dynamodb_tables_deletion_protection_enabled",
-        "efs_have_backup_enabled",
-        "fsx_file_system_copy_tags_to_backups",
-        "rds_instance_backup_enabled",
-        "rds_instance_backup_retention_policy",
-        "rds_instance_deletion_protection",
-        "rds_cluster_deletion_protection",
-        "rds_snapshots_encrypted",
-        "redshift_cluster_automated_snapshot"
-      ]
-    },
-    {
-      "Id": "ksi-svc",
-      "Name": "KSI-SVC: Service Configuration",
-      "Description": "A secure cloud service offering will follow FedRAMP encryption policies, continuously verify information resource integrity, and restrict access to third-party information resources",
-      "Attributes": [
-        {
-          "ItemId": "ksi-svc",
-          "Section": "Service Configuration",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "acm_certificates_expiration_check",
-        "apigateway_restapi_cache_encrypted",
-        "cloudtrail_kms_encryption_enabled",
-        "dax_cluster_encryption_enabled",
-        "dynamodb_table_encryption_enabled",
-        "dynamodb_table_encryption_uses_cmks",
-        "ebs_volume_encryption_enabled",
-        "ec2_ebs_default_encryption",
-        "ec2_instance_ebs_optimized",
-        "efs_encryption_at_rest_enabled",
-        "eks_cluster_envelope_encryption_enabled",
-        "elasticache_redis_cluster_encryption_at_rest_enabled",
-        "elasticache_redis_cluster_encryption_at_transit_enabled",
-        "elbv2_ssl_listeners",
-        "fsx_file_system_encryption_at_rest_enabled",
-        "kinesis_stream_encrypted_at_rest",
-        "kms_cmk_rotation_enabled",
-        "kms_cmk_not_scheduled_for_deletion",
-        "kms_key_not_publicly_accessible",
-        "rds_instance_storage_encrypted",
-        "rds_instance_storage_encrypted_with_cmk",
-        "rds_cluster_storage_encrypted",
-        "redshift_cluster_encryption_at_rest",
-        "redshift_cluster_encryption_in_transit",
-        "s3_bucket_server_side_encryption_enabled",
-        "s3_bucket_default_encryption",
-        "s3_bucket_secure_transport_policy",
-        "sagemaker_notebook_instance_encryption_enabled",
-        "sns_topics_kms_encryption_at_rest_enabled",
-        "sqs_queue_server_side_encryption_enabled",
-        "kms_key_enclave_attestation_not_enforced"
-      ]
-    },
-    {
-      "Id": "ksi-tpr",
-      "Name": "KSI-TPR: Third-Party Information Resources",
-      "Description": "A secure cloud service offering will understand, monitor, and manage supply chain risks from third-party information resources",
-      "Attributes": [
-        {
-          "ItemId": "ksi-tpr",
-          "Section": "Third-Party Information Resources",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "ecr_registry_scan_images_on_push_enabled",
-        "ecr_repositories_lifecycle_policy_enabled",
-        "ecr_repositories_not_publicly_accessible",
-        "ecr_repositories_scan_on_push_enabled",
-        "ecr_repositories_scan_vulnerabilities_in_latest_image",
-        "ecr_repositories_tag_immutability",
-        "inspector2_active_findings_exist",
-        "inspector2_is_enabled",
-        "awslambda_function_using_supported_runtimes",
-        "ssm_managed_compliant_patching",
-        "trustedadvisor_premium_support_plan_subscribed",
-        "guardduty_no_high_severity_findings"
-      ]
-    },
-    {
-      "Id": "ksi-iam-07",
-      "Name": "KSI-IAM-07: Account Lifecycle Management",
-      "Description": "Securely manage the lifecycle and privileges of all accounts, roles, and groups",
-      "Attributes": [
-        {
-          "ItemId": "ksi-iam-07",
-          "Section": "Identity and Access Management",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "iam_no_root_access_key",
-        "iam_policy_attached_only_to_group_or_roles",
-        "iam_rotate_access_key_90_days",
-        "iam_role_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_bedrock",
-        "iam_user_access_not_stale_to_sagemaker",
-        "iam_user_accesskey_unused",
-        "iam_user_console_access_unused",
-        "organizations_delegated_administrators"
-      ]
-    },
-    {
-      "Id": "ksi-mla-07",
-      "Name": "KSI-MLA-07: Monitoring and Logging Inventory",
-      "Description": "Maintain a list of information resources and event types that will be monitored, logged, and audited",
-      "Attributes": [
-        {
-          "ItemId": "ksi-mla-07",
-          "Section": "Monitoring, Logging, and Auditing",
-          "Service": "aws"
-        }
-      ],
-      "Checks": [
-        "cloudtrail_multi_region_enabled",
-        "cloudwatch_log_group_retention_policy_specific_days_enabled",
-        "config_recorder_all_regions_enabled",
-        "inspector2_is_enabled",
-        "resourceexplorer_indexes_found"
-      ],
-      "ConfigRequirements": [
-        {
-          "Check": "config_recorder_all_regions_enabled",
-          "ConfigKey": "mute_non_default_regions",
-          "Operator": "eq",
-          "Value": false
-        }
-      ]
-    }
-  ]
-}
@@ -21,7 +21,6 @@
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
-        "cloudtrail_multi_region_enabled",
        "cloudtrail_log_file_validation_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "opensearch_service_domains_cloudwatch_logging_enabled",
@@ -127,8 +126,7 @@
        "securityhub_enabled",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
-        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
-        "ec2_networkacl_allow_ingress_any_port"
+        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
      ],
      "ConfigRequirements": [
        {
@@ -161,7 +159,6 @@
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
-        "cloudtrail_multi_region_enabled",
        "cloudtrail_log_file_validation_enabled",
        "elbv2_logging_enabled",
        "rds_instance_integration_cloudwatch_logs",
@@ -226,7 +223,6 @@
        "cloudtrail_multi_region_enabled",
        "cloudtrail_s3_dataevents_read_enabled",
        "cloudtrail_s3_dataevents_write_enabled",
-        "cloudtrail_multi_region_enabled",
        "cloudwatch_changes_to_network_acls_alarm_configured",
        "ec2_instance_imdsv2_enabled",
        "elbv2_waf_acl_attached",
@@ -276,13 +272,11 @@
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
-        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ssm_managed_compliant_patching",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
-        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
-        "ec2_networkacl_allow_ingress_any_port"
+        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
      ]
    },
    {
@@ -299,7 +293,6 @@
      "Checks": [
        "ec2_instance_managed_by_ssm",
        "guardduty_is_enabled",
-        "ssm_managed_compliant_patching",
        "ssm_managed_compliant_patching"
      ],
      "ConfigRequirements": [
@@ -323,11 +316,9 @@
        }
      ],
      "Checks": [
-        "dynamodb_tables_pitr_enabled",
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "rds_instance_backup_enabled",
-        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
@@ -344,13 +335,11 @@
        }
      ],
      "Checks": [
-        "dynamodb_tables_pitr_enabled",
        "dynamodb_tables_pitr_enabled",
        "efs_have_backup_enabled",
        "elbv2_deletion_protection",
        "rds_instance_backup_enabled",
        "rds_instance_multi_az",
-        "rds_instance_backup_enabled",
        "redshift_cluster_automated_snapshot",
        "s3_bucket_object_versioning"
      ]
@@ -371,7 +360,6 @@
        "iam_root_hardware_mfa_enabled",
        "iam_root_mfa_enabled",
        "iam_no_root_access_key",
-        "iam_user_mfa_enabled_console_access",
        "iam_user_mfa_enabled_console_access"
      ]
    },
@@ -482,12 +470,10 @@
        "s3_bucket_public_access",
        "s3_bucket_policy_public_write_access",
        "s3_account_level_public_access_blocks",
-        "s3_bucket_public_access",
        "sagemaker_notebook_instance_without_direct_internet_access_configured",
        "ec2_securitygroup_default_restrict_traffic",
        "ec2_networkacl_allow_ingress_any_port",
-        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22",
-        "ec2_networkacl_allow_ingress_any_port"
+        "ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22"
      ]
    },
    {
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
renovate[bot]	79efa1dbb2	chore(docker): update docker	2026-10-03 23:18:07 +00:00
Alejandro Bailo	383a9bf903	fix(ui): bump Next.js to 16.3.6 to patch the next/og RCE advisory (#12922 )	2026-10-01 11:54:44 +02:00
Alejandro Bailo	4605d9a770	feat(ui): invite a teammate from the AWS connect step (#12917 )	2026-10-01 09:50:10 +02:00
César Arroba	f0da33f451	revert(api): release providers blocked by scans whose worker died (#12915 )	2026-09-30 13:00:50 +02:00
Alejandro Bailo	a44a725507	fix(ui): retry the first-run redirect until the add-provider wizard opens (#12914 )	2026-09-30 12:34:52 +02:00
César Arroba	b8ca30400b	fix(api): stop sending personal data to Sentry (#12912 )	2026-09-30 12:28:42 +02:00
César Arroba	a006525e78	fix(api): release providers blocked by scans whose worker died (#12899 )	2026-09-30 11:09:21 +02:00
Pedro Martín	ed510e217d	chore(deps): bump pyjwt to 2.14.0 for osv-scanner (#12911 )	2026-09-30 10:21:11 +02:00
Alejandro Bailo	04511f339e	test(ui): stabilize attack-paths refit integration test (#12896 )	2026-09-29 18:42:19 +02:00
Pedro Martín	f418b32c81	fix(oci): use home region for identity bootstrap (#12865 )	2026-09-29 17:50:54 +02:00
Pedro Martín	65fb146e76	chore(trivy): suppress fast-uri CVE-2026-84292 (#12907 )	2026-09-29 17:04:46 +02:00
Prowler Botandprowler-bot	5ea363d582	chore(release): Bump versions to v5.45.0 (#12905 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-09-29 16:31:16 +02:00
Prowler Botandprowler-bot	3ec379a75a	chore(changelog): v5.44.0 (#12900 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-09-29 13:32:41 +02:00
Pedro Martín	ea020ed46e	chore(changelog): v5.44.0 highlights (#12897 )	2026-09-29 13:32:13 +02:00
Alejandro Bailo	60b936005c	test(ui): scope E2E delete dialog and scans table locators (#12898 )	2026-09-29 12:32:55 +02:00
Pedro Martín	03502c2426	fix(api): require operation permission to revoke tasks (#12893 )	2026-09-28 17:15:39 +02:00
Alejandro Bailo	e6320b178a	fix(ui): bundle all icons so the UI renders without internet access (#12892 )	2026-09-28 15:58:32 +02:00
Alejandro Bailo	4195a4f818	test(ui): add AWS provider in one step in the E2E helper (#12895 )	2026-09-28 15:38:47 +02:00
César Arroba	8d003c60d0	fix(api): skip unconfigured attack paths sinks on provider deletion (#12894 ) Provider deletion now skips attack path graph cleanup for a sink whose connection settings have already been removed, instead of failing. The skip is logged as a warning, while the configured active sink still raises on error as before.	2026-09-28 14:33:44 +02:00
Alejandro Bailo	d5136f364c	perf(ui): stream the findings page and load the Finding Group filter on open (#12891 )	2026-09-28 12:21:13 +02:00
Rubén De la Torre Vico	453c953f37	fix(api): avoid field-named annotation in attack surface aggregation (#12889 )	2026-09-28 11:39:36 +02:00
César Arroba	c114aa304b	fix(api): stop locking the API key row on every authenticated request (#12882 )	2026-09-28 11:16:13 +02:00
Alejandro Bailo	c2b8092461	feat(ui): hint the resource re-check beside Last seen (#12883 )	2026-09-25 14:55:21 +02:00
Pedro Martín	26d9d24e5d	docs(introduction): list UI and API support for Okta (#12881 )	2026-09-25 10:16:53 +02:00
Alejandro Bailo	ee59e35bc2	fix(ui): stop offering reports and compliance for partial scans (#12880 )	2026-09-25 10:09:33 +02:00
César Arroba	e0fa23b9ee	fix(ui): show API error message when mute rule creation fails (#12853 )	2026-09-24 15:35:19 +02:00
Alejandro Bailo	4dbc3c7e74	feat(ui): re-check a resource with a partial scan from the findings actions (#12879 )	2026-09-24 13:54:15 +02:00
César Arroba	576433d85d	fix(api): reap orphaned attack paths temp Neo4j databases (#12832 )	2026-09-24 13:23:36 +02:00
Rubén De la Torre Vico	bf179212a5	fix(api): return the new scan id when a scan is created (#12878 )	2026-09-24 13:12:44 +02:00
César Arroba	60f936a10b	fix(ui): wait for the full provider connection check before reporting a result (#12869 )	2026-09-24 11:23:56 +02:00
César Arroba	15630f54d2	fix(aws): reuse the STS region that answered and add PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS (#12870 )	2026-09-24 10:24:44 +02:00
César Arroba	706603fe4d	feat(api): add an explicit endpoint for S3-compatible scan output storage (#12871 )	2026-09-24 10:24:19 +02:00
Pedro Martínandalejandrobailo	dc67fe4f37	feat(ui): connect and test AWS accounts in one step (#12876 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-09-24 09:57:59 +02:00
Prowler Botandprowler-bot	2c233c2f6c	chore(release): Bump versions to v5.44.0 (#12860 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-09-23 13:11:45 +02:00
Alejandro Bailo	69e1d19abe	feat(ui): open the paid plan upgrade modal from report downloads (#12875 )	2026-09-23 13:08:49 +02:00
Alejandro Bailo	859421b0ec	fix(ui): read the persisted sidebar mode without a hydration mismatch (#12873 )	2026-09-23 13:03:28 +02:00
Pedro Martínandalejandrobailo	ea36f12a01	feat(ui): connect AWS accounts in a single wizard step (#12852 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-09-22 18:21:55 +02:00
Pujitha Paladugu	50a9138bea	fix(api): sign report download URLs with SigV4 when the bucket region is set (#12746 ) When DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION is set, get_s3_presign_client() signs download URLs with SigV4, path-style, against the regional host, so SSE-KMS buckets no longer reject them with InvalidArgument. Without a region or a public endpoint, URLs are signed as before, and get_s3_client() is unchanged. Fixes #12734	2026-09-22 16:12:44 +02:00
tejas_0007	09821e6328	fix(api): log Celery worker failures and restart compose services (#12465 ) Declare the Celery worker, kombu, billiard and amqp loggers so fatal worker errors are no longer silenced by disable_existing_loggers, and log task failures from celery.app.trace at WARNING. Add restart: unless-stopped to the long-running services in docker-compose.yml. Refs #12461	2026-09-22 12:23:51 +02:00
César Arroba	94899e20fd	ci(ui): pass E2E AWS credentials through env vars (#12864 )	2026-09-22 10:42:40 +02:00
Pedro Martín	79da676c86	chore(changelog): v5.43.0 highlights (#12839 )	2026-09-22 09:22:26 +02:00
Rubén De la Torre Vico	8b35b69731	fix(api): make every endpoint resolve the same latest scan for a provider (#12858 )	2026-09-21 17:38:11 +02:00
Prowler Botandprowler-bot	81d90fc31e	chore(changelog): v5.43.0 (#12856 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-09-21 15:30:24 +02:00
César Arroba	8b5f1250a9	chore(changelog): reclassify FedRAMP 20x pilot removal as changed (#12855 )	2026-09-21 15:26:00 +02:00
Prowler Bot prowler-bot César Arroba	98d2db4e13	feat(aws): Update regions for AWS services (#12846 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com> Co-authored-by: César Arroba <19954079+cesararroba@users.noreply.github.com>	2026-09-21 13:00:52 +02:00
César Arroba	c9068515b2	fix(deps): bump anyio to 4.14.2 and accept unfixable CPython CVE-2026-82049 (#12848 )	2026-09-21 12:51:41 +02:00
Alejandro Bailo	3823186914	fix(ui): hide Registry when it is unavailable to the deployment (#12847 )	2026-09-21 12:27:22 +02:00
Alejandro BailoandClaude Fable 5.1	03cb59c20d	feat(ui): install Registry checks artifacts on the API's verdict (#12843 ) Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-18 16:04:58 +02:00
Pedro Martín	d819639f0e	fix(cloudflare): request every permission the checks need (#12842 )	2026-09-18 13:13:30 +02:00
Pedro Martín	6c8d6994bb	fix(api): sign report URLs against public storage host (#12552 )	2026-09-18 10:16:13 +02:00
Pedro Martín	07d48ab15d	fix(huaweicloud): remove mock data from SMN service (#12836 )	2026-09-18 09:20:35 +02:00
Alejandro Bailo	5fe1a6713b	revert: remove the onboarding profile step (#12818 ) (#12838 )	2026-09-17 18:01:41 +02:00
Alejandro Bailo	61d13f078c	fix(ui): hide the Registry tab in Add Provider when Registry is unavailable (#12837 )	2026-09-17 17:22:21 +02:00
Tomás Sebastián Tobio tomitobio Hugo P.Brito	bbb297aee7	feat(providers/huaweicloud): add smn_topic_subscriptions check (#12186 ) Co-authored-by: tomitobio <tomitobio@users.noreply.github.com> Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>	2026-09-17 13:31:08 +02:00
Haitao Zheng	d0d29108e0	fix(sdk): report all-users 2sv override failures (#12700 )	2026-09-17 13:19:11 +02:00
Pedro Martín	f382400037	fix(invitations): expire lapsed invitations on re-invite (#12831 )	2026-09-17 12:12:14 +02:00
Alejandro BailoandClaude Opus 5	396ccf56bb	feat(ui): offer an invite-your-team step before the onboarding checkpoint (#12819 ) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-17 11:58:53 +02:00
Alejandro BailoandClaude Opus 5	3069486549	feat: record the tenant profile declared at onboarding (#12818 ) Co-authored-by: Claude Opus 5 <noreply@anthropic.com>	2026-09-17 10:03:59 +02:00
Pedro Martín	9f616a5d43	feat(ui): allow disabling self-registration in Cloud (#12815 )	2026-09-16 14:00:54 +02:00
Alan Buscagliaandalejandrobailo	2198ba2d84	feat(ui): complete Registry provider onboarding for Private Cloud (#12494 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-09-16 12:21:25 +02:00
César Arroba	974f4251dd	chore(trivy): suppress fast-uri CVE-2026-75931 from Teams SPDX manifest (#12823 )	2026-09-16 10:29:50 +02:00
César Arroba	75c22df63b	fix(azure): use the selected cloud endpoints in Defender and Key Vault (#12813 )	2026-09-16 09:25:08 +02:00
César Arrobaandpedrooot	757cd44ecb	fix(aws): try the rest of the partition when the bootstrap region is unreachable (#12799 ) Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-09-16 09:24:41 +02:00
Pedro Martínandalejandrobailo	c0fdd5bdf3	fix(ui): add FedRAMP 20x cross-provider mappers (#12810 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-09-15 11:07:31 +02:00
Pedro Martín	61ef44a03b	fix(m365): skip defender preset policies without rules (#12809 )	2026-09-15 09:56:50 +02:00
Pedro Martín	682353e054	fix(container): bump PowerShell to 7.5.11 in SDK and API (#12811 )	2026-09-15 09:44:32 +02:00
Pedro Martín	3860cd3dce	feat(compliance): FedRAMP 20x Class C FRR + AWS checks (#12808 )	2026-09-14 16:35:05 +02:00
Ethan Troy Ethan Troy Cursor pedrooot	1b228d590b	feat(compliance): replace FedRAMP 20x pilot KSI with Consolidated Rules 2026.06.24.01 (#11701 ) Co-authored-by: Ethan Troy <ethanolivertroy@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-09-14 11:53:19 +02:00
Alejandro Bailo	8b265a8314	fix(ui): defer billing onboarding and add AWS button styling (#12803 )	2026-09-14 11:18:31 +02:00
Pedro Martín	ba258a5346	fix(container): patch high Debian CVEs in SDK and API (#12804 )	2026-09-14 11:01:15 +02:00
Prowler Botandprowler-bot	282fe5b46b	chore(release): Bump versions to v5.43.0 (#12797 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-09-11 13:23:08 +02:00
Pedro MartínandPepe Fagoaga	c08cb65d84	chore(changelog): v5.42.0 highlights (#12795 ) Co-authored-by: Pepe Fagoaga <pepe@prowler.com>	2026-09-11 12:11:44 +02:00
Prowler Botandprowler-bot	4727da7ca7	chore(changelog): v5.42.0 (#12794 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-09-11 10:21:17 +02:00
Pedro Martín	b378f15798	fix(aws): guard checks reading iam roles when unlisted (#12785 )	2026-09-11 08:37:20 +02:00
StylusFrostandpedrooot	f9c02da90a	feat(aws): support the ISO partitions for region resolution and scanning (#12759 ) Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-09-10 17:15:13 +02:00
Pedro Martín	865eebe7fb	fix(aws): configurable boto3 timeouts, 10s connect default (#12774 )	2026-09-10 08:21:27 +02:00
Alejandro Bailo	8270979ec8	fix(ui): align scan filters and actions (#12781 )	2026-09-09 23:05:09 +02:00
César Arrobaandpedrooot	369f852837	fix(aws): lead the partition bootstrap regions with the configured region (#12764 ) Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-09-09 18:07:22 +02:00
César Arroba	1e8454a3cb	fix(mcp): patch the six high libuuid CVEs in the container image (#12780 )	2026-09-09 17:21:27 +02:00
César Arrobaandalejandrobailo	6f6ae88a66	fix(ui): patch the Next.js and sharp image-handling vulnerabilities (#12778 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-09-09 17:11:43 +02:00
César Arrobaandpedrooot	c71f226e5c	fix(image): honour TRIVY_CACHE_DIR when it is set (#12773 ) Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-09-09 17:00:50 +02:00
Pedro Martín	bbf5e1fa9f	fix(tests): isolate secretsmanager policy test (#12782 )	2026-09-09 16:58:35 +02:00
César Arroba	9cab9b8653	fix(ci): suppress grpc xDS DoS CVE from the Trivy binary (#12777 )	2026-09-09 14:30:22 +02:00
César Arroba	806be2d061	chore(ci): bump agilepathway/label-checker to v1.6.66 (#12760 )	2026-09-08 11:58:06 +02:00
Alejandro Bailo	2769cb9876	fix(ui): patch dependency vulnerabilities flagged by dependabot and pnpm audit (#12758 )	2026-09-08 11:42:09 +02:00
César Arroba	623dc3125a	chore(codeowners): consolidate retired teams under engineering (#12755 )	2026-09-07 19:11:56 +02:00
Pedro Martínandalejandrobailo	1edcf6e5de	fix(jira): fix connection check timeout (#12742 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-09-04 15:51:09 +02:00
Pedro Martín	8bdb597921	perf(api): speed up compliance overview ingestion (#12738 )	2026-09-04 11:13:25 +02:00
Pedro Martín	1746e1052b	fix(ci): suppress unfixed x/crypto CVEs from Trivy binary (#12740 )	2026-09-04 10:09:17 +02:00
Pedro Martín	6827eef347	fix(ci): don't fail setup-python-uv on empty grep match (#12737 )	2026-09-04 09:12:15 +02:00
Prowler Bot prowler-bot Pepe Fagoaga pedrooot	90fc815d3c	chore(release): Bump versions to v5.42.0 (#12713 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com> Co-authored-by: Pepe Fagoaga <pepe@prowler.com> Co-authored-by: pedrooot <pedromarting3@gmail.com>	2026-09-03 14:23:50 +02:00
Pedro Martín	8f35fff255	fix(compliance): remove duplicate ids and stale check refs (#12717 )	2026-09-03 13:39:12 +02:00
Pedro Martín	ab51d09543	fix(tests): isolate mock class attrs leaking across tests (#12728 )	2026-09-03 12:20:33 +02:00
Pedro Martín	12faeb9aa2	chore(trivy): suppress fast-uri CVEs from Teams SPDX manifest (#12727 )	2026-09-03 11:09:13 +02:00
Alejandro Bailo	9ed07de610	feat(ui): separate PostHog hosts and enable Toolbar in development (#12582 )	2026-09-03 10:36:47 +02:00
Alejandro Bailo	8007501574	fix(ui): avoid missing selector in scan tour (#12705 )	2026-09-03 10:23:24 +02:00
Pedro Martín	36514534cb	chore(trivy): suppress CVE-2026-84304 in embedded grpc (#12720 )	2026-09-03 10:17:14 +02:00
Pedro Martín	9621bdfb9c	fix(tests): isolate provider mock in agentcore passrole (#12724 )	2026-09-03 10:15:49 +02:00
				`@@ -0,0 +1 @@`
				`OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1`
				`@@ -0,0 +1 @@`
				`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9
				`@@ -0,0 +1 @@`
				`Sentry error events no longer include user identity, IP addresses, cookies, headers or request bodies, which could contain personal data or provider credentials`
				`@@ -0,0 +1 @@`
				`OCI API key credentials accept a home region to bootstrap identity calls, so tenancies not subscribed to us-ashburn-1 can connect`