fix(ui): keep the Slack page usable on an unreadable check time

- Guard the last-checked timestamp with isValid before formatting - Fall back to the never-checked rendering instead of the error boundary
fix(ui): confirm a Slack install only from a readable integration
2026-08-19 09:30:21 +00:00 · 2026-08-18 09:23:40 +02:00 · 2026-08-18 09:23:40 +02:00 · 2026-08-18 09:23:40 +02:00 · 2026-08-18 09:23:40 +02:00 · 2026-08-18 09:23:40 +02:00
423 changed files with 30992 additions and 2367 deletions
@@ -158,7 +158,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=

 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.39.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.40.0

 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"
@@ -64,7 +64,7 @@ runs:
        scanners: 'vuln'
        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
        timeout: '5m'
-        version: 'v0.72.0'
+        version: 'v0.74.0'
      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
      env:
        TRIVY_IGNOREFILE: '.trivyignore.yaml'
@@ -81,7 +81,7 @@ runs:
        scanners: 'vuln'
        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
        timeout: '5m'
-        version: 'v0.72.0'
+        version: 'v0.74.0'
      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
      env:
        TRIVY_IGNOREFILE: '.trivyignore.yaml'
@@ -199,7 +199,7 @@ You MUST structure your response using this EXACT format. Do NOT include anythin

 ### For Check Logic Bug

-```
+```markdown
 ### AI Assessment [Experimental]: Check Logic Bug

 **Component**: {component from issue template}
@@ -297,7 +297,7 @@ Write tests FIRST (TDD). The skills contain all testing conventions and patterns

 ### For Bug (non-check)

-```
+```markdown
 ### AI Assessment [Experimental]: Bug

 **Component**: {CLI/SDK | API | UI | Dashboard | MCP Server | Other}
@@ -378,7 +378,7 @@ Write tests FIRST (TDD). The skills contain all testing conventions and patterns

 ### For Already Fixed

-```
+```markdown
 ### AI Assessment [Experimental]: Already Fixed

 **Component**: {component}
@@ -401,7 +401,7 @@ Upgrade to the latest version. Close the issue as resolved.

 ### For Feature Request

-```
+```markdown
 ### AI Assessment [Experimental]: Feature Request

 **Component**: {component}
@@ -419,7 +419,7 @@ Upgrade to the latest version. Close the issue as resolved.

 ### For Not a Bug

-```
+```markdown
 ### AI Assessment [Experimental]: Not a Bug

 **Component**: {component}
@@ -440,7 +440,7 @@ Upgrade to the latest version. Close the issue as resolved.

 ### For Needs More Information

-```
+```markdown
 ### AI Assessment [Experimental]: Needs More Information

 **Component**: {component or "Unknown"}
@@ -52,6 +52,16 @@ provider/alibabacloud:
      - any-glob-to-any-file: "prowler/providers/alibabacloud/**"
      - any-glob-to-any-file: "tests/providers/alibabacloud/**"

+provider/huaweicloud:
+  - changed-files:
+      - any-glob-to-any-file: "prowler/providers/huaweicloud/**"
+      - any-glob-to-any-file: "tests/providers/huaweicloud/**"
+
+provider/image:
+  - changed-files:
+      - any-glob-to-any-file: "prowler/providers/image/**"
+      - any-glob-to-any-file: "tests/providers/image/**"
+
 provider/cloudflare:
  - changed-files:
      - any-glob-to-any-file: "prowler/providers/cloudflare/**"
@@ -82,6 +92,11 @@ provider/linode:
      - any-glob-to-any-file: "prowler/providers/linode/**"
      - any-glob-to-any-file: "tests/providers/linode/**"

+provider/stackit:
+  - changed-files:
+      - any-glob-to-any-file: "prowler/providers/stackit/**"
+      - any-glob-to-any-file: "tests/providers/stackit/**"
+
 github_actions:
  - changed-files:
      - any-glob-to-any-file: ".github/workflows/*"
@@ -8,11 +8,11 @@ These JSON templates are used with the `slackapi/slack-github-action` using the

 ### Available Templates

-**Container Releases**
+#### Container Releases
 - `container-release-started.json`: Simple one-line notification when container push starts
 - `container-release-completed.json`: Simple one-line notification when container release completes

-**Deployments**
+#### Deployments
 - `deployment-started.json`: Deployment start notification with Block Kit formatting
 - `deployment-completed.json`: Deployment completion notification (updates the start message)

@@ -416,17 +416,17 @@ For deployments that start with one message and update it with the final status:
 ### Container Release (Simple One-Line)

 **Start message:**
-```
+```text
 API container release 4.5.0 push started... View run
 ```

 **Completion message (success):**
-```
+```text
 [✓] API container release 4.5.0 push completed successfully! View run
 ```

 **Completion message (failure):**
-```
+```text
 [✗] API container release 4.5.0 push failed View run
 ```

@@ -111,6 +111,7 @@ jobs:
        with:
          files: |
            api/**
+            .trivyignore.yaml
            .github/actions/trivy-scan/**
            .github/actions/grype-scan/**
            .grype.yaml
@@ -55,6 +55,10 @@ jobs:
        # Pin must match .pre-commit-config.yaml so prek and CI behave identically.
        # pnpm dlx doesn't accept --ignore-scripts as a flag; the env var
        # disables postinstall scripts on transitives the same way.
+        #
+        # Files come from `git ls-files` because markdownlint doesn't traverse
+        # dot-directories, so `.github/**/*.md` went unlinted.
+        # `.markdownlintignore` still applies to the listed paths.
        env:
          pnpm_config_ignore_scripts: 'true'
-        run: pnpm dlx markdownlint-cli@0.45.0 '**/*.md'
+        run: git ls-files -z '*.md' | xargs -0 -r pnpm dlx markdownlint-cli@0.45.0 --
@@ -103,6 +103,7 @@ jobs:
        with:
          files: |
            mcp_server/**
+            .trivyignore.yaml
            .github/actions/trivy-scan/**
            .github/actions/grype-scan/**
            .grype.yaml
@@ -113,7 +113,7 @@ jobs:

      - name: Publish prowler-mcp package to PyPI
        if: steps.pypi-check.outputs.skip != 'true'
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          packages-dir: ${{ env.WORKING_DIRECTORY }}/dist/
          print-hash: true
@@ -10,6 +10,7 @@ on:
      - 'Dockerfile*'
      - 'pyproject.toml'
      - 'uv.lock'
+      - '.trivyignore.yaml'
      - '.github/workflows/sdk-container-checks.yml'
  pull_request:
    branches:
@@ -116,6 +117,7 @@ jobs:
            Dockerfile*
            pyproject.toml
            uv.lock
+            .trivyignore.yaml
            .github/workflows/sdk-container-checks.yml
            .github/actions/trivy-scan/**
            .github/actions/grype-scan/**
@@ -0,0 +1,196 @@
+name: 'SDK: Package Checks'
+
+# Rehearses the PyPI release on every packaging change and once a week, from the
+# consumer's side. Two incidents this guards against:
+#
+# - 5.38.0 shipped an unsatisfiable Requires-Dist (cryptography==50.0.0 while
+#   alibabacloud-tea-openapi and pyopenssl cap it below 49). A [tool.uv] override hid
+#   the conflict inside the repo; pip could not install the wheel and silently
+#   resolved `pip install prowler` to 5.37.1 for a week.
+# - 5.39.0 never published: an unpinned build backend started emitting core metadata
+#   2.5 and the twine bundled in the publish action rejected it.
+#
+# Both were only detectable at release time because nothing built and installed the
+# artifact earlier. The weekly run also catches releases yanked from PyPI after we
+# pinned them (zstd 1.5.7.3, "buggy - not thread safe", sat in uv.lock for months).
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'v5.*'
+  pull_request:
+    branches:
+      - 'master'
+      - 'v5.*'
+  schedule:
+    # Monday 06:00 UTC. Yanks and upstream releases happen without a commit here.
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+env:
+  # Must equal the twine bundled in the pypa/gh-action-pypi-publish pin used by
+  # sdk-pypi-release.yml (requirements/runtime.txt in that repo at the pinned tag).
+  # A metadata check that passes here must pass there.
+  TWINE_VERSION: '7.0.0'
+
+jobs:
+  changes:
+    if: github.repository == 'prowler-cloud/prowler'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      # Scheduled and manual runs always execute; pushes and PRs only when a packaging
+      # input changed. Jobs skipped this way still report success to branch protection.
+      run: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || steps.filter.outputs.any_changed == 'true' }}
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+
+      - name: Checkout repository
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # zizmor: ignore[artipacked]
+          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
+
+      - name: Detect packaging changes
+        if: github.event_name == 'push' || github.event_name == 'pull_request'
+        id: filter
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            pyproject.toml
+            uv.lock
+            README.md
+            util/replicate_pypi_package.py
+            util/check_yanked_pins.py
+            api/pyproject.toml
+            api/uv.lock
+            mcp_server/pyproject.toml
+            mcp_server/uv.lock
+            .github/workflows/sdk-package-checks.yml
+            .github/workflows/sdk-pypi-release.yml
+            .github/actions/setup-python-uv/**
+
+  install-from-wheel:
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version:
+          - '3.10'
+          - '3.11'
+          - '3.12'
+          - '3.13'
+        package:
+          - 'prowler'
+        include:
+          # prowler-cloud is the same tree renamed by util/replicate_pypi_package.py;
+          # one Python is enough to prove the rename and its build still work.
+          - python-version: '3.12'
+            package: 'prowler-cloud'
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+            release-assets.githubusercontent.com:443
+            pypi.org:443
+            files.pythonhosted.org:443
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup Python with uv
+        uses: ./.github/actions/setup-python-uv
+        with:
+          python-version: ${{ matrix.python-version }}
+          install-dependencies: 'false'
+
+      - name: Rename package to prowler-cloud
+        if: matrix.package == 'prowler-cloud'
+        run: |
+          pip install --no-cache-dir toml
+          python util/replicate_pypi_package.py
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Check metadata with the release workflow's twine
+        run: uvx --from "twine==${TWINE_VERSION}" twine check --strict dist/*
+
+      - name: Install the wheel with pip into a clean virtualenv
+        # Plain pip, --isolated, from outside the repo: consumers never see [tool.uv]
+        # override-dependencies or constraint-dependencies, so neither does this step.
+        run: |
+          python -m venv "${RUNNER_TEMP}/consumer"
+          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
+          cd "${RUNNER_TEMP}"
+          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir "${GITHUB_WORKSPACE}"/dist/*.whl
+
+      - name: Smoke test the installed CLI
+        run: |
+          cd "${RUNNER_TEMP}"
+          "${RUNNER_TEMP}/consumer/bin/prowler" --version
+          # Loads every AWS check module from the installed wheel: catches files missing
+          # from the package. grep fails the step if the summary line never appears.
+          "${RUNNER_TEMP}/consumer/bin/prowler" aws --list-checks | grep 'available checks'
+
+  pinned-releases-not-yanked:
+    needs: changes
+    if: needs.changes.outputs.run == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+            release-assets.githubusercontent.com:443
+            pypi.org:443
+            files.pythonhosted.org:443
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        with:
+          python-version: '3.12'
+
+      - name: Check every pinned and locked release against PyPI
+        run: python util/check_yanked_pins.py . api mcp_server
@@ -84,8 +84,18 @@ jobs:
      - name: Build Prowler package
        run: uv build

+      - name: Verify the wheel installs with pip
+        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
+        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
+        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
+        run: |
+          python -m venv "${RUNNER_TEMP}/consumer"
+          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
+          cd "${RUNNER_TEMP}"
+          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl
+
      - name: Publish Prowler package to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          print-hash: true

@@ -128,7 +138,17 @@ jobs:
      - name: Build prowler-cloud package
        run: uv build

+      - name: Verify the wheel installs with pip
+        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
+        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
+        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
+        run: |
+          python -m venv "${RUNNER_TEMP}/consumer"
+          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
+          cd "${RUNNER_TEMP}"
+          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl
+
      - name: Publish prowler-cloud package to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
        with:
          print-hash: true
@@ -104,6 +104,7 @@ jobs:
        with:
          files: |
            ui/**
+            .trivyignore.yaml
            .github/actions/trivy-scan/**
            .github/actions/grype-scan/**
            .grype.yaml
@@ -9,6 +9,14 @@ ignore:

  # Modules compiled into the Trivy binary we ship.
  # Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
+  # CVE-2026-71556 is the same temporary exception documented in .trivyignore.yaml:
+  # Trivy 0.73.0 still embeds go-git 5.19.1, while the 5.19.2 fix is merged only on
+  # Trivy main. Remove this entry with the Trivy exception by 2026-09-15.
+  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
+  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
+  - vulnerability: CVE-2026-71556
+    package:
+      name: github.com/go-git/go-git/v5
  - vulnerability: CVE-2026-56852
    package:
      name: golang.org/x/text
@@ -25,6 +33,19 @@ ignore:
    package:
      name: Microsoft.Bcl.Memory

+  # The .NET runtime bundled inside the PowerShell tarball the Dockerfile pins.
+  # CVE-2026-62901 is the same temporary exception documented in .trivyignore.yaml:
+  # fixed in .NET 9.0.19 / 10.0.11 (2026-08-11), but no published PowerShell release
+  # ships a patched runtime yet (7.5.9 bundles 9.0.18; 7.6.4 bundles 10.0.x < 10.0.11).
+  # pwsh runs only local M365 module cmdlets; nothing listens for inbound WebSocket
+  # connections. Remove with the Trivy exception by 2026-09-15.
+  - vulnerability: CVE-2026-62901
+    package:
+      name: Microsoft.NETCore.App.Runtime.linux-x64
+  - vulnerability: CVE-2026-62901
+    package:
+      name: Microsoft.NETCore.App.Runtime.linux-arm64
+

  # The CPython interpreter, compiled into the official base image.
  # TEMPORARY, unlike the entries above: moving to Python 3.13 clears seven of these, and
@@ -118,8 +118,36 @@ vulnerabilities:
      - "pkg:npm/ip-address"
    expired_at: 2027-01-31

+  # CVE-2026-62901 is a DoS in System.Net.WebSockets (unchecked input for loop condition,
+  # CWE-606), fixed in .NET 9.0.19 / 10.0.11 (published 2026-08-11). The vulnerable runtime
+  # ships inside the PowerShell tarball the Dockerfile pins: 7.5.9 is the latest 7.5.x and
+  # bundles .NET 9.0.18; 7.6.4 bundles .NET 10.0.x < 10.0.11, so no published PowerShell
+  # release contains the fix yet. Prowler only invokes pwsh locally to run M365 module
+  # cmdlets; the image does not accept inbound WebSocket connections, so the DoS path is
+  # not reachable from the network. Remove this temporary suppression as soon as a
+  # PowerShell release shipping .NET 9.0.19+ is available.
+  - id: CVE-2026-62901
+    purls:
+      - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64"
+      - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64"
+    expired_at: 2026-09-15
+
  # Modules compiled into the Trivy binary the images ship. The binary is pinned by version
  # and verified by checksum in the Dockerfile; only a rebuild by its vendor moves these.
+  # CVE-2026-71556 affects go-git worktree operations that can follow symlinks outside a
+  # cloned repository. Trivy 0.73.0, the latest published release and the version the
+  # images ship, still pins that vulnerable version:
+  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
+  # Trivy main already contains the 5.19.2 fix, but no published release includes it yet:
+  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
+  # Prowler invokes Trivy only with `fs` on an existing local path or with `image`; it does
+  # not ask Trivy to clone or mutate a Git worktree, so the affected path is not reachable.
+  # Remove this temporary suppression as soon as a fixed Trivy release is available.
+  - id: CVE-2026-71556
+    purls:
+      - "pkg:golang/github.com/go-git/go-git/v5"
+    expired_at: 2026-09-15
+
  - id: CVE-2026-56852
    purls:
      - "pkg:golang/golang.org/x/text"
@@ -136,8 +164,3 @@ vulnerabilities:
    purls:
      - "pkg:golang/oras.land/oras-go/v2"
    expired_at: 2026-12-31
-  - id: CVE-2026-39822
-    purls:
-      - "pkg:golang/stdlib"
-    expired_at: 2026-12-31
-
@@ -8,15 +8,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.72.0
+ARG TRIVY_VERSION=0.74.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}

 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea
-ARG TRIVY_SHA256_ARM64=2ca2c023109c2db6b2b77366b6717291452d4531167377d95c79547f0c8e3467
+ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
+ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
 ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0
 ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
@@ -26,6 +26,7 @@ ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed9
 RUN apt-get update && apt-get install -y --no-install-recommends \
    wget libicu76 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
    build-essential pkg-config libzstd-dev zlib1g-dev \
+    && apt-get install -y --no-install-recommends --only-upgrade util-linux \
    && rm -rf /var/lib/apt/lists/*

 # Install PowerShell
@@ -126,12 +126,12 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically

 | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/user-guide/compliance/tutorials/compliance) | [Categories](https://docs.prowler.com/user-guide/cli/tutorials/misc#categories) | Support | Interface |
 |---|---|---|---|---|---|---|
-| AWS | 621 | 86 | 47 | 19 | Official | UI, API, CLI |
+| AWS | 639 | 86 | 47 | 19 | Official | UI, API, CLI |
 | Azure | 191 | 22 | 21 | 16 | Official | UI, API, CLI |
 | GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |
 | Kubernetes | 92 | 7 | 8 | 11 | Official | UI, API, CLI |
 | GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |
-| M365 | 111 | 10 | 6 | 10 | Official | UI, API, CLI |
+| M365 | 143 | 10 | 6 | 10 | Official | UI, API, CLI |
 | OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |
 | Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |
 | Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |
@@ -147,7 +147,7 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 | Huawei Cloud [Contact us](https://prowler.com/contact) | 25 | 10 | 1 | 6 | Unofficial | CLI |
 | E2E Networks [Contact us](https://prowler.com/contact) | 27 | 6 | 0 | 2 | Unofficial | CLI |
 | Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 1 | 1 | Unofficial | CLI |
-| StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 1 | 3 | Unofficial | CLI |
+| StackIT [Contact us](https://prowler.com/contact) | 8 | 2 | 1 | 3 | Unofficial | CLI |
 | NHN | 6 | 2 | 2 | 0 | Unofficial | CLI |

 > [!Note]
@@ -4,6 +4,20 @@ All notable changes to the **Prowler API** are documented in this file.

 <!-- changelog: release notes start -->

+## [1.40.0] (Prowler v5.39.0)
+
+### 🔄 Changed
+
+- `GET /api/v1/users/me` membership relationships identify the active tenant with `meta.active` for JWT and API key authentication [(#12388)](https://github.com/prowler-cloud/prowler/pull/12388)
+
+### 🐞 Fixed
+
+- Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails [(#12379)](https://github.com/prowler-cloud/prowler/pull/12379)
+- `/api/v1/accounts/saml/{organization_slug}/acs/` rejects non-POST requests before SAML response processing [(#12393)](https://github.com/prowler-cloud/prowler/pull/12393)
+- Social login derives a valid user name when identity providers omit the profile name [(#12413)](https://github.com/prowler-cloud/prowler/pull/12413)
+
+---
+
 ## [1.39.0] (Prowler v5.38.0)

 ### 🚀 Added
@@ -7,15 +7,15 @@ ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1

-ARG TRIVY_VERSION=0.72.0
+ARG TRIVY_VERSION=0.74.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}

 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}

 # Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea
-ARG TRIVY_SHA256_ARM64=2ca2c023109c2db6b2b77366b6717291452d4531167377d95c79547f0c8e3467
+ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
+ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
 ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0
 ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56
 ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
@@ -36,6 +36,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
    libtool \
    libxslt1-dev \
    python3-dev \
+    && apt-get install -y --no-install-recommends --only-upgrade util-linux \
    && rm -rf /var/lib/apt/lists/*

 # Install PowerShell
@@ -0,0 +1 @@
+Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48)
@@ -0,0 +1 @@
+Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net`
@@ -0,0 +1 @@
+Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615
@@ -0,0 +1 @@
+Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe
@@ -1 +0,0 @@
-`/api/v1/accounts/saml/{organization_slug}/acs/` rejects non-POST requests before SAML response processing
@@ -1 +0,0 @@
-Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails
@@ -1 +0,0 @@
-`GET /api/v1/users/me` membership relationships identify the active tenant with `meta.active` for JWT and API key authentication
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.40.0"
+version = "1.41.0"

 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.
@@ -92,8 +92,7 @@ extend-select = [

 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
-# workos and pyopenssl run ahead of master: the versions master pins cap cryptography
-# below 48, so both were bumped to versions that allow it (PROWLER-2310).
+# workos is api-only; pyopenssl matches master (PROWLER-2310).
 constraint-dependencies = [
  "about-time==4.2.1",
  "adal==1.2.7",
@@ -130,7 +129,7 @@ constraint-dependencies = [
  "alibabacloud-sls20201230==5.9.0",
  "alibabacloud-sts20150401==1.1.6",
  "alibabacloud-tea==0.4.3",
-  "alibabacloud-tea-openapi==0.4.5",
+  "alibabacloud-tea-openapi==0.4.6",
  "alibabacloud-tea-util==0.3.14",
  "alibabacloud-tea-xml==0.0.3",
  "alibabacloud-vpc20160428==6.13.0",
@@ -339,7 +338,7 @@ constraint-dependencies = [
  "nltk==3.9.4",
  "numpy==2.2.6",
  "oauthlib==3.3.1",
-  "oci==2.183.0",
+  "oci==2.184.1",
  "openai==1.109.1",
  "openstacksdk==4.2.0",
  "opentelemetry-api==1.39.1",
@@ -380,7 +379,7 @@ constraint-dependencies = [
  "pylint==3.2.5",
  "pymsalruntime==0.18.1",
  "pynacl==1.6.2",
-  "pyopenssl==26.2.0",
+  "pyopenssl==26.4.0",
  "pyparsing==3.3.2",
  "pyreadline3==3.5.4",
  "pysocks==1.7.1",
@@ -458,7 +457,7 @@ constraint-dependencies = [
  "zipp==3.23.0",
  "zope-event==6.1",
  "zope-interface==8.2",
-  "zstd==1.5.7.3"
+  "zstd==1.5.7.2"
 ]
 # prowler@master needs okta==3.4.2, but cartography 0.138.1 requires okta<1.0.0.
 # Attack Paths does not ingest Okta today, so override the Cartography
@@ -485,7 +484,12 @@ constraint-dependencies = [
 # that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
 override-dependencies = [
  "okta==3.4.2",
-  # alibabacloud-tea-openapi 0.4.5 caps cryptography below 49 and is the latest release.
+  # prowler requires cryptography==50.0.0. Two api-only dependencies still cap it below
+  # 49 and cannot move yet: msal, pinned exactly by azure-cli-core (2.83.0 -> 1.35.0b1,
+  # 2.89.1 -> 1.36.0, both <49; cartography needs azure-cli-core), and workos 8.3.0
+  # (~=48.0; workos 10.1.1+ needs ~=50.0 and is a separate SDK upgrade). This api is
+  # deployed from this lock with `uv sync --locked`, so the override applies to what runs.
+  # Remove when azure-cli-core pins msal>=1.37.0 and workos is on 10.x.
  "cryptography==50.0.0",
  "azure-mgmt-containerservice==34.1.0",
  "microsoft-kiota-abstractions==1.9.10",
@@ -12,11 +12,37 @@ from api.models import (
    UserRoleRelationship,
 )
 from api.utils import accept_invitation_for_user
+from django.core.exceptions import ValidationError
 from django.db import transaction
 from django.http import HttpResponseForbidden


 class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
+    @staticmethod
+    def _get_social_account_name(extra_data: dict, email: str) -> str:
+        name_field = User._meta.get_field("name")
+        for value in (
+            extra_data.get("name"),
+            extra_data.get("login"),
+            extra_data.get("username"),
+            email,
+        ):
+            if not isinstance(value, str):
+                continue
+
+            candidate = value.strip()[: name_field.max_length].rstrip()
+            if not candidate:
+                continue
+
+            try:
+                name_field.run_validators(candidate)
+            except ValidationError:
+                continue
+
+            return candidate
+
+        raise ValueError("Social account does not provide a valid user identity.")
+
    @staticmethod
    def get_user_by_email(email: str):
        try:
@@ -116,11 +142,8 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):

            if provider != "saml":
                # Handle other providers (e.g., GitHub, Google)
+                user.name = self._get_social_account_name(extra, user.email)
                user.save(using=MainRouter.admin_db)
-                social_account_name = extra.get("name")
-                if social_account_name:
-                    user.name = social_account_name
-                    user.save(using=MainRouter.admin_db)

                invitation_token = self._get_invitation_token(request)
                if invitation_token:
@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
  title: Prowler API
-  version: 1.40.0
+  version: 1.41.0
  description: |-
    Prowler API specification.

@@ -111,6 +111,110 @@ def _verify_local_email(user):
    )


+def test_social_account_name_falls_back_to_login_for_blank_name():
+    adapter = ProwlerSocialAccountAdapter()
+
+    name = adapter._get_social_account_name(
+        {"name": "   ", "login": "octocat"},
+        "verified@example.com",
+    )
+
+    assert name == "octocat"
+
+
+@pytest.mark.parametrize("provider_name", [None, "", "   ", 123, ["name"]])
+def test_social_account_name_ignores_unusable_provider_names(provider_name):
+    adapter = ProwlerSocialAccountAdapter()
+
+    name = adapter._get_social_account_name(
+        {"name": provider_name, "login": "octocat"},
+        "verified@example.com",
+    )
+
+    assert name == "octocat"
+
+
+def test_social_account_name_uses_login_when_name_is_missing():
+    adapter = ProwlerSocialAccountAdapter()
+
+    name = adapter._get_social_account_name(
+        {"login": "octocat"},
+        "verified@example.com",
+    )
+
+    assert name == "octocat"
+
+
+def test_social_account_name_falls_back_to_username_then_email():
+    adapter = ProwlerSocialAccountAdapter()
+
+    username_name = adapter._get_social_account_name(
+        {"name": "ab", "login": None, "username": "  monalisa  "},
+        "verified@example.com",
+    )
+    email_name = adapter._get_social_account_name({}, "  verified@example.com  ")
+
+    assert username_name == "monalisa"
+    assert email_name == "verified@example.com"
+
+
+def test_social_account_name_trims_and_limits_provider_name():
+    adapter = ProwlerSocialAccountAdapter()
+    max_length = User._meta.get_field("name").max_length
+
+    trimmed_name = adapter._get_social_account_name(
+        {"name": "  Ada Lovelace  "},
+        "verified@example.com",
+    )
+    limited_name = adapter._get_social_account_name(
+        {"name": "a" * (max_length + 1)},
+        "verified@example.com",
+    )
+
+    assert trimmed_name == "Ada Lovelace"
+    assert limited_name == "a" * max_length
+
+
+def test_social_account_name_rejects_missing_identity():
+    adapter = ProwlerSocialAccountAdapter()
+
+    with pytest.raises(
+        ValueError,
+        match="Social account does not provide a valid user identity",
+    ):
+        adapter._get_social_account_name({}, "")
+
+
+def test_save_user_applies_normalized_social_account_name(rf):
+    adapter = ProwlerSocialAccountAdapter()
+    request = rf.post("/")
+    request.session = {}
+    sociallogin = MagicMock(spec=SocialLogin)
+    sociallogin.provider = MagicMock()
+    sociallogin.provider.id = "github"
+    sociallogin.account = MagicMock()
+    sociallogin.account.extra_data = {"name": None, "login": "  octocat  "}
+    user = User(email="verified@example.com")
+    user.save = MagicMock()
+    invitation = SimpleNamespace(tenant_id="tenant-id")
+
+    with (
+        patch("api.adapters.super") as mock_super,
+        patch("api.adapters.transaction.atomic"),
+        patch("api.adapters.write_db_alias"),
+        patch.object(adapter, "_get_invitation_token", return_value="token"),
+        patch(
+            "api.adapters.accept_invitation_for_user",
+            return_value=(invitation, True),
+        ),
+    ):
+        mock_super.return_value.save_user.return_value = user
+        saved_user = adapter.save_user(request, sociallogin)
+
+    assert saved_user.name == "octocat"
+    assert request.prowler_invitation_token == "token"
+
+
@pytest.mark.django_db
 class TestProwlerSocialAccountAdapter:
    def test_get_user_by_email_returns_user(self, create_test_user):
@@ -45,7 +45,7 @@ constraints = [
    { name = "alibabacloud-sls20201230", specifier = "==5.9.0" },
    { name = "alibabacloud-sts20150401", specifier = "==1.1.6" },
    { name = "alibabacloud-tea", specifier = "==0.4.3" },
-    { name = "alibabacloud-tea-openapi", specifier = "==0.4.5" },
+    { name = "alibabacloud-tea-openapi", specifier = "==0.4.6" },
    { name = "alibabacloud-tea-util", specifier = "==0.3.14" },
    { name = "alibabacloud-tea-xml", specifier = "==0.0.3" },
    { name = "alibabacloud-vpc20160428", specifier = "==6.13.0" },
@@ -254,7 +254,7 @@ constraints = [
    { name = "nltk", specifier = "==3.9.4" },
    { name = "numpy", specifier = "==2.2.6" },
    { name = "oauthlib", specifier = "==3.3.1" },
-    { name = "oci", specifier = "==2.183.0" },
+    { name = "oci", specifier = "==2.184.1" },
    { name = "openai", specifier = "==1.109.1" },
    { name = "openstacksdk", specifier = "==4.2.0" },
    { name = "opentelemetry-api", specifier = "==1.39.1" },
@@ -295,7 +295,7 @@ constraints = [
    { name = "pylint", specifier = "==3.2.5" },
    { name = "pymsalruntime", specifier = "==0.18.1" },
    { name = "pynacl", specifier = "==1.6.2" },
-    { name = "pyopenssl", specifier = "==26.2.0" },
+    { name = "pyopenssl", specifier = "==26.4.0" },
    { name = "pyparsing", specifier = "==3.3.2" },
    { name = "pyreadline3", specifier = "==3.5.4" },
    { name = "pysocks", specifier = "==1.7.1" },
@@ -373,7 +373,7 @@ constraints = [
    { name = "zipp", specifier = "==3.23.0" },
    { name = "zope-event", specifier = "==6.1" },
    { name = "zope-interface", specifier = "==8.2" },
-    { name = "zstd", specifier = "==1.5.7.3" },
+    { name = "zstd", specifier = "==1.5.7.2" },
 ]
 overrides = [
    { name = "azure-mgmt-containerservice", specifier = "==34.1.0" },
@@ -860,7 +860,7 @@ sdist = { url = "https://files.pythonhosted.org/packages/9a/7d/b22cb9a0d4f396ee0

 [[package]]
 name = "alibabacloud-tea-openapi"
-version = "0.4.5"
+version = "0.4.6"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "alibabacloud-credentials" },
@@ -869,9 +869,9 @@ dependencies = [
    { name = "cryptography" },
    { name = "darabonba-core" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3b/73/fb0c4d44759791ecdf269fc715c1e810fa1aba3981bfaaf8a01f61899296/alibabacloud_tea_openapi-0.4.5.tar.gz", hash = "sha256:75fa1f4360a46e41f5bf5f8d4917e52efb6f64885839bc1328c35590670c97b9", size = 26616, upload-time = "2026-07-14T13:15:39.364Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ab/34/1918a2d780676494365c7f945bfab397ecddb988054d78025bd26f438977/alibabacloud_tea_openapi-0.4.6.tar.gz", hash = "sha256:dafc32401712f5b21c12dc3d05ba887a91ad156d9b49a7662279f9fd90526fb2", size = 26742, upload-time = "2026-08-17T08:34:11.55Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/8d/ec/6b368a10e9c2e8b1b394c69b96ac213ae66e8c4895e0baa1ffaf7178fd32/alibabacloud_tea_openapi-0.4.5-py3-none-any.whl", hash = "sha256:338979095c7beda80a5b413c31262892cafdc12069dde4ce4fc2e4f7ce0fc609", size = 33333, upload-time = "2026-07-14T13:15:38.365Z" },
+    { url = "https://files.pythonhosted.org/packages/35/00/2f534f5884e5f299d9cb3a1e8be2def8071bc6a6e2a192ba4ff2a8cd5e02/alibabacloud_tea_openapi-0.4.6-py3-none-any.whl", hash = "sha256:c9e1727b9fb2936f487d050fc3590c99f9f2065256dc3a927e5b61f414674ed6", size = 33448, upload-time = "2026-08-17T08:34:10.472Z" },
 ]

 [[package]]
@@ -4426,7 +4426,7 @@ wheels = [

 [[package]]
 name = "oci"
-version = "2.183.0"
+version = "2.184.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "certifi" },
@@ -4439,9 +4439,9 @@ dependencies = [
    { name = "pytz" },
    { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1e/2a/77bd6cbf1c69b2f368fe3d6462d84369b0cba15e37ce713cdc08d459b95a/oci-2.183.0.tar.gz", hash = "sha256:ff572ef5f2030a788796bb509d257e6a41c6510ef9b4b6a75a079efd06e533ce", size = 17759723, upload-time = "2026-07-28T06:02:29.76Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/74/2d/fa5368cfabb868f4111c6978e8b5f66aa3a55076c40c1a59ac3081b0227b/oci-2.184.1.tar.gz", hash = "sha256:617dad69caf8dd6e521d224dbc3e8a8bc289906943a0214fd2c3419094e26435", size = 17990631, upload-time = "2026-08-11T11:01:26.194Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a9/de/8574b3e527996a099d196e87794a4652d91a0c3185fcc7fdbb5649b75a8a/oci-2.183.0-py3-none-any.whl", hash = "sha256:bd789c98a94d7c5ea08c20d11dcf68c9cd1ad479b134727d80a930b84387070b", size = 36133501, upload-time = "2026-07-28T06:02:18.239Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/63/5ae22e42aaf96a5da74dc2b9de449c78b4d7418cce621d5da723b3e49f32/oci-2.184.1-py3-none-any.whl", hash = "sha256:bd814e38a70da2190e721937455a08689ab13c0750bd2ef8dd0c98b2dc5a38ea", size = 36628063, upload-time = "2026-08-11T11:01:18.178Z" },
 ]

 [[package]]
@@ -4835,8 +4835,8 @@ wheels = [

 [[package]]
 name = "prowler"
-version = "5.38.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#b3d174d0c1eb202ed7cb9a9daf0500683f4443be" }
+version = "5.40.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=master#b6e9967da6bebd6c7b8b237317a2a95e2e0c65bc" }
 dependencies = [
    { name = "alibabacloud-actiontrail20200706" },
    { name = "alibabacloud-credentials" },
@@ -4935,7 +4935,7 @@ dependencies = [

 [[package]]
 name = "prowler-api"
-version = "1.40.0"
+version = "1.41.0"
 source = { virtual = "." }
 dependencies = [
    { name = "cartography" },
@@ -5426,15 +5426,15 @@ wheels = [

 [[package]]
 name = "pyopenssl"
-version = "26.2.0"
+version = "26.4.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
    { name = "cryptography" },
    { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1a/51/27a5ad5f939d08f690a326ef9582cda7140555180db71695f6fb747d6a36/pyopenssl-26.2.0.tar.gz", hash = "sha256:8c6fcecd1183a7fc897548dfe388b0cdb7f37e018200d8409cf33959dbe35387", size = 182195, upload-time = "2026-05-04T23:06:09.72Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3f/e8/7325d258199b159eb2c03fe32107533e2832e70e63f4fb88a6aa00023201/pyopenssl-26.4.0.tar.gz", hash = "sha256:28dfcce0162b9211413e26dfbfdf1d24317fbeba18fc93c12400a1856b2a0bc7", size = 182046, upload-time = "2026-08-01T19:50:50.512Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/73/b8/a0e2790ae249d6f38c9f66de7a211621a7ab2650217bcd04e1262f578a56/pyopenssl-26.2.0-py3-none-any.whl", hash = "sha256:4f9d971bc5298b8bc1fab282803da04bf000c755d4ad9d99b52de2569ca19a70", size = 55823, upload-time = "2026-05-04T23:06:08.395Z" },
+    { url = "https://files.pythonhosted.org/packages/51/ad/2cf6d3fa2fae5c79e1ed9960c0d42badd0f94d81dd12b50604cdc839e648/pyopenssl-26.4.0-py3-none-any.whl", hash = "sha256:f0eb0cb2d581d3ad2b9c489468485e7f2ab6727d08401bcf9d824c3caddf3c1c", size = 56026, upload-time = "2026-08-01T19:50:48.94Z" },
 ]

 [[package]]
@@ -6623,39 +6623,27 @@ wheels = [

 [[package]]
 name = "zstd"
-version = "1.5.7.3"
+version = "1.5.7.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/49/62/b9c075ad664e7c4cbb3d8d2be7c246506abe1bc7f778eb58d260ef9538c8/zstd-1.5.7.3.tar.gz", hash = "sha256:403e5205f4ac04b92e6b0cda654be2f51de268228a0db0067bc087faacf2f495", size = 672559, upload-time = "2026-01-08T16:24:43.361Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/0f/78/9a476e09c825304df47b98be80d1ffe223733b03550af71325415028f615/zstd-1.5.7.2.tar.gz", hash = "sha256:6d8684c69009be49e1b18ec251a5eb0d7e24f93624990a8a124a1da66a92fc8a", size = 670481, upload-time = "2025-06-23T12:36:08.131Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/75/0d/8c89c0d010b58c21a7865a239790bb1c6822029c053b1ded858d6b573e3a/zstd-1.5.7.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1a3c1781a24e2ced2c0ddee11d45b1f04018b03615eeb622a62eca4d56d3358a", size = 267641, upload-time = "2026-01-08T16:30:50.812Z" },
-    { url = "https://files.pythonhosted.org/packages/a3/6d/155d8c344d96eca2a5a003a5ddd63373a5f13591fd5cf2b9490250d6805a/zstd-1.5.7.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a6c7c81056362b60a04baa34632e713d596662a860ec34efd8e9b109c10e6ec7", size = 230962, upload-time = "2026-01-08T16:30:49.155Z" },
-    { url = "https://files.pythonhosted.org/packages/c8/c7/ab93916a26eb58cd501ad701974c31b4bc67a7f6abd6c24bef8fe4d7649b/zstd-1.5.7.3-cp311-cp311-manylinux_2_14_x86_64.whl", hash = "sha256:e564f34a55effc7d654eb293468edc80b64d476b0f899f82760ecd8323223ff5", size = 304166, upload-time = "2026-01-10T11:17:45.697Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/54/27a7040a360019a4602343e3c98c0c0a140f382186002c01e1992fd21837/zstd-1.5.7.3-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:fbc49a57188184931d5e3c9f1133cad7eea5a370a9e9418fb8122d58c14340a5", size = 1540288, upload-time = "2026-01-08T17:50:26.913Z" },
-    { url = "https://files.pythonhosted.org/packages/96/93/4a4d4edd1b2e809e0ebbb16000404bdcc9a09743c04ee1661442c9581b75/zstd-1.5.7.3-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:d121d3e63722819e1fe5effbcd9628d8a7cfea0cddabcc5bb37ea861a6a83424", size = 1619134, upload-time = "2026-01-08T17:50:32.324Z" },
-    { url = "https://files.pythonhosted.org/packages/31/6b/cd6f0a7f4f0d98e4110aa77763cf3e85f594d983ea9ca3d64cc0cee10684/zstd-1.5.7.3-cp311-cp311-manylinux_2_4_i686.whl", hash = "sha256:621f2e7ca8e9eb52a83eb9c91ec3cd283d87591bf75cc658de486b65f44742c7", size = 300166, upload-time = "2026-01-10T11:12:27.938Z" },
-    { url = "https://files.pythonhosted.org/packages/05/3f/c717e0d15127d04b7fa58ba9b4c56e8b88b803048b9766cd9d158dbb22ea/zstd-1.5.7.3-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:c1950fcae690ba32d0f31702b335c548fb42547821565925e48576afdad774a5", size = 1525776, upload-time = "2026-01-08T17:50:35.518Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/a2/1813cd787d1a2f9ab8e8a90d28dcbc8e8098997dd04de38897ea8e75dd08/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:bac4f0d03da69115878bedbfa03c4a3f64364e8396b432028c4ce0f05141a0fb", size = 2096057, upload-time = "2026-01-08T17:50:33.984Z" },
-    { url = "https://files.pythonhosted.org/packages/36/ce/f5a3c7c12de458dd9ce15c484d627fe5412b60c155da23dacb5fcf08d9d5/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:da0ab134b7fd28023dedf013751ca850de300a090eb11f689d2a1c178c87d9dc", size = 2132659, upload-time = "2026-01-08T17:50:29.534Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/66/151f9546498bfd8971a0b6ad67d87c26d7a0df17d57f724da674f3778666/zstd-1.5.7.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b9923175842ee8f7602ec9cc578f5fc396896f0e8460d3ac9a5adc3cea77244e", size = 2124811, upload-time = "2026-01-08T17:50:37.612Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/34/4d2dbb36cb2373d3f115c047cb901b64f89de0703d10779da39de9453812/zstd-1.5.7.3-cp311-cp311-win32.whl", hash = "sha256:0612b604948d7b58aecc6788c7ceb53c5f21d94a155bb6ea9bd0f54ffa43725d", size = 150363, upload-time = "2026-01-08T17:11:02.392Z" },
-    { url = "https://files.pythonhosted.org/packages/d9/de/f53687e0dd8c0d0ebfaed9ae88f6a96a1a0388ae7424b469e74bb17ac57d/zstd-1.5.7.3-cp311-cp311-win_amd64.whl", hash = "sha256:5b7f8c81b2bd3b62c0345242247d484cafa4b518d59d18619813d9225af5c5c3", size = 167577, upload-time = "2026-01-08T17:11:03.356Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/58/d4a6a902e229e953ed273fe9b78587ed31f57567aa68d3e34af6056e42af/zstd-1.5.7.3-cp311-cp311-win_arm64.whl", hash = "sha256:ea112e3acd9e1765adca35df7b54ac75b36194290f64ea03a3a59664209c8527", size = 157238, upload-time = "2026-01-08T16:36:06.25Z" },
-    { url = "https://files.pythonhosted.org/packages/aa/ed/5a3bf2e29dc56d4cc7619929bb51f0c758de6d02967cc73c5d8755a862c0/zstd-1.5.7.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:01a39efb0eeab7cc45cb308618233b624b0840d5e16dcf85456b6cca0592f203", size = 268124, upload-time = "2026-01-08T16:29:57.091Z" },
-    { url = "https://files.pythonhosted.org/packages/e2/1d/efc2074ac90af938e78f2ed4004639fe24f294d9086c5280f8d9a02b9897/zstd-1.5.7.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:7a8e8838cf35fa3987bfe1958584cc22e1797efce8e155a63544b4144fc671f8", size = 230988, upload-time = "2026-01-08T16:29:55.604Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/52/178393b8d70e23fba67f42dfce4663e4e8a30867110168beb490a36d4639/zstd-1.5.7.3-cp312-cp312-manylinux_2_14_i686.whl", hash = "sha256:f3920ac1d1cc7e9f252f3e29f217fe3cd36f2191bb3dbcae826c29e189b7ad54", size = 300207, upload-time = "2026-01-10T11:26:58.351Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/7a/8dcd86a2efb2ed3f9dae39545a05d3c7ed26c7678330786ce4a44cd8b099/zstd-1.5.7.3-cp312-cp312-manylinux_2_14_x86_64.whl", hash = "sha256:143f9062953fb5590cbd47c1040d357336742c79696bf90b6d5b835279a68304", size = 304154, upload-time = "2026-01-10T11:17:40.91Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/ce/0c96905ab01ffe0e53a3cec8132123b82db26bd583a71608029bcc789ebc/zstd-1.5.7.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:36d1fd8647e47e1f21b345e192f1a279e925678c23dad8236b547d04456cd699", size = 2162222, upload-time = "2026-01-08T18:02:22.762Z" },
-    { url = "https://files.pythonhosted.org/packages/11/c4/db4807d6a68b4628c74fd379de7e3c67ec34f19a2a80ac246b3837cde6cb/zstd-1.5.7.3-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f1538db419afa62773cf534fc7f3009ff59ecf55ecee4e889587ac2ef0010ed8", size = 2201732, upload-time = "2026-01-08T18:02:20.835Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/99/c19a3c0f5580ff9c33a74f06d98d6060ed1fa6bd09b55aed9be852ec191f/zstd-1.5.7.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c5efd16adb092e2a547a7d51cfdaf6fd5680528227684c5bafc7669ab4a55f41", size = 2096459, upload-time = "2026-01-08T18:02:25.336Z" },
-    { url = "https://files.pythonhosted.org/packages/23/fd/02eac30419475dbe50212c119043a2d0698a0cbc756da85fd3fd9abddf42/zstd-1.5.7.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:39b3438e64637d80a5b1860526903b92020acb9bae9ceb5adffd9838c1441328", size = 2125442, upload-time = "2026-01-08T18:02:17.715Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/43/3a16ff0a8c913bb9825379db1bd533c75c57c2d2f31dd9111aa9b53711f4/zstd-1.5.7.3-cp312-cp312-win32.whl", hash = "sha256:cbf48c53461e224ffc2490cfe5120a1ff40d14c84d2b512c6d6d99fc91685cf3", size = 150367, upload-time = "2026-01-08T17:03:40.178Z" },
-    { url = "https://files.pythonhosted.org/packages/46/83/b85875d7428e63dfa9247e41d17fac611443c774f7892f8643bd4164a6b2/zstd-1.5.7.3-cp312-cp312-win_amd64.whl", hash = "sha256:943a189910f2fea997462e3e4d7fbf727a06d231ef801ebee557b1c87568981c", size = 167604, upload-time = "2026-01-08T17:03:41.355Z" },
-    { url = "https://files.pythonhosted.org/packages/37/42/cf291e26804de2f55500cdac93f5e9fa6267cf315def8aa402529bae3a87/zstd-1.5.7.3-cp312-cp312-win_arm64.whl", hash = "sha256:85c4d508f8109afa7c51c4960626c3325af2cf1e442c6c36ebfea15d04757e3f", size = 157241, upload-time = "2026-01-08T16:47:34.615Z" },
-    { url = "https://files.pythonhosted.org/packages/04/b8/d13d584867d5eb1bc607877a870858e02a256d4706a4274e475413a000aa/zstd-1.5.7.3-pp311-pypy311_pp73-macosx_10_15_x86_64.whl", hash = "sha256:76c49ea969bc08389ea59155cea7c5dea224522ffc62f443f3c0a915f5fd184d", size = 260025, upload-time = "2026-01-08T16:57:45.739Z" },
-    { url = "https://files.pythonhosted.org/packages/16/a1/1e5faf75bedfd2bfccfb83e18736b115bed6e348504bd21800cd8f30dcea/zstd-1.5.7.3-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:6b1a638ff3dfce8f4cb1203c662fb5606dd99b4a62c5ddc4c406d2d1326bcfdd", size = 221038, upload-time = "2026-01-08T17:16:32.005Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/2c/0fe74d8b2029eef8000bc71aac5b3e5b55d00581238711cf627814183ea3/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:5e96a5cb100a0edc162935227f2d9784b1031ce4a8a83e96e66eae2673c10143", size = 326792, upload-time = "2026-01-08T16:57:35.631Z" },
-    { url = "https://files.pythonhosted.org/packages/96/e0/2c7f081f3524f872128ff31bea2acb6b21cb1dacccef920eb6a1a77a87c6/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1bda0bbf3a9553720cd33f1f85940a259656c7ffba4be717ff82b7f062052188", size = 322283, upload-time = "2026-01-08T16:57:36.759Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/a7/3bebfcc18d66b90bc7b506a61b2ff4af5ee1b0b16e784ea644afa06241c5/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ac36e4022422f6e49b3f07bdbb8a964fd348223d3dc9c82ad5398a4f0432a719", size = 311553, upload-time = "2026-01-08T16:57:38.465Z" },
-    { url = "https://files.pythonhosted.org/packages/41/75/8a791cae2c98e5e44a158e15db50d21b7ec0b37aeaffa68d151bc8ffb6d6/zstd-1.5.7.3-pp311-pypy311_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:fa4d760a220541b18ce732a3a2cf7547ea05afc76d05b3b39edebfeb721f6079", size = 317071, upload-time = "2026-01-08T16:36:07.47Z" },
-    { url = "https://files.pythonhosted.org/packages/2f/25/b6624e6b08d515242154436c9d06fb20b790d300ac82e84f3c4c133e25e1/zstd-1.5.7.3-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:a69e60146bf8aaa6a0e6c9a94a7c5f3133d68091e2e5c5a3c5ababf71fd5ec7a", size = 167654, upload-time = "2026-01-08T17:00:56.667Z" },
+    { url = "https://files.pythonhosted.org/packages/43/2a/0885f6f1921ec1ef4a8f8ab29ab0a335cc867abe4c7aaa4e5031435a32a5/zstd-1.5.7.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f799c1e9900ad77e7a3d994b9b5146d7cfd1cbd1b61c3db53a697bf21ffcc57b", size = 269702, upload-time = "2025-06-23T12:50:11.695Z" },
+    { url = "https://files.pythonhosted.org/packages/05/e6/629cf6b77e47fc7149f5724fb4853c48edcdeb10d8c64e391d7026cb10e1/zstd-1.5.7.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1ff4c667f29101566a7b71f06bbd677a63192818396003354131f586383db042", size = 228145, upload-time = "2025-06-23T12:50:10.411Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/b8/9ddefd4670bfe9328ca6657ad335eb8d9c657466247e234a579818b6b0b9/zstd-1.5.7.2-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.manylinux_2_24_aarch64.whl", hash = "sha256:8526a32fa9f67b07fd09e62474e345f8ca1daf3e37a41137643d45bd1bc90773", size = 1536530, upload-time = "2025-06-23T13:51:38.853Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/6a/1bb836c18760dc1e28ca7a9706016e482ebdea633b980d8505dbb65e18f8/zstd-1.5.7.2-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.manylinux_2_24_x86_64.whl", hash = "sha256:2cec2472760d48a7a3445beaba509d3f7850e200fed65db15a1a66e315baec6a", size = 1616141, upload-time = "2025-06-23T13:51:34.152Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/7a/bb6c6e2cb2a066e347dc27d45d5205058b69d6c8b8d4ae2ee7d6b91c64a5/zstd-1.5.7.2-cp311-cp311-manylinux_2_4_i686.whl", hash = "sha256:a200c479ee1bb661bc45518e016a1fdc215a1d8f7e4bf6c7de0af254976cfdf6", size = 322188, upload-time = "2025-06-23T13:01:48.704Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/4f/cf0669c8a89fdcc91814bf92bd05cc363d5d12a79b656418c0add6f2d266/zstd-1.5.7.2-cp311-cp311-manylinux_2_4_x86_64.whl", hash = "sha256:f5d159e57a13147aa8293c0f14803a75e9039fd8afdf6cf1c8c2289fb4d2333a", size = 302736, upload-time = "2025-06-23T13:05:33.649Z" },
+    { url = "https://files.pythonhosted.org/packages/be/bc/e5f8b7f61826323e39e099db1eb5c0e09b18315df1b1ff778f7ae9aadcac/zstd-1.5.7.2-cp311-cp311-manylinux_2_5_i686.manylinux1_i686.manylinux_2_24_i686.whl", hash = "sha256:7206934a2bd390080e972a1fed5a897e184dfd71dbb54e978dc11c6b295e1806", size = 1522687, upload-time = "2025-06-23T13:51:35.494Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/8c/7660a949a020ac9d02b3166a25dd1c12144572d77b11ae92a31d341016da/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:7e0027b20f296d1c9a8e85b8436834cf46560240a29d623aa8eaa8911832eb58", size = 2098794, upload-time = "2025-06-23T13:51:37.219Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/b2/730c811a78d670104d40c7f08cc8092577cdff870cba42b3158f20fceb57/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:d6b17e5581dd1a13437079bd62838d2635db8eb8aca9c0e9251faa5d4d40a6d7", size = 2112266, upload-time = "2025-06-23T13:51:31.258Z" },
+    { url = "https://files.pythonhosted.org/packages/44/74/2c16e1632094db36c8920d4c13b8e2e843024d548ae26888c2d22af6a676/zstd-1.5.7.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b13285c99cc710f60dd270785ec75233018870a1831f5655d862745470a0ca29", size = 2109465, upload-time = "2025-06-23T13:51:32.884Z" },
+    { url = "https://files.pythonhosted.org/packages/58/6e/b9c9a834769d96cab2122da1be8c8c700d3f76be796d2b7516e85d2eca0e/zstd-1.5.7.2-cp311-cp311-win32.whl", hash = "sha256:cdb5ec80da299f63f8aeccec0bff3247e96252d4c8442876363ff1b438d8049b", size = 149448, upload-time = "2025-06-23T13:06:21.144Z" },
+    { url = "https://files.pythonhosted.org/packages/47/b7/fc22ad6292a32d7676ab815de3a23573beac3679e8abd9914288d1496ceb/zstd-1.5.7.2-cp311-cp311-win_amd64.whl", hash = "sha256:4f6861c8edceb25fda37cdaf422fc5f15dcc88ced37c6a5b3c9011eda51aa218", size = 166592, upload-time = "2025-06-23T13:06:22.126Z" },
+    { url = "https://files.pythonhosted.org/packages/45/14/096bb77f3e5ef525b452cd6294da33de7f8a8c9647ba78293378fbb0a7ce/zstd-1.5.7.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d2ebe3e60dbace52525fa7aa604479e231dc3e4fcc76d0b4c54d8abce5e58734", size = 269408, upload-time = "2025-06-23T13:11:46.492Z" },
+    { url = "https://files.pythonhosted.org/packages/08/b8/2bc2590a34c733ea0570f366e6ad7d889d05c7825bd3ccab01f36ece71c6/zstd-1.5.7.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ef201b6f7d3a6751d85cc52f9e6198d4d870e83d490172016b64a6dd654a9583", size = 228188, upload-time = "2025-06-23T13:11:47.539Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/80/6252de3a70cfd7767718ad476893f1c7dc129f942cc7ed0322e3137c03d9/zstd-1.5.7.2-cp312-cp312-manylinux_2_14_x86_64.whl", hash = "sha256:ac7bdfedda51b1fcdcf0ab69267d01256fc97ddf666ce894fde0fae9f3630eac", size = 302720, upload-time = "2025-06-23T12:40:11.522Z" },
+    { url = "https://files.pythonhosted.org/packages/af/b6/af908387814b99172d3aea6aeb24b19583aadfa45f6021e5e2a0d6d8e99a/zstd-1.5.7.2-cp312-cp312-manylinux_2_4_i686.whl", hash = "sha256:b835405cc4080b378e45029f2fe500e408d1eaedfba7dd7402aba27af16955f9", size = 322237, upload-time = "2025-06-23T13:17:35.482Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/d7/ab9142e002a7eaa451cb4bb37a74c390c489ba8ae75ade543840496eda04/zstd-1.5.7.2-cp312-cp312-win32.whl", hash = "sha256:e4cf97bb97ed6dbb62d139d68fd42fa1af51fd26fd178c501f7b62040e897c50", size = 149453, upload-time = "2025-06-23T13:13:02.786Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/c7/c182ea7bc283f591e3f3c5f0f239e7a92c9bc1f626642ae2c4dfbe51d6f2/zstd-1.5.7.2-cp312-cp312-win_amd64.whl", hash = "sha256:55e2edc4560a5cf8ee9908595e90a15b1f47536ea9aad4b2889f0e6165890a38", size = 166628, upload-time = "2025-06-23T13:13:03.745Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/c9/a6495a7bf168a78f0a0c01d61d830ebfb401315a64fd1ae8d725c458114c/zstd-1.5.7.2-pp311-pypy311_pp73-manylinux_2_14_x86_64.whl", hash = "sha256:5fb2ff5718fe89181223c23ce7308bd0b4a427239379e2566294da805d8df68a", size = 315542, upload-time = "2025-06-23T12:39:27.598Z" },
 ]
@@ -4,6 +4,117 @@ description: "New features and improvements in each Prowler release"
 rss: true
 ---

+<Update label="v5.39.0" description="August 13, 2026">
+  ### 🤖 Lighthouse AI — Finding Skills
+
+  <Note>
+  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
+  </Note>
+
+  Lighthouse AI now embeds a Skills menu on every finding, answering the questions an analyst actually asks. **Contextual Fix** produces the fix for the finding, **Triage Decision** judges whether it is real and closes it out when it is not, and **Systemic Scope** determines whether the problem is a one-off or everywhere. A free-form "Ask Lighthouse anything" prompt sits in the same menu, and each run shows its progress and offers follow-up actions such as creating a Jira issue or muting the finding.
+
+  ![Lighthouse AI Skills menu on a finding resource](/images/changelog/v5.39.0-lighthouse-finding-skills.png)
+
+  Read more in the [Lighthouse AI documentation](https://docs.prowler.com/getting-started/products/prowler-cloud-lighthouse).
+
+  ### ☁️ Azure Management Group Onboarding
+
+  <Note>
+  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
+  </Note>
+
+  Azure subscriptions no longer onboard one at a time. Choose "Add Multiple Subscriptions With Azure Management Group" in the add-provider wizard, enter the Microsoft Entra tenant ID, and authenticate once with a single tenant-wide service principal: Prowler discovers the entire management-group hierarchy under the tenant root, lets you select the subscriptions to onboard, and creates their providers with the management-group structure preserved. Azure now matches the one-step onboarding that AWS Organizations and GCP organizations already have.
+
+  ![Azure onboarding method selector with the Management Group option](/images/changelog/v5.39.0-azure-mg-selector.png)
+
+  Read more in the [Azure Management Groups documentation](https://docs.prowler.com/user-guide/tutorials/prowler-cloud-azure-management-groups).
+
+  ### ✅ Findings Triage — Verify MANUAL Findings as PASS
+
+  <Note>
+  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
+  </Note>
+
+  Checks that require human judgment report `MANUAL` findings. For these findings, and only for them, the triage status selector now offers **Resolved**: choosing it asks for the required written evidence and verifies the finding as passing. The finding then reports an effective `PASS` while preserving the raw `MANUAL` scan result, across findings, finding groups, compliance reports, and scans, with the attestation's author, evidence, and validity always visible. Attestations expire automatically after 90 days, or as soon as a new scan reports a real failure, returning the finding to the review queue.
+
+  ![Triage status selector offering Resolved on a MANUAL finding](/images/changelog/v5.39.0-manual-pass-selector.png)
+
+  ![Manual Pass details showing evidence, author, and validity](/images/changelog/v5.39.0-manual-pass-details.png)
+
+  Read more in the [Findings Triage documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-findings-triage#verify-a-manual-finding-as-pass).
+
+  ### ☁️ Prowler Cloud MCP — Organizations Management and Grouped Jira Dispatch
+
+  <Note>
+  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
+  </Note>
+
+  The hosted Prowler Cloud MCP server adds eight organization tools, so an agent can onboard and manage entire cloud organizations end to end: create the organization, discover its accounts, subscriptions, and projects, apply the selection, and manage the resulting providers. The tools cover AWS Organizations, GCP organizations, and Azure tenant root management groups, and they are available to Lighthouse AI.
+
+  `prowler_send_findings_to_jira` also gains Cloud-only dispatch capabilities: select failed findings by check IDs against the latest completed scan, and send them in grouped mode, one Jira work item per check listing up to 50 affected resources, with per-group error reporting.
+
+  Read more in the [Prowler MCP tools documentation](https://docs.prowler.com/getting-started/basic-usage/prowler-mcp-tools) and its [Jira operations reference](https://docs.prowler.com/getting-started/basic-usage/prowler-mcp-tools#jira-operations).
+
+  ### 🕸️ Attack Paths — Grouped Graph with Outcome Destinations
+
+  <Note>
+  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
+  </Note>
+
+  The Attack Paths graph now reads from source to destination. Resources of the same class collapse into a single expandable node with a count, clicking reveals its members, and every path terminates in an explicit outcome node naming the destination impact: code execution, privilege escalation, public exposure, or resource inventory. The per-account hub node is gone, and the clicked resource stays highlighted while its findings are expanded.
+
+  ![Attack Paths graph from the Internet to a public exposure outcome node](/images/changelog/v5.39.0-attack-paths-graph.png)
+
+  Explore the full Attack Paths query catalog at [Prowler Hub](https://hub.prowler.com/attack-paths).
+
+  Read more in the [Attack Paths documentation](https://docs.prowler.com/user-guide/tutorials/prowler-app-attack-paths).
+
+  ### 📚 New Compliance Framework — CMMC 2.0
+
+  The Cybersecurity Maturity Model Certification (CMMC) is the certification the US Department of Defense requires from contractors and suppliers that handle federal contract data. Prowler now includes CMMC 2.0 as a universal framework with all 149 requirements defined by the CMMC Program rule (32 CFR Part 170), organized in its three levels:
+
+  - **Level 1 (Foundational):** 15 requirements for the basic safeguarding of Federal Contract Information, from FAR 52.204-21.
+  - **Level 2 (Advanced):** 110 requirements from NIST SP 800-171 Rev 2, protecting Controlled Unclassified Information.
+  - **Level 3 (Expert):** 24 enhanced requirements from NIST SP 800-172 for the most sensitive programs.
+
+  Requirements map to Prowler checks across AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud, and Microsoft 365, so one framework reports the compliance posture of the whole estate.
+
+  Read more in the [Compliance documentation](https://docs.prowler.com/user-guide/compliance/tutorials/compliance).
+
+  ### 🔍 Checks
+
+  #### Microsoft 365
+
+  Twenty new Entra ID checks expand the coverage of CIS Microsoft 365 Foundations Benchmark v7.0.0:
+
+  - **Password protection:** custom banned password list, on-premises enforcement, and lockout threshold and duration.
+  - **Default user permissions:** security group and Microsoft 365 group creation restricted, and guest invitations limited to allowed domains.
+  - **Conditional Access:** high and medium sign-in risk blocked, authentication transfer blocked, untrusted locations blocked, trusted named locations defined, sign-in frequency enforced, and token protection enforced.
+  - **Sessions and authentication methods:** idle session timeout configured, email one-time passcodes disabled, and Microsoft Authenticator context shown.
+  - **PIM and access reviews:** approval required to activate the Global Administrator and Privileged Role Administrator roles, and access reviews configured for guest users and privileged roles.
+
+  Explore all Microsoft 365 checks at [Prowler Hub](https://hub.prowler.com/check?provider=m365).
+
+  #### AWS
+
+  Two new checks detect hardcoded secrets:
+
+  - `batch_job_definition_no_secrets` scans Batch job definition environment variables and command parameters. Thanks to @praneetrajv!
+  - `awslambda_layer_no_secrets_in_content` scans Lambda layer package content. Thanks to @ganiganesh25!
+
+  Explore all AWS checks at [Prowler Hub](https://hub.prowler.com/check?provider=aws).
+
+  ### 🙌 External Contributors
+
+  Thank you to our community contributors for this release!
+
+  - @praneetrajv: AWS `batch_job_definition_no_secrets` check ([#12117](https://github.com/prowler-cloud/prowler/pull/12117))
+  - @ganiganesh25: AWS `awslambda_layer_no_secrets_in_content` check ([#12233](https://github.com/prowler-cloud/prowler/pull/12233))
+  - @andoniaf: GitHub `organization_repository_creation_limited` now reports low severity when repository creation is limited to private or internal visibility ([#12164](https://github.com/prowler-cloud/prowler/pull/12164))
+
+  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.39.0) for the complete list of changes.
+</Update>
+
 <Update label="v5.38.0" description="August 6, 2026">
  ### 📌 Compliance Watchlist

@@ -224,9 +224,9 @@ Each check **must** populate the report with a unique identifier for the audited
            - `resource_name`: Description of the configuration (e.g., "SharePoint Settings")
 - GitHub
    - Resource ID — `report.resource_id`.
-        - The ID of the Github resource. This is a system-generated integer that uniquely identifies the resource within the Github platform.
+        - The ID of the GitHub resource. This is a system-generated integer that uniquely identifies the resource within the GitHub platform.
    - Resource Name — `report.resource_name`.
-        - The name of the Github resource. In the case of a repository, this is just the repository name. For full repository names use the resource `full_name`.
+        - The name of the GitHub resource. In the case of a repository, this is just the repository name. For full repository names use the resource `full_name`.

 ### Configurable Checks in Prowler

@@ -107,7 +107,7 @@ Once you have decided the provider you want or need to add to Prowler, the next
 - **SDK Providers**: Low complexity. You have mature examples like AWS, Azure, GCP, Kubernetes, etc. that you can leverage to implement your provider.
 - **API Providers**: Medium complexity. You need to implement the authentication and session management, and the API calls to the provider. You now have NHN and MongoDB Atlas as example to follow.
 - **Tool/Wrapper Providers**: High complexity. You need to implement the argument/output mapping to the provider and handle problems that the tool/wrapper may have. You now have IAC and the PowerShell wrapper as example to follow.
- **Hybrid Providers**: High complexity. You need to "customize" your provider, mixing the other types of providers in order to achieve the desired result. You have M365 (msgraph SDK + PowerShell wrapper) and Github (PyGithub SDK + graphql API requests) as examples.
+- **Hybrid Providers**: High complexity. You need to "customize" your provider, mixing the other types of providers in order to achieve the desired result. You have M365 (msgraph SDK + PowerShell wrapper) and GitHub (PyGithub SDK + graphql API requests) as examples.

 ### Determining Regional vs Non-Regional Architecture

@@ -814,7 +814,7 @@ class YourProviderMutelist(Mutelist):
 Region management is essential for cloud providers that operate across multiple geographic locations. This component handles region validation and provides region-specific functionality.

 <Note>
-Regions are optional, only if the provider has regions, for example Github does not have regions, but AWS does.
+Regions are optional, only if the provider has regions, for example GitHub does not have regions, but AWS does.
 </Note>

 **File:** `prowler/providers/<provider_name>/lib/regions/<provider_name>_regions.py`
@@ -1773,7 +1773,7 @@ The implementation of the mutelist is the same as the [SDK providers](#step-5-im
 Region management is essential for cloud providers that operate across multiple geographic locations. This component handles region validation and provides region-specific functionality.

 <Note>
-Regions are optional, only if the provider has regions, for example Github does not have regions, but AWS does.
+Regions are optional, only if the provider has regions, for example GitHub does not have regions, but AWS does.
 </Note>

 **File:** `prowler/providers/<provider_name>/lib/regions/<provider_name>_regions.py`
@@ -184,7 +184,7 @@ Prowler enables security scanning of Kubernetes clusters, supporting both **in-c
    ```

    <Note>
-        By default, Prowler scans all namespaces in the active Kubernetes context. Use the `--context`flag to specify the context to be scanned and `--namespaces` to restrict scanning to specific namespaces.
+        By default, Prowler scans all namespaces in the active Kubernetes context. Use the `--context` flag to specify the context to be scanned and `--namespaces` to restrict scanning to specific namespaces.

    </Note>
 ## Microsoft 365
@@ -11,10 +11,10 @@ Complete reference guide for all tools available in the Prowler MCP Server. Tool
 | Prowler Hub | 10 tools | No | Cloud and Local MCP Server |
 | Prowler Documentation | 2 tools | No | Cloud and Local MCP Server |
 | Prowler Cloud, Private Cloud & Local Server | 49 tools | Yes | Cloud and Local MCP Server |
-| Prowler Cloud management | 32 tools | Yes | Cloud MCP Server only |
+| Prowler Cloud management | 40 tools | Yes | Cloud MCP Server only |

 <Note>
-48 of the 49 Prowler tools are available on both servers. `prowler_schedule_daily_scan` is the exception: it is Local-only, because the Cloud MCP Server supersedes it with the `prowler_cloud_*` [Scan Scheduling](#scan-scheduling) tools.
+48 of the 49 Prowler tools are available on both servers. `prowler_schedule_daily_scan` is the exception: it is Local-only, because the Cloud MCP Server supersedes it with the `prowler_cloud_*` [Scan Scheduling](#scan-scheduling) tools. `prowler_send_findings_to_jira` is exposed by both servers but accepts two [extra parameters](#jira-operations) on the Cloud MCP Server.
 </Note>

 ## Tool Naming Convention
@@ -124,7 +124,20 @@ Tools for managing where Prowler sends its results: Amazon S3 buckets, AWS Secur
 #### Jira Operations

 - **`prowler_get_jira_issue_types`** - List the issue types available in a Jira project, fetched live from Jira
- **`prowler_send_findings_to_jira`** - Create one Jira work item per finding, with its severity, resource, risk, and remediation steps
+- **`prowler_send_findings_to_jira`** - Create Jira work items from findings, each carrying the check title, severity, status, provider, region, resource, risk, and remediation steps. Select the findings either by ID with `finding_ids`, or — on Prowler Cloud only — by check with `check_ids`, and choose between one work item per finding or one per check with `dispatch_mode`
+
+<Note>
+`check_ids` and `dispatch_mode` are **Prowler Cloud only**:
+
+- **`check_ids`** - Send the failing findings of a check (for example `s3_bucket_public_access`) without listing their IDs. Prowler resolves them server-side, taking only the failed findings of the latest completed scan of every provider. Get the check IDs from `prowler_list_finding_groups`. Exactly one of `finding_ids` or `check_ids` is required — Prowler combines both filters, so sending both would only dispatch their intersection. A Local MCP Server rejects `check_ids` with a client error.
+- **`dispatch_mode`** - `individual` (the default) creates one work item per finding. `grouped` creates one work item per check instead, listing up to 50 affected resources and linking back to the finding group in Prowler Cloud, which keeps a noisy check to a single ticket. Grouped dispatch only covers failed, unmuted findings of the latest completed scan of every provider. A Local MCP Server ignores `dispatch_mode` instead of rejecting it, and creates one work item per finding.
+
+In `grouped` mode the response counters change meaning: `created_count` counts work items (one per check) rather than findings, `failed_count` counts the entries of the new `failed_groups` field, and `failed_groups` details each failure with its reason and the `check_id` whose work item could not be created.
+</Note>
+
+<Warning>
+`prowler_send_findings_to_jira` creates real work items that Prowler cannot delete or update afterwards. Only retry the same dispatch when the previous response returned `safe_to_retry: true`, otherwise the work items already created are duplicated. Combining `check_ids` with the default `individual` mode opens one work item per failing resource, which can be hundreds of them — use `dispatch_mode="grouped"` to keep it to one per check.
+</Warning>

 ### Attack Paths Analysis

@@ -167,6 +180,23 @@ Manage Prowler Cloud-only features and configuration. **Requires authentication.
 These tools are available **only on the Cloud MCP Server** (`https://mcp.prowler.com/mcp`). A Local MCP Server does not expose them, because the features they manage exist only in Prowler Cloud.
 </Note>

+### Organizations
+
+Tools for onboarding a cloud provider organization as a whole — an AWS Organization, an Azure tenant with its management groups, or a GCP organization with its folders. An organization holds org-level credentials, discovers the real account, subscription, or project structure in the cloud, and turns a selection from that discovery into Prowler providers linked into a hierarchy of nodes. Every tool that changes something — creating, updating, deleting, discovering, applying a discovery, or adjusting provider membership — requires the **Manage Providers** permission; listing and reading do not.
+
+<Note>
+Use these tools for the whole organization. To register providers one by one, use the [Provider Management](#provider-management) tools instead; to build arbitrary RBAC buckets of providers, use provider groups.
+</Note>
+
+- **`prowler_cloud_list_organizations`** - Browse the registered organizations with lightweight data (name, type, external id, provider and node counts), filtered by type or cloud-side external id
+- **`prowler_cloud_get_organization`** - Get one organization in full: attributes, linked providers, credentials status, latest discovery, and the OU / management group / folder hierarchy. Set `include_hierarchy` to `false` to skip the tree on large organizations
+- **`prowler_cloud_create_organization`** - Register an organization, optionally storing its org-level credentials in the same call. Idempotent: an organization with the same type and external id is reused and its credentials rotated, reported as `created: false`
+- **`prowler_cloud_update_organization`** - Rename an organization, replace its metadata, and/or create or rotate its org-level credentials. `org_type` and `external_id` are immutable after creation
+- **`prowler_cloud_delete_organization`** - Delete an organization, its entire hierarchy, and every linked provider
+- **`prowler_cloud_discover_organization`** - Enumerate the real cloud structure: AWS accounts and OUs, Azure subscriptions and management groups, or GCP projects and folders. Each item comes back with its registration state so you can choose what to onboard
+- **`prowler_cloud_apply_organization_discovery`** - Turn a discovery selection into Prowler providers and hierarchy nodes
+- **`prowler_cloud_manage_organization_providers`** - Manually `add`, `replace`, or `remove` the providers linked to an organization or to one of its hierarchy nodes. Providers are detached, never deleted
+
 ### Scan Configurations

 Tools for managing reusable scan configurations — per-provider check and compliance selections — and attaching them to providers. Providers without a configuration attached use the default.
@@ -128,12 +128,12 @@ To update the environment file:
 Edit the `.env` file and change version values:

 ```env
-PROWLER_UI_VERSION="5.38.0"
-PROWLER_API_VERSION="5.38.0"
+PROWLER_UI_VERSION="5.39.0"
+PROWLER_API_VERSION="5.39.0"
 ```

 <Note>
-  You can find the latest versions of Prowler Local Server in the [Releases Github section](https://github.com/prowler-cloud/prowler/releases) or in the [Container Versions](#container-versions) section of this documentation.
+  You can find the latest versions of Prowler Local Server in the [Releases GitHub section](https://github.com/prowler-cloud/prowler/releases) or in the [Container Versions](#container-versions) section of this documentation.
 </Note>


@@ -495,7 +495,7 @@ aws:

  # AWS CloudTrail Configuration
  # aws.cloudtrail_threat_detection_privilege_escalation
-  threat_detection_privilege_escalation_threshold: 0.2 # Percentage of actions found to decide if it is an privilege_escalation attack event, by default is 0.2 (20%)
+  threat_detection_privilege_escalation_threshold: 0.2 # Percentage of actions found to decide if it is a privilege_escalation attack event, by default is 0.2 (20%)
  threat_detection_privilege_escalation_minutes: 1440 # Past minutes to search from now for privilege_escalation attacks, by default is 1440 minutes (24 hours)
  threat_detection_privilege_escalation_actions:
    [
@@ -4,13 +4,13 @@ title: "Custom Checks Metadata"

 In certain organizations, the severity of specific checks might differ from the default values defined in the check's metadata. For instance, while `s3_bucket_level_public_access_block` could be deemed `critical` for some organizations, others might assign a different severity level to it.

-The custom metadata option offers a means to override default metadata set by Prowler
+The custom metadata option offers a means to override default metadata set by Prowler.

 You can utilize `--custom-checks-metadata-file` followed by the path to your custom checks metadata YAML file.

 ## Available Fields

-The list of supported check's metadata fields that can be override are listed as follows:
+The list of supported check's metadata fields that can be overridden are listed as follows:

 - Severity
 - CheckTitle
@@ -322,7 +322,7 @@ The Mutelist Table must have the following columns:

  - Checks (String): This field can contain either a Prowler Check Name or an `*` (which applies to all the scanned checks).

-  - Regions (List): This field contains a list of regions where this mutelist rule is applied (it can also contains an `*` to apply all scanned regions).
+  - Regions (List): This field contains a list of regions where this mutelist rule is applied (it can also contain an `*` to apply all scanned regions).

  - Resources (List): This field contains a list of regular expressions (regex) that applies to the resources that are wanted to be muted.

@@ -2,7 +2,7 @@
 title: 'Scanning Multiple AWS Accounts with Prowler'
 ---

-Prowler enables security scanning across multiple AWS accounts by utilizing the  [Assume Role feature](/user-guide/providers/aws/role-assumption) and [integration with AWS Organizations feature](/user-guide/providers/aws/organizations).
+Prowler enables security scanning across multiple AWS accounts by utilizing the [Assume Role feature](/user-guide/providers/aws/role-assumption) and [integration with AWS Organizations feature](/user-guide/providers/aws/organizations).

 This approach allows execution from a single account with permissions to assume roles in the target accounts.

@@ -2,7 +2,7 @@
 title: 'AWS Security Hub Integration with Prowler'
 ---

-Prowler natively supports **official integration** with [AWS Security Hub](https://aws.amazon.com/security-hub), allowing security findings to be sent directly.  This integration enables **Prowler** to import its findings into AWS Security Hub.
+Prowler natively supports **official integration** with [AWS Security Hub](https://aws.amazon.com/security-hub), allowing security findings to be sent directly. This integration enables **Prowler** to import its findings into AWS Security Hub.

 To activate the integration, follow these steps in at least one AWS region within your AWS account:

@@ -39,10 +39,12 @@ When using service principal authentication, add these **Application Permissions

 **Microsoft Graph API Permissions:**

+- `AccessReview.Read.All`: Required for `entra_access_review_guest_users_configured` and `entra_access_review_privileged_roles_configured` checks. A Microsoft Entra ID P2 or Microsoft Entra ID Governance license is also required.
 - `AuditLog.Read.All`: Required for Entra service.
 - `Directory.Read.All`: Required for all services.
 - `OnPremDirectorySynchronization.Read.All`: Required for `entra_seamless_sso_disabled` check (hybrid deployments).
 - `Policy.Read.All`: Required for all services.
+- `RoleManagementPolicy.Read.Directory`: Required for `entra_pim_global_administrator_approval_required` and `entra_pim_privileged_role_administrator_approval_required` checks. A Microsoft Entra ID P2 or Microsoft Entra ID Governance license is also required.
 - `SecurityIdentitiesHealth.Read.All`: Required for `defenderidentity_health_issues_no_open` check.
 - `SecurityIdentitiesSensors.Read.All`: Required for `defenderidentity_health_issues_no_open` check.
 - `SharePointTenantSettings.Read.All`: Required for SharePoint service.
@@ -110,10 +112,12 @@ Browser and Azure CLI authentication methods limit scanning capabilities to chec

 3. Search and select the required permissions:

+   - `AccessReview.Read.All`: Required for `entra_access_review_guest_users_configured` and `entra_access_review_privileged_roles_configured` checks. A Microsoft Entra ID P2 or Microsoft Entra ID Governance license is also required
   - `AuditLog.Read.All`: Required for Entra service
   - `Directory.Read.All`: Required for all services
   - `OnPremDirectorySynchronization.Read.All`: Required for `entra_seamless_sso_disabled` check (hybrid deployments)
   - `Policy.Read.All`: Required for all services
+   - `RoleManagementPolicy.Read.Directory`: Required for `entra_pim_global_administrator_approval_required` and `entra_pim_privileged_role_administrator_approval_required` checks. A Microsoft Entra ID P2 or Microsoft Entra ID Governance license is also required
   - `SecurityIdentitiesHealth.Read.All`: Required for `defenderidentity_health_issues_no_open` check
   - `SecurityIdentitiesSensors.Read.All`: Required for `defenderidentity_health_issues_no_open` check
   - `SharePointTenantSettings.Read.All`: Required for SharePoint service
@@ -16,26 +16,24 @@ Attack Paths analyzes relationships between cloud resources, permissions, and se
 By mapping these relationships as a graph, Attack Paths reveals risks that individual security checks cannot detect on their own, such as an IAM role that can escalate its own permissions, or a chain of policies that grants unintended access to sensitive resources.

 <Note>
-  Attack Paths is currently available for **AWS** providers. Support for
-  additional providers is planned.
+  Attack Paths is currently available for **AWS** providers. Support for additional providers is planned.
 </Note>

 ## Prerequisites

 The following prerequisites are required for Attack Paths:

- **An AWS provider is configured** with valid credentials in Prowler Cloud. For setup instructions, see [Getting Started with AWS](/user-guide/providers/aws/getting-started-aws).
+- **An AWS provider is configured** with valid credentials. For setup instructions, see [Getting Started with AWS](/user-guide/providers/aws/getting-started-aws).
 - **At least one scan has completed** on the configured AWS provider and produced graph data. Attack Paths scans run automatically alongside regular security scans, no separate configuration is required.

 ## How Attack Paths Scans Work

-Attack Paths scans are generated automatically when a security scan runs on an AWS provider. Each completed scan produces graph data that maps relationships between IAM principals, policies, trust configurations, and other resources.
+Attack Paths scans are generated automatically when a security scan runs on an AWS provider. When a scan produces graph data, it maps relationships between IAM principals, policies, trust configurations, and other resources. A scan can complete without producing graph data.

-Once the scan finishes and graph data is ready, the scan appears in the Attack Paths scan table with a **Completed** status and a check in the **Graph** column. Scans that are still queued or running remain visible, but they cannot be selected until graph data is ready.
+When graph data is ready, the scan appears in the Attack Paths scan table with a check in the **Graph** column and can be selected regardless of its current status. Scans without graph data remain visible but cannot be selected. If a new scan cycle starts after graph data is available, the previous cycle remains available while the new scan runs.

 <Note>
-  Since Prowler scans all configured providers every **24 hours** by default,
-  Attack Paths data stays up to date automatically.
+  Prowler Cloud and Prowler Private Cloud scan configured providers every **24 hours** by default, so Attack Paths data stays up to date automatically.
 </Note>

 ## Accessing Attack Paths
@@ -66,7 +64,7 @@ The scans table displays all Attack Paths scans with the following columns:
 - **Graph:** Whether Attack Paths graph data is available for the scan.
 - **Duration:** Total scan time.

-To select a scan for analysis, click the radio button on any row with a **Completed** status and available graph data.
+To select a scan for analysis, click any row with a check in the **Graph** column. A row can remain selectable while a new scan cycle runs because Attack Paths keeps the graph from the previous completed cycle available.

 <img
  src="/images/prowler-app/attack-paths/scan-list-table.png"
@@ -75,8 +73,7 @@ To select a scan for analysis, click the radio button on any row with a **Comple
 />

 <Note>
-  Only scans with graph data can be selected. Disabled rows include a tooltip
-  that explains why the graph is not available yet.
+  Only scans with graph data can be selected. Disabled rows include a tooltip that explains why the graph is not available yet.
 </Note>

 ## Choosing a Query
@@ -97,9 +94,7 @@ To choose a query, click the dropdown and select from the available options. Eac
 Once selected, a description panel appears below the dropdown with more context about the query.

 <Note>
-  In Prowler Cloud and Prowler Private Cloud, the query selector hides queries
-  confirmed empty for the selected scan, so only queries that return data remain
-  visible. See [Active Queries](/user-guide/tutorials/prowler-app-attack-paths-active-queries).
+  In Prowler Cloud and Prowler Private Cloud, the query selector hides built-in queries confirmed empty for the selected scan. Built-in queries without a confirmed empty result and the **Custom openCypher query** remain visible. See [Active Queries](/user-guide/tutorials/prowler-app-attack-paths-active-queries).
 </Note>

 ## Configuring Query Parameters
@@ -120,7 +115,7 @@ For example, **Internet-Exposed EC2 with Sensitive S3 Access** uses **Tag key**

 ## Writing Custom openCypher Queries

-In addition to the built-in queries, Attack Paths supports custom read-only [openCypher](https://opencypher.org/) queries. Custom queries provide direct access to the underlying graph so security teams can answer ad-hoc questions, prototype detections, or extend coverage beyond the built-in catalogue.
+In addition to the built-in queries, Attack Paths supports custom read-only [openCypher](https://opencypher.org/) queries. Custom queries provide direct access to the underlying graph so security teams can answer ad-hoc questions, prototype detections, or extend coverage beyond the built-in catalog.

 To write a custom query, select **Custom openCypher query** from the query dropdown. A code editor with syntax highlighting and line numbers appears, ready to receive the query.

@@ -192,11 +187,7 @@ Custom queries traverse the same Cartography graph the built-in queries use. Nod
 For the complete reference, including the graph model, list-typed and JSON-encoded properties, performance guidance, and openCypher compatibility rules, see [Attack Paths Queries](/developer-guide/attack-paths-queries) in the Developer Guide.

 <Note>
-  AI assistants connected through Prowler MCP Server can fetch the exact
-  Cartography schema for the active scan via the
-  `prowler_get_attack_paths_cartography_schema` tool. This guarantees that
-  generated queries match the schema version pinned by the running Prowler
-  release.
+  AI assistants connected through Prowler MCP Server can fetch the exact Cartography schema for the active scan via the `prowler_get_attack_paths_cartography_schema` tool. This guarantees that generated queries match the schema version pinned by the running Prowler release.
 </Note>

 ## Executing a Query
@@ -221,12 +212,22 @@ If the query returns no results, an informational message appears. Common reason

 After a successful execution, the graph visualization renders below the query builder. The graph maps relationships between cloud resources, IAM entities, public exposure, and security findings.

+### Grouped Graphs and Query Outcomes
+
+<VersionBadge version="5.39.0" />
+
+Prowler Cloud and Prowler Private Cloud group resources of the same class and graph level into expandable nodes. Built-in query graphs also end with a query outcome, which states the result that the path can lead to.
+
+Prowler Local Server keeps the flat graph view, including the provider root. Custom openCypher queries do not have a catalog outcome, so their graphs do not include an outcome node.
+
 ### Node Types

- **Provider root nodes:** Represent the AWS account or provider root for the selected scan.
- **Resource nodes:** Represent cloud resources such as IAM roles, policies, EC2 instances, security groups, and S3 buckets.
+- **Grouped resource nodes:** Represent multiple resources of the same class in Prowler Cloud and Prowler Private Cloud. A number in the upper-right corner shows how many resources the node contains. A red outline indicates that one or more resources in the group have findings.
+- **Resource nodes:** Represent individual cloud resources such as IAM roles, policies, EC2 instances, security groups, and S3 buckets. A class with one resource remains an individual node.
 - **Internet nodes:** Represent exposure from the public internet.
 - **Finding nodes:** Represent Prowler findings linked to resources. Finding colors indicate risk level, such as critical, high, medium, or low.
+- **Outcome nodes:** Mark the terminal result of a built-in query in Prowler Cloud and Prowler Private Cloud. The orange node displays outcomes such as **Code execution**, **Privilege escalation**, **Public exposure**, or **Resource inventory**. A dashed ring and the label **Latent outcome** indicate an inventory or another partial outcome.
+- **Provider root nodes:** Represent the AWS account or provider root in the Prowler Local Server flat graph.

 ### Edge Types

@@ -234,7 +235,7 @@ After a successful execution, the graph visualization renders below the query bu
 - **Finding edges:** Dashed relationships between resources and their associated findings.
 - **Highlighted paths:** Green edges that show the active path when you hover a node or focus a finding.

-The standard graph view includes a minimap and a legend below the canvas. The legend shows the provider roots, visible node types, finding risk levels, node states, and edge types present in the current view.
+The standard graph view includes a minimap and a legend below the canvas. The legend shows the visible node types, finding risk levels, node states, and edge types present in the current view. Prowler Local Server also displays the provider root in the legend.

 <img
  src="/images/prowler-app/attack-paths/graph-visualization.png"
@@ -244,17 +245,32 @@ The standard graph view includes a minimap and a legend below the canvas. The le

 ## Interacting with the Graph

-The graph banner describes the main interactions:
+The graph supports these interactions:

+- Click a node with a number in the upper-right corner to expand its resource group.
 - Click a finding to focus its connected path.
 - Click a resource with findings to show or hide its related findings.
 - Hover a node to highlight its connected path.

+### Expanding Resource Groups
+
+In Prowler Cloud and Prowler Private Cloud, a node with a number in its upper-right corner represents a resource group. The number is the total number of resources in the group.
+
+- Click the group node to display its resources. Multiple groups can remain expanded, and the graph automatically fits the visible nodes to the canvas.
+- Double-click any resource revealed from a group to collapse that group.
+- Click **Collapse all groups** in the graph toolbar to close every expanded group. This control appears only while at least one group is expanded.
+
+<img
+  src="/images/prowler-app/attack-paths/graph-visualization-expanded.png"
+  alt="Attack Paths graph showing an expanded AWS Role group and remaining numbered resource groups"
+  width="700"
+/>
+
 ### Showing Related Findings

 Resource nodes with related findings are clickable. Click one of these resources to show its finding nodes. Click the resource again to hide them.

-The graph automatically fits the selected resource and its related findings when the findings are shown.
+The selected resource is highlighted in green while its findings are visible. The graph automatically fits the selected resource and its related findings when the findings are shown.

 ### Focusing a Finding Path

@@ -279,12 +295,12 @@ The toolbar in the top-right corner of the graph provides:

 - **Zoom in / Zoom out:** Adjust the zoom level
 - **Fit graph to view:** Reset the view to fit the visible graph
- **Export graph:** Download the current graph as a PNG file
+- **Collapse all groups:** Close every expanded resource group. This control appears only when a group is expanded
+- **Export graph:** Download the current graph, including its grouped or expanded state and outcome, as a PNG file
 - **Fullscreen:** Open the graph in a full-size modal

 <Note>
-  Use **Ctrl + Scroll** (or **Cmd + Scroll** on macOS) to zoom directly within
-  the graph area.
+  Use **Ctrl + Scroll** (or **Cmd + Scroll** on macOS) to zoom directly within the graph area.
 </Note>

 ## Viewing Finding Details
@@ -42,12 +42,12 @@ The status selector includes manual statuses. Prowler also sets automatic status
 | **Remediating** | Manual | Work is in progress to fix the finding. |
 | **Risk Accepted** | Manual | The team accepts the risk and wants to mute the finding. |
 | **False Positive** | Manual | The finding does not apply and should be muted. |
-| **Resolved** | Automatic | A finding changed from `FAIL` to `PASS` in a later scan. A passed finding with no saved triage state also appears as **Resolved**. |
+| **Resolved** | Automatic / Manual | A finding changed from `FAIL` to `PASS` in a later scan. A passed finding with no saved triage state also appears as **Resolved**. On `MANUAL` findings, select it to verify the finding as passing (see [Verify a MANUAL Finding as Pass](#verify-a-manual-finding-as-pass)). |
 | **Reopened** | Automatic | A finding changed from `PASS` to `FAIL` in a later scan. |

 ![Findings Triage Status Selector](/images/prowler-app/findings-triage/findings-triage-status-dropdown.png)

-Resolved and Reopened are not manual selector options.
+**Reopened** is never a manual selector option. **Resolved** appears in the selector only on `MANUAL` findings, where it starts the [Manual Pass verification](#verify-a-manual-finding-as-pass).

 These automatic states keep triage tied to the finding UID across scans, even when each scan creates a new finding snapshot.

@@ -93,6 +93,39 @@ Triage notes are visible only to the team in the current organization. Each note

 To remove an existing note, clear the note text and save the change.

+## Verify a MANUAL Finding as Pass
+
+<VersionBadge version="5.39.0" />
+
+Checks that Prowler cannot judge automatically report `MANUAL` findings. When a team verifies such a control outside Prowler, the triage selector on that finding offers **Resolved**: choosing it records a Manual Pass attestation, and the finding reports an effective `PASS` while keeping the raw `MANUAL` scan result.
+
+![Triage selector offering Resolved on a MANUAL finding](/images/prowler-app/findings-triage/findings-triage-manual-pass-selector.png)
+
+<Steps>
+  <Step title="Filter MANUAL findings">
+    Go to **Findings** and filter by status **Manual**.
+  </Step>
+  <Step title="Open the triage selector">
+    Expand a Finding Group and click the current status in the **Triage** column of an individual finding.
+  </Step>
+  <Step title="Choose Resolved">
+    Select **Resolved**. Prowler opens the triage note modal with a required **Manual pass evidence** field.
+  </Step>
+  <Step title="Record the evidence">
+    Describe how the control was verified, then click **Save**. The evidence supports up to 500 characters.
+  </Step>
+</Steps>
+
+![Manual Pass attestation with required evidence](/images/prowler-app/findings-triage/findings-triage-manual-pass-note.png)
+
+After saving, the finding reports `PASS` in finding tables, finding groups, compliance reports, and scans. While the attestation is active, the triage status is managed automatically and cannot be changed. **View Manual Pass details** shows who verified the finding, the evidence, the attestation time, and its expiration.
+
+![Manual Pass details showing evidence, author, and validity](/images/prowler-app/findings-triage/findings-triage-manual-pass-details.png)
+
+### Attestation Expiration
+
+A Manual Pass attestation is valid for 90 days. It also ends early when a later scan reports a real failure for the finding. In both cases the finding returns to its raw `MANUAL` status for a new review.
+
 ## Mutelist Behavior

 Findings Triage uses Mutelist when a status means the finding should be muted:
@@ -118,7 +151,7 @@ Confirm that the user role has **Manage Scans** permission. Prowler Local Server

 ### Resolved or Reopened is missing from the selector

-This is expected. Prowler sets **Resolved** and **Reopened** automatically from scan result changes.
+**Reopened** is always automatic. **Resolved** is set automatically from scan result changes and appears as a selector option only on `MANUAL` findings, where it records a [Manual Pass](#verify-a-manual-finding-as-pass). On findings with any other status, this is expected.

 ### Risk Accepted or False Positive muted a finding

@@ -136,7 +136,7 @@ To view all `new` findings that have not been seen prior to this scan, click the
 ## Step 9: Download the Outputs
 Once a scan is complete, navigate to the `Scans` section to download the output files generated by Prowler:

-You can download the output files generated by Prowler as a single `zip` file. This archive contains the CSV, JSON-OSCF, and HTML reports detailing the findings.
+You can download the output files generated by Prowler as a single `zip` file. This archive contains the CSV, JSON-OCSF, and HTML reports detailing the findings.

 To download these files, click the **Download** button. This button becomes available only after the scan has finished.

@@ -66,7 +66,7 @@ The Prowler wizard walks you through the entire flow: deploying both roles from
 <Frame>
  <img src="/images/organizations/aws-console-org-id.png" alt="AWS Organizations Console showing the Organization ID in the left sidebar" />
 </Frame>
- **Name** (optional): A display name for the organization. If left blank, Prowler uses the name stored in AWS.
+- **Name** (optional): A display name for the organization. If left blank, Prowler uses the AWS organization ID.

 <Frame>
  <img src="/images/organizations/organization-details-form.png" alt="Organization Details form with Organization ID and Name fields" />
@@ -280,7 +280,7 @@ Open the row actions menu on the organization row on the **Providers** page.

 | Action | What it does |
 |--------|--------------|
-| **Edit Organization Name** | Renames the organization in Prowler. Leave it blank to fall back to the name stored in AWS. |
+| **Edit Organization Name** | Renames the organization in Prowler. Leave it blank to fall back to the AWS organization ID. |
 | **Update Credentials** | Reopens the Authentication Details step to store a new Role ARN. |
 | **Edit Scan Schedule** | Applies one schedule to every connected account in the organization. |
 | **Test Connections (N)** | Re-tests every account in the organization. |
@@ -1,11 +1,467 @@
 ---
 title: 'Azure Management Groups'
-description: 'Onboard all Azure subscriptions in your management groups through a single guided wizard'
-tag: "Coming Soon"
+description: 'Discover the Azure subscriptions in your management groups and onboard the ones you select through a single guided wizard'
 ---

-Onboarding Azure management groups through a single guided wizard is coming soon to Prowler Cloud.
+import { VersionBadge } from "/snippets/version-badge.mdx"
+import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"

-Today, Azure subscriptions are onboarded individually. See [Getting Started with Azure](/user-guide/providers/azure/getting-started-azure) and [Bulk Provider Provisioning](/user-guide/tutorials/bulk-provider-provisioning) to automate onboarding multiple subscriptions.
+<VersionBadge version="5.39.0" />

-Keep an eye on the [changelog](https://github.com/prowler-cloud/prowler/releases) for updates.
+Prowler Cloud discovers every Azure subscription in your Microsoft Entra tenant and onboards the eligible ones you select, through a single guided wizard. Instead of connecting subscriptions one by one, you can discover every Management Group and subscription under the tenant root Management Group, select the ones you want to monitor, test connectivity, and launch scans — all from the Prowler Cloud UI.
+
+<SubscriptionBanner>
+For Command-Line Interface (CLI) scanning of several subscriptions, see [Configuring Specific Subscription Scans in Prowler](/user-guide/providers/azure/subscriptions).
+</SubscriptionBanner>
+
+To follow this guide you need an active [Prowler Cloud](https://cloud.prowler.com) account and an Azure service principal with read access granted **at the tenant root Management Group**.
+
+## Overview
+
+### Individual Subscriptions vs Azure Management Groups
+
+| Approach | Best for | How it works |
+|----------|----------|--------------|
+| **Individual subscriptions** | A few Azure subscriptions | Connect each subscription one by one with its own service principal credential. |
+| **Azure Management Groups** | 10+ subscriptions, or any tenant organized into Management Groups | Connect once with a tenant-wide credential, discover every Management Group and subscription automatically, and scan them in bulk. |
+
+### How It Works
+
+Onboarding runs in four stages:
+
+1. **Grant read access** to one service principal at the tenant root Management Group.
+2. **Discover** — Prowler walks the Management Group hierarchy and returns every Management Group and subscription under the tenant root.
+3. **Select and connect** — choose the subscriptions to monitor. Prowler creates one provider per subscription and tests every connection.
+4. **Launch scans** — apply a scan schedule across the connected subscriptions.
+
+<Note>
+**Nothing is deployed into your tenant.** Unlike AWS Organizations onboarding, Azure onboarding creates no resources in Azure. Prowler reuses the service principal credential you provide as the credential of every subscription it onboards, so one credential covers discovery and scanning once all the required permissions are granted.
+</Note>
+
+<Note>
+**Onboarding always covers the whole tenant.** Prowler scopes the organization to the tenant root Management Group, which it derives from the Microsoft Entra tenant ID. The wizard therefore asks for the tenant, never for a Management Group — there is no partial onboarding from a Management Group further down the hierarchy.
+</Note>
+
+## Before You Start
+
+### Create a Service Principal
+
+Prowler Cloud authenticates against Azure with a service principal application. To create one, follow [Creating a Prowler Service Principal Application](/user-guide/providers/azure/create-prowler-service-principal). Keep the **client ID** and the **client secret** — the wizard asks for both.
+
+### Grant Read Access at the Tenant Root Management Group
+
+Discovery reads the Management Group hierarchy and the subscriptions inside it. Assign the built-in **Reader** role to the service principal **on the tenant root Management Group**, so the grant covers every Management Group and subscription beneath it:
+
+```bash
+TENANT_ID=<microsoft-entra-tenant-id>
+CLIENT_ID=<prowler-service-principal-client-id>
+
+# Resolve the exact service principal from its client ID. A display-name search
+# is a prefix match, so it can return a different principal than intended.
+SP_OBJECT_ID=$(az ad sp show --id "$CLIENT_ID" --query id -o tsv)
+
+az role assignment create \
+  --role "Reader" \
+  --assignee-object-id "$SP_OBJECT_ID" \
+  --assignee-principal-type ServicePrincipal \
+  --scope "/providers/Microsoft.Management/managementGroups/$TENANT_ID"
+```
+
+<Note>
+The tenant root Management Group is named after the tenant ID, so its resource identifier is always `/providers/Microsoft.Management/managementGroups/<tenant-id>`. Creating a role assignment there requires **Owner** or **User Access Administrator** at that scope; a Global Administrator who holds neither can grant themselves access through the elevated-access toggle in Microsoft Entra ID.
+</Note>
+
+### Grant the Scanning Permissions
+
+Scanning each subscription additionally needs the permissions described in [Azure Authentication in Prowler](/user-guide/providers/azure/authentication#required-permissions):
+
+| Permission | Scope | Used for |
+|------------|-------|----------|
+| **Reader** | Subscription, or inherited from the Management Group | Reading Azure resources during a scan. |
+| **ProwlerRole** | Subscription, or inherited from the Management Group | The read-only actions the Reader role does not cover. |
+| `AuditLog.Read.All`, `Directory.Read.All`, `Policy.Read.All` | Microsoft Entra ID (Microsoft Graph) | The Microsoft Entra ID checks. |
+
+Role assignments made at the tenant root Management Group are inherited by every subscription beneath it, so assigning **Reader** and **ProwlerRole** there means every subscription you onboard is scannable without a per-subscription grant. To create the custom role, see [Assigning "ProwlerRole" Permissions at the Subscription Level](/user-guide/providers/azure/authentication#assigning-prowlerrole-permissions-at-the-subscription-level) — and set its `assignableScopes` to the Management Group, `/providers/Microsoft.Management/managementGroups/<tenant-id>`, rather than to a single subscription, so it can be assigned once for the whole tenant.
+
+### Find Your Microsoft Entra Tenant ID
+
+Prowler identifies the organization by the Microsoft Entra tenant ID, a Universally Unique Identifier (UUID):
+
+```bash
+az account show --query tenantId -o tsv
+```
+
+In the Azure portal, the same value sits on your service principal's **App registrations** > **Overview** blade as **Directory (tenant) ID**, next to the **Application (client) ID** the wizard also asks for. [Adding Azure credentials to Prowler Cloud](/user-guide/providers/azure/getting-started-azure#step-3-add-credentials-to-prowler-cloud) shows both on the annotated blade.
+
+## Step 1: Start the Organization Wizard
+
+### Open the Wizard
+
+1. Navigate to **Providers** and click **Add Provider**.
+
+<Frame>
+  <img src="/images/organizations/cloud-providers-add.png" alt="Providers page showing the Add Provider button" />
+</Frame>
+
+2. Select **Microsoft Azure** as the provider.
+
+<Frame>
+  <img src="/images/organizations/azure/select-azure-provider.png" alt="Provider selection modal with Microsoft Azure highlighted" />
+</Frame>
+
+3. Choose **Add Multiple Subscriptions With Azure Management Group**.
+
+<Frame>
+  <img src="/images/organizations/azure/select-azure-management-groups-method.png" alt="Method selector showing the Add Multiple Subscriptions With Azure Management Group option highlighted" />
+</Frame>
+
+<Note>
+In Prowler Local Server the Management Group option is marked **Cloud** and opens an upgrade panel instead of the wizard. Management Group onboarding is a Prowler Cloud feature; the single-subscription method remains available.
+</Note>
+
+### Enter Organization Details
+
+- **Tenant ID**: the Microsoft Entra tenant ID (for example, `8b3c9a41-5f27-4d6e-9c18-7ae204f5b6d2`). Values that are not valid UUIDs are rejected before submission.
+- **Name** (optional): a display name for the organization in Prowler. If left blank, Prowler uses the tenant ID.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-organization-details-form.png" alt="Organization Details form with the Microsoft Entra tenant ID and Name fields" />
+</Frame>
+
+Click **Next** to proceed to the authentication phase. Prowler matches the organization by tenant ID, so submitting a tenant that is already onboarded reuses it instead of creating a duplicate.
+
+## Step 2: Authenticate With Azure
+
+The **Authentication Details** step collects the service principal Prowler uses to read the Management Group hierarchy and, later, to scan each subscription:
+
+- **Client ID**: the application (client) ID of the service principal, a UUID.
+- **Client Secret**: a client secret of that service principal.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-authentication-details.png" alt="Authentication Details step showing the Client ID and Client Secret fields" />
+</Frame>
+
+The tenant is not repeated here: Prowler takes it from the organization created in the previous step.
+
+<Warning>
+Every subscription you onboard inherits this credential. Revoking it, rotating the client secret, or deleting the service principal stops the scans of every subscription in the organization.
+</Warning>
+
+### Authenticate and Discover
+
+Click **Authenticate**. Prowler then:
+
+- Creates the organization and stores the credential securely.
+- Triggers an asynchronous discovery that walks the Management Group hierarchy.
+- Shows a **"Gathering Azure Subscriptions..."** spinner while it waits.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-gathering-subscriptions.png" alt="Gathering Azure Subscriptions spinner shown while discovery runs" />
+</Frame>
+
+Discovery usually takes seconds to a couple of minutes, depending on how many Management Groups and subscriptions the tenant holds.
+
+#### When Discovery Takes Too Long
+
+Prowler waits up to **3 minutes** for a result. Past that, the wizard stops waiting — but the discovery keeps running in Azure — and offers two actions:
+
+- **Keep waiting** — resume the same discovery. Nothing is re-read from Azure.
+- **Retry** — start a fresh discovery, which reads the hierarchy again.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-discovery-timeout.png" alt="Discovery timeout notice offering Keep waiting and Retry" />
+</Frame>
+
+If discovery fails outright, the wizard explains why and offers **Retry discovery**. See [Troubleshooting](#troubleshooting) for each message.
+
+## Step 3: Select Subscriptions to Scan
+
+### Understanding the Tree View
+
+Once discovery completes, the wizard renders the tenant as a hierarchical tree:
+
+<Frame>
+  <img src="/images/organizations/azure/azure-tree-view-subscriptions.png" alt="Hierarchical tree view showing Management Groups and subscriptions with selection checkboxes" />
+</Frame>
+
+- **Management Groups** nest under the tenant root; subscriptions that sit directly under the tenant root appear at the top level. The tenant root itself is not shown as a row — the whole tree is its content.
+- Each Management Group row shows its Management Group name, with the Azure display name beside it. Hover the name to read the full Azure Resource Manager (ARM) resource identifier.
+- **Selecting a Management Group** selects every selectable subscription beneath it. A Management Group whose subscriptions are only partly selected renders in an indeterminate state.
+- **Individual overrides**: deselect single subscriptions even when the parent Management Group is selected.
+- The header tracks the selection as **"X of Y subscriptions selected"**.
+- Management Group hierarchies are read up to **six levels** below the tenant root Management Group, which is Azure's own platform limit. Deeper tenants report an error at discovery — see [Troubleshooting](#troubleshooting).
+
+### Blocked Subscriptions
+
+A subscription is shown grayed out and cannot be selected when Azure reports it as inactive, or when onboarding it would conflict with something Prowler already stores. Hover the subscription to see the reason:
+
+| Reason | What it means |
+|--------|---------------|
+| `subscription_not_enabled` | The subscription is not in the **Enabled** state in Azure — it is disabled, expired, or otherwise inactive. Nothing in Prowler conflicts with it: resolve whatever Azure reports against the subscription, billing included, then run discovery again. |
+| `organization_conflict` | The subscription is already connected under a **different** Prowler organization. |
+| `organization_node_conflict` | The subscription is already grouped under a different Management Group in Prowler — for example, it moved in Azure after it was onboarded. |
+| `provider_type_conflict` | A provider with the same identifier exists in Prowler for another cloud provider. |
+
+<Frame>
+  <img src="/images/organizations/azure/azure-blocked-subscription.png" alt="Blocked subscription row with the reason shown in a tooltip" />
+</Frame>
+
+### Management Groups With Nothing to Select
+
+A Management Group that holds no subscriptions, or whose subscriptions are all blocked, is shown disabled with the note *"No subscriptions available to select in this management group."* The Management Group still expands, so you can see the blocked subscriptions it holds and why they are blocked.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-inert-group.png" alt="Disabled Management Group row noting that no subscriptions are available to select" />
+</Frame>
+
+### Custom Aliases
+
+Each subscription row carries an editable name, prefilled with the subscription's display name. The alias is used only inside Prowler — it does not rename anything in Azure. Management Group names are read-only: Prowler stores the display name from Azure.
+
+### Subscriptions That Already Have Credentials
+
+Applying your selection stores the organization credential on every selected subscription. When a selected subscription is already connected to Prowler with its own credential, that credential is **overwritten** — so the wizard asks first, naming the affected subscriptions:
+
+<Frame>
+  <img src="/images/organizations/azure/azure-replace-credentials-apply.png" alt="Replace existing credentials modal listing the subscriptions whose credentials will be replaced" />
+</Frame>
+
+Click **Replace and continue** to proceed, or **Cancel** to adjust your selection.
+
+<Note>
+**Your existing data is safe.** A subscription already connected as an individual provider is **linked** to the organization, never duplicated: its historical scans and findings are preserved, and it does not count twice toward your subscription.
+</Note>
+
+## Step 4: Test Connections
+
+Click **Test Connections** to verify that Prowler can authenticate against each selected subscription. Prowler creates one provider per subscription — identified by its Azure subscription ID — and then tests every connection.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-test-connections.png" alt="Connection testing in progress with status icons on each subscription" />
+</Frame>
+
+Each subscription shows a real-time status indicator:
+
+- **Spinner** — test in progress
+- **Green checkmark (✓)** — connection successful
+- **Red icon (✗)** — connection failed (hover to see the error)
+
+If every subscription connects successfully, you advance to the next step automatically.
+
+### When Some Tests Fail
+
+An error banner appears: **"There was a problem connecting to some subscriptions. Hover each subscription to check the error."** You have two options:
+
+**a) Fix and retry:**
+
+1. Confirm the service principal holds **Reader** and **ProwlerRole** on the failing subscriptions, or on a Management Group above them.
+2. Confirm the Microsoft Graph permissions have been granted admin consent, as described in [Azure Authentication in Prowler](/user-guide/providers/azure/authentication#assigning-required-api-permissions).
+3. Click **Test Connections** again — only the **failed subscriptions are re-tested**. Subscriptions that already passed are not tested again.
+
+**b) Skip and continue:**
+
+Click **Skip Connection Validation** to proceed with the subscriptions that connected successfully. Failed subscriptions stay onboarded and visible on the Providers page, but they are not scanned. This option appears only when at least one subscription connected.
+
+If **no subscription** connects, the banner instead reads *"No subscriptions connected successfully. Fix the connection errors and retry before launching scans."* and you cannot proceed. Fix the underlying problem — see [Troubleshooting](#troubleshooting) — and retry.
+
+## Step 5: Launch Scans
+
+The Organizations wizard uses the same schedule controls described in [Scan Scheduling](/user-guide/tutorials/prowler-scan-scheduling#schedule-options).
+
+Click **Save**, **Save and launch scan**, or **Launch scan**, depending on the selected schedule option. A toast notification confirms whether the schedule was saved, scans were launched, or both, and links to the **Scans** page. Prowler then redirects to the **Providers** page. Scans launch only for subscriptions that passed connection testing.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-launch-scan.png" alt="Launch Scan step showing the Subscriptions Connected confirmation and the scan schedule selector" />
+</Frame>
+
+After launching:
+
+- Scans appear on the **Scans** page as they start and complete.
+- Results populate the **Overview** and **Findings** pages.
+- On the **Providers** page, your subscriptions are grouped under the organization and, when they live in a Management Group, under that Management Group.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-providers-grouping.png" alt="Providers page showing subscriptions grouped under Azure Management Groups and the organization" />
+</Frame>
+
+## Manage Your Organization After Onboarding
+
+Open the row actions menu on the organization row on the **Providers** page.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-organization-row-actions.png" alt="Row actions menu on an Azure organization row" />
+</Frame>
+
+| Action | What it does |
+|--------|--------------|
+| **Edit Organization Name** | Renames the organization in Prowler. Leave it blank to fall back to the tenant ID. |
+| **Update Credentials** | Reopens the Authentication Details step to store a new service principal credential. |
+| **Edit Scan Schedule** | Applies one schedule to every connected subscription in the organization. |
+| **Test Connections (N)** | Re-tests every subscription in the organization. |
+| **Delete Organization** | Deletes the organization and cascades to its providers. |
+
+### Onboard Subscriptions Created Later
+
+Subscriptions added to the tenant after onboarding are not picked up automatically. Run the wizard again with the same tenant ID: discovery returns the current hierarchy, already-connected subscriptions come back preselected, and the new ones are ready to select.
+
+### Update Organization Credentials
+
+Choosing **Update Credentials** re-enters the Authentication Details step. Because the organization already holds a credential, Prowler warns before overwriting it and names how many providers re-authenticate with the new one:
+
+<Frame>
+  <img src="/images/organizations/azure/azure-replace-credentials-setup.png" alt="Replace existing credentials modal showing how many providers re-authenticate" />
+</Frame>
+
+Storing a new credential runs a fresh discovery, so any discovery already in progress is discarded — discovery authenticates with the credential it started from.
+
+### Delete an Organization or Management Group
+
+Deleting an organization or a Management Group **cascades to every provider grouped under it**, along with their scans and findings. Both dialogs state how many providers are affected before you confirm.
+
+<Frame>
+  <img src="/images/organizations/azure/azure-delete-organization.png" alt="Delete organization dialog showing how many providers are deleted with it" />
+</Frame>
+
+Deletion runs in the background. Prowler confirms with a **"Deletion started"** notification; if any part of it fails, the affected rows reappear on a later refresh.
+
+<Danger>
+Deleting an organization **permanently deletes every subscription provider grouped under it**, including their historical scans and findings. This action cannot be undone.
+</Danger>
+
+### When Grouping Is Unavailable
+
+If Prowler cannot read the hierarchy while loading the Providers page, a notice reads *"Organization grouping is incomplete. Some providers may appear ungrouped."* Your providers are still listed, just flat. Reload the page to try again.
+
+## Billing Impact
+
+Each Azure subscription you connect through the Organizations wizard counts as one **provider** in your Prowler Cloud subscription.
+
+- **Already-connected subscriptions**: linking an existing provider to the organization does **not** add billing. The existing provider is reused.
+- **Large tenants**: connecting a 500-subscription tenant results in up to 500 providers on your subscription. Review your plan limits before proceeding.
+- **Deleted providers**: a subscription you later remove no longer counts toward your subscription.
+
+For pricing details, see [Prowler Cloud Pricing](https://prowler.com/pricing).
+
+## Troubleshooting
+
+### Those Service Principal Credentials Were Rejected
+
+*"Those service principal credentials were rejected. Check the client ID and client secret, then try again."*
+
+Azure refused the sign-in. Confirm the client ID belongs to the service principal you granted access to, and that the client secret is current — secrets expire, and a rotated one invalidates the old value immediately.
+
+```bash
+az ad app credential list --id <client-id> --query "[].{name:displayName, expires:endDateTime}" -o table
+```
+
+### The Service Principal Cannot Read the Complete Management Group Hierarchy
+
+*"The service principal cannot read the complete Management Group hierarchy. Grant it the Reader role at the Management Group level, then try again."*
+
+The credential authenticated but lacks read access to part of the hierarchy. Grant **Reader** at the tenant root Management Group, as described in [Grant Read Access at the Tenant Root Management Group](#grant-read-access-at-the-tenant-root-management-group), and confirm the assignment landed on the Management Group and not on a single subscription:
+
+```bash
+az role assignment list \
+  --assignee <client-id> \
+  --scope "/providers/Microsoft.Management/managementGroups/<tenant-id>" \
+  --query "[].{role:roleDefinitionName, scope:scope}" -o table
+```
+
+### Azure Returned an Incomplete Management Group Hierarchy
+
+*"Azure returned an incomplete Management Group hierarchy. This usually clears on a retry; if it does not, check that the service principal can read every Management Group in the tenant."*
+
+Azure answered, but the hierarchy it returned was missing Management Groups that Prowler expected to find. This is usually a transient inconsistency in Azure Resource Manager, so click **Retry discovery** first.
+
+If it repeats, treat it as a permissions problem. Unlike the error above, Azure did not refuse the read — a partial grant can surface as missing data rather than as an outright denial. Confirm that the **Reader** assignment sits on the tenant root Management Group and not on individual Management Groups beneath it, using the command in [The Service Principal Cannot Read the Complete Management Group Hierarchy](#the-service-principal-cannot-read-the-complete-management-group-hierarchy).
+
+### The Tenant Root Management Group Could Not Be Found
+
+*"The tenant root Management Group could not be found. Check the tenant ID, and that the service principal has been granted access at the tenant root."*
+
+Prowler derives the tenant root Management Group from the tenant ID you entered, and could not read it. Either the tenant ID is wrong, or the service principal cannot see the root. Confirm the tenant ID and list what the credential can reach:
+
+```bash
+az account management-group list --query "[].{name:name, displayName:displayName}" -o table
+```
+
+### Those Credentials Belong to a Different Microsoft Entra Tenant
+
+*"Those credentials belong to a different Microsoft Entra tenant. Use a service principal from the tenant you entered."*
+
+The service principal is registered in another tenant. Register the application in the tenant being onboarded, or correct the tenant ID in the first step of the wizard.
+
+### Azure Did Not Respond
+
+*"Azure did not respond while reading the Management Group hierarchy. Nothing is wrong with your credentials — try again in a few minutes."*
+
+A transient Azure Resource Manager error. Click **Retry discovery**.
+
+### Azure Rate Limited the Hierarchy Read
+
+*"Azure rate limited the hierarchy read. Nothing is wrong with your credentials — try again in a few minutes."*
+
+Azure Resource Manager throttled Prowler's requests while it walked the hierarchy. Large tenants and back-to-back discoveries are the common causes. Wait a few minutes, then click **Retry discovery**.
+
+### The Hierarchy Is Too Deep
+
+*"This tenant's Management Group hierarchy is deeper than Prowler can read. Contact support so we can help you onboard it."*
+
+The tenant nests Management Groups deeper than Prowler reads in one pass. Contact [Prowler Support](mailto:support@prowler.com).
+
+### Authentication Failed
+
+*"Authentication failed. Please verify the service principal permissions or credentials, then try again."*
+
+The generic authentication failure, shown when Azure reports no more specific reason. Confirm that the service principal still exists, that its client secret has not expired, and that the Reader role assignment at the tenant root Management Group is still in place.
+
+### Azure Rejected the Hierarchy Read
+
+*"Azure rejected the hierarchy read. Try again, and contact support if it keeps failing."*
+
+Azure refused the request for a reason Prowler could not narrow down to credentials, permissions, or throttling. Click **Retry discovery**, and contact [Prowler Support](mailto:support@prowler.com) if the failure repeats. This message names Azure as the source of the failure; the one below is shown when the failure cannot be attributed to Azure at all.
+
+### Discovery Could Not Be Completed
+
+*"Discovery could not be completed. Try again, and contact support if it keeps failing."*
+
+Discovery failed for a reason Prowler cannot attribute to the credential or to Azure. Click **Retry discovery**, and contact [Prowler Support](mailto:support@prowler.com) if the failure repeats.
+
+### Discovery Never Finishes
+
+The wizard stops waiting after 3 minutes, but the discovery keeps running in Azure. Click **Keep waiting** to resume the same discovery rather than **Retry**, which starts over and re-reads the whole hierarchy.
+
+## Key Concepts
+
+### How Subscriptions Map to Prowler Providers
+
+Each selected subscription becomes one Prowler provider:
+
+| Prowler field | Comes from |
+|---------------|------------|
+| Provider identifier | The Azure subscription ID (for example, `22222222-2222-4222-8222-222222222222`). |
+| Alias | The name you typed in the tree, or the subscription's display name. |
+| Credential | A copy of the organization credential. |
+
+Management Groups that hold selected subscriptions become grouping rows on the Providers page. You select subscriptions only — Prowler derives the Management Group ancestors itself.
+
+### Organization Credential vs Subscription Credential
+
+One credential, stored twice: on the organization, where discovery reads it, and on each subscription provider, where scans read it. That is why replacing the organization credential re-authenticates every subscription under it, and why the wizard asks before overwriting a subscription's own credential.
+
+## What's Next
+
+<Columns cols={2}>
+  <Card title="Prowler Cloud" icon="cloud" href="/user-guide/tutorials/prowler-app">
+    Full guide to using Prowler Cloud features.
+  </Card>
+  <Card title="Azure Subscriptions (CLI)" icon="terminal" href="/user-guide/providers/azure/subscriptions">
+    CLI-based scanning of specific Azure subscriptions.
+  </Card>
+  <Card title="Azure Authentication" icon="key" href="/user-guide/providers/azure/authentication">
+    Credential types and the permissions Prowler needs in Azure.
+  </Card>
+  <Card title="Bulk Provider Provisioning" icon="upload" href="/user-guide/tutorials/bulk-provider-provisioning">
+    Script-based bulk provisioning for advanced automation.
+  </Card>
+</Columns>
@@ -120,7 +120,7 @@ In Prowler Local Server the organization option is marked **Cloud** and opens an
 ### Enter Organization Details

 - **Organization ID**: the numeric ID of your Google Cloud organization (for example, `123456789012`). Non-numeric values are rejected before submission.
- **Name** (optional): a display name for the organization in Prowler. If left blank, Prowler uses the name stored in Google Cloud.
+- **Name** (optional): a display name for the organization in Prowler. If left blank, Prowler uses the organization ID.

 <Frame>
  <img src="/images/organizations/gcp/gcp-organization-details-form.png" alt="Organization Details form with the Google Cloud organization ID and Name fields" />
@@ -307,7 +307,7 @@ Open the row actions menu on the organization row on the **Providers** page.

 | Action | What it does |
 |--------|--------------|
-| **Edit Organization Name** | Renames the organization in Prowler. Leave it blank to fall back to the name stored in Google Cloud. |
+| **Edit Organization Name** | Renames the organization in Prowler. Leave it blank to fall back to the organization ID. |
 | **Update Credentials** | Reopens the Authentication Details step to store a new credential. |
 | **Edit Scan Schedule** | Applies one schedule to every connected project in the organization. |
 | **Test Connections (N)** | Re-tests every project in the organization. |
@@ -42,6 +42,7 @@
        "lightsail:GetRelationalDatabases",
        "macie2:GetMacieSession",
        "macie2:GetAutomatedDiscoveryConfiguration",
+        "rolesanywhere:ListProfiles",
        "rolesanywhere:ListTagsForResource",
        "rolesanywhere:ListTrustAnchors",
        "s3:GetAccountPublicAccessBlock",
@@ -213,6 +213,7 @@ Resources:
                  - "lightsail:GetRelationalDatabases"
                  - "macie2:GetMacieSession"
                  - "macie2:GetAutomatedDiscoveryConfiguration"
+                  - "rolesanywhere:ListProfiles"
                  - "rolesanywhere:ListTagsForResource"
                  - "rolesanywhere:ListTrustAnchors"
                  - "s3:GetAccountPublicAccessBlock"
@@ -4,6 +4,27 @@ All notable changes to the **Prowler SDK** are documented in this file.

 <!-- changelog: release notes start -->

+## [5.39.0] (Prowler v5.39.0)
+
+### 🚀 Added
+
+- `batch_job_definition_no_secrets` check for AWS provider, scanning Batch job definition environment variables and command parameters for hardcoded secrets [(#12117)](https://github.com/prowler-cloud/prowler/pull/12117)
+- 7 M365 Entra checks covering CIS Microsoft 365 Foundations Benchmark v7.0.0 password protection, default user permissions, and guest invitation domain restrictions [(#12153)](https://github.com/prowler-cloud/prowler/pull/12153)
+- 7 M365 entra checks covering CIS Microsoft 365 Foundations Benchmark v7.0.0 Conditional Access (5.2.2.x) and idle session timeout controls [(#12154)](https://github.com/prowler-cloud/prowler/pull/12154)
+- `entra_authentication_method_email_otp_disabled`, `entra_authentication_method_authenticator_show_context`, `entra_pim_global_administrator_approval_required`, `entra_pim_privileged_role_administrator_approval_required`, `entra_access_review_guest_users_configured` and `entra_access_review_privileged_roles_configured` checks for M365 provider covering CIS Microsoft 365 Foundations Benchmark v7.0.0 authentication method, PIM approval and access review controls [(#12155)](https://github.com/prowler-cloud/prowler/pull/12155)
+- `awslambda_layer_no_secrets_in_content` check for AWS provider, scanning Lambda layer package content for hardcoded secrets [(#12233)](https://github.com/prowler-cloud/prowler/pull/12233)
+- CMMC 2.0 universal compliance framework (`cmmc_2.0`) with the 149 official requirements from 32 CFR Part 170 — Level 1 (15, 48 CFR 52.204-21), Level 2 (110, NIST SP 800-171 Rev 2) and Level 3 (24, NIST SP 800-172) — with AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud and M365 check mappings and config guardrails [(#12401)](https://github.com/prowler-cloud/prowler/pull/12401)
+
+### 🔄 Changed
+
+- GitHub `organization_repository_creation_limited` check now reports low severity for FAIL findings when repository creation is provably limited to private/internal visibility, instead of always reporting high [(#12164)](https://github.com/prowler-cloud/prowler/pull/12164)
+
+### 🔐 Security
+
+- HTML report header now HTML-escapes every provider identity field across all 23 providers, closing a stored XSS in the header block (Secur0, CWE-79) that was left unaddressed by the earlier finding-row fix in #12221 [(#12424)](https://github.com/prowler-cloud/prowler/pull/12424)
+
+---
+
 ## [5.38.0] (Prowler v5.38.0)

 ### 🚀 Added
@@ -1 +0,0 @@
-`awslambda_layer_no_secrets_in_content` check for AWS provider, scanning Lambda layer package content for hardcoded secrets
@@ -1 +0,0 @@
-`batch_job_definition_no_secrets` check for AWS provider, scanning Batch job definition environment variables and command parameters for hardcoded secrets
@@ -0,0 +1 @@
+ECS task-definition checks no longer report PASS when `DescribeTaskDefinition` fails before container evidence is gathered
@@ -0,0 +1 @@
+Add the `iam_workload_identity_pool_provider_attribute_condition` check to flag GCP Workload Identity Federation providers that trust a multi-tenant issuer without an attribute condition restricting which external identities can impersonate federated principals
@@ -0,0 +1 @@
+Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 so the published wheel installs with cryptography 50.0.0; 5.38.0 declared cryptography 50.0.0 while those packages capped it below 50, so pip could not install it and `pip install prowler` silently fell back to 5.37.1
@@ -1 +0,0 @@
-7 M365 Entra checks covering CIS Microsoft 365 Foundations Benchmark v7.0.0 password protection, default user permissions, and guest invitation domain restrictions
@@ -0,0 +1 @@
+Add the `rolesanywhere_profile_restricts_session_permissions` check to flag AWS IAM Roles Anywhere profiles that reference an administrative role without scoping down the vended session with a session policy or managed policies
@@ -0,0 +1 @@
+`ses_identity_not_publicly_accessible` now evaluates every SES identity authorization policy and marks mixed public Allow and Deny statements for manual review
@@ -0,0 +1 @@
+Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net`
@@ -0,0 +1 @@
+Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the SDK container image, patching Go standard library vulnerabilities and CVE-2026-53615
@@ -0,0 +1 @@
+Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe
@@ -170,7 +170,10 @@
    {
      "Id": "1.3.2",
      "Description": "Idle session timeout allows the configuration of a setting which will timeout inactive users after a pre-determined amount of time. When a user reaches the set idle timeout session, they'll get a notification that they're about to be signed out. They must choose to stay signed in or they'll be automatically signed out of all Microsoft 365 web apps. Combined with a Conditional Access rule this will only impact unmanaged devices. A managed device is considered a device managed by Intune MDM or joined to a domain (Entra ID or Hybrid joined). The following Microsoft 365 web apps are supported. - Outlook Web App - OneDrive - SharePoint - Microsoft Fabric - Microsoft365.com and other start pages - Microsoft 365 web apps (Word, Excel, PowerPoint) - Microsoft 365 Admin Center - M365 Defender Portal - Microsoft Purview Compliance Portal The recommended setting is 3 hours (or less) for unmanaged devices. Note: Idle session timeout doesn't affect Microsoft 365 desktop and mobile apps.",
-      "Checks": [],
+      "Checks": [
+        "entra_idle_session_timeout_configured",
+        "entra_conditional_access_policy_app_enforced_restrictions"
+      ],
      "Attributes": [
        {
          "Section": "1 Microsoft 365 admin center",
@@ -1783,7 +1786,9 @@
    {
      "Id": "5.2.2.8",
      "Description": "Microsoft Entra ID Protection sign-in risk detects risks in real-time and offline. A risky sign-in is an indicator for a sign-in attempt that might not have been performed by the legitimate owner of a user account. Note: While Identity Protection also provides two risk policies with limited conditions, Microsoft highly recommends setting up risk-based policies in Conditional Access as opposed to the \"legacy method\" for the following benefits: - Enhanced diagnostic data - Report-only mode integration - Graph API support - Use more Conditional Access attributes like sign-in frequency in the policy",
-      "Checks": [],
+      "Checks": [
+        "entra_conditional_access_policy_block_high_medium_sign_in_risk"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -1896,7 +1901,9 @@
    {
      "Id": "5.2.2.13",
      "Description": "Sign-in frequency defines the time period before a user is asked to sign in again when attempting to access a resource. The Microsoft Entra ID default configuration for user sign-in frequency is a rolling window of 90 days. The recommended state for all users is to enforce periodic reauthentication for 7 days or less.",
-      "Checks": [],
+      "Checks": [
+        "entra_conditional_access_policy_sign_in_frequency_all_users"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -1917,7 +1924,9 @@
    {
      "Id": "5.2.2.14",
      "Description": "Microsoft Entra ID Conditional Access allows an organization to configure Named locations and configure whether those locations are trusted or untrusted. These settings provide organizations the means to specify Geographical locations for use in conditional access policies, or define actual IP addresses and IP ranges and whether or not those IP addresses and/or ranges are trusted by the organization. The recommended state is to define at least one trusted, IP range named location.",
-      "Checks": [],
+      "Checks": [
+        "entra_conditional_access_trusted_named_location_exists"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -1938,7 +1947,9 @@
    {
      "Id": "5.2.2.15",
      "Description": "Conditional Access Policies can be used to block access from geographic locations that are deemed out-of-scope for your organization or application. The scope and variables for this policy should be carefully examined and defined. The recommended state is to configure at least one policy to block access from untrusted locations.",
-      "Checks": [],
+      "Checks": [
+        "entra_conditional_access_policy_untrusted_locations_blocked"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -1959,7 +1970,9 @@
    {
      "Id": "5.2.2.16",
      "Description": "Token Protection is a Conditional Access session control that attempts to reduce token replay attacks by ensuring only device bound sign-in session tokens, like Primary Refresh Tokens (PRTs), are accepted by Microsoft Entra ID when applications request access to protected resources. When a user registers a supported device with Microsoft Entra, a PRT is issued and cryptographically bound to that device. This binding ensures that even if a threat actor steals the token, it can't be used from another device. With Token Protection enforced, Microsoft Entra validates that only these bound sign-in session tokens are used by supported applications. The recommended state is to enforce Token Protection for Office 365 Exchange Online, Office 365 SharePoint Online and Microsoft Teams Services.",
-      "Checks": [],
+      "Checks": [
+        "entra_conditional_access_policy_token_protection_enforced"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -1980,7 +1993,9 @@
    {
      "Id": "5.2.2.17",
      "Description": "Authentication transfer is a flow that lets users seamlessly transfer authenticated state from one device to another. For example, users might see a QR code in the desktop version of Outlook that, when scanned on their mobile device, transfers their authenticated state to the mobile device. The recommended state is to block Authentication transfer.",
-      "Checks": [],
+      "Checks": [
+        "entra_conditional_access_policy_authentication_transfer_blocked"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -2001,7 +2016,9 @@
    {
      "Id": "5.2.3.1",
      "Description": "Microsoft provides supporting settings to enhance the configuration of the Microsoft Authenticator application. These settings provide users with additional information and context when they receive MFA passwordless and push requests, including the geographic location of the request, the requesting application, and a requirement for number matching. The recommended state is Enabled for the following: - Show application name in push and passwordless notifications - Show geographic location in push and passwordless notifications Note: On February 27, 2023 Microsoft started enforcing number matching tenant-wide for all users using Microsoft Authenticator.",
-      "Checks": [],
+      "Checks": [
+        "entra_authentication_method_authenticator_show_context"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -2135,7 +2152,9 @@
    {
      "Id": "5.2.3.7",
      "Description": "Authentication methods support a wide variety of scenarios for signing in to Microsoft 365 resources. Some of these methods are inherently more secure than others but require more investment in time to get users enrolled and operational. The email one-time passcode feature is a way to authenticate B2B collaboration users when they can't be authenticated through other means, such as Microsoft Entra ID, Microsoft account (MSA), or social identity providers. When a B2B guest user tries to redeem your invitation or sign in to your shared resources, they can request a temporary passcode, which is sent to their email address. Then they enter this passcode to continue signing in. The recommended state is to Disable email OTP.",
-      "Checks": [],
+      "Checks": [
+        "entra_authentication_method_email_otp_disabled"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -2349,7 +2368,9 @@
    {
      "Id": "5.3.2",
      "Description": "Access reviews enable administrators to establish an efficient automated process for reviewing group memberships, access to enterprise applications, and role assignments. These reviews can be scheduled to recur regularly, with flexible options for delegating the task of reviewing membership to different members of the organization. When configured for guest users, access reviews can automatically remove access if no reviewer responds within the review period, enforcing a fail-closed posture for external identities.",
-      "Checks": [],
+      "Checks": [
+        "entra_access_review_guest_users_configured"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -2370,7 +2391,9 @@
    {
      "Id": "5.3.3",
      "Description": "Access reviews in Microsoft Entra Privileged Identity Management (PIM) enable administrators to periodically validate whether users still require their privileged role assignments. These reviews can be scheduled to recur on a regular cadence and can be delegated to reviewers other than the role holders themselves, such as security auditors.",
-      "Checks": [],
+      "Checks": [
+        "entra_access_review_privileged_roles_configured"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -2391,7 +2414,9 @@
    {
      "Id": "5.3.4",
      "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Requiring approval before activation allows one of the selected approvers to first review and then approve the activation prior to PIM granted the role. The approver doesn't have to be a group member or owner. The recommended state is Require approval to activate for the Global Administrator role.",
-      "Checks": [],
+      "Checks": [
+        "entra_pim_global_administrator_approval_required"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -2412,7 +2437,9 @@
    {
      "Id": "5.3.5",
      "Description": "Microsoft Entra Privileged Identity Management can be used to audit roles, allow just in time activation of roles and allow for periodic role attestation. Requiring approval before activation allows one of the selected approvers to first review and then approve the activation prior to PIM granted the role. The approver doesn't have to be a group member or owner. The recommended state is Require approval to activate for the Privileged Role Administrator role.",
-      "Checks": [],
+      "Checks": [
+        "entra_pim_privileged_role_administrator_approval_required"
+      ],
      "Attributes": [
        {
          "Section": "5 Microsoft Entra admin center",
@@ -49,7 +49,7 @@ class _MutableTimestamp:

 timestamp = _MutableTimestamp(datetime.today())
 timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.39.0"
+prowler_version = "5.40.0"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"
@@ -463,6 +463,11 @@ class HTML(Output):
                audited_regions = "All Regions"
            else:
                audited_regions = ", ".join(provider.identity.audited_regions)
+            account = escape(str(provider.identity.account))
+            profile = escape(str(profile))
+            audited_regions = escape(str(audited_regions))
+            user_id = escape(str(provider.identity.user_id))
+            identity_arn = escape(str(provider.identity.identity_arn))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -471,7 +476,7 @@ class HTML(Output):
                        </div>
                        <ul class="list-group list-group-flush">
                            <li class="list-group-item">
-                                <b>AWS Account:</b> {provider.identity.account}
+                                <b>AWS Account:</b> {account}
                            </li>
                            <li class="list-group-item">
                                <b>AWS-CLI Profile:</b> {profile}
@@ -489,10 +494,10 @@ class HTML(Output):
                    </div>
                    <ul class="list-group list-group-flush">
                        <li class="list-group-item">
-                            <b>User Id:</b> {provider.identity.user_id}
+                            <b>User Id:</b> {user_id}
                            </li>
                            <li class="list-group-item">
-                                <b>Caller Identity ARN:</b> {provider.identity.identity_arn}
+                                <b>Caller Identity ARN:</b> {identity_arn}
                            </li>
                        </ul>
                    </div>
@@ -530,6 +535,11 @@ class HTML(Output):
                )
            else:
                html_identity = provider.identity.identity_id
+            tenant_ids = escape(" ".join(provider.identity.tenant_ids))
+            tenant_domain = escape(str(provider.identity.tenant_domain))
+            subscriptions = escape(" ".join(printed_subscriptions))
+            identity_type = escape(str(provider.identity.identity_type))
+            html_identity = escape(str(html_identity))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -538,13 +548,13 @@ class HTML(Output):
                        </div>
                        <ul class="list-group list-group-flush">
                            <li class="list-group-item">
-                                <b>Azure Tenant IDs:</b> {" ".join(provider.identity.tenant_ids)}
+                                <b>Azure Tenant IDs:</b> {tenant_ids}
                            </li>
                            <li class="list-group-item">
-                                <b>Azure Tenant Domain:</b> {provider.identity.tenant_domain}
+                                <b>Azure Tenant Domain:</b> {tenant_domain}
                            </li>
                            <li class="list-group-item">
-                                <b>Azure Subscriptions:</b> {" ".join(printed_subscriptions)}
+                                <b>Azure Subscriptions:</b> {subscriptions}
                            </li>
                        </ul>
                    </div>
@@ -556,7 +566,7 @@ class HTML(Output):
                    </div>
                    <ul class="list-group list-group-flush">
                        <li class="list-group-item">
-                            <b>Azure Identity Type:</b> {provider.identity.identity_type}
+                            <b>Azure Identity Type:</b> {identity_type}
                            </li>
                            <li class="list-group-item">
                                <b>Azure Identity ID:</b> {html_identity}
@@ -591,6 +601,8 @@ class HTML(Output):
                )
            except AttributeError:
                profile = "default"
+            project_ids = escape(", ".join(provider.project_ids))
+            profile = escape(str(profile))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -599,7 +611,7 @@ class HTML(Output):
                        </div>
                        <ul class="list-group list-group-flush">
                            <li class="list-group-item">
-                                <b>GCP Project IDs:</b> {", ".join(provider.project_ids)}
+                                <b>GCP Project IDs:</b> {project_ids}
                            </li>
                        </ul>
                    </div>
@@ -634,6 +646,8 @@ class HTML(Output):
            str: the HTML assessment summary
        """
        try:
+            cluster = escape(str(provider.identity.cluster))
+            context = escape(str(provider.identity.context))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -643,7 +657,7 @@ class HTML(Output):
                        <ul class="list-group
                        list-group-flush">
                            <li class="list-group-item">
-                                <b>Kubernetes Cluster:</b> {provider.identity.cluster}
+                                <b>Kubernetes Cluster:</b> {cluster}
                            </li>
                        </ul>
                    </div>
@@ -656,7 +670,7 @@ class HTML(Output):
                        <ul class="list-group
                        list-group-flush">
                            <li class="list-group-item">
-                                <b>Kubernetes Context:</b> {provider.identity.context}
+                                <b>Kubernetes Context:</b> {context}
                            </li>
                        </ul>
                    </div>
@@ -679,11 +693,13 @@ class HTML(Output):
            str: the HTML assessment summary
        """
        try:
+            auth_method = escape(str(provider.auth_method))
            if hasattr(provider.identity, "account_name"):
                # GithubIdentityInfo (Personal Access Token, OAuth)
+                account_name = escape(str(provider.identity.account_name))
                account_info_items = f"""
                            <li class="list-group-item">
-                                <b>GitHub account:</b> {provider.identity.account_name}
+                                <b>GitHub account:</b> {account_name}
                            </li>
                            """
                # Add email if available
@@ -691,23 +707,27 @@ class HTML(Output):
                    hasattr(provider.identity, "account_email")
                    and provider.identity.account_email
                ):
+                    account_email = escape(str(provider.identity.account_email))
                    account_info_items += f"""
                                <li class="list-group-item">
-                                    <b>GitHub account email:</b> {provider.identity.account_email}
+                                    <b>GitHub account email:</b> {account_email}
                                </li>"""
            elif hasattr(provider.identity, "app_id"):
                # GithubAppIdentityInfo (GitHub App)
                # Assessment items: App Name and Installations
+                app_name = escape(str(provider.identity.app_name))
                account_info_items = f"""
                                <li class="list-group-item">
-                                    <b>GitHub App Name:</b> {provider.identity.app_name}
+                                    <b>GitHub App Name:</b> {app_name}
                                </li>"""
                # Add installations if available
                if (
                    hasattr(provider.identity, "installations")
                    and provider.identity.installations
                ):
-                    installations_display = ", ".join(provider.identity.installations)
+                    installations_display = escape(
+                        ", ".join(provider.identity.installations)
+                    )
                    account_info_items += f"""
                            <li class="list-group-item">
                                <b>Installations:</b> {installations_display}
@@ -719,26 +739,27 @@ class HTML(Output):
                            </li>"""

                # Credentials items: Authentication method and App ID
+                app_id = escape(str(provider.identity.app_id))
                credentials_items = f"""
                            <li class="list-group-item">
-                                <b>GitHub authentication method:</b> {provider.auth_method}
+                                <b>GitHub authentication method:</b> {auth_method}
                            </li>
                            <li class="list-group-item">
-                                <b>GitHub App ID:</b> {provider.identity.app_id}
+                                <b>GitHub App ID:</b> {app_id}
                            </li>"""
            else:
                # Fallback for other identity types
                account_info_items = ""
                credentials_items = f"""
                            <li class="list-group-item">
-                                <b>GitHub authentication method:</b> {provider.auth_method}
+                                <b>GitHub authentication method:</b> {auth_method}
                            </li>"""

            # For PAT/OAuth, use default credentials structure
            if hasattr(provider.identity, "account_name"):
                credentials_items = f"""
                            <li class="list-group-item">
-                                <b>GitHub authentication method:</b> {provider.auth_method}
+                                <b>GitHub authentication method:</b> {auth_method}
                            </li>"""

            return f"""
@@ -779,6 +800,18 @@ class HTML(Output):
            str: the HTML assessment summary
        """
        try:
+            tenant_domain = escape(str(provider.identity.tenant_domain))
+            identity_type = escape(str(provider.identity.identity_type))
+            identity_id = escape(str(provider.identity.identity_id))
+            user_item = ""
+            if (
+                hasattr(provider.identity, "user")
+                and provider.identity.user is not None
+            ):
+                user = escape(str(provider.identity.user))
+                user_item = f"""<li class="list-group-item">
+                                <b>M365 User:</b> {user}
+                            </li>"""
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -787,9 +820,7 @@ class HTML(Output):
                        </div>
                        <ul class="list-group list-group-flush">
                            <li class="list-group-item">
-                                <b>M365 Tenant Domain:</b> {
-                provider.identity.tenant_domain
-            }
+                                <b>M365 Tenant Domain:</b> {tenant_domain}
                            </li>
                        </ul>
                    </div>
@@ -801,19 +832,12 @@ class HTML(Output):
                    </div>
                    <ul class="list-group list-group-flush">
                        <li class="list-group-item">
-                            <b>M365 Identity Type:</b> {provider.identity.identity_type}
+                            <b>M365 Identity Type:</b> {identity_type}
                            </li>
                            <li class="list-group-item">
-                                <b>M365 Identity ID:</b> {provider.identity.identity_id}
+                                <b>M365 Identity ID:</b> {identity_id}
                            </li>
-                            {
-                f'''<li class="list-group-item">
-                                <b>M365 User:</b> {provider.identity.user}
-                            </li>'''
-                if hasattr(provider.identity, "user")
-                and provider.identity.user is not None
-                else ""
-            }
+                            {user_item}
                        </ul>
                    </div>
                </div>"""
@@ -834,6 +858,9 @@ class HTML(Output):
            str: the HTML assessment summary
        """
        try:
+            tenant_domain = escape(str(provider.identity.tenant_domain))
+            identity_type = escape(str(provider.identity.identity_type))
+            identity_id = escape(str(provider.identity.identity_id))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -842,7 +869,7 @@ class HTML(Output):
                        </div>
                        <ul class="list-group list-group-flush">
                            <li class="list-group-item">
-                                <b>NHN Tenant Domain:</b> {provider.identity.tenant_domain}
+                                <b>NHN Tenant Domain:</b> {tenant_domain}
                            </li>
                        </ul>
                    </div>
@@ -854,10 +881,10 @@ class HTML(Output):
                    </div>
                    <ul class="list-group list-group-flush">
                        <li class="list-group-item">
-                            <b>NHN Identity Type:</b> {provider.identity.identity_type}
+                            <b>NHN Identity Type:</b> {identity_type}
                            </li>
                            <li class="list-group-item">
-                                <b>NHN Identity ID:</b> {provider.identity.identity_id}
+                                <b>NHN Identity ID:</b> {identity_id}
                            </li>
                        </ul>
                    </div>
@@ -880,6 +907,7 @@ class HTML(Output):
            str: the HTML assessment summary
        """
        try:
+            organization_name = escape(str(provider.identity.organization_name))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -889,7 +917,7 @@ class HTML(Output):
                        <ul class="list-group
                        list-group-flush">
                            <li class="list-group-item">
-                                <b>MongoDB Atlas organization:</b> {provider.identity.organization_name}
+                                <b>MongoDB Atlas organization:</b> {organization_name}
                            </li>
                        </ul>
                    </div>
@@ -925,6 +953,13 @@ class HTML(Output):
            str: the HTML assessment summary
        """
        try:
+            if provider.scan_repository_url:
+                target_info = "<b>IAC repository URL:</b> " + str(
+                    escape(str(provider.scan_repository_url))
+                )
+            else:
+                target_info = "<b>IAC path:</b> " + str(escape(str(provider.scan_path)))
+            auth_method = escape(str(provider.auth_method))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -934,7 +969,7 @@ class HTML(Output):
                        <ul class="list-group
                        list-group-flush">
                            <li class="list-group-item">
-                                {"<b>IAC repository URL:</b> " + provider.scan_repository_url if provider.scan_repository_url else "<b>IAC path:</b> " + provider.scan_path}
+                                {target_info}
                            </li>
                        </ul>
                    </div>
@@ -947,7 +982,7 @@ class HTML(Output):
                        <ul class="list-group
                        list-group-flush">
                            <li class="list-group-item">
-                                <b>IAC authentication method:</b> {provider.auth_method}
+                                <b>IAC authentication method:</b> {auth_method}
                            </li>
                        </ul>
                    </div>
@@ -971,10 +1006,13 @@ class HTML(Output):
        """
        try:
            if provider.registry:
-                target_info = f"<b>Registry URL:</b> {provider.registry}"
+                registry = escape(str(provider.registry))
+                target_info = f"<b>Registry URL:</b> {registry}"
            else:
-                target_info = f'<b>Images:</b> {", ".join(provider.images)}'
+                images = escape(", ".join(provider.images))
+                target_info = f"<b>Images:</b> {images}"

+            auth_method = escape(str(provider.auth_method))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -997,7 +1035,7 @@ class HTML(Output):
                        <ul class="list-group
                        list-group-flush">
                            <li class="list-group-item">
-                                <b>Image authentication method:</b> {provider.auth_method}
+                                <b>Image authentication method:</b> {auth_method}
                            </li>
                        </ul>
                    </div>
@@ -1020,6 +1058,14 @@ class HTML(Output):
            str: HTML assessment summary for the LLM provider
        """
        try:
+            model = escape(str(provider.model))
+            plugins = escape(", ".join(provider.plugins))
+            max_concurrency = escape(str(provider.max_concurrency))
+            config_file = escape(
+                str(provider.config_path)
+                if provider.config_path
+                else "Using promptfoo defaults"
+            )
            return f"""
                <div class="card">
                    <div class="card-header">
@@ -1031,16 +1077,16 @@ class HTML(Output):
                        <ul class="list-group
                        list-group-flush">
                            <li class="list-group-item">
-                                <b>Target LLM:</b> {provider.model}
+                                <b>Target LLM:</b> {model}
                            </li>
                            <li class="list-group-item">
-                                <b>Plugins:</b> {", ".join(provider.plugins)}
+                                <b>Plugins:</b> {plugins}
                            </li>
                            <li class="list-group-item">
-                                <b>Max concurrency:</b> {provider.max_concurrency}
+                                <b>Max concurrency:</b> {max_concurrency}
                            </li>
                            <li class="list-group-item">
-                                <b>Config file:</b> {provider.config_path if provider.config_path else "Using promptfoo defaults"}
+                                <b>Config file:</b> {config_file}
                            </li>
                        </ul>
                    </div>
@@ -1069,6 +1115,10 @@ class HTML(Output):
            tenancy_name = getattr(provider.identity, "tenancy_name", "unknown")
            tenancy_id = getattr(provider.identity, "tenancy_id", "unknown")

+            tenancy = escape(
+                str(tenancy_name if tenancy_name != "unknown" else tenancy_id)
+            )
+            profile = escape(str(profile))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -1077,7 +1127,7 @@ class HTML(Output):
                        </div>
                        <ul class="list-group list-group-flush">
                            <li class="list-group-item">
-                                <b>OracleCloud Tenancy:</b> {tenancy_name if tenancy_name != "unknown" else tenancy_id}
+                                <b>OracleCloud Tenancy:</b> {tenancy}
                            </li>
                        </ul>
                    </div>
@@ -1116,10 +1166,11 @@ class HTML(Output):
            project_name = getattr(provider.identity, "project_name", "")
            audited_regions = getattr(provider.identity, "audited_regions", set())

+            project_id = escape(str(project_id))
            project_name_item = (
                f"""
                            <li class="list-group-item">
-                                <b>Project Name:</b> {project_name}
+                                <b>Project Name:</b> {escape(str(project_name))}
                            </li>"""
                if project_name
                else ""
@@ -1128,7 +1179,7 @@ class HTML(Output):
            regions_item = (
                f"""
                            <li class="list-group-item">
-                                <b>Regions:</b> {", ".join(sorted(audited_regions))}
+                                <b>Regions:</b> {escape(", ".join(sorted(audited_regions)))}
                            </li>"""
                if audited_regions
                else ""
@@ -1182,7 +1233,7 @@ class HTML(Output):
            # Build assessment summary items (only non-None values)
            assessment_items = ""
            if provider.accounts:
-                accounts = ", ".join([acc.id for acc in provider.accounts])
+                accounts = escape(", ".join([str(acc.id) for acc in provider.accounts]))
                assessment_items += f"""
                            <li class="list-group-item">
                                <b>Accounts:</b> {accounts}
@@ -1208,6 +1259,7 @@ class HTML(Output):
                provider.session, "api_email", None
            )
            if email:
+                email = escape(str(email))
                credentials_items += f"""
                            <li class="list-group-item">
                                <b>Email:</b> {email}
@@ -1261,11 +1313,15 @@ class HTML(Output):
            account_name_item = (
                f"""
                            <li class="list-group-item">
-                                <b>Account Name:</b> {account_name}
+                                <b>Account Name:</b> {escape(str(account_name))}
                            </li>"""
                if account_name
                else ""
            )
+            account_id = escape(str(account_id))
+            audited_regions = escape(str(audited_regions))
+            user_name = escape(str(user_name))
+            identity_arn = escape(str(identity_arn))

            return f"""
                <div class="col-md-2">
@@ -1326,7 +1382,7 @@ class HTML(Output):
            project_name_item = (
                f"""
                            <li class="list-group-item">
-                                <b>Project Name:</b> {project_name}
+                                <b>Project Name:</b> {escape(str(project_name))}
                            </li>"""
                if project_name
                else ""
@@ -1335,11 +1391,14 @@ class HTML(Output):
            user_id_item = (
                f"""
                            <li class="list-group-item">
-                                <b>User ID:</b> {user_id}
+                                <b>User ID:</b> {escape(str(user_id))}
                            </li>"""
                if user_id
                else ""
            )
+            project_id = escape(str(project_id))
+            region_name = escape(str(region_name))
+            username = escape(str(username))

            return f"""
                <div class="col-md-2">
@@ -1389,6 +1448,9 @@ class HTML(Output):
            str: HTML assessment summary for the Google Workspace provider
        """
        try:
+            domain = escape(str(provider.identity.domain))
+            customer_id = escape(str(provider.identity.customer_id))
+            delegated_user = escape(str(provider.identity.delegated_user))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -1397,10 +1459,10 @@ class HTML(Output):
                        </div>
                        <ul class="list-group list-group-flush">
                            <li class="list-group-item">
-                                <b>Domain:</b> {provider.identity.domain}
+                                <b>Domain:</b> {domain}
                            </li>
                            <li class="list-group-item">
-                                <b>Customer ID:</b> {provider.identity.customer_id}
+                                <b>Customer ID:</b> {customer_id}
                            </li>
                        </ul>
                    </div>
@@ -1412,7 +1474,7 @@ class HTML(Output):
                        </div>
                        <ul class="list-group list-group-flush">
                            <li class="list-group-item">
-                                <b>Delegated User:</b> {provider.identity.delegated_user}
+                                <b>Delegated User:</b> {delegated_user}
                            </li>
                            <li class="list-group-item">
                                <b>Authentication Method:</b> Service Account with Domain-Wide Delegation
@@ -1482,9 +1544,11 @@ class HTML(Output):

            team = getattr(provider.identity, "team", None)
            if team:
+                team_name = escape(str(team.name))
+                team_id = escape(str(team.id))
                assessment_items += f"""
                            <li class="list-group-item">
-                                <b>Team:</b> {team.name} ({team.id})
+                                <b>Team:</b> {team_name} ({team_id})
                            </li>"""

            credentials_items = """
@@ -1494,6 +1558,7 @@ class HTML(Output):

            email = getattr(provider.identity, "email", None)
            if email:
+                email = escape(str(email))
                credentials_items += f"""
                            <li class="list-group-item">
                                <b>Email:</b> {email}
@@ -1501,6 +1566,7 @@ class HTML(Output):

            username = getattr(provider.identity, "username", None)
            if username:
+                username = escape(str(username))
                credentials_items += f"""
                            <li class="list-group-item">
                                <b>Username:</b> {username}
@@ -1543,17 +1609,20 @@ class HTML(Output):
            str: HTML assessment summary for the Okta provider
        """
        try:
+            org_domain = escape(str(provider.identity.org_domain))
+            auth_method = escape(str(provider.auth_method))
+            client_id = escape(str(provider.identity.client_id))
            assessment_items = f"""
                            <li class="list-group-item">
-                                <b>Okta Domain:</b> {provider.identity.org_domain}
+                                <b>Okta Domain:</b> {org_domain}
                            </li>"""

            credentials_items = f"""
                            <li class="list-group-item">
-                                <b>Authentication:</b> {provider.auth_method}
+                                <b>Authentication:</b> {auth_method}
                            </li>
                            <li class="list-group-item">
-                                <b>Client ID:</b> {provider.identity.client_id}
+                                <b>Client ID:</b> {client_id}
                            </li>"""

            return f"""
@@ -1593,9 +1662,10 @@ class HTML(Output):
            str: HTML assessment summary for the Scaleway provider
        """
        try:
+            organization_id = escape(str(provider.identity.organization_id))
            assessment_items = f"""
                            <li class="list-group-item">
-                                <b>Organization ID:</b> {provider.identity.organization_id}
+                                <b>Organization ID:</b> {organization_id}
                            </li>"""

            credentials_items = """
@@ -1605,6 +1675,7 @@ class HTML(Output):

            access_key = getattr(provider.session, "access_key", None)
            if access_key:
+                access_key = escape(str(access_key))
                credentials_items += f"""
                            <li class="list-group-item">
                                <b>Access Key:</b> {access_key}
@@ -1615,6 +1686,8 @@ class HTML(Output):
            bearer_id = getattr(provider.identity, "bearer_id", None)
            if bearer_type:
                bearer_label = bearer_email or bearer_id or "-"
+                bearer_type = escape(str(bearer_type))
+                bearer_label = escape(str(bearer_label))
                credentials_items += f"""
                            <li class="list-group-item">
                                <b>Bearer:</b> {bearer_type} ({bearer_label})
@@ -1622,6 +1695,7 @@ class HTML(Output):

            region = getattr(provider.session, "default_region", None)
            if region:
+                region = escape(str(region))
                credentials_items += f"""
                            <li class="list-group-item">
                                <b>Default Region:</b> {region}
@@ -1668,6 +1742,9 @@ class HTML(Output):
            email = getattr(provider.identity, "email", None) or "-"
            account_id = getattr(provider.identity, "account_id", None) or "-"

+            username = escape(str(username))
+            email = escape(str(email))
+            account_id = escape(str(account_id))
            assessment_items = f"""
                            <li class="list-group-item">
                                <b>Account ID:</b> {account_id}
@@ -1732,6 +1809,14 @@ class HTML(Output):
                audited_regions = "All Regions"
            else:
                audited_regions = ", ".join(provider.identity.regions)
+            account_id = escape(str(provider.identity.account_id))
+            account_name = escape(str(provider.identity.account_name))
+            profile = escape(str(profile))
+            audited_regions = escape(str(audited_regions))
+            domain_id = escape(str(provider.identity.domain_id))
+            user_id = escape(str(provider.identity.user_id))
+            user_name = escape(str(provider.identity.user_name))
+            identity_type = escape(str(provider.identity.identity_type))
            return f"""
                <div class="col-md-2">
                    <div class="card">
@@ -1740,10 +1825,10 @@ class HTML(Output):
                        </div>
                        <ul class="list-group list-group-flush">
                            <li class="list-group-item">
-                                <b>Account ID:</b> {provider.identity.account_id}
+                                <b>Account ID:</b> {account_id}
                            </li>
                            <li class="list-group-item">
-                                <b>Account Name:</b> {provider.identity.account_name}
+                                <b>Account Name:</b> {account_name}
                            </li>
                            <li class="list-group-item">
                                <b>Profile:</b> {profile}
@@ -1761,16 +1846,16 @@ class HTML(Output):
                    </div>
                    <ul class="list-group list-group-flush">
                        <li class="list-group-item">
-                            <b>Domain ID:</b> {provider.identity.domain_id}
+                            <b>Domain ID:</b> {domain_id}
                        </li>
                        <li class="list-group-item">
-                            <b>User ID:</b> {provider.identity.user_id}
+                            <b>User ID:</b> {user_id}
                        </li>
                        <li class="list-group-item">
-                            <b>User Name:</b> {provider.identity.user_name}
+                            <b>User Name:</b> {user_name}
                        </li>
                        <li class="list-group-item">
-                            <b>Identity Type:</b> {provider.identity.identity_type}
+                            <b>Identity Type:</b> {identity_type}
                        </li>
                    </ul>
                </div>
@@ -149,8 +149,8 @@ class ECS(AWSService):
                    "TAGS",
                ],
            )
-            container_definitions = response["taskDefinition"]["containerDefinitions"]
-            for container in container_definitions:
+            container_definitions = []
+            for container in response["taskDefinition"]["containerDefinitions"]:
                environment = []
                if "environment" in container:
                    for env_var in container["environment"]:
@@ -159,7 +159,7 @@ class ECS(AWSService):
                                name=env_var["name"], value=env_var["value"]
                            )
                        )
-                task_definition.container_definitions.append(
+                container_definitions.append(
                    ContainerDefinition(
                        name=container["name"],
                        privileged=container.get("privileged", False),
@@ -176,14 +176,16 @@ class ECS(AWSService):
                        .get("mode", ""),
                    )
                )
-            task_definition.pid_mode = response["taskDefinition"].get("pidMode", "")
-            task_definition.registered_at = response["taskDefinition"].get(
-                "registeredAt"
-            )
-            task_definition.tags = response.get("tags")
-            task_definition.network_mode = response["taskDefinition"].get(
-                "networkMode", "bridge"
-            )
+            pid_mode = response["taskDefinition"].get("pidMode", "")
+            registered_at = response["taskDefinition"].get("registeredAt")
+            tags = response.get("tags")
+            network_mode = response["taskDefinition"].get("networkMode", "bridge")
+
+            task_definition.container_definitions = container_definitions
+            task_definition.pid_mode = pid_mode
+            task_definition.registered_at = registered_at
+            task_definition.tags = tags
+            task_definition.network_mode = network_mode
        except Exception as error:
            logger.error(
                f"{error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
@@ -302,7 +304,7 @@ class TaskDefinition(BaseModel):
    arn: str
    revision: str
    region: str
-    container_definitions: list[ContainerDefinition] = []
+    container_definitions: Optional[list[ContainerDefinition]] = None
    pid_mode: Optional[str]
    registered_at: Optional[datetime] = None
    tags: Optional[list] = []
@@ -6,6 +6,8 @@ class ecs_task_definitions_containers_readonly_access(Check):
    def execute(self):
        findings = []
        for task_definition in ecs_client.task_definitions.values():
+            if task_definition.container_definitions is None:
+                continue
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=task_definition
            )
@@ -6,6 +6,8 @@ class ecs_task_definitions_host_namespace_not_shared(Check):
    def execute(self):
        findings = []
        for task_definition in ecs_client.task_definitions.values():
+            if task_definition.container_definitions is None:
+                continue
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=task_definition
            )
@@ -6,6 +6,8 @@ class ecs_task_definitions_host_networking_mode_users(Check):
    def execute(self):
        findings = []
        for task_definition in ecs_client.task_definitions.values():
+            if task_definition.container_definitions is None:
+                continue
            report = Check_Report_AWS(
                metadata=self.metadata(), resource=task_definition
            )
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Pablo F.G	434e5aaf03	fix(ui): keep the Slack page usable on an unreadable check time - Guard the last-checked timestamp with isValid before formatting - Fall back to the never-checked rendering instead of the error boundary	2026-08-18 09:23:40 +02:00
Pablo F.G	68f1092f56	fix(ui): confirm a Slack install only from a readable integration - Validate the exchange body as a minimal JSON:API resource before the cast - Report truthy-but-unreadable payloads as the existing unconfirmed result	2026-08-18 09:23:40 +02:00
Pablo F.G	5ed235088c	fix(ui): only link an install to Slack's own consent screen - Require HTTPS, the Slack hostname, and the OAuth v2 path - Refuse hostile schemes, origins, and lookalike hosts with the existing copy	2026-08-18 09:23:40 +02:00
Pablo F.G	ed1fce420e	fix(ui): validate the input to the Slack exchange action - Reject a malformed exchange argument before it reaches the API - Derive IntegrationType from a const object - Honor explicit width and height on the Slack icon - Pin the revalidated paths on a completed install	2026-08-18 09:23:40 +02:00
Pablo F.G	8481a43fe3	fix(ui): refresh the Slack page after a connection test - Revalidate the Slack path so the badge and last-checked date update - Hide the decorative Slack icon from assistive technology - Keep the Slack integration card a Server Component - Match Slack error codes on own properties only - Assert the callback redirects back to the integration page	2026-08-18 09:23:40 +02:00
Pablo F.G	37b3ae7d25	test(ui): give the Slack OAuth callback its own page test file `/integrations/slack/callback` is a route of its own, so its 11 tests move out of the Slack page file, which now covers only `/integrations/slack`.	2026-08-18 09:23:40 +02:00
Pablo F.G	553c0429e6	docs(ui): focus the Slack changelog entry on what the user can do	2026-08-18 09:23:40 +02:00
Pablo F.G	2f59b89b49	test(ui): stop compiling Server Components in the browser suite Next runs the React Compiler on the client compilation only, so a Server Component ships uncompiled. The browser project compiled every module, and its injected `useMemoCache` needs a dispatcher the page harnesses cannot provide, which is why two components carried `"use no memo"`. - Skip the compiler for `app/` modules without `"use client"` - Pre-bundle `react/compiler-runtime`, which plugin-react no longer adds - Drop both `"use no memo"` directives	2026-08-18 09:23:40 +02:00
Pablo F.G	4cf3d7af73	docs(ui): trim the Slack harness and page comments - Drop the JSDoc that restated harness method names - Keep the server-component, cache-stub and copy-overlap gotchas	2026-08-18 09:23:40 +02:00
Pablo F.G	d60bb6ee62	docs(ui): trim the Slack page integration-test comments - Remove the product arguments the assertions make on their own - Keep the contract statuses and why each rejection path is covered	2026-08-18 09:23:40 +02:00
Pablo F.G	327d0ed0c9	docs(ui): trim the Slack MSW handler and fixture comments - Cut the retellings of the API contract each fixture already shows - Keep the status meanings and the sources of the fixture values	2026-08-18 09:23:40 +02:00
Pablo F.G	ffa593dff9	docs(ui): trim the Slack unit-test comments - Remove the Given/When/Then prose that restated the assertions - Keep the notes explaining why a case exists at all	2026-08-18 09:23:40 +02:00
Pablo F.G	dfc66e43a8	docs(ui): trim the Slack action and error-mapping comments - Drop the outcome-by-outcome rationale the result types already state - Keep the status contract, the read-before-throw order and the revalidate why	2026-08-18 09:23:40 +02:00
Pablo F.G	bdb2e52261	docs(ui): trim the Slack component comments to the non-obvious why - Cut the design essays on the callback, the manager and the card header - Keep the single-use code, never-checked badge and 400-on-no-channel notes	2026-08-18 09:23:40 +02:00
Pablo F.G	e15a68c6d1	fix(ui): stop titling an unconfirmed Slack install as not connected - Give the unreadable success answer its own outcome instead of an error string, matching how the other Slack outcomes are modelled - Title the two outcomes whose result is unknown for what they are, and keep the failure wording for the outcomes that really are failures - Anchor the callback test helpers on the escape link rather than on the title copy	2026-08-18 09:23:40 +02:00
Pablo F.G	866cb6077f	docs(ui): credit the right mechanism in the Slack callback comment - Name router.replace, not the ref, as what keeps a back navigation away from a completed install	2026-08-18 09:23:40 +02:00
Pablo F.G	fce28e364a	fix(ui): keep a failed install read visible when Slack is unavailable - Render the notice stack before the cards, so an unavailable environment no longer hides that the tenant's install could not be read - Pin the ordering with the combined-failure case	2026-08-18 09:23:40 +02:00
Pablo F.G	7cf3d4d486	fix(ui): report a Slack upstream server fault to Sentry - Route a 5xx other than the ship-dark 503 through the shared server error handling, so an upstream fault is no longer only user copy - Await the classifier so its throw reaches the action's own catch - Answer a 502 the API described in HTML or an empty body in Prowler's own words - Cover both the reported and the deliberately unreported statuses	2026-08-18 09:23:40 +02:00
Pablo F.G	8089a7576e	fix(ui): only echo a Slack error reason that looks like a code - Render the reason from the callback URL only when it has the shape of a Slack error token, so URL text cannot pose as Prowler's own copy - Fall back to owned wording for anything else - Keep an unrecognised but real code visible for diagnosis	2026-08-18 09:23:40 +02:00
Pablo F.G	4fa4354796	fix(ui): report an unreadable Slack install result as its own outcome - Guard the OAuth success paths against a response body the UI cannot parse, instead of leaking a parser message to the user - Keep the install pages revalidated on that path, since the API has already connected the workspace - Add owned wording for a result Prowler could not read - Cover the empty, HTML and resource-less answers	2026-08-18 09:23:40 +02:00
Pablo F.G	0aa6457ef1	fix(ui): stop the Slack callback spinning when the exchange fails - Report an unconfirmed result instead of spinning forever when the exchange call never returns - Tolerate a created integration that carries no configuration - Cover both paths with callback unit tests	2026-08-18 09:23:40 +02:00
Pablo F.G	baa0d03c06	fix(ui): keep the Slack page usable when the install read fails - Handle a server error from the integrations read instead of letting it reach the error boundary - Reuse the existing server-error wording rather than surfacing the API's own message - Add a server-error scenario to the Slack test handlers	2026-08-18 09:23:40 +02:00
Pablo F.G	19dadeca05	fix(ui): report an unverified integration as never checked - Widen the shared integration type so `connected` carries the never-checked state the API can return - Show a neutral badge instead of a red "Disconnected" for an integration whose connection has not been checked yet - Stop offering the Slack connection check while no destination channel is recorded, since the API refuses it - Cover the post-install state in the Slack page tests	2026-08-18 09:23:40 +02:00
Pablo F.G	513b76d68d	fix(ui): match the Slack error model the API implements - Carry Slack's reason in the JSON:API error code, not in the detail - Map each code to copy that says what to do, falling back to the detail - Refuse a second workspace with a conflict, named by its code - Say when to come back when Slack is rate limiting, instead of reporting Slack as unavailable in the environment - Serialize the bot user, and omit the channel keys until one is chosen	2026-08-18 09:23:40 +02:00
Pablo F.G	34f752cf41	feat(ui): add Slack integration connect flow for Prowler Cloud - Add Slack card and management page, gated on Prowler Cloud - Connect a workspace by approving Prowler in Slack, with no token to paste - Complete the install on return from Slack and report the outcome - Cover the flow with browser-mode integration tests	2026-08-18 09:23:40 +02:00
ye11oc4tandHugo P.Brito	f3224d0988	fix(ses): evaluate all identity authorization policies (#12464 ) Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>	2026-08-17 14:19:45 +01:00
Pepe Fagoaga	450e6ba553	chore(api): drop temporary SDK pin overrides after cryptography cap bump (#12473 )	2026-08-17 13:42:09 +02:00
Haitao Zheng Nguyễn Công Thuận Huy Hugo P.Brito	2cd93fe119	fix(sdk): skip undescribed ECS task definitions (#12217 ) Co-authored-by: Nguyễn Công Thuận Huy <nguyencongthuanhuy@gmail.com> Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>	2026-08-17 12:42:06 +01:00
Pablo Fernandez Guerra (PFE)	f807b22ea6	ci: lint .github markdown and fix the violations it exposed (#12290 )	2026-08-17 13:00:32 +02:00
Pepe Fagoaga	b6e9967da6	fix(deps): make published wheels installable and add package checks (#12467 )	2026-08-17 12:34:11 +02:00
Hugo Pereira Brito	16e62f7514	ci(labeler): cover existing provider labels (#12476 )	2026-08-17 11:33:22 +01:00
Adrián Peña	13ce9436b3	chore: update Trivy to 0.74.0 (#12466 )	2026-08-17 10:25:28 +02:00
mintlify[bot]andmintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>	d3ced63397	fix(docs): typos and grammar (#12468 ) Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>	2026-08-17 09:21:56 +02:00
Adrián Peña	758b696ca5	feat(ui): highlight imported providers (#12447 )	2026-08-17 08:53:14 +02:00
Pepe Fagoaga	0d3ce45374	fix(pypi): bump to pypa/gh-action-pypi-publish v1.14.2 (#12456 )	2026-08-14 14:57:07 +02:00
Alejandro Bailo	f35666ff0a	fix(ui): settle scan auto-refresh safely (#12455 )	2026-08-14 11:48:08 +02:00
Pedro Martín	0758c3585d	feat(rolesanywhere): flag profiles with unscoped sessions (#12416 )	2026-08-13 17:06:24 +02:00
Prowler Bot prowler-bot Josema Camacho	dd882c70e7	chore(release): Bump versions to v5.40.0 (#12443 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com> Co-authored-by: Josema Camacho <josema@prowler.com>	2026-08-13 13:49:26 +02:00
Hugo Pereira BritoandPablo F.G	d05c9fbb31	feat(ui): add trial usage sidebar banner (#12420 ) Co-authored-by: Pablo F.G <pablo.fernandez@prowler.com>	2026-08-13 11:36:59 +01:00
Josema Camacho	7bde42ffb9	docs: update attack paths documentation for grouped graphs (#12440 )	2026-08-13 12:25:14 +02:00
Pepe Fagoaga	0d3df0fd0b	chore(changelog): v5.39.0 release highlights (#12432 )	2026-08-13 12:08:15 +02:00
Pedro Martín	ab996417e6	fix(ci): bump Trivy to v0.73.0 to fix CVE-2026-46600 (#12444 )	2026-08-13 12:04:51 +02:00
Prowler Botandprowler-bot	5f109bc00e	chore(changelog): v5.39.0 (#12433 ) Co-authored-by: prowler-bot <179230569+prowler-bot@users.noreply.github.com>	2026-08-13 09:01:51 +02:00
Pepe Fagoaga	472e04f4cc	docs(triage): manual `PASS` verification for `MANUAL` findings (#12431 )	2026-08-12 15:46:54 +02:00
Rubén De la Torre Vico	b848aace33	docs(mcp): document the Cloud organization tools and Jira dispatch options (#12427 )	2026-08-12 15:05:24 +02:00
Pedro Martín	94c20eb9fe	feat(ui): add CMMC compliance framework (#12414 )	2026-08-12 14:52:09 +02:00
lydiavilchez pedroootcopilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>pedrooot	02df22ca19	fix(html): escape provider identity fields in report header (#12424 ) Co-authored-by: pedrooot <pedromarting3@gmail.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: pedrooot <56402503+pedrooot@users.noreply.github.com>	2026-08-12 13:58:31 +02:00
Hugo Pereira BritoandJosema Camacho	de64df11b9	fix(api): normalize social account names (#12413 ) Co-authored-by: Josema Camacho <josema@prowler.com>	2026-08-12 12:41:44 +01:00
Pedro Martín	37ebd9b6fd	fix(cmmc): remove stale config_requirements (#12425 )	2026-08-12 12:29:43 +02:00
Pedro Martín	a28487cbff	fix(ci): suppress .NET runtime CVE temporarily (#12426 )	2026-08-12 12:16:14 +02:00
Rubén De la Torre Vico	68471d2a0e	feat(ui): add Manage Lighthouse AI role permission (#12412 )	2026-08-12 10:19:20 +02:00
Pablo Fernandez Guerra (PFE)	d41b2eaa0f	docs: add the Azure Management Groups onboarding tutorial (#12389 )	2026-08-12 09:15:32 +02:00
Pablo Fernandez Guerra (PFE)	b480907484	feat(ui): onboard Azure subscriptions from a Management Group (#12386 )	2026-08-12 09:07:43 +02:00
Pablo Fernandez Guerra (PFE)	6d7bc8a86e	test(ui): consolidate the providers page integration suites (#12383 )	2026-08-11 18:50:10 +02:00
Hugo Pereira Britoandalejandrobailo	8bfca81e4b	feat(ui): add manual pass triage workflow (#12253 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-08-11 15:09:08 +01:00
Pablo Fernandez Guerra (PFE)	931612443a	test(ui): drop organization unit tests restated by integration (#12382 )	2026-08-11 15:41:34 +02:00
Daniel Barranqueroandalejandrobailo	3074f02a63	feat(ui): grouped Attack Paths graph with expandable resource classes and outcome node (#12381 ) Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com>	2026-08-11 14:05:12 +02:00
Pablo Fernandez Guerra (PFE)	5cfc22040a	fix(ui): open scan findings using the scan's UTC day (#12411 )	2026-08-11 12:54:47 +02:00
Hugo Pereira Brito	48ba1692e1	docs: update provider check counts (#12418 )	2026-08-11 10:37:48 +01:00
Alejandro Bailo	a8b12813f9	feat(ui): add Lighthouse AI Skills on findings (#12355 )	2026-08-11 11:05:04 +02:00
Pedro Martín	85c36bb812	feat(compliance): add CMMC 2.0 compliance framework (#12401 )	2026-08-10 12:48:26 -07:00
Pedro Martín Daniel Barranquero Hugo P.Brito	ce037318cd	feat(m365): add CIS M365 v7.0.0 entra authentication method, PIM and access review checks (#12155 ) Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com> Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>	2026-08-10 15:37:48 +01:00
Pedro MartínandHugo P.Brito	356036fe1f	feat(m365): add CIS M365 v7.0.0 entra conditional access and session checks (#12154 ) Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>	2026-08-10 11:17:19 +01:00
Andoni AlonsoandLydia Vilchez	286685a4f3	feat(github): scale organization_repository_creation_limited severity by repository visibility (#12164 ) Co-authored-by: Lydia Vilchez <lydiavilchezlopez@gmail.com>	2026-08-10 11:51:38 +02:00
Hugo Pereira Brito	9daca2e4df	fix(ci): suppress Trivy go-git vulnerability temporarily (#12405 )	2026-08-10 10:41:19 +01:00
Hugo Pereira Brito	3ca3a977a9	test(m365): avoid Lob secret pattern in test name (#12395 )	2026-08-10 08:35:28 +01:00
mintlify[bot]andmintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>	561a1390be	docs: fix typos and grammar (#12404 ) Co-authored-by: mintlify[bot] <109931778+mintlify[bot]@users.noreply.github.com>	2026-08-10 09:22:41 +02:00
				`@@ -0,0 +1 @@`
				`Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48)`
				`@@ -0,0 +1 @@`
				Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net`
				`@@ -0,0 +1 @@`
				`Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615`
				`@@ -0,0 +1 @@`
				`Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe`
				`@@ -1 +0,0 @@`
				`/api/v1/accounts/saml/{organization_slug}/acs/` rejects non-POST requests before SAML response processing
				`@@ -1 +0,0 @@`
				`Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails`
				`@@ -1 +0,0 @@`
				`GET /api/v1/users/me` membership relationships identify the active tenant with `meta.active` for JWT and API key authentication
				`@@ -1 +0,0 @@`
				`awslambda_layer_no_secrets_in_content` check for AWS provider, scanning Lambda layer package content for hardcoded secrets
				`@@ -1 +0,0 @@`
				`batch_job_definition_no_secrets` check for AWS provider, scanning Batch job definition environment variables and command parameters for hardcoded secrets