docs(skills): add UI motion guidance

- Document visible microinteraction rules for shadcn primitives
- Register the skill for motion and transition work
- Link skeleton guidance for loading handoff cases

.env

@@ -145,7 +145,7 @@ SENTRY_RELEASE=local
 NEXT_PUBLIC_SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.31.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.29.0
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"

.github/pull_request_template.md

@@ -18,8 +18,8 @@ Please add a detailed description of how to review this PR.
 
 <summary><b>Community Checklist</b></summary>
 
-- [ ] This feature/issue is listed in the [open issues](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or roadmap.prowler.com
-- [ ] Is it assigned to me, if not, request it via the [open issues](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or [Prowler Community Slack](goto.prowler.com/slack)
+- [ ] This feature/issue is listed in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or roadmap.prowler.com
+- [ ] Is it assigned to me, if not, request it via the issue/feature in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or [Prowler Community Slack](goto.prowler.com/slack)
 
 </details>
 
@@ -28,7 +28,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
 - [ ] Review if backport is needed.
 - [ ] Review if is needed to change the [Readme.md](https://github.com/prowler-cloud/prowler/blob/master/README.md)
-- [ ] Ensure a changelog fragment is added under [prowler/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/prowler/changelog.d), if applicable.
+- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/prowler/CHANGELOG.md), if applicable.
 
 #### SDK/CLI
 - Are there new checks included in this PR? Yes / No
@@ -40,7 +40,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px)
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px)
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px)
-- [ ] Ensure a changelog fragment is added under [ui/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/ui/changelog.d), if applicable.
+- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/ui/CHANGELOG.md), if applicable.
 
 #### API
 - [ ] All issue/task requirements work as expected on the API
@@ -50,7 +50,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Any other relevant evidence of the implementation (if applicable)
 - [ ] Verify if API specs need to be regenerated.
 - [ ] Check if version updates are required (e.g., specs, uv, etc.).
-- [ ] Ensure a changelog fragment is added under [api/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/api/changelog.d), if applicable.
+- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/api/CHANGELOG.md), if applicable.
 
 ### License
 

.github/scripts/changelog_attribution.py

@@ -1,150 +0,0 @@
-#!/usr/bin/env python3
-"""Rename changelog fragments to their PR number before running towncrier.
-
-For every <slug>.<type>.md in <component_dir>/changelog.d/, find the commit that
-added it, resolve its PR via the GitHub API (falling back to the squash-commit
-subject), and `git mv` it to <PR>.<type>.md so towncrier renders the PR link.
-Unresolvable fragments become +<slug>.<type>.md orphans (rendered without link).
-"""
-
-import argparse
-import json
-import os
-import re
-import subprocess
-import sys
-import urllib.error
-import urllib.request
-
-FRAGMENT_RE = re.compile(
-    r"^(?P<slug>[A-Za-z0-9][A-Za-z0-9._-]*?)"
-    r"\.(?P<type>added|changed|deprecated|removed|fixed|security)"
-    r"(?:\.(?P<counter>[0-9]+))?\.md$"
-)
-SUBJECT_PR_RE = re.compile(r" \(#([0-9]+)\)$")
-IGNORED_FILES = {".gitkeep", "README.md"}
-API_TIMEOUT_SECONDS = 10
-
-
-def git(*args: str) -> str:
-    result = subprocess.run(["git", *args], check=True, capture_output=True, text=True)
-    return result.stdout.strip()
-
-
-def find_adding_commit(path: str) -> str | None:
-    """Find the commit that added a file, following renames.
-
-    Falls back to a plain (no --follow) lookup: rename detection can lose the
-    add event for degenerate content (e.g. files identical to many others).
-    """
-    sha = git("log", "--follow", "--diff-filter=A", "--format=%H", "-1", "--", path)
-    if not sha:
-        sha = git("log", "--diff-filter=A", "--format=%H", "-1", "--", path)
-    return sha or None
-
-
-def pr_from_api(repo: str, sha: str) -> int | None:
-    """Resolve the PR associated with a commit via the GitHub API.
-
-    Returns None on any network/API failure so the caller can fall back to
-    parsing the squash-commit subject.
-    """
-    url = f"https://api.github.com/repos/{repo}/commits/{sha}/pulls"
-    headers = {
-        "Accept": "application/vnd.github+json",
-        "X-GitHub-Api-Version": "2022-11-28",
-        "User-Agent": "prowler-changelog-attribution",
-    }
-    token = os.environ.get("GITHUB_TOKEN")
-    if token:
-        headers["Authorization"] = f"Bearer {token}"
-    request = urllib.request.Request(url, headers=headers)
-    try:
-        with urllib.request.urlopen(request, timeout=API_TIMEOUT_SECONDS) as response:
-            pulls = json.load(response)
-    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError):
-        return None
-    if isinstance(pulls, list) and pulls:
-        return pulls[0].get("number")
-    return None
-
-
-def pr_from_subject(sha: str) -> int | None:
-    subject = git("log", "-1", "--format=%s", sha)
-    match = SUBJECT_PR_RE.search(subject)
-    return int(match.group(1)) if match else None
-
-
-def unique_destination(directory: str, base_name: str, fragment_type: str) -> str:
-    """Return a non-colliding fragment path, appending a numeric counter if needed."""
-    candidate = os.path.join(directory, f"{base_name}.{fragment_type}.md")
-    counter = 0
-    while os.path.exists(candidate):
-        counter += 1
-        candidate = os.path.join(directory, f"{base_name}.{fragment_type}.{counter}.md")
-    return candidate
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("component_dir", help="Component directory, e.g. prowler")
-    parser.add_argument("--repo", default="prowler-cloud/prowler")
-    parser.add_argument(
-        "--no-api",
-        action="store_true",
-        help="Skip the GitHub API and resolve PRs from commit subjects only",
-    )
-    args = parser.parse_args()
-
-    fragments_dir = os.path.join(args.component_dir, "changelog.d")
-    if not os.path.isdir(fragments_dir):
-        print(f"::error::Fragments directory not found: {fragments_dir}")
-        return 1
-
-    malformed = []
-    for name in sorted(os.listdir(fragments_dir)):
-        if name in IGNORED_FILES or name.startswith("+"):
-            continue
-        match = FRAGMENT_RE.match(name)
-        if not match:
-            malformed.append(name)
-            continue
-        slug, fragment_type = match.group("slug"), match.group("type")
-        if slug.isdigit():
-            continue
-
-        path = os.path.join(fragments_dir, name)
-        sha = find_adding_commit(path)
-        pr_number = None
-        if sha:
-            if not args.no_api:
-                pr_number = pr_from_api(args.repo, sha)
-            if pr_number is None:
-                pr_number = pr_from_subject(sha)
-
-        if pr_number is not None:
-            destination = unique_destination(
-                fragments_dir, str(pr_number), fragment_type
-            )
-        else:
-            destination = unique_destination(fragments_dir, f"+{slug}", fragment_type)
-            print(
-                f"::warning::Could not resolve a PR for {path}; renamed to "
-                f"{os.path.basename(destination)} (entry will render without a PR link)"
-            )
-        git("mv", path, destination)
-        print(f"{path} -> {destination}")
-
-    if malformed:
-        for name in malformed:
-            print(
-                f"::error::Malformed fragment filename in {fragments_dir}: {name} "
-                "(expected <slug>.<type>.md with type one of added|changed|"
-                "deprecated|removed|fixed|security)"
-            )
-        return 1
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/towncrier/template.md.jinja

@@ -1,13 +0,0 @@
-{% for section, _ in sections.items() %}
-{% for category, val in definitions.items() if category in sections[section] %}
-### {{ definitions[category]['name'] }}
-
-{% for text, values in sections[section][category].items() %}
-- {{ text }}{% if values %} {{ values|join(', ') }}{% endif %}
-
-{% endfor %}
-
-{% endfor %}
-{% endfor %}
----
-{{ "\n" }}

.github/workflows/api-code-quality.yml

@@ -62,7 +62,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/api-container-checks.yml

@@ -111,7 +111,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Set up Docker Buildx

.github/workflows/api-security.yml

@@ -84,7 +84,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/api-tests.yml

@@ -111,7 +111,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/compile-changelogs.yml

@@ -1,356 +0,0 @@
-name: 'Tools: Compile Changelogs'
-
-run-name: 'Compile changelogs for Prowler ${{ inputs.prowler_version }}'
-
-on:
-  workflow_dispatch:
-    inputs:
-      prowler_version:
-        description: 'Prowler version being released (e.g., 5.31.0)'
-        required: true
-        type: string
-      target_branch:
-        description: 'Branch to compile on (master for minor releases, v5.X for patches)'
-        required: true
-        type: string
-      sdk_version:
-        description: 'SDK version override (empty = auto-derive from prowler/CHANGELOG.md + pending fragment types; "skip" = hold this component back)'
-        required: false
-        type: string
-      api_version:
-        description: 'API version override (empty = auto-derive; "skip" = hold back)'
-        required: false
-        type: string
-      ui_version:
-        description: 'UI version override (empty = auto-derive; "skip" = hold back)'
-        required: false
-        type: string
-      mcp_version:
-        description: 'MCP Server version override (empty = auto-derive; "skip" = hold back)'
-        required: false
-        type: string
-
-concurrency:
-  group: ${{ github.workflow }}-${{ inputs.prowler_version }}
-  cancel-in-progress: false
-
-env:
-  PROWLER_VERSION: ${{ inputs.prowler_version }}
-  TARGET_BRANCH: ${{ inputs.target_branch }}
-  SDK_VERSION: ${{ inputs.sdk_version }}
-  API_VERSION: ${{ inputs.api_version }}
-  UI_VERSION: ${{ inputs.ui_version }}
-  MCP_VERSION: ${{ inputs.mcp_version }}
-
-permissions: {}
-
-jobs:
-  compile-changelogs:
-    if: github.event_name == 'workflow_dispatch' && github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ inputs.target_branch }}
-          fetch-depth: 0 # PR attribution resolves each fragment's adding commit from history
-          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: '3.12'
-
-      - name: Install towncrier
-        run: pip install --no-cache-dir towncrier==25.8.0
-
-      - name: Configure Git
-        run: |
-          git config --global user.name 'prowler-bot'
-          git config --global user.email '179230569+prowler-bot@users.noreply.github.com'
-
-      - name: Validate version inputs
-        run: |
-          if [[ ! "$PROWLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Invalid prowler_version syntax: '$PROWLER_VERSION' (must be N.N.N)"
-            exit 1
-          fi
-          if [ "$TARGET_BRANCH" != "master" ] && [[ ! "$TARGET_BRANCH" =~ ^v[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Invalid target_branch syntax: '$TARGET_BRANCH' (must be 'master' or vN.N, e.g. v5.31)"
-            exit 1
-          fi
-          for pair in "sdk_version:$SDK_VERSION" "api_version:$API_VERSION" "ui_version:$UI_VERSION" "mcp_version:$MCP_VERSION"; do
-            input_name="${pair%%:*}"
-            input_value="${pair#*:}"
-            if [ -n "$input_value" ] && [ "$input_value" != "skip" ] && [[ ! "$input_value" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-              echo "::error::Invalid $input_name syntax: '$input_value' (must be N.N.N, empty for auto-derivation, or 'skip')"
-              exit 1
-            fi
-          done
-
-      - name: Compile changelogs
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          component_input() {
-            case "$1" in
-              prowler) echo "$SDK_VERSION" ;;
-              api) echo "$API_VERSION" ;;
-              ui) echo "$UI_VERSION" ;;
-              mcp_server) echo "$MCP_VERSION" ;;
-            esac
-          }
-
-          pending_fragments() {
-            find "$1/changelog.d" -maxdepth 1 -type f ! -name '.gitkeep' ! -name 'README.md' | sort
-          }
-
-          # The component's last released version is the first stamped heading
-          # of its CHANGELOG.md, the same source prepare-release.yml greps.
-          latest_released_version() {
-            grep -m1 -E '^## \[v?[0-9]+\.[0-9]+\.[0-9]+\]' "$1/CHANGELOG.md" | sed -E 's/^## \[v?([0-9]+\.[0-9]+\.[0-9]+)\].*/\1/'
-          }
-
-          # Resolve every component's effective version before compiling
-          # anything, so a wrong input cannot leave the tree half-compiled.
-          # Empty input = auto-derive (latest released version + semver bump
-          # from the pending fragment types). 'skip' = hold the component back.
-          errors=0
-          compiling=""
-          for component in prowler api ui mcp_server; do
-            input=$(component_input "$component")
-            fragments=$(pending_fragments "$component")
-
-            if [ "$input" = "skip" ]; then
-              if [ -n "$fragments" ]; then
-                echo "::warning::${component}: held back by request; these pending fragments stay for a future release:"
-                echo "$fragments"
-              fi
-              continue
-            fi
-            if [ -n "$input" ] && [ -z "$fragments" ]; then
-              echo "::error::${component}: version input '$input' provided but ${component}/changelog.d/ has no pending fragments (wrong input?)"
-              errors=1
-              continue
-            fi
-            if [ -z "$fragments" ]; then
-              continue
-            fi
-
-            if [ -n "$input" ]; then
-              effective="$input"
-              mode="explicit"
-            else
-              if echo "$fragments" | grep -qE '\.removed(\.[0-9]+)?\.md$'; then
-                echo "::error::${component}: pending 'removed' fragments imply a major bump (breaking change); provide its version input explicitly"
-                errors=1
-                continue
-              fi
-              current=$(latest_released_version "$component")
-              if [ -z "$current" ]; then
-                echo "::error::${component}: could not read the latest released version from ${component}/CHANGELOG.md; provide its version input explicitly"
-                errors=1
-                continue
-              fi
-              IFS=. read -r major minor patch <<< "$current"
-              if echo "$fragments" | grep -qE '\.(added|changed|deprecated)(\.[0-9]+)?\.md$'; then
-                effective="${major}.$((minor + 1)).0"
-              else
-                effective="${major}.${minor}.$((patch + 1))"
-              fi
-              mode="auto"
-              echo "::notice::${component}: version auto-derived ${current} -> ${effective} from the pending fragment types"
-            fi
-
-            # Without the marker the build would insert the new block above the
-            # file header instead of below it.
-            if ! grep -q '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md"; then
-              echo "::error::${component}/CHANGELOG.md is missing the '<!-- changelog: release notes start -->' marker; restore it after the intro line before compiling"
-              errors=1
-              continue
-            fi
-            # A hand-written UNRELEASED block means someone followed the old
-            # convention; its entries would be left out of the compiled block
-            # and out of the release notes extraction.
-            if grep -q '(Prowler UNRELEASED)' "$component/CHANGELOG.md"; then
-              echo "::error::${component}/CHANGELOG.md contains a hand-written '(Prowler UNRELEASED)' block; convert its entries to fragments in ${component}/changelog.d/ and delete the block before compiling"
-              errors=1
-              continue
-            fi
-
-            echo "${effective} ${mode}" > "${RUNNER_TEMP}/version-${component}.txt"
-            compiling="${compiling}${component} "
-          done
-          if [ "$errors" -ne 0 ]; then
-            exit 1
-          fi
-          if [ -z "$compiling" ]; then
-            echo "::error::Nothing to compile: no component has pending fragments to release"
-            exit 1
-          fi
-
-          body_file="${RUNNER_TEMP}/compile-changelogs-pr-body.md"
-          {
-            echo "### Description"
-            echo ""
-            echo "Compiles the pending changelog fragments into the per-component \`CHANGELOG.md\` files for Prowler v${PROWLER_VERSION}, replacing the manual stamping PR."
-            echo ""
-            echo "| Component | Version | Fragments consumed |"
-            echo "|---|---|---|"
-          } > "$body_file"
-
-          compiled_components=""
-          for component in prowler api ui mcp_server; do
-            if [ ! -f "${RUNNER_TEMP}/version-${component}.txt" ]; then
-              echo "Skipping ${component} (no pending fragments or held back)"
-              echo "| \`${component}\` | - | 0 |" >> "$body_file"
-              continue
-            fi
-            read -r version mode < "${RUNNER_TEMP}/version-${component}.txt"
-            version_label="$version"
-            if [ "$mode" = "auto" ]; then
-              version_label="${version} (auto)"
-            fi
-
-            count=$(pending_fragments "$component" | wc -l | tr -d ' ')
-            echo "Compiling ${component} ${version} (${count} fragments, ${mode} version)..."
-
-            # Captured before attribution renames them: these original paths are
-            # what the forward-sync deletes on master (backports copy fragments
-            # verbatim, so filenames match across branches).
-            pending_fragments "$component" > "${RUNNER_TEMP}/consumed-${component}.txt"
-            pre_lines=$(wc -l < "$component/CHANGELOG.md")
-
-            # Attribution must run before the build: towncrier renders the
-            # first dotted segment of each filename as the PR number.
-            python .github/scripts/changelog_attribution.py "$component"
-            towncrier build --config "$component/towncrier.toml" --version "$version" --name "Prowler v${PROWLER_VERSION}" --yes
-
-            # The build only inserts lines right after the marker, so the new
-            # stamped block is exactly the added lines following it. Captured
-            # for the forward-sync to master.
-            post_lines=$(wc -l < "$component/CHANGELOG.md")
-            delta=$((post_lines - pre_lines))
-            marker_line=$(grep -n -m1 '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md" | cut -d: -f1)
-            sed -n "$((marker_line + 1)),$((marker_line + delta))p" "$component/CHANGELOG.md" > "${RUNNER_TEMP}/block-${component}.md"
-
-            compiled_components="${compiled_components}${component} "
-            echo "| \`${component}\` | ${version_label} | ${count} |" >> "$body_file"
-          done
-          echo "COMPILED_COMPONENTS=${compiled_components}" >> "$GITHUB_ENV"
-
-          {
-            echo ""
-            echo "Review that no pending fragment was dropped (the diff must delete every consumed fragment) and that each new version block is correct, then squash-merge."
-            echo ""
-            echo "### License"
-            echo ""
-            echo "By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license."
-          } >> "$body_file"
-
-          echo "PR_BODY_FILE=${body_file}" >> "$GITHUB_ENV"
-
-      - name: Create compile PR
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-          commit-message: 'chore(changelog): v${{ env.PROWLER_VERSION }}'
-          branch: compile-changelogs-${{ env.PROWLER_VERSION }}
-          base: ${{ env.TARGET_BRANCH }}
-          title: 'chore(changelog): v${{ env.PROWLER_VERSION }}'
-          body-path: ${{ env.PR_BODY_FILE }}
-          author: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
-          labels: |
-            no-changelog
-
-      # Patch compiles (target_branch = v5.X) leave master holding the consumed
-      # fragments and missing the new version block. This applies the equivalent
-      # change to master: insert the same stamped blocks under the marker and
-      # delete the consumed fragments, so the next minor compile cannot
-      # re-release entries that already shipped in the patch.
-      - name: Apply forward-sync to master
-        if: env.TARGET_BRANCH != 'master'
-        run: |
-          set -euo pipefail
-
-          git checkout -B master origin/master
-
-          sync_body="${RUNNER_TEMP}/forward-sync-pr-body.md"
-          {
-            echo "### Description"
-            echo ""
-            echo "Forward-syncs the v${PROWLER_VERSION} compiled changelogs from \`${TARGET_BRANCH}\` to \`master\`: inserts the same stamped version blocks under the insertion marker and deletes the consumed fragments, so the next minor compile cannot re-release entries that already shipped in this patch. Opened automatically by the same run that opened the compile PR; review and squash-merge after it."
-            echo ""
-            echo "| Component | Fragments deleted on master | Skipped (only on ${TARGET_BRANCH}) |"
-            echo "|---|---|---|"
-          } > "$sync_body"
-
-          for component in $COMPILED_COMPONENTS; do
-            block_file="${RUNNER_TEMP}/block-${component}.md"
-            consumed_file="${RUNNER_TEMP}/consumed-${component}.txt"
-
-            if ! grep -qm1 '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md"; then
-              echo "::error::${component}/CHANGELOG.md on master is missing the insertion marker; cannot forward-sync"
-              exit 1
-            fi
-
-            deleted=0
-            skipped=0
-            while IFS= read -r fragment; do
-              if [ -z "$fragment" ]; then
-                continue
-              fi
-              if [ -f "$fragment" ]; then
-                git rm -q "$fragment"
-                deleted=$((deleted + 1))
-              else
-                echo "::notice::${fragment} does not exist on master (change landed only on ${TARGET_BRANCH}); skipping its deletion"
-                skipped=$((skipped + 1))
-              fi
-            done < "$consumed_file"
-
-            marker_line=$(grep -n -m1 '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md" | cut -d: -f1)
-            {
-              head -n "$marker_line" "$component/CHANGELOG.md"
-              cat "$block_file"
-              tail -n +"$((marker_line + 1))" "$component/CHANGELOG.md"
-            } > "${RUNNER_TEMP}/changelog.tmp"
-            mv "${RUNNER_TEMP}/changelog.tmp" "$component/CHANGELOG.md"
-
-            echo "| \`${component}\` | ${deleted} | ${skipped} |" >> "$sync_body"
-          done
-
-          {
-            echo ""
-            echo "### License"
-            echo ""
-            echo "By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license."
-          } >> "$sync_body"
-
-          echo "SYNC_BODY_FILE=${sync_body}" >> "$GITHUB_ENV"
-
-      - name: Create forward-sync PR
-        if: env.TARGET_BRANCH != 'master'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-          commit-message: 'chore(changelog): v${{ env.PROWLER_VERSION }} forward-sync to master'
-          branch: forward-sync-changelogs-${{ env.PROWLER_VERSION }}
-          base: master
-          title: 'chore(changelog): v${{ env.PROWLER_VERSION }} forward-sync to master'
-          body-path: ${{ env.SYNC_BODY_FILE }}
-          author: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
-          labels: |
-            no-changelog

.github/workflows/mcp-container-checks.yml

@@ -105,7 +105,6 @@ jobs:
           files_ignore: |
             mcp_server/README.md
             mcp_server/CHANGELOG.md
-            mcp_server/changelog.d/**
 
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'

.github/workflows/pr-check-changelog.yml

@@ -62,140 +62,53 @@ jobs:
             uv.lock
             pyproject.toml
 
-      - name: Check for folder changes and changelog fragment presence
+      - name: Check for folder changes and changelog presence
         id: check-folders
         run: |
-          fragment_name_re='^[A-Za-z0-9][A-Za-z0-9._-]*\.(added|changed|deprecated|removed|fixed|security)(\.[0-9]+)?\.md$'
-
-          missing_fragments=""
-          invalid_fragments=""
-          linked_fragments=""
-
-          all_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n')
-          added=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" | tr ' ' '\n')
-          added_or_modified=$(printf '%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES}" | tr ' ' '\n')
-
-          # Returns success if the folder has a valid fragment added/modified, or
-          # (transition mode, to be removed after the migration grace period) a
-          # direct CHANGELOG.md edit.
-          has_changelog_update() {
-            local folder="$1"
-            if echo "$added_or_modified" | grep "^${folder}/changelog.d/" | sed "s|^${folder}/changelog.d/||" | grep -qE "$fragment_name_re"; then
-              return 0
-            fi
-            if echo "$all_changed" | grep -q "^${folder}/CHANGELOG.md$"; then
-              return 0
-            fi
-            return 1
-          }
+          missing_changelogs=""
 
           if [[ "${STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED}" == "true" ]]; then
             # Check monitored folders
             for folder in $MONITORED_FOLDERS; do
-              changed_in_folder=$(echo "$all_changed" | grep "^${folder}/" || true)
+              # Get files changed in this folder
+              changed_in_folder=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^${folder}/" || true)
 
               if [ -n "$changed_in_folder" ]; then
                 echo "Detected changes in ${folder}/"
 
-                if ! has_changelog_update "$folder"; then
-                  echo "No changelog fragment found for ${folder}/"
-                  missing_fragments="${missing_fragments}- \`${folder}\`"$'\n'
+                # Check if CHANGELOG.md was updated
+                if ! echo "$changed_in_folder" | grep -q "^${folder}/CHANGELOG.md$"; then
+                  echo "No changelog update found for ${folder}/"
+                  missing_changelogs="${missing_changelogs}- \`${folder}\`"$'\n'
                 fi
               fi
             done
 
             # Check root-level dependency files (uv.lock, pyproject.toml)
             # These are associated with the prowler folder changelog
-            root_deps_changed=$(echo "$all_changed" | grep -E "^(uv\.lock|pyproject\.toml)$" || true)
+            root_deps_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep -E "^(uv\.lock|pyproject\.toml)$" || true)
             if [ -n "$root_deps_changed" ]; then
               echo "Detected changes in root dependency files: $root_deps_changed"
-              if ! has_changelog_update "prowler"; then
+              # Check if prowler/CHANGELOG.md was already updated (might have been caught above)
+              prowler_changelog_updated=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^prowler/CHANGELOG.md$" || true)
+              if [ -z "$prowler_changelog_updated" ]; then
                 # Only add if prowler wasn't already flagged
-                if ! echo "$missing_fragments" | grep -q "prowler"; then
-                  echo "No changelog fragment found for root dependency changes"
-                  missing_fragments="${missing_fragments}- \`prowler\` (root dependency files changed)"$'\n'
+                if ! echo "$missing_changelogs" | grep -q "prowler"; then
+                  echo "No changelog update found for root dependency changes"
+                  missing_changelogs="${missing_changelogs}- \`prowler\` (root dependency files changed)"$'\n'
                 fi
               fi
             fi
-
-            # Validate the filename of every fragment added by this PR
-            added_fragments=$(echo "$added" | grep -E '^(api|ui|prowler|mcp_server)/changelog\.d/' || true)
-            for fragment in $added_fragments; do
-              name=$(basename "$fragment")
-              if [ "$name" = ".gitkeep" ] || [ "$name" = "README.md" ]; then
-                continue
-              fi
-              if ! echo "$name" | grep -qE "$fragment_name_re"; then
-                echo "Invalid fragment filename: $fragment"
-                invalid_fragments="${invalid_fragments}- \`${fragment}\`"$'\n'
-              fi
-            done
-
-            # Lint fragment content: the PR link is attached automatically at
-            # compile time, so a hand-written one would end up duplicated
-            touched_fragments=$(echo "$added_or_modified" | grep -E '^(api|ui|prowler|mcp_server)/changelog\.d/' || true)
-            for fragment in $touched_fragments; do
-              name=$(basename "$fragment")
-              if [ "$name" = ".gitkeep" ] || [ "$name" = "README.md" ] || [ ! -f "$fragment" ]; then
-                continue
-              fi
-              if grep -qE '\[\(#[0-9]+\)\]' "$fragment"; then
-                echo "Fragment contains a hand-written PR link: $fragment"
-                linked_fragments="${linked_fragments}- \`${fragment}\`"$'\n'
-              fi
-            done
-          fi
-
-          # Suggest a slug derived from the branch name for the bot comment
-          suggested_slug=$(echo "$HEAD_REF" | tr '[:upper:]' '[:lower:]' | sed 's|.*/||; s/[^a-z0-9._-]/-/g; s/^[^a-z0-9]*//')
-          if [ -z "$suggested_slug" ]; then
-            suggested_slug="my-change"
-          fi
-
-          fragment_help="A changelog fragment is a small Markdown file named \`<slug>.<type>.md\` under \`<component>/changelog.d/\`, where \`<type>\` is one of \`added\`, \`changed\`, \`deprecated\`, \`removed\`, \`fixed\` or \`security\`. Its content is the changelog entry text, without the PR link (added automatically at release time) and without a trailing period. For example:
-
-          \`\`\`
-          echo 'Entry text describing the change' > <component>/changelog.d/${suggested_slug}.fixed.md
-          \`\`\`
-
-          If this PR does not need a changelog entry, add the \`no-changelog\` label instead."
-
-          if [ -n "$missing_fragments" ] || [ -n "$invalid_fragments" ] || [ -n "$linked_fragments" ]; then
-            comment_body=""
-            if [ -n "$missing_fragments" ]; then
-              comment_body="⚠️ **Changes detected in the following folders without a changelog fragment:**"$'\n\n'"${missing_fragments}"$'\n'
-            fi
-            if [ -n "$invalid_fragments" ]; then
-              comment_body="${comment_body}⚠️ **Changelog fragment filenames that do not follow the naming convention:**"$'\n\n'"${invalid_fragments}"$'\n'
-            fi
-            if [ -n "$linked_fragments" ]; then
-              comment_body="${comment_body}⚠️ **Changelog fragments containing a hand-written PR link (remove it; the link is attached automatically at release time):**"$'\n\n'"${linked_fragments}"$'\n'
-            fi
-            comment_body="${comment_body}${fragment_help}"
-          else
-            comment_body="✅ All required changelog fragments are present."
           fi
 
           {
-            echo "missing_fragments<<EOF"
-            echo -e "${missing_fragments}"
-            echo "EOF"
-            echo "invalid_fragments<<EOF"
-            echo -e "${invalid_fragments}"
-            echo "EOF"
-            echo "linked_fragments<<EOF"
-            echo -e "${linked_fragments}"
-            echo "EOF"
-            echo "comment_body<<EOF"
-            echo "${comment_body}"
+            echo "missing_changelogs<<EOF"
+            echo -e "${missing_changelogs}"
             echo "EOF"
           } >> $GITHUB_OUTPUT
         env:
           STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED: ${{ steps.changed-files.outputs.any_changed }}
           STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
-          STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES: ${{ steps.changed-files.outputs.added_files }}
-          STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES: ${{ steps.changed-files.outputs.modified_files }}
-          HEAD_REF: ${{ github.event.pull_request.head.ref }}
 
       - name: Find existing changelog comment
         if: github.event.pull_request.head.repo.full_name == github.repository
@@ -215,10 +128,14 @@ jobs:
           edit-mode: replace
           body: |
             <!-- changelog-check -->
-            ${{ steps.check-folders.outputs.comment_body }}
+            ${{ steps.check-folders.outputs.missing_changelogs != '' && format('⚠️ **Changes detected in the following folders without a corresponding update to the `CHANGELOG.md`:**
 
-      - name: Fail if changelog fragment is missing or invalid
-        if: steps.check-folders.outputs.missing_fragments != '' || steps.check-folders.outputs.invalid_fragments != '' || steps.check-folders.outputs.linked_fragments != ''
+            {0}
+
+            Please add an entry to the corresponding `CHANGELOG.md` file to maintain a clear history of changes.', steps.check-folders.outputs.missing_changelogs) || '✅ All necessary `CHANGELOG.md` files have been updated.' }}
+
+      - name: Fail if changelog is missing
+        if: steps.check-folders.outputs.missing_changelogs != ''
         run: |
-          echo "::error::Missing or invalid changelog fragments"
+          echo "::error::Missing changelog updates in some folders"
           exit 1

.github/workflows/sdk-code-quality.yml

@@ -54,7 +54,6 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**

.github/workflows/sdk-codeql.yml

@@ -12,7 +12,6 @@ on:
       - '.github/workflows/sdk-codeql.yml'
       - '.github/codeql/sdk-codeql-config.yml'
       - '!prowler/CHANGELOG.md'
-      - '!prowler/changelog.d/**'
   pull_request:
     branches:
       - 'master'
@@ -24,7 +23,6 @@ on:
       - '.github/workflows/sdk-codeql.yml'
       - '.github/codeql/sdk-codeql-config.yml'
       - '!prowler/CHANGELOG.md'
-      - '!prowler/changelog.d/**'
   schedule:
     - cron: '00 12 * * *'
 

.github/workflows/sdk-container-checks.yml

@@ -115,7 +115,6 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**

.github/workflows/sdk-security.yml

@@ -77,7 +77,6 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**

.github/workflows/sdk-tests.yml

@@ -76,7 +76,6 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**
@@ -590,33 +589,6 @@ jobs:
           flags: prowler-py${{ matrix.python-version }}-stackit
           files: ./stackit_coverage.xml
 
-      # External Provider (dynamic loading)
-      - name: Check if External Provider files changed
-        if: steps.check-changes.outputs.any_changed == 'true'
-        id: changed-external
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
-        with:
-          files: |
-            ./prowler/providers/common/**
-            ./prowler/config/**
-            ./prowler/lib/**
-            ./tests/providers/external/**
-            ./uv.lock
-
-      - name: Run External Provider tests
-        if: steps.changed-external.outputs.any_changed == 'true'
-        run: uv run pytest -n auto --cov=./prowler/providers/common --cov=./prowler/config --cov=./prowler/lib --cov-report=xml:external_coverage.xml tests/providers/external
-
-      - name: Upload External Provider coverage to Codecov
-        if: steps.changed-external.outputs.any_changed == 'true'
-
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        with:
-          flags: prowler-py${{ matrix.python-version }}-external
-          files: ./external_coverage.xml
-
       # Lib
       - name: Check if Lib files changed
         if: steps.check-changes.outputs.any_changed == 'true'

.github/workflows/ui-codeql.yml

@@ -10,7 +10,6 @@ on:
       - '.github/workflows/ui-codeql.yml'
       - '.github/codeql/ui-codeql-config.yml'
       - '!ui/CHANGELOG.md'
-      - '!ui/changelog.d/**'
   pull_request:
     branches:
       - 'master'
@@ -20,7 +19,6 @@ on:
       - '.github/workflows/ui-codeql.yml'
       - '.github/codeql/ui-codeql-config.yml'
       - '!ui/CHANGELOG.md'
-      - '!ui/changelog.d/**'
   schedule:
     - cron: '00 12 * * *'
 

.github/workflows/ui-container-checks.yml

@@ -105,7 +105,6 @@ jobs:
           files: ui/**
           files_ignore: |
             ui/CHANGELOG.md
-            ui/changelog.d/**
             ui/README.md
             ui/AGENTS.md
 

.github/workflows/ui-e2e-tests-v2.yml

@@ -134,17 +134,7 @@ jobs:
         # docker-compose.yml references prowlercloud/prowler-api:latest from the registry,
         # which lags behind PR changes; build locally so E2E exercises the API image
         # produced by this PR.
-        #
-        # The image installs the SDK from git@master (api/uv.lock), so a PR changing BOTH the SDK
-        # and the API would run against the OLD SDK and crash on startup. Overlay the checkout's
-        # SDK source so both run together. New SDK dependencies still need an api/uv.lock bump.
-        run: |
-          docker build -t prowlercloud/prowler-api:pr-base ./api
-          docker build -t prowlercloud/prowler-api:latest -f - prowler <<'DOCKERFILE'
-          FROM prowlercloud/prowler-api:pr-base
-          RUN rm -rf /home/prowler/.venv/lib/python3.12/site-packages/prowler
-          COPY --chown=prowler:prowler . /home/prowler/.venv/lib/python3.12/site-packages/prowler
-          DOCKERFILE
+        run: docker build -t prowlercloud/prowler-api:latest ./api
 
       - name: Start API services
         run: |

.github/workflows/ui-tests.yml

@@ -60,7 +60,6 @@ jobs:
             .github/workflows/ui-tests.yml
           files_ignore: |
             ui/CHANGELOG.md
-            ui/changelog.d/**
             ui/README.md
             ui/AGENTS.md
 

AGENTS.md

@@ -12,135 +12,139 @@ Use these skills for detailed patterns on-demand:
 
 ### Generic Skills (Any Project)
 
-| Skill | Description | URL |
-|-------|-------------|-----|
-| `typescript` | Const types, flat interfaces, utility types | [SKILL.md](skills/typescript/SKILL.md) |
-| `react-19` | No useMemo/useCallback, React Compiler | [SKILL.md](skills/react-19/SKILL.md) |
-| `nextjs-16` | App Router, Server Actions, proxy.ts, streaming | [SKILL.md](skills/nextjs-16/SKILL.md) |
-| `tailwind-4` | cn() utility, no var() in className | [SKILL.md](skills/tailwind-4/SKILL.md) |
-| `playwright` | Page Object Model, MCP workflow, selectors | [SKILL.md](skills/playwright/SKILL.md) |
-| `pytest` | Fixtures, mocking, markers, parametrize | [SKILL.md](skills/pytest/SKILL.md) |
-| `django-drf` | ViewSets, Serializers, Filters | [SKILL.md](skills/django-drf/SKILL.md) |
-| `jsonapi` | Strict JSON:API v1.1 spec compliance | [SKILL.md](skills/jsonapi/SKILL.md) |
-| `zod-4` | New API (z.email(), z.uuid()) | [SKILL.md](skills/zod-4/SKILL.md) |
-| `zustand-5` | Persist, selectors, slices | [SKILL.md](skills/zustand-5/SKILL.md) |
-| `ai-sdk-5` | UIMessage, streaming, LangChain | [SKILL.md](skills/ai-sdk-5/SKILL.md) |
-| `vitest` | Unit testing, React Testing Library | [SKILL.md](skills/vitest/SKILL.md) |
-| `tdd` | Test-Driven Development workflow | [SKILL.md](skills/tdd/SKILL.md) |
+| Skill        | Description                                     | URL                                    |
+| ------------ | ----------------------------------------------- | -------------------------------------- |
+| `typescript` | Const types, flat interfaces, utility types     | [SKILL.md](skills/typescript/SKILL.md) |
+| `react-19`   | No useMemo/useCallback, React Compiler          | [SKILL.md](skills/react-19/SKILL.md)   |
+| `nextjs-16`  | App Router, Server Actions, proxy.ts, streaming | [SKILL.md](skills/nextjs-16/SKILL.md)  |
+| `tailwind-4` | cn() utility, no var() in className             | [SKILL.md](skills/tailwind-4/SKILL.md) |
+| `playwright` | Page Object Model, MCP workflow, selectors      | [SKILL.md](skills/playwright/SKILL.md) |
+| `pytest`     | Fixtures, mocking, markers, parametrize         | [SKILL.md](skills/pytest/SKILL.md)     |
+| `django-drf` | ViewSets, Serializers, Filters                  | [SKILL.md](skills/django-drf/SKILL.md) |
+| `jsonapi`    | Strict JSON:API v1.1 spec compliance            | [SKILL.md](skills/jsonapi/SKILL.md)    |
+| `zod-4`      | New API (z.email(), z.uuid())                   | [SKILL.md](skills/zod-4/SKILL.md)      |
+| `zustand-5`  | Persist, selectors, slices                      | [SKILL.md](skills/zustand-5/SKILL.md)  |
+| `ai-sdk-5`   | UIMessage, streaming, LangChain                 | [SKILL.md](skills/ai-sdk-5/SKILL.md)   |
+| `vitest`     | Unit testing, React Testing Library             | [SKILL.md](skills/vitest/SKILL.md)     |
+| `tdd`        | Test-Driven Development workflow                | [SKILL.md](skills/tdd/SKILL.md)        |
 
 ### Prowler-Specific Skills
 
-| Skill | Description | URL |
-|-------|-------------|-----|
-| `prowler` | Project overview, component navigation | [SKILL.md](skills/prowler/SKILL.md) |
-| `prowler-api` | Django + RLS + JSON:API patterns | [SKILL.md](skills/prowler-api/SKILL.md) |
-| `prowler-ui` | Next.js + shadcn conventions | [SKILL.md](skills/prowler-ui/SKILL.md) |
-| `prowler-sdk-check` | Create new security checks | [SKILL.md](skills/prowler-sdk-check/SKILL.md) |
-| `prowler-mcp` | MCP server tools and models | [SKILL.md](skills/prowler-mcp/SKILL.md) |
-| `prowler-test-sdk` | SDK testing (pytest + moto) | [SKILL.md](skills/prowler-test-sdk/SKILL.md) |
-| `prowler-test-api` | API testing (pytest-django + RLS) | [SKILL.md](skills/prowler-test-api/SKILL.md) |
-| `prowler-test-ui` | E2E testing (Playwright) | [SKILL.md](skills/prowler-test-ui/SKILL.md) |
-| `prowler-compliance` | Compliance framework structure | [SKILL.md](skills/prowler-compliance/SKILL.md) |
-| `prowler-compliance-review` | Review compliance framework PRs | [SKILL.md](skills/prowler-compliance-review/SKILL.md) |
-| `prowler-provider` | Add new cloud providers | [SKILL.md](skills/prowler-provider/SKILL.md) |
-| `prowler-changelog` | Changelog entries (keepachangelog.com) | [SKILL.md](skills/prowler-changelog/SKILL.md) |
-| `prowler-ci` | CI checks and PR gates (GitHub Actions) | [SKILL.md](skills/prowler-ci/SKILL.md) |
-| `prowler-commit` | Professional commits (conventional-commits) | [SKILL.md](skills/prowler-commit/SKILL.md) |
-| `prowler-pr` | Pull request conventions | [SKILL.md](skills/prowler-pr/SKILL.md) |
-| `prowler-docs` | Documentation style guide | [SKILL.md](skills/prowler-docs/SKILL.md) |
-| `django-migration-psql` | Django migration best practices for PostgreSQL | [SKILL.md](skills/django-migration-psql/SKILL.md) |
-| `postgresql-indexing` | PostgreSQL indexing, EXPLAIN, monitoring, maintenance | [SKILL.md](skills/postgresql-indexing/SKILL.md) |
-| `prowler-attack-paths-query` | Create Attack Paths openCypher queries | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |
-| `gh-aw` | GitHub Agentic Workflows (gh-aw) | [SKILL.md](skills/gh-aw/SKILL.md) |
-| `skill-creator` | Create new AI agent skills | [SKILL.md](skills/skill-creator/SKILL.md) |
+| Skill                        | Description                                            | URL                                                    |
+| ---------------------------- | ------------------------------------------------------ | ------------------------------------------------------ |
+| `prowler`                    | Project overview, component navigation                 | [SKILL.md](skills/prowler/SKILL.md)                    |
+| `prowler-api`                | Django + RLS + JSON:API patterns                       | [SKILL.md](skills/prowler-api/SKILL.md)                |
+| `prowler-ui`                 | Next.js + shadcn conventions                           | [SKILL.md](skills/prowler-ui/SKILL.md)                 |
+| `prowler-ui-motion`          | shadcn/Radix visible microinteraction conventions      | [SKILL.md](skills/prowler-ui-motion/SKILL.md)          |
+| `prowler-ui-skeletons`       | shadcn skeleton loading and content reveal conventions | [SKILL.md](skills/prowler-ui-skeletons/SKILL.md)       |
+| `prowler-sdk-check`          | Create new security checks                             | [SKILL.md](skills/prowler-sdk-check/SKILL.md)          |
+| `prowler-mcp`                | MCP server tools and models                            | [SKILL.md](skills/prowler-mcp/SKILL.md)                |
+| `prowler-test-sdk`           | SDK testing (pytest + moto)                            | [SKILL.md](skills/prowler-test-sdk/SKILL.md)           |
+| `prowler-test-api`           | API testing (pytest-django + RLS)                      | [SKILL.md](skills/prowler-test-api/SKILL.md)           |
+| `prowler-test-ui`            | E2E testing (Playwright)                               | [SKILL.md](skills/prowler-test-ui/SKILL.md)            |
+| `prowler-compliance`         | Compliance framework structure                         | [SKILL.md](skills/prowler-compliance/SKILL.md)         |
+| `prowler-compliance-review`  | Review compliance framework PRs                        | [SKILL.md](skills/prowler-compliance-review/SKILL.md)  |
+| `prowler-provider`           | Add new cloud providers                                | [SKILL.md](skills/prowler-provider/SKILL.md)           |
+| `prowler-changelog`          | Changelog entries (keepachangelog.com)                 | [SKILL.md](skills/prowler-changelog/SKILL.md)          |
+| `prowler-ci`                 | CI checks and PR gates (GitHub Actions)                | [SKILL.md](skills/prowler-ci/SKILL.md)                 |
+| `prowler-commit`             | Professional commits (conventional-commits)            | [SKILL.md](skills/prowler-commit/SKILL.md)             |
+| `prowler-pr`                 | Pull request conventions                               | [SKILL.md](skills/prowler-pr/SKILL.md)                 |
+| `prowler-docs`               | Documentation style guide                              | [SKILL.md](skills/prowler-docs/SKILL.md)               |
+| `django-migration-psql`      | Django migration best practices for PostgreSQL         | [SKILL.md](skills/django-migration-psql/SKILL.md)      |
+| `postgresql-indexing`        | PostgreSQL indexing, EXPLAIN, monitoring, maintenance  | [SKILL.md](skills/postgresql-indexing/SKILL.md)        |
+| `prowler-attack-paths-query` | Create Attack Paths openCypher queries                 | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |
+| `gh-aw`                      | GitHub Agentic Workflows (gh-aw)                       | [SKILL.md](skills/gh-aw/SKILL.md)                      |
+| `skill-creator`              | Create new AI agent skills                             | [SKILL.md](skills/skill-creator/SKILL.md)              |
 
 ### Auto-invoke Skills
 
 When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 
-| Action | Skill |
-|--------|-------|
-| Add changelog entry for a PR or feature | `prowler-changelog` |
-| Adding DRF pagination or permissions | `django-drf` |
-| Adding a compliance output formatter (per-provider class + table dispatcher) | `prowler-compliance` |
-| Adding indexes or constraints to database tables | `django-migration-psql` |
-| Adding new providers | `prowler-provider` |
-| Adding privilege escalation detection queries | `prowler-attack-paths-query` |
-| Adding services to existing providers | `prowler-provider` |
-| After creating/modifying a skill | `skill-sync` |
-| App Router / Server Actions | `nextjs-16` |
-| Auditing check-to-requirement mappings as a cloud auditor | `prowler-compliance` |
-| Building AI chat features | `ai-sdk-5` |
-| Committing changes | `prowler-commit` |
-| Configuring MCP servers in agentic workflows | `gh-aw` |
-| Create PR that requires changelog entry | `prowler-changelog` |
-| Create a PR with gh pr create | `prowler-pr` |
-| Creating API endpoints | `jsonapi` |
-| Creating Attack Paths queries | `prowler-attack-paths-query` |
-| Creating GitHub Agentic Workflows | `gh-aw` |
-| Creating ViewSets, serializers, or filters in api/ | `django-drf` |
-| Creating Zod schemas | `zod-4` |
-| Creating a git commit | `prowler-commit` |
-| Creating new checks | `prowler-sdk-check` |
-| Creating new skills | `skill-creator` |
-| Creating or reviewing Django migrations | `django-migration-psql` |
-| Creating/modifying Prowler UI components | `prowler-ui` |
-| Creating/modifying models, views, serializers | `prowler-api` |
-| Creating/updating compliance frameworks | `prowler-compliance` |
-| Debug why a GitHub Actions job is failing | `prowler-ci` |
-| Debugging gh-aw compilation errors | `gh-aw` |
-| Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist) | `prowler-pr` |
-| Fixing bug | `tdd` |
-| Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs) | `prowler-compliance` |
-| General Prowler development questions | `prowler` |
-| Implementing JSON:API endpoints | `django-drf` |
-| Implementing feature | `tdd` |
-| Importing Copilot Custom Agents into workflows | `gh-aw` |
-| Inspect PR CI checks and gates (.github/workflows/*) | `prowler-ci` |
-| Inspect PR CI workflows (.github/workflows/*): conventional-commit, pr-check-changelog, pr-conflict-checker, labeler | `prowler-pr` |
-| Mapping checks to compliance controls | `prowler-compliance` |
-| Mocking AWS with moto in tests | `prowler-test-sdk` |
-| Modifying API responses | `jsonapi` |
-| Modifying component | `tdd` |
-| Modifying gh-aw workflow frontmatter or safe-outputs | `gh-aw` |
-| Refactoring code | `tdd` |
-| Regenerate AGENTS.md Auto-invoke tables (sync.sh) | `skill-sync` |
-| Review PR requirements: template, title conventions, changelog gate | `prowler-pr` |
-| Review changelog format and conventions | `prowler-changelog` |
-| Reviewing JSON:API compliance | `jsonapi` |
-| Reviewing compliance framework PRs | `prowler-compliance-review` |
-| Running makemigrations or pgmakemigrations | `django-migration-psql` |
-| Syncing compliance framework with upstream catalog | `prowler-compliance` |
-| Testing RLS tenant isolation | `prowler-test-api` |
-| Testing hooks or utilities | `vitest` |
-| Troubleshoot why a skill is missing from AGENTS.md auto-invoke | `skill-sync` |
-| Understand CODEOWNERS/labeler-based automation | `prowler-ci` |
-| Understand PR title conventional-commit validation | `prowler-ci` |
-| Understand changelog gate and no-changelog label behavior | `prowler-ci` |
-| Understand review ownership with CODEOWNERS | `prowler-pr` |
-| Update CHANGELOG.md in any component | `prowler-changelog` |
-| Updating README.md provider statistics table | `prowler-readme-table` |
-| Updating checks, services, compliance, or categories count in README.md | `prowler-readme-table` |
-| Updating existing Attack Paths queries | `prowler-attack-paths-query` |
-| Updating existing checks and metadata | `prowler-sdk-check` |
-| Using Zustand stores | `zustand-5` |
-| Working on MCP server tools | `prowler-mcp` |
-| Working on Prowler UI structure (actions/adapters/types/hooks) | `prowler-ui` |
-| Working on task | `tdd` |
-| Working with Prowler UI test helpers/pages | `prowler-test-ui` |
-| Working with Tailwind classes | `tailwind-4` |
-| Writing Playwright E2E tests | `playwright` |
-| Writing Prowler API tests | `prowler-test-api` |
-| Writing Prowler SDK tests | `prowler-test-sdk` |
-| Writing Prowler UI E2E tests | `prowler-test-ui` |
-| Writing Python tests with pytest | `pytest` |
-| Writing React component tests | `vitest` |
-| Writing React components | `react-19` |
-| Writing TypeScript types/interfaces | `typescript` |
-| Writing Vitest tests | `vitest` |
-| Writing data backfill or data migration | `django-migration-psql` |
-| Writing documentation | `prowler-docs` |
-| Writing unit tests for UI | `vitest` |
+| Action                                                                                                                | Skill                        |
+| --------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
+| Add changelog entry for a PR or feature                                                                               | `prowler-changelog`          |
+| Adding DRF pagination or permissions                                                                                  | `django-drf`                 |
+| Adding a compliance output formatter (per-provider class + table dispatcher)                                          | `prowler-compliance`         |
+| Adding indexes or constraints to database tables                                                                      | `django-migration-psql`      |
+| Adding new providers                                                                                                  | `prowler-provider`           |
+| Adding privilege escalation detection queries                                                                         | `prowler-attack-paths-query` |
+| Adding services to existing providers                                                                                 | `prowler-provider`           |
+| After creating/modifying a skill                                                                                      | `skill-sync`                 |
+| App Router / Server Actions                                                                                           | `nextjs-16`                  |
+| Auditing check-to-requirement mappings as a cloud auditor                                                             | `prowler-compliance`         |
+| Building AI chat features                                                                                             | `ai-sdk-5`                   |
+| Committing changes                                                                                                    | `prowler-commit`             |
+| Configuring MCP servers in agentic workflows                                                                          | `gh-aw`                      |
+| Create PR that requires changelog entry                                                                               | `prowler-changelog`          |
+| Create a PR with gh pr create                                                                                         | `prowler-pr`                 |
+| Creating API endpoints                                                                                                | `jsonapi`                    |
+| Creating Attack Paths queries                                                                                         | `prowler-attack-paths-query` |
+| Creating GitHub Agentic Workflows                                                                                     | `gh-aw`                      |
+| Creating ViewSets, serializers, or filters in api/                                                                    | `django-drf`                 |
+| Creating Zod schemas                                                                                                  | `zod-4`                      |
+| Creating a git commit                                                                                                 | `prowler-commit`             |
+| Creating new checks                                                                                                   | `prowler-sdk-check`          |
+| Creating new skills                                                                                                   | `skill-creator`              |
+| Creating or reviewing Django migrations                                                                               | `django-migration-psql`      |
+| Creating/modifying Prowler UI components                                                                              | `prowler-ui`                 |
+| Creating/modifying UI motion, transitions, or microinteractions                                                       | `prowler-ui-motion`          |
+| Creating/modifying skeletons, loading states, or Suspense fallbacks                                                   | `prowler-ui-skeletons`       |
+| Creating/modifying models, views, serializers                                                                         | `prowler-api`                |
+| Creating/updating compliance frameworks                                                                               | `prowler-compliance`         |
+| Debug why a GitHub Actions job is failing                                                                             | `prowler-ci`                 |
+| Debugging gh-aw compilation errors                                                                                    | `gh-aw`                      |
+| Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist)                                 | `prowler-pr`                 |
+| Fixing bug                                                                                                            | `tdd`                        |
+| Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs)                                                | `prowler-compliance`         |
+| General Prowler development questions                                                                                 | `prowler`                    |
+| Implementing JSON:API endpoints                                                                                       | `django-drf`                 |
+| Implementing feature                                                                                                  | `tdd`                        |
+| Importing Copilot Custom Agents into workflows                                                                        | `gh-aw`                      |
+| Inspect PR CI checks and gates (.github/workflows/\*)                                                                 | `prowler-ci`                 |
+| Inspect PR CI workflows (.github/workflows/\*): conventional-commit, pr-check-changelog, pr-conflict-checker, labeler | `prowler-pr`                 |
+| Mapping checks to compliance controls                                                                                 | `prowler-compliance`         |
+| Mocking AWS with moto in tests                                                                                        | `prowler-test-sdk`           |
+| Modifying API responses                                                                                               | `jsonapi`                    |
+| Modifying component                                                                                                   | `tdd`                        |
+| Modifying gh-aw workflow frontmatter or safe-outputs                                                                  | `gh-aw`                      |
+| Refactoring code                                                                                                      | `tdd`                        |
+| Regenerate AGENTS.md Auto-invoke tables (sync.sh)                                                                     | `skill-sync`                 |
+| Review PR requirements: template, title conventions, changelog gate                                                   | `prowler-pr`                 |
+| Review changelog format and conventions                                                                               | `prowler-changelog`          |
+| Reviewing JSON:API compliance                                                                                         | `jsonapi`                    |
+| Reviewing compliance framework PRs                                                                                    | `prowler-compliance-review`  |
+| Running makemigrations or pgmakemigrations                                                                            | `django-migration-psql`      |
+| Syncing compliance framework with upstream catalog                                                                    | `prowler-compliance`         |
+| Testing RLS tenant isolation                                                                                          | `prowler-test-api`           |
+| Testing hooks or utilities                                                                                            | `vitest`                     |
+| Troubleshoot why a skill is missing from AGENTS.md auto-invoke                                                        | `skill-sync`                 |
+| Understand CODEOWNERS/labeler-based automation                                                                        | `prowler-ci`                 |
+| Understand PR title conventional-commit validation                                                                    | `prowler-ci`                 |
+| Understand changelog gate and no-changelog label behavior                                                             | `prowler-ci`                 |
+| Understand review ownership with CODEOWNERS                                                                           | `prowler-pr`                 |
+| Update CHANGELOG.md in any component                                                                                  | `prowler-changelog`          |
+| Updating README.md provider statistics table                                                                          | `prowler-readme-table`       |
+| Updating checks, services, compliance, or categories count in README.md                                               | `prowler-readme-table`       |
+| Updating existing Attack Paths queries                                                                                | `prowler-attack-paths-query` |
+| Updating existing checks and metadata                                                                                 | `prowler-sdk-check`          |
+| Using Zustand stores                                                                                                  | `zustand-5`                  |
+| Working on MCP server tools                                                                                           | `prowler-mcp`                |
+| Working on Prowler UI structure (actions/adapters/types/hooks)                                                        | `prowler-ui`                 |
+| Working on task                                                                                                       | `tdd`                        |
+| Working with Prowler UI test helpers/pages                                                                            | `prowler-test-ui`            |
+| Working with Tailwind classes                                                                                         | `tailwind-4`                 |
+| Writing Playwright E2E tests                                                                                          | `playwright`                 |
+| Writing Prowler API tests                                                                                             | `prowler-test-api`           |
+| Writing Prowler SDK tests                                                                                             | `prowler-test-sdk`           |
+| Writing Prowler UI E2E tests                                                                                          | `prowler-test-ui`            |
+| Writing Python tests with pytest                                                                                      | `pytest`                     |
+| Writing React component tests                                                                                         | `vitest`                     |
+| Writing React components                                                                                              | `react-19`                   |
+| Writing TypeScript types/interfaces                                                                                   | `typescript`                 |
+| Writing Vitest tests                                                                                                  | `vitest`                     |
+| Writing data backfill or data migration                                                                               | `django-migration-psql`      |
+| Writing documentation                                                                                                 | `prowler-docs`               |
+| Writing unit tests for UI                                                                                             | `vitest`                     |
 
 ---
 
@@ -148,13 +152,13 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 
 Prowler is an open-source cloud security assessment tool supporting AWS, Azure, GCP, Kubernetes, GitHub, M365, and more.
 
-| Component | Location | Tech Stack |
-|-----------|----------|------------|
-| SDK | `prowler/` | Python 3.10+, uv |
-| API | `api/` | Django 5.1, DRF, Celery |
-| UI | `ui/` | Next.js 16, React 19, Tailwind 4 |
-| MCP Server | `mcp_server/` | FastMCP, Python 3.12+ |
-| Dashboard | `dashboard/` | Dash, Plotly |
+| Component  | Location      | Tech Stack                       |
+| ---------- | ------------- | -------------------------------- |
+| SDK        | `prowler/`    | Python 3.10+, uv                 |
+| API        | `api/`        | Django 5.1, DRF, Celery          |
+| UI         | `ui/`         | Next.js 16, React 19, Tailwind 4 |
+| MCP Server | `mcp_server/` | FastMCP, Python 3.12+            |
+| Dashboard  | `dashboard/`  | Dash, Plotly                     |
 
 ---
 
@@ -180,6 +184,7 @@ Follow conventional-commit style: `<type>[scope]: <description>`
 **Types:** `feat`, `fix`, `docs`, `chore`, `perf`, `refactor`, `style`, `test`
 
 Before creating a PR:
+
 1. Complete checklist in `.github/pull_request_template.md`
 2. Run all relevant tests and linters
 3. Link screenshots for UI changes

README.md

@@ -122,7 +122,7 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 | Vercel | 26 | 6 | 0 | 8 | Official | UI, API, CLI |
 | Okta | 1 | 1 | 0 | 1 | Official | CLI |
 | Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 0 | 1 | Unofficial | CLI |
-| StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 0 | 3 | Unofficial | CLI |
+| StackIT [Contact us](https://prowler.com/contact) | 4 | 1 | 0 | 1 | Unofficial | CLI |
 | NHN | 6 | 2 | 1 | 0 | Unofficial | CLI |
 
 > [!Note]
@@ -153,8 +153,6 @@ Prowler App offers flexible installation methods tailored to various environment
 
 #### Commands
 
-_macOS/Linux:_
-
 ``` console
 VERSION=$(curl -s https://api.github.com/repos/prowler-cloud/prowler/releases/latest | jq -r .tag_name)
 curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${VERSION}/docker-compose.yml"
@@ -163,16 +161,6 @@ curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${V
 docker compose up -d
 ```
 
-_Windows PowerShell:_
-
-``` powershell
-$VERSION = (Invoke-RestMethod -Uri "https://api.github.com/repos/prowler-cloud/prowler/releases/latest").tag_name
-Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/docker-compose.yml" -OutFile "docker-compose.yml"
-# Environment variables can be customized in the .env file. Using default values in production environments is not recommended.
-Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/.env" -OutFile ".env"
-docker compose up -d
-```
-
 > [!WARNING]
 > 🔒 For a secure setup, the API auto-generates a unique key pair, `DJANGO_TOKEN_SIGNING_KEY` and `DJANGO_TOKEN_VERIFYING_KEY`, and stores it in `~/.config/prowler-api` (non-container) or the bound Docker volume in `_data/api` (container). Never commit or reuse static/default keys. To rotate keys, delete the stored key files and restart the API.
 

api/CHANGELOG.md

@@ -2,66 +2,11 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
-<!-- changelog: release notes start -->
-
-## [1.31.1] (Prowler v5.30.1)
-
-### 🐞 Fixed
-
-- `compliance-overviews/attributes` now resolves the provider from the scan, so multi-provider universal frameworks (e.g. CSA CCM) return the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
-- Attack Paths: `drop_subgraph` now deletes relationships first and then nodes in batches, using less memory on Neo4j when clearing a dense provider graph [(#11557)](https://github.com/prowler-cloud/prowler/pull/11557)
-- OCI scans now use API key credentials with the configured region instead of falling back to `/home/prowler/.oci/config` [(#11558)](https://github.com/prowler-cloud/prowler/pull/11558)
-
----
-
-## [1.31.0] (Prowler v5.30.0)
-
-### 🚀 Added
-
-- Opt-in automatic recovery of allowlisted idempotent background tasks whose worker died during a deploy or crash: when enabled via `DJANGO_TASK_RECOVERY_ENABLED` (off by default), stuck summary and deletion tasks are detected and re-run instead of staying pending forever (scan and Jira tasks are excluded), with a `reconcile_orphan_tasks` management command for on-demand recovery [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
-- DORA compliance framework support [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
-- Label Postgres connections with `application_name="<component>:<alias>"` (component injected per process via `DJANGO_APP_COMPONENT`) so connections are attributable by component in `pg_stat_activity` [(#11494)](https://github.com/prowler-cloud/prowler/pull/11494)
-- DISA Okta IDaaS STIG V1R2 compliance framework export support for the Okta provider [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
-
-### 🔄 Changed
-
-- Allowlisted idempotent background tasks are no longer lost when a worker is stopped or crashes mid-task; tasks with external side effects are marked terminal instead of blindly re-running [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
-
-### 🐞 Fixed
-
-- Workers now shut down gracefully on deploy or restart, finishing or re-queueing in-flight tasks instead of being force-killed and leaving them stuck [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
-- Resource `name` is now stored and refreshed on every scan, so resources no longer keep an empty name [(#11476)](https://github.com/prowler-cloud/prowler/pull/11476)
-- Compliance catalog now warms in background during startup. `compliance-overviews/attributes` returns `503` while warming, so the first request after a deploy no longer trips the API timeout [(#11530)](https://github.com/prowler-cloud/prowler/pull/11530)
-
-### 🔐 Security
-
-- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
-
----
-
-## [1.30.3] (Prowler v5.29.3)
-
-### 🐞 Fixed
-
-- API startup no longer crashes when Neo4j is unreachable, as the Neo4j driver now connects lazily on first use rather than during app initialization [(#11491)](https://github.com/prowler-cloud/prowler/pull/11491)
-
----
-
-## [1.30.1] (Prowler v5.29.1)
-
-### 🐞 Fixed
-
-- `GET /api/v1/findings` N+1 query loading `resources__tags` when listing findings [(#11420)](https://github.com/prowler-cloud/prowler/pull/11420)
-- Clean up the scan tmp output directory when `scan-report` fails so partial files do not accumulate and fill the worker disk (`No space left on device`) [(#11421)](https://github.com/prowler-cloud/prowler/pull/11421)
-
----
-
-## [1.30.0] (Prowler v5.29.0)
+## [1.30.0] (Prowler UNRELEASED)
 
 ### 🔄 Changed
 
 - Scan finding ingestion: bulk-resolve `Resource`/`ResourceTag` rows, replace per-mapping `SELECT FOR UPDATE` with deferred `ResourceTagMapping.bulk_create(ignore_conflicts=True)`, wrap each micro-batch in a single `rls_transaction`, and raise `SCAN_DB_BATCH_SIZE` to 1000 [(#11249)](https://github.com/prowler-cloud/prowler/pull/11249)
-- Faster `GET /api/v1/finding-groups/latest` aggregation on tenants where one recent scan holds most findings [(#11380)](https://github.com/prowler-cloud/prowler/pull/11380)
 
 ---
 

api/changelog.d/README.md

@@ -1,10 +0,0 @@
-# Changelog fragments
-
-Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
-
-- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
-- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
-- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
-- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
-
-Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.

api/docker-entrypoint.sh

@@ -22,12 +22,12 @@ apply_fixtures() {
 
 start_dev_server() {
   echo "Starting the development server..."
-  exec uv run python manage.py runserver 0.0.0.0:"${DJANGO_PORT:-8080}"
+  uv run python manage.py runserver 0.0.0.0:"${DJANGO_PORT:-8080}"
 }
 
 start_prod_server() {
   echo "Starting the Gunicorn server..."
-  exec uv run gunicorn -c config/guniconf.py config.wsgi:application
+  uv run gunicorn -c config/guniconf.py config.wsgi:application
 }
 
 resolve_worker_hostname() {
@@ -47,7 +47,7 @@ resolve_worker_hostname() {
 
 start_worker() {
   echo "Starting the worker..."
-  exec uv run python -m celery -A config.celery worker \
+  uv run python -m celery -A config.celery worker \
     -n "$(resolve_worker_hostname)" \
     -l "${DJANGO_LOGGING_LEVEL:-info}" \
     -Q celery,scans,scan-reports,deletion,backfill,overview,integrations,compliance,attack-paths-scans \
@@ -56,7 +56,7 @@ start_worker() {
 
 start_worker_beat() {
   echo "Starting the worker-beat..."
-  exec uv run python -m celery -A config.celery beat -l "${DJANGO_LOGGING_LEVEL:-info}" --scheduler django_celery_beat.schedulers:DatabaseScheduler
+  uv run python -m celery -A config.celery beat -l "${DJANGO_LOGGING_LEVEL:-info}" --scheduler django_celery_beat.schedulers:DatabaseScheduler
 }
 
 manage_db_partitions() {
@@ -68,15 +68,6 @@ manage_db_partitions() {
   fi
 }
 
-# Identify this process to Postgres (application_name=<component>:<alias>) so
-# connections are attributable by component in pg_stat_activity. Web tiers
-# report "api"; everything else uses the launch subcommand.
-case "$1" in
-  prod|dev) DJANGO_APP_COMPONENT="api" ;;
-  *)        DJANGO_APP_COMPONENT="$1" ;;
-esac
-export DJANGO_APP_COMPONENT
-
 case "$1" in
   dev)
     apply_migrations

api/docs/orphan-task-recovery.md

@@ -1,105 +0,0 @@
-# Orphan Celery task recovery
-
-When a worker is terminated mid-task (a deploy, an OOM kill, a node eviction), the
-task it was running can be left non-terminal forever: the `TaskResult` stays
-`STARTED` and nothing re-runs it. This page describes the mechanisms that detect and
-recover allowlisted idempotent orphans so pending-task alerts do not fire. Scan tasks
-are not auto-recovered (re-running a scan is not safe to do automatically); the
-watchdog covers the summary/aggregation and deletion tasks.
-
-## How recovery works
-
-1. **Durable delivery.** The broker is configured so a task message is acknowledged
-   only after the task finishes (`task_acks_late`), one task is reserved at a time
-   (`worker_prefetch_multiplier = 1`), and an abruptly-lost worker re-queues its task
-   (`task_reject_on_worker_lost`). On `SIGTERM` the worker is given a soft-shutdown
-   window (`worker_soft_shutdown_timeout`) to finish or re-queue in-flight work
-   before it is force-killed. `scan-perform`, `scan-perform-scheduled` and
-   `integration-jira` opt out of redelivery with `acks_late=False`, so a crash drops
-   them rather than re-running and duplicating findings or Jira issues. Other
-   non-recovered side-effect tasks keep `acks_late=True`, so the broker can still
-   re-deliver them after a worker loss: the S3 upload rebuilds from worker-local files
-   that did not survive the crash and so no-ops, but Security Hub re-reads findings from
-   the DB and re-sends them to AWS.
-
-2. **Periodic watchdog.** A Beat task, `reconcile-orphan-tasks`, runs every couple of
-   minutes (a `django_celery_beat` periodic task created by migration). For each
-   in-flight task result with an allowlisted idempotent task name, it pings the
-   worker recorded on the task's `TaskResult`:
-   - worker responds -> the task is still running, leave it alone;
-   - worker is gone (and the task started before a short grace window) -> it is a
-     real orphan: the stale task is revoked and marked terminal (clearing the
-     pending/started alert), and the task is re-enqueued from its stored name and
-     kwargs.
-
-   The re-run is safe because only tasks with proven idempotency are allowlisted: the
-   summary/aggregation tasks clear and re-write their own rows, and deletions are
-   idempotent. Scan tasks and external side effects are excluded: re-running a scan is
-   not safe to do automatically, Jira sends would create duplicate issues, the S3
-   upload rebuilds from worker-local files that do not survive a crash, and
-   report/Security Hub recovery is out of scope.
-
-3. **Recovery cap.** A per-task Valkey counter limits how often the same task is
-   re-enqueued. After `--max-attempts` recoveries (default 3) the orphan is marked
-   terminal instead of re-enqueued, so a task that repeatedly kills its worker cannot
-   loop forever.
-
-A Postgres advisory lock ensures that, even with multiple API/worker replicas, only
-one reconciliation runs at a time; the others no-op.
-
-## On-demand command
-
-The same logic is available as a management command, useful right after a deploy or
-for manual intervention:
-
-```bash
-python manage.py reconcile_orphan_tasks            # recover now
-python manage.py reconcile_orphan_tasks --dry-run  # report orphans, change nothing
-python manage.py reconcile_orphan_tasks --grace-minutes 5 --max-attempts 3
-```
-
-## Configuration
-
-All settings have safe defaults; override via environment variables.
-
-| Env var | Default | Purpose |
-| --- | --- | --- |
-| `DJANGO_CELERY_WORKER_PREFETCH_MULTIPLIER` | `1` | Tasks reserved per worker process. |
-| `DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT` | `60` | Seconds the worker drains/re-queues on `SIGTERM` before force-kill. |
-| `DJANGO_CELERY_TASK_TIME_LIMIT` | `21600` (6h) | Hard limit for most tasks; connection checks are capped at 120s. |
-| `DJANGO_CELERY_TASK_SOFT_TIME_LIMIT` | hard - 600 | Soft limit; raises `SoftTimeLimitExceeded` for cleanup. |
-| `DJANGO_CELERY_LONG_TASK_TIME_LIMIT` | `172800` (48h) | Hard limit for scans and provider/tenant deletions, which can legitimately run for more than a day. |
-| `DJANGO_CELERY_LONG_TASK_SOFT_TIME_LIMIT` | long hard - 600 | Soft limit for the long-running tasks above. |
-| `DJANGO_TASK_RECOVERY_ENABLED` | `false` | Master switch for orphan-task recovery, disabled by default (opt-in); set to `true` to enable. When off, no orphan is detected, marked terminal, or re-enqueued (attack-paths stale cleanup still runs). |
-| `DJANGO_TASK_RECOVERY_SUMMARIES_ENABLED` | `true` | Auto re-enqueue orphaned scan summary/aggregation tasks. |
-| `DJANGO_TASK_RECOVERY_DELETIONS_ENABLED` | `true` | Auto re-enqueue orphaned provider/tenant deletion tasks. |
-
-Recovery is opt-in: with the master flag off (the default) the sweep does nothing.
-Once enabled, the per-group flags default to on, so every group recovers unless you
-turn one off; a task whose group flag is off is marked terminal instead of
-re-enqueued.
-
-Turning recovery off only disables this watchdog sweep; it does not change Celery's
-broker-level redelivery (`task_acks_late`/`task_reject_on_worker_lost`), which still
-re-delivers tasks that keep `acks_late=True` on worker loss, independently of this flag.
-
-`task_acks_late` and `task_reject_on_worker_lost` are enabled in `config/celery.py`.
-
-## Deployment requirement
-
-Two conditions must both hold for the soft shutdown to actually drain work:
-
-1. **The worker must receive `SIGTERM`.** The container entrypoint `exec`s the
-   Celery process so it runs as PID 1; otherwise `SIGTERM` from `docker stop`/ECS
-   hits the entrypoint shell, never reaches Celery, and the worker is hard-killed
-   (SIGKILL) at the grace deadline without draining. Custom entrypoints must
-   preserve the `exec`.
-2. **The orchestrator must give the worker enough time** before force-killing it.
-   Set the stop grace period to exceed `DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT`
-   plus a margin:
-   - **docker-compose:** `stop_grace_period` on the worker services (set to `120s`).
-   - **AWS ECS:** the worker container `stopTimeout` (configured in the deployment
-     repository).
-
-If either condition is missing, long tasks are still recovered by the watchdog,
-but they are cut mid-run on every deploy instead of draining.

api/pyproject.toml

@@ -68,7 +68,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.32.0"
+version = "1.30.0"
 
 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
@@ -226,7 +226,7 @@ constraint-dependencies = [
   "drf-simple-apikey==2.2.1",
   "drf-spectacular==0.27.2",
   "drf-spectacular-jsonapi==0.5.1",
-  "dulwich==1.2.5",
+  "dulwich==0.23.0",
   "duo-client==5.5.0",
   "durationpy==0.10",
   "email-validator==2.2.0",
@@ -354,7 +354,7 @@ constraint-dependencies = [
   "pydantic-core==2.41.5",
   "pygithub==2.8.0",
   "pygments==2.20.0",
-  "pyjwt==2.13.0",
+  "pyjwt==2.12.1",
   "pylint==3.2.5",
   "pymsalruntime==0.18.1",
   "pynacl==1.6.2",
@@ -443,17 +443,7 @@ constraint-dependencies = [
 # The microsoft-kiota-http security bump to 1.9.9 (GHSA-7j59-v9qr-6fq9) requires
 # microsoft-kiota-abstractions>=1.9.9, which a constraint cannot satisfy against the
 # SDK's hard pin; override it to the patched, kiota-aligned version.
-#
-# prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
-# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
-# patches PYSEC-2026-179 (HMAC/JWK key-confusion); a constraint cannot satisfy these
-# against the SDK's hard pins, so override them to the patched versions until the SDK
-# bump propagates to the pinned master rev. pyjwt keeps the [crypto] extra because an
-# override replaces the whole requirement; bare pyjwt would drop it from the consumers
-# that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
 override-dependencies = [
   "okta==3.4.2",
-  "microsoft-kiota-abstractions==1.9.9",
-  "dulwich==1.2.5",
-  "pyjwt[crypto]==2.13.0"
+  "microsoft-kiota-abstractions==1.9.9"
 ]

api/src/backend/api/apps.py

@@ -1,14 +1,12 @@
 import logging
 import os
 import sys
-
 from pathlib import Path
 
-from django.apps import AppConfig
-from django.conf import settings
-
 from config.custom_logging import BackendLogger
 from config.env import env
+from django.apps import AppConfig
+from django.conf import settings
 
 logger = logging.getLogger(BackendLogger.API)
 
@@ -32,6 +30,7 @@ class ApiConfig(AppConfig):
     def ready(self):
         from api import schema_extensions  # noqa: F401
         from api import signals  # noqa: F401
+        from api.attack_paths import database as graph_database
 
         # Generate required cryptographic keys if not present, but only if:
         #   `"manage.py" not in sys.argv[0]`: If an external server (e.g., Gunicorn) is running the app
@@ -42,8 +41,37 @@ class ApiConfig(AppConfig):
         ):
             self._ensure_crypto_keys()
 
-        # Neo4j driver is created lazily on first use (see api.attack_paths.database).
-        # App init never contacts Neo4j, so a Neo4j outage cannot block API startup.
+        # Commands that don't need Neo4j
+        SKIP_NEO4J_DJANGO_COMMANDS = [
+            "makemigrations",
+            "migrate",
+            "pgpartition",
+            "check",
+            "help",
+            "showmigrations",
+            "check_and_fix_socialaccount_sites_migration",
+        ]
+
+        # Skip eager Neo4j init for tests, some Django commands, and Celery (prefork pool: driver must stay lazy, no post_fork hook)
+        if getattr(settings, "TESTING", False) or (
+            len(sys.argv) > 1
+            and (
+                (
+                    "manage.py" in sys.argv[0]
+                    and sys.argv[1] in SKIP_NEO4J_DJANGO_COMMANDS
+                )
+                or "celery" in sys.argv[0]
+            )
+        ):
+            logger.info(
+                "Skipping eager Neo4j init: tests, some Django commands, or Celery prefork pool (driver stays lazy)"
+            )
+
+        else:
+            graph_database.init_driver()
+
+        # Neo4j driver is initialized at API startup (see api.attack_paths.database)
+        # It remains lazy for Celery workers and selected Django commands
 
     def _ensure_crypto_keys(self):
         """

api/src/backend/api/attack_paths/database.py

@@ -1,24 +1,22 @@
 import atexit
 import logging
 import threading
-
 from contextlib import contextmanager
 from typing import Any, Iterator
 from uuid import UUID
 
 import neo4j
 import neo4j.exceptions
-
 from config.env import env
 from django.conf import settings
-
-from api.attack_paths.retryable_session import RetryableSession
 from tasks.jobs.attack_paths.config import (
     BATCH_SIZE,
     PROVIDER_RESOURCE_LABEL,
     get_provider_label,
 )
 
+from api.attack_paths.retryable_session import RetryableSession
+
 # Without this Celery goes crazy with Neo4j logging
 logging.getLogger("neo4j").setLevel(logging.ERROR)
 logging.getLogger("neo4j").propagate = False
@@ -30,9 +28,6 @@ READ_QUERY_TIMEOUT_SECONDS = env.int(
     "ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30
 )
 MAX_CUSTOM_QUERY_NODES = env.int("ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES", default=250)
-# Shorter than CONN_ACQUISITION_TIMEOUT — the driver requires acquisition to be
-# the longer of the two (it may include opening a new connection).
-CONNECTION_TIMEOUT = env.int("NEO4J_CONNECTION_TIMEOUT", default=5)
 CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
 READ_EXCEPTION_CODES = [
     "Neo.ClientError.Statement.AccessMode",
@@ -63,24 +58,15 @@ def init_driver() -> neo4j.Driver:
             uri = get_uri()
             config = settings.DATABASES["neo4j"]
 
-            driver = neo4j.GraphDatabase.driver(
+            _driver = neo4j.GraphDatabase.driver(
                 uri,
                 auth=(config["USER"], config["PASSWORD"]),
                 keep_alive=True,
                 max_connection_lifetime=7200,
-                connection_timeout=CONNECTION_TIMEOUT,
                 connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
                 max_connection_pool_size=50,
             )
-            # Publish the singleton only after connectivity is verified so a
-            # failed probe does not leave an unverified driver behind. Close the
-            # driver on failure so a repeatedly-probed outage cannot leak pools.
-            try:
-                driver.verify_connectivity()
-            except Exception:
-                driver.close()
-                raise
-            _driver = driver
+            _driver.verify_connectivity()
 
             # Register cleanup handler (only runs once since we're inside the _driver is None block)
             atexit.register(close_driver)
@@ -175,8 +161,7 @@ def drop_subgraph(database: str, provider_id: str) -> int:
     """
     Delete all nodes for a provider from the tenant database.
 
-    Deletes relationships then nodes in batches (not `DETACH DELETE`) so a dense
-    provider's graph cannot exceed Neo4j's transaction memory limit.
+    Uses batched deletion to avoid memory issues with large graphs.
     Silently returns 0 if the database doesn't exist.
     """
     provider_label = get_provider_label(provider_id)
@@ -184,28 +169,13 @@ def drop_subgraph(database: str, provider_id: str) -> int:
 
     try:
         with get_session(database) as session:
-            # Phase 1: delete relationships incident to provider nodes in batches.
-            deleted_count = 1
-            while deleted_count > 0:
-                result = session.run(
-                    f"""
-                    MATCH (:`{provider_label}`)-[r]-()
-                    WITH DISTINCT r LIMIT $batch_size
-                    DELETE r
-                    RETURN COUNT(r) AS deleted_rels_count
-                    """,
-                    {"batch_size": BATCH_SIZE},
-                )
-                deleted_count = result.single().get("deleted_rels_count", 0)
-
-            # Phase 2: delete the now relationship-free nodes in batches.
             deleted_count = 1
             while deleted_count > 0:
                 result = session.run(
                     f"""
                     MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`)
                     WITH n LIMIT $batch_size
-                    DELETE n
+                    DETACH DELETE n
                     RETURN COUNT(n) AS deleted_nodes_count
                     """,
                     {"batch_size": BATCH_SIZE},

api/src/backend/api/compliance.py

@@ -1,26 +1,11 @@
-import logging
-import threading
 from collections.abc import Iterable, Mapping
 
 from api.models import Provider
-from prowler.lib.check.compliance_models import (
-    get_bulk_compliance_frameworks_universal,
-)
+from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.check.models import CheckMetadata
 
-logger = logging.getLogger(__name__)
-
 AVAILABLE_COMPLIANCE_FRAMEWORKS = {}
 
-# Per-process readiness flags for the background compliance warm-up.
-# `STARTED` is set as soon as warming begins (only happens under Gunicorn via
-# the post_fork hook); `WARMED` is set when it finishes. The attributes
-# endpoint checks both: it returns 503 only while warming is in progress.
-# Under `runserver` warming never runs, so `STARTED` stays clear and the
-# endpoint keeps lazy-loading as before.
-COMPLIANCE_WARMING_STARTED = threading.Event()
-COMPLIANCE_WARMED = threading.Event()
-
 
 class LazyComplianceTemplate(Mapping):
     """Lazy-load compliance templates per provider on first access."""
@@ -109,22 +94,25 @@ PROWLER_CHECKS = LazyChecksMapping()
 
 
 def get_compliance_frameworks(provider_type: Provider.ProviderChoices) -> list[str]:
-    """List compliance framework identifiers available for `provider_type`.
+    """List compliance frameworks the API can load for `provider_type`.
 
-    Includes both per-provider frameworks and universal top-level frameworks
-    (e.g. ``dora``, ``csa_ccm_4.0``).
+    The list is sourced from `Compliance.get_bulk` so that the names
+    returned here are guaranteed to be loadable by the bulk loader. This
+    prevents downstream key mismatches (e.g. CSV report generation iterating
+    framework names and looking them up in the bulk dict).
 
     Args:
-        provider_type (Provider.ProviderChoices): The cloud provider type
-            (e.g., "aws", "azure", "gcp", "m365").
+        provider_type (Provider.ProviderChoices): The cloud provider type for which to retrieve
+            available compliance frameworks (e.g., "aws", "azure", "gcp", "m365").
 
     Returns:
-        list[str]: Framework identifiers (e.g., "cis_1.4_aws", "dora").
+        list[str]: A list of framework identifiers (e.g., "cis_1.4_aws", "mitre_attack_azure") available
+        for the given provider.
     """
     global AVAILABLE_COMPLIANCE_FRAMEWORKS
     if provider_type not in AVAILABLE_COMPLIANCE_FRAMEWORKS:
         AVAILABLE_COMPLIANCE_FRAMEWORKS[provider_type] = list(
-            get_bulk_compliance_frameworks_universal(provider_type).keys()
+            Compliance.get_bulk(provider_type).keys()
         )
 
     return AVAILABLE_COMPLIANCE_FRAMEWORKS[provider_type]
@@ -151,14 +139,18 @@ def get_prowler_provider_compliance(provider_type: Provider.ProviderChoices) ->
     """
     Retrieve the Prowler compliance data for a specified provider type.
 
+    This function fetches the compliance frameworks and their associated
+    requirements for the given cloud provider.
+
     Args:
         provider_type (Provider.ProviderChoices): The provider type
             (e.g., 'aws', 'azure') for which to retrieve compliance data.
 
     Returns:
-        dict: Mapping of framework name to `ComplianceFramework` for the provider.
+        dict: A dictionary mapping compliance framework names to their respective
+            Compliance objects for the specified provider.
     """
-    return get_bulk_compliance_frameworks_universal(provider_type)
+    return Compliance.get_bulk(provider_type)
 
 
 def _load_provider_assets(provider_type: Provider.ProviderChoices) -> tuple[dict, dict]:
@@ -187,56 +179,6 @@ def _ensure_provider_loaded(provider_type: Provider.ProviderChoices) -> None:
         PROWLER_CHECKS._cache[provider_type] = checks
 
 
-def warm_compliance_caches(
-    provider_types: Iterable[str] | None = None,
-) -> list[str]:
-    """
-    Eagerly populate the per-process compliance caches at server startup.
-
-    Moves the cold-cache catalog load off the request thread so the first
-    request does not trip the Gunicorn worker timeout. Reads only on-disk
-    metadata (no database access). Each provider is warmed in isolation;
-    failures are logged and fall back to lazy loading.
-
-    Args:
-        provider_types (Iterable[str] | None): Subset to warm. Defaults to all.
-
-    Returns:
-        list[str]: Provider types that could not be warmed.
-    """
-    if provider_types is None:
-        provider_types = Provider.ProviderChoices.values
-    provider_types = list(provider_types)
-
-    COMPLIANCE_WARMING_STARTED.set()
-    logger.info("Compliance cache warm-up started for providers: %s", provider_types)
-
-    failed = []
-    for provider_type in provider_types:
-        try:
-            get_compliance_frameworks(provider_type)
-            _ensure_provider_loaded(provider_type)
-        # Prowler check loading may sys.exit (SystemExit, not Exception).
-        except (Exception, SystemExit):
-            logger.warning(
-                "Failed to warm compliance caches for provider '%s'; "
-                "loading lazily on first request",
-                provider_type,
-                exc_info=True,
-            )
-            failed.append(provider_type)
-
-    # Mark as warmed even when some providers failed: a failed provider falls
-    # back to a single-provider lazy load, which stays under the worker timeout.
-    COMPLIANCE_WARMED.set()
-    logger.info(
-        "Compliance cache warm-up finished (providers warmed: %d, failed: %s)",
-        len(provider_types) - len(failed),
-        failed,
-    )
-    return failed
-
-
 def load_prowler_checks(
     prowler_compliance, provider_types: Iterable[str] | None = None
 ):
@@ -267,8 +209,8 @@ def load_prowler_checks(
         for compliance_name, compliance_data in prowler_compliance.get(
             provider_type, {}
         ).items():
-            for requirement in compliance_data.requirements:
-                for check in requirement.checks.get(provider_type, []):
+            for requirement in compliance_data.Requirements:
+                for check in requirement.Checks:
                     try:
                         checks[provider_type][check].add(compliance_name)
                     except KeyError:
@@ -348,40 +290,24 @@ def generate_compliance_overview_template(
             requirements_status = {"passed": 0, "failed": 0, "manual": 0}
             total_requirements = 0
 
-            for requirement in compliance_data.requirements:
+            for requirement in compliance_data.Requirements:
                 total_requirements += 1
-                provider_check_list = list(requirement.checks.get(provider_type, []))
-                total_checks = len(provider_check_list)
-                checks_dict = {check: None for check in provider_check_list}
+                total_checks = len(requirement.Checks)
+                checks_dict = {check: None for check in requirement.Checks}
 
                 req_status_val = "MANUAL" if total_checks == 0 else "PASS"
 
-                # MITRE attrs are wrapped under `_raw_attributes` by the
-                # universal adapter — unwrap so consumers see the flat list.
-                requirement_attributes = requirement.attributes
-                if (
-                    isinstance(requirement_attributes, dict)
-                    and "_raw_attributes" in requirement_attributes
-                ):
-                    attributes_payload = list(requirement_attributes["_raw_attributes"])
-                elif isinstance(requirement_attributes, dict):
-                    attributes_payload = (
-                        [dict(requirement_attributes)] if requirement_attributes else []
-                    )
-                else:
-                    attributes_payload = [
-                        dict(attribute) for attribute in requirement_attributes
-                    ]
-
                 # Build requirement dictionary
                 requirement_dict = {
-                    "name": requirement.name or requirement.id,
-                    "description": requirement.description,
-                    "tactics": requirement.tactics or [],
-                    "subtechniques": requirement.sub_techniques or [],
-                    "platforms": requirement.platforms or [],
-                    "technique_url": requirement.technique_url or "",
-                    "attributes": attributes_payload,
+                    "name": requirement.Name or requirement.Id,
+                    "description": requirement.Description,
+                    "tactics": getattr(requirement, "Tactics", []),
+                    "subtechniques": getattr(requirement, "SubTechniques", []),
+                    "platforms": getattr(requirement, "Platforms", []),
+                    "technique_url": getattr(requirement, "TechniqueURL", ""),
+                    "attributes": [
+                        dict(attribute) for attribute in requirement.Attributes
+                    ],
                     "checks": checks_dict,
                     "checks_status": {
                         "pass": 0,
@@ -399,15 +325,15 @@ def generate_compliance_overview_template(
                     requirements_status["passed"] += 1
 
                 # Add requirement to compliance requirements
-                compliance_requirements[requirement.id] = requirement_dict
+                compliance_requirements[requirement.Id] = requirement_dict
 
             # Build compliance dictionary
             compliance_dict = {
-                "framework": compliance_data.framework,
-                "name": compliance_data.name,
-                "version": compliance_data.version,
+                "framework": compliance_data.Framework,
+                "name": compliance_data.Name,
+                "version": compliance_data.Version,
                 "provider": provider_type,
-                "description": compliance_data.description,
+                "description": compliance_data.Description,
                 "requirements": compliance_requirements,
                 "requirements_status": requirements_status,
                 "total_requirements": total_requirements,

api/src/backend/api/exceptions.py

@@ -187,32 +187,6 @@ class UpstreamServiceUnavailableError(APIException):
         )
 
 
-class ComplianceWarmingError(APIException):
-    """Compliance catalog is still warming (503 Service Unavailable).
-
-    Returned by the compliance attributes endpoint while the per-process
-    catalog warm-up is in progress, so the request thread never triggers the
-    slow cold load that would trip the Gunicorn worker timeout.
-    """
-
-    status_code = status.HTTP_503_SERVICE_UNAVAILABLE
-    default_detail = (
-        "Compliance data is still loading. Please try again in a few seconds."
-    )
-    default_code = "compliance_warming"
-
-    def __init__(self, detail=None):
-        super().__init__(
-            detail=[
-                {
-                    "detail": detail or self.default_detail,
-                    "status": str(self.status_code),
-                    "code": self.default_code,
-                }
-            ]
-        )
-
-
 class UpstreamInternalError(APIException):
     """Unexpected error communicating with provider (500 Internal Server Error).
 

api/src/backend/api/management/commands/reconcile_orphan_tasks.py

@@ -1,59 +0,0 @@
-from django.core.management.base import BaseCommand
-
-from tasks.jobs.orphan_recovery import reconcile_orphans
-
-
-class Command(BaseCommand):
-    help = (
-        "Recover orphaned allowlisted Celery tasks whose worker is gone and mark "
-        "other stale task results terminal. Single-flight via a Postgres advisory lock."
-    )
-
-    def add_arguments(self, parser):
-        parser.add_argument(
-            "--grace-minutes",
-            type=int,
-            default=2,
-            help="Skip tasks started within this window (worker may still register).",
-        )
-        parser.add_argument(
-            "--max-attempts",
-            type=int,
-            default=3,
-            help="Give up re-running a task after this many recovery attempts; it is then left terminal instead of re-enqueued.",
-        )
-        parser.add_argument(
-            "--dry-run",
-            action="store_true",
-            help="Detect and report orphans without revoking or re-enqueuing.",
-        )
-
-    def handle(self, *args, **options):
-        result = reconcile_orphans(
-            grace_minutes=options["grace_minutes"],
-            max_attempts=options["max_attempts"],
-            dry_run=options["dry_run"],
-        )
-
-        if not result.get("acquired"):
-            self.stdout.write("Reconcile skipped: another run holds the lock.")
-            return
-
-        if result.get("enabled") is False:
-            message = (
-                "Task recovery is disabled (DJANGO_TASK_RECOVERY_ENABLED is off); "
-                "no orphans were recovered."
-            )
-            if result.get("attack_paths") is not None:
-                message += " Attack-paths stale cleanup still ran."
-            self.stdout.write(message)
-            return
-
-        self.stdout.write(
-            self.style.SUCCESS(
-                "Orphan reconcile complete: "
-                f"recovered={len(result.get('recovered', []))} "
-                f"failed={len(result.get('failed', []))} "
-                f"skipped(in-flight)={len(result.get('skipped', []))}"
-            )
-        )

api/src/backend/api/migrations/0095_reconcile_orphan_tasks_periodic_task.py

@@ -1,49 +0,0 @@
-from django.db import migrations
-
-
-TASK_NAME = "reconcile-orphan-tasks"
-INTERVAL_MINUTES = 2
-
-
-def create_periodic_task(apps, schema_editor):
-    IntervalSchedule = apps.get_model("django_celery_beat", "IntervalSchedule")
-    PeriodicTask = apps.get_model("django_celery_beat", "PeriodicTask")
-
-    schedule, _ = IntervalSchedule.objects.get_or_create(
-        every=INTERVAL_MINUTES,
-        period="minutes",
-    )
-
-    PeriodicTask.objects.update_or_create(
-        name=TASK_NAME,
-        defaults={
-            "task": TASK_NAME,
-            "interval": schedule,
-            "enabled": True,
-        },
-    )
-
-
-def delete_periodic_task(apps, schema_editor):
-    IntervalSchedule = apps.get_model("django_celery_beat", "IntervalSchedule")
-    PeriodicTask = apps.get_model("django_celery_beat", "PeriodicTask")
-
-    PeriodicTask.objects.filter(name=TASK_NAME).delete()
-
-    # Clean up the schedule if no other task references it
-    IntervalSchedule.objects.filter(
-        every=INTERVAL_MINUTES,
-        period="minutes",
-        periodictask__isnull=True,
-    ).delete()
-
-
-class Migration(migrations.Migration):
-    dependencies = [
-        ("api", "0093_okta_provider"),
-        ("django_celery_beat", "0019_alter_periodictasks_options"),
-    ]
-
-    operations = [
-        migrations.RunPython(create_periodic_task, delete_periodic_task),
-    ]

api/src/backend/api/specs/v1.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.32.0
+  version: 1.30.0
   description: |-
     Prowler API specification.
 
@@ -13137,59 +13137,8 @@ paths:
       responses:
         '200':
           description: CSV file containing the compliance report
-        '202':
-          description: The task is in progress
-        '403':
-          description: There is a problem with credentials
         '404':
-          description: Compliance report not found, or the scan has no reports yet
-  /api/v1/scans/{id}/compliance/{name}/ocsf:
-    get:
-      operationId: scans_compliance_ocsf_retrieve
-      description: Download a specific compliance report as an OCSF JSON file. Only
-        universal frameworks that declare an output configuration produce this artifact
-        (currently 'dora' and 'csa_ccm_4.0'); any other framework returns 404.
-      summary: Retrieve compliance report as OCSF JSON
-      parameters:
-      - in: query
-        name: fields[scan-reports]
-        schema:
-          type: array
-          items:
-            type: string
-            enum:
-            - id
-            - name
-        description: endpoint return only specific fields in the response on a per-type
-          basis by including a fields[TYPE] query parameter.
-        explode: false
-      - in: path
-        name: id
-        schema:
-          type: string
-          format: uuid
-        description: A UUID string identifying this scan.
-        required: true
-      - in: path
-        name: name
-        schema:
-          type: string
-        description: The compliance report name, like 'dora'
-        required: true
-      tags:
-      - Scan
-      security:
-      - JWT or API Key: []
-      responses:
-        '200':
-          description: OCSF JSON file containing the compliance report
-        '202':
-          description: The task is in progress
-        '403':
-          description: There is a problem with credentials
-        '404':
-          description: Compliance report not found, the framework does not provide
-            an OCSF export, or the scan has no reports yet
+          description: Compliance report not found
   /api/v1/scans/{id}/csa:
     get:
       operationId: scans_csa_retrieve

api/src/backend/api/tests/test_apps.py

@@ -182,19 +182,23 @@ def _make_app():
     return ApiConfig("api", api)
 
 
-@pytest.mark.parametrize(
-    "argv",
-    [
-        ["gunicorn"],
-        ["celery", "-A", "api"],
-        ["manage.py", "migrate"],
-    ],
-    ids=["api", "celery", "manage_py"],
-)
-def test_ready_never_eagerly_initializes_neo4j_driver(monkeypatch, argv):
-    """ready() must never contact Neo4j; the driver is created lazily on first use."""
+def test_ready_initializes_driver_for_api_process(monkeypatch):
     config = _make_app()
-    _set_argv(monkeypatch, argv)
+    _set_argv(monkeypatch, ["gunicorn"])
+    _set_testing(monkeypatch, False)
+
+    with (
+        patch.object(ApiConfig, "_ensure_crypto_keys", return_value=None),
+        patch("api.attack_paths.database.init_driver") as init_driver,
+    ):
+        config.ready()
+
+    init_driver.assert_called_once()
+
+
+def test_ready_skips_driver_for_celery(monkeypatch):
+    config = _make_app()
+    _set_argv(monkeypatch, ["celery", "-A", "api"])
     _set_testing(monkeypatch, False)
 
     with (
@@ -204,3 +208,31 @@ def test_ready_never_eagerly_initializes_neo4j_driver(monkeypatch, argv):
         config.ready()
 
     init_driver.assert_not_called()
+
+
+def test_ready_skips_driver_for_manage_py_skip_command(monkeypatch):
+    config = _make_app()
+    _set_argv(monkeypatch, ["manage.py", "migrate"])
+    _set_testing(monkeypatch, False)
+
+    with (
+        patch.object(ApiConfig, "_ensure_crypto_keys", return_value=None),
+        patch("api.attack_paths.database.init_driver") as init_driver,
+    ):
+        config.ready()
+
+    init_driver.assert_not_called()
+
+
+def test_ready_skips_driver_when_testing(monkeypatch):
+    config = _make_app()
+    _set_argv(monkeypatch, ["gunicorn"])
+    _set_testing(monkeypatch, True)
+
+    with (
+        patch.object(ApiConfig, "_ensure_crypto_keys", return_value=None),
+        patch("api.attack_paths.database.init_driver") as init_driver,
+    ):
+        config.ready()
+
+    init_driver.assert_not_called()

api/src/backend/api/tests/test_attack_paths_database.py

@@ -1,16 +1,15 @@
 """
 Tests for Neo4j database lazy initialization.
 
-The Neo4j driver is created on first use for every process type; app startup
-never contacts Neo4j. These tests validate the database module behavior itself.
+The Neo4j driver connects on first use by default. API processes may
+eagerly initialize the driver during app startup, while Celery workers
+remain lazy. These tests validate the database module behavior itself.
 """
 
 import threading
-
 from unittest.mock import MagicMock, patch
 
 import neo4j
-import neo4j.exceptions
 import pytest
 
 import api.attack_paths.database as db_module
@@ -60,32 +59,6 @@ class TestLazyInitialization:
         assert result is mock_driver
         assert db_module._driver is mock_driver
 
-    @patch("api.attack_paths.database.settings")
-    @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
-    def test_init_driver_leaves_driver_none_when_verify_fails(
-        self, mock_driver_factory, mock_settings
-    ):
-        """A failed verify_connectivity() must not publish or leak the driver."""
-        mock_driver = MagicMock()
-        mock_driver.verify_connectivity.side_effect = (
-            neo4j.exceptions.ServiceUnavailable("down")
-        )
-        mock_driver_factory.return_value = mock_driver
-        mock_settings.DATABASES = {
-            "neo4j": {
-                "HOST": "localhost",
-                "PORT": 7687,
-                "USER": "neo4j",
-                "PASSWORD": "password",
-            }
-        }
-
-        with pytest.raises(neo4j.exceptions.ServiceUnavailable):
-            db_module.init_driver()
-
-        assert db_module._driver is None
-        mock_driver.close.assert_called_once()
-
     @patch("api.attack_paths.database.settings")
     @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
     def test_init_driver_returns_cached_driver_on_subsequent_calls(
@@ -143,23 +116,21 @@ class TestConnectionAcquisitionTimeout:
     @pytest.fixture(autouse=True)
     def reset_module_state(self):
         original_driver = db_module._driver
-        original_acq_timeout = db_module.CONN_ACQUISITION_TIMEOUT
-        original_conn_timeout = db_module.CONNECTION_TIMEOUT
+        original_timeout = db_module.CONN_ACQUISITION_TIMEOUT
 
         db_module._driver = None
 
         yield
 
         db_module._driver = original_driver
-        db_module.CONN_ACQUISITION_TIMEOUT = original_acq_timeout
-        db_module.CONNECTION_TIMEOUT = original_conn_timeout
+        db_module.CONN_ACQUISITION_TIMEOUT = original_timeout
 
     @patch("api.attack_paths.database.settings")
     @patch("api.attack_paths.database.neo4j.GraphDatabase.driver")
     def test_driver_receives_configured_timeout(
         self, mock_driver_factory, mock_settings
     ):
-        """init_driver() should pass the configured timeouts to the neo4j driver."""
+        """init_driver() should pass CONN_ACQUISITION_TIMEOUT to the neo4j driver."""
         mock_driver_factory.return_value = MagicMock()
         mock_settings.DATABASES = {
             "neo4j": {
@@ -170,13 +141,11 @@ class TestConnectionAcquisitionTimeout:
             }
         }
         db_module.CONN_ACQUISITION_TIMEOUT = 42
-        db_module.CONNECTION_TIMEOUT = 7
 
         db_module.init_driver()
 
         _, kwargs = mock_driver_factory.call_args
         assert kwargs["connection_acquisition_timeout"] == 42
-        assert kwargs["connection_timeout"] == 7
 
 
 class TestAtexitRegistration:
@@ -542,84 +511,3 @@ class TestHasProviderData:
         ):
             with pytest.raises(db_module.GraphDatabaseQueryException):
                 db_module.has_provider_data("db-tenant-abc", "provider-123")
-
-
-class TestDropSubgraph:
-    """Test drop_subgraph two-phase batched deletion of a provider's graph."""
-
-    @staticmethod
-    def _result(count):
-        result = MagicMock()
-        result.single.return_value.get.return_value = count
-        return result
-
-    @staticmethod
-    def _session_ctx(session):
-        ctx = MagicMock()
-        ctx.__enter__.return_value = session
-        ctx.__exit__.return_value = False
-        return ctx
-
-    def test_deletes_relationships_then_nodes_in_batches(self):
-        session = MagicMock()
-        # Phase 1 (relationships): one full batch then empty.
-        # Phase 2 (nodes): one full batch then empty.
-        session.run.side_effect = [
-            self._result(1000),
-            self._result(0),
-            self._result(1000),
-            self._result(0),
-        ]
-
-        with patch(
-            "api.attack_paths.database.get_session",
-            return_value=self._session_ctx(session),
-        ):
-            deleted = db_module.drop_subgraph("db-tenant-abc", "provider-123")
-
-        # Only phase-2 node counts contribute to the return value.
-        assert deleted == 1000
-        assert session.run.call_count == 4
-
-        queries = [call.args[0] for call in session.run.call_args_list]
-
-        # Regression guard: the memory blow-up was caused by DETACH DELETE.
-        assert all("DETACH DELETE" not in query for query in queries)
-
-        rel_queries = [query for query in queries if "DELETE r" in query]
-        node_queries = [query for query in queries if "DELETE n" in query]
-        assert rel_queries and node_queries
-        # DISTINCT avoids double-counting relationships matched from both ends.
-        assert all("DISTINCT r" in query for query in rel_queries)
-
-        # Relationships must be fully drained before nodes are deleted.
-        first_node = next(i for i, q in enumerate(queries) if "DELETE n" in q)
-        last_rel = max(i for i, q in enumerate(queries) if "DELETE r" in q)
-        assert last_rel < first_node
-
-    def test_returns_zero_when_database_not_found(self):
-        session_ctx = MagicMock()
-        session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
-            message="Database does not exist",
-            code="Neo.ClientError.Database.DatabaseNotFound",
-        )
-
-        with patch(
-            "api.attack_paths.database.get_session",
-            return_value=session_ctx,
-        ):
-            assert db_module.drop_subgraph("db-tenant-gone", "provider-123") == 0
-
-    def test_raises_on_other_errors(self):
-        session_ctx = MagicMock()
-        session_ctx.__enter__.side_effect = db_module.GraphDatabaseQueryException(
-            message="Connection refused",
-            code="Neo.TransientError.General.UnknownError",
-        )
-
-        with patch(
-            "api.attack_paths.database.get_session",
-            return_value=session_ctx,
-        ):
-            with pytest.raises(db_module.GraphDatabaseQueryException):
-                db_module.drop_subgraph("db-tenant-abc", "provider-123")

api/src/backend/api/tests/test_compliance.py

@@ -10,12 +10,9 @@ from api.compliance import (
     get_prowler_provider_checks,
     get_prowler_provider_compliance,
     load_prowler_checks,
-    warm_compliance_caches,
 )
 from api.models import Provider
-from prowler.lib.check.compliance_models import (
-    get_bulk_compliance_frameworks_universal,
-)
+from prowler.lib.check.compliance_models import Compliance
 
 
 class TestCompliance:
@@ -31,16 +28,16 @@ class TestCompliance:
         assert set(checks) == {"check1", "check2", "check3"}
         mock_check_metadata.get_bulk.assert_called_once_with(provider_type)
 
-    @patch("api.compliance.get_bulk_compliance_frameworks_universal")
-    def test_get_prowler_provider_compliance(self, mock_get_bulk):
+    @patch("api.compliance.Compliance")
+    def test_get_prowler_provider_compliance(self, mock_compliance):
         provider_type = Provider.ProviderChoices.AWS
-        mock_get_bulk.return_value = {
+        mock_compliance.get_bulk.return_value = {
             "compliance1": MagicMock(),
             "compliance2": MagicMock(),
         }
         compliance_data = get_prowler_provider_compliance(provider_type)
-        assert compliance_data == mock_get_bulk.return_value
-        mock_get_bulk.assert_called_once_with(provider_type)
+        assert compliance_data == mock_compliance.get_bulk.return_value
+        mock_compliance.get_bulk.assert_called_once_with(provider_type)
 
     @patch("api.compliance.get_prowler_provider_checks")
     @patch("api.models.Provider.ProviderChoices")
@@ -54,9 +51,9 @@ class TestCompliance:
         prowler_compliance = {
             "aws": {
                 "compliance1": MagicMock(
-                    requirements=[
+                    Requirements=[
                         MagicMock(
-                            checks={"aws": ["check1", "check2"]},
+                            Checks=["check1", "check2"],
                         ),
                     ],
                 ),
@@ -170,38 +167,35 @@ class TestCompliance:
     def test_generate_compliance_overview_template(self, mock_provider_choices):
         mock_provider_choices.values = ["aws"]
 
-        # ``name`` is a reserved MagicMock kwarg (it labels the mock for repr,
-        # it does NOT set a ``.name`` attribute), so it must be assigned
-        # explicitly after construction.
         requirement1 = MagicMock(
-            id="requirement1",
-            description="Description of requirement 1",
-            attributes=[],
-            checks={"aws": ["check1", "check2"]},
-            tactics=["tactic1"],
-            sub_techniques=["subtechnique1"],
-            platforms=["platform1"],
-            technique_url="https://example.com",
+            Id="requirement1",
+            Name="Requirement 1",
+            Description="Description of requirement 1",
+            Attributes=[],
+            Checks=["check1", "check2"],
+            Tactics=["tactic1"],
+            SubTechniques=["subtechnique1"],
+            Platforms=["platform1"],
+            TechniqueURL="https://example.com",
         )
-        requirement1.name = "Requirement 1"
         requirement2 = MagicMock(
-            id="requirement2",
-            description="Description of requirement 2",
-            attributes=[],
-            checks={"aws": []},
-            tactics=[],
-            sub_techniques=[],
-            platforms=[],
-            technique_url="",
+            Id="requirement2",
+            Name="Requirement 2",
+            Description="Description of requirement 2",
+            Attributes=[],
+            Checks=[],
+            Tactics=[],
+            SubTechniques=[],
+            Platforms=[],
+            TechniqueURL="",
         )
-        requirement2.name = "Requirement 2"
         compliance1 = MagicMock(
-            requirements=[requirement1, requirement2],
-            framework="Framework 1",
-            version="1.0",
-            description="Description of compliance1",
+            Requirements=[requirement1, requirement2],
+            Framework="Framework 1",
+            Version="1.0",
+            Description="Description of compliance1",
+            Name="Compliance 1",
         )
-        compliance1.name = "Compliance 1"
         prowler_compliance = {"aws": {"compliance1": compliance1}}
 
         template = generate_compliance_overview_template(prowler_compliance)
@@ -268,43 +262,33 @@ def reset_compliance_cache():
     """Reset the module-level cache so each test starts cold."""
     previous = dict(compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS)
     compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS.clear()
-    # The warming flags are module-global; clear them so they do not leak
-    # between tests that call warm_compliance_caches.
-    compliance_module.COMPLIANCE_WARMING_STARTED.clear()
-    compliance_module.COMPLIANCE_WARMED.clear()
     try:
         yield
     finally:
         compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS.clear()
         compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS.update(previous)
-        compliance_module.COMPLIANCE_WARMING_STARTED.clear()
-        compliance_module.COMPLIANCE_WARMED.clear()
 
 
 class TestGetComplianceFrameworks:
     def test_returns_keys_from_compliance_get_bulk(self, reset_compliance_cache):
-        with patch(
-            "api.compliance.get_bulk_compliance_frameworks_universal"
-        ) as mock_get_bulk:
-            mock_get_bulk.return_value = {
+        with patch("api.compliance.Compliance") as mock_compliance:
+            mock_compliance.get_bulk.return_value = {
                 "cis_1.4_aws": MagicMock(),
                 "mitre_attack_aws": MagicMock(),
             }
             result = get_compliance_frameworks(Provider.ProviderChoices.AWS)
 
         assert sorted(result) == ["cis_1.4_aws", "mitre_attack_aws"]
-        mock_get_bulk.assert_called_once_with(Provider.ProviderChoices.AWS)
+        mock_compliance.get_bulk.assert_called_once_with(Provider.ProviderChoices.AWS)
 
     def test_caches_result_per_provider(self, reset_compliance_cache):
-        with patch(
-            "api.compliance.get_bulk_compliance_frameworks_universal"
-        ) as mock_get_bulk:
-            mock_get_bulk.return_value = {"cis_1.4_aws": MagicMock()}
+        with patch("api.compliance.Compliance") as mock_compliance:
+            mock_compliance.get_bulk.return_value = {"cis_1.4_aws": MagicMock()}
             get_compliance_frameworks(Provider.ProviderChoices.AWS)
             get_compliance_frameworks(Provider.ProviderChoices.AWS)
 
         # Cached after first call.
-        assert mock_get_bulk.call_count == 1
+        assert mock_compliance.get_bulk.call_count == 1
 
     @pytest.mark.parametrize(
         "provider_type",
@@ -312,105 +296,17 @@ class TestGetComplianceFrameworks:
     )
     def test_listing_is_subset_of_bulk(self, reset_compliance_cache, provider_type):
         """Regression for CLOUD-API-40S: every name returned by
-        ``get_compliance_frameworks`` must be loadable via
-        ``get_bulk_compliance_frameworks_universal``.
+        ``get_compliance_frameworks`` must be loadable via ``Compliance.get_bulk``.
 
         A divergence here is what produced ``KeyError: 'csa_ccm_4.0'`` in
         ``generate_outputs_task`` after universal/multi-provider compliance
         JSONs were introduced at the top-level ``prowler/compliance/`` path.
         """
-        bulk_keys = set(get_bulk_compliance_frameworks_universal(provider_type).keys())
+        bulk_keys = set(Compliance.get_bulk(provider_type).keys())
         listed = set(get_compliance_frameworks(provider_type))
 
         missing = listed - bulk_keys
         assert not missing, (
             f"get_compliance_frameworks({provider_type!r}) returned names not "
-            f"loadable by get_bulk_compliance_frameworks_universal: "
-            f"{sorted(missing)}"
+            f"loadable by Compliance.get_bulk: {sorted(missing)}"
         )
-
-
-class TestWarmComplianceCaches:
-    def test_warms_all_provider_types_by_default(self, reset_compliance_cache):
-        provider_types = list(Provider.ProviderChoices.values)
-        with (
-            patch("api.compliance.get_compliance_frameworks") as mock_frameworks,
-            patch("api.compliance._ensure_provider_loaded") as mock_ensure,
-        ):
-            warm_compliance_caches()
-
-        warmed = {call.args[0] for call in mock_frameworks.call_args_list}
-        assert warmed == set(provider_types)
-        assert mock_frameworks.call_count == len(provider_types)
-        assert mock_ensure.call_count == len(provider_types)
-
-    def test_warms_only_requested_provider_types(self, reset_compliance_cache):
-        with (
-            patch("api.compliance.get_compliance_frameworks") as mock_frameworks,
-            patch("api.compliance._ensure_provider_loaded") as mock_ensure,
-        ):
-            warm_compliance_caches([Provider.ProviderChoices.AWS])
-
-        mock_frameworks.assert_called_once_with(Provider.ProviderChoices.AWS)
-        mock_ensure.assert_called_once_with(Provider.ProviderChoices.AWS)
-
-    def test_populates_module_cache(self, reset_compliance_cache):
-        with (
-            patch(
-                "api.compliance.get_bulk_compliance_frameworks_universal"
-            ) as mock_get_bulk,
-            patch("api.compliance._ensure_provider_loaded"),
-        ):
-            mock_get_bulk.return_value = {"cis_1.4_aws": MagicMock()}
-            warm_compliance_caches([Provider.ProviderChoices.AWS])
-
-        assert (
-            Provider.ProviderChoices.AWS
-            in compliance_module.AVAILABLE_COMPLIANCE_FRAMEWORKS
-        )
-
-    def test_failing_provider_does_not_abort_the_rest(self, reset_compliance_cache):
-        """A failing provider (even on SystemExit) is isolated; others warm."""
-        providers = [Provider.ProviderChoices.AWS, Provider.ProviderChoices.OKTA]
-
-        def fake_frameworks(provider_type):
-            if provider_type == Provider.ProviderChoices.OKTA:
-                raise SystemExit(1)
-            return []
-
-        with (
-            patch(
-                "api.compliance.get_compliance_frameworks", side_effect=fake_frameworks
-            ),
-            patch("api.compliance._ensure_provider_loaded") as mock_ensure,
-        ):
-            failed = warm_compliance_caches(providers)
-
-        assert failed == [Provider.ProviderChoices.OKTA]
-        mock_ensure.assert_called_once_with(Provider.ProviderChoices.AWS)
-
-    def test_sets_readiness_flags(self, reset_compliance_cache):
-        assert not compliance_module.COMPLIANCE_WARMING_STARTED.is_set()
-        assert not compliance_module.COMPLIANCE_WARMED.is_set()
-
-        with (
-            patch("api.compliance.get_compliance_frameworks"),
-            patch("api.compliance._ensure_provider_loaded"),
-        ):
-            warm_compliance_caches([Provider.ProviderChoices.AWS])
-
-        assert compliance_module.COMPLIANCE_WARMING_STARTED.is_set()
-        assert compliance_module.COMPLIANCE_WARMED.is_set()
-
-    def test_marks_warmed_even_when_a_provider_fails(self, reset_compliance_cache):
-        """A failed provider still leaves the caches flagged as warmed."""
-        with (
-            patch(
-                "api.compliance.get_compliance_frameworks",
-                side_effect=SystemExit(1),
-            ),
-            patch("api.compliance._ensure_provider_loaded"),
-        ):
-            warm_compliance_caches([Provider.ProviderChoices.AWS])
-
-        assert compliance_module.COMPLIANCE_WARMED.is_set()

api/src/backend/api/tests/test_db_connection_labels.py

@@ -1,55 +0,0 @@
-from config.django.base import label_postgres_connections
-
-
-class TestLabelPostgresConnections:
-    def test_labels_postgres_and_skips_neo4j(self, monkeypatch):
-        monkeypatch.setenv("DJANGO_APP_COMPONENT", "scan")
-        databases = {
-            "default": {"ENGINE": "psqlextra.backend"},
-            "neo4j": {"HOST": "neo4j", "PORT": "7687"},
-        }
-
-        label_postgres_connections(databases)
-
-        assert databases["default"]["OPTIONS"]["application_name"] == "scan:default"
-        assert "OPTIONS" not in databases["neo4j"]
-
-    def test_labels_plain_postgresql_backend(self, monkeypatch):
-        monkeypatch.setenv("DJANGO_APP_COMPONENT", "api")
-        databases = {"saas": {"ENGINE": "django.db.backends.postgresql"}}
-
-        label_postgres_connections(databases)
-
-        assert databases["saas"]["OPTIONS"]["application_name"] == "api:saas"
-
-    def test_defaults_component_to_api_when_unset(self, monkeypatch):
-        monkeypatch.delenv("DJANGO_APP_COMPONENT", raising=False)
-        databases = {"default": {"ENGINE": "psqlextra.backend"}}
-
-        label_postgres_connections(databases)
-
-        assert databases["default"]["OPTIONS"]["application_name"] == "api:default"
-
-    def test_preserves_existing_options(self, monkeypatch):
-        monkeypatch.setenv("DJANGO_APP_COMPONENT", "worker")
-        databases = {
-            "replica": {
-                "ENGINE": "psqlextra.backend",
-                "OPTIONS": {"sslmode": "require"},
-            }
-        }
-
-        label_postgres_connections(databases)
-
-        assert databases["replica"]["OPTIONS"] == {
-            "sslmode": "require",
-            "application_name": "worker:replica",
-        }
-
-    def test_truncates_application_name_to_63_bytes(self, monkeypatch):
-        monkeypatch.setenv("DJANGO_APP_COMPONENT", "c" * 80)
-        databases = {"default": {"ENGINE": "psqlextra.backend"}}
-
-        label_postgres_connections(databases)
-
-        assert len(databases["default"]["OPTIONS"]["application_name"]) == 63

api/src/backend/api/tests/test_utils.py

@@ -357,30 +357,6 @@ class TestGetProwlerProviderKwargs:
         expected_result = {**secret_dict, **expected_extra_kwargs}
         assert result == expected_result
 
-    def test_get_prowler_provider_kwargs_oraclecloud_converts_region_string_to_set(
-        self,
-    ):
-        secret_dict = {
-            "user": "ocid1.user.oc1..fake",
-            "fingerprint": "00:11:22:33:44:55:66:77",
-            "key_content": "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----",
-            "tenancy": "ocid1.tenancy.oc1..fake",
-            "region": "us-ashburn-1",
-            "pass_phrase": "fake-passphrase",
-        }
-        secret_mock = MagicMock()
-        secret_mock.secret = secret_dict
-
-        provider = MagicMock()
-        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
-        provider.secret = secret_mock
-        provider.uid = "ocid1.tenancy.oc1..fake"
-
-        result = get_prowler_provider_kwargs(provider)
-
-        expected_result = {**secret_dict, "region": {"us-ashburn-1"}}
-        assert result == expected_result
-
     def test_get_prowler_provider_kwargs_with_mutelist(self):
         provider_uid = "provider_uid"
         secret_dict = {"key": "value"}

api/src/backend/api/tests/test_views.py

@@ -24,11 +24,9 @@ from conftest import (
     today_after_n_days,
 )
 from django.conf import settings
-from django.db import connection
 from django.db.models import Count
 from django.http import JsonResponse
 from django.test import RequestFactory
-from django.test.utils import CaptureQueriesContext
 from django.urls import reverse
 from django_celery_results.models import TaskResult
 from rest_framework import status
@@ -66,7 +64,6 @@ from api.models import (
     ProviderSecret,
     Resource,
     ResourceFindingMapping,
-    ResourceTag,
     Role,
     RoleProviderGroupRelationship,
     SAMLConfiguration,
@@ -3859,20 +3856,16 @@ class TestScanViewSet:
         scan.output_location = "dummy"
         scan.save()
 
-        task_result = TaskResult.objects.create(
-            task_id=str(uuid4()),
-            task_name="scan-report",
-            task_kwargs={"scan_id": str(scan.id)},
-        )
-        task = Task.objects.create(
-            tenant_id=scan.tenant_id,
-            task_runner_task=task_result,
-        )
-        dummy_task_data = {"id": str(task.id), "state": StateChoices.EXECUTING}
+        dummy_task = Task.objects.create(tenant_id=scan.tenant_id)
+        dummy_task.id = "dummy-task-id"
+        dummy_task_data = {"id": dummy_task.id, "state": StateChoices.EXECUTING}
 
-        with patch(
-            "api.v1.views.TaskSerializer",
-            return_value=type("DummySerializer", (), {"data": dummy_task_data}),
+        with (
+            patch("api.v1.views.Task.objects.get", return_value=dummy_task),
+            patch(
+                "api.v1.views.TaskSerializer",
+                return_value=type("DummySerializer", (), {"data": dummy_task_data}),
+            ),
         ):
             url = reverse("scan-report", kwargs={"pk": scan.id})
             response = authenticated_client.get(url)
@@ -4193,88 +4186,6 @@ class TestScanViewSet:
         assert resp.status_code == status.HTTP_302_FOUND
         assert resp["Location"] == presigned_url
 
-    def test_compliance_s3_returns_latest_match(
-        self, authenticated_client, scans_fixture, monkeypatch
-    ):
-        """When several files match, the most recently modified one is served."""
-        scan = scans_fixture[0]
-        bucket = "bucket"
-        scan.output_location = f"s3://{bucket}/path/scan.zip"
-        scan.state = StateChoices.COMPLETED
-        scan.save()
-
-        monkeypatch.setattr(
-            "api.v1.views.env",
-            type("env", (), {"str": lambda self, *args, **kwargs: "test-bucket"})(),
-        )
-
-        old_key = "path/compliance/prowler-output-aws-20240101000000_cis_1.4_aws.csv"
-        latest_key = "path/compliance/prowler-output-aws-20240202000000_cis_1.4_aws.csv"
-
-        class FakeS3Client:
-            def list_objects_v2(self, Bucket, Prefix):
-                return {
-                    "Contents": [
-                        {
-                            "Key": old_key,
-                            "LastModified": datetime(2024, 1, 1, tzinfo=timezone.utc),
-                        },
-                        {
-                            "Key": latest_key,
-                            "LastModified": datetime(2024, 2, 2, tzinfo=timezone.utc),
-                        },
-                    ]
-                }
-
-            def generate_presigned_url(self, ClientMethod, Params, ExpiresIn):
-                assert Params["Key"] == latest_key
-                return "https://test-bucket.s3.amazonaws.com/latest"
-
-        monkeypatch.setattr("api.v1.views.get_s3_client", lambda: FakeS3Client())
-
-        url = reverse("scan-compliance", kwargs={"pk": scan.id, "name": "cis_1.4_aws"})
-        resp = authenticated_client.get(url)
-        assert resp.status_code == status.HTTP_302_FOUND
-        assert resp["Location"].endswith("/latest")
-
-    def test_compliance_local_returns_latest_match(
-        self, authenticated_client, scans_fixture, monkeypatch
-    ):
-        """The local branch serves the most recently modified matching file."""
-        scan = scans_fixture[0]
-        scan.state = StateChoices.COMPLETED
-
-        with tempfile.TemporaryDirectory() as tmp:
-            comp_dir = Path(tmp) / "reports" / "compliance"
-            comp_dir.mkdir(parents=True, exist_ok=True)
-
-            old_file = comp_dir / "prowler-output-aws-20240101000000_cis_1.4_aws.csv"
-            old_file.write_bytes(b"old")
-            latest_file = comp_dir / "prowler-output-aws-20240202000000_cis_1.4_aws.csv"
-            latest_file.write_bytes(b"latest")
-            # Make `latest_file` newer regardless of creation order.
-            os.utime(old_file, (1_700_000_000, 1_700_000_000))
-            os.utime(latest_file, (1_700_000_100, 1_700_000_100))
-
-            scan.output_location = str(Path(tmp) / "reports" / "scan.zip")
-            scan.save()
-
-            monkeypatch.setattr(
-                glob,
-                "glob",
-                lambda p: [str(old_file), str(latest_file)],
-            )
-
-            url = reverse(
-                "scan-compliance", kwargs={"pk": scan.id, "name": "cis_1.4_aws"}
-            )
-            resp = authenticated_client.get(url)
-            assert resp.status_code == status.HTTP_200_OK
-            assert resp.content == b"latest"
-            assert resp["Content-Disposition"].endswith(
-                f'filename="{latest_file.name}"'
-            )
-
     def test_compliance_s3_not_found(
         self, authenticated_client, scans_fixture, monkeypatch
     ):
@@ -4383,24 +4294,18 @@ class TestScanViewSet:
             assert cd.startswith('attachment; filename="')
             assert cd.endswith(f'filename="{fname.name}"')
 
+    @patch("api.v1.views.Task.objects.get")
     @patch("api.v1.views.TaskSerializer")
     def test__get_task_status_returns_none_if_task_not_executing(
-        self, mock_task_serializer, authenticated_client, scans_fixture
+        self, mock_task_serializer, mock_task_get, authenticated_client, scans_fixture
     ):
         scan = scans_fixture[0]
         scan.state = StateChoices.COMPLETED
         scan.output_location = "dummy"
         scan.save()
 
-        task_result = TaskResult.objects.create(
-            task_id=str(uuid4()),
-            task_name="scan-report",
-            task_kwargs={"scan_id": str(scan.id)},
-        )
-        task = Task.objects.create(
-            tenant_id=scan.tenant_id,
-            task_runner_task=task_result,
-        )
+        task = Task.objects.create(tenant_id=scan.tenant_id)
+        mock_task_get.return_value = task
         mock_task_serializer.return_value.data = {
             "id": str(task.id),
             "state": StateChoices.COMPLETED,
@@ -4421,7 +4326,6 @@ class TestScanViewSet:
         scan.save()
 
         task_result = TaskResult.objects.create(
-            task_id=str(uuid4()),
             task_name="scan-report",
             task_kwargs={"scan_id": str(scan.id)},
         )
@@ -4442,51 +4346,6 @@ class TestScanViewSet:
         assert response.status_code == status.HTTP_202_ACCEPTED
         assert response.data["id"] == str(task.id)
 
-    @patch("api.v1.views.TaskSerializer")
-    def test__get_task_status_returns_latest_task(
-        self, mock_task_serializer, authenticated_client, scans_fixture
-    ):
-        """With several scan-report tasks for the scan, the most recent is used."""
-        scan = scans_fixture[0]
-        scan.state = StateChoices.COMPLETED
-        scan.output_location = "dummy"
-        scan.save()
-
-        old_task = Task.objects.create(
-            tenant_id=scan.tenant_id,
-            task_runner_task=TaskResult.objects.create(
-                task_id=str(uuid4()),
-                task_name="scan-report",
-                task_kwargs={"scan_id": str(scan.id)},
-            ),
-        )
-        new_task = Task.objects.create(
-            tenant_id=scan.tenant_id,
-            task_runner_task=TaskResult.objects.create(
-                task_id=str(uuid4()),
-                task_name="scan-report",
-                task_kwargs={"scan_id": str(scan.id)},
-            ),
-        )
-        # `inserted_at` is `auto_now_add`, and within the test transaction the DB
-        # `now()` is constant, so force distinct timestamps to make order_by stable.
-        base = datetime(2024, 1, 1, tzinfo=timezone.utc)
-        Task.objects.filter(pk=old_task.pk).update(inserted_at=base)
-        Task.objects.filter(pk=new_task.pk).update(
-            inserted_at=base + timedelta(hours=1)
-        )
-
-        mock_task_serializer.side_effect = lambda instance, *a, **k: SimpleNamespace(
-            data={"id": str(instance.id), "state": StateChoices.EXECUTING}
-        )
-
-        url = reverse("scan-report", kwargs={"pk": scan.id})
-        response = authenticated_client.get(url)
-
-        assert response.status_code == status.HTTP_202_ACCEPTED
-        assert str(new_task.id) in response["Content-Location"]
-        assert str(old_task.id) not in response["Content-Location"]
-
     @patch("api.v1.views.get_s3_client")
     @patch("api.v1.views.sentry_sdk.capture_exception")
     def test_compliance_list_objects_client_error(
@@ -7057,80 +6916,6 @@ class TestFindingViewSet:
             == findings_fixture[0].status
         )
 
-    def test_findings_list_resource_tags_no_n_plus_one(
-        self, authenticated_client, findings_fixture
-    ):
-        """Listing findings must load every resource's tags in a constant
-        number of queries, no matter how many findings/resources are returned.
-
-        This guards ``FindingViewSet._optimize_tags_loading`` against
-        regressions that would reintroduce one extra query per resource (the
-        N+1 the prefetch was added to remove).
-        """
-        scan = findings_fixture[0].scan
-        tenant_id = findings_fixture[0].tenant_id
-        provider = scan.provider
-
-        def _create_finding_with_tagged_resource(index):
-            resource = Resource.objects.create(
-                tenant_id=tenant_id,
-                provider=provider,
-                uid=f"arn:aws:ec2:us-east-1:123456789012:instance/n-plus-one-{index}",
-                name=f"N+1 Instance {index}",
-                region="us-east-1",
-                service="ec2",
-                type="prowler-test",
-            )
-            resource.upsert_or_delete_tags(
-                [
-                    ResourceTag.objects.create(
-                        tenant_id=tenant_id,
-                        key=f"key-{index}",
-                        value=f"value-{index}",
-                    )
-                ]
-            )
-            finding = Finding.objects.create(
-                tenant_id=tenant_id,
-                uid=f"n_plus_one_finding_{index}",
-                scan=scan,
-                status=Status.FAIL,
-                status_extended="n+1 status",
-                impact=Severity.medium,
-                severity=Severity.medium,
-                check_id="test_check_id",
-                check_metadata={"CheckId": "test_check_id", "servicename": "ec2"},
-                first_seen_at="2024-01-02T00:00:00Z",
-            )
-            finding.add_resources([resource])
-            return finding
-
-        params = {"filter[inserted_at]": TODAY, "include": "resources"}
-
-        # Baseline: the two findings provided by the fixture.
-        with CaptureQueriesContext(connection) as baseline:
-            response = authenticated_client.get(reverse("finding-list"), params)
-        assert response.status_code == status.HTTP_200_OK
-
-        # Add more findings, each with its own resource carrying tags.
-        extra_findings = 5
-        for index in range(extra_findings):
-            _create_finding_with_tagged_resource(index)
-
-        with CaptureQueriesContext(connection) as scaled:
-            response = authenticated_client.get(reverse("finding-list"), params)
-        assert response.status_code == status.HTTP_200_OK
-        assert len(response.json()["data"]) == len(findings_fixture) + extra_findings
-
-        # The query count must not grow with the number of findings/resources.
-        assert len(scaled.captured_queries) == len(baseline.captured_queries), (
-            "Resource tags are not being prefetched: "
-            f"{len(baseline.captured_queries)} queries for {len(findings_fixture)} "
-            f"findings vs {len(scaled.captured_queries)} for "
-            f"{len(findings_fixture) + extra_findings}. Likely an N+1 regression "
-            "in FindingViewSet._optimize_tags_loading."
-        )
-
     @pytest.mark.parametrize(
         "include_values, expected_resources",
         [
@@ -9560,198 +9345,6 @@ class TestComplianceOverviewViewSet:
             assert "platforms" in attributes["attributes"]["technique_details"]
             assert "technique_url" in attributes["attributes"]["technique_details"]
 
-            # Guard against the `_raw_attributes` wrapper leaking through —
-            # the UI reads metadata[i].Category / .AWSService directly.
-            metadata = attributes["attributes"]["metadata"]
-            assert isinstance(metadata, list) and len(metadata) > 0
-            first_attr = metadata[0]
-            assert isinstance(first_attr, dict)
-            assert "_raw_attributes" not in first_attr
-            assert "Category" in first_attr
-            assert "AWSService" in first_attr
-
-    def test_compliance_overview_attributes_resolves_provider_from_scan(
-        self, authenticated_client, tenants_fixture, providers_fixture
-    ):
-        # csa_ccm_4.0 is a multi-provider universal framework: a single
-        # compliance_id whose requirements expose different checks per provider.
-        # Passing a scan must return the check IDs for that scan's provider,
-        # otherwise the endpoint defaults to the first provider that declares the
-        # framework and azure/gcp requirements end up with check IDs that match
-        # no findings.
-        tenant = tenants_fixture[0]
-        gcp_provider = providers_fixture[2]
-        azure_provider = providers_fixture[4]
-        assert gcp_provider.provider == Provider.ProviderChoices.GCP.value
-        assert azure_provider.provider == Provider.ProviderChoices.AZURE.value
-
-        now = datetime.now(timezone.utc)
-        gcp_scan = Scan.objects.create(
-            name="gcp scan",
-            provider=gcp_provider,
-            trigger=Scan.TriggerChoices.MANUAL,
-            state=StateChoices.COMPLETED,
-            tenant_id=tenant.id,
-            started_at=now,
-            completed_at=now,
-        )
-        azure_scan = Scan.objects.create(
-            name="azure scan",
-            provider=azure_provider,
-            trigger=Scan.TriggerChoices.MANUAL,
-            state=StateChoices.COMPLETED,
-            tenant_id=tenant.id,
-            started_at=now,
-            completed_at=now,
-        )
-
-        def request_attributes(scan_id=None):
-            params = {"filter[compliance_id]": "csa_ccm_4.0"}
-            if scan_id is not None:
-                params["filter[scan_id]"] = str(scan_id)
-            return authenticated_client.get(
-                reverse("complianceoverview-attributes"), params
-            )
-
-        def collect_check_ids(scan_id=None):
-            response = request_attributes(scan_id)
-            assert response.status_code == status.HTTP_200_OK
-            check_ids = set()
-            for item in response.json()["data"]:
-                check_ids.update(item["attributes"]["attributes"]["check_ids"])
-            return check_ids
-
-        gcp_check_ids = collect_check_ids(gcp_scan.id)
-        azure_check_ids = collect_check_ids(azure_scan.id)
-
-        # Each scan resolves to its own provider's checks, and they differ.
-        assert gcp_check_ids
-        assert azure_check_ids
-        assert gcp_check_ids != azure_check_ids
-
-        # The returned check IDs belong to the SDK's per-provider definition.
-        from api.compliance import get_prowler_provider_compliance
-
-        def expected_check_ids(provider_type):
-            framework = get_prowler_provider_compliance(provider_type)["csa_ccm_4.0"]
-            expected = set()
-            for requirement in framework.requirements:
-                expected.update(requirement.checks.get(provider_type, []))
-            return expected
-
-        assert gcp_check_ids <= expected_check_ids(Provider.ProviderChoices.GCP.value)
-        assert azure_check_ids <= expected_check_ids(
-            Provider.ProviderChoices.AZURE.value
-        )
-
-        # An explicit scan_id is authoritative: a non-existent scan must fail
-        # closed with 404 instead of silently falling back to another provider.
-        missing_response = request_attributes("00000000-0000-0000-0000-000000000000")
-        assert missing_response.status_code == status.HTTP_404_NOT_FOUND
-
-        # A malformed scan_id is rejected with 404 as well.
-        malformed_response = request_attributes("not-a-uuid")
-        assert malformed_response.status_code == status.HTTP_404_NOT_FOUND
-
-        # An empty value (filter[scan_id]=) must not fall back to the legacy
-        # provider picker: the explicit (if blank) selector fails closed.
-        empty_response = request_attributes("")
-        assert empty_response.status_code == status.HTTP_404_NOT_FOUND
-
-        # A scan belonging to another tenant is not visible (RLS), so it must
-        # return 404 rather than leaking the fallback provider's check IDs.
-        other_tenant = Tenant.objects.create(name="Other Compliance Tenant")
-        foreign_provider = Provider.objects.create(
-            provider="gcp",
-            uid="foreign-gcp-test",
-            alias="foreign_gcp",
-            tenant_id=other_tenant.id,
-        )
-        foreign_scan = Scan.objects.create(
-            name="foreign scan",
-            provider=foreign_provider,
-            trigger=Scan.TriggerChoices.MANUAL,
-            state=StateChoices.COMPLETED,
-            tenant_id=other_tenant.id,
-            started_at=now,
-            completed_at=now,
-        )
-        foreign_response = request_attributes(foreign_scan.id)
-        assert foreign_response.status_code == status.HTTP_404_NOT_FOUND
-
-    def test_compliance_overview_attributes_scan_scoped_by_provider_group(
-        self,
-        authenticated_client_no_permissions_rbac,
-        providers_fixture,
-    ):
-        # A user with limited visibility (no UNLIMITED_VISIBILITY) must only be
-        # able to resolve scans for providers in its provider groups. Tenant RLS
-        # alone is not enough here: both scans belong to the same tenant, so the
-        # endpoint has to scope the scan lookup by provider group, otherwise a
-        # restricted user could read another provider's compliance metadata.
-        client = authenticated_client_no_permissions_rbac
-        limited_user = client.user
-        membership = Membership.objects.filter(user=limited_user).first()
-        tenant = membership.tenant
-
-        allowed_provider = providers_fixture[2]
-        denied_provider = providers_fixture[4]
-        assert allowed_provider.provider == Provider.ProviderChoices.GCP.value
-        assert denied_provider.provider == Provider.ProviderChoices.AZURE.value
-
-        provider_group = ProviderGroup.objects.create(
-            name="limited-compliance-group",
-            tenant_id=tenant.id,
-        )
-        ProviderGroupMembership.objects.create(
-            tenant_id=tenant.id,
-            provider_group=provider_group,
-            provider=allowed_provider,
-        )
-        RoleProviderGroupRelationship.objects.create(
-            tenant_id=tenant.id,
-            role=limited_user.roles.first(),
-            provider_group=provider_group,
-        )
-
-        now = datetime.now(timezone.utc)
-        allowed_scan = Scan.objects.create(
-            name="allowed scan",
-            provider=allowed_provider,
-            trigger=Scan.TriggerChoices.MANUAL,
-            state=StateChoices.COMPLETED,
-            tenant_id=tenant.id,
-            started_at=now,
-            completed_at=now,
-        )
-        denied_scan = Scan.objects.create(
-            name="denied scan",
-            provider=denied_provider,
-            trigger=Scan.TriggerChoices.MANUAL,
-            state=StateChoices.COMPLETED,
-            tenant_id=tenant.id,
-            started_at=now,
-            completed_at=now,
-        )
-
-        def request_attributes(scan_id):
-            return client.get(
-                reverse("complianceoverview-attributes"),
-                {
-                    "filter[compliance_id]": "csa_ccm_4.0",
-                    "filter[scan_id]": str(scan_id),
-                },
-            )
-
-        # The scan in the user's provider group resolves normally.
-        assert request_attributes(allowed_scan.id).status_code == status.HTTP_200_OK
-
-        # The scan outside the user's provider group is invisible, so it fails
-        # closed with 404 instead of leaking the other provider's check IDs.
-        assert (
-            request_attributes(denied_scan.id).status_code == status.HTTP_404_NOT_FOUND
-        )
-
     def test_compliance_overview_attributes_missing_compliance_id(
         self, authenticated_client
     ):
@@ -9760,39 +9353,6 @@ class TestComplianceOverviewViewSet:
         )
         assert response.status_code == status.HTTP_400_BAD_REQUEST
 
-    def test_compliance_overview_attributes_503_while_warming(
-        self, authenticated_client
-    ):
-        from api.compliance import COMPLIANCE_WARMED, COMPLIANCE_WARMING_STARTED
-
-        COMPLIANCE_WARMING_STARTED.set()
-        COMPLIANCE_WARMED.clear()
-        try:
-            response = authenticated_client.get(
-                reverse("complianceoverview-attributes"),
-                {"filter[compliance_id]": "aws_account_security_onboarding_aws"},
-            )
-        finally:
-            COMPLIANCE_WARMING_STARTED.clear()
-
-        assert response.status_code == status.HTTP_503_SERVICE_UNAVAILABLE
-        assert response.json()["errors"][0]["code"] == "compliance_warming"
-
-    def test_compliance_overview_attributes_serves_when_warming_not_started(
-        self, authenticated_client
-    ):
-        # Dev fallback: under runserver warming never runs, so the guard must
-        # not refuse — the endpoint lazily loads and serves as before.
-        from api.compliance import COMPLIANCE_WARMED, COMPLIANCE_WARMING_STARTED
-
-        COMPLIANCE_WARMING_STARTED.clear()
-        COMPLIANCE_WARMED.clear()
-        response = authenticated_client.get(
-            reverse("complianceoverview-attributes"),
-            {"filter[compliance_id]": "aws_account_security_onboarding_aws"},
-        )
-        assert response.status_code == status.HTTP_200_OK
-
     def test_compliance_overview_task_management_integration(
         self, authenticated_client, compliance_requirements_overviews_fixture
     ):

api/src/backend/api/utils.py

@@ -243,12 +243,6 @@ def get_prowler_provider_kwargs(
             **prowler_provider_kwargs,
             "filter_accounts": [provider.uid],
         }
-    elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
-        if isinstance(prowler_provider_kwargs.get("region"), str):
-            prowler_provider_kwargs = {
-                **prowler_provider_kwargs,
-                "region": {prowler_provider_kwargs["region"]},
-            }
     elif provider.provider == Provider.ProviderChoices.OPENSTACK.value:
         # clouds_yaml_content, clouds_yaml_cloud and provider_id are validated
         # in the provider itself, so it's not needed here.

api/src/backend/api/v1/views.py

@@ -30,7 +30,6 @@ from dj_rest_auth.registration.views import SocialLoginView
 from django.conf import settings as django_settings
 from django.contrib.postgres.aggregates import ArrayAgg, BoolAnd, StringAgg
 from django.contrib.postgres.search import SearchQuery
-from django.core.exceptions import ValidationError as DjangoValidationError
 from django.db import transaction
 from django.db.models import (
     BooleanField,
@@ -115,17 +114,13 @@ from api.attack_paths import get_queries_for_provider, get_query_by_id
 from api.attack_paths import views_helpers as attack_paths_views_helpers
 from api.base_views import BaseRLSViewSet, BaseTenantViewset, BaseUserViewset
 from api.compliance import (
-    COMPLIANCE_WARMED,
-    COMPLIANCE_WARMING_STARTED,
     PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE,
     get_compliance_frameworks,
-    get_prowler_provider_compliance,
 )
 from api.constants import SEVERITY_ORDER
 from api.db_router import MainRouter
 from api.db_utils import rls_transaction
 from api.exceptions import (
-    ComplianceWarmingError,
     TaskFailedException,
     UpstreamAccessDeniedError,
     UpstreamAuthenticationError,
@@ -1854,42 +1849,7 @@ class ProviderViewSet(DisablePaginationMixin, BaseRLSViewSet):
             200: OpenApiResponse(
                 description="CSV file containing the compliance report"
             ),
-            202: OpenApiResponse(description="The task is in progress"),
-            403: OpenApiResponse(description="There is a problem with credentials"),
-            404: OpenApiResponse(
-                description="Compliance report not found, or the scan has no reports yet"
-            ),
-        },
-        request=None,
-    ),
-    compliance_ocsf=extend_schema(
-        tags=["Scan"],
-        summary="Retrieve compliance report as OCSF JSON",
-        description=(
-            "Download a specific compliance report as an OCSF JSON file. "
-            "Only universal frameworks that declare an output configuration "
-            "produce this artifact (currently 'dora' and 'csa_ccm_4.0'); any "
-            "other framework returns 404."
-        ),
-        parameters=[
-            OpenApiParameter(
-                name="name",
-                type=str,
-                location=OpenApiParameter.PATH,
-                required=True,
-                description="The compliance report name, like 'dora'",
-            ),
-        ],
-        responses={
-            200: OpenApiResponse(
-                description="OCSF JSON file containing the compliance report"
-            ),
-            202: OpenApiResponse(description="The task is in progress"),
-            403: OpenApiResponse(description="There is a problem with credentials"),
-            404: OpenApiResponse(
-                description="Compliance report not found, the framework does "
-                "not provide an OCSF export, or the scan has no reports yet"
-            ),
+            404: OpenApiResponse(description="Compliance report not found"),
         },
         request=None,
     ),
@@ -2032,23 +1992,35 @@ class ScanViewSet(BaseRLSViewSet):
         return queryset.select_related("provider", "task")
 
     def get_serializer_class(self):
-        if self.action == "partial_update":
-            return ScanUpdateSerializer
-
-        action_defaults = {
-            "create": ScanCreateSerializer,
-            "report": ScanReportSerializer,
-            "compliance": ScanComplianceReportSerializer,
-            "compliance_ocsf": ScanComplianceReportSerializer,
-        }
-        response_only_actions = {"threatscore", "ens", "nis2", "csa", "cis"}
-
-        if self.action in action_defaults or self.action in response_only_actions:
+        if self.action == "create":
+            if hasattr(self, "response_serializer_class"):
+                return self.response_serializer_class
+            return ScanCreateSerializer
+        elif self.action == "partial_update":
+            return ScanUpdateSerializer
+        elif self.action == "report":
+            if hasattr(self, "response_serializer_class"):
+                return self.response_serializer_class
+            return ScanReportSerializer
+        elif self.action == "compliance":
+            if hasattr(self, "response_serializer_class"):
+                return self.response_serializer_class
+            return ScanComplianceReportSerializer
+        elif self.action == "threatscore":
+            if hasattr(self, "response_serializer_class"):
+                return self.response_serializer_class
+        elif self.action == "ens":
+            if hasattr(self, "response_serializer_class"):
+                return self.response_serializer_class
+        elif self.action == "nis2":
+            if hasattr(self, "response_serializer_class"):
+                return self.response_serializer_class
+        elif self.action == "csa":
+            if hasattr(self, "response_serializer_class"):
+                return self.response_serializer_class
+        elif self.action == "cis":
             if hasattr(self, "response_serializer_class"):
                 return self.response_serializer_class
-            if self.action in action_defaults:
-                return action_defaults[self.action]
-
         return super().get_serializer_class()
 
     def partial_update(self, request, *args, **kwargs):
@@ -2087,17 +2059,12 @@ class ScanViewSet(BaseRLSViewSet):
         if scan_instance.state == StateChoices.EXECUTING and scan_instance.task:
             task = scan_instance.task
         else:
-            # A scan can have several `scan-report` tasks (e.g. re-runs); take the
-            # most recent one. `.first()` also avoids `MultipleObjectsReturned`.
-            task = (
-                Task.objects.filter(
+            try:
+                task = Task.objects.get(
                     task_runner_task__task_name="scan-report",
                     task_runner_task__task_kwargs__contains=str(scan_instance.id),
                 )
-                .order_by("-inserted_at")
-                .first()
-            )
-            if task is None:
+            except Task.DoesNotExist:
                 return None
 
         self.response_serializer_class = TaskSerializer
@@ -2172,32 +2139,27 @@ class ScanViewSet(BaseRLSViewSet):
                         status=status.HTTP_502_BAD_GATEWAY,
                     )
                 contents = resp.get("Contents", [])
-                matches = []
+                keys = []
                 for obj in contents:
                     key = obj["Key"]
                     key_basename = os.path.basename(key)
                     if any(ch in suffix for ch in ("*", "?", "[")):
                         if fnmatch.fnmatch(key_basename, suffix):
-                            matches.append(obj)
+                            keys.append(key)
                     elif key_basename == suffix:
-                        matches.append(obj)
+                        keys.append(key)
                     elif key.endswith(suffix):
                         # Backward compatibility if suffix already includes directories
-                        matches.append(obj)
-                if not matches:
+                        keys.append(key)
+                if not keys:
                     return Response(
                         {
                             "detail": f"No compliance file found for name '{os.path.splitext(suffix)[0]}'."
                         },
                         status=status.HTTP_404_NOT_FOUND,
                     )
-                # Return the most recently modified match (latest report) when
-                # several files share the prefix/suffix. `list_objects_v2` always
-                # returns `LastModified`; the fallback keeps ordering deterministic
-                # if it is ever absent.
-                key = max(matches, key=lambda o: (o.get("LastModified", ""), o["Key"]))[
-                    "Key"
-                ]
+                # path_pattern here is prefix, but in compliance we build correct suffix check before
+                key = keys[0]
             else:
                 # path_pattern is exact key; HEAD before presigning to preserve the 404 contract.
                 key = path_pattern
@@ -2247,9 +2209,7 @@ class ScanViewSet(BaseRLSViewSet):
                     },
                     status=status.HTTP_404_NOT_FOUND,
                 )
-            # Return the most recently modified match (latest report) when the
-            # pattern resolves to several files.
-            filepath = max(files, key=os.path.getmtime)
+            filepath = files[0]
             with open(filepath, "rb") as f:
                 content = f.read()
             filename = os.path.basename(filepath)
@@ -2297,16 +2257,20 @@ class ScanViewSet(BaseRLSViewSet):
         content, filename = loader
         return self._serve_file(content, filename, "application/x-zip-compressed")
 
-    def _serve_compliance_artifact(self, scan, name, file_extension, content_type):
-        """Resolve and serve a per-framework compliance artifact from disk/S3.
+    @action(
+        detail=True,
+        methods=["get"],
+        url_path="compliance/(?P<name>[^/]+)",
+        url_name="compliance",
+    )
+    def compliance(self, request, pk=None, name=None):
+        scan = self.get_object()
+        if name not in get_compliance_frameworks(scan.provider.provider):
+            return Response(
+                {"detail": f"Compliance '{name}' not found."},
+                status=status.HTTP_404_NOT_FOUND,
+            )
 
-        Shared by the CSV and OCSF compliance download actions. Both are
-        path-based (no query params) on purpose: ``get_object`` runs
-        ``filter_queryset``, which triggers JSON:API's
-        ``QueryParameterValidationFilter`` and 400s on any non-JSON:API
-        query param, so a ``?format=`` / ``?type=`` selector is not viable
-        here — the format is encoded in the route instead.
-        """
         running_resp = self._get_task_status(scan)
         if running_resp:
             return running_resp
@@ -2323,66 +2287,25 @@ class ScanViewSet(BaseRLSViewSet):
             bucket = env.str("DJANGO_OUTPUT_S3_AWS_OUTPUT_BUCKET", "")
             key_prefix = scan.output_location.removeprefix(f"s3://{bucket}/")
             prefix = os.path.join(
-                os.path.dirname(key_prefix), "compliance", f"{name}.{file_extension}"
+                os.path.dirname(key_prefix), "compliance", f"{name}.csv"
             )
             loader = self._load_file(
                 prefix,
                 s3=True,
                 bucket=bucket,
                 list_objects=True,
-                content_type=content_type,
+                content_type="text/csv",
             )
         else:
             base = os.path.dirname(scan.output_location)
-            pattern = os.path.join(base, "compliance", f"*_{name}.{file_extension}")
+            pattern = os.path.join(base, "compliance", f"*_{name}.csv")
             loader = self._load_file(pattern, s3=False)
 
         if isinstance(loader, HttpResponseBase):
             return loader
 
         content, filename = loader
-        return self._serve_file(content, filename, content_type)
-
-    @action(
-        detail=True,
-        methods=["get"],
-        url_path="compliance/(?P<name>[^/]+)",
-        url_name="compliance",
-    )
-    def compliance(self, request, pk=None, name=None):
-        scan = self.get_object()
-        if name not in get_compliance_frameworks(scan.provider.provider):
-            return Response(
-                {"detail": f"Compliance '{name}' not found."},
-                status=status.HTTP_404_NOT_FOUND,
-            )
-        return self._serve_compliance_artifact(scan, name, "csv", "text/csv")
-
-    @action(
-        detail=True,
-        methods=["get"],
-        url_path="compliance/(?P<name>[^/]+)/ocsf",
-        url_name="compliance-ocsf",
-    )
-    def compliance_ocsf(self, request, pk=None, name=None):
-        scan = self.get_object()
-        if name not in get_compliance_frameworks(scan.provider.provider):
-            return Response(
-                {"detail": f"Compliance '{name}' not found."},
-                status=status.HTTP_404_NOT_FOUND,
-            )
-
-        universal_bulk = get_prowler_provider_compliance(scan.provider.provider)
-        framework_obj = universal_bulk.get(name)
-        if not (framework_obj and getattr(framework_obj, "outputs", None)):
-            return Response(
-                {"detail": f"Compliance '{name}' does not provide an OCSF export."},
-                status=status.HTTP_404_NOT_FOUND,
-            )
-
-        return self._serve_compliance_artifact(
-            scan, name, "ocsf.json", "application/json"
-        )
+        return self._serve_file(content, filename, "text/csv")
 
     @action(
         detail=True,
@@ -3826,16 +3749,6 @@ class FindingViewSet(PaginateByPkMixin, BaseRLSViewSet):
             return queryset
         return super().filter_queryset(queryset)
 
-    def _optimize_tags_loading(self, queryset):
-        """Prefetch resource tags to avoid N+1 queries when serializing findings"""
-        return queryset.prefetch_related(
-            Prefetch(
-                "resources__tags",
-                queryset=ResourceTag.objects.filter(tenant_id=self.request.tenant_id),
-                to_attr="prefetched_tags",
-            )
-        )
-
     def list(self, request, *args, **kwargs):
         filtered_queryset = self.filter_queryset(self.get_queryset())
         return self.paginate_by_pk(
@@ -4645,16 +4558,6 @@ class RoleProviderGroupRelationshipView(RelationshipView, BaseRLSViewSet):
                 location=OpenApiParameter.QUERY,
                 description="Compliance framework ID to get attributes for.",
             ),
-            OpenApiParameter(
-                name="filter[scan_id]",
-                required=False,
-                type=OpenApiTypes.UUID,
-                location=OpenApiParameter.QUERY,
-                description="Scan ID used to resolve the provider for "
-                "multi-provider universal frameworks (e.g. CSA CCM), so "
-                "the returned check IDs match the scan's provider. When omitted, "
-                "the first provider that declares the framework is used.",
-            ),
         ],
         responses={
             200: OpenApiResponse(
@@ -5073,13 +4976,6 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
     @action(detail=False, methods=["get"], url_name="attributes")
     def attributes(self, request):
-        # While the background warm-up is in progress, refuse immediately
-        # instead of falling through to the slow cold load on the request
-        # thread (which would trip the Gunicorn worker timeout). `is_set()` is
-        # a non-blocking flag read, so this never touches the loader.
-        if COMPLIANCE_WARMING_STARTED.is_set() and not COMPLIANCE_WARMED.is_set():
-            raise ComplianceWarmingError()
-
         compliance_id = request.query_params.get("filter[compliance_id]")
         if not compliance_id:
             raise ValidationError(
@@ -5095,51 +4991,7 @@ class ComplianceOverviewViewSet(BaseRLSViewSet, TaskManagementMixin):
 
         provider_type = None
 
-        # When a scan is provided, resolve the provider from it. Multi-provider
-        # universal frameworks (e.g. CSA CCM) share a single compliance_id
-        # across providers but expose different checks per provider, so the
-        # metadata (and therefore the check IDs the UI uses to fetch findings)
-        # must be returned for the scan's provider. Without this, the endpoint
-        # falls back to the first provider that declares the framework and
-        # returns its check IDs, leaving azure/gcp/... requirements with no
-        # matching findings.
-        scan_id = request.query_params.get("filter[scan_id]")
-        if "filter[scan_id]" in request.query_params:
-            # An explicit scan_id is authoritative: fail closed instead of
-            # falling back to another provider. Otherwise an invalid, empty
-            # (filter[scan_id]=) or inaccessible scan would silently return the
-            # first provider's check IDs, recreating the multi-provider mismatch
-            # this endpoint fixes.
-            if not scan_id:
-                raise NotFound(detail=f"Scan '{scan_id}' not found.")
-
-            # Tenant isolation is already enforced by Postgres RLS on the
-            # connection (see BaseRLSViewSet). Scope the lookup by provider
-            # group as well so a user with limited visibility can't resolve
-            # another provider's scan and read its compliance metadata, mirroring
-            # the RBAC scoping get_queryset() applies to the rest of the ViewSet.
-            role = get_role(request.user, request.tenant_id)
-            if getattr(role, Permissions.UNLIMITED_VISIBILITY.value, False):
-                scan_queryset = Scan.objects.filter(tenant_id=request.tenant_id)
-            else:
-                scan_queryset = Scan.objects.filter(provider__in=get_providers(role))
-
-            try:
-                scan = scan_queryset.select_related("provider").get(id=scan_id)
-            except (Scan.DoesNotExist, DjangoValidationError, ValueError):
-                raise NotFound(detail=f"Scan '{scan_id}' not found.")
-
-            provider_type = scan.provider.provider
-            if compliance_id not in get_compliance_frameworks(provider_type):
-                raise NotFound(
-                    detail=(
-                        f"Compliance framework '{compliance_id}' is not "
-                        f"available for scan '{scan_id}'."
-                    )
-                )
-
-        # Fall back to the first provider that declares the framework. Keeps the
-        # endpoint working for provider-agnostic callers that omit the scan.
+        # If we couldn't determine from database, try each provider type
         if not provider_type:
             for pt in Provider.ProviderChoices.values:
                 if compliance_id in get_compliance_frameworks(pt):

api/src/backend/config/celery.py

@@ -26,61 +26,6 @@ celery_app.conf.result_backend_transport_options = {
 }
 celery_app.conf.visibility_timeout = BROKER_VISIBILITY_TIMEOUT
 
-# Durable delivery: keep the message until the task finishes, so a worker killed
-# mid-task (deploy/OOM/eviction) does not silently drop it. Reserve one task at a
-# time so a crash exposes at most one extra reserved message.
-celery_app.conf.task_acks_late = True
-celery_app.conf.task_reject_on_worker_lost = True
-celery_app.conf.worker_prefetch_multiplier = env.int(
-    "DJANGO_CELERY_WORKER_PREFETCH_MULTIPLIER", default=1
-)
-# On SIGTERM, give the worker time to finish or re-queue in-flight tasks before
-# it is forcefully killed (Celery 5.5+ soft shutdown).
-celery_app.conf.worker_soft_shutdown_timeout = env.int(
-    "DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT", default=60
-)
-# Bound execution so a blocked task cannot pin a worker forever. Connection
-# checks get a tight limit; scans and provider/tenant deletions can legitimately
-# run for more than a day on large tenants, so they get a much higher cap.
-# The default for every other task is set as the global limit, not as a "*"
-# annotation: Celery applies the "*" entry AFTER the per-task one, so a "*" in
-# task_annotations would silently overwrite every specific limit defined below.
-_TASK_HARD_LIMIT = env.int("DJANGO_CELERY_TASK_TIME_LIMIT", default=6 * 60 * 60)
-_TASK_SOFT_LIMIT = env.int(
-    "DJANGO_CELERY_TASK_SOFT_TIME_LIMIT", default=_TASK_HARD_LIMIT - 600
-)
-_LONG_TASK_HARD_LIMIT = env.int(
-    "DJANGO_CELERY_LONG_TASK_TIME_LIMIT", default=48 * 60 * 60
-)
-_LONG_TASK_SOFT_LIMIT = env.int(
-    "DJANGO_CELERY_LONG_TASK_SOFT_TIME_LIMIT", default=_LONG_TASK_HARD_LIMIT - 600
-)
-celery_app.conf.task_time_limit = _TASK_HARD_LIMIT
-celery_app.conf.task_soft_time_limit = _TASK_SOFT_LIMIT
-celery_app.conf.task_annotations = {
-    **{
-        name: {"soft_time_limit": 60, "time_limit": 120}
-        for name in (
-            "provider-connection-check",
-            "integration-connection-check",
-            "lighthouse-connection-check",
-            "lighthouse-provider-connection-check",
-        )
-    },
-    **{
-        name: {
-            "soft_time_limit": _LONG_TASK_SOFT_LIMIT,
-            "time_limit": _LONG_TASK_HARD_LIMIT,
-        }
-        for name in (
-            "scan-perform",
-            "scan-perform-scheduled",
-            "provider-deletion",
-            "tenant-deletion",
-        )
-    },
-}
-
 celery_app.autodiscover_tasks(["api"])
 
 

api/src/backend/config/django/base.py

@@ -306,32 +306,3 @@ SESSION_COOKIE_SECURE = True
 ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES = env.int(
     "ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES", 2880
 )  # 48h
-
-# Orphan task recovery feature flags. The master switch is OFF by default, so task
-# recovery is opt-in; enable it with DJANGO_TASK_RECOVERY_ENABLED=true. The per-group
-# toggles default to enabled, so once the master is on every group recovers unless a
-# group is explicitly turned off.
-TASK_RECOVERY_ENABLED = env.bool("DJANGO_TASK_RECOVERY_ENABLED", False)
-TASK_RECOVERY_SUMMARIES_ENABLED = env.bool(
-    "DJANGO_TASK_RECOVERY_SUMMARIES_ENABLED", True
-)
-TASK_RECOVERY_DELETIONS_ENABLED = env.bool(
-    "DJANGO_TASK_RECOVERY_DELETIONS_ENABLED", True
-)
-
-
-def label_postgres_connections(databases):
-    """Tag each Postgres connection with ``application_name="<component>:<alias>"``
-    so connections are attributable by component in ``pg_stat_activity`` (and any
-    tooling that surfaces ``application_name``). The component (api / worker /
-    scan / ...) is injected per process by the container entrypoint via
-    ``DJANGO_APP_COMPONENT``; the alias distinguishes which pool inside the
-    process owns the connection. The neo4j entry is skipped (not a Postgres
-    backend). Postgres truncates ``application_name`` at 63 bytes.
-    """
-    component = env.str("DJANGO_APP_COMPONENT", default="api")
-    for alias, config in databases.items():
-        engine = config.get("ENGINE", "")
-        if engine.startswith("psqlextra") or "postgresql" in engine:
-            name = f"{component}:{alias}"[:63]
-            config.setdefault("OPTIONS", {})["application_name"] = name

api/src/backend/config/django/devel.py

@@ -54,8 +54,6 @@ DATABASES = {
 
 DATABASES["default"] = DATABASES["prowler_user"]
 
-label_postgres_connections(DATABASES)  # noqa: F405
-
 REST_FRAMEWORK["DEFAULT_RENDERER_CLASSES"] = tuple(  # noqa: F405
     render_class
     for render_class in REST_FRAMEWORK["DEFAULT_RENDERER_CLASSES"]  # noqa: F405

api/src/backend/config/django/production.py

@@ -58,5 +58,3 @@ DATABASES = {
 }
 
 DATABASES["default"] = DATABASES["prowler_user"]
-
-label_postgres_connections(DATABASES)  # noqa: F405

api/src/backend/config/django/testing.py

@@ -34,8 +34,3 @@ DRF_API_KEY = {
 # JWT
 
 SIMPLE_JWT["ALGORITHM"] = "HS256"  # noqa: F405
-# pyjwt >= 2.13.0 rejects an empty HMAC signing key, so HS256 tests need a real
-# key (>= 32 bytes also avoids the InsecureKeyLengthWarning). Production uses RS256.
-SIMPLE_JWT["SIGNING_KEY"] = env.str(  # noqa: F405
-    "DJANGO_TOKEN_SIGNING_KEY", "insecure-testing-jwt-signing-key-do-not-use-in-prod"
-)

api/src/backend/config/guniconf.py

@@ -1,7 +1,6 @@
 import logging
 import multiprocessing
 import os
-import threading
 
 from config.env import env
 
@@ -12,7 +11,6 @@ os.environ.setdefault("DJANGO_SETTINGS_MODULE", "config.django.production")
 import django  # noqa: E402
 
 django.setup()
-from api.compliance import warm_compliance_caches  # noqa: E402
 from config.django.production import LOGGING as DJANGO_LOGGERS, DEBUG  # noqa: E402
 from config.custom_logging import BackendLogger  # noqa: E402
 
@@ -43,26 +41,3 @@ def on_reload(_):
 
 def when_ready(_):
     gunicorn_logger.info("Gunicorn server is ready")
-
-
-def _warm_compliance_caches_in_background():
-    """Warm compliance caches off the request path and log the outcome."""
-    failed = warm_compliance_caches()
-    if failed:
-        gunicorn_logger.warning("Compliance caches warmed (skipped: %s)", failed)
-    else:
-        gunicorn_logger.info("Compliance caches warmed")
-
-
-def post_fork(_server, worker):
-    """Warm compliance caches after each worker fork.
-
-    Warm compliance caches in a background thread so the worker becomes ready
-    immediately. A request for a not-yet-warmed provider lazily loads just that
-    provider, which stays well under the worker timeout.
-    """
-    threading.Thread(
-        target=_warm_compliance_caches_in_background,
-        name="warm-compliance-caches",
-        daemon=True,
-    ).start()

api/src/backend/tasks/jobs/attack_paths/cleanup.py

@@ -1,14 +1,12 @@
 from datetime import datetime, timedelta, timezone
 
-from celery import states
+from celery import current_app, states
 from celery.utils.log import get_task_logger
 from config.django.base import ATTACK_PATHS_SCAN_STALE_THRESHOLD_MINUTES
 from tasks.jobs.attack_paths.db_utils import (
     _mark_scan_finished,
     recover_graph_data_ready,
 )
-from tasks.jobs.orphan_recovery import is_worker_alive as _is_worker_alive
-from tasks.jobs.orphan_recovery import revoke_task as _revoke_task
 
 from api.attack_paths import database as graph_database
 from api.db_router import MainRouter
@@ -152,6 +150,32 @@ def _cleanup_stale_scheduled_scans(cutoff: datetime) -> list[str]:
     return cleaned_up
 
 
+def _is_worker_alive(worker: str) -> bool:
+    """Ping a specific Celery worker. Returns `True` if it responds or on error."""
+    try:
+        response = current_app.control.inspect(destination=[worker], timeout=1.0).ping()
+        return response is not None and worker in response
+    except Exception:
+        logger.exception(f"Failed to ping worker {worker}, treating as alive")
+        return True
+
+
+def _revoke_task(task_result, terminate: bool = True) -> None:
+    """Revoke a Celery task. Non-fatal on failure.
+
+    `terminate=True` SIGTERMs the worker if the task is mid-execution; use
+    for EXECUTING cleanup. `terminate=False` only marks the task id revoked
+    across workers, so any worker pulling the queued message discards it;
+    use for SCHEDULED cleanup where the task hasn't run yet.
+    """
+    try:
+        kwargs = {"terminate": True, "signal": "SIGTERM"} if terminate else {}
+        current_app.control.revoke(task_result.task_id, **kwargs)
+        logger.info(f"Revoked task {task_result.task_id}")
+    except Exception:
+        logger.exception(f"Failed to revoke task {task_result.task_id}")
+
+
 def _cleanup_scan(scan, task_result, reason: str) -> bool:
     """
     Clean up a single stale `AttackPathsScan`:

api/src/backend/tasks/jobs/export.py

@@ -39,6 +39,11 @@ from prowler.lib.outputs.compliance.cis.cis_oraclecloud import OracleCloudCIS
 from prowler.lib.outputs.compliance.cisa_scuba.cisa_scuba_googleworkspace import (
     GoogleWorkspaceCISASCuBA,
 )
+from prowler.lib.outputs.compliance.csa.csa_alibabacloud import AlibabaCloudCSA
+from prowler.lib.outputs.compliance.csa.csa_aws import AWSCSA
+from prowler.lib.outputs.compliance.csa.csa_azure import AzureCSA
+from prowler.lib.outputs.compliance.csa.csa_gcp import GCPCSA
+from prowler.lib.outputs.compliance.csa.csa_oraclecloud import OracleCloudCSA
 from prowler.lib.outputs.compliance.ens.ens_aws import AWSENS
 from prowler.lib.outputs.compliance.ens.ens_azure import AzureENS
 from prowler.lib.outputs.compliance.ens.ens_gcp import GCPENS
@@ -58,9 +63,6 @@ from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_azure import (
     AzureMitreAttack,
 )
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_gcp import GCPMitreAttack
-from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta import (
-    OktaIDaaSSTIG,
-)
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_alibaba import (
     ProwlerThreatScoreAlibaba,
 )
@@ -100,6 +102,7 @@ COMPLIANCE_CLASS_MAP = {
         (lambda name: name == "prowler_threatscore_aws", ProwlerThreatScoreAWS),
         (lambda name: name.startswith("ccc_"), CCC_AWS),
         (lambda name: name.startswith("c5_"), AWSC5),
+        (lambda name: name.startswith("csa_"), AWSCSA),
         (lambda name: name == "asd_essential_eight_aws", ASDEssentialEightAWS),
     ],
     "azure": [
@@ -110,6 +113,7 @@ COMPLIANCE_CLASS_MAP = {
         (lambda name: name.startswith("ccc_"), CCC_Azure),
         (lambda name: name == "prowler_threatscore_azure", ProwlerThreatScoreAzure),
         (lambda name: name == "c5_azure", AzureC5),
+        (lambda name: name.startswith("csa_"), AzureCSA),
     ],
     "gcp": [
         (lambda name: name.startswith("cis_"), GCPCIS),
@@ -119,6 +123,7 @@ COMPLIANCE_CLASS_MAP = {
         (lambda name: name == "prowler_threatscore_gcp", ProwlerThreatScoreGCP),
         (lambda name: name.startswith("ccc_"), CCC_GCP),
         (lambda name: name == "c5_gcp", GCPC5),
+        (lambda name: name.startswith("csa_"), GCPCSA),
     ],
     "kubernetes": [
         (lambda name: name.startswith("cis_"), KubernetesCIS),
@@ -147,17 +152,16 @@ COMPLIANCE_CLASS_MAP = {
     "image": [],
     "oraclecloud": [
         (lambda name: name.startswith("cis_"), OracleCloudCIS),
+        (lambda name: name.startswith("csa_"), OracleCloudCSA),
     ],
     "alibabacloud": [
         (lambda name: name.startswith("cis_"), AlibabaCloudCIS),
+        (lambda name: name.startswith("csa_"), AlibabaCloudCSA),
         (
             lambda name: name == "prowler_threatscore_alibabacloud",
             ProwlerThreatScoreAlibaba,
         ),
     ],
-    "okta": [
-        (lambda name: name.startswith("okta_idaas_stig"), OktaIDaaSSTIG),
-    ],
 }
 
 

api/src/backend/tasks/jobs/orphan_recovery.py

@@ -1,341 +0,0 @@
-"""Detect and recover orphaned Celery tasks.
-
-A task is "orphaned" when its result row is non-terminal (STARTED/RECEIVED) but the
-worker that was running it is gone (deploy, OOM, eviction). We tell a real orphan
-from a still-running task by pinging the worker recorded on its `TaskResult`:
-
-- worker responds  -> the task is in flight, leave it alone (never double-run);
-- worker is gone   -> real orphan: mark the stale result terminal (so pending/started
-  alerts clear), then re-enqueue the task from its stored name + kwargs.
-
-This recovers only allowlisted tasks with local, proven idempotency. Celery's
-`result_extended=True` gives us the stored `task_name`/`task_kwargs`/`worker` once
-the task starts, but external side-effect tasks are failed instead of blindly
-re-run. A small recovery cap stops a task that repeatedly kills its worker from
-looping forever.
-
-This is the shared engine behind both the periodic Beat watchdog and the
-`reconcile_orphan_tasks` management command.
-"""
-
-import ast
-import json
-from contextlib import contextmanager
-from datetime import datetime, timedelta, timezone
-from uuid import uuid4
-
-from celery import current_app, states
-from celery.utils.log import get_task_logger
-from django.db import connections
-
-logger = get_task_logger(__name__)
-
-# Arbitrary constant key for pg_try_advisory_lock so only one reconciliation
-# runs at a time across replicas / the watchdog / the command.
-ORPHAN_RECOVERY_LOCK_KEY = 0x70726F77  # "prow"
-
-# Non-terminal states that mean "a worker had this and may have died with it".
-IN_FLIGHT_STATES = (states.STARTED, states.RECEIVED)
-
-# Tasks with proven idempotency are eligible for auto re-enqueue, grouped so each
-# group can be toggled independently by a feature flag (see config.django.base).
-# Summaries clear and rewrite their own rows and deletions are idempotent. Tasks with
-# external side effects are never eligible: integration-jira would create duplicate
-# issues, integration-s3 rebuilds its upload from worker-local files that do not
-# survive a crash, and report/Security Hub recovery is out of scope.
-RECOVERY_TASK_GROUPS = {
-    "summaries": {
-        "scan-summary",
-        "scan-compliance-overviews",
-        "scan-provider-compliance-scores",
-        "scan-daily-severity",
-        "scan-finding-group-summaries",
-        "scan-reset-ephemeral-resources",
-    },
-    "deletions": {"provider-deletion", "tenant-deletion"},
-}
-
-
-def reenqueueable_tasks() -> set[str]:
-    """Task names eligible for auto re-enqueue, honoring the per-group feature flags.
-
-    A group whose flag is disabled is dropped, so its orphaned tasks are marked
-    terminal instead of re-enqueued.
-    """
-    from django.conf import settings
-
-    group_enabled = {
-        "summaries": settings.TASK_RECOVERY_SUMMARIES_ENABLED,
-        "deletions": settings.TASK_RECOVERY_DELETIONS_ENABLED,
-    }
-    return {
-        task
-        for group, tasks in RECOVERY_TASK_GROUPS.items()
-        if group_enabled[group]
-        for task in tasks
-    }
-
-
-# Tasks the watchdog ignores entirely (not even marked terminal): scan tasks are not
-# auto-recovered, since re-running a scan is not safe to do automatically; attack-paths
-# scans are handled by their own stale-cleanup (which also drops the temp Neo4j db);
-# and the maintenance tasks must not self-recover (they run again on their own schedule).
-_SKIP_RECOVERY = {
-    "scan-perform",
-    "scan-perform-scheduled",
-    "attack-paths-scan-perform",
-    "attack-paths-cleanup-stale-scans",
-    "reconcile-orphan-tasks",
-}
-
-
-@contextmanager
-def advisory_lock(key: int = ORPHAN_RECOVERY_LOCK_KEY, using: str = "default"):
-    """Yield True if this session won a Postgres advisory lock, else False.
-
-    Non-blocking: losers get False and should no-op. The lock is released on
-    exit (and implicitly if the session dies).
-    """
-    with connections[using].cursor() as cursor:
-        cursor.execute("SELECT pg_try_advisory_lock(%s)", [key])
-        acquired = bool(cursor.fetchone()[0])
-        try:
-            yield acquired
-        finally:
-            if acquired:
-                cursor.execute("SELECT pg_advisory_unlock(%s)", [key])
-
-
-def is_worker_alive(worker: str, timeout: float = 1.0) -> bool:
-    """Ping a specific Celery worker. Returns True if it responds, or on error.
-
-    Erring on the side of "alive" means an unreachable control bus never causes
-    a still-running task to be re-enqueued.
-    """
-    try:
-        response = current_app.control.inspect(
-            destination=[worker], timeout=timeout
-        ).ping()
-        return response is not None and worker in response
-    except Exception:
-        logger.exception(f"Failed to ping worker {worker}, treating as alive")
-        return True
-
-
-def revoke_task(task_result, terminate: bool = True) -> None:
-    """Revoke a Celery task by its TaskResult. Non-fatal on failure.
-
-    terminate=True SIGTERMs the worker if the task is mid-execution; terminate=False
-    only marks the id revoked so any worker pulling the queued message discards it
-    (use before re-enqueuing, so a later broker redelivery of the stale message is
-    dropped).
-    """
-    try:
-        kwargs = {"terminate": True, "signal": "SIGTERM"} if terminate else {}
-        current_app.control.revoke(task_result.task_id, **kwargs)
-        logger.info(f"Revoked task {task_result.task_id}")
-    except Exception:
-        logger.exception(f"Failed to revoke task {task_result.task_id}")
-
-
-def _decode_celery_field(value, default):
-    """Decode django-celery-results' stored task_args/task_kwargs to a Python object.
-
-    The backend stores them as a (sometimes double-encoded) repr/JSON string. An
-    empty or missing field returns ``default``; a non-empty value that cannot be
-    decoded raises ``ValueError`` so the caller can avoid re-enqueuing a task with
-    the wrong arguments.
-    """
-    obj = value
-    for _ in range(2):  # values can be double-encoded (a string holding a repr)
-        if not isinstance(obj, str):
-            break
-        text = obj.strip()
-        if not text:
-            return default
-        parsed = None
-        for parser in (ast.literal_eval, json.loads):
-            try:
-                parsed = parser(text)
-                break
-            except (ValueError, SyntaxError, TypeError):
-                continue
-        if parsed is None:
-            raise ValueError(f"undecodable celery field: {text[:120]!r}")
-        obj = parsed
-    return default if obj is None else obj
-
-
-def reconcile_orphans(
-    grace_minutes: int = 2,
-    max_attempts: int = 3,
-    window_hours: int = 6,
-    dry_run: bool = False,
-) -> dict:
-    """Run the full orphan sweep under a single-flight advisory lock.
-
-    Recovers any orphaned in-flight task and delegates attack-paths scans that
-    never reached a worker to their existing stale-cleanup. Returns a summary;
-    a no-op (lock not won) is reported too.
-    """
-    with advisory_lock() as acquired:
-        if not acquired:
-            logger.info("Orphan reconcile skipped: another run holds the lock")
-            return {"acquired": False}
-
-        from django.conf import settings
-
-        if settings.TASK_RECOVERY_ENABLED:
-            # Populate the task registry so we can re-enqueue any task by name.
-            import tasks.tasks  # noqa: F401
-
-            result = _reconcile_task_results(
-                grace_minutes=grace_minutes,
-                max_attempts=max_attempts,
-                window_hours=window_hours,
-                dry_run=dry_run,
-            )
-            result["enabled"] = True
-        else:
-            logger.info("Orphan task recovery disabled by feature flag")
-            result = {"recovered": [], "failed": [], "skipped": [], "enabled": False}
-
-        if not dry_run:
-            from tasks.jobs.attack_paths.cleanup import cleanup_stale_attack_paths_scans
-
-            result["attack_paths"] = cleanup_stale_attack_paths_scans()
-
-        return {"acquired": True, **result}
-
-
-def _reconcile_task_results(
-    grace_minutes: int, max_attempts: int, window_hours: int, dry_run: bool
-) -> dict:
-    from django_celery_results.models import TaskResult
-
-    cutoff = datetime.now(tz=timezone.utc) - timedelta(minutes=grace_minutes)
-    candidates = list(
-        TaskResult.objects.filter(status__in=IN_FLIGHT_STATES, date_created__lt=cutoff)
-        .exclude(worker__isnull=True)
-        .exclude(worker="")
-        .exclude(task_name__in=_SKIP_RECOVERY)
-    )
-
-    # Ping each distinct worker at most once.
-    worker_alive = {w: is_worker_alive(w) for w in {tr.worker for tr in candidates}}
-
-    recovered, failed, skipped = [], [], []
-    for task_result in candidates:
-        if worker_alive.get(task_result.worker, True):
-            skipped.append(task_result.task_id)  # in flight, do not double-run
-            continue
-        if dry_run:
-            recovered.append(task_result.task_id)
-            continue
-        outcome = _recover_task(task_result, max_attempts, window_hours)
-        (recovered if outcome == "recovered" else failed).append(task_result.task_id)
-
-    logger.info(
-        "Orphan reconcile: recovered=%d failed=%d skipped(in-flight)=%d",
-        len(recovered),
-        len(failed),
-        len(skipped),
-    )
-    return {"recovered": recovered, "failed": failed, "skipped": skipped}
-
-
-def _recovery_attempt_count(name: str, kwargs_repr, window_hours: int) -> int:
-    """Increment and return the recovery count for this (task, kwargs) within the
-    window. Backed by Valkey so it survives result-row churn (a worker processing
-    the revoke can blank the TaskResult fields). Fail-open if Valkey is down (the
-    broker being unreachable means nothing is running anyway).
-    """
-    import hashlib
-
-    from django.conf import settings
-
-    try:
-        import redis
-
-        client = redis.from_url(settings.CELERY_BROKER_URL)
-        signature = f"{name}|{kwargs_repr}".encode()
-        key = (
-            "orphan-recovery:"
-            + hashlib.sha1(signature, usedforsecurity=False).hexdigest()
-        )
-        count = client.incr(key)
-        if count == 1:
-            client.expire(key, max(1, window_hours) * 3600)
-        return int(count)
-    except Exception:
-        logger.exception("Recovery-attempt counter unavailable; allowing recovery")
-        return 1
-
-
-def _recover_task(task_result, max_attempts: int, window_hours: int) -> str:
-    """Recover one orphaned task. Returns 'recovered' or 'failed'."""
-    # Capture name/args/kwargs now: revoking can let a worker blank the row.
-    name = task_result.task_name
-    args_repr = task_result.task_args
-    kwargs_repr = task_result.task_kwargs
-    now = datetime.now(tz=timezone.utc)
-
-    # Drop any future broker redelivery of the stale message.
-    revoke_task(task_result, terminate=False)
-
-    # Mark the stale result terminal so "pending/started forever" alerts clear.
-    task_result.status = states.REVOKED
-    task_result.date_done = now
-    task_result.save(update_fields=["status", "date_done"])
-
-    if name not in reenqueueable_tasks():
-        logger.warning(
-            "Orphan %s (%s) not re-enqueued: not allowlisted for auto recovery",
-            task_result.task_id,
-            name,
-        )
-        return "failed"
-
-    # Count the attempt only once the task is allowlisted, so a task sitting in a
-    # disabled group does not burn its recovery budget while the flag is off (and is
-    # not already over the cap the moment the group is re-enabled).
-    attempt = _recovery_attempt_count(name, kwargs_repr, window_hours)
-    if attempt > max_attempts:
-        logger.warning(
-            "Orphan %s (%s) not re-enqueued: recovery cap reached (%d/%d)",
-            task_result.task_id,
-            name,
-            attempt,
-            max_attempts,
-        )
-        return "failed"
-
-    task_obj = current_app.tasks.get(name)
-    if task_obj is None:
-        logger.error(
-            "Orphan %s: task %s not registered, cannot re-enqueue",
-            task_result.task_id,
-            name,
-        )
-        return "failed"
-
-    try:
-        args = _decode_celery_field(args_repr, [])
-        kwargs = _decode_celery_field(kwargs_repr, {})
-    except ValueError:
-        logger.error(
-            "Orphan %s (%s): could not decode stored args/kwargs, not re-enqueuing",
-            task_result.task_id,
-            name,
-        )
-        return "failed"
-    new_task_id = str(uuid4())
-    task_obj.apply_async(
-        args=list(args) if isinstance(args, (list, tuple)) else [],
-        kwargs=kwargs if isinstance(kwargs, dict) else {},
-        task_id=new_task_id,
-    )
-    logger.info(
-        "Re-enqueued orphan %s (%s) as %s", task_result.task_id, name, new_task_id
-    )
-    return "recovered"

api/src/backend/tasks/jobs/report.py

@@ -29,10 +29,7 @@ from api.db_router import READ_REPLICA_ALIAS, MainRouter
 from api.db_utils import rls_transaction
 from api.models import Provider, Scan, ScanSummary, StateChoices, ThreatScoreSnapshot
 from api.utils import initialize_prowler_provider
-from prowler.lib.check.compliance_models import (
-    Compliance,
-    get_bulk_compliance_frameworks_universal,
-)
+from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.finding import Finding as FindingOutput
 
 logger = get_task_logger(__name__)
@@ -574,7 +571,7 @@ def generate_csa_report(
     Args:
         tenant_id: The tenant ID for Row-Level Security context.
         scan_id: ID of the scan executed by Prowler.
-        compliance_id: ID of the compliance framework (e.g., "csa_ccm_4.0").
+        compliance_id: ID of the compliance framework (e.g., "csa_ccm_4.0_aws").
         output_path: Output PDF file path.
         provider_id: Provider ID for the scan.
         only_failed: If True, only include failed requirements in detailed section.
@@ -886,11 +883,9 @@ def generate_compliance_reports(
             frameworks_bulk.get(f"nis2_{provider_type}")
         )
     if generate_csa:
-        # csa_ccm_4.0 lives at the top level, not under compliance/{provider}/.
-        csa_framework = frameworks_bulk.get(
-            "csa_ccm_4.0"
-        ) or get_bulk_compliance_frameworks_universal(provider_type).get("csa_ccm_4.0")
-        pending_checks_by_framework["csa"] = _get_compliance_check_ids(csa_framework)
+        pending_checks_by_framework["csa"] = _get_compliance_check_ids(
+            frameworks_bulk.get(f"csa_ccm_4.0_{provider_type}")
+        )
     if generate_cis and latest_cis:
         pending_checks_by_framework["cis"] = _get_compliance_check_ids(
             frameworks_bulk.get(latest_cis)
@@ -1188,7 +1183,7 @@ def generate_compliance_reports(
     if generate_csa:
         generated_report_keys.append("csa")
         csa_path = output_paths["csa"]
-        compliance_id_csa = "csa_ccm_4.0"
+        compliance_id_csa = f"csa_ccm_4.0_{provider_type}"
         pdf_path_csa = f"{csa_path}_csa_report.pdf"
         logger.info("Generating CSA CCM report with compliance %s", compliance_id_csa)
 

api/src/backend/tasks/jobs/reports/base.py

@@ -5,7 +5,6 @@ import time
 from abc import ABC, abstractmethod
 from contextlib import contextmanager
 from dataclasses import dataclass, field
-from types import SimpleNamespace
 from typing import Any
 
 from celery.utils.log import get_task_logger
@@ -27,10 +26,7 @@ from api.db_router import READ_REPLICA_ALIAS
 from api.db_utils import rls_transaction
 from api.models import Provider, StatusChoices
 from api.utils import initialize_prowler_provider
-from prowler.lib.check.compliance_models import (
-    Compliance,
-    get_bulk_compliance_frameworks_universal,
-)
+from prowler.lib.check.compliance_models import Compliance
 from prowler.lib.outputs.finding import Finding as FindingOutput
 
 from .components import (
@@ -226,46 +222,6 @@ def get_requirement_metadata(
     return None
 
 
-def _universal_attributes_to_list(attributes) -> list:
-    """Flatten a universal requirement's ``attributes`` into a list of objects
-    with attribute access. MITRE wraps its list under ``_raw_attributes``."""
-    if isinstance(attributes, dict) and "_raw_attributes" in attributes:
-        entries = attributes.get("_raw_attributes") or []
-        return [
-            SimpleNamespace(**entry) for entry in entries if isinstance(entry, dict)
-        ]
-    if isinstance(attributes, dict):
-        return [SimpleNamespace(**attributes)] if attributes else []
-    return list(attributes or [])
-
-
-def _adapt_universal_to_legacy(framework, provider_type: str) -> SimpleNamespace:
-    """Expose a universal ``ComplianceFramework`` under the legacy ``Compliance``
-    attribute names used by the PDF pipeline."""
-    provider_key = (provider_type or "").lower()
-    requirements = []
-    for requirement in framework.requirements:
-        checks_by_provider = (
-            requirement.checks if isinstance(requirement.checks, dict) else {}
-        )
-        requirements.append(
-            SimpleNamespace(
-                Id=requirement.id,
-                Description=requirement.description or "",
-                Checks=list(checks_by_provider.get(provider_key, [])),
-                Attributes=_universal_attributes_to_list(requirement.attributes),
-            )
-        )
-    return SimpleNamespace(
-        Framework=framework.framework,
-        Name=framework.name,
-        Version=framework.version or "",
-        Description=framework.description or "",
-        Provider=framework.provider or provider_type,
-        Requirements=requirements,
-    )
-
-
 # =============================================================================
 # PDF Styles Cache
 # =============================================================================
@@ -913,18 +869,9 @@ class BaseComplianceReportGenerator(ABC):
                 prowler_provider = initialize_prowler_provider(provider_obj)
             provider_type = provider_obj.provider
 
-            # Load compliance framework — fall back to the universal loader
-            # for top-level JSONs (e.g. csa_ccm_4.0) that Compliance.get_bulk
-            # does not scan.
-            compliance_obj = Compliance.get_bulk(provider_type).get(compliance_id)
-            if not compliance_obj:
-                universal_framework = get_bulk_compliance_frameworks_universal(
-                    provider_type
-                ).get(compliance_id)
-                if universal_framework:
-                    compliance_obj = _adapt_universal_to_legacy(
-                        universal_framework, provider_type
-                    )
+            # Load compliance framework
+            frameworks_bulk = Compliance.get_bulk(provider_type)
+            compliance_obj = frameworks_bulk.get(compliance_id)
 
             if not compliance_obj:
                 raise ValueError(f"Compliance framework not found: {compliance_id}")

api/src/backend/tasks/jobs/scan.py

@@ -269,7 +269,6 @@ def _store_resources(
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
-                "name": finding.resource_name,
                 "region": finding.region,
                 "service": finding.service_name,
                 "type": finding.resource_type,
@@ -277,7 +276,6 @@ def _store_resources(
         )
 
         if not created:
-            resource_instance.name = finding.resource_name
             resource_instance.region = finding.region
             resource_instance.service = finding.service_name
             resource_instance.type = finding.resource_type
@@ -478,12 +476,9 @@ def _create_compliance_summaries(
             )
         )
 
-    # Idempotent re-run: clear this scan's prior summaries before re-inserting, so a
-    # recovered scan-compliance-overviews run reflects its own re-derived rows instead
-    # of keeping a stale one (bulk_create ignore_conflicts alone would keep the old).
-    with rls_transaction(tenant_id):
-        ComplianceOverviewSummary.objects.filter(scan_id=scan_id).delete()
-        if summary_objects:
+    # Bulk insert summaries
+    if summary_objects:
+        with rls_transaction(tenant_id):
             ComplianceOverviewSummary.objects.bulk_create(
                 summary_objects, batch_size=500, ignore_conflicts=True
             )
@@ -706,12 +701,6 @@ def _process_finding_micro_batch(
                     if finding.region and resource_instance.region != finding.region:
                         resource_instance.region = finding.region
                         updated = True
-                    if (
-                        finding.resource_name
-                        and resource_instance.name != finding.resource_name
-                    ):
-                        resource_instance.name = finding.resource_name
-                        updated = True
                     if resource_instance.service != finding.service_name:
                         resource_instance.service = finding.service_name
                         updated = True
@@ -953,7 +942,6 @@ def _process_finding_micro_batch(
                         Resource.objects.bulk_update(
                             resources_to_bulk_update,
                             [
-                                "name",
                                 "metadata",
                                 "details",
                                 "partition",
@@ -1663,10 +1651,6 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                         elif requirement_status == "PASS":
                             requirement_statuses[key]["pass_count"] += 1
 
-            # Idempotent re-run: COPY can't ON CONFLICT, so clear this scan's rows first.
-            with rls_transaction(tenant_id):
-                ComplianceRequirementOverview.objects.filter(scan_id=scan_id).delete()
-
             # Bulk create requirement records using PostgreSQL COPY
             _persist_compliance_requirement_rows(tenant_id, compliance_requirement_rows)
 

api/src/backend/tasks/jobs/threatscore_utils.py

@@ -359,40 +359,35 @@ def _load_findings_for_requirement_checks(
 def _get_compliance_check_ids(compliance_obj) -> set[str]:
     """Return the union of all check_ids referenced by a compliance framework.
 
-    Used by the master report orchestrator to evict entries from
-    ``findings_cache`` once no pending framework needs them (PROWLER-1733).
+    Used by the master report orchestrator to know which checks each
+    framework consumes from the shared ``findings_cache``, so that once a
+    framework finishes the entries no other pending framework needs can be
+    evicted from the cache (PROWLER-1733).
 
-    Accepts the legacy ``Compliance`` shape (``Requirements`` / ``Checks``
-    lists) and the universal ``ComplianceFramework`` shape (``requirements``
-    / ``checks`` dict keyed by provider). ``None`` returns an empty set so
-    callers can pass ``frameworks_bulk.get(...)`` directly.
+    Args:
+        compliance_obj: A loaded Compliance framework object exposing a
+            ``Requirements`` iterable, each requirement carrying ``Checks``.
+            ``None`` is treated as "no checks" rather than raising, so the
+            caller can pass ``frameworks_bulk.get(...)`` directly without
+            an extra existence check.
+
+    Returns:
+        Set of check_id strings (empty if ``compliance_obj`` is ``None``).
     """
     if compliance_obj is None:
         return set()
-
-    requirements = getattr(compliance_obj, "Requirements", None) or getattr(
-        compliance_obj, "requirements", None
-    )
-    if not requirements:
-        return set()
-
-    check_ids: set[str] = set()
+    checks: set[str] = set()
+    requirements = getattr(compliance_obj, "Requirements", None) or []
     try:
-        # Mock objects in unit tests return another Mock for any attribute
-        # access — truthy but not iterable. Treat that as "no checks".
-        for requirement in requirements:
-            requirement_checks = getattr(requirement, "Checks", None)
-            if requirement_checks is None:
-                checks_by_provider = getattr(requirement, "checks", None) or {}
-                requirement_checks = [
-                    check_id
-                    for check_ids_list in checks_by_provider.values()
-                    for check_id in check_ids_list
-                ]
+        # Defensive: Mock objects (used in unit tests) return another Mock
+        # for any attribute access, which is truthy but not iterable. Treat
+        # any non-iterable Requirements value as "no checks".
+        for req in requirements:
+            req_checks = getattr(req, "Checks", None) or []
             try:
-                check_ids.update(requirement_checks)
+                checks.update(req_checks)
             except TypeError:
                 continue
     except TypeError:
         return set()
-    return check_ids
+    return checks

api/src/backend/tasks/tasks.py

@@ -46,7 +46,6 @@ from tasks.jobs.lighthouse_providers import (
     refresh_lighthouse_provider_models,
 )
 from tasks.jobs.muting import mute_historical_findings
-from tasks.jobs.orphan_recovery import reconcile_orphans
 from tasks.jobs.report import (
     STALE_TMP_OUTPUT_MAX_AGE_HOURS,
     _cleanup_stale_tmp_output_directories,
@@ -68,10 +67,7 @@ from tasks.utils import (
     get_next_execution_datetime,
 )
 
-from api.compliance import (
-    get_compliance_frameworks,
-    get_prowler_provider_compliance,
-)
+from api.compliance import get_compliance_frameworks
 from api.db_router import READ_REPLICA_ALIAS
 from api.db_utils import delete_related_daily_task, rls_transaction
 from api.decorators import handle_provider_deletion, set_tenant
@@ -79,9 +75,6 @@ from api.models import Finding, Integration, Provider, Scan, ScanSummary, StateC
 from api.utils import initialize_prowler_provider
 from api.v1.serializers import ScanTaskSerializer
 from prowler.lib.check.compliance_models import Compliance
-from prowler.lib.outputs.compliance.compliance import (
-    process_universal_compliance_frameworks,
-)
 from prowler.lib.outputs.compliance.generic.generic import GenericCompliance
 from prowler.lib.outputs.finding import Finding as FindingOutput
 
@@ -260,9 +253,7 @@ def delete_provider_task(provider_id: str, tenant_id: str):
     return delete_provider(tenant_id=tenant_id, pk=provider_id)
 
 
-# acks_late=False: a re-run would duplicate findings and the task is not auto-recovered,
-# so a crashed scan is dropped rather than redelivered by the broker (as before #11416).
-@shared_task(base=RLSTask, name="scan-perform", queue="scans", acks_late=False)
+@shared_task(base=RLSTask, name="scan-perform", queue="scans")
 @handle_provider_deletion
 def perform_scan_task(
     tenant_id: str, scan_id: str, provider_id: str, checks_to_execute: list[str] = None
@@ -306,14 +297,7 @@ def perform_scan_task(
     return result
 
 
-# acks_late=False: like scan-perform; a dropped run is re-fired by Beat on the next tick.
-@shared_task(
-    base=RLSTask,
-    bind=True,
-    name="scan-perform-scheduled",
-    queue="scans",
-    acks_late=False,
-)
+@shared_task(base=RLSTask, bind=True, name="scan-perform-scheduled", queue="scans")
 @handle_provider_deletion
 def perform_scheduled_scan_task(self, tenant_id: str, provider_id: str):
     """
@@ -478,42 +462,13 @@ def cleanup_stale_attack_paths_scans_task():
     return cleanup_stale_attack_paths_scans()
 
 
-@shared_task(name="reconcile-orphan-tasks", queue="celery")
-def reconcile_orphan_tasks_task():
-    """Periodic watchdog: recover tasks whose worker is gone (deploys, crashes)."""
-    return reconcile_orphans()
-
-
 @shared_task(name="tenant-deletion", queue="deletion", autoretry_for=(Exception,))
 def delete_tenant_task(tenant_id: str):
     return delete_tenant(pk=tenant_id)
 
 
-def _scan_tmp_output_directory(tenant_id: str, scan_id: str) -> Path:
-    """Root tmp output directory for a scan ({tmp}/{tenant_id}/{scan_id})."""
-    return Path(DJANGO_TMP_OUTPUT_DIRECTORY) / str(tenant_id) / str(scan_id)
-
-
-class ScanReportRLSTask(RLSTask):
-    """
-    RLS task that removes the scan's tmp output directory when the task fails.
-
-    Covers failures both inside and outside the task body (e.g. ENOSPC mid-write,
-    or setup errors) so partial artifacts do not accumulate on the worker disk.
-    """
-
-    def on_failure(self, exc, task_id, args, kwargs, _einfo):  # noqa: ARG002
-        del args  # Required by Celery's Task.on_failure signature; not used.
-        tenant_id = kwargs.get("tenant_id")
-        scan_id = kwargs.get("scan_id")
-
-        if tenant_id and scan_id:
-            logger.error(f"Scan report task {task_id} failed: {exc}")
-            rmtree(_scan_tmp_output_directory(tenant_id, scan_id), ignore_errors=True)
-
-
 @shared_task(
-    base=ScanReportRLSTask,
+    base=RLSTask,
     name="scan-report",
     queue="scan-reports",
 )
@@ -558,23 +513,11 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
     provider_uid = provider_obj.uid
     provider_type = provider_obj.provider
 
-    # Per-framework exporters in `COMPLIANCE_CLASS_MAP` consume the legacy bulk.
     frameworks_bulk = Compliance.get_bulk(provider_type)
-    # Universal-only frameworks (top-level JSONs like `dora.json`) are emitted
-    # via `process_universal_compliance_frameworks` below.
-    universal_bulk = get_prowler_provider_compliance(provider_type)
-    universal_only_names = {
-        name
-        for name in universal_bulk
-        if name not in frameworks_bulk and universal_bulk[name].outputs
-    }
     frameworks_avail = get_compliance_frameworks(provider_type)
     out_dir, comp_dir = _generate_output_directory(
         DJANGO_TMP_OUTPUT_DIRECTORY, provider_uid, tenant_id, scan_id
     )
-    # Removed on success here and on failure by ScanReportRLSTask.on_failure,
-    # so partial artifacts do not accumulate and fill the disk (ENOSPC).
-    scan_tmp_dir = _scan_tmp_output_directory(tenant_id, scan_id)
 
     def get_writer(writer_map, name, factory, is_last):
         """
@@ -592,10 +535,6 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
 
     output_writers = {}
     compliance_writers = {}
-    # Shared across batches so universal writers are created once and reused.
-    universal_compliance_state: dict[str, list] = {"compliance": []}
-    universal_base_dir = os.path.dirname(out_dir)
-    universal_output_filename = os.path.basename(out_dir)
 
     scan_summary = FindingOutput._transform_findings_stats(
         ScanSummary.objects.filter(scan_id=scan_id)
@@ -650,30 +589,8 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
                 writer.batch_write_data_to_file(**extra)
                 writer._data.clear()
 
-            # Universal-only frameworks (e.g. `dora.json`).
-            if universal_only_names:
-                process_universal_compliance_frameworks(
-                    input_compliance_frameworks=universal_only_names,
-                    universal_frameworks=universal_bulk,
-                    finding_outputs=fos,
-                    output_directory=universal_base_dir,
-                    output_filename=universal_output_filename,
-                    provider=provider_type,
-                    generated_outputs=universal_compliance_state,
-                    from_cli=False,
-                    is_last=is_last,
-                )
-
-            # Compliance CSVs (per-framework exporters).
+            # Compliance CSVs
             for name in frameworks_avail:
-                if name in universal_only_names:
-                    continue
-                if name not in frameworks_bulk:
-                    logger.warning(
-                        "Compliance framework '%s' missing from bulk; skipping CSV export",
-                        name,
-                    )
-                    continue
                 compliance_obj = frameworks_bulk[name]
 
                 klass = GenericCompliance
@@ -749,7 +666,7 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
         # TODO: We need to create a new periodic task to delete the output files
         # This task shouldn't be responsible for deleting the output files
         try:
-            rmtree(scan_tmp_dir, ignore_errors=True)
+            rmtree(Path(compressed).parent, ignore_errors=True)
         except Exception as e:
             logger.error(f"Error deleting output files: {e}")
         final_location, did_upload = upload_uri, True
@@ -1160,13 +1077,10 @@ def security_hub_integration_task(
     return upload_security_hub_integration(tenant_id, provider_id, scan_id)
 
 
-# acks_late=False: Jira sends are not deduplicated and the task is not auto-recovered,
-# so a crashed send is dropped rather than redelivered (avoids duplicate Jira issues).
 @shared_task(
     base=RLSTask,
     name="integration-jira",
     queue="integrations",
-    acks_late=False,
 )
 def jira_integration_task(
     tenant_id: str,

api/src/backend/tasks/tests/test_orphan_recovery.py

@@ -1,408 +0,0 @@
-from datetime import datetime, timedelta, timezone
-from unittest.mock import MagicMock, patch
-from uuid import uuid4
-
-import pytest
-from celery import states
-from django.test import override_settings
-from django_celery_results.models import TaskResult
-
-from tasks.jobs.orphan_recovery import (
-    _decode_celery_field,
-    _reconcile_task_results,
-    _recovery_attempt_count,
-    advisory_lock,
-    is_worker_alive,
-    reconcile_orphans,
-    reenqueueable_tasks,
-)
-
-
-def _orphan_result(*, name, kwargs, worker, created_minutes_ago, status=states.STARTED):
-    """Create a TaskResult mimicking an in-flight task, backdated past the grace."""
-    tr = TaskResult.objects.create(
-        task_id=str(uuid4()),
-        status=status,
-        task_name=name,
-        worker=worker,
-        task_kwargs=repr(kwargs),
-        task_args=repr([]),
-    )
-    TaskResult.objects.filter(pk=tr.pk).update(
-        date_created=datetime.now(tz=timezone.utc)
-        - timedelta(minutes=created_minutes_ago)
-    )
-    tr.refresh_from_db()
-    return tr
-
-
-@pytest.mark.django_db
-class TestDecodeCeleryField:
-    def test_decodes_single_encoded_repr(self):
-        assert _decode_celery_field("{'tenant_id': 'abc'}", {}) == {"tenant_id": "abc"}
-
-    def test_decodes_double_encoded(self):
-        import json
-
-        stored = json.dumps(repr({"tenant_id": "abc", "scan_id": "s1"}))
-        assert _decode_celery_field(stored, {}) == {"tenant_id": "abc", "scan_id": "s1"}
-
-    def test_empty_returns_default(self):
-        assert _decode_celery_field(None, {}) == {}
-        assert _decode_celery_field("", []) == []
-
-    def test_unparseable_raises(self):
-        with pytest.raises(ValueError):
-            _decode_celery_field("<<not a literal>>", {})
-
-
-@pytest.mark.django_db
-class TestReconcileTaskResults:
-    def _patches(self, alive):
-        """Patch worker liveness, revoke, and the task registry for re-enqueue."""
-        mock_app = MagicMock()
-        mock_task = MagicMock()
-        mock_app.tasks.get.return_value = mock_task
-        return (
-            patch("tasks.jobs.orphan_recovery.is_worker_alive", return_value=alive),
-            patch("tasks.jobs.orphan_recovery.revoke_task"),
-            patch("tasks.jobs.orphan_recovery.current_app", mock_app),
-            mock_task,
-        )
-
-    def test_recovers_non_scan_task(self, tenants_fixture):
-        """A NON-scan task (tenant-deletion) left orphaned is re-enqueued too."""
-        tenant = tenants_fixture[0]
-        tr = _orphan_result(
-            name="tenant-deletion",
-            kwargs={"tenant_id": str(tenant.id)},
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-        with (
-            p_alive,
-            p_revoke,
-            p_app,
-            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
-        ):
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["recovered"]
-        tr.refresh_from_db()
-        assert tr.status == states.REVOKED  # stale result cleared (no pending alert)
-        mock_task.apply_async.assert_called_once()
-        call = mock_task.apply_async.call_args.kwargs
-        assert call["kwargs"] == {"tenant_id": str(tenant.id)}
-        assert call["task_id"] != tr.task_id  # fresh task id
-
-    def test_external_integration_task_is_not_reenqueued_by_default(
-        self, tenants_fixture
-    ):
-        """External side-effect tasks without proven idempotency stay terminal.
-
-        integration-s3 rebuilds its upload from worker-local files that do not
-        survive the crash, so re-enqueuing it would upload nothing.
-        """
-        tr = _orphan_result(
-            name="integration-s3",
-            kwargs={
-                "tenant_id": str(tenants_fixture[0].id),
-                "provider_id": str(uuid4()),
-                "output_directory": "/tmp/gone",
-            },
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-        with (
-            p_alive,
-            p_revoke,
-            p_app,
-            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
-        ):
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["failed"]
-        mock_task.apply_async.assert_not_called()
-
-    @override_settings(TASK_RECOVERY_SUMMARIES_ENABLED=False)
-    def test_disabled_group_task_is_not_reenqueued(self, tenants_fixture):
-        """A task whose group feature flag is off stays terminal, not re-enqueued."""
-        tr = _orphan_result(
-            name="scan-summary",
-            kwargs={
-                "tenant_id": str(tenants_fixture[0].id),
-                "scan_id": str(uuid4()),
-            },
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-        with (
-            p_alive,
-            p_revoke,
-            p_app,
-            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
-        ):
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["failed"]
-        mock_task.apply_async.assert_not_called()
-
-    @override_settings(TASK_RECOVERY_SUMMARIES_ENABLED=False)
-    def test_disabled_group_task_does_not_consume_recovery_attempt(
-        self, tenants_fixture
-    ):
-        """A disabled-group task is failed without incrementing its Valkey attempt
-        counter, so re-enabling the group does not start it at the cap."""
-        tr = _orphan_result(
-            name="scan-summary",
-            kwargs={"tenant_id": str(tenants_fixture[0].id), "scan_id": str(uuid4())},
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-        with (
-            p_alive,
-            p_revoke,
-            p_app,
-            patch("tasks.jobs.orphan_recovery._recovery_attempt_count") as mock_count,
-        ):
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["failed"]
-        mock_count.assert_not_called()
-
-    def test_scan_task_is_skipped_entirely(self, tenants_fixture):
-        """Scan tasks are excluded from recovery: the watchdog never touches them."""
-        tr = _orphan_result(
-            name="scan-perform",
-            kwargs={
-                "tenant_id": str(tenants_fixture[0].id),
-                "scan_id": str(uuid4()),
-            },
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-        with p_alive, p_revoke, p_app:
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id not in result["recovered"]
-        assert tr.task_id not in result["failed"]
-        assert tr.task_id not in result["skipped"]
-        mock_task.apply_async.assert_not_called()
-
-    def test_jira_integration_task_is_not_reenqueued(self, tenants_fixture):
-        """integration-jira stays terminal: re-running it would create duplicate Jira
-        issues, so an orphaned send is failed instead of re-enqueued."""
-        tenant = tenants_fixture[0]
-        kwargs = {
-            "tenant_id": str(tenant.id),
-            "integration_id": str(uuid4()),
-            "project_key": "PROWLER",
-            "issue_type": "Task",
-            "finding_ids": [str(uuid4()), str(uuid4())],
-        }
-        tr = _orphan_result(
-            name="integration-jira",
-            kwargs=kwargs,
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-        with (
-            p_alive,
-            p_revoke,
-            p_app,
-            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
-        ):
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["failed"]
-        tr.refresh_from_db()
-        assert tr.status == states.REVOKED  # stale result cleared (no pending alert)
-        mock_task.apply_async.assert_not_called()
-
-    def test_skips_live_worker(self, tenants_fixture):
-        tr = _orphan_result(
-            name="tenant-deletion",
-            kwargs={"tenant_id": str(tenants_fixture[0].id)},
-            worker="alive@host",
-            created_minutes_ago=60,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=True)
-        with p_alive, p_revoke, p_app:
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["skipped"]
-        mock_task.apply_async.assert_not_called()
-
-    def test_skips_recently_created(self, tenants_fixture):
-        tr = _orphan_result(
-            name="tenant-deletion",
-            kwargs={"tenant_id": str(tenants_fixture[0].id)},
-            worker="dead@gone",
-            created_minutes_ago=0,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-        with p_alive, p_revoke, p_app:
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        # too recent: excluded by the grace window (not even a candidate)
-        assert tr.task_id not in result["recovered"]
-        mock_task.apply_async.assert_not_called()
-
-    def test_denylisted_task_failed_not_reenqueued(self, tenants_fixture):
-        """A non-allowlisted task is failed, never blind re-run."""
-        tr = _orphan_result(
-            name="some-non-idempotent-task",
-            kwargs={"tenant_id": str(tenants_fixture[0].id)},
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-        with (
-            p_alive,
-            p_revoke,
-            p_app,
-            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=1),
-        ):
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["failed"]
-        tr.refresh_from_db()
-        assert tr.status == states.REVOKED
-        mock_task.apply_async.assert_not_called()
-
-    def test_recovery_cap_marks_failed(self, tenants_fixture):
-        """When the recovery counter exceeds the cap, the task is failed not re-run."""
-        tr = _orphan_result(
-            name="tenant-deletion",
-            kwargs={"tenant_id": str(tenants_fixture[0].id)},
-            worker="dead@gone",
-            created_minutes_ago=60,
-        )
-        p_alive, p_revoke, p_app, mock_task = self._patches(alive=False)
-        with (
-            p_alive,
-            p_revoke,
-            p_app,
-            patch("tasks.jobs.orphan_recovery._recovery_attempt_count", return_value=4),
-        ):
-            result = _reconcile_task_results(
-                grace_minutes=2, max_attempts=3, window_hours=6, dry_run=False
-            )
-
-        assert tr.task_id in result["failed"]
-        mock_task.apply_async.assert_not_called()
-
-
-@pytest.mark.django_db
-class TestOrphanRecoveryHelpers:
-    def test_advisory_lock_acquires_and_releases(self):
-        with advisory_lock() as acquired:
-            assert acquired is True
-
-    def test_is_worker_alive_true_when_responds(self):
-        inspect = MagicMock()
-        inspect.ping.return_value = {"w@h": {"ok": "pong"}}
-        with patch(
-            "tasks.jobs.orphan_recovery.current_app.control.inspect",
-            return_value=inspect,
-        ):
-            assert is_worker_alive("w@h") is True
-
-    def test_is_worker_alive_false_when_silent(self):
-        inspect = MagicMock()
-        inspect.ping.return_value = None
-        with patch(
-            "tasks.jobs.orphan_recovery.current_app.control.inspect",
-            return_value=inspect,
-        ):
-            assert is_worker_alive("w@h") is False
-
-    def test_recovery_attempt_count_increments(self):
-        # Unique signature so the Valkey counter starts fresh for this test.
-        kwargs_repr = repr({"probe": str(uuid4())})
-        redis_client = MagicMock()
-        redis_client.incr.side_effect = [1, 2]
-        with patch("redis.from_url", return_value=redis_client):
-            assert _recovery_attempt_count("probe-task", kwargs_repr, 6) == 1
-            assert _recovery_attempt_count("probe-task", kwargs_repr, 6) == 2
-
-
-class TestRecoveryFeatureFlags:
-    def test_all_groups_enabled_by_default(self):
-        tasks = reenqueueable_tasks()
-        assert "scan-summary" in tasks
-        assert {"provider-deletion", "tenant-deletion"} <= tasks
-
-    @override_settings(TASK_RECOVERY_SUMMARIES_ENABLED=False)
-    def test_summaries_group_flag_excludes_summary_tasks(self):
-        tasks = reenqueueable_tasks()
-        assert "scan-summary" not in tasks
-        assert "scan-compliance-overviews" not in tasks
-        assert "provider-deletion" in tasks
-
-    @override_settings(TASK_RECOVERY_DELETIONS_ENABLED=False)
-    def test_deletions_group_flag_excludes_deletion_tasks(self):
-        tasks = reenqueueable_tasks()
-        assert "provider-deletion" not in tasks
-        assert "tenant-deletion" not in tasks
-        assert "scan-summary" in tasks
-
-
-@pytest.mark.django_db
-class TestRecoveryMasterFlag:
-    @override_settings(TASK_RECOVERY_ENABLED=False)
-    def test_master_flag_disables_task_recovery(self):
-        with (
-            patch(
-                "tasks.jobs.orphan_recovery._reconcile_task_results"
-            ) as mock_reconcile,
-            patch(
-                "tasks.jobs.attack_paths.cleanup.cleanup_stale_attack_paths_scans",
-                return_value={},
-            ),
-        ):
-            result = reconcile_orphans(grace_minutes=2, max_attempts=3, dry_run=False)
-
-        mock_reconcile.assert_not_called()
-        assert result["acquired"] is True
-        assert result["enabled"] is False
-
-    @override_settings(TASK_RECOVERY_ENABLED=True)
-    def test_master_flag_enabled_runs_task_recovery(self):
-        with (
-            patch(
-                "tasks.jobs.orphan_recovery._reconcile_task_results",
-                return_value={"recovered": [], "failed": [], "skipped": []},
-            ) as mock_reconcile,
-            patch(
-                "tasks.jobs.attack_paths.cleanup.cleanup_stale_attack_paths_scans",
-                return_value={},
-            ),
-        ):
-            reconcile_orphans(grace_minutes=2, max_attempts=3, dry_run=False)
-
-        mock_reconcile.assert_called_once()

api/src/backend/tasks/tests/test_reports_csa.py

@@ -80,7 +80,7 @@ def basic_csa_compliance_data():
         tenant_id="tenant-123",
         scan_id="scan-456",
         provider_id="provider-789",
-        compliance_id="csa_ccm_4.0",
+        compliance_id="csa_ccm_4.0_aws",
         framework="CSA-CCM",
         name="CSA Cloud Controls Matrix v4.0",
         version="4.0",

api/src/backend/tasks/tests/test_scan.py

@@ -315,7 +315,6 @@ class TestPerformScan:
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
-                "name": finding.resource_name,
                 "region": finding.region,
                 "service": finding.service_name,
                 "type": finding.resource_type,
@@ -349,7 +348,6 @@ class TestPerformScan:
 
         resource_instance = MagicMock()
         resource_instance.uid = finding.resource_uid
-        resource_instance.name = "old_name"
         resource_instance.region = "us-west-1"
         resource_instance.service = "old_service"
         resource_instance.type = "old_type"
@@ -368,7 +366,6 @@ class TestPerformScan:
             provider=provider_instance,
             uid=finding.resource_uid,
             defaults={
-                "name": finding.resource_name,
                 "region": finding.region,
                 "service": finding.service_name,
                 "type": finding.resource_type,
@@ -376,7 +373,6 @@ class TestPerformScan:
         )
 
         # Check that resource fields were updated
-        assert resource_instance.name == finding.resource_name
         assert resource_instance.region == finding.region
         assert resource_instance.service == finding.service_name
         assert resource_instance.type == finding.resource_type
@@ -1569,75 +1565,6 @@ class TestProcessFindingMicroBatch:
         assert resource_cache[finding.resource_uid].service == finding.service_name
         assert tag_cache.keys() == {("team", "devsec")}
 
-    def test_process_finding_micro_batch_refreshes_empty_resource_name(
-        self, tenants_fixture, scans_fixture
-    ):
-        tenant = tenants_fixture[0]
-        scan = scans_fixture[0]
-        provider = scan.provider
-
-        # Old resource stored before names were persisted: empty name.
-        existing_resource = Resource.objects.create(
-            tenant_id=tenant.id,
-            provider=provider,
-            uid="arn:aws:s3:::my-bucket",
-            name="",
-            region="us-east-1",
-            service="s3",
-            type="bucket",
-        )
-
-        finding = FakeFinding(
-            uid="finding-empty-name",
-            status=StatusChoices.PASS,
-            status_extended="passing",
-            severity=Severity.low,
-            check_id="s3_bucket_public_access",
-            resource_uid=existing_resource.uid,
-            resource_name="my-bucket",
-            region="us-east-1",
-            service_name="s3",
-            resource_type="bucket",
-            partition="aws",
-            raw={"status": "PASS"},
-            metadata={"source": "prowler"},
-        )
-
-        resource_cache = {existing_resource.uid: existing_resource}
-        tag_cache = {}
-        last_status_cache = {}
-        resource_failed_findings_cache = {existing_resource.uid: 0}
-        unique_resources: set[tuple[str, str]] = set()
-        scan_resource_cache: set[tuple[str, str, str, str]] = set()
-        mute_rules_cache = {}
-        scan_categories_cache: dict[tuple[str, str], dict[str, int]] = {}
-        scan_resource_groups_cache: dict[tuple[str, str], dict[str, int]] = {}
-        group_resources_cache: dict[str, set] = {}
-
-        with (
-            patch("tasks.jobs.scan.rls_transaction", new=noop_rls_transaction),
-            patch("api.db_utils.rls_transaction", new=noop_rls_transaction),
-        ):
-            _process_finding_micro_batch(
-                str(tenant.id),
-                [finding],
-                scan,
-                provider,
-                resource_cache,
-                tag_cache,
-                last_status_cache,
-                resource_failed_findings_cache,
-                unique_resources,
-                scan_resource_cache,
-                mute_rules_cache,
-                scan_categories_cache,
-                scan_resource_groups_cache,
-                group_resources_cache,
-            )
-
-        existing_resource.refresh_from_db()
-        assert existing_resource.name == finding.resource_name
-
     def test_process_finding_micro_batch_skips_long_uid(
         self, tenants_fixture, scans_fixture
     ):
@@ -1953,62 +1880,6 @@ class TestCreateComplianceRequirements:
 
             assert "requirements_created" in result
 
-    @pytest.mark.django_db(transaction=True)
-    def test_create_compliance_requirements_idempotent_on_rerun(
-        self,
-        tenants_fixture,
-        scans_fixture,
-        providers_fixture,
-        findings_fixture,
-    ):
-        """Re-running compliance materialization must not raise nor duplicate rows.
-
-        Uses transaction=True because the COPY path commits on its own connection,
-        so the test must use real commits (mirroring production) rather than the
-        default rollback wrapper.
-        """
-        from api.models import ComplianceRequirementOverview
-
-        with patch(
-            "tasks.jobs.scan.PROWLER_COMPLIANCE_OVERVIEW_TEMPLATE"
-        ) as mock_compliance_template:
-            tenant_id = str(tenants_fixture[0].id)
-            scan_id = str(scans_fixture[0].id)
-
-            mock_compliance_template.__getitem__.return_value = {
-                "test_compliance": {
-                    "framework": "Test Framework",
-                    "version": "1.0",
-                    "requirements": {
-                        "req_1": {
-                            "description": "Test Requirement 1",
-                            "checks": {"test_check_id": None},
-                            "checks_status": {
-                                "pass": 2,
-                                "fail": 1,
-                                "manual": 0,
-                                "total": 3,
-                            },
-                            "status": "FAIL",
-                        },
-                    },
-                }
-            }
-
-            create_compliance_requirements(tenant_id, scan_id)
-            count_after_first = ComplianceRequirementOverview.objects.filter(
-                scan_id=scan_id
-            ).count()
-
-            # Second run must not raise and must not duplicate rows.
-            create_compliance_requirements(tenant_id, scan_id)
-            count_after_second = ComplianceRequirementOverview.objects.filter(
-                scan_id=scan_id
-            ).count()
-
-        assert count_after_first > 0
-        assert count_after_second == count_after_first
-
     def test_create_compliance_requirements_kubernetes_provider(
         self,
         tenants_fixture,

api/src/backend/tasks/tests/test_tasks.py

@@ -15,10 +15,8 @@ from tasks.jobs.lighthouse_providers import (
 from tasks.tasks import (
     DJANGO_TMP_OUTPUT_DIRECTORY,
     STALE_TMP_OUTPUT_MAX_AGE_HOURS,
-    ScanReportRLSTask,
     _cleanup_orphan_scheduled_scans,
     _perform_scan_complete_tasks,
-    _scan_tmp_output_directory,
     check_integrations_task,
     check_lighthouse_provider_connection_task,
     generate_outputs_task,
@@ -323,7 +321,6 @@ class TestGenerateOutputs:
 
         mock_transformed_stats = {"some": "stats"}
         with (
-            patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
             patch(
                 "tasks.tasks.FindingOutput._transform_findings_stats",
                 return_value=mock_transformed_stats,
@@ -442,7 +439,6 @@ class TestGenerateOutputs:
         mock_provider.uid = "test-provider-uid"
 
         with (
-            patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
             patch("tasks.tasks.ScanSummary.objects.filter") as mock_filter,
             patch("tasks.tasks.Provider.objects.get", return_value=mock_provider),
             patch("tasks.tasks.initialize_prowler_provider"),
@@ -598,7 +594,6 @@ class TestGenerateOutputs:
         ]
 
         with (
-            patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
             patch("tasks.tasks.ScanSummary.objects.filter") as mock_summary,
             patch(
                 "tasks.tasks.Provider.objects.get",
@@ -673,7 +668,6 @@ class TestGenerateOutputs:
         mock_provider.uid = "test-provider-uid"
 
         with (
-            patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
             patch("tasks.tasks.ScanSummary.objects.filter") as mock_filter,
             patch("tasks.tasks.Provider.objects.get", return_value=mock_provider),
             patch("tasks.tasks.initialize_prowler_provider"),
@@ -777,38 +771,6 @@ class TestGenerateOutputs:
             mock_s3_task.assert_called_once()
 
 
-class TestScanReportRLSTaskOnFailure:
-    def test_on_failure_removes_scan_tmp_directory(self):
-        task = ScanReportRLSTask()
-
-        with patch("tasks.tasks.rmtree") as mock_rmtree:
-            task.on_failure(
-                exc=OSError("No space left on device"),
-                task_id="task-abc",
-                args=(),
-                kwargs={"tenant_id": "t-1", "scan_id": "s-1"},
-                _einfo=None,
-            )
-
-        mock_rmtree.assert_called_once_with(
-            _scan_tmp_output_directory("t-1", "s-1"), ignore_errors=True
-        )
-
-    def test_on_failure_skips_when_missing_kwargs(self):
-        task = ScanReportRLSTask()
-
-        with patch("tasks.tasks.rmtree") as mock_rmtree:
-            task.on_failure(
-                exc=OSError("No space left on device"),
-                task_id="task-abc",
-                args=(),
-                kwargs={},
-                _einfo=None,
-            )
-
-        mock_rmtree.assert_not_called()
-
-
 class TestScanCompleteTasks:
     @patch("tasks.tasks.aggregate_attack_surface_task.apply_async")
     @patch("tasks.tasks.chain")
@@ -1117,7 +1079,6 @@ class TestCheckIntegrationsTask:
             enabled=True,
         )
 
-    @patch("tasks.tasks.get_prowler_provider_compliance", return_value={})
     @patch("tasks.tasks.s3_integration_task")
     @patch("tasks.tasks.Integration.objects.filter")
     @patch("tasks.tasks.ScanSummary.objects.filter")
@@ -1150,7 +1111,6 @@ class TestCheckIntegrationsTask:
         mock_scan_summary,
         mock_integration_filter,
         mock_s3_task,
-        mock_get_prowler_compliance,
     ):
         """Test that ASFF output is generated for AWS providers with SecurityHub integration."""
         # Setup
@@ -1247,7 +1207,6 @@ class TestCheckIntegrationsTask:
 
             assert result == {"upload": True}
 
-    @patch("tasks.tasks.get_prowler_provider_compliance", return_value={})
     @patch("tasks.tasks.s3_integration_task")
     @patch("tasks.tasks.Integration.objects.filter")
     @patch("tasks.tasks.ScanSummary.objects.filter")
@@ -1280,7 +1239,6 @@ class TestCheckIntegrationsTask:
         mock_scan_summary,
         mock_integration_filter,
         mock_s3_task,
-        mock_get_prowler_compliance,
     ):
         """Test that ASFF output is NOT generated for AWS providers without SecurityHub integration."""
         # Setup
@@ -1374,7 +1332,6 @@ class TestCheckIntegrationsTask:
 
             assert result == {"upload": True}
 
-    @patch("tasks.tasks.get_prowler_provider_compliance", return_value={})
     @patch("tasks.tasks.ScanSummary.objects.filter")
     @patch("tasks.tasks.Provider.objects.get")
     @patch("tasks.tasks.initialize_prowler_provider")
@@ -1403,7 +1360,6 @@ class TestCheckIntegrationsTask:
         mock_initialize_provider,
         mock_provider_get,
         mock_scan_summary,
-        mock_get_prowler_compliance,
     ):
         """Test that ASFF output is NOT generated for non-AWS providers (e.g., Azure, GCP)."""
         # Setup
@@ -2716,36 +2672,3 @@ class TestReaggregateAllFindingGroupSummaries:
         assert result == {"scans_reaggregated": 0}
         mock_group.assert_not_called()
         mock_chain.assert_not_called()
-
-
-class TestTaskTimeLimits:
-    """The per-task limits in task_annotations must actually take effect.
-
-    Celery applies a "*" annotation after the per-task one, so a "*" entry would
-    silently overwrite every specific limit and cap long scans at the default. The
-    default is set as the global limit instead, and these per-task limits must win.
-    """
-
-    def test_long_running_tasks_exceed_the_default_limit(self):
-        from config.celery import celery_app
-
-        default = celery_app.conf.task_time_limit
-        for name in (
-            "scan-perform",
-            "scan-perform-scheduled",
-            "provider-deletion",
-            "tenant-deletion",
-        ):
-            assert celery_app.tasks[name].time_limit > default
-
-    def test_connection_checks_stay_below_the_default_limit(self):
-        from config.celery import celery_app
-
-        default = celery_app.conf.task_time_limit
-        for name in (
-            "provider-connection-check",
-            "integration-connection-check",
-            "lighthouse-connection-check",
-            "lighthouse-provider-connection-check",
-        ):
-            assert celery_app.tasks[name].time_limit < default

api/towncrier.toml

@@ -1,39 +0,0 @@
-[tool.towncrier]
-directory = "changelog.d"
-filename = "CHANGELOG.md"
-start_string = "<!-- changelog: release notes start -->\n"
-title_format = "## [{version}] ({name})"
-issue_format = "[(#{issue})](https://github.com/prowler-cloud/prowler/pull/{issue})"
-template = "../.github/towncrier/template.md.jinja"
-underlines = ["", "", ""]
-ignore = [".gitkeep", "README.md"]
-
-[[tool.towncrier.type]]
-directory = "added"
-name = "🚀 Added"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "changed"
-name = "🔄 Changed"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "deprecated"
-name = "⚠️ Deprecated"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "removed"
-name = "❌ Removed"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "fixed"
-name = "🐞 Fixed"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "security"
-name = "🔐 Security"
-showcontent = true

api/uv.lock

@@ -163,7 +163,7 @@ constraints = [
     { name = "drf-simple-apikey", specifier = "==2.2.1" },
     { name = "drf-spectacular", specifier = "==0.27.2" },
     { name = "drf-spectacular-jsonapi", specifier = "==0.5.1" },
-    { name = "dulwich", specifier = "==1.2.5" },
+    { name = "dulwich", specifier = "==0.23.0" },
     { name = "duo-client", specifier = "==5.5.0" },
     { name = "durationpy", specifier = "==0.10" },
     { name = "email-validator", specifier = "==2.2.0" },
@@ -291,7 +291,7 @@ constraints = [
     { name = "pydantic-core", specifier = "==2.41.5" },
     { name = "pygithub", specifier = "==2.8.0" },
     { name = "pygments", specifier = "==2.20.0" },
-    { name = "pyjwt", specifier = "==2.13.0" },
+    { name = "pyjwt", specifier = "==2.12.1" },
     { name = "pylint", specifier = "==3.2.5" },
     { name = "pymsalruntime", specifier = "==0.18.1" },
     { name = "pynacl", specifier = "==1.6.2" },
@@ -374,10 +374,8 @@ constraints = [
     { name = "zstd", specifier = "==1.5.7.3" },
 ]
 overrides = [
-    { name = "dulwich", specifier = "==1.2.5" },
     { name = "microsoft-kiota-abstractions", specifier = "==1.9.9" },
     { name = "okta", specifier = "==3.4.2" },
-    { name = "pyjwt", extras = ["crypto"], specifier = "==2.13.0" },
 ]
 
 [[package]]
@@ -395,7 +393,7 @@ version = "1.2.7"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
-    { name = "pyjwt", extra = ["crypto"] },
+    { name = "pyjwt" },
     { name = "python-dateutil" },
     { name = "requests" },
 ]
@@ -1076,7 +1074,7 @@ dependencies = [
     { name = "pkginfo" },
     { name = "psutil", marker = "sys_platform != 'cygwin'" },
     { name = "py-deviceid" },
-    { name = "pyjwt", extra = ["crypto"] },
+    { name = "pyjwt" },
     { name = "pyopenssl" },
     { name = "requests", extra = ["socks"] },
 ]
@@ -2459,7 +2457,7 @@ source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "django" },
     { name = "djangorestframework" },
-    { name = "pyjwt", extra = ["crypto"] },
+    { name = "pyjwt" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/a8/27/2874a325c11112066139769f7794afae238a07ce6adf96259f08fd37a9d7/djangorestframework_simplejwt-5.5.1.tar.gz", hash = "sha256:e72c5572f51d7803021288e2057afcbd03f17fe11d484096f40a460abc76e87f", size = 101265, upload-time = "2025-07-21T16:52:25.026Z" }
 wheels = [
@@ -2578,27 +2576,24 @@ wheels = [
 
 [[package]]
 name = "dulwich"
-version = "1.2.5"
+version = "0.23.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.12'" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/7f/85/ceb8ecff5cdeee4ceeebb86b599476dee559041dacc6c2c50cc0d4711549/dulwich-1.2.5.tar.gz", hash = "sha256:0395b2c8924c3424bafe2d9c1edd5348cc4b21ce9c1d6655bf01f9a5c47164c8", size = 1253230, upload-time = "2026-05-28T22:27:55.17Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/4b/ac/ba58cf420640c7bc77ae8e1b31e174d83c9117750c63cf9ea3b5e202e5c4/dulwich-0.23.0.tar.gz", hash = "sha256:0aa6c2489dd5e978b27e9b75983b7331a66c999f0efc54ebe37cab808ed322ae", size = 575116, upload-time = "2025-06-21T17:56:47.494Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4a/4a/654ae1671610fdf6b65a64586ad67ddd8550d4d08a632b2a4b9614754b6d/dulwich-1.2.5-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:556593fd11637f80f6018bee1916b1a84f5b420423b470ebb3f1a782ad6ef081", size = 1399277, upload-time = "2026-05-28T22:27:00.801Z" },
-    { url = "https://files.pythonhosted.org/packages/85/d8/06ee3bc8eded4bd7adf8adf0c9ea5f19bf96f7e5e626bfaf7311cde4208a/dulwich-1.2.5-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a70477c991e96cfe8fdd7c866e7251faf71b38bfeb51d6f27554c9cce1caabf3", size = 1382310, upload-time = "2026-05-28T22:27:02.216Z" },
-    { url = "https://files.pythonhosted.org/packages/07/17/a03adf50b9095f9f5d863393f21d585dea39bdc4fdf60788ff3a9407a512/dulwich-1.2.5-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:9008ef25cabd379cda4fa86000fc38ca14b72afe17db798a8c85c0b2b7ce4d1e", size = 1470993, upload-time = "2026-05-28T22:27:04.075Z" },
-    { url = "https://files.pythonhosted.org/packages/60/58/1dc352d2a5e80befe4338af7208febb44bcfd7496b0dde5ac6dacb07b031/dulwich-1.2.5-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:a5549f4afc973e0a15ea6b0244d57f848d3f3ee13dac557eb311024aebebf128", size = 1497820, upload-time = "2026-05-28T22:27:05.549Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/a8/e058959a87e7df7753b112ef66a43ccbc57338c1bbdc23a0edf3833396df/dulwich-1.2.5-cp311-cp311-win32.whl", hash = "sha256:5108acead814d1de8b6262d6d8fb90af7e82f5a4d83788b6b48e39d01800a92f", size = 1066549, upload-time = "2026-05-28T22:27:06.832Z" },
-    { url = "https://files.pythonhosted.org/packages/33/91/ff0b444f686718635348986bd73dfce42e947912417893de35de399b878b/dulwich-1.2.5-cp311-cp311-win_amd64.whl", hash = "sha256:5e067b7feceb7034bc99e7c7143a704f1d97d4be7027d9a0aa5a83c0657ff091", size = 1079481, upload-time = "2026-05-28T22:27:08.33Z" },
-    { url = "https://files.pythonhosted.org/packages/19/22/4f75770bbe5521cac61c4820ef46d4fbf8c2175d3519ba3d0378d4ba798e/dulwich-1.2.5-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:701a9ecf7a8a44f5e2459e46befa93530cf36a8b1ae3140aefc007db1d7d0207", size = 1396522, upload-time = "2026-05-28T22:27:09.997Z" },
-    { url = "https://files.pythonhosted.org/packages/e5/b1/c07c347681c0cf6acd4b189bf6e8d6207c71a1347b7a1e865eb40faa46b9/dulwich-1.2.5-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:2f90d68bfa97c4ca71de7507984365aefe27b6d248cb28dc99644d0f3ae8c60b", size = 1334826, upload-time = "2026-05-28T22:27:11.582Z" },
-    { url = "https://files.pythonhosted.org/packages/13/80/6818eb7ce492e18ab2efa92ab901d173b4b0b159e5681c1424f329600c40/dulwich-1.2.5-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:00b54a1d56ddbacdd8eadd6d4787a51b3a05fefa30eadbf9165fd283a00b90ed", size = 1416616, upload-time = "2026-05-28T22:27:13.195Z" },
-    { url = "https://files.pythonhosted.org/packages/14/a7/9790e60d19870f6554f7583722bb324c1355784316f20aeda1c0b5b1491a/dulwich-1.2.5-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:d8f7ea8f47e38e5b0de3fab97e07e9c9161ffddc90b3964512cab2b7749df4e6", size = 1441354, upload-time = "2026-05-28T22:27:14.683Z" },
-    { url = "https://files.pythonhosted.org/packages/91/44/0ea8a69c24aa1254ff5996d682eae2eab287d471b937dcdb26d9ea9720b4/dulwich-1.2.5-cp312-cp312-win32.whl", hash = "sha256:8929134acf4ff967203df7600b38535f9b5b590462067a7e30dbce01acb97af9", size = 1017058, upload-time = "2026-05-28T22:27:16.121Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/9c/2fcddda7faec3bae52db7c64bfcb5dc756f597f33fae90e8d4e4b4d3b39b/dulwich-1.2.5-cp312-cp312-win_amd64.whl", hash = "sha256:9693d2c9e226b2ea855c1dc3a87e2f4d972f7523fc0f7924e5997e9f4c23d97f", size = 1031731, upload-time = "2026-05-28T22:27:17.633Z" },
-    { url = "https://files.pythonhosted.org/packages/07/4b/4a18a59ad230581cd0ef460e96001f90762e566dc2dfdba22aa358eb5a0e/dulwich-1.2.5-py3-none-any.whl", hash = "sha256:1679b376433a0fc7f36586afda1d4ed7427afa7a79d4bf17e5014474eea69fa4", size = 686745, upload-time = "2026-05-28T22:27:53.695Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/11/f6bbba8583f69cf19ef4bd7f5fde1a6b5ccaf8b6951781cec8db247116f4/dulwich-0.23.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:d68498fdda13ab00791b483daab3bcfe9f9721c037aa458695e6ad81640c57cc", size = 972658, upload-time = "2025-06-21T17:56:13.505Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/9d/2720e0ab58666378a33c752a61543f936cd6b06dfe5d84a2215ddc0914b0/dulwich-0.23.0-cp311-cp311-manylinux_2_28_aarch64.whl", hash = "sha256:cb7bb930b12471a1cfcea4b3d25a671dc0ad32573f0ad25684684298959a1527", size = 1049813, upload-time = "2025-06-21T17:56:14.884Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/f3/81d8075141dfcc0a0449c2093596e58d3e11444e3af54e819eca63b84dd0/dulwich-0.23.0-cp311-cp311-manylinux_2_28_x86_64.whl", hash = "sha256:a2abbce32fd2bc7902bcc5f69b10bf22576810de21651baaa864b78fd7aec261", size = 1051639, upload-time = "2025-06-21T17:56:16.437Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/0d/c06ccb227b096aef5906142fe78b5c79f9070a0ea6152fc219941186d540/dulwich-0.23.0-cp311-cp311-win32.whl", hash = "sha256:9e3151f10ce2a9ff91bca64c74345217f53bdd947dc958032343822009832f7a", size = 642918, upload-time = "2025-06-21T17:56:18.373Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/1c/1e99aa34c9aead9e641b2d9934f0a3d00257f75027cf5cdecc8a1a6c18ae/dulwich-0.23.0-cp311-cp311-win_amd64.whl", hash = "sha256:3ae9f1d9dc92d4e9a3f89ba2c55221f7b6442c5dd93b3f6f539a3c9eb3f37bdd", size = 659010, upload-time = "2025-06-21T17:56:19.947Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/d7/1e6fba0235babe912e8467b036062e37d11672cbbeb0d8074f9d4559057b/dulwich-0.23.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:52cdef66a7994d29528ca79ca59452518bbba3fd56a9c61c61f6c467c1c7956e", size = 960292, upload-time = "2025-06-21T17:56:21.308Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/6a/23f0c487ec03f2752600cab4a8e0dedb38186246c475bf3fa90a8db830d5/dulwich-0.23.0-cp312-cp312-manylinux_2_28_aarch64.whl", hash = "sha256:d473888a6ab9ed5d4a4c3f053cbe5b77f72d54b6efdf5688fed76094316e571e", size = 1047892, upload-time = "2025-06-21T17:56:22.989Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/e2/8f3d216be5fd0ee1180d917b59b34b54b9896384cf139f319b5d3a8f16b4/dulwich-0.23.0-cp312-cp312-manylinux_2_28_x86_64.whl", hash = "sha256:19fcf20224c641a61c774da92f098fbaae9938c7e17a52841e64092adf7e78f9", size = 1048699, upload-time = "2025-06-21T17:56:24.602Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/c4/18e6223cd4ad1ae9334eb4e6aa5952fd8f5c3d75762918eb90c209fec4ba/dulwich-0.23.0-cp312-cp312-win32.whl", hash = "sha256:7fc8b76b704ef35cd001e993e3aa4e1d666a2064bf467c07c560f12b2959dcaf", size = 641268, upload-time = "2025-06-21T17:56:26.18Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/9c/65bfbbac62d8a2967e13f6a1512371c5eb6b906a61fb6dead992669cad0e/dulwich-0.23.0-cp312-cp312-win_amd64.whl", hash = "sha256:cb0566b888b578325350b4d67c61a0de35d417e9877560e3a6df88cae4576a59", size = 657837, upload-time = "2025-06-21T17:56:27.821Z" },
+    { url = "https://files.pythonhosted.org/packages/35/31/49318ee9db4b402e6d8b9b01bd4cae9298f59e1bb9bd56cf4a94e48fa069/dulwich-0.23.0-py3-none-any.whl", hash = "sha256:d8da6694ca332bb48775e35ee2215aa4673821164a91b83062f699c69f7cd135", size = 313776, upload-time = "2025-06-21T17:56:46.221Z" },
 ]
 
 [[package]]
@@ -4036,7 +4031,7 @@ dependencies = [
     { name = "pycryptodomex" },
     { name = "pydantic" },
     { name = "pydash" },
-    { name = "pyjwt", extra = ["crypto"] },
+    { name = "pyjwt" },
     { name = "python-dateutil" },
     { name = "pyyaml" },
     { name = "requests" },
@@ -4415,8 +4410,8 @@ wheels = [
 
 [[package]]
 name = "prowler"
-version = "5.30.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#f1d741214a60df17158c3fdc97804fd1fde64f3a" }
+version = "5.27.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#0abbb7fc590eaf7de6ed354dd5a217bca261d2b0" }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },
     { name = "alibabacloud-credentials" },
@@ -4489,14 +4484,9 @@ dependencies = [
     { name = "pygithub" },
     { name = "python-dateutil" },
     { name = "pytz" },
-    { name = "scaleway" },
     { name = "schema" },
     { name = "shodan" },
     { name = "slack-sdk" },
-    { name = "stackit-core" },
-    { name = "stackit-iaas" },
-    { name = "stackit-objectstorage" },
-    { name = "stackit-resourcemanager" },
     { name = "tabulate" },
     { name = "tzlocal" },
     { name = "uuid6" },
@@ -4504,7 +4494,7 @@ dependencies = [
 
 [[package]]
 name = "prowler-api"
-version = "1.32.0"
+version = "1.30.0"
 source = { virtual = "." }
 dependencies = [
     { name = "cartography" },
@@ -4883,11 +4873,11 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.13.0"
+version = "2.12.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c2/27/a3b6e5bf6ff856d2509292e95c8f57f0df7017cf5394921fc4e4ef40308a/pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b", size = 102564, upload-time = "2026-03-13T19:27:37.25Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" },
 ]
 
 [package.optional-dependencies]
@@ -5536,67 +5526,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/49/4b/359f28a903c13438ef59ebeee215fb25da53066db67b305c125f1c6d2a25/sqlparse-0.5.5-py3-none-any.whl", hash = "sha256:12a08b3bf3eec877c519589833aed092e2444e68240a3577e8e26148acc7b1ba", size = 46138, upload-time = "2025-12-19T07:17:46.573Z" },
 ]
 
-[[package]]
-name = "stackit-core"
-version = "0.2.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "cryptography" },
-    { name = "pydantic" },
-    { name = "pyjwt", extra = ["crypto"] },
-    { name = "requests" },
-    { name = "urllib3" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/24/90/20f9ec7387eec4067cfd3d29055d0e2b5e1e0322c601a7f48125fd8ea35f/stackit_core-0.2.0.tar.gz", hash = "sha256:b8af91877cdb060d6969a303d8cf20bc0b33b345afd91f679c44a987381e2d47", size = 8987, upload-time = "2025-06-12T08:24:45.251Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/ab/b4/7b53187ce68956870d864ccb9ccfb68066c9df9de1c9568fd2feb03c4504/stackit_core-0.2.0-py3-none-any.whl", hash = "sha256:04632fc6742790d08ddfcb7f2313e04d1254827397a80250f838a2f81b92645b", size = 10240, upload-time = "2025-06-12T08:24:44.214Z" },
-]
-
-[[package]]
-name = "stackit-iaas"
-version = "1.4.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "pydantic" },
-    { name = "python-dateutil" },
-    { name = "requests" },
-    { name = "stackit-core" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/52/07/24e65278300d5c3cb19cb1660bff924c80812cf8aad3e715f826bae5aa80/stackit_iaas-1.4.0.tar.gz", hash = "sha256:93523b23442350c7ebefd9129485c4c2a539f694a9c36a0f8edfaba9862057ea", size = 116236, upload-time = "2026-05-13T09:43:15.996Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/08/51/2201164d7bfacf47539888c735f10f6320c188252384957aa1b23121a210/stackit_iaas-1.4.0-py3-none-any.whl", hash = "sha256:3f4a32321b57ac238f73e5d660c6428186b92cc0425c1f0783ba801e377149d9", size = 316588, upload-time = "2026-05-13T09:43:14.943Z" },
-]
-
-[[package]]
-name = "stackit-objectstorage"
-version = "1.4.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "pydantic" },
-    { name = "python-dateutil" },
-    { name = "requests" },
-    { name = "stackit-core" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/90/80/b790756af40a5c6d979dd688b2557394ac54b594eb4c08edc33157ba890f/stackit_objectstorage-1.4.0.tar.gz", hash = "sha256:4a3812b4de102b199f061706a802909f9e53ae9b0858769d5bd720f814c8bdbe", size = 31814, upload-time = "2026-05-13T09:43:05.027Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/68/f1/ffa8d5e2ec9f818c72a6f045691364eb4e927ee86641993a70882d00205a/stackit_objectstorage-1.4.0-py3-none-any.whl", hash = "sha256:1a3285c6840d95cff591d84fd21803575cb0d010c398e6575ed92987b9c39866", size = 65061, upload-time = "2026-05-13T09:43:04.13Z" },
-]
-
-[[package]]
-name = "stackit-resourcemanager"
-version = "0.8.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "pydantic" },
-    { name = "python-dateutil" },
-    { name = "requests" },
-    { name = "stackit-core" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/23/2d/f458f18e48ed2b1c83df52cff7dbdfd5dd904fb2980ffd9385876e47bbd9/stackit_resourcemanager-0.8.0.tar.gz", hash = "sha256:f44542beab4130857f5a7f465cf02defeef657bdf63c1beeb3102f0ba3c003fe", size = 33943, upload-time = "2026-05-13T09:43:08.667Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/c7/9c/38a74d0f7a89b4320f6d2366fb660638bda8860daa08748b12c713d84381/stackit_resourcemanager-0.8.0-py3-none-any.whl", hash = "sha256:dd04bb8353d041a137c4dcba190beabded7acfaff1bc98b218fce20a99389ebc", size = 81288, upload-time = "2026-05-13T09:43:07.81Z" },
-]
-
 [[package]]
 name = "statsd"
 version = "4.0.1"
@@ -5856,7 +5785,7 @@ source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
     { name = "httpx" },
-    { name = "pyjwt", extra = ["crypto"] },
+    { name = "pyjwt" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/3c/2f/99fb8718274116c5c146c745755620fd5c5943f78ca52ca9b17e94348286/workos-6.0.4.tar.gz", hash = "sha256:b0bfe8fd212b8567422c4ea3732eb33608794033eb3a69900c6b04db183c32d6", size = 172217, upload-time = "2026-04-16T03:09:28.583Z" }
 wheels = [

dashboard/common_methods.py

@@ -1538,186 +1538,6 @@ def get_section_container_iso(data, section_1, section_2):
     return html.Div(section_containers, className="compliance-data-layout")
 
 
-def _status_bar(success, failed, classname):
-    """Build the stacked PASS/FAIL bar shown next to an accordion title."""
-    fig = go.Figure(
-        data=[
-            go.Bar(
-                name="Failed",
-                x=[failed],
-                y=[""],
-                orientation="h",
-                marker=dict(color="#e77676"),
-                width=[0.8],
-            ),
-            go.Bar(
-                name="Success",
-                x=[success],
-                y=[""],
-                orientation="h",
-                marker=dict(color="#45cc6e"),
-                width=[0.8],
-            ),
-        ]
-    )
-    fig.update_layout(
-        barmode="stack",
-        margin=dict(l=10, r=10, t=10, b=10),
-        paper_bgcolor="rgba(0,0,0,0)",
-        plot_bgcolor="rgba(0,0,0,0)",
-        showlegend=False,
-        width=350,
-        height=30,
-        xaxis=dict(showticklabels=False, showgrid=False, zeroline=False),
-        yaxis=dict(showticklabels=False, showgrid=False, zeroline=False),
-        annotations=[
-            dict(
-                x=success + failed,
-                y=0,
-                xref="x",
-                yref="y",
-                text=str(success),
-                showarrow=False,
-                font=dict(color="#45cc6e", size=14),
-                xanchor="left",
-                yanchor="middle",
-            ),
-            dict(
-                x=0,
-                y=0,
-                xref="x",
-                yref="y",
-                text=str(failed),
-                showarrow=False,
-                font=dict(color="#e77676", size=14),
-                xanchor="right",
-                yanchor="middle",
-            ),
-        ],
-    )
-    fig.add_annotation(
-        x=failed,
-        y=0.3,
-        text="|",
-        showarrow=False,
-        xanchor="center",
-        yanchor="middle",
-        font=dict(size=20),
-    )
-    return dcc.Graph(figure=fig, config={"staticPlot": True}, className=classname)
-
-
-def get_section_containers_generic(data, section_col, id_col):
-    """Two-level view: section -> requirement id (+ description) -> checks.
-
-    Sorts lexicographically so arbitrary requirement IDs never crash the
-    version-aware sort used by the CIS renderer.
-    """
-    data["STATUS"] = data["STATUS"].apply(map_status_to_icon)
-    data[section_col] = data[section_col].astype(str)
-    data[id_col] = data[id_col].astype(str)
-    data.sort_values(by=[section_col, id_col], inplace=True)
-
-    counts_section = data.groupby([section_col, "STATUS"]).size().unstack(fill_value=0)
-    counts_id = (
-        data.groupby([section_col, id_col, "STATUS"]).size().unstack(fill_value=0)
-    )
-
-    def count(counts, key, emoji):
-        return counts.loc[key, emoji] if emoji in counts.columns else 0
-
-    has_description = "REQUIREMENTS_DESCRIPTION" in data.columns
-    table_cols = ["CHECKID", "STATUS", "REGION", "ACCOUNTID", "RESOURCEID"]
-
-    section_containers = []
-    for section in data[section_col].unique():
-        graph_div = html.Div(
-            _status_bar(
-                count(counts_section, section, pass_emoji),
-                count(counts_section, section, fail_emoji),
-                "info-bar",
-            ),
-            className="graph-section",
-        )
-
-        internal_items = []
-        for req_id in data[data[section_col] == section][id_col].unique():
-            specific_data = data[
-                (data[section_col] == section) & (data[id_col] == req_id)
-            ]
-            data_table = dash_table.DataTable(
-                data=specific_data.to_dict("records"),
-                columns=[
-                    {"name": i, "id": i}
-                    for i in table_cols
-                    if i in specific_data.columns
-                ],
-                style_table={"overflowX": "auto"},
-                style_as_list_view=True,
-                style_cell={"textAlign": "left", "padding": "5px"},
-            )
-            graph_div_req = html.Div(
-                _status_bar(
-                    count(counts_id, (section, req_id), pass_emoji),
-                    count(counts_id, (section, req_id), fail_emoji),
-                    "info-bar-child",
-                ),
-                className="graph-section-req",
-            )
-
-            title = req_id
-            if has_description:
-                title = (
-                    f"{req_id} - {specific_data['REQUIREMENTS_DESCRIPTION'].iloc[0]}"
-                )
-            if len(title) > 130:
-                title = title[:130] + " ..."
-
-            internal_items.append(
-                html.Div(
-                    [
-                        graph_div_req,
-                        dbc.Accordion(
-                            [
-                                dbc.AccordionItem(
-                                    title=title,
-                                    children=[
-                                        html.Div(
-                                            [data_table],
-                                            className="inner-accordion-content",
-                                        )
-                                    ],
-                                )
-                            ],
-                            start_collapsed=True,
-                            flush=True,
-                        ),
-                    ],
-                    className="accordion-inner--child",
-                )
-            )
-
-        section_containers.append(
-            html.Div(
-                [
-                    graph_div,
-                    dbc.Accordion(
-                        [
-                            dbc.AccordionItem(
-                                title=f"{section}", children=internal_items
-                            )
-                        ],
-                        start_collapsed=True,
-                        flush=True,
-                    ),
-                ],
-                className="accordion-inner",
-            )
-        )
-
-    return html.Div(section_containers, className="compliance-data-layout")
-
-
 def get_section_containers_format4(data, section_1):
 
     data["STATUS"] = data["STATUS"].apply(map_status_to_icon)

dashboard/compliance/aws_ai_security_framework_aws.py

@@ -1,27 +0,0 @@
-import warnings
-
-from dashboard.common_methods import get_section_containers_3_levels
-
-warnings.filterwarnings("ignore")
-
-
-def get_table(data):
-    aux = data[
-        [
-            "REQUIREMENTS_ATTRIBUTES_SECTION",
-            "REQUIREMENTS_ATTRIBUTES_SUBSECTION",
-            "NAME",
-            "CHECKID",
-            "STATUS",
-            "REGION",
-            "ACCOUNTID",
-            "RESOURCEID",
-        ]
-    ]
-
-    return get_section_containers_3_levels(
-        aux,
-        "REQUIREMENTS_ATTRIBUTES_SECTION",
-        "REQUIREMENTS_ATTRIBUTES_SUBSECTION",
-        "NAME",
-    )

dashboard/compliance/generic.py

@@ -1,44 +0,0 @@
-import warnings
-
-from dashboard.common_methods import (
-    get_section_containers_format4,
-    get_section_containers_generic,
-)
-
-warnings.filterwarnings("ignore")
-
-
-def get_table(data):
-    # Discover REQUIREMENTS_ATTRIBUTES_* columns at runtime.
-    attr_cols = [c for c in data.columns if c.startswith("REQUIREMENTS_ATTRIBUTES_")]
-
-    # Section column (in priority order):
-    #   1. REQUIREMENTS_ATTRIBUTES_SECTION — most common convention
-    #   2. First discovered attribute column — covers novel schemas
-    #   3. None — no section, group flat by requirement id
-    if "REQUIREMENTS_ATTRIBUTES_SECTION" in attr_cols:
-        section_col = "REQUIREMENTS_ATTRIBUTES_SECTION"
-    elif attr_cols:
-        section_col = attr_cols[0]
-    else:
-        section_col = None
-
-    base_cols = [
-        "REQUIREMENTS_ID",
-        "REQUIREMENTS_DESCRIPTION",
-        "STATUS",
-        "CHECKID",
-        "REGION",
-        "ACCOUNTID",
-        "RESOURCEID",
-    ]
-
-    # Two levels (section -> requirement id) when a section distinct from the
-    # id exists; otherwise group flat by requirement id.
-    if section_col and section_col != "REQUIREMENTS_ID":
-        needed = [section_col] + base_cols
-        aux = data[[c for c in needed if c in data.columns]].copy()
-        return get_section_containers_generic(aux, section_col, "REQUIREMENTS_ID")
-
-    aux = data[[c for c in base_cols if c in data.columns]].copy()
-    return get_section_containers_format4(aux, "REQUIREMENTS_ID")

dashboard/lib/layouts.py

@@ -156,7 +156,7 @@ def create_layout_compliance(
                             html.Img(src="assets/favicon.ico", className="w-5 mr-3"),
                             html.Span("Subscribe to Prowler Cloud"),
                         ],
-                        href="https://cloud.prowler.com/",
+                        href="https://prowler.pro/",
                         target="_blank",
                         className="text-prowler-stone-900 inline-flex px-4 py-2 text-xs font-bold uppercase transition-all rounded-lg text-gray-900 hover:bg-prowler-stone-900/10 border-solid border-1 hover:border-prowler-stone-900/10 hover:border-solid hover:border-1 border-prowler-stone-900/10",
                     ),

dashboard/pages/compliance.py

@@ -215,58 +215,6 @@ else:
     )
 
 
-def _ensure_scope_columns(data):
-    """Guarantee ACCOUNTID and REGION exist.
-
-    Scope columns always sit between DESCRIPTION and ASSESSMENTDATE, so derive
-    them positionally for any provider (e.g. Okta's ORGANIZATIONDOMAIN) and
-    fall back to "-" to avoid a KeyError.
-    """
-    cols = list(data.columns)
-    scope = []
-    if "DESCRIPTION" in cols and "ASSESSMENTDATE" in cols:
-        start, end = cols.index("DESCRIPTION") + 1, cols.index("ASSESSMENTDATE")
-        scope = [c for c in cols[start:end] if c not in ("ACCOUNTID", "REGION")]
-
-    if "ACCOUNTID" not in data.columns:
-        if scope:
-            data.rename(columns={scope.pop(0): "ACCOUNTID"}, inplace=True)
-        else:
-            data["ACCOUNTID"] = "-"
-    if "REGION" not in data.columns:
-        if scope:
-            data.rename(columns={scope.pop(0): "REGION"}, inplace=True)
-        else:
-            data["REGION"] = "-"
-    return data
-
-
-def _dispatch_compliance_renderer(data, analytics_input):
-    """Resolve the compliance renderer module and return (table, deduped_data).
-
-    Tries to import the framework-specific builtin module.  On
-    ModuleNotFoundError (dynamic/external provider with no dedicated module),
-    falls back to the generic renderer.  Any other ImportError is re-raised.
-    get_table() is called OUTSIDE the try block so errors inside the renderer
-    surface as real exceptions rather than being swallowed.
-    """
-    current = analytics_input.replace(".", "_")
-    target = f"dashboard.compliance.{current}"
-    try:
-        module = importlib.import_module(target)
-    except ModuleNotFoundError as exc:
-        if exc.name != target:
-            raise
-        from dashboard.compliance import generic as module
-    dedup_columns = ["CHECKID", "STATUS", "RESOURCEID", "STATUSEXTENDED"]
-    if "MUTED" in data.columns:
-        dedup_columns.insert(2, "MUTED")
-    data = data.drop_duplicates(subset=dedup_columns)
-    if "threatscore" in analytics_input:
-        data = get_threatscore_mean_by_pillar(data)
-    return module.get_table(data), data
-
-
 @callback(
     [
         Output("output", "children"),
@@ -344,7 +292,7 @@ def display_data(
         data.rename(columns={"TENANCYID": "ACCOUNTID"}, inplace=True)
 
     # Filter the chosen level of the CIS
-    if is_level_1 and "REQUIREMENTS_ATTRIBUTES_PROFILE" in data.columns:
+    if is_level_1:
         data = data[data["REQUIREMENTS_ATTRIBUTES_PROFILE"].str.contains("Level 1")]
 
     # Rename the column PROJECTID to ACCOUNTID for GCP
@@ -366,9 +314,6 @@ def display_data(
         data.rename(columns={"SUBSCRIPTION": "ACCOUNTID"}, inplace=True)
         data["REGION"] = "-"
 
-    # Normalize scope columns for any remaining (e.g. dynamic) provider.
-    data = _ensure_scope_columns(data)
-
     # Filter ACCOUNT
     if account_filter == ["All"]:
         updated_cloud_account_values = data["ACCOUNTID"].unique()
@@ -464,7 +409,36 @@ def display_data(
         # Check cases where the compliance start with AWS_
         if "aws_" in analytics_input:
             analytics_input = analytics_input + "_aws"
-        table, data = _dispatch_compliance_renderer(data, analytics_input)
+        try:
+            current = analytics_input.replace(".", "_")
+            compliance_module = importlib.import_module(
+                f"dashboard.compliance.{current}"
+            )
+            # Build subset list based on available columns
+            dedup_columns = ["CHECKID", "STATUS", "RESOURCEID", "STATUSEXTENDED"]
+            if "MUTED" in data.columns:
+                dedup_columns.insert(2, "MUTED")
+            data = data.drop_duplicates(subset=dedup_columns)
+
+            if "threatscore" in analytics_input:
+                data = get_threatscore_mean_by_pillar(data)
+
+            table = compliance_module.get_table(data)
+        except ModuleNotFoundError:
+            table = html.Div(
+                [
+                    html.H5(
+                        "No data found for this compliance",
+                        className="card-title",
+                        style={"text-align": "left", "color": "black"},
+                    )
+                ],
+                style={
+                    "width": "99%",
+                    "margin-right": "0.8%",
+                    "margin-bottom": "10px",
+                },
+            )
 
         df = data.copy()
         # Remove Muted rows

dashboard/pages/overview.py

@@ -1538,7 +1538,7 @@ def filter_data(
                     html.Img(src="assets/favicon.ico", className="w-5 mr-3"),
                     html.Span("Subscribe to Prowler Cloud"),
                 ],
-                href="https://cloud.prowler.com/",
+                href="https://prowler.pro/",
                 target="_blank",
                 className="text-prowler-stone-900 inline-flex px-4 py-2 text-xs font-bold uppercase transition-all rounded-lg text-gray-900 hover:bg-prowler-stone-900/10 border-solid border-1 hover:border-prowler-stone-900/10 hover:border-solid hover:border-1 border-prowler-stone-900/10",
             ),

docker-compose-dev.yml

@@ -139,8 +139,6 @@ services:
 
   worker-dev:
     image: prowler-api-dev
-    # Give Celery soft shutdown time to drain/re-queue in-flight tasks on stop.
-    stop_grace_period: 120s
     build:
       context: ./api
       dockerfile: Dockerfile

docker-compose.yml

@@ -129,8 +129,6 @@ services:
 
   worker:
     image: prowlercloud/prowler-api:${PROWLER_API_VERSION:-stable}
-    # Give Celery soft shutdown time to drain/re-queue in-flight tasks on stop.
-    stop_grace_period: 120s
     env_file:
       - path: .env
         required: false

docs/developer-guide/ai-skills.mdx

@@ -8,77 +8,7 @@ This guide explains the AI Skills system that provides on-demand context and pat
 **What are AI Skills?** Skills are structured instructions that help AI agents (Claude Code, Cursor, Copilot, etc.) understand Prowler's conventions, patterns, and best practices.
 </Info>
 
-Skills live in the [`skills/`](https://github.com/prowler-cloud/prowler/tree/master/skills) directory of the Prowler OSS repository. Each skill is a folder containing a `SKILL.md` file with its patterns and metadata.
-
-## Installation
-
-To enable skills for the supported AI coding assistants, run the setup script from the repository root:
-
-```bash
-./skills/setup.sh
-```
-
-The script creates symlinks so each tool finds the skills in its expected location:
-
-| Tool | Created by setup |
-|------|------------------|
-| Claude Code | `.claude/skills/` symlink and `CLAUDE.md` |
-| Gemini CLI | `.gemini/skills/` symlink and `GEMINI.md` |
-| Codex (OpenAI) | `.codex/skills/` symlink (uses `AGENTS.md` natively) |
-| GitHub Copilot | `.github/copilot-instructions.md` symlink to `AGENTS.md` |
-
-After running the setup, restart the AI coding assistant to load the skills.
-
-## Using Skills
-
-AI agents discover skills automatically and load them when a request matches a skill trigger. To load a skill manually during a session, point the agent to the skill's `SKILL.md` file:
-
-```text
-Read skills/{skill-name}/SKILL.md
-```
-
-For the full list of available skills, their triggers, and the Auto-invoke mappings, see the [`skills/README.md`](https://github.com/prowler-cloud/prowler/blob/master/skills/README.md) and [`AGENTS.md`](https://github.com/prowler-cloud/prowler/blob/master/AGENTS.md) in the repository.
-
-## Available Skills
-
-| Type | Skills |
-|------|--------|
-| **Generic** | typescript, react-19, nextjs-16, tailwind-4, pytest, playwright, django-drf, zod-4, zustand-5, ai-sdk-5, vitest, tdd |
-| **Prowler** | prowler, prowler-sdk-check, prowler-api, prowler-ui, prowler-mcp, prowler-provider, prowler-compliance, prowler-compliance-review, prowler-docs, prowler-pr, prowler-ci, prowler-attack-paths-query |
-| **Testing** | prowler-test-sdk, prowler-test-api, prowler-test-ui |
-| **Meta** | skill-creator, skill-sync |
-
-<Note>
-This table is a snapshot. The repository is the source of truth: see [`skills/README.md`](https://github.com/prowler-cloud/prowler/blob/master/skills/README.md) for the current, complete list.
-</Note>
-
-## Skill Structure
-
-Each skill follows the [Agent Skills spec](https://agentskills.io):
-
-```text
-skills/{skill-name}/
-├── SKILL.md          # Patterns, rules, decision trees
-├── assets/           # Code templates, schemas
-└── references/       # Links to local docs (single source of truth)
-```
-
-## Key Design Decisions
-
-1. **Self-contained skills** - Critical patterns inline for fast loading
-2. **Local doc references** - No web URLs, points to `docs/developer-guide/*.mdx`
-3. **Single source of truth** - Skills reference docs, no duplication
-4. **On-demand loading** - AI loads only what's needed for the task
-
-## Creating New Skills
-
-Use the `skill-creator` meta-skill to create new skills that follow the Agent Skills spec. See [`AGENTS.md`](https://github.com/prowler-cloud/prowler/blob/master/AGENTS.md) for the full list of available skills and their triggers.
-
-## How Skills Work
-
-The diagrams below explain the internals of the skill system. They are useful for understanding the design, but are not required to install or use skills.
-
-### Architecture Overview
+## Architecture Overview
 
 ```mermaid
 graph LR
@@ -98,7 +28,7 @@ graph LR
     style F fill:#1a4d2e,stroke:#66bb6a,color:#fff
 ```
 
-### Request Lifecycle
+## How It Works
 
 ```mermaid
 sequenceDiagram
@@ -138,7 +68,7 @@ sequenceDiagram
     A->>U: Creates check with correct patterns
 ```
 
-### With and Without Skills
+## Before vs After
 
 ```mermaid
 graph TD
@@ -166,7 +96,7 @@ graph TD
     style AFTER fill:#1a4d1a,stroke:#66bb6a,color:#fff
 ```
 
-### Full Component Map
+## Complete Architecture
 
 ```mermaid
 flowchart TB
@@ -180,7 +110,7 @@ flowchart TB
         subgraph GENERIC["Generic Skills"]
             G1["typescript"]
             G2["react-19"]
-            G3["nextjs-16"]
+            G3["nextjs-15"]
             G4["tailwind-4"]
             G5["pytest"]
             G6["playwright"]
@@ -256,3 +186,34 @@ flowchart TB
     style STRUCTURE fill:#5c3d1a,stroke:#ffb74d,color:#fff
     style DOCS fill:#1a3d4d,stroke:#4dd0e1,color:#fff
 ```
+
+## Skills Included
+
+| Type | Skills |
+|------|--------|
+| **Generic** | typescript, react-19, nextjs-15, tailwind-4, pytest, playwright, django-drf, zod-4, zustand-5, ai-sdk-5 |
+| **Prowler** | prowler, prowler-sdk-check, prowler-api, prowler-ui, prowler-mcp, prowler-provider, prowler-compliance, prowler-compliance-review, prowler-docs, prowler-pr, prowler-ci |
+| **Testing** | prowler-test-sdk, prowler-test-api, prowler-test-ui |
+| **Meta** | skill-creator, skill-sync |
+
+## Skill Structure
+
+Each skill follows the [Agent Skills spec](https://agentskills.io):
+
+```
+skills/{skill-name}/
+├── SKILL.md          # Patterns, rules, decision trees
+├── assets/           # Code templates, schemas
+└── references/       # Links to local docs (single source of truth)
+```
+
+## Key Design Decisions
+
+1. **Self-contained skills** - Critical patterns inline for fast loading
+2. **Local doc references** - No web URLs, points to `docs/developer-guide/*.mdx`
+3. **Single source of truth** - Skills reference docs, no duplication
+4. **On-demand loading** - AI loads only what's needed for the task
+
+## Creating New Skills
+
+Use the `skill-creator` meta-skill to create new skills that follow the Agent Skills spec. See `AGENTS.md` for the full list of available skills and their triggers.

docs/developer-guide/provider.mdx

@@ -3421,7 +3421,7 @@ Use existing providers as templates, this will help you to understand better the
 - **Documentation & Maintenance**
 
     - **README Updates**: Update provider-specific documentation
-    - **Changelog**: Document changes and new features with a fragment under `prowler/changelog.d/` (see the [Pull Request Template](https://github.com/prowler-cloud/prowler/blob/master/.github/pull_request_template.md))
+    - **Changelog**: Document changes and new features
     - **Examples**: Provide usage examples and common scenarios
     - **Troubleshooting**: Include common issues and solutions
     - **Documentation**: Update the provider documentation to include your new tool provider in the examples and implementation guidance.

docs/developer-guide/security-compliance-framework.mdx

@@ -2,228 +2,40 @@
 title: 'Creating a New Security Compliance Framework in Prowler'
 ---
 
-This guide explains how to add a new security compliance framework to Prowler, end to end. It covers directory layout, the two supported JSON schemas (universal and legacy), the Pydantic models that validate each framework, check mapping conventions, output formatting, local validation, testing, and the pull request process.
+This guide explains how to add a new security compliance framework to Prowler, end to end. It covers directory layout, the JSON schema, check mapping conventions, the Pydantic models that validate each framework, the CSV output formatter, local validation, testing, and the pull request process.
 
 ## Introduction
 
-A compliance framework in Prowler maps a public or custom control catalog (for example CIS, NIST 800-53, PCI DSS, HIPAA, ENS, CCC, DORA) to the security checks that Prowler already runs. Each requirement links to zero, one or more Prowler checks. When a scan executes, findings are aggregated per requirement to produce the compliance report rendered by Prowler CLI and Prowler Cloud.
+A compliance framework in Prowler maps a public or custom control catalog (for example CIS, NIST 800-53, PCI DSS, HIPAA, ENS, CCC) to the security checks that Prowler already runs. Each requirement links to zero, one or more Prowler checks. When a scan executes, findings are aggregated per requirement to produce the compliance report rendered by Prowler CLI and Prowler Cloud.
 
-Prowler ships 85+ compliance frameworks across all providers. The catalog lives under `prowler/compliance/<provider>/` (legacy, per-provider) or `prowler/compliance/` (universal, multi-provider).
+Prowler ships with 85+ compliance frameworks across All Providers. The catalog lives under `prowler/compliance/<provider>/` (or `prowler/compliance/` for universal compliance frameworks)
 
 <Warning>
-A compliance framework must represent the **complete state** of the source catalog. Every requirement defined by the framework has to be present in the JSON file, even when no Prowler check can automate it. In that case, leave the requirement's check list empty, but do not omit the requirement.
+A compliance framework must represent the **complete state** of the source catalog. Every requirement defined by the framework has to be present in the JSON file, even when none of the existing Prowler checks can automate it. In that case, leave `Checks` as an empty array, but do not omit the requirement.
 
 Requirement coverage feeds the compliance percentage calculations and the metadata surfaces (dashboards, widgets, exports). Missing requirements skew those metrics and break the report as a faithful snapshot of the framework.
 </Warning>
 
-### Two supported schemas
-
-| Schema | When to use | File location | Discovered as |
-| --- | --- | --- | --- |
-| **Universal (recommended for new frameworks)** | Multi-provider frameworks, or single-provider frameworks that benefit from declarative table/PDF rendering | `prowler/compliance/<framework>.json` (top-level) | Available for **every** provider whose key appears in any `requirement.checks` dict |
-| **Legacy provider-specific** | Single-provider frameworks with framework-specific attribute classes already declared in the codebase (CIS, ENS, ISO 27001, etc.) | `prowler/compliance/<provider>/<framework>_<version>_<provider>.json` | Available only under that provider |
-
-Auto-discovery happens in `get_bulk_compliance_frameworks_universal(provider)` (`prowler/lib/check/compliance_models.py:915`), which scans **both** the top-level `prowler/compliance/` directory and every per-provider sub-directory. Legacy frameworks are transparently converted to the universal `ComplianceFramework` model via `adapt_legacy_to_universal()` before being returned, so the rest of Prowler — CLI table rendering, CSV/OCSF outputs, PDF generation — works the same regardless of the source schema.
-
-> The legacy entry-point `Compliance.get_bulk(provider)` (used by older code paths) only scans per-provider sub-directories. Universal top-level files are picked up exclusively via the universal loader; this matters if you are wiring a new code path against the legacy API.
-
-For **new** frameworks, prefer the universal schema: it requires no Python code changes, supports multiple providers in a single file, and table/PDF rendering is driven entirely from declarative configuration inside the JSON.
-
-> All Pydantic models in `compliance_models.py` are imported from `pydantic.v1`. Subclasses you add for the legacy schema must use `from pydantic.v1 import BaseModel`.
-
 ### Prerequisites
 
 Before adding a new framework, complete the following checks:
 
-- **Verify the framework is not already supported.** Inspect `prowler/compliance/` and every `prowler/compliance/<provider>/` for an existing JSON file matching the name and version.
+- **Verify the framework is not already supported.** Inspect `prowler/compliance/<provider>/` for an existing JSON file matching the name and version.
 - **Confirm the required checks exist.** Every requirement that can be automated must point to one or more existing Prowler checks. For each missing check, implement it first by following the [Prowler Checks](/developer-guide/checks) guide.
-- **Review a reference framework.** Use an existing framework with a similar structure as your template:
-  - Universal: `prowler/compliance/dora.json`, `prowler/compliance/csa_ccm_4.0.json`.
-  - Legacy: `prowler/compliance/aws/cis_2.0_aws.json` (canonical CIS shape), `prowler/compliance/aws/ccc_aws.json`, `prowler/compliance/aws/ens_rd2022_aws.json`, `prowler/compliance/aws/nist_800_53_revision_5_aws.json`.
+- **Review a reference framework.** Use an existing framework with a similar structure as your template. `cis_2.0_aws.json` is the canonical reference for CIS-style frameworks. `ccc_aws.json`, `ens_rd2022_aws.json`, and `nist_800_53_revision_5_aws.json` illustrate other attribute shapes.
 
-## Universal Compliance Framework
+## Four-Layer Architecture
 
-### Where the file lives
+A compliance framework spans four layers. A complete contribution must touch each layer that applies.
 
-Place the file at the top level of the compliance directory:
+- **Layer 1 – Schema validation:** The Pydantic models in `prowler/lib/check/compliance_models.py` define the canonical schema for each attribute shape (CIS, ENS, Mitre, CCC, C5, CSA CCM, ISO 27001, KISA ISMS-P, AWS Well-Architected, Prowler ThreatScore, and a generic fallback).
+- **Layer 2 – JSON catalog:** The framework JSON file in `prowler/compliance/<provider>/` lists every requirement and maps it to checks.
+- **Layer 3 – Output formatter:** The Python module in `prowler/lib/outputs/compliance/<framework>/` builds the CSV row model, the per-provider transformer, and the CLI summary table.
+- **Layer 4 – Output dispatchers:** The dispatchers in `prowler/lib/outputs/compliance/compliance.py` and `prowler/lib/outputs/compliance/compliance_output.py` route findings to the right formatter based on the framework identifier.
 
-```
-prowler/compliance/<framework_name>.json
-```
+The rest of this guide walks each layer in order.
 
-Examples in the repository: `prowler/compliance/csa_ccm_4.0.json`, `prowler/compliance/dora.json`.
-
-The file is auto-discovered — there is **no** need to register it in any `__init__.py`, modify `prowler/lib/outputs/`, or update any other Python module. The framework key Prowler CLI accepts via `--compliance` is the basename of the JSON file without `.json` (`dora.json` → `dora`).
-
-### Top-level structure
-
-```json
-{
-  "framework": "<short identifier, e.g. \"DORA\" or \"CSA-CCM\">",
-  "name": "<human-readable full name>",
-  "version": "<framework version>",
-  "description": "<one-paragraph description shown in --list-compliance and PDF reports>",
-  "icon": "<short icon slug, optional>",
-  "attributes_metadata": [ /* see below */ ],
-  "outputs": { /* see below — optional */ },
-  "requirements": [ /* see below */ ]
-}
-```
-
-A `provider` field at the top level is **optional**. The framework's effective provider list is derived by `ComplianceFramework.get_providers()` (`compliance_models.py:739`) from the union of all keys appearing in `requirement.checks` across all requirements; the explicit `provider` field is used **only as a fallback** when no requirement carries any `checks` key. This is what enables a single file (e.g. `dora.json`) to cover AWS today and add Azure / GCP / etc. tomorrow without restructuring.
-
-Provider keys inside `requirement.checks` must match the directory names under `prowler/providers/`. The valid keys at present are: `aws`, `azure`, `gcp`, `m365`, `kubernetes`, `iac`, `github`, `googleworkspace`, `alibabacloud`, `cloudflare`, `mongodbatlas`, `nhn`, `openstack`, `oraclecloud`, `llm`. Comparison in `supports_provider()` is case-insensitive, but lowercase is the convention used everywhere in the repository.
-
-### `attributes_metadata`
-
-Declares the shape of the per-requirement `attributes` dict. When this field is present, the root validator `validate_attributes_against_metadata` (`compliance_models.py:669`) enforces the schema at load time and rejects:
-
-- Missing keys marked `required: true`.
-- Keys present in `attributes` but not declared in `attributes_metadata` (typo / drift guard).
-- Values that violate a declared `enum`.
-- Values whose Python type does not match a declared `int`, `float` or `bool`.
-
-The runtime type check **only** covers `int`, `float` and `bool`. For `str`, `list_str` and `list_dict` the type is documentation-only — non-conforming values won't fail validation. If `attributes_metadata` is omitted, **no per-requirement validation runs at all**.
-
-```json
-"attributes_metadata": [
-  {
-    "key": "Pillar",
-    "label": "Pillar",
-    "type": "str",
-    "required": true,
-    "enum": [
-      "ICT Risk Management",
-      "ICT-Related Incident Reporting",
-      "Digital Operational Resilience Testing",
-      "ICT Third-Party Risk Management",
-      "Information Sharing"
-    ],
-    "output_formats": { "csv": true, "ocsf": true }
-  },
-  {
-    "key": "Article",
-    "label": "Article",
-    "type": "str",
-    "required": true,
-    "output_formats": { "csv": true, "ocsf": true }
-  }
-]
-```
-
-Per attribute:
-
-- `key` (required): attribute name as it will appear in `requirement.attributes`.
-- `label`: human-readable label used in CSV headers and PDF.
-- `type`: one of `str`, `int`, `float`, `bool`, `list_str`, `list_dict`. Defaults to `str`.
-- `enum`: optional list of allowed values; non-conforming values are rejected at load time.
-- `required`: if `true`, every requirement must include this key with a non-null value.
-- `enum_display` / `enum_order`: optional per-enum-value visual metadata (label, abbreviation, color, icon) and explicit ordering for PDF rendering.
-- `output_formats`: `{ "csv": <bool>, "ocsf": <bool> }` — toggles inclusion in each output format. Both default to `true`.
-
-### `outputs`
-
-Optional. Controls how the framework is rendered in the console table and in the generated PDF report. Skipping it falls back to sensible defaults.
-
-```json
-"outputs": {
-  "table_config": {
-    "group_by": "Pillar"
-  },
-  "pdf_config": {
-    "language": "en",
-    "primary_color": "#003399",
-    "secondary_color": "#0055A5",
-    "bg_color": "#F0F4FA",
-    "group_by_field": "Pillar",
-    "sections": [ "ICT Risk Management", "ICT-Related Incident Reporting", "..." ],
-    "section_short_names": { "ICT Risk Management": "ICT Risk Mgmt" },
-    "charts": [
-      {
-        "id": "pillar_compliance",
-        "type": "horizontal_bar",
-        "group_by": "Pillar",
-        "title": "Compliance Score by Pillar",
-        "y_label": "Pillar",
-        "x_label": "Compliance %",
-        "value_source": "compliance_percent",
-        "color_mode": "by_value"
-      }
-    ],
-    "filter": { "only_failed": true, "include_manual": false }
-  }
-}
-```
-
-`table_config.group_by` must reference an attribute key declared in `attributes_metadata`. The same applies to `pdf_config.group_by_field` and to every `charts[].group_by`.
-
-For frameworks with weighted scoring (e.g. ThreatScore) declare `pdf_config.scoring` with `risk_field` / `weight_field` / `risk_boost_factor`. For column splitting (e.g. CIS Level 1 vs Level 2) use `table_config.split_by`.
-
-### `requirements`
-
-```json
-"requirements": [
-  {
-    "id": "DORA-Art5",
-    "name": "Governance and organisation",
-    "description": "Financial entities shall have a sound, comprehensive and well-documented ICT internal governance and control framework. ...",
-    "attributes": {
-      "Pillar": "ICT Risk Management",
-      "Article": "Article 5",
-      "ArticleTitle": "Governance and organisation"
-    },
-    "checks": {
-      "aws": [
-        "iam_avoid_root_usage",
-        "iam_no_root_access_key",
-        "iam_root_mfa_enabled"
-      ],
-      "azure": [],
-      "gcp": []
-    }
-  }
-]
-```
-
-Per requirement:
-
-- `id` (required): unique identifier within the framework.
-- `description` (required): the requirement text as authored by the framework.
-- `name`: short title shown alongside the id.
-- `attributes`: flat dict; keys must conform to `attributes_metadata`.
-- `checks`: dict keyed by provider name (the same lowercase keys listed in the previous section). Each value is a list of Prowler check names that evidence this requirement for that provider. The list **may be empty** and the dict itself defaults to `{}` if omitted; either way the requirement is still loaded and listed by `--list-compliance-requirements`, it just has zero checks to execute. Note: there is **no automatic check-existence validation** at load time — referencing a non-existent check name will silently produce a requirement with no findings. Validate this yourself (see "Validating Your Framework" below).
-
-For MITRE-style frameworks, additional optional fields are available on the requirement: `tactics`, `sub_techniques`, `platforms`, `technique_url` (these are populated automatically when adapting a legacy MITRE JSON to the universal model).
-
-### Multi-provider frameworks
-
-A single universal file can cover any number of providers. The framework appears under each provider's `--list-compliance` output as long as **at least one** requirement has that provider key in its `checks` dict.
-
-When extending an existing universal framework with a new provider, the only change required is editing `requirement.checks`:
-
-```diff
- "checks": {
-   "aws": ["iam_avoid_root_usage", "iam_no_root_access_key"],
-+  "azure": ["entra_policy_ensure_mfa_for_admin_roles"]
- }
-```
-
-No code changes, no new file, no registration step.
-
-## Legacy Provider-Specific Compliance Framework
-
-The legacy schema is still fully supported and remains the format used by most frameworks shipped today (CIS, NIST, ISO 27001, FedRAMP, PCI DSS, GDPR, HIPAA, ENS, etc.). It binds a framework to a single provider and validates each requirement against a framework-specific Pydantic attribute class.
-
-The legacy schema spans **four layers** — a complete contribution must touch every layer that applies:
-
-- **Layer 1 — Schema validation:** the Pydantic models in `prowler/lib/check/compliance_models.py` define the canonical schema for each attribute shape.
-- **Layer 2 — JSON catalog:** the framework JSON file in `prowler/compliance/<provider>/` lists every requirement and maps it to checks.
-- **Layer 3 — Output formatter:** the Python module in `prowler/lib/outputs/compliance/<framework>/` builds the CSV row model, the per-provider transformer, and the CLI summary table.
-- **Layer 4 — Output dispatchers:** the dispatchers in `prowler/lib/outputs/compliance/compliance.py` and `prowler/lib/outputs/compliance/compliance_output.py` route findings to the right formatter based on the framework identifier.
-
-The universal schema collapses Layers 3 and 4 into declarative configuration inside the JSON — that is the main reason it is preferred for new contributions.
-
-### Directory structure and file naming
+## Directory Structure and File Naming
 
 Compliance frameworks live at:
 
@@ -234,8 +46,8 @@ prowler/compliance/<provider>/<framework>_<version>_<provider>.json
 The filename conventions are:
 
 - All lowercase, words separated with underscores.
-- `<provider>` is a supported provider identifier (same lowercase list as the universal section above).
-- `<version>` is optional but recommended. Omit only when the framework has no versioning (e.g. `ccc_aws.json`).
+- `<provider>` is a supported provider identifier: `aws`, `azure`, `gcp`, `kubernetes`, `m365`, `github`, `googleworkspace`, `alibabacloud`, `oraclecloud`, `cloudflare`, `mongodbatlas`, `nhn`, `openstack`, `iac`, `llm`.
+- `<version>` is optional. Omit it when the framework has no versioning, as in `ccc_aws.json`.
 - The file basename (without `.json`) is the framework key that Prowler CLI accepts via `--compliance`.
 
 Examples:
@@ -250,50 +62,48 @@ The output formatter directory mirrors the framework name:
 
 ```
 prowler/lib/outputs/compliance/<framework>/
-├── <framework>.py            # CLI summary-table dispatcher
+├── <framework>.py           # CLI summary-table dispatcher
 ├── <framework>_<provider>.py # Per-provider transformer class
 ├── models.py                 # Pydantic CSV row model
 └── __init__.py
 ```
 
-### JSON schema reference
+## JSON Schema Reference
 
-Every legacy compliance file is a JSON document with the following top-level keys. `Framework`, `Name` and `Provider` are validated non-empty by the root validator `framework_and_provider_must_not_be_empty` (`compliance_models.py:329`).
+Every compliance file is a JSON document with the following top-level keys.
 
 | Field | Type | Required | Description |
 |---|---|---|---|
 | `Framework` | string | Yes | Canonical framework identifier, for example `CIS`, `NIST-800-53-Revision-5`, `ENS`, `CCC`. |
 | `Name` | string | Yes | Human-readable framework name displayed by Prowler App. |
-| `Version` | string | Yes (recommended) | Framework version, e.g. `2.0`. See [Version Handling](#version-handling). |
+| `Version` | string | Yes | Framework version, for example `2.0`. Use an empty string only for frameworks without versioning. See [Version Handling](#version-handling). |
 | `Provider` | string | Yes | Upper-cased provider identifier: `AWS`, `AZURE`, `GCP`, `KUBERNETES`, `M365`, `GITHUB`, `GOOGLEWORKSPACE`, and so on. |
 | `Description` | string | Yes | Short description of the framework's scope and purpose. |
 | `Requirements` | array | Yes | List of [requirement objects](#requirement-object). |
 
-#### Requirement Object
+### Requirement Object
 
 Each entry in `Requirements` describes one control or requirement.
 
 | Field | Type | Required | Description |
 |---|---|---|---|
 | `Id` | string | Yes | Unique identifier within the framework, for example `1.10` or `CCC.Core.CN01.AR01`. |
-| `Name` | string | No | Optional human-readable name (frameworks like NIST distinguish control name from description). |
+| `Name` | string | No | Optional human-readable name used by frameworks that distinguish control name from description, such as NIST. |
 | `Description` | string | Yes | Verbatim description from the source framework. |
 | `Attributes` | array | Yes | List of [attribute objects](#attribute-objects). The shape depends on the framework. |
 | `Checks` | array of strings | Yes | Prowler check identifiers that automate the requirement. Leave the list empty when the control cannot be automated. |
 
-#### Attribute Objects
+### Attribute Objects
 
-`Attributes` is parsed against the union declared in `Compliance_Requirement.Attributes` (`compliance_models.py:293`). Pydantic v1 tries each member of the union in declaration order and falls back to `Generic_Compliance_Requirement_Attribute` (the last entry) when nothing else matches — so a brand-new shape that doesn't match any existing class will silently be accepted as Generic, losing its specific fields.
+Attributes carry the metadata that Prowler App and the CSV output display for each requirement. The object shape is framework-specific and is validated by a dedicated Pydantic model in `prowler/lib/check/compliance_models.py`. The most common shapes are summarized below.
 
-As of today, the registered attribute classes are: `CIS_Requirement_Attribute`, `ENS_Requirement_Attribute`, `ASDEssentialEight_Requirement_Attribute`, `ISO27001_2013_Requirement_Attribute`, `AWS_Well_Architected_Requirement_Attribute`, `KISA_ISMSP_Requirement_Attribute`, `Prowler_ThreatScore_Requirement_Attribute`, `CCC_Requirement_Attribute`, `C5Germany_Requirement_Attribute`, `CSA_CCM_Requirement_Attribute`, and `Generic_Compliance_Requirement_Attribute` (fallback). MITRE-style frameworks use the separate `Mitre_Requirement` model with `Tactics` / `SubTechniques` / `Platforms` / `TechniqueURL` at the requirement top level. The most common shapes are summarized below.
-
-##### CIS_Requirement_Attribute
+#### CIS_Requirement_Attribute
 
 Used by every CIS benchmark.
 
 | Field | Type | Required | Notes |
 |---|---|---|---|
-| `Section` | string | Yes | Top-level section, e.g. `1 Identity and Access Management`. |
+| `Section` | string | Yes | Top-level section, for example `1 Identity and Access Management`. |
 | `SubSection` | string | No | Optional second-level grouping. |
 | `Profile` | enum | Yes | One of `Level 1`, `Level 2`, `E3 Level 1`, `E3 Level 2`, `E5 Level 1`, `E5 Level 2`. |
 | `AssessmentStatus` | enum | Yes | `Manual` or `Automated`. |
@@ -306,7 +116,7 @@ Used by every CIS benchmark.
 | `DefaultValue` | string | No | Default configuration value, when relevant. |
 | `References` | string | Yes | Colon-separated list of reference URLs. |
 
-##### ENS_Requirement_Attribute
+#### ENS_Requirement_Attribute
 
 Used by the Spanish ENS (Esquema Nacional de Seguridad) frameworks.
 
@@ -322,13 +132,13 @@ Used by the Spanish ENS (Esquema Nacional de Seguridad) frameworks.
 | `ModoEjecucion` | string | Yes | Execution mode (`manual`, `automático`, `híbrido`). |
 | `Dependencias` | array of strings | Yes | Ids of prerequisite controls. Empty list when none. |
 
-##### CCC_Requirement_Attribute
+#### CCC_Requirement_Attribute
 
 Used by the Common Cloud Controls Catalog.
 
 | Field | Type | Required | Notes |
 |---|---|---|---|
-| `FamilyName` | string | Yes | Control family, e.g. `Data`. |
+| `FamilyName` | string | Yes | Control family, for example `Data`. |
 | `FamilyDescription` | string | Yes | Description of the family. |
 | `Section` | string | Yes | Section title. |
 | `SubSection` | string | Yes | Subsection title, or empty string. |
@@ -338,9 +148,9 @@ Used by the Common Cloud Controls Catalog.
 | `SectionThreatMappings` | array of objects | Yes | Each entry has `ReferenceId` and `Identifiers`. |
 | `SectionGuidelineMappings` | array of objects | Yes | Each entry has `ReferenceId` and `Identifiers`. |
 
-##### Generic_Compliance_Requirement_Attribute
+#### Generic_Compliance_Requirement_Attribute
 
-The fallback attribute model used when no framework-specific schema applies (e.g. NIST 800-53, PCI DSS, GDPR, HIPAA). It is **always the last** element of the `Compliance_Requirement.Attributes` Union; that ordering is load-bearing.
+The fallback attribute model used when no framework-specific schema applies (for example NIST 800-53, PCI DSS, GDPR, HIPAA).
 
 | Field | Type | Required | Notes |
 |---|---|---|---|
@@ -348,17 +158,17 @@ The fallback attribute model used when no framework-specific schema applies (e.g
 | `Section` | string | No | Section name. |
 | `SubSection` | string | No | Subsection name. |
 | `SubGroup` | string | No | Subgroup name. |
-| `Service` | string | No | Affected service, e.g. `iam`. |
+| `Service` | string | No | Affected service, for example `aws`, `iam`. |
 | `Type` | string | No | Control type. |
 | `Comment` | string | No | Free-form comment. |
 
-For the remaining attribute classes (`AWS_Well_Architected_Requirement_Attribute`, `ISO27001_2013_Requirement_Attribute`, `Mitre_Requirement_Attribute_<Provider>`, `KISA_ISMSP_Requirement_Attribute`, `Prowler_ThreatScore_Requirement_Attribute`, `C5Germany_Requirement_Attribute`, `CSA_CCM_Requirement_Attribute`) consult `prowler/lib/check/compliance_models.py` for the full field sets.
+Additional per-framework attribute models exist for `AWS_Well_Architected_Requirement_Attribute`, `ISO27001_2013_Requirement_Attribute`, `Mitre_Requirement_Attribute_<Provider>`, `KISA_ISMSP_Requirement_Attribute`, `Prowler_ThreatScore_Requirement_Attribute`, `C5Germany_Requirement_Attribute`, and `CSA_CCM_Requirement_Attribute`. Consult `prowler/lib/check/compliance_models.py` for their full field sets.
 
 <Note>
-The `Attributes` field is a Pydantic `Union`. The generic attribute model **must** remain the last element of that Union — otherwise Pydantic v1 silently coerces every framework into the generic shape and your specialized fields are dropped. Adding a brand-new attribute shape requires inserting the Pydantic class **before** `Generic_Compliance_Requirement_Attribute`.
+The `Attributes` field is a Pydantic `Union`. The generic attribute model must remain the last element of that Union, otherwise Pydantic v1 silently coerces every framework into the generic shape and your specialized fields are dropped.
 </Note>
 
-#### Minimal working example
+## Minimal Working Example
 
 The following snippet is a complete, valid framework file named `my_framework_1.0_aws.json`, saved at `prowler/compliance/aws/my_framework_1.0_aws.json`. It uses the generic attribute shape for simplicity.
 
@@ -404,26 +214,26 @@ The following snippet is a complete, valid framework file named `my_framework_1.
 }
 ```
 
-### Mapping checks to requirements
+## Mapping Checks to Requirements
 
 Each requirement links to the Prowler checks that, together, produce a PASS or FAIL verdict for that control.
 
-- **Include every requirement from the source catalog.** The framework file must mirror the full control list, one-to-one. Compliance percentages, dashboards, and exported metadata are computed against the total requirement count.
-- List every check by its canonical identifier — the value of `CheckID` inside the check's `.metadata.json` file.
+- **Include every requirement from the source catalog.** The framework file must mirror the full control list, one-to-one. Compliance percentages, dashboards, and exported metadata are computed against the total requirement count, so omitting an unmappable control inflates coverage and misrepresents the framework.
+- List every check by its canonical identifier, the value of `CheckID` inside the check's `.metadata.json` file.
 - One requirement can reference multiple checks. The requirement is evaluated as FAIL when any referenced check produces a FAIL finding for a resource in scope.
-- Leave `Checks` (legacy) or `checks.<provider>` (universal) as an empty array when the requirement cannot be automated. The requirement still appears in the report and contributes to the total.
+- Leave `Checks` as an empty array when the requirement cannot be automated. The requirement still appears in the report, contributes to the total, and resolves to `MANUAL`. An empty mapping is valid; a missing requirement is not.
 - Reuse checks across requirements when the same control applies in multiple places. Do not duplicate check logic to match framework structure.
-- Avoid referencing checks from a different provider. A legacy compliance file is bound to one provider, and cross-provider checks will never match findings in the scan.
+- Avoid referencing checks from a different provider. A compliance file is bound to one provider, and cross-provider checks will never match findings in the scan.
 
-To discover available checks:
+To discover available checks, run:
 
 ```bash
 uv run python prowler-cli.py <provider> --list-checks
 ```
 
-### Supporting multiple providers (legacy)
+## Supporting Multiple Providers
 
-The legacy schema binds each file to a single provider. To cover several providers with the same framework, ship one JSON file per provider:
+Each compliance file targets a single provider. To cover several providers with the same framework (for example CIS across AWS, Azure, and GCP), ship one JSON file per provider:
 
 ```
 prowler/compliance/aws/cis_2.0_aws.json
@@ -431,15 +241,15 @@ prowler/compliance/azure/cis_2.0_azure.json
 prowler/compliance/gcp/cis_2.0_gcp.json
 ```
 
-Keep the `Framework` and `Version` values identical across the files so the dispatcher matches them; change only the `Provider`, `Checks`, and provider-specific metadata. The CIS output formatter already supports every provider listed above.
+Keep the `Framework` and `Version` values identical across the files so the dispatcher matches them, and change only the `Provider`, `Checks`, and provider-specific metadata.
 
-For a brand-new framework that spans several providers, **prefer the universal schema** — it covers every provider from a single file. If you must use the legacy schema, add one transformer per provider in `prowler/lib/outputs/compliance/<framework>/` and extend the summary-table dispatcher accordingly. See [Output Formatter](#output-formatter).
+The CIS output formatter already supports every provider listed above. For a brand-new framework that spans several providers, add one transformer per provider in `prowler/lib/outputs/compliance/<framework>/` and extend the summary-table dispatcher accordingly. See [Output Formatter](#output-formatter).
 
-### Output formatter
+## Output Formatter
 
-Legacy frameworks render in two forms: a detailed CSV report written to disk, and a summary table printed in the CLI. Both are produced by the output formatter package for the framework. Universal frameworks do **not** need a Python output formatter — the `outputs` config inside the JSON drives rendering — so this section applies only to the legacy schema.
+Prowler renders every compliance framework in two forms: a detailed CSV report written to disk, and a summary table printed in the CLI. Both are produced by the output formatter package for the framework.
 
-For a new legacy framework named `my_framework`, create:
+For a new framework named `my_framework`, create:
 
 ```
 prowler/lib/outputs/compliance/my_framework/
@@ -449,19 +259,19 @@ prowler/lib/outputs/compliance/my_framework/
 └── models.py                  # CSV row Pydantic model
 ```
 
-#### Step 1 — Define the CSV row model
+### Step 1 – Define the CSV Row Model
 
 In `models.py`, declare a Pydantic v1 model with one field per CSV column. Use existing models such as `AWSCISModel` in `prowler/lib/outputs/compliance/cis/models.py` as the reference. Fields typically include `Provider`, `Description`, `AccountId`, `Region`, `AssessmentDate`, `Requirements_Id`, `Requirements_Description`, one `Requirements_Attributes_*` field per attribute key, plus the finding fields `Status`, `StatusExtended`, `ResourceId`, `ResourceName`, `CheckId`, `Muted`, `Framework`, `Name`.
 
-#### Step 2 — Implement the transformer
+### Step 2 – Implement the Transformer Class
 
 In `my_framework_aws.py`, subclass `ComplianceOutput` from `prowler.lib.outputs.compliance.compliance_output` and implement `transform(findings, compliance, compliance_name)`. Iterate over `findings`, match each finding to the requirements it satisfies through `finding.compliance.get(compliance_name, [])`, and append one row per attribute to `self._data`.
 
-#### Step 3 — Add the summary-table dispatcher
+### Step 3 – Add the Summary-Table Dispatcher
 
 In `my_framework.py`, implement `get_my_framework_table(findings, bulk_checks_metadata, compliance_framework, output_filename, output_directory, compliance_overview)` following the pattern in `prowler/lib/outputs/compliance/cis/cis.py`.
 
-#### Step 4 — Register the framework in the dispatchers
+### Step 4 – Register the Framework in the Dispatchers
 
 - Add the dispatcher call in `prowler/lib/outputs/compliance/compliance.py`, inside `display_compliance_table`, with a branch such as `elif "my_framework" in compliance_framework:`.
 - Register the CSV model and transformer in `prowler/lib/outputs/compliance/compliance_output.py` so the CSV file is emitted during the scan.
@@ -470,94 +280,49 @@ In `my_framework.py`, implement `get_my_framework_table(findings, bulk_checks_me
 For NIST-style catalogs that use `Generic_Compliance_Requirement_Attribute`, no custom formatter is needed. The generic formatter in `prowler/lib/outputs/compliance/generic/` handles them automatically, provided the JSON validates against the generic attribute schema.
 </Note>
 
-### Legacy-to-universal adapter
-
-At load time, every legacy file is transparently adapted to a `ComplianceFramework` via `adapt_legacy_to_universal()` (`compliance_models.py:819`), which: (a) flattens the first element of `Attributes` into a flat `attributes` dict, (b) wraps `Checks` as `{provider_lower: [...]}`, (c) infers `attributes_metadata` from the matched Pydantic class via `_infer_attribute_metadata()`. The rest of Prowler (CSV/OCSF/PDF output, CLI table) then treats both formats identically.
-
-Loader-error behaviour differs between the two entry points:
-
-- `load_compliance_framework()` (legacy) is **fail-fast**: it calls `sys.exit(1)` on any `ValidationError` (`compliance_models.py:464`).
-- `load_compliance_framework_universal()` is more lenient — it logs the error and returns `None`, so `get_bulk_compliance_frameworks_universal()` simply skips the broken file and keeps loading the rest.
-
-## Version handling
+## Version Handling
 
 Prowler matches frameworks by concatenating `Framework` and `Version`. A missing or empty `Version` collapses several frameworks to the same key and breaks CLI filtering with `--compliance`.
 
-- Always set `Version` (or `version` for universal frameworks) to a non-empty string, even for frameworks that rename editions rather than version them. Use the edition identifier (for example `RD2022`, `v2025.10`, `4.0`, `2022/2554`).
+- Always set `Version` to a non-empty string, even for frameworks that rename editions rather than version them. Use the edition identifier (for example `RD2022`, `v2025.10`, `4.0`).
 - When the source catalog has no version, use the first year of adoption or the release date.
-- For **legacy** files, make sure the version substring embedded in the filename matches `Version`, because the CLI dispatcher reads `compliance_framework.split("_")[1]` to select the correct version.
+- Make sure the version substring embedded in the filename matches `Version`, because the CLI dispatcher reads `compliance_framework.split("_")[1]` to select the correct version.
 
-## Validating Your Framework
+## Validating the Framework Locally
 
-Before opening a PR, validate the JSON loads cleanly against the model and that every referenced check actually exists.
+Follow the steps below before opening a pull request.
 
-### 1. Schema validation
-
-For **universal** frameworks, load the file and inspect what was parsed. The framework key inside `bulk` is the **basename of the JSON file** (without `.json`); for `prowler/compliance/dora.json` that key is `dora`, for `prowler/compliance/aws/cis_5.0_aws.json` it is `cis_5.0_aws`.
-
-```python
-from prowler.lib.check.compliance_models import (
-    load_compliance_framework_universal,
-    get_bulk_compliance_frameworks_universal,
-)
-
-fw = load_compliance_framework_universal("prowler/compliance/<your_framework>.json")
-assert fw is not None, "load returned None — check the logs for the validation error"
-print(fw.framework, len(fw.requirements), fw.get_providers())
-
-bulk = get_bulk_compliance_frameworks_universal("aws")
-assert "<your_framework_filename_without_json>" in bulk
-```
-
-### 2. Check existence cross-check
-
-There is **no automatic check-existence validation** at load time. Cross-check that every check name in your framework maps to a real check directory:
-
-```python
-import os
-real = set()
-for svc in os.listdir("prowler/providers/aws/services"):
-    svc_path = f"prowler/providers/aws/services/{svc}"
-    if not os.path.isdir(svc_path):
-        continue
-    for entry in os.listdir(svc_path):
-        if os.path.isfile(f"{svc_path}/{entry}/{entry}.metadata.json"):
-            real.add(entry)
-
-referenced = {c for r in fw.requirements for c in r.checks.get("aws", [])}
-missing = referenced - real
-assert not missing, f"checks referenced in framework but not found in repo: {sorted(missing)}"
-```
-
-### 3. CLI smoke test
+### 1. Run the Compliance Model Validator
 
 ```bash
 uv run python prowler-cli.py <provider> --list-compliance
 ```
 
-The framework must appear in the output. A validation error indicates a schema mismatch.
+The framework must appear in the output. A validation error indicates a schema mismatch between the JSON file and the attribute model.
+
+### 2. Run a Scan Filtered by the Framework
 
 ```bash
 uv run python prowler-cli.py <provider> \
-  --compliance <framework_key> \
+  --compliance <framework>_<version>_<provider> \
   --log-level ERROR
 ```
 
 Verify that:
 
 - Prowler produces a CSV file under `output/compliance/` with the expected name.
-- The CLI summary table lists every section / pillar of the framework.
+- The CLI summary table lists every section in the framework.
 - Findings roll up under the expected requirements.
 
-### 4. Inspect the CSV output
+### 3. Inspect the CSV Output
 
 Open the generated CSV and confirm:
 
-- All columns defined in `models.py` (legacy) or in `attributes_metadata` (universal) appear.
-- Every requirement has at least one row per scanned resource (when there are findings).
-- Attribute values such as `Requirements_Attributes_Section` reflect the JSON content.
+- All columns defined in `models.py` appear.
+- Every requirement has at least one row per scanned resource.
+- Values such as `Requirements_Attributes_Section` reflect the JSON content.
 
-### 5. Verify the framework in Prowler App
+### 4. Verify the Framework in Prowler App
 
 Launch Prowler App locally (`docker compose up` from the repository root) and run a scan with the new compliance framework. Confirm the compliance page renders the requirements, sections, and status widgets correctly.
 
@@ -566,7 +331,7 @@ Launch Prowler App locally (`docker compose up` from the repository root) and ru
 Compliance contributions require two layers of tests.
 
 - **Schema tests** exercise the Pydantic models. Extend `tests/lib/check/universal_compliance_models_test.py` with a case that loads the new JSON file and asserts the attribute type matches the expected model.
-- **Output tests** (legacy frameworks only) exercise the transformer. Mirror the structure under `tests/lib/outputs/compliance/<framework>/` with fixtures that feed synthetic findings through the transformer and assert the resulting CSV rows.
+- **Output tests** exercise the transformer. Mirror the structure under `tests/lib/outputs/compliance/<framework>/` with fixtures that feed synthetic findings through the transformer and assert the resulting CSV rows.
 
 Run the suite with:
 
@@ -577,20 +342,7 @@ uv run pytest -n auto tests/lib/check/universal_compliance_models_test.py \
 
 For guidance on writing Prowler SDK tests, refer to [Unit Testing](/developer-guide/unit-testing).
 
-## Running and listing your framework
-
-Once the file is in place, the CLI auto-discovers it:
-
-```sh
-prowler <provider> --list-compliance                                            # framework appears in the list
-prowler <provider> --compliance <framework_key> --list-checks
-prowler <provider> --compliance <framework_key>                                 # full scan + compliance report
-prowler <provider> --compliance <framework_key> --list-compliance-requirements <framework_key>
-```
-
-For end-user-facing tutorials (recommended for high-profile frameworks), add a dedicated page under `docs/user-guide/compliance/tutorials/` and register it in the `"Compliance"` group of `docs/docs.json`. See `docs/user-guide/compliance/tutorials/threatscore.mdx` as a reference.
-
-## Submitting the pull request
+## Submitting the Pull Request
 
 Before opening the pull request:
 
@@ -599,32 +351,29 @@ Before opening the pull request:
     uv run pre-commit run --all-files
     uv run pytest -n auto
     ```
-2. Add a changelog fragment `prowler/changelog.d/<slug>.added.md`, describing the new framework and the providers it covers (no PR link in the text; it is attached automatically at release time).
-3. Follow the [Pull Request Template](https://github.com/prowler-cloud/prowler/blob/master/.github/pull_request_template.md) and set the PR title using Conventional Commits, e.g. `feat(compliance): add My Framework 1.0 for AWS`.
+2. Add a changelog entry under the `### 🚀 Added` section of `prowler/CHANGELOG.md`, describing the new framework and the providers it covers.
+3. Follow the [Pull Request Template](https://github.com/prowler-cloud/prowler/blob/master/.github/pull_request_template.md) and set the PR title using Conventional Commits, for example `feat(compliance): add My Framework 1.0 for AWS`.
 4. Request review from the compliance codeowners listed in `.github/CODEOWNERS`.
 
 ## Troubleshooting
 
 The following issues are the most common when contributing a compliance framework.
 
-- **`ValidationError: field required` during scan (legacy).** The JSON is missing a required attribute field. Re-check the matching Pydantic model in `prowler/lib/check/compliance_models.py`.
-- **All attributes collapse to `Generic_Compliance_Requirement_Attribute` values (legacy).** The Pydantic `Union` is ordered incorrectly, or the JSON matches only the generic shape. Keep the generic model in the last Union position and ensure every required field is present in the JSON.
-- **`attributes_metadata validation failed` (universal).** The root validator in `compliance_models.py:669` rejected the file. The error message lists each offending requirement; common causes are unknown attribute keys (typo or missing entry in `attributes_metadata`), enum violations, or missing required keys.
-- **`--compliance` filter does not find the framework.** For legacy: the filename does not match `<framework>_<version>_<provider>.json`, the version is empty, or the file lives outside `prowler/compliance/<provider>/`. For universal: the file is not at the top level of `prowler/compliance/` or it loaded as `None` (check logs for the validation error).
-- **CLI summary table is empty but the CSV is populated (legacy).** The dispatcher branch in `prowler/lib/outputs/compliance/compliance.py` is missing or its substring match does not catch the framework key.
-- **CSV file is missing after the scan (legacy).** The transformer class is not registered in `prowler/lib/outputs/compliance/compliance_output.py`, or `transform()` raises silently. Run the scan with `--log-level DEBUG`.
-- **Findings do not roll up under a requirement.** A check listed in `Checks` either does not exist for that provider or is spelled incorrectly. Run `--list-checks | grep <check_name>` to confirm, or run the check-existence cross-check from "Validating Your Framework".
+- **`ValidationError: field required` during scan.** The JSON is missing a required attribute field. Re-check the matching Pydantic model in `prowler/lib/check/compliance_models.py`.
+- **All attributes collapse to `Generic_Compliance_Requirement_Attribute` values.** The Pydantic `Union` is ordered incorrectly, or the JSON matches only the generic shape. Move the generic model to the last Union position and ensure every required field is present in the JSON.
+- **`--compliance` filter does not find the framework.** The filename does not match the expected pattern `<framework>_<version>_<provider>.json`, the version is empty, or the file lives outside `prowler/compliance/<provider>/`.
+- **CLI summary table is empty but the CSV is populated.** The dispatcher branch in `prowler/lib/outputs/compliance/compliance.py` is missing or its substring match does not catch the framework key.
+- **CSV file is missing after the scan.** The transformer class is not registered in `prowler/lib/outputs/compliance/compliance_output.py`, or `transform()` raises silently. Run the scan with `--log-level DEBUG`.
+- **Findings do not roll up under a requirement.** A check listed in `Checks` either does not exist for that provider or is spelled incorrectly. Run `--list-checks | grep <check_name>` to confirm.
 
-## Reference examples
+## Reference Examples
 
 Use the following files as templates when modeling a new contribution.
 
-- `prowler/compliance/dora.json` — universal schema, single-provider populated (AWS), ready to extend with more providers.
-- `prowler/compliance/csa_ccm_4.0.json` — universal schema, multi-provider populated (AWS, Azure, GCP, AlibabaCloud, OracleCloud).
-- `prowler/compliance/aws/cis_2.0_aws.json` — legacy CIS attribute shape.
-- `prowler/compliance/aws/nist_800_53_revision_5_aws.json` — legacy generic attribute shape.
-- `prowler/compliance/aws/ccc_aws.json` — legacy CCC attribute shape.
-- `prowler/compliance/azure/ens_rd2022_azure.json` — legacy ENS attribute shape.
-- `prowler/lib/check/compliance_models.py` — canonical Pydantic schemas for both formats.
-- `prowler/lib/outputs/compliance/cis/` — reference implementation of a multi-provider legacy output formatter.
-- `prowler/lib/outputs/compliance/generic/` — reference implementation of a legacy generic output formatter.
+- `prowler/compliance/aws/cis_2.0_aws.json` – CIS attribute shape.
+- `prowler/compliance/aws/nist_800_53_revision_5_aws.json` – Generic attribute shape.
+- `prowler/compliance/aws/ccc_aws.json` – CCC attribute shape.
+- `prowler/compliance/azure/ens_rd2022_azure.json` – ENS attribute shape.
+- `prowler/lib/check/compliance_models.py` – Canonical Pydantic schemas.
+- `prowler/lib/outputs/compliance/cis/` – Reference implementation of a multi-provider output formatter.
+- `prowler/lib/outputs/compliance/generic/` – Reference implementation of a generic output formatter.

docs/getting-started/installation/prowler-app.mdx

@@ -20,8 +20,7 @@ Refer to the [Prowler App Tutorial](/user-guide/tutorials/prowler-app) for detai
 
     _Commands_:
 
-    <CodeGroup>
-    ```bash macOS/Linux
+    ```bash
     VERSION=$(curl -s https://api.github.com/repos/prowler-cloud/prowler/releases/latest | jq -r .tag_name)
     curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${VERSION}/docker-compose.yml"
     # Environment variables can be customized in the .env file. Using default values in production environments is not recommended.
@@ -29,15 +28,6 @@ Refer to the [Prowler App Tutorial](/user-guide/tutorials/prowler-app) for detai
     docker compose up -d
     ```
 
-    ```powershell Windows PowerShell
-    $VERSION = (Invoke-RestMethod -Uri "https://api.github.com/repos/prowler-cloud/prowler/releases/latest").tag_name
-    Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/docker-compose.yml" -OutFile "docker-compose.yml"
-    # Environment variables can be customized in the .env file. Using default values in production environments is not recommended.
-    Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/.env" -OutFile ".env"
-    docker compose up -d
-    ```
-    </CodeGroup>
-
     <Callout icon="lock" iconType="regular" color="#e74c3c">
       For a secure setup, the API auto-generates a unique key pair, `DJANGO_TOKEN_SIGNING_KEY` and `DJANGO_TOKEN_VERIFYING_KEY`, and stores it in `~/.config/prowler-api` (non-container) or the bound Docker volume in `_data/api` (container). Never commit or reuse static/default keys. To rotate keys, delete the stored key files and restart the API.
     </Callout>
@@ -128,8 +118,8 @@ To update the environment file:
 Edit the `.env` file and change version values:
 
 ```env
-PROWLER_UI_VERSION="5.30.0"
-PROWLER_API_VERSION="5.30.0"
+PROWLER_UI_VERSION="5.28.0"
+PROWLER_API_VERSION="5.28.0"
 ```
 
 <Note>

docs/getting-started/installation/prowler-cli.mdx

@@ -40,6 +40,12 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
     pip install prowler
     prowler -v
     ```
+
+    To upgrade Prowler to the latest version:
+
+    ``` bash
+    pip install --upgrade prowler
+    ```
   </Tab>
   <Tab title="Docker">
     _Requirements_:
@@ -164,68 +170,6 @@ To install Prowler as a Python package, use `Python >= 3.10, <= 3.12`. Prowler i
   </Tab>
 </Tabs>
 
-## Updating Prowler CLI
-
-Upgrade Prowler CLI to the latest release using the same method chosen for installation:
-
-<Tabs>
-  <Tab title="pipx">
-    ```bash
-    pipx upgrade prowler
-    prowler -v
-    ```
-  </Tab>
-  <Tab title="pip">
-    ```bash
-    pip install --upgrade prowler
-    prowler -v
-    ```
-  </Tab>
-  <Tab title="Docker">
-    Pull the desired image tag to fetch the latest version:
-
-    ```bash
-    docker pull toniblyx/prowler:latest
-    ```
-
-    <Note>
-      Replace `latest` with a specific release tag (for example, `stable` or `<x.y.z>`) to pin a version. Refer to the [Container Versions](#container-versions) section for the full list of available tags.
-    </Note>
-  </Tab>
-  <Tab title="GitHub">
-    Pull the latest changes and sync the environment:
-
-    ```bash
-    cd prowler
-    git pull
-    uv sync
-    uv run python prowler-cli.py -v
-    ```
-
-    <Note>
-      To upgrade to a specific release, check out the corresponding tag before syncing: `git checkout <x.y.z>`.
-    </Note>
-  </Tab>
-  <Tab title="Brew">
-    ```bash
-    brew upgrade prowler
-    prowler -v
-    ```
-  </Tab>
-  <Tab title="CloudShell">
-    Both AWS CloudShell and Azure CloudShell install Prowler with `pipx`, so the upgrade command is the same:
-
-    ```bash
-    pipx upgrade prowler
-    prowler -v
-    ```
-  </Tab>
-</Tabs>
-
-<Note>
-  To install a specific version instead of the latest release, pin it explicitly. For example, with `pipx`: `pipx install prowler==<x.y.z>`, or with `pip`: `pip install prowler==<x.y.z>`. The available releases are listed in the [Releases GitHub section](https://github.com/prowler-cloud/prowler/releases).
-</Note>
-
 ## Container Versions
 
 The available versions of Prowler CLI are the following:

docs/getting-started/installation/prowler-mcp.mdx

@@ -141,45 +141,6 @@ Choose one of the following installation methods:
 
 ---
 
-## Updating Prowler MCP Server
-
-When running Prowler MCP Server locally ("Option 2: Run Locally"), upgrade to the latest version using the same method chosen for installation. The hosted server (`https://mcp.prowler.com/mcp`) is always kept up to date by Prowler and requires no action.
-
-<Tabs>
-  <Tab title="Docker">
-    Pull the latest image and restart the container:
-
-    ```bash
-    docker pull prowlercloud/prowler-mcp
-    ```
-
-    <Note>
-      Recreate any running container after pulling the new image so the updated version takes effect.
-    </Note>
-  </Tab>
-  <Tab title="From Source">
-    Pull the latest changes and sync the dependencies:
-
-    ```bash
-    cd prowler/mcp_server
-    git pull
-    uv sync
-    uv run prowler-mcp --help
-    ```
-  </Tab>
-  <Tab title="Build Docker Image">
-    Pull the latest source and rebuild the image:
-
-    ```bash
-    cd prowler/mcp_server
-    git pull
-    docker build -t prowler-mcp .
-    ```
-  </Tab>
-</Tabs>
-
----
-
 ## Command Line Options
 
 The Prowler MCP Server supports the following command-line arguments:

docs/user-guide/providers/okta/authentication.mdx

@@ -35,28 +35,14 @@ The bundled checks require the following read-only scopes:
 - `okta.policies.read`
 - `okta.brands.read`
 - `okta.apps.read`
-- `okta.authenticators.read`
-- `okta.networkZones.read`
-- `okta.apiTokens.read`
-- `okta.roles.read`
-- `okta.groups.read`
-- `okta.logStreams.read`
-- `okta.idps.read`
 
 Additional scopes will be needed as more services and checks are added. These are the current ones needed:
 
 | Scope | Used by |
 |---|---|
-| `okta.policies.read` | Sign-on, password, authentication, and `USER_LIFECYCLE` (Workflow > Automations) policies |
+| `okta.policies.read` | Sign-on, password, and authentication policies |
 | `okta.brands.read` | Sign-in page customizations (DOD Notice and Consent Banner check) |
 | `okta.apps.read` | First-party app settings (Okta Admin Console session), integrated app inventory, and the Authentication Policies bound to Okta applications |
-| `okta.authenticators.read` | Okta authenticator configuration, including Okta Verify and Smart Card IdP |
-| `okta.networkZones.read` | Network Zone inventory, anonymized-proxy blocklist checks, and API token Network Zone validation |
-| `okta.apiTokens.read` | API token metadata and token network conditions |
-| `okta.roles.read` | Admin role assignments for API token owners (both direct and group-inherited) |
-| `okta.groups.read` | Group memberships of API token owners, used to resolve admin roles inherited via group assignment (e.g. Super Admin granted through the default admin group) |
-| `okta.logStreams.read` | Log Stream configuration (`/api/v1/logStreams`) |
-| `okta.idps.read` | Identity Providers, including Smart Card (X509) IdPs (`/api/v1/idps`) |
 
 ### Required Admin Role
 
@@ -82,9 +68,7 @@ Okta filters the first-party apps (`saasure`, `okta_enduser`) out of `/api/v1/ap
 
 A fifth check — `application_admin_console_session_idle_timeout_15min` (STIG V-273187) — also requires Super Administrator: it calls `GET /api/v1/first-party-app-settings/admin-console`, which returns `403 E0000006` for every role below Super Administrator.
 
-`user_inactivity_automation_35d_enabled` (STIG V-273188) reads `USER_LIFECYCLE` policies (`list_policies(type='USER_LIFECYCLE')`) using the `okta.policies.read` scope. The Read-Only Administrator role is enough to list them; no Super Administrator requirement.
-
-When the service app runs with Read-Only Administrator, the checks listed in this section return **MANUAL** instead of PASS/FAIL — the rest of the scan keeps running.
+When the service app runs with Read-Only Administrator, the five checks listed in this section return **MANUAL** instead of PASS/FAIL — the rest of the scan keeps running.
 
 <Note>
 Read-Only Administrator stays the recommended default for the least-privilege framing that aligns with DISA STIG. Assign Super Administrator on a separate run when full coverage of the first-party app checks is needed.
@@ -138,7 +122,7 @@ Okta displays the private key **only once**. If you close the modal without copy
 
 ### 5. Grant the required OAuth scopes
 
-On the app, open the **Okta API Scopes** tab and click **Grant** on every scope Prowler needs. The bundled checks require `okta.policies.read`, `okta.brands.read`, `okta.apps.read`, `okta.authenticators.read`, `okta.networkZones.read`, `okta.apiTokens.read`, `okta.roles.read`, `okta.groups.read`, `okta.logStreams.read`, and `okta.idps.read`.
+On the app, open the **Okta API Scopes** tab and click **Grant** on every scope Prowler needs. The bundled checks require `okta.policies.read`, `okta.brands.read`, and `okta.apps.read`.
 
 ![Okta — grant OAuth scopes](/user-guide/providers/okta/images/grant-permissions.png)
 
@@ -174,8 +158,8 @@ export OKTA_PRIVATE_KEY_FILE="/secure/path/to/prowler-okta.pem"
 # or
 export OKTA_PRIVATE_KEY="$(cat /secure/path/to/prowler-okta.pem)"
 
-# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read"
-export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read"
+# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read"
+export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read"
 
 uv run python prowler-cli.py okta
 ```
@@ -216,7 +200,7 @@ Prowler validates credentials at startup by listing one sign-on policy. This err
 
 Raised when the credential probe succeeds at the OAuth layer but the request is rejected because the service app lacks the required scope or admin role:
 
-- **`invalid_scope`** — one of the requested scopes (`okta.policies.read`, `okta.brands.read`, `okta.apps.read`, `okta.authenticators.read`, `okta.networkZones.read`, `okta.apiTokens.read`, `okta.roles.read`, `okta.groups.read`, `okta.logStreams.read`, and `okta.idps.read`) is not granted on the service app. Grant the missing scope from **Okta API Scopes**.
+- **`invalid_scope`** — one of the requested scopes (`okta.policies.read`, `okta.brands.read`, or `okta.apps.read`) is not granted on the service app. Grant the missing scope from **Okta API Scopes**.
 - **`Forbidden` / `not authorized`** — no admin role is assigned to the service app. Assign **Read-Only Administrator** (or **Super Administrator** for the first-party application checks) from **Admin roles**.
 
 ### Application-service checks return MANUAL on first-party apps

docs/user-guide/providers/okta/getting-started-okta.mdx

@@ -12,7 +12,7 @@ Set up authentication for Okta with the [Okta Authentication](/user-guide/provid
 
 - An Okta organization. The UI examples below use **Identity Engine** terminology such as **Global Session Policy**; Classic Engine exposes the equivalent sign-on policy concepts under older names.
 - A **Super Administrator** account on that organization for the one-time service-app setup.
-- An **API Services** app integration in the Okta Admin Console with the `okta.policies.read`, `okta.brands.read`, `okta.apps.read`, `okta.authenticators.read`, `okta.networkZones.read`, `okta.apiTokens.read`, `okta.roles.read`, `okta.groups.read`, `okta.logStreams.read`, and `okta.idps.read` scopes granted and an admin role assigned. **Read-Only Administrator** covers the Sign-On, Network, API Token, User, System Log, and Identity Provider checks, and runs the per-app application network-zone check against the apps the service app can see (under Read-Only Administrator that is typically only the service app's own row — the rest of the org's app inventory stays invisible). **Super Administrator** is required additionally to evaluate the five first-party application checks (Okta Admin Console / Okta Dashboard idle timeout, MFA, phishing-resistant authentication) and to widen the application network-zone check to the full app inventory — see [Okta Authentication](/user-guide/providers/okta/authentication#required-admin-role) for the full breakdown.
+- An **API Services** app integration in the Okta Admin Console with the `okta.policies.read`, `okta.brands.read`, and `okta.apps.read` scopes granted and an admin role assigned. **Read-Only Administrator** covers every `signon` check and runs the per-app network-zone check against the apps the service app can see (under Read-Only Administrator that is typically only the service app's own row — the rest of the org's app inventory stays invisible). **Super Administrator** is required additionally to evaluate the five first-party application checks (Okta Admin Console / Okta Dashboard idle timeout, MFA, phishing-resistant authentication) and to widen the network-zone check to the full app inventory — see [Okta Authentication](/user-guide/providers/okta/authentication#required-admin-role) for the full breakdown.
 - Python 3.10+ and Prowler 5.27.0 or later installed locally.
 
 <CardGroup cols={2}>
@@ -85,8 +85,8 @@ Follow the [Okta Authentication](/user-guide/providers/okta/authentication) guid
 export OKTA_ORG_DOMAIN="acme.okta.com"
 export OKTA_CLIENT_ID="0oa1234567890abcdef"
 export OKTA_PRIVATE_KEY_FILE="/secure/path/to/prowler-okta.pem"
-# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read"
-export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read"
+# Optional — defaults to "okta.policies.read,okta.brands.read,okta.apps.read"
+export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read"
 ```
 
 The private key file may contain either a PEM-encoded RSA key or a JWK JSON document.
@@ -143,16 +143,10 @@ prowler okta --config-file /path/to/config.yaml
 
 Prowler for Okta includes security checks across the following services:
 
-| Service               | Description                                                                                                                                           |
-| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
-| **Sign-On**           | Global session policy controls (idle timeout, lifetime, rule priority and ordering)                                                                   |
-| **Application**       | Okta Admin Console sign-on settings plus Authentication Policy controls for Okta applications (session idle, MFA, phishing resistance, network zones) |
-| **Authenticator**     | Password Policy controls plus Okta Verify FIPS and Smart Card IdP authenticator status                                                                |
-| **Network**           | Network Zone blocklists for anonymized proxy sources                                                                                                  |
-| **API Token**         | API token owner-role validation and Network Zone restrictions                                                                                         |
-| **User**              | User lifecycle automations (inactivity-based deprovisioning)                                                                                          |
-| **System Log**        | Log Stream configuration that off-loads audit records to a central SIEM                                                                               |
-| **Identity Provider** | Identity Providers, including Smart Card (X509) IdP status and certificate-chain visibility                                                           |
+| Service         | Description                                                                                                                            |
+| --------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
+| **Sign-On**     | Global session policy controls (idle timeout, lifetime, rule priority and ordering)                                                    |
+| **Application** | Okta Admin Console sign-on settings plus Authentication Policy controls for Okta applications (session idle, MFA, phishing resistance, network zones) |
 
 ## Troubleshooting
 
@@ -164,29 +158,22 @@ This is stricter than simply finding the same timeout value somewhere else in th
 
 ### Default Scopes
 
-Prowler requests a fixed set of OAuth scopes on every token exchange. The defaults cover every bundled check across the Sign-On, Application, Authenticator, Network, API Token, User, System Log, and Identity Provider services:
+Prowler requests a fixed set of OAuth scopes on every token exchange. The defaults cover every bundled check across the Sign-On and Application services:
 
 - `okta.policies.read`
 - `okta.brands.read`
 - `okta.apps.read`
-- `okta.authenticators.read`
-- `okta.networkZones.read`
-- `okta.apiTokens.read`
-- `okta.roles.read`
-- `okta.groups.read`
-- `okta.logStreams.read`
-- `okta.idps.read`
 
-The service app must have these scopes granted in the **Okta API Scopes** tab. `okta.groups.read` is required so the API token Super Admin check can resolve admin roles inherited via group membership; without it the check falls back to direct-only role assignments and emits a best-effort caveat. When the granted set is narrower than the requested set, the token request fails with an `invalid_scope` error and the scan stops at provider initialization.
+The service app must have these scopes granted in the **Okta API Scopes** tab. When the granted set is narrower than the requested set, the token request fails with an `invalid_scope` error and the scan stops at provider initialization.
 
 When additional checks are enabled — or when running against a service app that exposes a different scope set — override the default with `OKTA_SCOPES` (comma-separated string for the env var) or `--okta-scopes` (space-separated list for the CLI):
 
 ```bash
 # Environment variable — comma-separated
-export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read,okta.authenticators.read,okta.networkZones.read,okta.apiTokens.read,okta.roles.read,okta.groups.read,okta.logStreams.read,okta.idps.read,okta.users.read"
+export OKTA_SCOPES="okta.policies.read,okta.brands.read,okta.apps.read,okta.users.read"
 
 # CLI flag — space-separated
-prowler okta --okta-scopes okta.policies.read okta.brands.read okta.apps.read okta.authenticators.read okta.networkZones.read okta.apiTokens.read okta.roles.read okta.groups.read okta.logStreams.read okta.idps.read okta.users.read
+prowler okta --okta-scopes okta.policies.read okta.brands.read okta.apps.read okta.users.read
 ```
 
 For the full catalog of OAuth scopes exposed by the Okta Management API, refer to the [Okta OAuth 2.0 scopes documentation](https://developer.okta.com/docs/api/oauth2/).

docs/user-guide/tutorials/prowler-app-rbac.mdx

@@ -47,11 +47,7 @@ Follow these steps to remove a user of your account:
 1. Navigate to **Users** from the side menu.
 2. Click the delete button of your current user.
 
-> **Note: Each user can only delete their own account, regardless of their permissions. For this reason, the delete button is only shown on your own row and not on other users' rows.**
-
-Deleting a user removes the **entire user account** from Prowler, not just its membership in your organization. Because a single account can belong to more than one tenant, allowing one administrator to delete it outright could affect organizations they don't manage and irreversibly remove another person's identity. To keep this destructive action under the control of the account owner, the API only permits a user to delete themselves (it rejects any other target with a `400` response), and the UI mirrors this by showing the delete button exclusively on your own row.
-
-To remove **another** user from your organization, use the [_Expel from organization_](/user-guide/tutorials/prowler-app-multi-tenant#expelling-a-user-from-an-organization) action instead. Expelling removes the user's membership, role grants, and active sessions for your tenant only, and deletes the underlying account just for that user if your organization was their last remaining membership. This action is reserved for tenant **owners**.
+> **Note: Each user will be able to delete himself and not others, regardless of his permissions.**
 
 <img src="/images/prowler-app/rbac/user_remove.png" alt="Remove User" width="700" />
 

mcp_server/CHANGELOG.md

@@ -2,8 +2,6 @@
 
 All notable changes to the **Prowler MCP Server** are documented in this file.
 
-<!-- changelog: release notes start -->
-
 ## [0.7.2] (Prowler v5.28.1)
 
 ### 🐞 Fixed

mcp_server/changelog.d/README.md

@@ -1,10 +0,0 @@
-# Changelog fragments
-
-Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
-
-- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
-- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
-- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
-- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
-
-Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.

mcp_server/towncrier.toml

@@ -1,39 +0,0 @@
-[tool.towncrier]
-directory = "changelog.d"
-filename = "CHANGELOG.md"
-start_string = "<!-- changelog: release notes start -->\n"
-title_format = "## [{version}] ({name})"
-issue_format = "[(#{issue})](https://github.com/prowler-cloud/prowler/pull/{issue})"
-template = "../.github/towncrier/template.md.jinja"
-underlines = ["", "", ""]
-ignore = [".gitkeep", "README.md"]
-
-[[tool.towncrier.type]]
-directory = "added"
-name = "🚀 Added"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "changed"
-name = "🔄 Changed"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "deprecated"
-name = "⚠️ Deprecated"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "removed"
-name = "❌ Removed"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "fixed"
-name = "🐞 Fixed"
-showcontent = true
-
-[[tool.towncrier.type]]
-directory = "security"
-name = "🔐 Security"
-showcontent = true

osv-scanner.toml

@@ -12,9 +12,8 @@ reason = """
 CVE-2025-45768 is disputed by the pyjwt maintainers. The advisory describes
 weak encryption, but the underlying issue is that callers may pick a short
 HMAC secret — key-length enforcement is the application's responsibility, not
-a defect in the library. We are on pyjwt 2.13.0 (which now also emits an
-InsecureKeyLengthWarning for short HMAC secrets) and enforce key strength in
-our own auth code, so this advisory does not apply.
+a defect in the library. We are on pyjwt 2.12.1 (latest at pin time) and
+enforce key strength in our own auth code, so this advisory does not apply.
 Re-evaluate when a non-disputed advisory or upstream fix lands.
 """
 

prowler/CHANGELOG.md

@@ -2,89 +2,26 @@
 
 All notable changes to the **Prowler SDK** are documented in this file.
 
-<!-- changelog: release notes start -->
-
-## [5.30.0] (Prowler v5.30.0)
-
-### 🚀 Added
-
-- DISA Okta IDaaS STIG V1R2 compliance framework for the Okta provider, with a dedicated CSV output formatter and terminal summary table [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
-- `sagemaker_models_monitor_enabled` check for AWS provider, verifying that each SageMaker monitoring schedule is in the `Scheduled` state so data and model drift is actively detected [(#11278)](https://github.com/prowler-cloud/prowler/pull/11278)
-- DORA (Digital Operational Resilience Act, Regulation (EU) 2022/2554) universal compliance framework with AWS provider coverage across the five DORA pillars [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
-- Okta authenticator and password policy checks for STIG-aligned hardening requirements [(#11465)](https://github.com/prowler-cloud/prowler/pull/11465)
-- Okta network zone check to detect whether anonymized proxy traffic is blocked [(#11463)](https://github.com/prowler-cloud/prowler/pull/11463)
-- Okta API token checks for super admin ownership and network zone restrictions [(#11464)](https://github.com/prowler-cloud/prowler/pull/11464)
-- Support for external/custom providers, checks, and compliance frameworks without modifying core code [(#10700)](https://github.com/prowler-cloud/prowler/pull/10700)
-- `elbv2_alb_drop_invalid_header_fields_enabled` check for AWS provider, verifying Application Load Balancers have `routing.http.drop_invalid_header_fields.enabled` set to `true` to mitigate HTTP desync attacks (AWS FSBP ELB.4) [(#11471)](https://github.com/prowler-cloud/prowler/pull/11471)
-- `user`, `systemlog` and `idp` service for Okta provider with `user_inactivity_automation_35d_enabled`, `systemlog_streaming_enabled` and `idp_smart_card_dod_approved_ca` checks [(#11496)](https://github.com/prowler-cloud/prowler/pull/11496)
-- External multi-provider compliance frameworks can be registered via the `prowler.compliance.universal` entry point group [(#11490)](https://github.com/prowler-cloud/prowler/pull/11490)
-- AWS AI Security Framework support in the CLI dashboard [(#11475)](https://github.com/prowler-cloud/prowler/pull/11475)
-- `entra_service_principal_privileged_role_no_owners` check for M365 provider, failing when a service principal with a permanent Tier 0 directory role has owners on the service principal or its parent app registration [(#11070)](https://github.com/prowler-cloud/prowler/issues/11070)
-- `kms_key_rotation_max_90_days` check for GCP provider, verifying KMS customer-managed keys are rotated every 90 days or less in line with the CIS Benchmark [(#11516)](https://github.com/prowler-cloud/prowler/pull/11516)
-- `exchange_mailbox_primary_smtp_uses_custom_domain` check for M365 provider [(#11215)](https://github.com/prowler-cloud/prowler/pull/11215)
-- `bedrock_agent_role_least_privilege` check for AWS provider, flagging Bedrock Agent execution roles with full-access managed policies, broad `Resource:*` inline statements, or missing permissions boundaries [(#11335)](https://github.com/prowler-cloud/prowler/pull/11335)
-- STACKIT ObjectStorage service with Object Lock, default retention policy, and access key expiration checks [(#11397)](https://github.com/prowler-cloud/prowler/pull/11397)
-
-### 🐞 Fixed
-
-- `load_and_validate_config_file` now unwraps namespaced config for every built-in and external provider, and no longer leaks the full file as the provider's config when the file is namespaced [(#10700)](https://github.com/prowler-cloud/prowler/pull/10700)
-- `entra_users_mfa_capable` no longer flags pre-provisioned users with future `employeeHireDate`; future-hire date comparisons now tolerate naive datetimes [(#11511)](https://github.com/prowler-cloud/prowler/pull/11511)
-- M365 Admin Center group enumeration now follows Microsoft Graph pagination so group-scoped checks include groups beyond the first page [(#11510)](https://github.com/prowler-cloud/prowler/pull/11510)
-- GCP `kms_key_rotation_enabled` check now only verifies that automatic key rotation is enabled (any interval) instead of enforcing a 90-day period, resolving the mismatch between the check and its documentation; the CIS, Prowler ThreatScore, and CCC requirements that mandate a 90-day maximum were remapped to the new `kms_key_rotation_max_90_days` check [(#11516)](https://github.com/prowler-cloud/prowler/pull/11516)
-- AWS CloudWatch log metric filter checks now validate `filterPattern` clauses regardless of order [(#11345)](https://github.com/prowler-cloud/prowler/pull/11345)
-- AWS `bedrock_api_key_no_long_term_credentials` now applies severity per finding (never-expires keys correctly flag as critical, no leak across findings) and aligns title and wording with AWS guidance to prefer short-term Bedrock API keys [(#11526)](https://github.com/prowler-cloud/prowler/pull/11526)
-
-### 🔐 Security
-
-- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
-
----
-
-## [5.29.3] (Prowler v5.29.3)
-
-### 🐞 Fixed
-
-- GCP `logging_sink_created` now recognizes organization-level aggregated sinks with `includeChildren=True`, avoiding false failures for covered projects [(#11355)](https://github.com/prowler-cloud/prowler/pull/11355)
-- GCP `logging_log_metric_filter_and_alert_*` checks now recognize organization-level aggregated sinks with `includeChildren=True`, no longer false-failing projects covered by a central bucket-scoped metric + alert [(#11488)](https://github.com/prowler-cloud/prowler/pull/11488)
-- Jira integration no longer fails with `400 INVALID_INPUT` when a finding has empty fields [(#11474)](https://github.com/prowler-cloud/prowler/pull/11474)
-- GCP `iam_service_account_unused` now passes disabled service accounts instead of failing them, since a disabled account cannot authenticate or be used [(#11467)](https://github.com/prowler-cloud/prowler/pull/11467)
-
----
-
-## [5.29.1] (Prowler v5.29.1)
-
-### 🐞 Fixed
-
-- OCSF output writer now re-raises I/O errors (e.g. `ENOSPC`) instead of logging them per finding and leaving a truncated file [(#11421)](https://github.com/prowler-cloud/prowler/pull/11421)
-
----
-
-## [5.29.0] (Prowler v5.29.0)
+## [5.29.0] (Prowler UNRELEASED)
 
 ### 🚀 Added
 
 - `application` service for Okta provider with `application_admin_console_session_idle_timeout_15min`, `application_admin_console_mfa_required`, `application_admin_console_phishing_resistant_authentication`, `application_dashboard_mfa_required`, `application_dashboard_phishing_resistant_authentication`, and `application_authentication_policy_network_zone_enforced` checks [(#11358)](https://github.com/prowler-cloud/prowler/pull/11358)
 - AWS AI Security Framework compliance for AWS provider [(#11353)](https://github.com/prowler-cloud/prowler/pull/11353)
 - `storage_account_public_network_access_disabled` check for Azure provider and remapped the Azure CIS "Public Network Access is Disabled" requirements to it [(#11334)](https://github.com/prowler-cloud/prowler/pull/11334)
-- StackIT provider with service account key authentication [(#9237)](https://github.com/prowler-cloud/prowler/pull/9237)
+- StackIT provider now authenticates with a service account key, either as a file path (`--stackit-service-account-key-path` / `STACKIT_SERVICE_ACCOUNT_KEY_PATH`) or as inline JSON content (`--stackit-service-account-key` / `STACKIT_SERVICE_ACCOUNT_KEY`, intended for CI/CD with a secret manager); the StackIT SDK refreshes access tokens internally, replacing the short-lived `STACKIT_API_TOKEN` flow [(#9237)](https://github.com/prowler-cloud/prowler/pull/9237)
 - 8 Rules service checks for Google Workspace provider using the Cloud Identity Policy API [(#11379)](https://github.com/prowler-cloud/prowler/pull/11379)
 - 12 Security service checks for Google Workspace provider using the Cloud Identity Policy API [(#11356)](https://github.com/prowler-cloud/prowler/pull/11356)
 
-### ⚠️ Deprecated
-
-- `s3_bucket_default_encryption` check for AWS provider since SSE-S3 is automatically applied to all S3 buckets by AWS as of January 5, 2023 and can no longer be disabled [(#11230)](https://github.com/prowler-cloud/prowler/pull/11230)
-
 ### 🐞 Fixed
 
-- Broken documentation URLs in Google Workspace check metadata [(#11405)](https://github.com/prowler-cloud/prowler/pull/11405)
 - ENS RD 311/2022 (AWS) compliance mapping: `vpc_different_regions` was uncorrectly mapped under the `mp.com.4` family (Network segregation). That check is now mapped to a new `op.cont.2.aws.vpc.1` requirement under the Continuity of Service control [(#11372)](https://github.com/prowler-cloud/prowler/pull/11372)
 - Compliance CSV row count now matches the UI per requirement by sourcing rows from the framework JSON's `requirement.Checks` instead of the stale `finding.compliance` snapshot [(#11370)](https://github.com/prowler-cloud/prowler/pull/11370)
 - OpenStack provider exception codes moved from the `10000-10999` range, shared with the AlibabaCloud provider, to the free `17000-17999` range to keep error codes unambiguous [(#11382)](https://github.com/prowler-cloud/prowler/pull/11382)
-- Azure provider authentication against sovereign clouds (`AzureChinaCloud`, `AzureUSGovernment`) [(#10284)](https://github.com/prowler-cloud/prowler/pull/10284)
 
 ---
 
-## [5.28.1] (Prowler v5.28.1)
+## [5.28.1] (Prowler 5.28.1)
 
 ### 🐞 Fixed
 

prowler/__main__.py

@@ -10,6 +10,7 @@ from colorama import Fore, Style
 from colorama import init as colorama_init
 
 from prowler.config.config import (
+    EXTERNAL_TOOL_PROVIDERS,
     cloud_api_base_url,
     csv_file_suffix,
     get_available_compliance_frameworks,
@@ -19,7 +20,7 @@ from prowler.config.config import (
     orange_color,
     sarif_file_suffix,
 )
-from prowler.lib.banner import print_banner, print_prowler_cloud_banner
+from prowler.lib.banner import print_banner
 from prowler.lib.check.check import (
     exclude_checks_to_run,
     exclude_services_to_run,
@@ -84,6 +85,11 @@ from prowler.lib.outputs.compliance.compliance import (
     display_compliance_table,
     process_universal_compliance_frameworks,
 )
+from prowler.lib.outputs.compliance.csa.csa_alibabacloud import AlibabaCloudCSA
+from prowler.lib.outputs.compliance.csa.csa_aws import AWSCSA
+from prowler.lib.outputs.compliance.csa.csa_azure import AzureCSA
+from prowler.lib.outputs.compliance.csa.csa_gcp import GCPCSA
+from prowler.lib.outputs.compliance.csa.csa_oraclecloud import OracleCloudCSA
 from prowler.lib.outputs.compliance.ens.ens_aws import AWSENS
 from prowler.lib.outputs.compliance.ens.ens_azure import AzureENS
 from prowler.lib.outputs.compliance.ens.ens_gcp import GCPENS
@@ -102,9 +108,6 @@ from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_azure import (
     AzureMitreAttack,
 )
 from prowler.lib.outputs.compliance.mitre_attack.mitre_attack_gcp import GCPMitreAttack
-from prowler.lib.outputs.compliance.okta_idaas_stig.okta_idaas_stig_okta import (
-    OktaIDaaSSTIG,
-)
 from prowler.lib.outputs.compliance.prowler_threatscore.prowler_threatscore_alibaba import (
     ProwlerThreatScoreAlibaba,
 )
@@ -202,15 +205,14 @@ def prowler():
 
     if not args.no_banner:
         legend = args.verbose or getattr(args, "fixer", None)
-        print_banner(legend, provider)
+        print_banner(legend)
 
     # We treat the compliance framework as another output format
     if compliance_framework:
         args.output_formats.extend(compliance_framework)
-    # If no input compliance framework, set all, unless a specific service or check is input.
-    # Skip for tool-wrapper providers (iac, llm, image, and any external plug-in
-    # declaring `is_external_tool_provider = True`) — they don't use compliance frameworks.
-    elif default_execution and not Provider.is_tool_wrapper_provider(provider):
+    # If no input compliance framework, set all, unless a specific service or check is input
+    # Skip for IAC and LLM providers that don't use compliance frameworks
+    elif default_execution and provider not in ["iac", "llm"]:
         args.output_formats.extend(get_available_compliance_frameworks(provider))
 
     # Set Logger configuration
@@ -248,7 +250,7 @@ def prowler():
     universal_frameworks = {}
 
     # Skip compliance frameworks for external-tool providers
-    if not Provider.is_tool_wrapper_provider(provider):
+    if provider not in EXTERNAL_TOOL_PROVIDERS:
         bulk_compliance_frameworks = Compliance.get_bulk(provider)
         # Complete checks metadata with the compliance framework specification
         bulk_checks_metadata = update_checks_metadata_with_compliance(
@@ -316,7 +318,7 @@ def prowler():
         sys.exit()
 
     # Skip service and check loading for external-tool providers
-    if not Provider.is_tool_wrapper_provider(provider):
+    if provider not in EXTERNAL_TOOL_PROVIDERS:
         # Import custom checks from folder
         if checks_folder:
             custom_checks = parse_checks_from_folder(global_provider, checks_folder)
@@ -439,20 +441,6 @@ def prowler():
         output_options = ScalewayOutputOptions(
             args, bulk_checks_metadata, global_provider.identity
         )
-    else:
-        # Dynamic fallback: any external/custom provider
-        try:
-            output_options = global_provider.get_output_options(
-                args, bulk_checks_metadata
-            )
-        except NotImplementedError:
-            # No provider-specific OutputOptions: use the generic default so the
-            # run still produces output instead of aborting.
-            from prowler.providers.common.models import default_output_options
-
-            output_options = default_output_options(
-                global_provider, args, bulk_checks_metadata
-            )
 
     # Run the quick inventory for the provider if available
     if hasattr(args, "quick_inventory") and args.quick_inventory:
@@ -462,7 +450,7 @@ def prowler():
     # Execute checks
     findings = []
 
-    if Provider.is_tool_wrapper_provider(provider):
+    if provider in EXTERNAL_TOOL_PROVIDERS:
         # For external-tool providers, run the scan directly
         if provider == "llm":
 
@@ -472,19 +460,12 @@ def prowler():
 
             findings = global_provider.run_scan(streaming_callback=streaming_callback)
         else:
-            if provider == "image":
-                try:
-                    findings = global_provider.run()
-                except ImageBaseException as error:
-                    logger.critical(f"{error}")
-                    sys.exit(1)
-            else:
-                # IAC and external tool-wrapper providers registered via entry
-                # points. Unexpected failures propagate to the outer except
-                # Exception backstop further down in this file — keeping the
-                # branch free of an Image-specific catch that would otherwise
-                # mislead plug-in authors reading this code.
+            # Original behavior for IAC and Image
+            try:
                 findings = global_provider.run()
+            except ImageBaseException as error:
+                logger.critical(f"{error}")
+                sys.exit(1)
             # Note: External tool providers don't support granular progress tracking since
             # they run external tools as a black box and return all findings at once.
             # Progress tracking would just be 0% → 100%.
@@ -825,6 +806,18 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(c5)
                 c5.batch_write_data_to_file()
+            elif compliance_name == "csa_ccm_4.0_aws":
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                csa_ccm_4_0_aws = AWSCSA(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(csa_ccm_4_0_aws)
+                csa_ccm_4_0_aws.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -928,6 +921,18 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(c5_azure)
                 c5_azure.batch_write_data_to_file()
+            elif compliance_name == "csa_ccm_4.0_azure":
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                csa_ccm_4_0_azure = AzureCSA(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(csa_ccm_4_0_azure)
+                csa_ccm_4_0_azure.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -1031,6 +1036,18 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(c5_gcp)
                 c5_gcp.batch_write_data_to_file()
+            elif compliance_name == "csa_ccm_4.0_gcp":
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                csa_ccm_4_0_gcp = GCPCSA(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(csa_ccm_4_0_gcp)
+                csa_ccm_4_0_gcp.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -1265,6 +1282,18 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(cis)
                 cis.batch_write_data_to_file()
+            elif compliance_name == "csa_ccm_4.0_oraclecloud":
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                csa_ccm_4_0_oraclecloud = OracleCloudCSA(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(csa_ccm_4_0_oraclecloud)
+                csa_ccm_4_0_oraclecloud.batch_write_data_to_file()
             else:
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -1293,6 +1322,18 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(cis)
                 cis.batch_write_data_to_file()
+            elif compliance_name == "csa_ccm_4.0_alibabacloud":
+                filename = (
+                    f"{output_options.output_directory}/compliance/"
+                    f"{output_options.output_filename}_{compliance_name}.csv"
+                )
+                csa_ccm_4_0_alibabacloud = AlibabaCloudCSA(
+                    findings=finding_outputs,
+                    compliance=bulk_compliance_frameworks[compliance_name],
+                    file_path=filename,
+                )
+                generated_outputs["compliance"].append(csa_ccm_4_0_alibabacloud)
+                csa_ccm_4_0_alibabacloud.batch_write_data_to_file()
             elif compliance_name == "prowler_threatscore_alibabacloud":
                 filename = (
                     f"{output_options.output_directory}/compliance/"
@@ -1317,57 +1358,6 @@ def prowler():
                 )
                 generated_outputs["compliance"].append(generic_compliance)
                 generic_compliance.batch_write_data_to_file()
-    elif provider == "okta":
-        for compliance_name in input_compliance_frameworks:
-            if compliance_name.startswith("okta_idaas_stig"):
-                # Generate Okta IDaaS STIG Finding Object
-                filename = (
-                    f"{output_options.output_directory}/compliance/"
-                    f"{output_options.output_filename}_{compliance_name}.csv"
-                )
-                okta_idaas_stig = OktaIDaaSSTIG(
-                    findings=finding_outputs,
-                    compliance=bulk_compliance_frameworks[compliance_name],
-                    file_path=filename,
-                )
-                generated_outputs["compliance"].append(okta_idaas_stig)
-                okta_idaas_stig.batch_write_data_to_file()
-            else:
-                filename = (
-                    f"{output_options.output_directory}/compliance/"
-                    f"{output_options.output_filename}_{compliance_name}.csv"
-                )
-                generic_compliance = GenericCompliance(
-                    findings=finding_outputs,
-                    compliance=bulk_compliance_frameworks[compliance_name],
-                    file_path=filename,
-                )
-                generated_outputs["compliance"].append(generic_compliance)
-                generic_compliance.batch_write_data_to_file()
-    else:
-        # Dynamic fallback: any external/custom provider
-        try:
-            global_provider.generate_compliance_output(
-                finding_outputs,
-                bulk_compliance_frameworks,
-                input_compliance_frameworks,
-                output_options,
-                generated_outputs,
-            )
-        except NotImplementedError:
-            # Last resort: generic compliance
-            for compliance_name in input_compliance_frameworks:
-                filename = (
-                    f"{output_options.output_directory}/compliance/"
-                    f"{output_options.output_filename}_{compliance_name}.csv"
-                )
-                generic_compliance = GenericCompliance(
-                    findings=finding_outputs,
-                    compliance=bulk_compliance_frameworks[compliance_name],
-                    file_path=filename,
-                )
-                generated_outputs["compliance"].append(generic_compliance)
-                generic_compliance.batch_write_data_to_file()
 
     # AWS Security Hub Integration
     if provider == "aws":
@@ -1476,10 +1466,6 @@ def prowler():
                     f"\nDetailed compliance results are in {Fore.YELLOW}{output_options.output_directory}/compliance/{Style.RESET_ALL}\n"
                 )
 
-    # Promote Prowler Cloud as the last thing the user sees after the results
-    if not args.no_banner and not args.only_logs:
-        print_prowler_cloud_banner(provider)
-
     # If custom checks were passed, remove the modules
     if checks_folder:
         remove_custom_checks_module(checks_folder, provider)

prowler/changelog.d/11024.added.md

@@ -1 +0,0 @@
-`cloudsql_instance_high_availability_enabled` check for GCP provider, verifying Cloud SQL primary instances use `REGIONAL` availability for automatic zone failover

prowler/changelog.d/11031.added.md

@@ -1 +0,0 @@
-`cosmosdb_account_automatic_failover_enabled` check for Azure provider

prowler/changelog.d/11211.added.md

@@ -1 +0,0 @@
-`sagemaker_clarify_exists` check for AWS provider

prowler/changelog.d/11259.added.1.md

@@ -1 +0,0 @@
-`config_delegated_admin_and_org_aggregator_all_regions` check for AWS provider, verifying that AWS Config has a delegated administrator and an organization aggregator covering all AWS regions

prowler/changelog.d/11259.added.md

@@ -1 +0,0 @@
-`securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on

prowler/changelog.d/11523.added.md

@@ -1 +0,0 @@
-`identity_storage_service_level_admins_scoped` check for OCI provider CIS 3.1 control 1.15, ensuring storage service-level administrators exclude delete permissions

prowler/changelog.d/README.md

@@ -1,10 +0,0 @@
-# Changelog fragments
-
-Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
-
-- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
-- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
-- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
-- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
-
-Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.

prowler/compliance/aws/aws_foundational_security_best_practices_aws.json

@@ -1863,9 +1863,7 @@
       "Id": "ELB.4",
       "Name": "Application load balancers should be configured to drop HTTP headers",
       "Description": "This control evaluates AWS Application Load Balancers (ALB) to ensure they are configured to drop invalid HTTP headers. The control fails if the value of routing.http.drop_invalid_header_fields.enabled is set to false. By default, ALBs are not configured to drop invalid HTTP header values. Removing these header values prevents HTTP desync attacks.",
-      "Checks": [
-        "elbv2_alb_drop_invalid_header_fields_enabled"
-      ],
+      "Checks": [],
       "Attributes": [
         {
           "ItemId": "ELB.4",

prowler/compliance/azure/iso27001_2022_azure.json

@@ -1293,8 +1293,7 @@
         "storage_ensure_private_endpoints_in_storage_accounts",
         "storage_secure_transfer_required_is_enabled",
         "vm_ensure_using_managed_disks",
-        "vm_trusted_launch_enabled",
-        "cosmosdb_account_automatic_failover_enabled"
+        "vm_trusted_launch_enabled"
       ]
     },
     {