Merge remote-tracking branch 'origin/master' into mintlify/55c1f1a5

.env

@@ -174,7 +174,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.45.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.44.0
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"

.github/workflows/sdk-refresh-oci-regions.yml

@@ -76,7 +76,7 @@ jobs:
 
             ### Changes
 
-            This PR updates the `OCI_COMMERCIAL_REGIONS` dictionary in `prowler/providers/oraclecloud/config.py` and the matching list in `ui/lib/provider-credentials/oci-regions.ts` with the latest regions fetched from the OCI Identity API (`list_regions()`).
+            This PR updates the `OCI_COMMERCIAL_REGIONS` dictionary in `prowler/providers/oraclecloud/config.py` with the latest regions fetched from the OCI Identity API (`list_regions()`).
 
             - Government regions (`OCI_GOVERNMENT_REGIONS`) are preserved unchanged
             - DOD regions (`OCI_US_DOD_REGIONS`) are preserved unchanged

.trivyignore.yaml

@@ -68,7 +68,7 @@ vulnerabilities:
     expired_at: 2026-11-30
 
   # Declared in the SPDX manifest that ships inside PowerShell's MicrosoftTeams module
-  # (Modules/MicrosoftTeams/8.0.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
+  # (Modules/MicrosoftTeams/7.9.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
   # SBOM and reports what it declares, which is not the same as what the image contains:
   # there is no Node runtime and no node_modules anywhere in the image, and the .NET
   # assemblies target net472, a Windows-only framework. Nothing here is reachable, and none
@@ -129,10 +129,6 @@ vulnerabilities:
     purls:
       - "pkg:npm/fast-uri"
     expired_at: 2027-01-31
-  - id: CVE-2026-84292
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
   - id: CVE-2026-69192
     purls:
       - "pkg:npm/ip-address"

api/CHANGELOG.md

@@ -4,33 +4,6 @@ All notable changes to the **Prowler API** are documented in this file.
 
 <!-- changelog: release notes start -->
 
-## [1.45.0] (Prowler v5.44.0)
-
-### 🚀 Added
-
-- Scan output uploads and downloads can now target S3-compatible object storage such as MinIO directly via `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL`, instead of relying on process-wide AWS environment variables that also hijacked unrelated AWS API calls [(#12871)](https://github.com/prowler-cloud/prowler/pull/12871)
-
-### 🔄 Changed
-
-- Unify how every endpoint resolves a provider latest completed scan, so overlapping scans no longer make findings, compliance and mute rules read from different scans [(#12858)](https://github.com/prowler-cloud/prowler/pull/12858)
-
-### 🐞 Fixed
-
-- Celery loggers are now declared explicitly in `custom_logging.py` so fatal worker errors are no longer silenced by `disable_existing_loggers=True`. All long-running services in `docker-compose.yml` now have `restart: unless-stopped` so containers recover automatically after unexpected crashes. [(#12465)](https://github.com/prowler-cloud/prowler/pull/12465)
-- Scan report downloads from an S3 bucket with default SSE-KMS encryption no longer fail with an `InvalidArgument` error: when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is set, presigned download URLs are signed with AWS Signature Version 4 for that region [(#12746)](https://github.com/prowler-cloud/prowler/pull/12746)
-- Adds a periodic sweep that drops orphaned Attack Paths temp Neo4j scan databases left behind when a worker or Neo4j crashes mid-scan, before they accumulate unbounded [(#12832)](https://github.com/prowler-cloud/prowler/pull/12832)
-- Providers whose most recent completed scan has no `completed_at` timestamp are no longer missing from every endpoint that reports a provider's latest scan, which now falls back to scan creation order instead of skipping the provider [(#12858)](https://github.com/prowler-cloud/prowler/pull/12858)
-- Resources no longer keep a stale failed findings count forever when a scoped or imported scan for the same provider completes after a full scan, which used to make the full scan skip its own cleanup [(#12858)](https://github.com/prowler-cloud/prowler/pull/12858)
-- `POST /api/v1/scans` again returns the new scan id in the response `task_args`, which had been empty since the scan broker publish moved to transaction commit [(#12878)](https://github.com/prowler-cloud/prowler/pull/12878)
-- API key authentication no longer locks the key row on every request and now throttles `last_used_at` updates to once per 60 seconds, preventing a hot key from serializing all its requests onto a single locked row [(#12882)](https://github.com/prowler-cloud/prowler/pull/12882)
-- Provider deletion no longer fails when the provider has Attack Paths scans recorded on a sink that is no longer configured, such as Neptune after moving back to Neo4j [(#12894)](https://github.com/prowler-cloud/prowler/pull/12894)
-
-### 🔐 Security
-
-- `DELETE /api/v1/tasks/{id}` requires the permission of the operation that queued the task and rejects provider deletions, and `GET /api/v1/tasks` hides tasks of providers outside the visibility of the role [(#12893)](https://github.com/prowler-cloud/prowler/pull/12893)
-
----
-
 ## [1.44.0] (Prowler v5.43.0)
 
 ### 🐞 Fixed

api/changelog.d/attack-paths-tmp-db-reaper.fixed.md

@@ -0,0 +1 @@
+Adds a periodic sweep that drops orphaned Attack Paths temp Neo4j scan databases left behind when a worker or Neo4j crashes mid-scan, before they accumulate unbounded

api/changelog.d/ephemeral-resource-count-reset.fixed.md

@@ -0,0 +1 @@
+Resources no longer keep a stale failed findings count forever when a scoped or imported scan for the same provider completes after a full scan, which used to make the full scan skip its own cleanup

api/changelog.d/latest-scan-null-completed-at.fixed.md

@@ -0,0 +1 @@
+Providers whose most recent completed scan has no `completed_at` timestamp are no longer missing from every endpoint that reports a provider's latest scan, which now falls back to scan creation order instead of skipping the provider

api/changelog.d/latest-scan-selector.changed.md

@@ -0,0 +1 @@
+Unify how every endpoint resolves a provider latest completed scan, so overlapping scans no longer make findings, compliance and mute rules read from different scans

api/changelog.d/oci-home-region-bootstrap.fixed.md

@@ -1 +0,0 @@
-OCI provider secrets keep the region as home region for credential validation and scans, instead of always using us-ashburn-1

api/changelog.d/pyjwt-2-14-0.security.md

@@ -1 +0,0 @@
-`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9

api/changelog.d/s3-output-internal-endpoint.added.md

@@ -0,0 +1 @@
+Scan output uploads and downloads can now target S3-compatible object storage such as MinIO directly via `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL`, instead of relying on process-wide AWS environment variables that also hijacked unrelated AWS API calls

api/changelog.d/s3-report-download-sigv4.fixed.md

@@ -0,0 +1 @@
+Scan report downloads from an S3 bucket with default SSE-KMS encryption no longer fail with an `InvalidArgument` error: when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is set, presigned download URLs are signed with AWS Signature Version 4 for that region

api/changelog.d/scan-create-task-args.fixed.md

@@ -0,0 +1 @@
+`POST /api/v1/scans` again returns the new scan id in the response `task_args`, which had been empty since the scan broker publish moved to transaction commit

api/changelog.d/sentry-no-personal-data.security.md

@@ -1 +0,0 @@
-Sentry error events no longer include user identity, IP addresses, cookies, headers or request bodies, which could contain personal data or provider credentials

api/changelog.d/worker-logging-restart-policy.fixed.md

@@ -0,0 +1 @@
+Celery loggers are now declared explicitly in `custom_logging.py` so fatal worker errors are no longer silenced by `disable_existing_loggers=True`. All long-running services in `docker-compose.yml` now have `restart: unless-stopped` so containers recover automatically after unexpected crashes.

api/pyproject.toml

@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.46.0"
+version = "1.45.0"
 
 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.
@@ -375,7 +375,7 @@ constraint-dependencies = [
   "pydantic-core==2.41.5",
   "pygithub==2.8.0",
   "pygments==2.20.0",
-  "pyjwt==2.14.0",
+  "pyjwt==2.13.0",
   "pylint==3.2.5",
   "pymsalruntime==0.18.1",
   "pynacl==1.6.2",
@@ -476,8 +476,8 @@ constraint-dependencies = [
 # to 1.9.10 until the SDK bump propagates to the pinned master rev.
 #
 # prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
-# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.14.0
-# patches GHSA-ffc3-869f-jxw9 (HMAC/PEM key-confusion); a constraint cannot satisfy these
+# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
+# patches PYSEC-2026-179 (HMAC/JWK key-confusion); a constraint cannot satisfy these
 # against the SDK's hard pins, so override them to the patched versions until the SDK
 # bump propagates to the pinned master rev. pyjwt keeps the [crypto] extra because an
 # override replaces the whole requirement; bare pyjwt would drop it from the consumers
@@ -500,5 +500,5 @@ override-dependencies = [
   "microsoft-kiota-serialization-multipart==1.9.10",
   "microsoft-kiota-serialization-text==1.9.10",
   "dulwich==1.2.5",
-  "pyjwt[crypto]==2.14.0"
+  "pyjwt[crypto]==2.13.0"
 ]

api/src/backend/api/authentication.py

@@ -1,5 +1,4 @@
 import logging
-from datetime import timedelta
 from math import isfinite
 from uuid import UUID
 
@@ -7,7 +6,7 @@ from api.db_router import MainRouter
 from api.models import TenantAPIKey, TenantAPIKeyManager
 from cryptography.fernet import InvalidToken
 from django.core.exceptions import ObjectDoesNotExist
-from django.db.models import Q
+from django.db import transaction
 from django.utils import timezone
 from drf_simple_apikey.backends import APIKeyAuthentication as BaseAPIKeyAuth
 from drf_simple_apikey.crypto import get_crypto
@@ -19,15 +18,12 @@ from rest_framework_simplejwt.authentication import JWTAuthentication
 
 logger = logging.getLogger(__name__)
 
-# Writing on every request makes all requests of a busy key contend on one row
-API_KEY_LAST_USED_AT_THROTTLE_SECONDS = 60
-
 
 class OrphanedAPIKeyError(Exception):
     """Raised when an API key outlived the user that owns it.
 
-    The revocation is written by a plain `update()` before this is raised, so it is
-    already persisted by the time `authenticate` catches it and rejects the request.
+    Handled by `authenticate`, which commits the revocation written while detecting it
+    and then rejects the request with `AuthenticationFailed`.
     """
 
 
@@ -41,9 +37,8 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
         """
         Override to use admin connection, bypassing RLS during authentication.
 
-        Returns the validated API key row from a single read. `authenticate` builds
-        the auth claims from that same row instead of looking it up again, so a key
-        revoked or orphaned right after validation can't still authenticate.
+        Returns the validated API key row, locked with `select_for_update`, so callers
+        must run inside `transaction.atomic(using=MainRouter.admin_db)`.
         """
         try:
             payload = self.key_crypto.decrypt(key)
@@ -72,11 +67,9 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
             raise AuthenticationFailed("API Key has already expired.")
 
         try:
-            # Loading `entity` in the same query keeps a user deleted after this read
-            # from turning the later `api_key.entity` access into a 500
             api_key = (
                 self.model.objects.using(MainRouter.admin_db)
-                .select_related("entity")
+                .select_for_update()
                 .get(id=api_key_pk)
             )
         except ObjectDoesNotExist:
@@ -92,9 +85,8 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
         # Revoke it as well, so it stops showing up as active and later attempts fail
         # the `revoked` check above like any other revoked key.
         if api_key.entity_id is None:
-            self.model.objects.using(MainRouter.admin_db).filter(
-                id=api_key.id, revoked=False
-            ).update(revoked=True)
+            api_key.revoked = True
+            api_key.save(update_fields=["revoked"], using=MainRouter.admin_db)
             logger.warning(
                 "Revoked orphaned API key: prefix=%s tenant=%s",
                 api_key.prefix,
@@ -120,38 +112,34 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
         except ValueError:
             raise AuthenticationFailed("Invalid API Key.")
 
-        try:
-            api_key = self._authenticate_credentials(request, key)
-        except OrphanedAPIKeyError:
-            raise AuthenticationFailed("No entity matching this api key.")
+        # Validation, the `last_used_at` update and the auth claims all read the same
+        # row, locked until the transaction ends. Looking the key up a second time to
+        # build the claims used to leave a window where a key revoked or orphaned right
+        # after passing validation still authenticated.
+        with transaction.atomic(using=MainRouter.admin_db):
+            try:
+                api_key = self._authenticate_credentials(request, key)
+            except OrphanedAPIKeyError:
+                # Rejected below instead of here: leaving the block normally commits
+                # the revocation `_authenticate_credentials` wrote, while raising from
+                # inside would roll it back.
+                pass
+            else:
+                # The prefix used to be checked by the second lookup
+                if api_key.prefix != prefix:
+                    raise AuthenticationFailed("Invalid API Key.")
 
-        # The prefix used to be checked by the second lookup
-        if api_key.prefix != prefix:
-            raise AuthenticationFailed("Invalid API Key.")
+                api_key.last_used_at = timezone.now()
+                api_key.save(update_fields=["last_used_at"], using=MainRouter.admin_db)
 
-        self._throttled_touch_last_used_at(api_key)
+                entity = api_key.entity
+                return entity, {
+                    "tenant_id": str(api_key.tenant_id),
+                    "sub": str(entity.id),
+                    "api_key_prefix": api_key.prefix,
+                }
 
-        entity = api_key.entity
-        return entity, {
-            "tenant_id": str(api_key.tenant_id),
-            "sub": str(entity.id),
-            "api_key_prefix": api_key.prefix,
-        }
-
-    @staticmethod
-    def _throttled_touch_last_used_at(api_key: TenantAPIKey) -> None:
-        """Write `last_used_at` at most once per throttle interval, without locking the row."""
-        now = timezone.now()
-        stale_before = now - timedelta(seconds=API_KEY_LAST_USED_AT_THROTTLE_SECONDS)
-
-        if api_key.last_used_at is not None and api_key.last_used_at >= stale_before:
-            return
-
-        TenantAPIKey.objects.using(MainRouter.admin_db).filter(
-            id=api_key.id, revoked=False
-        ).filter(
-            Q(last_used_at__isnull=True) | Q(last_used_at__lt=stale_before)
-        ).update(last_used_at=now)
+        raise AuthenticationFailed("No entity matching this api key.")
 
 
 class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):

api/src/backend/api/rbac/permissions.py

@@ -1,7 +1,7 @@
 from enum import Enum
 
 from api.db_router import MainRouter
-from api.models import Integration, Provider, Role, Task, User
+from api.models import Integration, Provider, Role, User
 from django.db.models import Q, QuerySet
 from rest_framework.exceptions import PermissionDenied
 from rest_framework.permissions import BasePermission
@@ -17,50 +17,6 @@ class Permissions(Enum):
     UNLIMITED_VISIBILITY = "unlimited_visibility"
 
 
-# Revoking a task needs the permission of the operation that queued it.
-# None and unmapped names are not revocable; a revoked provider deletion
-# would leave the provider soft-deleted with nothing re-queuing the cleanup.
-TASK_REVOKE_PERMISSIONS: dict[str, list[Permissions] | None] = {
-    "provider-connection-check": [Permissions.MANAGE_PROVIDERS],
-    "provider-deletion": None,
-    "integration-connection-check": [Permissions.MANAGE_INTEGRATIONS],
-    "integration-s3": [Permissions.MANAGE_INTEGRATIONS],
-    "integration-security-hub": [Permissions.MANAGE_INTEGRATIONS],
-    "integration-jira": [Permissions.MANAGE_INTEGRATIONS],
-    "scan-perform": [Permissions.MANAGE_SCANS],
-    "scan-perform-scheduled": [Permissions.MANAGE_SCANS],
-    "scan-compliance-overviews": [Permissions.MANAGE_SCANS],
-    "scan-compliance-reports": [Permissions.MANAGE_SCANS],
-    "scan-finding-group-summaries": [Permissions.MANAGE_SCANS],
-    "scan-report": [Permissions.MANAGE_SCANS],
-    "attack-paths-scan-perform": [Permissions.MANAGE_SCANS],
-    "findings-mute-latest-scans": [Permissions.MANAGE_SCANS],
-    "lighthouse-connection-check": [],
-    "lighthouse-provider-connection-check": [],
-    "lighthouse-provider-models-refresh": [],
-}
-
-
-def get_user_roles(user: User, tenant_id: str) -> list[Role]:
-    """Return every role assigned to the user in the tenant."""
-    return list(
-        User.objects.using(MainRouter.admin_db)
-        .get(id=user.id)
-        .roles.using(MainRouter.admin_db)
-        .filter(tenant_id=tenant_id)
-    )
-
-
-def roles_have_permissions(
-    roles: list[Role], required_permissions: list[Permissions]
-) -> bool:
-    """Return True when every required permission is granted by at least one role."""
-    return all(
-        any(getattr(role, permission.value, False) for role in roles)
-        for permission in required_permissions
-    )
-
-
 class HasPermissions(BasePermission):
     """
     Custom permission to check if the user's role has the required permissions.
@@ -78,11 +34,19 @@ class HasPermissions(BasePermission):
         if not tenant_id:
             return False
 
-        user_roles = get_user_roles(request.user, tenant_id)
+        user_roles = list(
+            User.objects.using(MainRouter.admin_db)
+            .get(id=request.user.id)
+            .roles.using(MainRouter.admin_db)
+            .filter(tenant_id=tenant_id)
+        )
         if not user_roles:
             return False
 
-        return roles_have_permissions(user_roles, required_permissions)
+        return all(
+            any(getattr(role, permission.value, False) for role in user_roles)
+            for permission in required_permissions
+        )
 
 
 def get_role(user: User, tenant_id: str) -> Role:
@@ -121,25 +85,6 @@ def get_providers(role: Role) -> QuerySet[Provider]:
     ).distinct()
 
 
-def get_tasks(role: Role) -> QuerySet[Task]:
-    """Return the tasks visible to the role: tenant-wide ones and those of its providers."""
-    queryset = Task.objects.filter(tenant_id=role.tenant_id)
-    if role.unlimited_visibility:
-        return queryset
-
-    # Task has no provider FK, so match provider ids inside the stored kwargs.
-    # all_objects keeps a soft-deleted provider visible to its own groups, so the
-    # role that queued its deletion can still follow the task.
-    hidden = Q()
-    for provider_id in (
-        Provider.all_objects.filter(tenant_id=role.tenant_id)
-        .exclude(provider_groups__in=role.provider_groups.all())
-        .values_list("id", flat=True)
-    ):
-        hidden |= Q(task_runner_task__task_kwargs__contains=str(provider_id))
-    return queryset.exclude(hidden) if hidden else queryset
-
-
 def get_integrations(
     role: Role, providers: QuerySet[Provider] | None = None
 ) -> QuerySet[Integration]:

api/src/backend/api/specs/v1.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.46.0
+  version: 1.45.0
   description: |-
     Prowler API specification.
 
@@ -14823,9 +14823,7 @@ paths:
     get:
       operationId: api_v1_tasks_list
       description: Retrieve a list of all tasks with options for filtering by name,
-        state, and other criteria. Tasks that reference a provider are only returned
-        when the role can access it; tasks without a provider reference are returned
-        for every role.
+        state, and other criteria.
       summary: List all tasks
       parameters:
       - in: query
@@ -14924,8 +14922,7 @@ paths:
   /api/v1/tasks/{id}:
     get:
       operationId: api_v1_tasks_retrieve
-      description: Fetch detailed information about a specific task by its ID. Tasks
-        tied to a provider outside the visibility of the role are not found.
+      description: Fetch detailed information about a specific task by its ID.
       summary: Retrieve data from a specific task
       parameters:
       - in: query
@@ -14966,9 +14963,7 @@ paths:
     delete:
       operationId: api_v1_tasks_destroy
       description: Try to revoke a task using its ID. Only tasks that are not yet
-        in progress can be revoked, and the caller needs the same permission as the
-        operation that queued the task (for example MANAGE_SCANS for a scan). Provider
-        deletions cannot be revoked.
+        in progress can be revoked.
       summary: Revoke a task
       parameters:
       - in: path

api/src/backend/api/tests/integration/test_authentication.py

@@ -1,9 +1,9 @@
 import json
+import time
 from datetime import UTC, datetime, timedelta
 from uuid import uuid4
 
 import pytest
-from api.authentication import API_KEY_LAST_USED_AT_THROTTLE_SECONDS
 from api.db_router import MainRouter
 from api.models import Membership, Role, TenantAPIKey, User, UserRoleRelationship
 from api.signals import revoke_membership_api_keys, revoke_user_api_keys
@@ -11,7 +11,6 @@ from conftest import TEST_PASSWORD, get_api_tokens, get_authorization_header
 from django.db.utils import ConnectionDoesNotExist
 from django.urls import reverse
 from drf_simple_apikey.crypto import get_crypto
-from freezegun import freeze_time
 from rest_framework.test import APIClient
 from rest_framework_simplejwt.token_blacklist.models import (
     BlacklistedToken,
@@ -528,7 +527,7 @@ class TestAPIKeyAuthentication:
     def test_last_used_at_tracking(
         self, create_test_user, tenants_fixture, api_keys_fixture
     ):
-        """Verify last_used_at timestamp is set on first use and throttled after that."""
+        """Verify last_used_at timestamp updates on each authentication."""
         client = APIClient()
         api_key = api_keys_fixture[0]
 
@@ -537,11 +536,7 @@ class TestAPIKeyAuthentication:
 
         # Use API key to authenticate
         api_key_headers = get_api_key_header(api_key._raw_key)
-        start = datetime.now(UTC)
-        with freeze_time(start):
-            first_response = client.get(
-                reverse("provider-list"), headers=api_key_headers
-            )
+        first_response = client.get(reverse("provider-list"), headers=api_key_headers)
         assert first_response.status_code == 200
 
         # Reload from database and check last_used_at is set
@@ -549,23 +544,17 @@ class TestAPIKeyAuthentication:
         first_used_at = api_key.last_used_at
         assert first_used_at is not None
 
-        # Using the same key again within the throttle interval does not rewrite it
+        # Use the same key again after a small delay
+        time.sleep(0.1)
+
         second_response = client.get(reverse("provider-list"), headers=api_key_headers)
         assert second_response.status_code == 200
 
+        # Reload and verify last_used_at was updated
         api_key.refresh_from_db()
-        assert api_key.last_used_at == first_used_at
-
-        # Past the throttle interval, the next use refreshes it
-        later = start + timedelta(seconds=API_KEY_LAST_USED_AT_THROTTLE_SECONDS + 1)
-        with freeze_time(later):
-            third_response = client.get(
-                reverse("provider-list"), headers=api_key_headers
-            )
-        assert third_response.status_code == 200
-
-        api_key.refresh_from_db()
-        assert api_key.last_used_at > first_used_at
+        second_used_at = api_key.last_used_at
+        assert second_used_at is not None
+        assert second_used_at > first_used_at
 
 
 @pytest.mark.django_db
@@ -1452,7 +1441,6 @@ class TestAPIKeyRLSBypass:
 
         The update to last_used_at during authentication must also use the
         admin database since it occurs before RLS context is established.
-        Past the throttle interval, using the key again refreshes the timestamp.
         """
         client = APIClient()
         api_key = api_keys_fixture[0]
@@ -1460,11 +1448,7 @@ class TestAPIKeyRLSBypass:
         assert api_key.last_used_at is None
 
         api_key_headers = get_api_key_header(api_key._raw_key)
-        start = datetime.now(UTC)
-        with freeze_time(start):
-            first_response = client.get(
-                reverse("provider-list"), headers=api_key_headers
-            )
+        first_response = client.get(reverse("provider-list"), headers=api_key_headers)
 
         assert first_response.status_code == 200
 
@@ -1472,11 +1456,9 @@ class TestAPIKeyRLSBypass:
         first_timestamp = api_key.last_used_at
         assert first_timestamp is not None
 
-        later = start + timedelta(seconds=API_KEY_LAST_USED_AT_THROTTLE_SECONDS + 1)
-        with freeze_time(later):
-            second_response = client.get(
-                reverse("provider-list"), headers=api_key_headers
-            )
+        time.sleep(0.1)
+
+        second_response = client.get(reverse("provider-list"), headers=api_key_headers)
         assert second_response.status_code == 200
 
         api_key.refresh_from_db()

api/src/backend/api/tests/test_authentication.py

@@ -5,18 +5,16 @@ from uuid import uuid4
 
 import pytest
 from api.authentication import (
-    API_KEY_LAST_USED_AT_THROTTLE_SECONDS,
     OrphanedAPIKeyError,
     SSEAuthentication,
     TenantAPIKeyAuthentication,
 )
 from api.db_router import MainRouter
-from api.models import TenantAPIKey, User
+from api.models import TenantAPIKey
 from django.db import connections
 from django.db.models.query import QuerySet
 from django.test import RequestFactory
 from django.test.utils import CaptureQueriesContext
-from freezegun import freeze_time
 from rest_framework.exceptions import AuthenticationFailed
 
 
@@ -288,15 +286,14 @@ class TestTenantAPIKeyAuthentication:
 
         assert str(exc_info.value.detail) == "This API Key has been revoked."
 
-    def test_authenticate_reads_the_api_key_once_without_a_row_lock(
+    def test_authenticate_reads_the_api_key_once_under_a_row_lock(
         self, auth_backend, api_keys_fixture, request_factory
     ):
-        """Test the API key is read a single time and no row is locked.
+        """Test the API key is read a single time and the row is locked.
 
         Validation, the `last_used_at` update and the claims must all come from the
-        same authoritative row: a second lookup would reopen the window where a key
-        revoked in between still authenticates. `SELECT ... FOR UPDATE` serialized
-        every request for a hot key onto one locked row and is not used any more.
+        same authoritative row: a second, unlocked lookup would reopen the window
+        where a key revoked in between still authenticates.
         """
         api_key = api_keys_fixture[0]
 
@@ -313,40 +310,33 @@ class TestTenantAPIKeyAuthentication:
         ]
 
         assert len(api_key_selects) == 1
-        assert "FOR UPDATE" not in api_key_selects[0]
+        assert "FOR UPDATE" in api_key_selects[0]
 
-    def test_authenticate_ignores_revocation_after_the_single_read(
+    def test_authenticate_ignores_revocation_after_the_locked_read(
         self, auth_backend, api_keys_fixture, request_factory
     ):
         """Test the claims describe the row that was validated, not a later state.
 
         Regression test: the key used to be looked up again to build the auth dict,
         without rechecking `revoked` or `entity`. A key revoked or orphaned between
-        both reads still authenticated, and the claims came from that stale row.
-        There is now only a single read, so this race is closed by construction and
-        the revocation only takes effect on the next request.
+        both reads still authenticated, and the claims came from that stale row. With
+        a single locked read the write below cannot land mid-authentication, and the
+        revocation only takes effect on the next request.
         """
         api_key = api_keys_fixture[0]
         entity_at_validation = api_key.entity
-        original_authenticate_credentials = (
-            TenantAPIKeyAuthentication._authenticate_credentials
-        )
+        original_save = TenantAPIKey.save
 
-        def revoke_and_orphan_after_reading(self, request, key):
-            # Runs right after the single read `authenticate` will use to build the
-            # claims: the exact window a concurrent revocation used to slip into
-            result = original_authenticate_credentials(self, request, key)
+        def revoke_and_orphan_before_saving(instance, *args, **kwargs):
+            # Runs after validation, right before the claims are built: the exact
+            # window a concurrent revocation or user deletion used to slip into
             TenantAPIKey.objects.filter(id=api_key.id).update(revoked=True, entity=None)
-            return result
+            return original_save(instance, *args, **kwargs)
 
         request = request_factory.get("/")
         request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"
 
-        with patch.object(
-            TenantAPIKeyAuthentication,
-            "_authenticate_credentials",
-            revoke_and_orphan_after_reading,
-        ):
+        with patch.object(TenantAPIKey, "save", revoke_and_orphan_before_saving):
             entity, auth_dict = auth_backend.authenticate(request)
 
         assert entity == entity_at_validation
@@ -360,43 +350,6 @@ class TestTenantAPIKeyAuthentication:
 
         assert str(exc_info.value.detail) == "This API Key has been revoked."
 
-    def test_authenticate_survives_owner_deleted_after_the_single_read(
-        self, auth_backend, api_keys_fixture, request_factory
-    ):
-        """Test a user deleted right after the read does not turn into a 500.
-
-        Without the row lock a concurrent user deletion can land between the read
-        and building the claims. `entity` is loaded by the same query, so no later
-        lookup can raise `DoesNotExist`.
-        """
-        api_key = api_keys_fixture[0]
-        owner_id = api_key.entity_id
-        original_authenticate_credentials = (
-            TenantAPIKeyAuthentication._authenticate_credentials
-        )
-
-        def delete_owner_after_reading(self, request, key):
-            result = original_authenticate_credentials(self, request, key)
-            User.objects.using(MainRouter.admin_db).filter(id=owner_id).delete()
-            return result
-
-        request = request_factory.get("/")
-        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"
-
-        with patch.object(
-            TenantAPIKeyAuthentication,
-            "_authenticate_credentials",
-            delete_owner_after_reading,
-        ):
-            entity, auth_dict = auth_backend.authenticate(request)
-
-        assert auth_dict["sub"] == str(owner_id)
-        assert entity.id == owner_id
-
-        # From the next request on, the orphaned key is rejected with a 401
-        with pytest.raises(AuthenticationFailed):
-            auth_backend.authenticate(request)
-
     def test_authenticate_expired_api_key(
         self, auth_backend, create_test_user, tenants_fixture, request_factory
     ):
@@ -468,90 +421,24 @@ class TestTenantAPIKeyAuthentication:
         if original_last_used:
             assert api_key.last_used_at > original_last_used
 
-    def test_authenticate_updates_last_used_at_on_admin_database(
+    def test_authenticate_saves_to_admin_database(
         self, auth_backend, api_keys_fixture, request_factory
     ):
-        """Test that the `last_used_at` update runs against the admin database."""
+        """Test that the API key save operation uses admin database."""
         api_key = api_keys_fixture[0]
         raw_key = api_key._raw_key
 
         request = request_factory.get("/")
         request.META["HTTP_AUTHORIZATION"] = f"Api-Key {raw_key}"
 
-        with CaptureQueriesContext(connections[MainRouter.admin_db]) as captured:
+        # Mock the save method to verify it's called with using='admin'
+        with patch.object(TenantAPIKey, "save") as mock_save:
             auth_backend.authenticate(request)
 
-        api_key_updates = [
-            query["sql"]
-            for query in captured.captured_queries
-            if query["sql"].startswith("UPDATE") and '"api_keys"' in query["sql"]
-        ]
-
-        assert len(api_key_updates) == 1
-        assert "last_used_at" in api_key_updates[0]
-
-    def test_authenticate_does_not_rewrite_last_used_at_within_throttle_interval(
-        self, auth_backend, api_keys_fixture, request_factory
-    ):
-        """Test that a second authentication within the throttle interval is a no-op write."""
-        api_key = api_keys_fixture[0]
-        raw_key = api_key._raw_key
-
-        request = request_factory.get("/")
-        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {raw_key}"
-
-        # First call sets last_used_at
-        auth_backend.authenticate(request)
-        api_key.refresh_from_db()
-        first_used_at = api_key.last_used_at
-        assert first_used_at is not None
-
-        # Second call, still within the throttle interval, must issue no UPDATE
-        with CaptureQueriesContext(connections[MainRouter.admin_db]) as captured:
-            auth_backend.authenticate(request)
-
-        api_key_updates = [
-            query["sql"]
-            for query in captured.captured_queries
-            if query["sql"].startswith("UPDATE") and '"api_keys"' in query["sql"]
-        ]
-        assert api_key_updates == []
-
-        api_key.refresh_from_db()
-        assert api_key.last_used_at == first_used_at
-
-    def test_authenticate_rewrites_last_used_at_after_throttle_interval(
-        self, auth_backend, api_keys_fixture, request_factory
-    ):
-        """Test that `last_used_at` is refreshed once it is older than the throttle interval."""
-        api_key = api_keys_fixture[0]
-        raw_key = api_key._raw_key
-
-        request = request_factory.get("/")
-        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {raw_key}"
-
-        start = datetime.now(UTC)
-        with freeze_time(start):
-            auth_backend.authenticate(request)
-
-        api_key.refresh_from_db()
-        first_used_at = api_key.last_used_at
-        assert first_used_at is not None
-
-        later = start + timedelta(seconds=API_KEY_LAST_USED_AT_THROTTLE_SECONDS + 1)
-        with freeze_time(later):
-            with CaptureQueriesContext(connections[MainRouter.admin_db]) as captured:
-                auth_backend.authenticate(request)
-
-        api_key_updates = [
-            query["sql"]
-            for query in captured.captured_queries
-            if query["sql"].startswith("UPDATE") and '"api_keys"' in query["sql"]
-        ]
-        assert len(api_key_updates) == 1
-
-        api_key.refresh_from_db()
-        assert api_key.last_used_at > first_used_at
+            # Verify save was called with using=admin_db
+            mock_save.assert_called_once_with(
+                update_fields=["last_used_at"], using=MainRouter.admin_db
+            )
 
     def test_authenticate_returns_correct_auth_dict(
         self, auth_backend, api_keys_fixture, request_factory

api/src/backend/api/tests/test_sentry.py

@@ -30,21 +30,6 @@ def test_initialize_sentry_uses_configured_dsn():
     assert mock_init.call_args.kwargs["before_send"] is sentry_settings.before_send
 
 
-def test_initialize_sentry_sends_no_personal_data():
-    with (
-        patch.object(
-            sentry_settings.env,
-            "str",
-            return_value="https://fake-public-key@sentry.example.invalid/1",
-        ),
-        patch.object(sentry_settings.sentry_sdk, "init") as mock_init,
-    ):
-        sentry_settings.initialize_sentry()
-
-    assert mock_init.call_args.kwargs["send_default_pii"] is False
-    assert mock_init.call_args.kwargs["max_request_body_size"] == "never"
-
-
 def _make_log_record(msg, level=logging.ERROR, name="test", args=None):
     """Build a real LogRecord so getMessage() works like in production."""
     record = logging.LogRecord(

api/src/backend/api/tests/test_serializers.py

@@ -215,34 +215,36 @@ class TestOracleCloudProviderSecret:
         assert serializer.is_valid(), serializer.errors
         assert "region" not in serializer.validated_data
 
-    def test_keeps_region_as_home_region(self):
-        serializer = OracleCloudProviderSecret(
-            data=self.valid_secret(region=" me-abudhabi-1 ")
-        )
+    def test_accepts_and_ignores_region_field(self):
+        secret = self.valid_secret(region="us-phoenix-1")
+        serializer = OracleCloudProviderSecret(data=secret)
 
         assert serializer.is_valid(), serializer.errors
-        assert serializer.validated_data["region"] == "me-abudhabi-1"
 
-    def test_rejects_unknown_region(self):
-        serializer = OracleCloudProviderSecret(
-            data=self.valid_secret(region="mars-north-1")
-        )
-
-        assert not serializer.is_valid()
-        assert "region" in serializer.errors
-
-    @pytest.mark.parametrize("legacy_value", [None, "", {"name": "us-ashburn-1"}])
-    def test_drops_blank_or_non_string_region(self, legacy_value):
-        serializer = OracleCloudProviderSecret(
-            data=self.valid_secret(region=legacy_value)
-        )
-
-        assert serializer.is_valid(), serializer.errors
         assert "region" not in serializer.validated_data
 
+    @pytest.mark.parametrize(
+        "legacy_field, legacy_value",
+        [
+            ("region", None),
+            ("region", ""),
+            ("region", {"name": "us-ashburn-1"}),
+        ],
+    )
+    def test_accepts_and_ignores_any_legacy_region_value(
+        self, legacy_field, legacy_value
+    ):
+        serializer = OracleCloudProviderSecret(
+            data=self.valid_secret(**{legacy_field: legacy_value})
+        )
+
+        assert serializer.is_valid(), serializer.errors
+
+        assert legacy_field not in serializer.validated_data
+
 
 class TestProviderSecretFieldSchema:
-    def test_oraclecloud_schema_region_is_not_deprecated(self):
+    def test_oraclecloud_schema_includes_legacy_region_field(self):
         schema = ProviderSecretField._spectacular_annotation["field"]
         oraclecloud_schema = next(
             credential_schema
@@ -251,7 +253,7 @@ class TestProviderSecretFieldSchema:
             == "Oracle Cloud Infrastructure (OCI) API Key Credentials"
         )
 
-        assert "deprecated" not in oraclecloud_schema["properties"]["region"]
+        assert oraclecloud_schema["properties"]["region"]["deprecated"] is True
 
 
 class TestKubernetesProviderSecret:

api/src/backend/api/tests/test_utils.py

@@ -172,7 +172,7 @@ class TestInitializeProwlerProvider:
         )
 
     @patch("api.utils.return_prowler_provider")
-    def test_initialize_oraclecloud_provider_passes_region_as_home_region(
+    def test_initialize_oraclecloud_provider_removes_region_string(
         self, mock_return_prowler_provider
     ):
         provider = MagicMock()
@@ -182,7 +182,7 @@ class TestInitializeProwlerProvider:
             "fingerprint": "00:11:22:33:44:55:66:77",
             "key_content": "fake-base64-key-content",
             "tenancy": "ocid1.tenancy.oc1..fake",
-            "region": "me-abudhabi-1",
+            "region": "us-ashburn-1",
         }
         mock_return_prowler_provider.return_value = MagicMock()
 
@@ -193,7 +193,6 @@ class TestInitializeProwlerProvider:
             fingerprint="00:11:22:33:44:55:66:77",
             key_content="fake-base64-key-content",
             tenancy="ocid1.tenancy.oc1..fake",
-            home_region="me-abudhabi-1",
         )
 
     @patch("api.utils.return_prowler_provider")
@@ -255,35 +254,11 @@ class TestProwlerProviderConnectionTest:
             fingerprint="00:11:22:33:44:55:66:77",
             key_content="fake-base64-key-content",
             tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
-            region=OraclecloudProvider._bootstrap_region,
-            provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
-            raise_on_exception=False,
-        )
-
-    @patch("api.utils.return_prowler_provider")
-    def test_oraclecloud_connection_test_uses_stored_region_for_identity(
-        self, mock_return_prowler_provider
-    ):
-        provider = MagicMock()
-        provider.uid = "ocid1.tenancy.oc1..aaaaaaaexample"
-        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
-        provider.secret.secret = {
-            "user": "ocid1.user.oc1..aaaaaaaexample",
-            "fingerprint": "00:11:22:33:44:55:66:77",
-            "key_content": "fake-base64-key-content",
-            "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
-            "region": "me-abudhabi-1",
-        }
-        mock_return_prowler_provider.return_value = MagicMock()
-
-        prowler_provider_connection_test(provider)
-
-        mock_return_prowler_provider.return_value.test_connection.assert_called_once_with(
-            user="ocid1.user.oc1..aaaaaaaexample",
-            fingerprint="00:11:22:33:44:55:66:77",
-            key_content="fake-base64-key-content",
-            tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
-            region="me-abudhabi-1",
+            region=getattr(
+                OraclecloudProvider,
+                "_bootstrap_region",
+                OraclecloudProvider._home_region,
+            ),
             provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
             raise_on_exception=False,
         )
@@ -459,7 +434,7 @@ class TestGetProwlerProviderKwargs:
         expected_result = {**secret_dict, **expected_extra_kwargs}
         assert result == expected_result
 
-    def test_get_prowler_provider_kwargs_oraclecloud_maps_region_to_home_region(
+    def test_get_prowler_provider_kwargs_oraclecloud_removes_region(
         self,
     ):
         secret_dict = {
@@ -486,7 +461,6 @@ class TestGetProwlerProviderKwargs:
             "key_content": "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----",
             "tenancy": "ocid1.tenancy.oc1..fake",
             "pass_phrase": "fake-passphrase",
-            "home_region": "us-ashburn-1",
         }
 
     def test_get_prowler_provider_kwargs_with_mutelist(self):

api/src/backend/api/tests/test_views.py

@@ -60,7 +60,6 @@ from api.models import (
     User,
     UserRoleRelationship,
 )
-from api.rbac.permissions import TASK_REVOKE_PERMISSIONS
 from api.rls import Tenant
 from api.uuid_utils import datetime_to_uuid7
 from api.v1.views import (
@@ -3363,7 +3362,7 @@ current-context: test-context
         provider_secret = ProviderSecret.objects.get()
         assert "region" not in provider_secret.secret
 
-    def test_provider_secrets_create_oraclecloud_stores_region(
+    def test_provider_secrets_create_oraclecloud_accepts_and_ignores_region(
         self,
         authenticated_client,
         oraclecloud_provider,
@@ -3372,14 +3371,14 @@ current-context: test-context
             authenticated_client,
             oraclecloud_provider,
             self._oraclecloud_secret(
-                key_content="  test-key-content  ", region=" me-abudhabi-1 "
+                key_content="  test-key-content  ", region=" us-ashburn-1 "
             ),
         )
 
         assert response.status_code == status.HTTP_201_CREATED
         provider_secret = ProviderSecret.objects.get()
         assert provider_secret.secret["key_content"] == "test-key-content"
-        assert provider_secret.secret["region"] == "me-abudhabi-1"
+        assert "region" not in provider_secret.secret
 
     def test_provider_secrets_update_oraclecloud_without_region_stores_no_region(
         self,
@@ -3412,7 +3411,7 @@ current-context: test-context
         provider_secret.refresh_from_db()
         assert "region" not in provider_secret.secret
 
-    def test_provider_secrets_update_oraclecloud_stores_region(
+    def test_provider_secrets_update_oraclecloud_accepts_and_ignores_region(
         self,
         authenticated_client,
         oraclecloud_provider,
@@ -3430,7 +3429,7 @@ current-context: test-context
                 "type": "provider-secrets",
                 "id": str(provider_secret.id),
                 "attributes": {
-                    "secret": self._oraclecloud_secret(region=" me-abudhabi-1 ")
+                    "secret": self._oraclecloud_secret(region=" us-ashburn-1 ")
                 },
             }
         }
@@ -3443,7 +3442,7 @@ current-context: test-context
 
         assert response.status_code == status.HTTP_200_OK
         provider_secret.refresh_from_db()
-        assert provider_secret.secret["region"] == "me-abudhabi-1"
+        assert "region" not in provider_secret.secret
 
     @pytest.mark.parametrize(
         "attributes, error_code, error_pointer",
@@ -5240,7 +5239,6 @@ class TestTaskViewSet:
     @patch("api.v1.views.AsyncResult", return_value=Mock())
     def test_tasks_revoke(self, mock_async_result, authenticated_client, tasks_fixture):
         _, task2 = tasks_fixture
-        self._set_task_name(task2, "scan-perform")
         response = authenticated_client.delete(
             reverse("task-detail", kwargs={"pk": task2.id})
         )
@@ -5256,311 +5254,12 @@ class TestTaskViewSet:
 
     def test_tasks_revoke_invalid_status(self, authenticated_client, tasks_fixture):
         task1, _ = tasks_fixture
-        self._set_task_name(task1, "scan-perform")
         response = authenticated_client.delete(
             reverse("task-detail", kwargs={"pk": task1.id})
         )
         # Task status is SUCCESS
         assert response.status_code == status.HTTP_400_BAD_REQUEST
 
-    @staticmethod
-    def _set_task_name(task, name):
-        task.task_runner_task.task_name = name
-        task.task_runner_task.save(update_fields=["task_name"])
-
-    @staticmethod
-    def _set_task_kwargs(task, kwargs):
-        task.task_runner_task.task_kwargs = json.dumps(repr(kwargs))
-        task.task_runner_task.save(update_fields=["task_kwargs"])
-
-    @staticmethod
-    def _client_with_role(tenant, factory, **permissions):
-        user = User.objects.create_user(
-            name=f"revoker-{uuid4()}",
-            email=f"revoker-{uuid4()}@prowler.com",
-            password=TEST_PASSWORD,
-        )
-        Membership.objects.create(
-            user=user, tenant=tenant, role=Membership.RoleChoices.MEMBER
-        )
-        flags = {
-            "manage_users": False,
-            "manage_account": False,
-            "manage_billing": False,
-            "manage_providers": False,
-            "manage_integrations": False,
-            "manage_scans": False,
-            "unlimited_visibility": True,
-            **permissions,
-        }
-        role = Role.objects.create(
-            name=f"revoker-{uuid4()}", tenant_id=tenant.id, **flags
-        )
-        UserRoleRelationship.objects.create(user=user, role=role, tenant_id=tenant.id)
-        return factory(user, tenant)
-
-    @patch("api.v1.views.AsyncResult")
-    def test_tasks_revoke_without_permission_is_forbidden(
-        self, mock_async_result, authenticated_client_no_permissions_rbac, tasks_fixture
-    ):
-        _, pending_task = tasks_fixture
-        self._set_task_name(pending_task, "provider-connection-check")
-
-        response = authenticated_client_no_permissions_rbac.delete(
-            reverse("task-detail", kwargs={"pk": pending_task.id})
-        )
-
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-        mock_async_result.return_value.revoke.assert_not_called()
-
-    @pytest.mark.parametrize(
-        "task_name, permissions, expected_status",
-        [
-            (
-                "provider-connection-check",
-                {"manage_providers": True},
-                status.HTTP_202_ACCEPTED,
-            ),
-            (
-                "provider-connection-check",
-                {"manage_scans": True},
-                status.HTTP_403_FORBIDDEN,
-            ),
-            ("scan-perform", {"manage_scans": True}, status.HTTP_202_ACCEPTED),
-            (
-                "scan-perform-scheduled",
-                {"manage_providers": True},
-                status.HTTP_403_FORBIDDEN,
-            ),
-            (
-                "integration-jira",
-                {"manage_integrations": True},
-                status.HTTP_202_ACCEPTED,
-            ),
-            ("integration-jira", {"manage_providers": True}, status.HTTP_403_FORBIDDEN),
-            ("lighthouse-connection-check", {}, status.HTTP_202_ACCEPTED),
-        ],
-    )
-    @patch("api.v1.views.AsyncResult")
-    def test_tasks_revoke_requires_originating_operation_permission(
-        self,
-        mock_async_result,
-        authenticated_client_for_tenant_factory,
-        tenants_fixture,
-        tasks_fixture,
-        task_name,
-        permissions,
-        expected_status,
-    ):
-        tenant, *_ = tenants_fixture
-        _, pending_task = tasks_fixture
-        self._set_task_name(pending_task, task_name)
-        client = self._client_with_role(
-            tenant, authenticated_client_for_tenant_factory, **permissions
-        )
-
-        response = client.delete(reverse("task-detail", kwargs={"pk": pending_task.id}))
-
-        assert response.status_code == expected_status
-        if expected_status == status.HTTP_202_ACCEPTED:
-            mock_async_result.return_value.revoke.assert_called_once()
-        else:
-            mock_async_result.return_value.revoke.assert_not_called()
-
-    @patch("api.v1.views.AsyncResult")
-    def test_tasks_revoke_provider_deletion_is_forbidden_even_for_admin(
-        self, mock_async_result, authenticated_client, tasks_fixture
-    ):
-        _, pending_task = tasks_fixture
-        self._set_task_name(pending_task, "provider-deletion")
-
-        response = authenticated_client.delete(
-            reverse("task-detail", kwargs={"pk": pending_task.id})
-        )
-
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-        mock_async_result.return_value.revoke.assert_not_called()
-
-    @patch("api.v1.views.AsyncResult")
-    def test_tasks_revoke_unmapped_task_is_forbidden(
-        self, mock_async_result, authenticated_client, tasks_fixture
-    ):
-        _, pending_task = tasks_fixture
-        assert pending_task.task_runner_task.task_name not in TASK_REVOKE_PERMISSIONS
-
-        response = authenticated_client.delete(
-            reverse("task-detail", kwargs={"pk": pending_task.id})
-        )
-
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-        mock_async_result.return_value.revoke.assert_not_called()
-
-    def test_every_rls_task_has_revoke_permissions(self):
-        from config.celery import RLSTask, celery_app
-
-        rls_task_names = {
-            name for name, task in celery_app.tasks.items() if isinstance(task, RLSTask)
-        }
-        assert rls_task_names
-        assert rls_task_names <= set(TASK_REVOKE_PERMISSIONS)
-
-    @patch("api.v1.views.AsyncResult")
-    def test_tasks_hidden_for_providers_outside_role_visibility(
-        self,
-        mock_async_result,
-        authenticated_client_no_permissions_rbac,
-        tasks_fixture,
-        aws_provider_pair,
-    ):
-        client = authenticated_client_no_permissions_rbac
-        limited_user = client.user
-        tenant = Membership.objects.filter(user=limited_user).first().tenant
-        allowed_provider, denied_provider = aws_provider_pair
-        allowed_task, denied_task = tasks_fixture
-        self._set_task_kwargs(
-            allowed_task,
-            {"tenant_id": str(tenant.id), "provider_id": str(allowed_provider.id)},
-        )
-        self._set_task_name(denied_task, "provider-deletion")
-        self._set_task_kwargs(
-            denied_task,
-            {"tenant_id": str(tenant.id), "provider_id": str(denied_provider.id)},
-        )
-        provider_group = ProviderGroup.objects.create(
-            name="limited-task-group", tenant_id=tenant.id
-        )
-        ProviderGroupMembership.objects.create(
-            tenant_id=tenant.id,
-            provider_group=provider_group,
-            provider=allowed_provider,
-        )
-        RoleProviderGroupRelationship.objects.create(
-            tenant_id=tenant.id,
-            role=limited_user.roles.first(),
-            provider_group=provider_group,
-        )
-
-        response = client.get(reverse("task-list"))
-        assert response.status_code == status.HTTP_200_OK
-        assert [item["id"] for item in response.json()["data"]] == [
-            str(allowed_task.id)
-        ]
-
-        response = client.get(reverse("task-detail", kwargs={"pk": denied_task.id}))
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-
-        response = client.delete(reverse("task-detail", kwargs={"pk": denied_task.id}))
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-        mock_async_result.return_value.revoke.assert_not_called()
-
-    @patch("api.v1.views.AsyncResult")
-    def test_tasks_of_soft_deleted_provider_stay_visible_to_its_groups(
-        self,
-        mock_async_result,
-        authenticated_client_for_tenant_factory,
-        tenants_fixture,
-        tasks_fixture,
-        aws_provider_pair,
-    ):
-        tenant, *_ = tenants_fixture
-        provider, _ = aws_provider_pair
-        finished_task, pending_task = tasks_fixture
-        client = self._client_with_role(
-            tenant,
-            authenticated_client_for_tenant_factory,
-            manage_providers=True,
-            unlimited_visibility=False,
-        )
-        provider_group = ProviderGroup.objects.create(
-            name="own-group", tenant_id=tenant.id
-        )
-        ProviderGroupMembership.objects.create(
-            tenant_id=tenant.id, provider_group=provider_group, provider=provider
-        )
-        RoleProviderGroupRelationship.objects.create(
-            tenant_id=tenant.id,
-            role=client.user.roles.first(),
-            provider_group=provider_group,
-        )
-        for task, name in (
-            (finished_task, "provider-deletion"),
-            (pending_task, "provider-connection-check"),
-        ):
-            self._set_task_name(task, name)
-            self._set_task_kwargs(
-                task, {"tenant_id": str(tenant.id), "provider_id": str(provider.id)}
-            )
-        provider.is_deleted = True
-        provider.save()
-
-        response = client.get(reverse("task-detail", kwargs={"pk": finished_task.id}))
-        assert response.status_code == status.HTTP_200_OK
-
-        response = client.delete(reverse("task-detail", kwargs={"pk": pending_task.id}))
-        assert response.status_code == status.HTTP_202_ACCEPTED
-        mock_async_result.return_value.revoke.assert_called_once()
-
-    def test_tasks_without_provider_stay_visible_for_limited_roles(
-        self, authenticated_client_no_permissions_rbac, tasks_fixture, aws_provider_pair
-    ):
-        response = authenticated_client_no_permissions_rbac.get(reverse("task-list"))
-        assert response.status_code == status.HTTP_200_OK
-        assert len(response.json()["data"]) == len(tasks_fixture)
-
-    def test_tasks_list_without_role_is_forbidden(
-        self, authenticated_client_rbac_noroles, tasks_fixture
-    ):
-        response = authenticated_client_rbac_noroles.get(reverse("task-list"))
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-
-    def test_tasks_revoke_without_permission_hides_task_status(
-        self, authenticated_client_no_permissions_rbac, tasks_fixture
-    ):
-        finished_task, _ = tasks_fixture
-        self._set_task_name(finished_task, "provider-connection-check")
-
-        response = authenticated_client_no_permissions_rbac.delete(
-            reverse("task-detail", kwargs={"pk": finished_task.id})
-        )
-
-        assert response.status_code == status.HTTP_403_FORBIDDEN
-
-    @patch("api.v1.views.AsyncResult")
-    def test_tasks_revoke_unauthenticated_returns_401(
-        self, mock_async_result, tasks_fixture
-    ):
-        from rest_framework.test import APIClient
-
-        _, pending_task = tasks_fixture
-        self._set_task_name(pending_task, "scan-perform")
-
-        response = APIClient().delete(
-            reverse("task-detail", kwargs={"pk": pending_task.id})
-        )
-
-        assert response.status_code == status.HTTP_401_UNAUTHORIZED
-        mock_async_result.return_value.revoke.assert_not_called()
-
-    @patch("api.v1.views.AsyncResult")
-    def test_tasks_revoke_foreign_tenant_task_returns_404(
-        self,
-        mock_async_result,
-        authenticated_client_for_tenant_factory,
-        tenants_fixture,
-        tasks_fixture,
-    ):
-        _, foreign_tenant, *_ = tenants_fixture
-        _, pending_task = tasks_fixture
-        self._set_task_name(pending_task, "scan-perform")
-        client = self._client_with_role(
-            foreign_tenant, authenticated_client_for_tenant_factory, manage_scans=True
-        )
-
-        response = client.delete(reverse("task-detail", kwargs={"pk": pending_task.id}))
-
-        assert response.status_code == status.HTTP_404_NOT_FOUND
-        mock_async_result.return_value.revoke.assert_not_called()
-
 
 @pytest.mark.django_db
 class TestAttackPathsScanViewSet:

api/src/backend/api/utils.py

@@ -302,26 +302,17 @@ def get_prowler_provider_kwargs(
 def _normalize_oraclecloud_provider_kwargs(secret: dict) -> dict:
     """Normalize external OCI secret fields into SDK provider kwargs."""
     prowler_provider_kwargs = secret.copy()
-    home_region = _oraclecloud_home_region(prowler_provider_kwargs.pop("region", None))
-    if home_region:
-        prowler_provider_kwargs["home_region"] = home_region
+    prowler_provider_kwargs.pop("region", None)
 
     return prowler_provider_kwargs
 
 
-def _oraclecloud_home_region(region) -> str | None:
-    """Return the stored OCI region as a home region, ignoring blank or non-string legacy values."""
-    if isinstance(region, str) and region.strip():
-        return region.strip()
-    return None
-
-
 def _normalize_oraclecloud_connection_test_kwargs(secret: dict) -> dict:
     """Normalize external OCI secret fields into test_connection kwargs."""
     from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvider
 
     prowler_provider_kwargs = secret.copy()
-    home_region = _oraclecloud_home_region(prowler_provider_kwargs.pop("region", None))
+    prowler_provider_kwargs.pop("region", None)
 
     if (
         prowler_provider_kwargs.get("user")
@@ -332,9 +323,11 @@ def _normalize_oraclecloud_connection_test_kwargs(secret: dict) -> dict:
             or prowler_provider_kwargs.get("key_file")
         )
     ):
-        # Identity calls only succeed in a region the tenancy is subscribed to.
-        prowler_provider_kwargs["region"] = (
-            home_region or OraclecloudProvider._bootstrap_region
+        # Connection validation needs one OCI endpoint, but scans remain unfiltered.
+        prowler_provider_kwargs["region"] = getattr(
+            OraclecloudProvider,
+            "_bootstrap_region",
+            OraclecloudProvider._home_region,
         )
 
     return prowler_provider_kwargs

api/src/backend/api/v1/serializer_utils/providers.py

@@ -301,7 +301,8 @@ from rest_framework_json_api import serializers
                     },
                     "region": {
                         "type": "string",
-                        "description": "Optional OCI home region (or any region the tenancy is subscribed to) used to validate the credentials. It does not filter the scan, which covers all subscribed regions. Defaults to us-ashburn-1.",
+                        "deprecated": True,
+                        "description": "Legacy OCI region field accepted for backwards compatibility but ignored; OCI scans all regions.",
                     },
                 },
                 "required": ["user", "fingerprint", "tenancy"],

api/src/backend/api/v1/serializers.py

@@ -71,7 +71,6 @@ from django.db import IntegrityError, transaction
 from drf_spectacular.utils import extend_schema_field
 from jwt.exceptions import InvalidKeyError
 from prowler.lib.mutelist.mutelist import Mutelist
-from prowler.providers.oraclecloud.config import OCI_REGIONS
 from rest_framework.reverse import reverse
 from rest_framework.validators import UniqueTogetherValidator
 from rest_framework_json_api import serializers
@@ -1918,16 +1917,9 @@ class IacProviderSecret(serializers.Serializer):
         resource_name = "provider-secrets"
 
 
-class OCIHomeRegionField(serializers.Field):
-    """Optional OCI home region; blank or non-string legacy values are dropped."""
-
+class LegacyOCIRegionField(serializers.Field):
     def to_internal_value(self, data):
-        if not isinstance(data, str) or not data.strip():
-            return None
-        region = data.strip()
-        if region not in OCI_REGIONS:
-            raise serializers.ValidationError(f"Invalid OCI region: {region}")
-        return region
+        return data
 
     def to_representation(self, value):
         return value
@@ -1940,11 +1932,10 @@ class OracleCloudProviderSecret(serializers.Serializer):
     key_content = serializers.CharField(required=False)
     tenancy = serializers.CharField()
     pass_phrase = serializers.CharField(required=False)
-    region = OCIHomeRegionField(required=False, allow_null=True)
+    region = LegacyOCIRegionField(required=False, allow_null=True)
 
     def validate(self, attrs):
-        if not attrs.get("region"):
-            attrs.pop("region", None)
+        attrs.pop("region", None)
 
         if "key_file" not in attrs and "key_content" not in attrs:
             raise serializers.ValidationError(

api/src/backend/api/v1/views.py

@@ -125,14 +125,10 @@ from api.models import (
 )
 from api.pagination import ComplianceOverviewPagination
 from api.rbac.permissions import (
-    TASK_REVOKE_PERMISSIONS,
     Permissions,
     get_integrations,
     get_providers,
     get_role,
-    get_tasks,
-    get_user_roles,
-    roles_have_permissions,
 )
 from api.renderers import APIJSONRenderer, PlainTextRenderer
 from api.rls import Tenant
@@ -2862,29 +2858,17 @@ class ScanViewSet(ProviderVisibilityMixin, BaseRLSViewSet):
     list=extend_schema(
         tags=["Task"],
         summary="List all tasks",
-        description=(
-            "Retrieve a list of all tasks with options for filtering by name, state, and other "
-            "criteria. Tasks that reference a provider are only returned when the role can "
-            "access it; tasks without a provider reference are returned for every role."
-        ),
+        description="Retrieve a list of all tasks with options for filtering by name, state, and other criteria.",
     ),
     retrieve=extend_schema(
         tags=["Task"],
         summary="Retrieve data from a specific task",
-        description=(
-            "Fetch detailed information about a specific task by its ID. Tasks tied to a provider "
-            "outside the visibility of the role are not found."
-        ),
+        description="Fetch detailed information about a specific task by its ID.",
     ),
     destroy=extend_schema(
         tags=["Task"],
         summary="Revoke a task",
-        description=(
-            "Try to revoke a task using its ID. Only tasks that are not yet in progress can be "
-            "revoked, and the caller needs the same permission as the operation that queued "
-            "the task (for example MANAGE_SCANS for a scan). Provider deletions cannot be "
-            "revoked."
-        ),
+        description="Try to revoke a task using its ID. Only tasks that are not yet in progress can be revoked.",
         responses={202: OpenApiResponse(response=TaskSerializer)},
     ),
 )
@@ -2900,26 +2884,13 @@ class TaskViewSet(BaseRLSViewSet):
     required_permissions = []
 
     def get_queryset(self):
-        return (
-            get_tasks(self.user_role)
-            .annotate(
-                name=F("task_runner_task__task_name"),
-                state=F("task_runner_task__status"),
-            )
-            .select_related("task_runner_task")
-        )
+        return Task.objects.annotate(
+            name=F("task_runner_task__task_name"),
+            state=F("task_runner_task__status"),
+        ).select_related("task_runner_task")
 
     def destroy(self, request, *args, pk=None, **kwargs):
-        task = self.get_object()
-        required_permissions = TASK_REVOKE_PERMISSIONS.get(
-            task.task_runner_task.task_name
-        )
-        # Same multi-role semantics as HasPermissions.
-        if required_permissions is None or not roles_have_permissions(
-            get_user_roles(request.user, request.tenant_id), required_permissions
-        ):
-            raise PermissionDenied("You do not have permission to revoke this task.")
-
+        task = get_object_or_404(Task, pk=pk)
         if task.task_runner_task.status not in ["PENDING", "RECEIVED"]:
             serializer = TaskSerializer(task)
             return Response(

api/src/backend/config/settings/sentry.py

@@ -193,10 +193,10 @@ def initialize_sentry():
 
     sentry_sdk.init(
         dsn=sentry_dsn,
+        # Add data like request headers and IP for users,
+        # see https://docs.sentry.io/platforms/python/data-management/data-collected/ for more info
         before_send=before_send,
-        # No user identity, IPs, cookies, headers or request bodies: bodies carry emails and provider details.
-        send_default_pii=False,
-        max_request_body_size="never",
+        send_default_pii=True,
         traces_sample_rate=env.float("DJANGO_SENTRY_TRACES_SAMPLE_RATE", default=0.02),
         _experiments={
             # Set continuous_profiling_auto_start to True

api/src/backend/tasks/jobs/deletion.py

@@ -13,7 +13,6 @@ from api.models import (
     Tenant,
 )
 from celery.utils.log import get_task_logger
-from django.conf import settings
 from django.db import DatabaseError
 from tasks.jobs.queries import (
     COMPLIANCE_DELETE_EMPTY_TENANT_SUMMARY_SQL,
@@ -107,19 +106,9 @@ def delete_provider(tenant_id: str, pk: str):
     try:
         if attack_paths_sink_backends:
             for sink_backend in attack_paths_sink_backends:
-                try:
-                    backend = sink_module.get_backend_for_name(sink_backend)
-
-                except RuntimeError as sink_error:
-                    # A retired sink has no connection settings left, and no graph left to drop
-                    if sink_backend == settings.ATTACK_PATHS_SINK_DATABASE.lower():
-                        raise
-                    logger.warning(
-                        f"Skipping graph cleanup on unconfigured sink {sink_backend}: {sink_error}"
-                    )
-                    continue
-
-                backend.drop_subgraph(tenant_database_name, str(pk))
+                sink_module.get_backend_for_name(sink_backend).drop_subgraph(
+                    tenant_database_name, str(pk)
+                )
         else:
             graph_database.drop_subgraph(tenant_database_name, str(pk))
 

api/src/backend/tasks/jobs/scan.py

@@ -2113,9 +2113,7 @@ def aggregate_attack_surface(tenant_id: str, scan_id: str):
             .annotate(
                 total=Count("id"),
                 failed=Count("id", filter=Q(status="FAIL", muted=False)),
-                # Not `muted`: an annotation named after a model field comes
-                # back as `muted_new` from the psqlextra queryset.
-                muted_count=Count("id", filter=Q(status="FAIL", muted=True)),
+                muted=Count("id", filter=Q(status="FAIL", muted=True)),
             )
         )
 
@@ -2126,7 +2124,7 @@ def aggregate_attack_surface(tenant_id: str, scan_id: str):
 
             aggregated_counts[attack_surface_type]["total"] += stats["total"] or 0
             aggregated_counts[attack_surface_type]["failed"] += stats["failed"] or 0
-            aggregated_counts[attack_surface_type]["muted"] += stats["muted_count"] or 0
+            aggregated_counts[attack_surface_type]["muted"] += stats["muted"] or 0
 
     overview_objects = []
     for attack_surface_type, counts in aggregated_counts.items():

api/src/backend/tasks/tests/test_deletion.py

@@ -4,7 +4,6 @@ import pytest
 from api.attack_paths import database as graph_database
 from api.models import Provider, Tenant, TenantComplianceSummary
 from django.core.exceptions import ObjectDoesNotExist
-from django.test import override_settings
 from tasks.jobs.deletion import delete_provider, delete_tenant
 
 
@@ -124,60 +123,6 @@ class TestDeleteProvider:
             "tenant-db", str(instance.id)
         )
 
-    @override_settings(ATTACK_PATHS_SINK_DATABASE="neo4j")
-    def test_delete_provider_skips_unconfigured_retired_sink(
-        self, aws_provider, create_attack_paths_scan
-    ):
-        instance = aws_provider
-        tenant_id = str(instance.tenant_id)
-        create_attack_paths_scan(instance, sink_backend="neo4j")
-        create_attack_paths_scan(instance, sink_backend="neptune")
-        neo4j_backend = MagicMock()
-
-        def get_backend_for_name(name):
-            if name == "neptune":
-                raise RuntimeError("NEPTUNE_WRITER_ENDPOINT and AWS_REGION must be set")
-            return neo4j_backend
-
-        with (
-            patch(
-                "tasks.jobs.deletion.graph_database.get_database_name",
-                return_value="tenant-db",
-            ),
-            patch(
-                "tasks.jobs.deletion.sink_module.get_backend_for_name",
-                side_effect=get_backend_for_name,
-            ),
-            patch("tasks.jobs.deletion.graph_database.drop_database"),
-        ):
-            result = delete_provider(tenant_id, instance.id)
-
-        assert result
-        assert not Provider.all_objects.filter(pk=instance.id).exists()
-        neo4j_backend.drop_subgraph.assert_called_once_with(
-            "tenant-db", str(instance.id)
-        )
-
-    @override_settings(ATTACK_PATHS_SINK_DATABASE="neo4j")
-    def test_delete_provider_raises_when_active_sink_unconfigured(
-        self, aws_provider, create_attack_paths_scan
-    ):
-        instance = aws_provider
-        tenant_id = str(instance.tenant_id)
-        create_attack_paths_scan(instance, sink_backend="neo4j")
-
-        with (
-            patch(
-                "tasks.jobs.deletion.sink_module.get_backend_for_name",
-                side_effect=RuntimeError("NEO4J_HOST / NEO4J_PORT must be set"),
-            ),
-            patch("tasks.jobs.deletion.graph_database.drop_database"),
-            pytest.raises(RuntimeError),
-        ):
-            delete_provider(tenant_id, instance.id)
-
-        assert Provider.all_objects.filter(pk=instance.id).exists()
-
     def test_delete_provider_continues_when_temp_db_drop_fails(
         self, aws_provider, create_attack_paths_scan
     ):
@@ -204,10 +149,10 @@ class TestDeleteProvider:
         assert result
         assert not Provider.all_objects.filter(pk=instance.id).exists()
 
-    @pytest.mark.usefixtures("provider_compliance_scores_fixture")
     def test_delete_provider_recalculates_tenant_compliance_summary(
         self,
         aws_provider_pair,
+        provider_compliance_scores_fixture,
     ):
         instance = aws_provider_pair[0]
         tenant_id = instance.tenant_id

api/src/backend/tasks/tests/test_scan.py

@@ -12,7 +12,6 @@ from api.db_router import MainRouter
 from api.db_utils import rls_transaction
 from api.exceptions import ProviderConnectionError, ProviderDeletedException
 from api.models import (
-    AttackSurfaceOverview,
     Finding,
     MuteRule,
     Provider,
@@ -5328,13 +5327,8 @@ class TestAggregateAttackSurface:
         mock_queryset = MagicMock()
         mock_queryset.values.return_value = mock_queryset
         mock_queryset.annotate.return_value = [
-            {
-                "check_id": "check_internet_1",
-                "total": 10,
-                "failed": 3,
-                "muted_count": 1,
-            },
-            {"check_id": "check_secrets_1", "total": 5, "failed": 2, "muted_count": 0},
+            {"check_id": "check_internet_1", "total": 10, "failed": 3, "muted": 1},
+            {"check_id": "check_secrets_1", "total": 5, "failed": 2, "muted": 0},
         ]
 
         ctx = MagicMock()
@@ -5383,7 +5377,7 @@ class TestAggregateAttackSurface:
         mock_queryset = MagicMock()
         mock_queryset.values.return_value = mock_queryset
         mock_queryset.annotate.return_value = [
-            {"check_id": "check_internet_1", "total": 5, "failed": 1, "muted_count": 0},
+            {"check_id": "check_internet_1", "total": 5, "failed": 1, "muted": 0},
         ]
 
         ctx = MagicMock()
@@ -5466,13 +5460,8 @@ class TestAggregateAttackSurface:
         mock_queryset = MagicMock()
         mock_queryset.values.return_value = mock_queryset
         mock_queryset.annotate.return_value = [
-            {
-                "check_id": "check_internet_1",
-                "total": 10,
-                "failed": 3,
-                "muted_count": 1,
-            },
-            {"check_id": "check_internet_2", "total": 5, "failed": 2, "muted_count": 0},
+            {"check_id": "check_internet_1", "total": 10, "failed": 3, "muted": 1},
+            {"check_id": "check_internet_2", "total": 5, "failed": 2, "muted": 0},
         ]
 
         ctx = MagicMock()
@@ -5493,62 +5482,6 @@ class TestAggregateAttackSurface:
         assert overview.failed_findings == 5  # 3 + 2
         assert overview.muted_failed_findings == 1  # 1 + 0
 
-    @patch("tasks.jobs.scan._get_attack_surface_mapping_from_provider")
-    def test_aggregate_attack_surface_counts_real_findings(
-        self, mock_get_mapping, tenants_fixture, scans_fixture
-    ):
-        """Run the aggregation query against real Finding rows.
-
-        The other tests mock the queryset, so they never execute the real
-        `annotate`. This one guards the row keys the query returns."""
-        tenant = tenants_fixture[0]
-        scan = scans_fixture[0]
-
-        mock_get_mapping.return_value = {
-            "privilege-escalation": {"check_privesc_1"},
-            "secrets": {"check_secrets_1"},
-        }
-
-        def create_finding(uid, check_id, status, muted):
-            Finding.objects.create(
-                tenant_id=tenant.id,
-                uid=uid,
-                scan=scan,
-                status=status,
-                status_extended="status extended",
-                impact=Severity.high,
-                severity=Severity.high,
-                raw_result={"status": status},
-                check_id=check_id,
-                check_metadata={"CheckId": check_id},
-                muted=muted,
-                first_seen_at="2024-01-02T00:00:00Z",
-            )
-
-        create_finding("privesc_fail", "check_privesc_1", Status.FAIL, False)
-        create_finding("privesc_fail_2", "check_privesc_1", Status.FAIL, False)
-        create_finding("privesc_fail_muted", "check_privesc_1", Status.FAIL, True)
-        create_finding("privesc_pass", "check_privesc_1", Status.PASS, False)
-        create_finding("secrets_pass_muted", "check_secrets_1", Status.PASS, True)
-        create_finding("unmapped_fail", "check_unmapped", Status.FAIL, False)
-
-        aggregate_attack_surface(str(tenant.id), str(scan.id))
-
-        overviews = {
-            overview.attack_surface_type: overview
-            for overview in AttackSurfaceOverview.objects.filter(
-                tenant_id=tenant.id, scan_id=scan.id
-            )
-        }
-
-        assert set(overviews) == {"privilege-escalation", "secrets"}
-        assert overviews["privilege-escalation"].total_findings == 4
-        assert overviews["privilege-escalation"].failed_findings == 2
-        assert overviews["privilege-escalation"].muted_failed_findings == 1
-        assert overviews["secrets"].total_findings == 1
-        assert overviews["secrets"].failed_findings == 0
-        assert overviews["secrets"].muted_failed_findings == 0
-
     @patch("tasks.jobs.scan.Scan.all_objects.select_related")
     @patch("tasks.jobs.scan.rls_transaction")
     def test_aggregate_attack_surface_uses_select_related(

api/uv.lock

@@ -291,7 +291,7 @@ constraints = [
     { name = "pydantic-core", specifier = "==2.41.5" },
     { name = "pygithub", specifier = "==2.8.0" },
     { name = "pygments", specifier = "==2.20.0" },
-    { name = "pyjwt", specifier = "==2.14.0" },
+    { name = "pyjwt", specifier = "==2.13.0" },
     { name = "pylint", specifier = "==3.2.5" },
     { name = "pymsalruntime", specifier = "==0.18.1" },
     { name = "pynacl", specifier = "==1.6.2" },
@@ -387,7 +387,7 @@ overrides = [
     { name = "microsoft-kiota-serialization-multipart", specifier = "==1.9.10" },
     { name = "microsoft-kiota-serialization-text", specifier = "==1.9.10" },
     { name = "okta", specifier = "==3.4.2" },
-    { name = "pyjwt", extras = ["crypto"], specifier = "==2.14.0" },
+    { name = "pyjwt", extras = ["crypto"], specifier = "==2.13.0" },
 ]
 
 [[package]]
@@ -4938,7 +4938,7 @@ dependencies = [
 
 [[package]]
 name = "prowler-api"
-version = "1.46.0"
+version = "1.45.0"
 source = { virtual = "." }
 dependencies = [
     { name = "cartography" },
@@ -5332,11 +5332,11 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.14.0"
+version = "2.13.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/af/c3/8a3b59c25070cc61dc517fbdfa5dc0904670c96f605cc69759dc09166b99/pyjwt-2.14.0.tar.gz", hash = "sha256:77283c83fb56ecf566a886c757a714bc83668e38156de2cce8263302f42e0b86", size = 113177, upload-time = "2026-09-11T13:11:54.638Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9c/97/672cb32ce0dfea44b740cb7b4f97038463b9cf7c0ead1aacf595572851d6/pyjwt-2.14.0-py3-none-any.whl", hash = "sha256:ad0cef71c756a56e74863c2919cf0985f72decbcfcb550ee2f422e7c62b5eedc", size = 32896, upload-time = "2026-09-11T13:11:53.409Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
 ]
 
 [package.optional-dependencies]

docs/changelog.mdx

@@ -4,71 +4,6 @@ description: "New features and improvements in each Prowler release"
 rss: true
 ---
 
-<Update label="v5.44.0" description="September 29, 2026">
-  ### 🔁 Findings — Re-check a Resource with a Partial Scan
-
-  <Note>
-  This feature is available exclusively in **Prowler Cloud** and **Prowler Private Cloud** with a [subscription](https://prowler.com/pricing).
-  </Note>
-
-  A resource that has just been fixed can be confirmed from the Findings page without waiting for the next full scan. **Re-check resource** is available in the actions menu of every resource row and in the resource detail drawer, and a hint icon next to **Last seen** opens it directly. It launches a partial scan that runs again only the checks that last reported on that resource; its findings update when the scan completes, and every other resource keeps the results of the latest full scan. Roles need the Manage Scans permission, and a re-check is refused while the provider has a scan running or queued.
-
-  Re-checked resources that now pass drop out of the finding groups list and its drill-down instead of opening a detail panel that still reports `FAIL`. Partial scans do not change overviews or compliance until the next full scan and produce no report files, so the Scans table marks them as **Partial**, offers no report download for them, and the per-scan Compliance selector leaves them out.
-
-  Partial scans can also be launched outside the Findings page:
-
-  - **API:** `POST /api/v1/scans` accepts up to 10 resources in `resource_uids`, and scans expose `is_partial` with a `filter[is_partial]` filter.
-  - **MCP Server:** `prowler_trigger_scan` takes a `resource_uids` argument, and `prowler_list_scans` and `prowler_get_scan` return `is_partial`, with an `is_partial` filter on `prowler_list_scans`.
-  - **Lighthouse AI:** can launch a partial scan to re-check specific resources, such as confirming a remediation.
-
-  ### ☁️ AWS — Connect an Account in One Step
-
-  The Add Provider wizard connects an AWS account in a single step. The account ID is read from the role ARN (or typed when using static access keys), the role is assumed with Prowler's own credentials, and the account, its credentials and the connection test are handled by one submit. A confirmed connection goes straight to the launch step. A refused connection stays on the form with the reason the API returned, so the fields can be fixed and retried without registering the account twice.
-
-  New tenants without providers now land on this wizard on their first sign-in instead of a welcome modal, and the sidebar action reads **Add Provider** until the first provider is connected.
-
-  Read more in the [Getting Started with AWS documentation](https://docs.prowler.com/user-guide/providers/aws/getting-started-aws).
-
-  ### 🔌 Connection Tests No Longer Give Up Early
-
-  The provider connection test no longer reports `Max retries exceeded` for checks that take longer than 30 seconds, such as networks where some AWS endpoints are unreachable. The UI now waits for the full time limit of the backend task, and if that is still exhausted it shows the provider's current connection state instead of a failure.
-
-  On the SDK side, STS calls after a role assumption reuse the region that answered, so an unreachable partition region is waited on once instead of twice. The new `PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS` environment variable sets the Boto3 retries for deployments that build the AWS provider without CLI flags, next to the existing timeout variables; `0` disables retries.
-
-  Read more in the [Boto3 configuration documentation](https://docs.prowler.com/user-guide/providers/aws/boto3-configuration#retries-configuration).
-
-  ### 🗄️ Self-Hosted — S3-Compatible Storage and Air-Gapped Deployments
-
-  - `DJANGO_OUTPUT_S3_AWS_ENDPOINT_URL` points scan output uploads and downloads at S3-compatible object storage such as MinIO. Previously the only way to reach it was exporting process-wide AWS environment variables, which also hijacked unrelated AWS API calls such as role assumption for AWS providers.
-  - Report downloads from a bucket with default SSE-KMS encryption no longer fail with `InvalidArgument`: when `DJANGO_OUTPUT_S3_AWS_DEFAULT_REGION` is set, download URLs are signed with Signature Version 4 for that region.
-  - Icons ship in the UI bundle instead of being fetched from `api.iconify.design`, so pages render correctly without internet access.
-  - Celery worker fatal errors are logged instead of silenced, and every long-running service in `docker-compose.yml` restarts automatically after an unexpected crash.
-
-  ### 📊 Consistent Latest Scan Across Endpoints
-
-  Every endpoint now resolves a provider's latest completed scan the same way, so overlapping scans no longer make findings, compliance and mute rules read from different scans. Providers whose latest completed scan has no `completed_at` timestamp are no longer missing from those endpoints, and resources no longer keep a stale failed findings count when a scoped or imported scan completes after a full scan.
-
-  ### 🛠️ Prowler App Fixes
-
-  - API key authentication no longer locks the key row on every request, so a heavily used key no longer serializes all its requests; `last_used_at` is updated at most once per minute.
-  - `POST /api/v1/scans` returns the new scan ID in `task_args` again.
-  - Provider deletion no longer fails when the provider has Attack Paths scans recorded on a sink that is no longer configured, such as Neptune after moving back to Neo4j.
-  - A periodic sweep drops orphaned Attack Paths temporary Neo4j databases left behind when a worker or Neo4j crashes mid-scan.
-  - **Prowler Cloud:** imported findings no longer stay stuck in `pending` when the ingestion worker picks up the job before it is committed, and a failed enqueue marks the ingestion as failed.
-  - **Prowler Cloud:** the Lighthouse AI connection check reports a network failure as one, naming the endpoint it could not reach, instead of hitting a time limit that looked the same as a bad key.
-  - **Prowler Cloud:** the finding groups endpoints no longer query Manual Pass triages once per finding, and skip that overlay for tenants with no active Manual Pass.
-  - The Findings page renders a skeleton at once and streams the table before the filters, and the **Finding Group** options load when the dropdown opens.
-  - Mute rule creation errors show the API error message instead of the raw response body.
-  - The sidebar no longer throws a hydration error on full page loads for users who last used the chat mode.
-
-  ### 🔐 Security Updates
-
-  - `DELETE /api/v1/tasks/{id}` requires the permission of the operation that queued the task and rejects provider deletions, and `GET /api/v1/tasks` hides tasks of providers outside the role's visibility.
-  - The UI E2E workflow receives its AWS credentials through environment variables instead of template expansion.
-
-  See the [full release notes on GitHub](https://github.com/prowler-cloud/prowler/releases/tag/5.44.0) for the complete list of changes.
-</Update>
-
 <Update label="v5.43.0" description="September 21, 2026">
   ### 🏛️ Compliance — FedRAMP 20x Consolidated Rules 2026
 

docs/developer-guide/alibabacloud-details.mdx

@@ -68,7 +68,7 @@ The generic service pattern is described in [service page](/developer-guide/serv
 - Directly in the code, in location [`prowler/providers/alibabacloud/services/`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers/alibabacloud/services)
 - In the [Prowler Hub](https://hub.prowler.com/) for a more human-readable view.
 
-The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used across all Alibaba Cloud services.
+The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In the next subsection you can find a list of common patterns that are used across all Alibaba Cloud services.
 
 ### Alibaba Cloud Service Common Patterns
 

docs/developer-guide/aws-details.mdx

@@ -8,7 +8,7 @@ By default, Prowler will audit just one account and organization settings per sc
 
 ## AWS Provider Classes Architecture
 
-The AWS provider implementation follows the general [Provider structure](/developer-guide/provider). This section focuses on the AWS-specific implementation, highlighting how the generic provider concepts are realized for AWS in Prowler. For a full overview of the provider pattern, base classes, and extension guidelines, see [Provider documentation](/developer-guide/provider). In next subsection you can find a list of the main classes of the AWS provider.
+The AWS provider implementation follows the general [Provider structure](/developer-guide/provider). This section focuses on the AWS-specific implementation, highlighting how the generic provider concepts are realized for AWS in Prowler. For a full overview of the provider pattern, base classes, and extension guidelines, see [Provider documentation](/developer-guide/provider). In the next subsection you can find a list of the main classes of the AWS provider.
 
 ### `AwsProvider` (Main Class)
 
@@ -59,7 +59,7 @@ The generic service pattern is described in [service page](/developer-guide/serv
 - Directly in the code, in location [`prowler/providers/aws/services/`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers/aws/services)
 - In the [Prowler Hub](https://hub.prowler.com/) for a more human-readable view.
 
-The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used across all AWS services.
+The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In the next subsection you can find a list of common patterns that are used across all AWS services.
 
 ### AWS Service Common Patterns
 
@@ -67,8 +67,8 @@ The best reference to understand how to implement a new service is following the
 - Every AWS service class inherits from `AWSService`, ensuring access to session, identity, configuration, and threading utilities.
 - The constructor (`__init__`) always calls `super().__init__` with the service name and provider (e.g. `super().__init__(__class__.__name__, provider))`). Ensure that the service name in boto3 is the same that you use in the constructor. Usually is used the `__class__.__name__` to get the service name because it is the same as the class name.
 - Resource containers **must** be initialized in the constructor. They should be dictionaries, with the key being the resource ARN or equivalent unique identifier and the value being the resource object.
-- Resource discovery and attribute collection are parallelized using `self.__threading_call__`, typically by region or resource, for performance. The first parameter of the method is the iterator, if not provided, it will be the region; but if present indicate an array of the resources to be processed.
-- Resource filtering is consistently enforced using `self.audit_resources` attribute and `is_resource_filtered` function, it is used to see if user has provided some resource that is not in the audit scope, so we can skip it in the service logic. Normally it is used before storing the resource in the service container as follows: `if not self.audit_resources or (is_resource_filtered(resource["arn"], self.audit_resources)):`.
+- Resource discovery and attribute collection are parallelized using `self.__threading_call__`, typically by region or resource, for performance. The first parameter of the method is the iterator, if not provided, it will be the region; but if present it indicates an array of the resources to be processed.
+- Resource filtering is consistently enforced using `self.audit_resources` attribute and `is_resource_filtered` function, it is used to see if the user has provided some resource that is not in the audit scope, so we can skip it in the service logic. Normally it is used before storing the resource in the service container as follows: `if not self.audit_resources or (is_resource_filtered(resource["arn"], self.audit_resources)):`.
 - All AWS resources are represented as Pydantic `BaseModel` classes, providing type safety and structured access to resource attributes.
 - AWS API calls are wrapped in try/except blocks, with specific handling for `ClientError` and generic exceptions, always logging errors.
 - If ARN is not present for some resource, it can be constructed using string interpolation, always including partition, service, region, account, and resource ID.
@@ -162,7 +162,7 @@ When you instantiate `Check_Report_AWS`, you must provide the check metadata and
 
 If the resource object does not contain the required attributes, you must set them manually in the check logic.
 
-Other attributes are inherited from the `Check_Report` class, from those you **always** have to set the `status` and `status_extended` attributes in the check logic.
+Other attributes are inherited from the `Check_Report` class, from which you **always** have to set the `status` and `status_extended` attributes in the check logic.
 
 #### Example Usage
 

docs/developer-guide/azure-details.mdx

@@ -8,7 +8,7 @@ By default, Prowler will audit all the subscriptions that it is able to list in
 
 ## Azure Provider Classes Architecture
 
-The Azure provider implementation follows the general [Provider structure](/developer-guide/provider). This section focuses on the Azure-specific implementation, highlighting how the generic provider concepts are realized for Azure in Prowler. For a full overview of the provider pattern, base classes, and extension guidelines, see [Provider documentation](/developer-guide/provider). In next subsection you can find a list of the main classes of the Azure provider.
+The Azure provider implementation follows the general [Provider structure](/developer-guide/provider). This section focuses on the Azure-specific implementation, highlighting how the generic provider concepts are realized for Azure in Prowler. For a full overview of the provider pattern, base classes, and extension guidelines, see [Provider documentation](/developer-guide/provider). In the next subsection you can find a list of the main classes of the Azure provider.
 
 ### `AzureProvider` (Main Class)
 
@@ -57,13 +57,13 @@ The generic service pattern is described in [service page](/developer-guide/serv
 - Directly in the code, in location [`prowler/providers/azure/services/`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers/azure/services)
 - In the [Prowler Hub](https://hub.prowler.com/) for a more human-readable view.
 
-The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used across all Azure services.
+The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In the next subsection you can find a list of common patterns that are used across all Azure services.
 
 ### Azure Service Common Patterns
 
 - Services communicate with Azure using the Azure Python SDK, mainly using the Azure Management Client (except for the Microsoft Entra ID service, that is using the Microsoft Graph API), you can find the documentation with all the management services [here](https://learn.microsoft.com/en-us/python/api/overview/azure/?view=azure-python).
 - Every Azure service class inherits from `AzureService`, ensuring access to session, identity, configuration, and client utilities.
-- The constructor (`__init__`) always calls `super().__init__` with the service Azure Management Client and Prowler provider object (e.g `super().__init__(WebSiteManagementClient, provider)`).
+- The constructor (`__init__`) always calls `super().__init__` with the service Azure Management Client and Prowler provider object (e.g. `super().__init__(WebSiteManagementClient, provider)`).
 - Resource containers **must** be initialized in the constructor, and they should be dictionaries, with the key being the subscription ID, the value being a dictionary with the resource ID as key and the resource object as value.
 - All Azure resources are represented as Pydantic `BaseModel` classes, providing type safety and structured access to resource attributes. Some are represented as dataclasses due to legacy reasons, but new resources should be represented as Pydantic `BaseModel` classes.
 - Azure SDK functions are wrapped in try/except blocks, with specific handling for errors, always logging errors. It is a best practice to create a custom function for every Azure SDK call, in that way we can handle the errors in a more specific way.

docs/developer-guide/checks.mdx

@@ -103,7 +103,7 @@ class <check_name>(Check):
             # Set required fields and implement check logic
             report.status = "PASS"
             report.status_extended = f"<Description about why the resource is compliant>"
-            # If some of the information needed for the report is not inside the resource, it can be set it manually here.
+            # If some of the information needed for the report is not inside the resource, it can be set manually here.
             # This depends on the provider and the resource that is being audited.
             # report.region = resource.region
             # report.resource_tags = getattr(resource, "tags", [])
@@ -437,7 +437,7 @@ For the complete list of available categories, see [Categories Guidelines](/deve
 
 #### DependsOn
 
-List of check IDs of checks that if are compliant, this check will be a compliant too or it is not going to give any finding.
+List of check IDs of checks that if they are compliant, this check will be compliant too or it is not going to give any finding.
 
 #### RelatedTo
 

docs/developer-guide/environment-variables.mdx

@@ -41,14 +41,13 @@ The former build-time variables map to the new runtime variables as follows:
 `UI_CLOUD_ENABLED` is a plain runtime boolean flag that enables Prowler Cloud behavior when set to the exact string `"true"` and defaults to off; unlike the other renamed variables it has no legacy fallback, so `NEXT_PUBLIC_IS_CLOUD_ENV` is no longer read.
 
 `UI_SELF_REGISTRATION_ENABLED` is a runtime opt-out flag that Prowler Local Server reads only when `UI_CLOUD_ENABLED` is `"true"`. It defaults to on and turns off when set to `"false"`, matched case-insensitively so the same value can be shared with a backend setting written `False`. When it is off, the sign-up page only opens with an invitation token, the sign-in page drops its "Sign up" link, and the profile hides "Create organization"; invited users can still complete their registration. Outside a Prowler Cloud deployment the flag is ignored and account creation stays open.
+
 ## Registry UI Rollout and Rollback
 
 `UI_REGISTRY_ENABLED` is an optional runtime flag for Prowler Cloud and Private Cloud. Registry is eligible only when both `UI_CLOUD_ENABLED` and `UI_REGISTRY_ENABLED` are the exact string `"true"` and the current user has the backend-authorized `manage_registry` permission. Unset, `"false"`, or malformed values fail closed. The flag defaults to off and is not a replacement for backend authorization. Registry access is independent of billing; Private Cloud can use it with `CLOUD_BILLING_ENABLED=false`.
 
 Roll out Registry only after the Registry backend dependency is deployed, intended roles have `manage_registry`, and acceptance with real credentials has exercised installation, provider account creation, credentials, connection, and scan launch. Deploy the UI with `UI_REGISTRY_ENABLED` unset or `"false"`; set it to `"true"` only in the prepared process environment, then restart or otherwise apply the environment update required by the platform. A Registry key must belong to the configured Registry environment; a production key does not authenticate against a development Registry.
 
-The Registry links read `PROWLER_REGISTRY_INDEX_URL`, the same base URL the backend installs artifacts from. The Registry page and the credential banner link to it, and its origin is allowed for images. `UI_REGISTRY_MEDIA_URL` adds the Registry media service origin so artifact logos load. When `PROWLER_REGISTRY_INDEX_URL` is unset or invalid, the links are hidden instead of pointing to the public Prowler Registry, which keeps private and air-gapped deployments from sending users to an unreachable host. `UI_REGISTRY_URL` is no longer read.
-
 The catalog displays all artifacts, including built-ins and packages containing only checks or compliance frameworks. Only external provider artifacts support Add. After confirmed installation, open Providers and select the option labeled Registry to configure an account. Creating accounts and running scans also require the corresponding provider and scan permissions. Removing an artifact keeps existing provider accounts, but future connections or scans can fail until the artifact is installed again.
 
 To roll back, set `UI_REGISTRY_ENABLED=false` or remove it and apply the environment update. Proxy, page, and action checks deny on their next request. Navigation refreshes from server-authorized access when the page is requested again. Rollback does not delete Registry credentials, tenant artifact records, or provider accounts.

docs/developer-guide/gcp-details.mdx

@@ -102,7 +102,7 @@ The generic service pattern is described in [service page](/developer-guide/serv
 - Directly in the code, in location [`prowler/providers/gcp/services/`](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers/gcp/services)
 - In the [Prowler Hub](https://hub.prowler.com/) for a more human-readable view.
 
-The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In next subsection you can find a list of common patterns that are used across all GCP services.
+The best reference to understand how to implement a new service is following the [service implementation documentation](/developer-guide/services#adding-a-new-service) and taking other services already implemented as reference. In the next subsection you can find a list of common patterns that are used across all GCP services.
 
 ### GCP Service Common Patterns
 
@@ -161,7 +161,7 @@ When you instantiate `Check_Report_GCP`, you must provide the check metadata and
     - Defaults to "global" if none are available.
 
 All these attributes can be overridden by passing the corresponding argument to the constructor. If the resource object does not contain the required attributes, you must set them manually.
-Other attributes are inherited from the `Check_Report` class, from those you **always** have to set the `status` and `status_extended` attributes in the check logic.
+Other attributes are inherited from the `Check_Report` class, from which you **always** have to set the `status` and `status_extended` attributes in the check logic.
 
 #### Example Usage
 

docs/developer-guide/provider.mdx

@@ -17,7 +17,7 @@ A provider is any platform or service that offers resources, data, or functional
 For providers supported by Prowler, refer to [Prowler Hub](https://hub.prowler.com/).
 
 <Warning>
-    There are some custom providers added by the community, like [NHN Cloud](https://www.nhncloud.com/), that are not maintained by the Prowler team, but can be used in the Prowler CLI. The main purpose of this documentation is to guide you through creating a new provider and integrating it not only in the CLI, but also in the API and UI. Non official providers can be checked directly at the [Prowler GitHub repository](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers).
+    There are some custom providers added by the community, like [NHN Cloud](https://www.nhncloud.com/), that are not maintained by the Prowler team, but can be used in the Prowler CLI. The main purpose of this documentation is to guide you through creating a new provider and integrating it not only in the CLI, but also in the API and UI. Non-official providers can be checked directly at the [Prowler GitHub repository](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers).
 </Warning>
 ---
 
@@ -105,8 +105,8 @@ Once you have decided the provider you want or need to add to Prowler, the next
 #### Implementation Complexity
 
 - **SDK Providers**: Low complexity. You have mature examples like AWS, Azure, GCP, Kubernetes, etc. that you can leverage to implement your provider.
-- **API Providers**: Medium complexity. You need to implement the authentication and session management, and the API calls to the provider. You now have NHN and MongoDB Atlas as example to follow.
-- **Tool/Wrapper Providers**: High complexity. You need to implement the argument/output mapping to the provider and handle problems that the tool/wrapper may have. You now have IAC and the PowerShell wrapper as example to follow.
+- **API Providers**: Medium complexity. You need to implement the authentication and session management, and the API calls to the provider. You now have NHN and MongoDB Atlas as examples to follow.
+- **Tool/Wrapper Providers**: High complexity. You need to implement the argument/output mapping to the provider and handle problems that the tool/wrapper may have. You now have IAC and the PowerShell wrapper as examples to follow.
 - **Hybrid Providers**: High complexity. You need to "customize" your provider, mixing the other types of providers to achieve the desired result. You have M365 (msgraph SDK + PowerShell wrapper) and GitHub (PyGithub SDK + graphql API requests) as examples.
 
 ### Determining Regional vs Non-Regional Architecture
@@ -1756,7 +1756,7 @@ Argument validation ensures that the API provider receives valid configuration p
 
 **File:** `prowler/providers/<provider_name>/lib/arguments/arguments.py`
 
-Arguments depends on the provider and not the type, so the pattern for this step is the same as the [SDK providers](#step-4-implement-arguments).
+Arguments depend on the provider and not the type, so the pattern for this step is the same as the [SDK providers](#step-4-implement-arguments).
 
 #### Step 5: Implement Mutelist
 
@@ -2397,7 +2397,7 @@ class ToolProvider(Provider):
             # Build the tool command
             tool_command = [
                 "your_tool_command",
-                # Add your tool-specific arguments here, this are just examples
+                # Add your tool-specific arguments here, these are just examples
                 "-d",
                 directory,
                 "-o",

docs/developer-guide/services.mdx

@@ -5,7 +5,7 @@ title: 'Prowler Services'
 Here you can find how to create a new service, or to complement an existing one, for a [Prowler Provider](/developer-guide/provider).
 
 <Note>
-First ensure that the provider you want to add the service is already created. It can be checked [here](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers). If the provider is not present, please refer to the [Provider](./provider.md) documentation to create it from scratch.
+First ensure that the provider you want to add the service to is already created. It can be checked [here](https://github.com/prowler-cloud/prowler/tree/master/prowler/providers). If the provider is not present, please refer to the [Provider](/developer-guide/provider) documentation to create it from scratch.
 </Note>
 ## Introduction
 
@@ -102,7 +102,7 @@ class <Service>(ServiceParentClass):
 
         # A try-except block must be created in each function.
         try:
-            # If pagination is supported by the provider, is always better to use it, call to the provider API to retrieve the desired data.
+            # If pagination is supported by the provider, it is always better to use it, call to the provider API to retrieve the desired data.
             describe_<items>_paginator = regional_client.get_paginator("describe_<items>")
 
             # Paginator to get every item.
@@ -133,7 +133,7 @@ class <Service>(ServiceParentClass):
 
         # When handling exceptions, use the following approach to log errors appropriately based on the cloud provider being used:
         except Exception as error:
-            # Depending on each provider we can must use different fields in the logger, e.g.: AWS: regional_client.region or self.region, GCP: project_id and location, Azure: subscription
+            # Depending on each provider we must use different fields in the logger, e.g.: AWS: regional_client.region or self.region, GCP: project_id and location, Azure: subscription
             logger.error(
                 f"{<provider_specific_field>} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
             )

docs/developer-guide/unit-testing.mdx

@@ -284,7 +284,7 @@ class Test_iam_password_policy_uppercase:
 
         assert len(results) == 1
         assert result[0].status == "FAIL"
-        assert result[0].status_extended == "IAM password policy does not srequire at least one uppercase letter."
+        assert result[0].status_extended == "IAM password policy does not require at least one uppercase letter."
         assert result[0].resource_arn == f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
         assert result[0].resource_id == AWS_ACCOUNT_NUMBER
         assert result[0].resource_tags == []
@@ -882,7 +882,7 @@ from unittest import mock
 
 from uuid import uuid4
 
-# Import some constans values needed in almost every check
+# Import some constant values needed in almost every check
 
 from tests.providers.azure.azure_fixtures import (
     AZURE_SUBSCRIPTION_ID,
@@ -1024,7 +1024,7 @@ from prowler.providers.azure.services.appinsights.appinsights_service import (
     Component,
 )
 
-# Import some constans values needed in almost every check
+# Import some constant values needed in almost every check
 
 from tests.providers.azure.azure_fixtures import (
     AZURE_SUBSCRIPTION_ID,

docs/getting-started/installation/prowler-app.mdx

@@ -128,8 +128,8 @@ To update the environment file:
 Edit the `.env` file and change version values:
 
 ```env
-PROWLER_UI_VERSION="5.44.0"
-PROWLER_API_VERSION="5.44.0"
+PROWLER_UI_VERSION="5.43.0"
+PROWLER_API_VERSION="5.43.0"
 ```
 
 <Note>

docs/getting-started/products/prowler-cloud-aws-marketplace.mdx

@@ -6,7 +6,7 @@ This section contains the instructions to subscribe to **Prowler Cloud** through
 
 ## How to Subscribe
 
-To get to the **Prowler Cloud** product listing in the AWS Marketplace, and click the `View purchase options` button:
+Go to the **Prowler Cloud** product listing in the AWS Marketplace, and click the `View purchase options` button:
 
 1. Use this link to be taken directly to the [Prowler Cloud Marketplace Listing](https://aws.amazon.com/marketplace/pp/prodview-6ochhig5kxpok):
 
@@ -24,7 +24,7 @@ After you have subscribed to the **Prowler Cloud** product, you will need to set
 
     ![](/images/aws-marketplace/marketplace-message.png)
 
-2. You will be redirected to **Prowler Cloud Sign In** page. You can sign in with an existing account or sign up with a new account:
+2. You will be redirected to the **Prowler Cloud Sign In** page. You can sign in with an existing account or sign up with a new account:
 
     ![](/images/aws-marketplace/marketplace-sign-up.png)
 

docs/getting-started/products/prowler-cloud-lighthouse.mdx

@@ -5,7 +5,7 @@ title: 'Overview'
 import { SubscriptionBanner } from "/snippets/subscription-banner.mdx"
 import { VersionBadge } from "/snippets/version-badge.mdx"
 
-Prowler Cloud runs an enhanced version of Lighthouse AI in Open Source repository, the Agentic Cloud Defender that helps teams understand, prioritize, and remediate security findings across cloud environments.
+Prowler Cloud runs an enhanced version of Lighthouse AI in the Open Source repository, the Agentic Cloud Defender that helps teams understand, prioritize, and remediate security findings across cloud environments.
 
 <SubscriptionBanner />
 

docs/getting-started/products/prowler-cloud.mdx

@@ -10,7 +10,7 @@ Prowler Cloud automates scanning single or multiple accounts and has all of the
 
 <Card title="Create your account here to see Prowler Cloud in action" href="https://cloud.prowler.com/sign-up" />
 
-With 100% consistency across our open source policies and APIs. Prowler Cloud provides the following added benefits:
+With 100% consistency across our open source policies and APIs, Prowler Cloud provides the following added benefits:
 
 <ul>
     <li> Immediate sign-up and account provisioning, including a trial period with zero billing details needed at registration. </li>
@@ -20,5 +20,5 @@ With 100% consistency across our open source policies and APIs. Prowler Cloud pr
     <li> Zero touch third party notifications to Slack, Jira, and more. </li>
 </ul>
 
-The team who built [Prowler](https://github.com/prowler-cloud/prowler), has helped thousands of companies get Cloud Security under control, is now making it easier by taking
+The team who built [Prowler](https://github.com/prowler-cloud/prowler), which has helped thousands of companies get Cloud Security under control, is now making it easier by taking
 [Prowler](https://github.com/prowler-cloud/prowler) to the [Cloud](https://prowler.com)!

docs/getting-started/products/prowler-hub.mdx

@@ -2,7 +2,7 @@
 title: "Overview"
 ---
 
-**Prowler Hub** is our growing public library of versioned checks, cloud service artifacts, and compliance frameworks with its mappings. It’s searchable, explainable, and built to serve the community.
+**Prowler Hub** is our growing public library of versioned checks, cloud service artifacts, and compliance frameworks with their mappings. It’s searchable, explainable, and built to serve the community.
 
 **Why this matters**: Every engineer has asked, “What does this check actually do?” Prowler Hub answers that question in one place, lets you pin to a specific version, and pulls definitions into your own tools or dashboards.
 

docs/getting-started/products/prowler-lighthouse-ai.mdx

@@ -62,7 +62,7 @@ Prowler Lighthouse AI is powerful, but there are limitations:
 - **Continuous improvement**: Please report any issues, as the feature may make mistakes or encounter errors, despite extensive testing.
 - **Access limitations**: Lighthouse AI can only access data the logged-in user can view. If you can't see certain information, Lighthouse AI can't see it either.
 - **NextJS session dependence**: If your Prowler application session expires or logs out, Lighthouse AI will error out. Refresh and log back in to continue.
-- **Response quality**: The response quality depends on the selected LLM provider and model. Choose models with strong tool-calling capabilities for best results. We recommend `gpt-5` model from OpenAI.
+- **Response quality**: The response quality depends on the selected LLM provider and model. Choose models with strong tool-calling capabilities for best results. We recommend the `gpt-5` model from OpenAI.
 
 ## Architecture
 
@@ -82,7 +82,7 @@ If you encounter issues with Prowler Lighthouse AI or have suggestions for impro
 
 ### What Data Is Shared to LLM Providers?
 
-The following API endpoints are accessible to Prowler Lighthouse AI. Data from the following API endpoints could be shared with LLM provider depending on the scope of user's query:
+The following API endpoints are accessible to Prowler Lighthouse AI. Data from the following API endpoints could be shared with the LLM provider depending on the scope of the user's query:
 
 ## FAQs
 
@@ -110,7 +110,7 @@ Lighthouse AI [automatically filters](https://github.com/prowler-cloud/prowler/b
 
 **3. Is my security data shared with LLM providers?**
 
-Minimal data is shared to generate useful responses. Agent can access security findings and remediation details when needed. Provider secrets are protected by design and cannot be read. The LLM provider credentials configured with Lighthouse AI are only accessible to the Next.js server and are never sent to the LLM providers. Resource metadata (names, tags, account/project IDs, etc.) may be shared with the configured LLM provider based on query requirements.
+Minimal data is shared to generate useful responses. The agent can access security findings and remediation details when needed. Provider secrets are protected by design and cannot be read. The LLM provider credentials configured with Lighthouse AI are only accessible to the Next.js server and are never sent to the LLM providers. Resource metadata (names, tags, account/project IDs, etc.) may be shared with the configured LLM provider based on query requirements.
 
 **4. Can the Lighthouse AI change my cloud environment?**
 

docs/troubleshooting.mdx

@@ -14,7 +14,7 @@ In macOS Ventura, the default value for the `file descriptors` is `256`. With th
 
 If you have a different OS and you are experiencing the same, please increase the value of your `file descriptors`. You can check it running `ulimit -a | grep "file descriptors"`.
 
-This error is also related with a lack of system requirements. To improve performance, Prowler stores information in memory so it may need to be run in a system with more than 1GB of memory.
+This error is also related to a lack of system requirements. To improve performance, Prowler stores information in memory so it may need to be run in a system with more than 1GB of memory.
 
 See section [Logging](/user-guide/cli/tutorials/logging) for further information or [contact us](/contact).
 

docs/user-guide/ai-agents/claude-code.mdx

@@ -239,7 +239,7 @@ The **Code** tab in the Claude desktop app runs the same Claude Code as the CLI,
   </Step>
 
   <Step title="Verify in the Code tab">
-    Open a **Code** tab session and ask for a Prowler tool: "Do you have access to the Prowler MCP tools?", it should respond with a list of available tools or confirming that it has access.
+    Open a **Code** tab session and ask for a Prowler tool: "Do you have access to the Prowler MCP tools?", it should respond with a list of available tools or confirm that it has access.
   </Step>
 </Steps>
 

docs/user-guide/ai-agents/cursor.mdx

@@ -31,7 +31,7 @@ For Prowler, the **global** scope is usually the right choice — your findings
 
 <Steps>
   <Step title="Open the MCP settings">
-    From Agent Window open **Customize** in the Cursor sidebar, then select the MCP section.
+    From the Agent Window open **Customize** in the Cursor sidebar, then select the MCP section.
 
     On earlier versions, press `Cmd + Shift + J` (macOS) or `Ctrl + Shift + J` (Windows/Linux) to open Cursor Settings, then click **Tools & MCP** in the sidebar.
 

docs/user-guide/ai-agents/index.mdx

@@ -16,7 +16,7 @@ Pick your agent below. Each guide is a full walkthrough with screenshots, verifi
     The Chat tab, via a local bridge
   </Card>
   <Card title="Codex / ChatGPT Desktop App" icon="code" href="/user-guide/ai-agents/codex">
-    ChatGPT Desktop App, Codex CLI, the VS Code extension through same config file
+    ChatGPT Desktop App, Codex CLI, the VS Code extension through the same config file
   </Card>
   <Card title="Cursor" icon="arrow-pointer" href="/user-guide/ai-agents/cursor">
     Agentic code editor. Global and project scopes

docs/user-guide/cli/tutorials/configuration_file.mdx

@@ -4,7 +4,7 @@ title: "Configuration File"
 
 import { VersionBadge } from "/snippets/version-badge.mdx"
 
-Several Prowler's checks have user configurable variables that can be modified in a common **configuration file**. This file can be found in the following [path](https://github.com/prowler-cloud/prowler/blob/master/prowler/config/config.yaml):
+Several Prowler checks have user configurable variables that can be modified in a common **configuration file**. This file can be found in the following [path](https://github.com/prowler-cloud/prowler/blob/master/prowler/config/config.yaml):
 
 ```
 prowler/config/config.yaml
@@ -353,7 +353,7 @@ This is the new Prowler configuration file format. The old one without provider
 # AWS Configuration
 aws:
   # AWS Global Configuration
-  # aws.mute_non_default_regions --> Set to True to muted failed findings in non-default regions for AccessAnalyzer, GuardDuty, SecurityHub, DRS and Config
+  # aws.mute_non_default_regions --> Set to True to mute failed findings in non-default regions for AccessAnalyzer, GuardDuty, SecurityHub, DRS and Config
   mute_non_default_regions: False
 
   # AWS Resource Scan Limit Configuration

docs/user-guide/cli/tutorials/custom-checks-metadata.mdx

@@ -10,7 +10,7 @@ You can use `--custom-checks-metadata-file` followed by the path to your custom
 
 ## Available Fields
 
-The list of supported check's metadata fields that can be overridden are listed as follows:
+The list of supported check's metadata fields that can be overridden is listed as follows:
 
 - Severity
 - CheckTitle

docs/user-guide/cli/tutorials/dashboard.mdx

@@ -65,7 +65,7 @@ This page shows all the info related to the compliance selected. Multiple filter
 
 <img src="/images/cli/dashboard/dashboard-compliance.png" />
 
-To add your own compliance to compliance page, add a file with the compliance name (using `_` instead of `.`) to the path `/dashboard/compliance`.
+To add your own compliance to the compliance page, add a file with the compliance name (using `_` instead of `.`) to the path `/dashboard/compliance`.
 
 In this file use the format present in the other compliance files to create the table. Example for CIS 2.0:
 

docs/user-guide/cli/tutorials/mutelist.mdx

@@ -163,7 +163,7 @@ Mutelist:
             Resources:
               - "test"
             Tags:
-              - "environment=prod"   # Will mute every resource except in account 123456789012 except the ones containing the string "test" and tag environment=prod
+              - "environment=prod"   # Will mute every resource in account 123456789012 except the ones containing the string "test" and tag environment=prod
 
     "*":
       Checks:

docs/user-guide/cli/tutorials/quick-inventory.mdx

@@ -26,4 +26,4 @@ By default, it extracts resources from all the regions, you could use `-f`/`--fi
 
 ## Objections
 
-The inventorying process is carried out with `resourcegroupstaggingapi` calls, which means that only resources they have or have had tags will appear (except for the IAM and S3 resources which are done with Boto3 API calls).
+The inventorying process is carried out with `resourcegroupstaggingapi` calls, which means that only resources that have or have had tags will appear (except for the IAM and S3 resources which are done with Boto3 API calls).

docs/user-guide/cli/tutorials/reporting.mdx

@@ -114,7 +114,7 @@ The CSV format follows a standardized structure across all providers. The follow
 
 #### CSV Headers Mapping
 
-The following table shows the mapping between the CSV headers and the providers fields:
+The following table shows the mapping between the CSV headers and the providers' fields:
 
 | Open Source Consolidated| AWS| GCP| AZURE| KUBERNETES
 |----------|----------|----------|----------|----------
@@ -134,7 +134,7 @@ The following table shows the mapping between the CSV headers and the providers
 
 ### JSON-OCSF
 
-The JSON-OCSF output format implements the [Detection Finding](https://schema.ocsf.io/classes/detection_finding) from the [OCSF](https://schema.ocsf.io)
+The JSON-OCSF output format implements the [Detection Finding](https://schema.ocsf.io/classes/detection_finding) from the [OCSF](https://schema.ocsf.io).
 
 ```json
 [{

docs/user-guide/compliance/tutorials/compliance.mdx

@@ -253,7 +253,7 @@ Standard results plus the framework breakdown are printed to the terminal. A ded
 <img src="/images/cli/compliance/compliance-cis-sample1.png" />
 
 <Note>
-If Prowler cannot find a resource related with a check from a compliance requirement, that requirement is omitted from the output.
+If Prowler cannot find a resource related to a check from a compliance requirement, that requirement is omitted from the output.
 </Note>
 
 ### List Available Compliance Frameworks

docs/user-guide/providers/aws/authentication.mdx

@@ -167,7 +167,7 @@ The same `External ID` entered in the Prowler UI must match the `ExternalId` par
         ```
 
         <Note>
-        Check the aws documentation [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/sts_example_sts_GetSessionToken_section.html)
+        Check the AWS documentation [here](https://docs.aws.amazon.com/IAM/latest/UserGuide/sts_example_sts_GetSessionToken_section.html)
         </Note>
 
     2. Copy the output containing:

docs/user-guide/providers/aws/boto3-configuration.mdx

@@ -81,7 +81,7 @@ Boto3's Standard retry mode includes the following mechanisms:
 
 - Nondescriptive Transient Error Codes: The retrier applies retry logic to standard HTTP status codes signaling transient errors: 500, 502, 503, 504.
 
-- Exponential Backoff Strategy: Each retry attempt follows exponential backoff with a base factor of 2, ensuring progressive delay between retries. Maximum backoff time: 20 seconds
+- Exponential Backoff Strategy: Each retry attempt follows exponential backoff with a base factor of 2, ensuring progressive delay between retries. Maximum backoff time: 20 seconds.
 
 ## Validating Retry Attempts
 
@@ -92,4 +92,4 @@ For testing or modifying Prowler's behavior, use the following steps to confirm
 
 This approach follows the [AWS documentation](https://boto3.amazonaws.com/v1/documentation/api/latest/guide/retries.html#checking-retry-attempts-in-your-client-logs), which states that if a retry is performed, a message starting with "Retry needed" will be prompted.
 
-It is possible to determine the total number of calls made using `grep -i 'Sending http request' debuglogs.txt | wc -l`
+It is possible to determine the total number of calls made using `grep -i 'Sending http request' debuglogs.txt | wc -l`.

docs/user-guide/providers/aws/regions-and-partitions.mdx

@@ -27,6 +27,7 @@ When scanning the China (`aws-cn`), European Sovereign Cloud (`aws-eusc`) or Gov
 Refer to: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credentials.html#configuring-credentials for more information about the AWS credential configuration.
 
 </Note>
+
 ### Declaring the Partition
 
 `PROWLER_AWS_PARTITION` tells Prowler which partition the scan runs against, without relying on a region being configured:
@@ -35,7 +36,7 @@ Refer to: https://boto3.amazonaws.com/v1/documentation/api/latest/guide/credenti
 export PROWLER_AWS_PARTITION="aws-us-gov"
 ```
 
-It matters most where nothing else says. Resolving an identity means calling STS before anything is known about the credentials, and with no region configured Prowler would otherwise start from the commercial endpoints. Declaring the partition makes that first call go to the right place, which is the difference between a scan that starts and one that fails on an endpoint the credentials cannot use.
+It matters most where nothing else does. Resolving an identity means calling STS before anything is known about the credentials, and with no region configured Prowler would otherwise start from the commercial endpoints. Declaring the partition makes that first call go to the right place, which is the difference between a scan that starts and one that fails on an endpoint the credentials cannot use.
 
 A region configured for the session still wins when it belongs to the declared partition, so a deployment in `us-gov-west-1` is not sent to `us-gov-east-1`. A region belonging to a different partition is ignored, since a partition that has been declared explicitly is the more deliberate statement of the two.
 

docs/user-guide/providers/aws/securityhub.mdx

@@ -38,7 +38,7 @@ If AWS Security Hub is already enabled, you can proceed to the [next section](#e
 
 If the Prowler integration is already enabled in AWS Security Hub, you can proceed to the [next section](#sending-findings-to-aws-security-hub) and begin sending findings.
 
-Once **AWS Security Hub** is activated, **Prowler** must be enabled as partner integration to allow security findings to be sent to it.
+Once **AWS Security Hub** is activated, **Prowler** must be enabled as a partner integration to allow security findings to be sent to it.
 
 1. Enabling AWS Security Hub via Console
 Open the **AWS Security Hub** console: https://console.aws.amazon.com/securityhub/.
@@ -51,7 +51,7 @@ Open the **AWS Security Hub** console: https://console.aws.amazon.com/securityhu
 
 5. A new modal will appear to confirm that the integration with **Prowler** is being enabled. ![](/images/providers/enable-partner-integration-3.png)
 
-6. Click “**Accept Findings**”, to authorize **AWS Security Hub** to receive findings from Prowler. ![](/images/providers/enable-partner-integration-4.png)
+6. Click “**Accept Findings**” to authorize **AWS Security Hub** to receive findings from Prowler. ![](/images/providers/enable-partner-integration-4.png)
 
 ### Using AWS CLI
 
@@ -71,7 +71,7 @@ This command requires the `securityhub:EnableSecurityHub` permission. Ensure you
 </Note>
 **Step 2: Enable Prowler Integration**
 
-Once **AWS Security Hub** is activated, **Prowler** must be enabled as partner integration to allow security findings to be sent to it. Run the following AWS CLI commands:
+Once **AWS Security Hub** is activated, **Prowler** must be enabled as a partner integration to allow security findings to be sent to it. Run the following AWS CLI commands:
 
 ```shell
 aws securityhub enable-import-findings-for-product --region eu-west-1 --product-arn arn:aws:securityhub:<region>::product/prowler/prowler
@@ -151,7 +151,7 @@ prowler --security-hub --status FAIL
 
 **Configuring Findings Output**
 
-Instead of using `--status FAIL`, the `--send-sh-only-fails` argument to store all findings in Prowler outputs while sending only FAIL findings to AWS Security:
+Instead of using `--status FAIL`, use the `--send-sh-only-fails` argument to store all findings in Prowler outputs while sending only FAIL findings to AWS Security Hub:
 
 ```sh
 prowler --security-hub --send-sh-only-fails

docs/user-guide/providers/gcp/getting-started-gcp.mdx

@@ -55,7 +55,7 @@ For Google Cloud, first enter your `GCP Project ID` and then select the authenti
     - [Generate a key for a service account](https://cloud.google.com/iam/docs/creating-managing-service-account-keys)
 
     <img src="/images/prowler-app/gcp-service-account-creds.png" alt="GCP Service Account Credentials" width="700" />
-     For detailed instructions on how to setup Service Account authentication, see the [Authentication](/user-guide/providers/gcp/authentication#service-account-authentication) page.
+     For detailed instructions on how to set up Service Account authentication, see the [Authentication](/user-guide/providers/gcp/authentication#service-account-authentication) page.
   </Tab>
   <Tab title="Application Default Credentials">
     1. Run the following command in your terminal to authenticate with GCP:

docs/user-guide/providers/microsoft365/authentication.mdx

@@ -396,7 +396,7 @@ Installing PowerShell is different depending on your OS:
 
   </Tab>
   <Tab title="Linux (Ubuntu)">
-    [Ubuntu](https://learn.microsoft.com/es-es/powershell/scripting/install/install-ubuntu?view=powershell-7.5#installation-via-package-repository-the-package-repository): The required version for installing PowerShell +7.4 on Ubuntu are Ubuntu 22.04 and Ubuntu 24.04.
+    [Ubuntu](https://learn.microsoft.com/es-es/powershell/scripting/install/install-ubuntu?view=powershell-7.5#installation-via-package-repository-the-package-repository): The required versions for installing PowerShell +7.4 on Ubuntu are Ubuntu 22.04 and Ubuntu 24.04.
     The recommended way to install it is downloading the package available on PMC.
 
     Follow these steps:
@@ -482,7 +482,7 @@ Installing PowerShell is different depending on your OS:
 
   </Tab>
   <Tab title="Linux (Debian)">
-    [Debian](https://learn.microsoft.com/es-es/powershell/scripting/install/install-debian?view=powershell-7.5#installation-on-debian-11-or-12-via-the-package-repository): The required version for installing PowerShell +7.4 on Debian are Debian 11 and Debian 12. The recommended way to install it is downloading the package available on PMC.
+    [Debian](https://learn.microsoft.com/es-es/powershell/scripting/install/install-debian?view=powershell-7.5#installation-on-debian-11-or-12-via-the-package-repository): The required versions for installing PowerShell +7.4 on Debian are Debian 11 and Debian 12. The recommended way to install it is downloading the package available on PMC.
 
     Follow these steps:
 
@@ -521,7 +521,7 @@ Installing PowerShell is different depending on your OS:
 
   </Tab>
   <Tab title="Linux (RHEL)">
-    [Rhel](https://learn.microsoft.com/es-es/powershell/scripting/install/install-rhel?view=powershell-7.5#installation-via-the-package-repository): The required version for installing PowerShell +7.4 on Red Hat are RHEL 8 and RHEL 9. The recommended way to install it is downloading the package available on PMC.
+    [Rhel](https://learn.microsoft.com/es-es/powershell/scripting/install/install-rhel?view=powershell-7.5#installation-via-the-package-repository): The required versions for installing PowerShell +7.4 on Red Hat are RHEL 8 and RHEL 9. The recommended way to install it is downloading the package available on PMC.
 
     Follow these steps:
 

docs/user-guide/providers/oci/getting-started-oci.mdx

@@ -12,7 +12,7 @@ The following steps apply to Prowler Cloud and Prowler Local Server.
 1. Sign in to the [OCI Console](https://cloud.oracle.com/) and open **Tenancy Details** to copy the Tenancy OCID.
 2. Go to **Identity & Security** → **Users**, select the principal that owns the API key, and copy the **User OCID**.
 3. Generate or locate the API key fingerprint and private key for that user. Follow the [Config File Authentication steps](/user-guide/providers/oci/authentication#config-file-authentication-manual-api-key-setup) to create or rotate the key pair and copy the fingerprint.
-4. In **Tenancy Details**, note the **Home Region** identifier (for example, `me-abudhabi-1`). Any other region the tenancy is subscribed to also works.
+4. Note the **Region** identifier to scan (for example, `us-ashburn-1`).
 
 ### Step 2: Access Prowler Cloud
 1. Navigate to [Prowler Cloud](https://cloud.prowler.com/) or launch [Prowler Local Server](/user-guide/tutorials/prowler-app).
@@ -26,18 +26,12 @@ Prowler Cloud connects to OCI with API key credentials. Provide:
 
 - **User OCID** for the API key owner
 - **Fingerprint** of the API key
-- **Home Region**: select it from the list (for example, `me-abudhabi-1`)
+- **Region** (for example, `us-ashburn-1`)
 - **Private Key Content** (paste the full PEM value)
 - **Passphrase (Optional)** if the private key is encrypted
 
 Select **Next**, then **Launch Scan** to validate the connection and start the first OCI scan. The private key content is encoded for secure transmission.
 
-<Note>
-The home region is used only to validate the credentials and discover the regions the tenancy is subscribed to. It does not limit the scan: Prowler audits every subscribed region. OCI Identity and Access Management (IAM) only answers in subscribed regions, so a tenancy that is not subscribed to the selected region cannot be validated.
-</Note>
-
-Providers created without a region keep using `us-ashburn-1` for validation. If such a provider fails with `401 NotAuthenticated`, update its credentials and select the home region.
-
 ![Add OCI API Key Credentials](./images/oci-add-api-key-credentials.png)
 
 ---
@@ -340,11 +334,6 @@ prowler oci \
 
 #### Region Issues
 
-**Error: "OCI credential validation failed" with `401 NotAuthenticated` on `get_tenancy`**
-- The tenancy is not subscribed to the region used for validation (by default `us-ashburn-1`)
-- In Prowler Cloud or Prowler Local Server, update the provider credentials and select the tenancy home region
-- In Prowler CLI, set `region` in `~/.oci/config` to the home region. All subscribed regions are still scanned; `--region` also works but limits the scan to that region
-
 **Error: "Invalid region"**
 - Check available regions: `prowler oci --list-regions`
 - Verify your tenancy is subscribed to the region

docs/user-guide/providers/openstack/getting-started-openstack.mdx

@@ -7,7 +7,7 @@ import { VersionBadge } from "/snippets/version-badge.mdx"
 Prowler supports OpenStack both from the CLI and from Prowler Cloud. This guide walks you through the requirements, how to connect the provider in the UI, and how to run scans from the command line.
 
 <Note>
-Prowler currently supports **public cloud OpenStack providers** (OVH, Infomaniak, Vexxhost, etc.). Support for self-deployed OpenStack environments is not yet available, if you are interested in this feature, please [open an issue](https://github.com/prowler-cloud/prowler/issues/new) or [contact us](https://prowler.com/contact).
+Prowler currently supports **public cloud OpenStack providers** (OVH, Infomaniak, Vexxhost, etc.). Support for self-deployed OpenStack environments is not yet available. If you are interested in this feature, please [open an issue](https://github.com/prowler-cloud/prowler/issues/new) or [contact us](https://prowler.com/contact).
 </Note>
 
 ## Prerequisites

docs/user-guide/tutorials/prowler-app-jira-integration.mdx

@@ -154,7 +154,7 @@ Each Jira integration provides management actions through dedicated buttons:
 |--------|---------|------------------|-------|
 | **Test** | Verify integration connectivity | • Test Jira API access<br/>• Validate credentials<br/>• Check project permissions<br/>• Verify work item creation capability | Results displayed in notification message |
 | **Credentials** | Update authentication settings | • Change API token<br/>• Update email<br/>• Update Jira domain | Click "Update Credentials" to save changes |
-| **Enable/Disable** | Toggle integration status | • Enable or disable integration<br/>| Status change takes effect immediately |
+| **Enable/Disable** | Toggle integration status | • Enable or disable integration | Status change takes effect immediately |
 | **Delete** | Remove integration permanently | • Permanently delete integration<br/>• Remove all configuration data | ⚠️ **Cannot be undone** - confirm before deleting |
 
 ## Known Limitations

docs/user-guide/tutorials/prowler-app-rbac.mdx

@@ -148,12 +148,6 @@ New roles have no provider visibility by default. Assign at least one Provider G
 
 Integrations follow the visibility of the providers attached to them: a role can see an integration when it can access at least one of its providers, and only the providers visible to that role are listed on the integration. Editing or deleting an integration attached to providers outside the visibility of the role is not allowed. Integrations that are not attached to any provider, such as Jira, are tenant-wide and remain available to every role with the **Manage Integrations** permission.
 
-#### Task Visibility and Revocation
-
-<VersionBadge version="5.44.0" />
-
-Background tasks, such as provider deletions, connection checks and scans, follow the visibility of the provider they belong to: a role can see a task when it can access its provider. Tasks that carry no provider reference are treated as tenant-wide and are visible to every role. Revoking a pending task requires the same permission as the operation that queued it, for example **Manage Scans** for a scan. Provider deletions cannot be revoked.
-
 #### Creating a Provider Group
 
 Follow these steps to create a provider group in your account:

docs/user-guide/tutorials/prowler-app-s3-integration.mdx

@@ -330,8 +330,8 @@ Once the required permissions are set up, proceed to configure the S3 integratio
 
     ![Configuration form](/images/prowler-app/s3/s3-integration-ui-4.png)
 
-6. Click "Next" to configure credentials
-7. Configure AWS authentication using one of the supported methods:
+5. Click "Next" to configure credentials
+6. Configure AWS authentication using one of the supported methods:
 
     - **AWS SDK Default:** Use default AWS credentials from the environment. For Prowler Cloud users, this is the recommended option as the service has AWS credentials to assume IAM roles with ARNs matching `arn:aws:iam::*:role/Prowler*` or `arn:aws:iam::*:role/prowler*`
     - **Access Keys:** Provide AWS access key ID and secret access key
@@ -339,14 +339,14 @@ Once the required permissions are set up, proceed to configure the S3 integratio
 
     ![Credentials configuration](/images/prowler-app/s3/s3-integration-ui-5.png)
 
-8. Optional - For IAM role authentication, complete the required fields:
+7. Optional - For IAM role authentication, complete the required fields:
 
     - **Role ARN:** The Amazon Resource Name of the IAM role
     - **External ID:** Unique identifier for additional security (defaults to Tenant/Organization ID) - mandatory and automatically filled
     - **Role Session Name:** Optional - name for the assumed role session
     - **Session Duration:** Optional - duration in seconds for the session
 
-9. Click "Create Integration" to verify the connection and complete the setup
+8. Click "Create Integration" to verify the connection and complete the setup
 
 <Check>
 Once credentials are configured and the connection test passes, the S3 integration will be active. Scan results will automatically be exported to the specified bucket after each scan completes. Run a new scan and check the S3 bucket to verify the integration is working.

docs/user-guide/tutorials/prowler-app.mdx

@@ -93,10 +93,6 @@ After adding your cloud account credentials, click the `Check connection` button
 For a single AWS account, Prowler tests the connection as part of the `Connect account` step, so the wizard moves straight to launching the scan.
 </Note>
 
-<Note>
-To delegate the AWS connection, select `I don't have access, invite a teammate` on the same step when you cannot create the IAM role or do not have the account credentials. Prowler App sends the invitation to the tenant and shows the link to share. Prowler Cloud also emails it. This option is available to users who can manage the account.
-</Note>
-
 ## Step 6: Scan Started
 After the connection check succeeds, save the provider and start your first scan with the `Launch Scan` button. The `Scans` section shows the scan in progress:
 

mcp_server/changelog.d/pyjwt-2-14-0.security.md

@@ -1 +0,0 @@
-`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9

mcp_server/pyproject.toml

@@ -81,6 +81,5 @@ constraint-dependencies = [
   "cryptography==50.0.0",
   "joserfc==1.6.8",
   "mcp==1.28.1",
-  "pyjwt==2.14.0",
   "python-multipart==0.0.30"
 ]

mcp_server/uv.lock

@@ -13,7 +13,6 @@ constraints = [
     { name = "cryptography", specifier = "==50.0.0" },
     { name = "joserfc", specifier = "==1.6.8" },
     { name = "mcp", specifier = "==1.28.1" },
-    { name = "pyjwt", specifier = "==2.14.0" },
     { name = "python-multipart", specifier = "==0.0.30" },
 ]
 
@@ -978,11 +977,11 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.14.0"
+version = "2.13.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/af/c3/8a3b59c25070cc61dc517fbdfa5dc0904670c96f605cc69759dc09166b99/pyjwt-2.14.0.tar.gz", hash = "sha256:77283c83fb56ecf566a886c757a714bc83668e38156de2cce8263302f42e0b86", size = 113177, upload-time = "2026-09-11T13:11:54.638Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9c/97/672cb32ce0dfea44b740cb7b4f97038463b9cf7c0ead1aacf595572851d6/pyjwt-2.14.0-py3-none-any.whl", hash = "sha256:ad0cef71c756a56e74863c2919cf0985f72decbcfcb550ee2f422e7c62b5eedc", size = 32896, upload-time = "2026-09-11T13:11:53.409Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
 ]
 
 [package.optional-dependencies]
@@ -1293,8 +1292,8 @@ name = "secretstorage"
 version = "3.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "cryptography", marker = "sys_platform != 'win32'" },
-    { name = "jeepney", marker = "sys_platform != 'win32'" },
+    { name = "cryptography" },
+    { name = "jeepney" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" }
 wheels = [

prowler/CHANGELOG.md

@@ -4,22 +4,6 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 <!-- changelog: release notes start -->
 
-## [5.44.0] (Prowler v5.44.0)
-
-### 🚀 Added
-
-- `PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS` environment variable to set the Boto3 retries for deployments without CLI flags [(#12870)](https://github.com/prowler-cloud/prowler/pull/12870)
-
-### 🐞 Fixed
-
-- STS calls after role assumption use the answering region, avoiding a second wait for an unreachable partition region [(#12870)](https://github.com/prowler-cloud/prowler/pull/12870)
-
-### 🔐 Security
-
-- Pass the E2E AWS credentials to the UI E2E workflow through environment variables instead of template expansion [(#12864)](https://github.com/prowler-cloud/prowler/pull/12864)
-
----
-
 ## [5.43.0] (Prowler v5.43.0)
 
 ### 🚀 Added

prowler/changelog.d/aws-retries-max-attempts-env.added.md

@@ -0,0 +1 @@
+`PROWLER_AWS_BOTO3_RETRIES_MAX_ATTEMPTS` environment variable to set the Boto3 retries for deployments without CLI flags

prowler/changelog.d/aws-sts-reuse-answering-region.fixed.md

@@ -0,0 +1 @@
+STS calls after role assumption use the answering region, avoiding a second wait for an unreachable partition region

prowler/changelog.d/oci-home-region-bootstrap.fixed.md

@@ -1 +0,0 @@
-OCI API key credentials accept a home region to bootstrap identity calls, so tenancies not subscribed to us-ashburn-1 can connect

prowler/changelog.d/pyjwt-2-14-0.security.md

@@ -1 +0,0 @@
-`pyjwt` from 2.13.0 to 2.14.0, patching GHSA-ffc3-869f-jxw9

prowler/changelog.d/ui-e2e-secrets-via-env.security.md

@@ -0,0 +1 @@
+Pass the E2E AWS credentials to the UI E2E workflow through environment variables instead of template expansion

prowler/config/config.py

@@ -52,7 +52,7 @@ class _MutableTimestamp:
 
 timestamp = _MutableTimestamp(datetime.today())
 timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.45.0"
+prowler_version = "5.44.0"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"

prowler/providers/oraclecloud/oraclecloud_provider.py

@@ -89,7 +89,6 @@ class OraclecloudProvider(Provider):
         key_content: str = None,
         tenancy: str = None,
         pass_phrase: str = None,
-        home_region: str = None,
     ):
         """
         Initializes the OCI provider.
@@ -111,7 +110,6 @@ class OraclecloudProvider(Provider):
             - key_content: Content of the private key (base64 encoded).
             - tenancy: The OCID of the tenancy.
             - pass_phrase: The passphrase for the private key, if encrypted.
-            - home_region: Region used to bootstrap identity calls with API key credentials; it does not filter the audited regions.
 
         Raises:
             - OCISetUpSessionError: If an error occurs during the setup process.
@@ -142,7 +140,7 @@ class OraclecloudProvider(Provider):
         )
         has_direct_credentials = user and fingerprint and tenancy
         bootstrap_region = single_region or (
-            (home_region or self._bootstrap_region) if has_direct_credentials else None
+            self._bootstrap_region if has_direct_credentials else None
         )
 
         # Setup OCI Session

pyproject.toml

@@ -144,7 +144,7 @@ maintainers = [{name = "Prowler Engineering", email = "engineering@prowler.com"}
 name = "prowler"
 readme = "README.md"
 requires-python = ">=3.10,<3.14"
-version = "5.45.0"
+version = "5.44.0"
 
 [project.scripts]
 prowler = "prowler.__main__:prowler"
@@ -349,7 +349,7 @@ constraint-dependencies = [
   "pydash==8.0.6",
   "pyflakes==3.2.0",
   "pygments==2.20.0",
-  "pyjwt==2.14.0",
+  "pyjwt==2.13.0",
   "pylint==3.3.4",
   "pynacl==1.6.2",
   "pyopenssl==26.4.0",

tests/providers/oraclecloud/oraclecloud_provider_test.py

@@ -543,58 +543,6 @@ class TestOraclecloudProviderInit:
         assert mock_get_regions_to_audit.call_args_list[0].args == (None,)
         assert provider.regions == all_subscribed_regions
 
-    def test_init_with_home_region_bootstraps_there_without_scan_filter(self):
-        mock_session = OCISession(
-            config={"region": "me-abudhabi-1"}, signer=None, profile=None
-        )
-        mock_identity = OCIIdentityInfo(
-            tenancy_id="ocid1.tenancy.oc1..aaaaaaaexample",
-            tenancy_name="test-tenancy",
-            user_id="ocid1.user.oc1..aaaaaaaexample",
-            region="me-abudhabi-1",
-            profile=None,
-            audited_regions=set(),
-            audited_compartments=[],
-        )
-        all_subscribed_regions = [
-            OCIRegion(key="me-abudhabi-1", name="me-abudhabi-1", is_home_region=True),
-            OCIRegion(key="me-dubai-1", name="me-dubai-1", is_home_region=False),
-        ]
-
-        with (
-            patch(
-                "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.setup_session",
-                return_value=mock_session,
-            ) as mock_setup_session,
-            patch(
-                "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.set_identity",
-                return_value=mock_identity,
-            ),
-            patch(
-                "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_regions_to_audit",
-                return_value=all_subscribed_regions,
-            ) as mock_get_regions_to_audit,
-            patch(
-                "prowler.providers.oraclecloud.oraclecloud_provider.OraclecloudProvider.get_compartments_to_audit",
-                return_value=["ocid1.compartment.oc1..aaaaaaaexample"],
-            ),
-            patch("prowler.providers.common.provider.Provider.set_global_provider"),
-        ):
-            provider = OraclecloudProvider(
-                user="ocid1.user.oc1..aaaaaaaexample",
-                fingerprint="aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
-                key_content="fake-base64-key-content",
-                tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
-                home_region="me-abudhabi-1",
-                config_content={"dummy": True},
-                mutelist_content={"Accounts": {}},
-            )
-
-        assert mock_setup_session.call_args.kwargs["region"] == "me-abudhabi-1"
-        assert mock_get_regions_to_audit.call_args_list[0].args == (None,)
-        assert provider.regions == all_subscribed_regions
-        assert provider.home_region == "me-abudhabi-1"
-
     def test_init_with_config_file_auth_without_region_uses_session_config_region_for_identity(
         self,
     ):

tests/providers/oraclecloud/ui_regions_sync_test.py

@@ -1,20 +0,0 @@
-import re
-from pathlib import Path
-
-from prowler.providers.oraclecloud.config import OCI_REGIONS
-
-UI_REGIONS_FILE = (
-    Path(__file__).resolve().parents[3]
-    / "ui"
-    / "lib"
-    / "provider-credentials"
-    / "oci-regions.ts"
-)
-
-
-def test_ui_home_region_list_matches_sdk_regions():
-    ui_regions = set(
-        re.findall(r'"([a-z]{2,3}-[a-z-]+-\d+)"', UI_REGIONS_FILE.read_text())
-    )
-
-    assert ui_regions == set(OCI_REGIONS)

ui/CHANGELOG.md

@@ -4,27 +4,6 @@ All notable changes to the **Prowler UI** are documented in this file.
 
 <!-- changelog: release notes start -->
 
-## [1.44.0] (Prowler v5.44.0)
-
-### 🚀 Added
-
-- Sidebar action reads Add Provider while the tenant has no providers [(#12852)](https://github.com/prowler-cloud/prowler/pull/12852)
-
-### 🔄 Changed
-
-- AWS accounts are connected in a single wizard step: the account is read from the role ARN, or typed for access keys, the role is assumed with Prowler's own credentials, and the credentials are stored and tested with the account [(#12852)](https://github.com/prowler-cloud/prowler/pull/12852)
-- New tenants without providers land on the Add Provider wizard on first sign-in instead of a welcome modal [(#12852)](https://github.com/prowler-cloud/prowler/pull/12852)
-- Findings page paints a skeleton at once and streams the table before the filters; the "Finding Group" options load in a single request when the dropdown opens [(#12891)](https://github.com/prowler-cloud/prowler/pull/12891)
-
-### 🐞 Fixed
-
-- Mute rule creation errors show the API error message instead of the raw JSON:API response body [(#12853)](https://github.com/prowler-cloud/prowler/pull/12853)
-- Provider connection test no longer reports `Max retries exceeded` for checks that take longer than 30 seconds, such as networks where some AWS endpoints are unreachable; the wait now covers the backend task's full time limit and falls back to the provider's current connection state if it is still exhausted [(#12869)](https://github.com/prowler-cloud/prowler/pull/12869)
-- Sidebar no longer throws a React hydration error on full page loads for users who last used the chat mode [(#12873)](https://github.com/prowler-cloud/prowler/pull/12873)
-- Icons now ship in the UI bundle instead of being fetched from `api.iconify.design`, so pages render correctly in air-gapped deployments [(#12892)](https://github.com/prowler-cloud/prowler/pull/12892)
-
----
-
 ## [1.43.0] (Prowler v5.43.0)
 
 ### 🚀 Added

ui/__tests__/browser-harness.integration.test.ts

@@ -8,8 +8,6 @@ import { describe, expect, it } from "vitest";
 
 import { BrowserHarness } from "./browser-harness";
 
-const QUIET_MS = 50;
-
 /** Exposes the protected waiting helpers; no fixture or DOM is involved. */
 class WaitingHarness extends BrowserHarness<null> {
   constructor() {
@@ -23,10 +21,6 @@ class WaitingHarness extends BrowserHarness<null> {
   probeOrNull<T>(fn: () => T | null | undefined | false): Promise<T | null> {
     return this.waitForOrNull(fn, 200, "probe");
   }
-
-  probeStable<T>(read: () => T): Promise<T> {
-    return this.waitForStable(read, QUIET_MS, 1000, "probe");
-  }
 }
 
 describe("BrowserHarness waiting helpers", () => {
@@ -64,20 +58,4 @@ describe("BrowserHarness waiting helpers", () => {
       }),
     ).resolves.toBe("ready");
   });
-
-  it("resolves with a value only once it has held for the quiet window", async () => {
-    const harness = new WaitingHarness();
-    let reads = 0;
-    let settledAt = 0;
-
-    // Changes on each of the first reads, then holds at 4.
-    const settled = await harness.probeStable(() => {
-      reads += 1;
-      if (reads === 4) settledAt = performance.now();
-      return Math.min(reads, 4);
-    });
-
-    expect(settled).toBe(4);
-    expect(performance.now() - settledAt).toBeGreaterThanOrEqual(QUIET_MS);
-  });
 });

ui/__tests__/browser-harness.ts

@@ -211,31 +211,6 @@ export abstract class BrowserHarness<TFixture> {
     }
   }
 
-  /** Wait until `read` returns the same value for `quietMs`, and return it. */
-  protected async waitForStable<T>(
-    read: () => T,
-    quietMs: number,
-    timeoutMs = 5000,
-    label?: string,
-  ): Promise<T> {
-    let value = read();
-    let since = performance.now();
-    const settled = await this.waitFor(
-      () => {
-        const next = read();
-        if (!Object.is(next, value)) {
-          value = next;
-          since = performance.now();
-          return null;
-        }
-        return performance.now() - since >= quietMs ? { value } : null;
-      },
-      timeoutMs,
-      label ?? `a value stable for ${quietMs}ms`,
-    );
-    return settled.value;
-  }
-
   protected async waitForText(
     pattern: RegExp,
     timeoutMs = 5000,

ui/actions/finding-groups/finding-groups.ts

@@ -14,7 +14,6 @@ import {
   includesMutedFindings,
   splitCsvFilterValues,
 } from "@/lib";
-import { getFindingGroupFilterOptions } from "@/lib/finding-group-filter-options";
 import { appendSanitizedProviderFilters } from "@/lib/provider-filters";
 import { handleApiResponse } from "@/lib/server-actions-helper";
 
@@ -152,25 +151,6 @@ export const getLatestFindingGroups = async (
   params: FetchFindingGroupsParams = {},
 ) => fetchFindingGroupsEndpoint("finding-groups/latest", params);
 
-/**
- * Options for the "Finding Group" filter. Walks every finding-group page on the
- * server, so the browser issues a single request instead of one per page
- * (client-side Server Action calls are dispatched sequentially).
- */
-export const getFindingGroupCheckOptions = async ({
-  filters,
-  hasHistoricalData,
-}: {
-  filters: Record<string, string>;
-  hasHistoricalData: boolean;
-}) =>
-  getFindingGroupFilterOptions({
-    fetchFindingGroups: hasHistoricalData
-      ? getFindingGroups
-      : getLatestFindingGroups,
-    filters,
-  });
-
 interface FetchFindingGroupResourcesParams {
   checkId: string;
   page?: number;

ui/actions/invitations/invitation.adapter.test.ts

@@ -1,51 +0,0 @@
-import { describe, expect, it } from "vitest";
-
-import { toSentInvitation } from "./invitation.adapter";
-
-const created = {
-  data: {
-    id: "inv-1",
-    type: "invitations",
-    attributes: {
-      email: "teammate@company.com",
-      token: "abc123DEF45678",
-      state: "pending",
-      expires_at: "2026-10-07T10:00:00Z",
-    },
-  },
-};
-
-describe("toSentInvitation", () => {
-  it("reads the id, email and token of a created invitation", () => {
-    expect(toSentInvitation(created)).toEqual({
-      id: "inv-1",
-      email: "teammate@company.com",
-      token: "abc123DEF45678",
-    });
-  });
-
-  it("returns null when the action resolved without a value", () => {
-    // A 5xx makes `sendInvite` resolve undefined.
-    expect(toSentInvitation(undefined)).toBeNull();
-  });
-
-  it("returns null on a rejection, with or without an errors array", () => {
-    expect(
-      toSentInvitation({ errors: [{ detail: "Invalid email" }] }),
-    ).toBeNull();
-    expect(toSentInvitation({ error: "Something went wrong" })).toBeNull();
-  });
-
-  it("returns null when the record is missing any of the fields the link needs", () => {
-    expect(
-      toSentInvitation({
-        data: { id: "inv-1", attributes: { email: "a@b.com" } },
-      }),
-    ).toBeNull();
-    expect(
-      toSentInvitation({
-        data: { id: "inv-1", attributes: { token: "abc123DEF45678" } },
-      }),
-    ).toBeNull();
-  });
-});

ui/actions/invitations/invitation.adapter.ts

@@ -1,25 +0,0 @@
-import type { SentInvitation } from "@/types/onboarding-invite";
-
-const readString = (value: unknown): string | null =>
-  typeof value === "string" && value.length > 0 ? value : null;
-
-/**
- * The created record out of `sendInvite`'s JSON:API response. Null for every
- * failure shape: `undefined` (a 5xx makes the action resolve without a value),
- * `{ errors }`, a bare `{ error }`, or a record missing what the link needs.
- */
-export function toSentInvitation(response: unknown): SentInvitation | null {
-  if (!response || typeof response !== "object") return null;
-  const { data } = response as { data?: unknown };
-  if (!data || typeof data !== "object") return null;
-  const { id, attributes } = data as { id?: unknown; attributes?: unknown };
-  const fields =
-    attributes && typeof attributes === "object"
-      ? (attributes as Record<string, unknown>)
-      : {};
-  const invitationId = readString(id);
-  const email = readString(fields.email);
-  const token = readString(fields.token);
-  if (!invitationId || !email || !token) return null;
-  return { id: invitationId, email, token };
-}

ui/actions/onboarding/invite.ts

@@ -5,9 +5,11 @@ import type { InvitationRoleOption } from "@/types/onboarding-invite";
 
 const ROLES_PAGE_SIZE = 50;
 
-// Roles an invitation can grant; empty when the read fails so a caller can
-// fall back (skip, disable) rather than block.
-export const getInvitationRoles = async (): Promise<InvitationRoleOption[]> => {
+// Roles the onboarding invite step can offer; empty when the read fails so
+// the step can fall back to skipping rather than blocking the checkpoint.
+export const getOnboardingInviteRoles = async (): Promise<
+  InvitationRoleOption[]
+> => {
   const rolesData = await getRoles({ pageSize: ROLES_PAGE_SIZE });
   const roles: unknown = rolesData?.data;
   if (!Array.isArray(roles)) return [];

ui/app/(auth)/invitation/accept/accept-invitation-client.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import { Mail, TriangleAlert } from "lucide-react";
+import { Icon } from "@iconify/react";
 import Link from "next/link";
 import { useRouter } from "next/navigation";
 import { useEffect, useRef, useState } from "react";
@@ -12,7 +12,6 @@ import {
 } from "@/app/(auth)/invitation/_lib/invitation-errors";
 import { AuthBrand } from "@/components/auth/oss/auth-brand";
 import { Button } from "@/components/shadcn";
-import { Spinner } from "@/components/shadcn/spinner/spinner";
 
 type AcceptState =
   | { kind: "no-token" }
@@ -75,9 +74,10 @@ export function AcceptInvitationClient({
         {/* No token */}
         {state.kind === "no-token" && (
           <div className="flex flex-col items-center gap-4">
-            <TriangleAlert
-              aria-hidden="true"
-              className="text-text-warning-primary size-12"
+            <Icon
+              icon="solar:danger-triangle-bold"
+              className="text-text-warning-primary"
+              width={48}
             />
             <h1 className="text-xl font-semibold">Invalid Invitation Link</h1>
             <p className="text-text-neutral-tertiary">
@@ -93,7 +93,11 @@ export function AcceptInvitationClient({
         {/* Accepting */}
         {state.kind === "accepting" && (
           <div className="flex flex-col items-center gap-4">
-            <Spinner className="size-12" />
+            <Icon
+              icon="eos-icons:loading"
+              className="text-text-neutral-tertiary"
+              width={48}
+            />
             <h1 className="text-xl font-semibold">Accepting Invitation...</h1>
             <p className="text-text-neutral-tertiary">
               Please wait while we process your invitation.
@@ -104,9 +108,10 @@ export function AcceptInvitationClient({
         {/* Error */}
         {state.kind === "error" && (
           <div className="flex flex-col items-center gap-4">
-            <TriangleAlert
-              aria-hidden="true"
-              className="text-text-error-primary size-12"
+            <Icon
+              icon="solar:danger-triangle-bold"
+              className="text-text-error-primary"
+              width={48}
             />
             <h1 className="text-xl font-semibold">
               Could Not Accept Invitation
@@ -124,7 +129,11 @@ export function AcceptInvitationClient({
         {/* Choice page for unauthenticated users */}
         {state.kind === "choose" && (
           <div className="flex flex-col items-center gap-6">
-            <Mail aria-hidden="true" className="text-button-primary size-12" />
+            <Icon
+              icon="solar:letter-bold"
+              className="text-button-primary"
+              width={48}
+            />
             <div>
               <h1 className="text-xl font-semibold">
                 You&apos;ve Been Invited

ui/app/(prowler)/alerts/_components/__tests__/alert-form-modal.test.tsx

@@ -48,11 +48,6 @@ vi.mock(
 
 vi.mock("@/app/(prowler)/alerts/_actions", () => alertsActionMocks);
 
-// The findings filters lazily load check options through this Server Action.
-vi.mock("@/actions/finding-groups", () => ({
-  getFindingGroupCheckOptions: vi.fn().mockResolvedValue([]),
-}));
-
 vi.mock(
   "@/components/compliance/compliance-header/compliance-scan-info",
   () => ({

ui/app/(prowler)/alerts/page.tsx

@@ -1,4 +1,3 @@
-import { BellRing } from "lucide-react";
 import { redirect } from "next/navigation";
 
 import { getLatestMetadataInfo } from "@/actions/findings";
@@ -102,7 +101,7 @@ export default async function AlertsPage({ searchParams }: AlertsPageProps) {
     : undefined;
 
   return (
-    <ContentLayout title="Alerts" icon={<BellRing />}>
+    <ContentLayout title="Alerts" icon="lucide:bell-ring">
       {!hasError ? (
         <AlertsLighthouseContext
           totalCount={apiMeta?.pagination?.count ?? alerts.length}

ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.harness.ts

@@ -18,8 +18,6 @@ export class AttackPathPageHarness extends BrowserHarness<PageFixture> {
   private static readonly VIEWPORT_SEL = ".react-flow__viewport";
   private static readonly MINIMAP_SEL = ".react-flow__minimap";
   private static readonly BACKGROUND_SEL = ".react-flow__background";
-  // Matches the graph's auto-fit duration; a pause this long means no fit is mid-flight.
-  private static readonly FIT_ANIMATION_MS = 300;
 
   private static isFindingElement(el: Element): boolean {
     return (
@@ -257,31 +255,17 @@ export class AttackPathPageHarness extends BrowserHarness<PageFixture> {
   /** Wait until the React Flow viewport transform changes from `previous`. */
   async waitForViewportChange(
     previous: string,
-    timeoutMs?: number,
+    timeoutMs = 2000,
   ): Promise<void> {
-    await this.waitFor(
-      () => this.viewportTransform !== previous,
-      timeoutMs,
-      "the viewport transform to change",
-    );
-  }
-
-  /** Wait until the viewport stops moving and return its settled transform. */
-  async waitForViewportSettled(): Promise<string> {
-    return this.waitForStable(
-      () => this.viewportTransform,
-      AttackPathPageHarness.FIT_ANIMATION_MS,
-      undefined,
-      "the viewport to settle",
-    );
+    await this.waitFor(() => this.viewportTransform !== previous, timeoutMs);
   }
 
   /** Wait until every requested node is fully contained in the graph canvas. */
   async waitForNodesInViewport(
     nodeIds: string[],
-    timeoutMs?: number,
+    timeoutMs = 2000,
   ): Promise<void> {
-    const allInViewport = () => {
+    await this.waitFor(() => {
       const canvas = this.q(AttackPathPageHarness.FLOW_SEL);
       if (!canvas) return false;
 
@@ -298,12 +282,7 @@ export class AttackPathPageHarness extends BrowserHarness<PageFixture> {
           nodeRect.bottom <= canvasRect.bottom
         );
       });
-    };
-    await this.waitFor(
-      allInViewport,
-      timeoutMs,
-      `nodes ${nodeIds.join(", ")} to be in the viewport`,
-    );
+    }, timeoutMs);
   }
 
   /** Wait until exactly `count` edges are highlighted. */

ui/app/(prowler)/attack-paths/(workflow)/query-builder/attack-paths-page.integration.test.tsx

@@ -407,24 +407,19 @@ describe("exploring the graph", () => {
     const graph = await mountWith();
     await graph.executeQuery();
     await graph.waitForGraphStable(3);
-    // Settle before each capture so the next change can only come from the
-    // action under test, not the tail of the previous fit animation.
-    const initialViewport = await graph.waitForViewportSettled();
+
+    const initialViewport = graph.viewportTransform;
 
     await graph.clickFirstResourceNode();
 
     expect(graph.findingNodes.length).toBeGreaterThan(0);
     await graph.waitForViewportChange(initialViewport);
 
-    const contextualViewport = await graph.waitForViewportSettled();
-    const visibleNodeIds = graph.renderedNodeIds;
+    const contextualViewport = graph.viewportTransform;
 
     await graph.fit();
 
     await graph.waitForViewportChange(contextualViewport);
-    // The fit must end with the whole visible graph on screen, not just move
-    await graph.waitForViewportSettled();
-    await graph.waitForNodesInViewport(visibleNodeIds);
   });
   test("clicking an expanded resource re-fits the remaining visible graph", async ({
     mountWith,