chore(ci): update github-actions

Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com>

.env

@@ -158,7 +158,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.35.0
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.39.0
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+# Generated by gh-aw and marked DO NOT EDIT. It uses concurrency options newer than
+# actionlint knows, so the findings are about actionlint's schema, not our workflows.
+paths:
+  .github/workflows/**/*.lock.yml:
+    ignore:
+      - '.*'

.github/actions/grype-scan/action.yml

@@ -0,0 +1,179 @@
+name: 'Container Security Scan with Grype'
+description: 'Scans container images for vulnerabilities using Grype and reports results'
+author: 'Prowler'
+
+inputs:
+  image-name:
+    description: 'Container image name to scan'
+    required: true
+  image-tag:
+    description: 'Container image tag to scan'
+    required: true
+    default: ${{ github.sha }}
+  fail-on-severity:
+    description: 'Fail the build on findings at this severity or above: critical, high, or none'
+    required: false
+    default: 'high'
+  upload-sarif:
+    description: 'Upload results to GitHub Security tab'
+    required: false
+    default: 'true'
+  create-pr-comment:
+    description: 'Create a comment on the PR with scan results'
+    required: false
+    default: 'true'
+  artifact-retention-days:
+    description: 'Days to retain the Grype report artifact'
+    required: false
+    default: '2'
+
+outputs:
+  critical-count:
+    description: 'Number of critical vulnerabilities found'
+    value: ${{ steps.security-check.outputs.critical }}
+  high-count:
+    description: 'Number of high vulnerabilities found'
+    value: ${{ steps.security-check.outputs.high }}
+  total-count:
+    description: 'Total number of vulnerabilities found'
+    value: ${{ steps.security-check.outputs.total }}
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Run Grype vulnerability scan (JSON)
+      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+      with:
+        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
+        output-format: 'json'
+        output-file: 'grype-report.json'
+        fail-build: 'false'
+        by-cve: 'true' # Report CVE ids rather than GHSA, so findings line up with Trivy's
+        only-fixed: 'true' # A finding with no available fix is not actionable, so it must not gate
+        cache-db: 'true'
+        grype-version: 'v0.116.1'
+
+    - name: Run Grype vulnerability scan (SARIF)
+      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
+      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
+      with:
+        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
+        output-format: 'sarif'
+        output-file: 'grype-results.sarif'
+        fail-build: 'false'
+        severity-cutoff: 'high'
+        by-cve: 'true'
+        only-fixed: 'true' # A finding with no available fix is not actionable, so it must not gate
+        cache-db: 'true'
+        grype-version: 'v0.116.1'
+
+    - name: Upload Grype results to GitHub Security tab
+      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
+      uses: github/codeql-action/upload-sarif@a2983b8bed1923f44751c5c43237f479442827b3 # v3.37.4
+      with:
+        sarif_file: 'grype-results.sarif'
+        category: 'grype-container'
+
+    - name: Upload Grype report artifact
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      if: always()
+      with:
+        name: grype-scan-report-${{ inputs.image-name }}-${{ inputs.image-tag }}
+        path: grype-report.json
+        retention-days: ${{ inputs.artifact-retention-days }}
+
+    - name: Generate security summary
+      id: security-check
+      shell: bash
+      run: |
+        CRITICAL=$(jq '[.matches[]? | select(.vulnerability.severity=="Critical")] | length' grype-report.json)
+        HIGH=$(jq '[.matches[]? | select(.vulnerability.severity=="High")] | length' grype-report.json)
+        TOTAL=$(jq '[.matches[]?] | length' grype-report.json)
+
+        echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
+        echo "high=$HIGH" >> $GITHUB_OUTPUT
+        echo "total=$TOTAL" >> $GITHUB_OUTPUT
+
+        echo "### 🔎 Container Security Scan (Grype)" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "**Image:** \`${INPUTS_IMAGE_NAME}:${INPUTS_IMAGE_TAG}\`" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "- 🔴 Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY
+        echo "- 🟠 High: $HIGH" >> $GITHUB_STEP_SUMMARY
+        echo "- **Total**: $TOTAL" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "Reported alongside Trivy, not instead of it. Counts differ by design." >> $GITHUB_STEP_SUMMARY
+      env:
+        INPUTS_IMAGE_NAME: ${{ inputs.image-name }}
+        INPUTS_IMAGE_TAG: ${{ inputs.image-tag }}
+
+    # Before the gate, so the comment is there to explain a failure rather than absent because of it
+    - name: Comment scan results on PR
+      if: >-
+        inputs.create-pr-comment == 'true'
+        && github.event_name == 'pull_request'
+        && github.event.pull_request.head.repo.full_name == github.repository
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      env:
+        IMAGE_NAME: ${{ inputs.image-name }}
+        GITHUB_SHA: ${{ inputs.image-tag }}
+        CUTOFF: ${{ inputs.fail-on-severity }}
+      with:
+        script: |
+          const comment = require('./.github/scripts/grype-pr-comment.js');
+
+          // Unique identifier to find our comment
+          const marker = `<!-- grype-scan-comment:${process.env.IMAGE_NAME} -->`;
+          const body = marker + '\n' + comment;
+
+          const { data: comments } = await github.rest.issues.listComments({
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            issue_number: context.issue.number,
+          });
+
+          const existingComment = comments.find(c => c.body?.includes(marker));
+
+          if (existingComment) {
+            await github.rest.issues.updateComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: existingComment.id,
+              body: body
+            });
+            console.log('✅ Updated existing Grype scan comment');
+          } else {
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              body: body
+            });
+            console.log('✅ Created new Grype scan comment');
+          }
+
+    - name: Check for blocking vulnerabilities
+      if: inputs.fail-on-severity != 'none'
+      shell: bash
+      run: |
+        if [ "$CUTOFF" = "critical" ]; then
+          BLOCKING=$CRITICAL
+          SEVERITIES='["Critical"]'
+        else
+          BLOCKING=$((CRITICAL + HIGH))
+          SEVERITIES='["Critical","High"]'
+        fi
+
+        if [ "$BLOCKING" -gt 0 ]; then
+          echo "::error::Found $BLOCKING vulnerabilities at severity ${CUTOFF} or above ($CRITICAL critical, $HIGH high)"
+          echo "::warning::Update the package, or add it to .grype.yaml with a reason if nothing can be done"
+          jq -r --argjson severities "$SEVERITIES" \
+            '.matches[] | select(.vulnerability.severity | IN($severities[]))
+             | "  \(.vulnerability.severity)\t\(.vulnerability.id)\t\(.artifact.name) \(.artifact.version)"' \
+            grype-report.json | sort -u
+          exit 1
+        fi
+      env:
+        CUTOFF: ${{ inputs.fail-on-severity }}
+        CRITICAL: ${{ steps.security-check.outputs.critical }}
+        HIGH: ${{ steps.security-check.outputs.high }}

.github/actions/setup-python-uv/action.yml

@@ -86,7 +86,7 @@ runs:
       run: pip install --no-cache-dir --upgrade pip && pip install --no-cache-dir "uv==${UV_VERSION}"
 
     - name: Set up Python ${{ inputs.python-version }}
-      uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
       with:
         python-version: ${{ inputs.python-version }}
         cache: 'pip'

.github/actions/trivy-scan/action.yml

@@ -14,10 +14,10 @@ inputs:
     description: 'Severities to scan for (comma-separated)'
     required: false
     default: 'CRITICAL,HIGH,MEDIUM,LOW'
-  fail-on-critical:
-    description: 'Fail the build if critical vulnerabilities are found'
+  fail-on-severity:
+    description: 'Fail the build on findings at this severity or above: critical, high, or none'
     required: false
-    default: 'false'
+    default: 'high'
   upload-sarif:
     description: 'Upload results to GitHub Security tab'
     required: false
@@ -54,7 +54,7 @@ runs:
           trivy-db-${{ runner.os }}-
 
     - name: Run Trivy vulnerability scan (JSON)
-      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
+      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
       with:
         image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
         format: 'json'
@@ -62,12 +62,16 @@ runs:
         severity: ${{ inputs.severity }}
         exit-code: '0'
         scanners: 'vuln'
+        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
         timeout: '5m'
-        version: 'v0.71.2'
+        version: 'v0.72.0'
+      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
+      env:
+        TRIVY_IGNOREFILE: '.trivyignore.yaml'
 
     - name: Run Trivy vulnerability scan (SARIF)
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
+      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
       with:
         image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
         format: 'sarif'
@@ -75,12 +79,16 @@ runs:
         severity: 'CRITICAL,HIGH'
         exit-code: '0'
         scanners: 'vuln'
+        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
         timeout: '5m'
-        version: 'v0.71.2'
+        version: 'v0.72.0'
+      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
+      env:
+        TRIVY_IGNOREFILE: '.trivyignore.yaml'
 
     - name: Upload Trivy results to GitHub Security tab
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
+      uses: github/codeql-action/upload-sarif@a2983b8bed1923f44751c5c43237f479442827b3 # v3.37.4
       with:
         sarif_file: 'trivy-results.sarif'
         category: 'trivy-container'
@@ -163,13 +171,28 @@ runs:
             console.log('✅ Created new Trivy scan comment');
           }
 
-    - name: Check for critical vulnerabilities
-      if: inputs.fail-on-critical == 'true' && steps.security-check.outputs.critical != '0'
+    - name: Check for blocking vulnerabilities
+      if: inputs.fail-on-severity != 'none'
       shell: bash
       run: |
-        echo "::error::Found ${STEPS_SECURITY_CHECK_OUTPUTS_CRITICAL} critical vulnerabilities"
-        echo "::warning::Please update packages or use a different base image"
-        exit 1
+        if [ "$CUTOFF" = "critical" ]; then
+          BLOCKING=$CRITICAL
+          SEVERITIES='["CRITICAL"]'
+        else
+          BLOCKING=$((CRITICAL + HIGH))
+          SEVERITIES='["CRITICAL","HIGH"]'
+        fi
 
+        if [ "$BLOCKING" -gt 0 ]; then
+          echo "::error::Found $BLOCKING vulnerabilities at severity ${CUTOFF} or above ($CRITICAL critical, $HIGH high)"
+          echo "::warning::Update the package, or add it to .trivyignore.yaml with a reason if nothing can be done"
+          jq -r --argjson severities "$SEVERITIES" \
+            '.Results[]?.Vulnerabilities[]? | select(.Severity | IN($severities[]))
+             | "  \(.Severity)\t\(.VulnerabilityID)\t\(.PkgName) \(.InstalledVersion)"' \
+            trivy-report.json | sort -u
+          exit 1
+        fi
       env:
-        STEPS_SECURITY_CHECK_OUTPUTS_CRITICAL: ${{ steps.security-check.outputs.critical }}
+        CUTOFF: ${{ inputs.fail-on-severity }}
+        CRITICAL: ${{ steps.security-check.outputs.critical }}
+        HIGH: ${{ steps.security-check.outputs.high }}

.github/scripts/grype-pr-comment.js

@@ -0,0 +1,100 @@
+const fs = require('fs');
+
+// Configuration from environment variables
+const REPORT_FILE = process.env.GRYPE_REPORT_FILE || 'grype-report.json';
+const IMAGE_NAME = process.env.IMAGE_NAME || 'container-image';
+const GITHUB_SHA = process.env.GITHUB_SHA || 'unknown';
+const GITHUB_REPOSITORY = process.env.GITHUB_REPOSITORY || '';
+const GITHUB_RUN_ID = process.env.GITHUB_RUN_ID || '';
+const CUTOFF = process.env.CUTOFF || 'high';
+
+// A cutoff of 'critical' blocks only on critical; anything else blocks on high and above
+const blocking = CUTOFF === 'critical' ? ['Critical'] : ['Critical', 'High'];
+
+const report = JSON.parse(fs.readFileSync(REPORT_FILE, 'utf-8'));
+const matches = Array.isArray(report.matches) ? report.matches : [];
+const ignored = Array.isArray(report.ignoredMatches) ? report.ignoredMatches : [];
+
+const counts = { Critical: 0, High: 0, Medium: 0, Low: 0, Negligible: 0, Unknown: 0 };
+const blockers = new Map();
+
+for (const match of matches) {
+    const severity = match.vulnerability.severity;
+    if (counts[severity] !== undefined) {
+        counts[severity]++;
+    }
+    if (blocking.includes(severity)) {
+        const artifact = match.artifact;
+        const fixedIn = (match.vulnerability.fix && match.vulnerability.fix.versions || []).join(', ');
+        // Same CVE can match several install paths of one package; collapse them
+        blockers.set(`${match.vulnerability.id}|${artifact.name}`, {
+            id: match.vulnerability.id,
+            severity,
+            name: artifact.name,
+            version: artifact.version,
+            fixedIn
+        });
+    }
+}
+
+const ignoredBlocking = ignored.filter(m => blocking.includes(m.vulnerability.severity)).length;
+const shortSha = GITHUB_SHA.substring(0, 7);
+const timestamp = new Date().toISOString().replace('T', ' ').substring(0, 19) + ' UTC';
+
+const severityConfig = {
+    Critical: { icon: '🔴', label: 'Critical' },
+    High: { icon: '🟠', label: 'High' },
+    Medium: { icon: '🟡', label: 'Medium' },
+    Low: { icon: '🔵', label: 'Low' }
+};
+
+let comment = '## 🔎 Container Security Scan (Grype)\n\n';
+comment += `**Image:** \`${IMAGE_NAME}:${shortSha}\`\n`;
+comment += `**Last scan:** ${timestamp}\n\n`;
+
+if (blockers.size === 0) {
+    comment += '### ✅ Nothing Blocking\n\n';
+    comment += `No findings at **${blocking.join(' or ').toLowerCase()}** severity.\n`;
+} else {
+    comment += `### ⚠️ ${blockers.size} Finding(s) Blocking This PR\n\n`;
+    comment += '| Severity | CVE | Package | Installed | Fixed in |\n';
+    comment += '|---|---|---|---|---|\n';
+
+    const order = { Critical: 0, High: 1 };
+    const rows = [...blockers.values()].sort((a, b) =>
+        (order[a.severity] - order[b.severity]) || a.name.localeCompare(b.name));
+
+    for (const row of rows) {
+        const config = severityConfig[row.severity];
+        comment += `| ${config.icon} ${config.label} | \`${row.id}\` | \`${row.name}\` | ${row.version} | ${row.fixedIn || '—'} |\n`;
+    }
+
+    comment += '\n**What to do:**\n';
+    comment += '- Upgrade the package to the version in the "Fixed in" column.\n';
+    comment += '- If it is pinned by another dependency, or the fix is otherwise out of reach, add it to `.grype.yaml` **with the reason**.\n';
+    comment += '- Findings with no published fix never appear here: the scan runs with `only-fixed`, so it reports only what can actually be acted on.\n';
+}
+
+const otherCounts = Object.entries(counts)
+    .filter(([severity, count]) => !blocking.includes(severity) && count > 0)
+    .map(([severity, count]) => `${severity.toLowerCase()}: ${count}`);
+
+if (otherCounts.length > 0) {
+    comment += `\nNot blocking at this cutoff — ${otherCounts.join(', ')}.\n`;
+}
+
+if (ignoredBlocking > 0) {
+    comment += `\n${ignoredBlocking} finding(s) excluded by \`.grype.yaml\`, each with a documented reason.\n`;
+}
+
+comment += '\n---\n';
+comment += '📋 **Resources:**\n';
+
+if (GITHUB_REPOSITORY && GITHUB_RUN_ID) {
+    comment += `- [Download full report](https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) (see artifacts)\n`;
+}
+
+comment += '- [View in Security tab](https://github.com/' + (GITHUB_REPOSITORY || 'repository') + '/security/code-scanning)\n';
+comment += '- Scanned with [Grype](https://github.com/anchore/grype), alongside Trivy\n';
+
+module.exports = comment;

.github/scripts/osv-scan.sh

@@ -51,7 +51,8 @@ STDERR="$(mktemp)"
 trap 'rm -f "${STDERR}"' EXIT
 
 set +e
-OUTPUT="$(osv-scanner scan source "${SCAN_ARGS[@]}" --format=json "$@" 2>"${STDERR}")"
+# ${a[@]+...} guard: an empty array trips `set -u` on bash before 4.4.
+OUTPUT="$(osv-scanner scan source ${SCAN_ARGS[@]+"${SCAN_ARGS[@]}"} --format=json "$@" 2>"${STDERR}")"
 RC=$?
 set -e
 
@@ -100,6 +101,8 @@ FINDINGS="$(printf '%s' "${OUTPUT}" | jq --argjson sevs "${SEVERITY_JSON}" '
   ]
 ')"
 
+# jq exits 0 with no output on empty stdin, but non-zero on malformed JSON.
+# Let the failure abort under set -e rather than reporting zero findings.
 COUNT="$(printf '%s' "${FINDINGS}" | jq 'length')"
 
 # Write the findings JSON to OSV_REPORT_FILE so callers (e.g. the composite
@@ -108,7 +111,7 @@ if [ -n "${OSV_REPORT_FILE:-}" ]; then
   printf '%s' "${FINDINGS}" > "${OSV_REPORT_FILE}"
 fi
 
-if [ "${COUNT}" -gt 0 ]; then
+if [ "${COUNT:-0}" -gt 0 ]; then
   echo "osv-scanner: ${COUNT} finding(s) at severity ${SEVERITY_LEVELS}"
   printf '%s' "${FINDINGS}" | jq -r '
     .[] | "  [\(.severity)\(if .score then " \(.score)" else "" end)] \(.id) \(.ecosystem)/\(.package)@\(.version) — \(.summary // "(no summary)")"

.github/test-impact.yml

@@ -249,6 +249,7 @@ modules:
       - ui/tests/profile/**
       - ui/tests/lighthouse/**
       - ui/tests/home/**
+      - ui/tests/navigation/**
       - ui/tests/attack-paths/**
 
   - name: api-serializers
@@ -275,6 +276,7 @@ modules:
       - ui/tests/profile/**
       - ui/tests/lighthouse/**
       - ui/tests/home/**
+      - ui/tests/navigation/**
       - ui/tests/attack-paths/**
 
   - name: api-filters
@@ -432,6 +434,14 @@ modules:
     e2e:
       - ui/tests/lighthouse/**
 
+  - name: ui-navigation
+    match:
+      - ui/components/layout/**
+      - ui/tests/navigation/**
+    tests: []
+    e2e:
+      - ui/tests/navigation/**
+
   - name: ui-overview
     match:
       - ui/components/overview/**
@@ -464,6 +474,7 @@ modules:
       - ui/tests/profile/**
       - ui/tests/lighthouse/**
       - ui/tests/home/**
+      - ui/tests/navigation/**
       - ui/tests/attack-paths/**
 
   - name: ui-attack-paths

.github/workflows/api-code-quality.yml

@@ -46,7 +46,7 @@ jobs:
             raw.githubusercontent.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch

.github/workflows/api-codeql.yml

@@ -58,17 +58,17 @@ jobs:
             objects.githubusercontent.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/api-codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: '/language:${{ matrix.language }}'

.github/workflows/api-container-build-push.yml

@@ -42,6 +42,7 @@ jobs:
     timeout-minutes: 5
     outputs:
       short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
+      created: ${{ steps.set-short-sha.outputs.created }}
     permissions:
       contents: read
     steps:
@@ -52,7 +53,9 @@ jobs:
 
       - name: Calculate short SHA
         id: set-short-sha
-        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
+        run: |
+          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
+          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -70,7 +73,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -129,7 +132,7 @@ jobs:
             www.powershellgallery.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -144,24 +147,35 @@ jobs:
           (cd api && uv lock --upgrade-package prowler)
 
       - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build and push API container for ${{ matrix.arch }}
         id: container-push
         if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ env.WORKING_DIRECTORY }}
           push: true
+          sbom: true
+          # max, not the default min: min records little beyond the build ref.
+          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
+          labels: |
+            org.opencontainers.image.title=Prowler Local Server API
+            org.opencontainers.image.description=API for Prowler Local Server (Django/DRF)
+            org.opencontainers.image.vendor=ProwlerPro, Inc.
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
+            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -179,14 +193,14 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            github.com:443
-            release-assets.githubusercontent.com:443
-            registry-1.docker.io:443
             auth.docker.io:443
+            github.com:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
+            registry-1.docker.io:443
+            release-assets.githubusercontent.com:443
       - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -196,9 +210,9 @@ jobs:
         run: |
           docker buildx imagetools create \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
+            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -206,10 +220,10 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
+            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -241,7 +255,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -249,9 +263,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> $GITHUB_OUTPUT
+            echo "outcome=success" >> "$GITHUB_OUTPUT"
           else
-            echo "outcome=failure" >> $GITHUB_OUTPUT
+            echo "outcome=failure" >> "$GITHUB_OUTPUT"
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}

.github/workflows/api-container-checks.yml

@@ -40,7 +40,7 @@ jobs:
             github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -53,7 +53,7 @@ jobs:
 
       - name: Lint Dockerfile with Hadolint
         if: steps.dockerfile-changed.outputs.any_changed == 'true'
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
         with:
           dockerfile: api/Dockerfile
           ignore: DL3013
@@ -81,6 +81,10 @@ jobs:
             auth.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
+            raw.githubusercontent.com:443
+            objects.githubusercontent.com:443
+            grype.anchore.io:443
+            get.anchore.io:443
             debian.map.fastlydns.net:80
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
@@ -96,7 +100,7 @@ jobs:
             releases.astral.sh:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -105,7 +109,12 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: api/**
+          files: |
+            api/**
+            .github/actions/trivy-scan/**
+            .github/actions/grype-scan/**
+            .grype.yaml
+            .github/scripts/grype-pr-comment.js
           files_ignore: |
             api/docs/**
             api/README.md
@@ -113,13 +122,22 @@ jobs:
             api/changelog.d/**
             api/AGENTS.md
 
+      # api-container-build-push.yml resolves the SDK pin to the branch tip
+      # before building, so match it here and scan what ships. Push only: PRs
+      # stay deterministic against the committed lock.
+      - name: Refresh prowler SDK pin to current branch tip
+        if: steps.check-changes.outputs.any_changed == 'true' && github.event_name == 'push'
+        run: |
+          pip install --no-cache-dir "uv==0.11.14"
+          (cd api && uv lock --upgrade-package prowler)
+
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build container
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ env.API_WORKING_DIR }}
           push: false
@@ -134,5 +152,13 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
-          severity: 'CRITICAL'
+          fail-on-severity: 'high'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Scan container with Grype
+        if: steps.check-changes.outputs.any_changed == 'true'
+        uses: ./.github/actions/grype-scan
+        with:
+          image-name: ${{ env.IMAGE_NAME }}
+          image-tag: ${{ github.sha }}
+          fail-on-severity: 'high'

.github/workflows/api-security.yml

@@ -59,7 +59,7 @@ jobs:
             osv-vulnerabilities.storage.googleapis.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch

.github/workflows/api-tests.yml

@@ -95,7 +95,7 @@ jobs:
 
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -107,6 +107,7 @@ jobs:
           files: |
             api/**
             .github/workflows/api-tests.yml
+            codecov.yml
           files_ignore: |
             api/docs/**
             api/README.md
@@ -127,7 +128,7 @@ jobs:
 
       - name: Upload coverage reports to Codecov
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:

.github/workflows/bump-version.yml

@@ -80,7 +80,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout master
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: master
           persist-credentials: false
@@ -207,7 +207,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout version branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: v${{ needs.detect-release-type.outputs.major_version }}.${{ needs.detect-release-type.outputs.minor_version }}
           persist-credentials: false
@@ -312,7 +312,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 

.github/workflows/check-test-init-files.yml

@@ -22,12 +22,12 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 

.github/workflows/ci-actionlint.yml

@@ -0,0 +1,63 @@
+name: 'CI: Actionlint'
+
+on:
+  push:
+    branches:
+      - 'master'
+  pull_request:
+    branches:
+      - 'master'
+  schedule:
+    - cron: '45 06 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  actionlint:
+    if: github.repository == 'prowler-cloud/prowler'
+    name: GitHub Actions Schema Check
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            api.github.com:443
+            auth.docker.io:443
+            registry-1.docker.io:443
+            production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
+
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          # zizmor: ignore[artipacked]
+          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
+
+      # Always runs so it always reports; the lint is skipped when nothing changed.
+      - name: Check for workflow changes
+        id: check-changes
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: .github/**
+
+      # SC2129 is style only: it suggests grouping consecutive redirects.
+      - name: Run actionlint
+        if: steps.check-changes.outputs.any_changed == 'true'
+        env:
+          SHELLCHECK_OPTS: '-e SC2129'
+        run: |
+          docker run --rm -v "$PWD:/repo" --workdir /repo -e SHELLCHECK_OPTS \
+            rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 \
+            -color

.github/workflows/ci-zizmor.yml

@@ -46,11 +46,11 @@ jobs:
             api.github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@a16621b09c6db4281f81a93cb393b05dcd7b7165 # v0.5.5
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
         with:
           token: ${{ github.token }}

.github/workflows/comment-label-update.yml

@@ -32,7 +32,7 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           echo "Removing 'status/awaiting-response' label from #$ISSUE_NUMBER"
-          gh api /repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels/status%2Fawaiting-response \
+          gh api "/repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels/status%2Fawaiting-response" \
             -X DELETE
 
       - name: Add 'status/waiting-for-revision' label
@@ -41,6 +41,6 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           echo "Adding 'status/waiting-for-revision' label to #$ISSUE_NUMBER"
-          gh api /repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels \
+          gh api "/repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels" \
             -X POST \
             -f labels[]='status/waiting-for-revision'

.github/workflows/compile-changelogs.yml

@@ -65,7 +65,7 @@ jobs:
             files.pythonhosted.org:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ inputs.target_branch }}
           fetch-depth: 0 # PR attribution resolves each fragment's adding commit from history
@@ -73,9 +73,9 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: '3.12'
+          python-version: '3.12.13'
 
       - name: Install towncrier
         run: pip install --no-cache-dir towncrier==25.8.0

.github/workflows/dockerhub-descriptions.yml

@@ -0,0 +1,92 @@
+name: 'Tools: Sync Docker Hub Descriptions'
+
+on:
+  push:
+    branches:
+      - 'master'
+    paths:
+      - 'docs/dockerhub/README.md'
+      - '.github/workflows/dockerhub-descriptions.yml'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+env:
+  OVERVIEW_FILE: docs/dockerhub/README.md
+
+permissions: {}
+
+jobs:
+  prowlercloud:
+    if: github.repository == 'prowler-cloud/prowler' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - repository: prowlercloud/prowler
+            short_description: 'Prowler CLI: the Open Cloud Security tool for AWS, Azure, Google Cloud, Kubernetes, M365 and GitHub'
+          - repository: prowlercloud/prowler-api
+            short_description: 'Prowler Local Server - API: the JSON API and Task Runner components of Prowler'
+          - repository: prowlercloud/prowler-ui
+            short_description: 'Prowler Local Server - UI: the web interface to run Prowler scans and explore findings'
+          - repository: prowlercloud/prowler-mcp
+            short_description: 'Prowler MCP: the interface for agents, including IDE plugins and agent integrations'
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            hub.docker.com:443
+
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Update Docker Hub description for ${{ matrix.repository }}
+        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+          repository: ${{ matrix.repository }}
+          short-description: ${{ matrix.short_description }}
+          readme-filepath: ${{ env.OVERVIEW_FILE }}
+
+  toniblyx:
+    if: github.repository == 'prowler-cloud/prowler' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            github.com:443
+            hub.docker.com:443
+
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Update Docker Hub description for toniblyx/prowler
+        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
+        with:
+          username: ${{ secrets.TONIBLYX_DOCKERHUB_USERNAME }}
+          password: ${{ secrets.TONIBLYX_DOCKERHUB_PASSWORD }}
+          repository: toniblyx/prowler
+          short-description: 'Prowler CLI (legacy repository, mirrors prowlercloud/prowler)'
+          readme-filepath: ${{ env.OVERVIEW_FILE }}

.github/workflows/docs-check-provider-cards.yml

@@ -28,14 +28,14 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: block
           allowed-endpoints: >
             github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 

.github/workflows/find-secrets.yml

@@ -36,7 +36,7 @@ jobs:
             www.formbucket.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # PRs only need the diff range; push to master/release walks the new range from event.before.
           # 50 is enough headroom for the longest realistic PR/push chain without paying for a full clone.
@@ -45,6 +45,6 @@ jobs:
 
       - name: Scan diff for secrets with TruffleHog
         # Action auto-injects --since-commit/--branch from event payload; passing them in extra_args produces duplicate flags.
-        uses: trufflesecurity/trufflehog@37b77001d0174ebec2fcca2bd83ff83a6d45a3ab # v3.95.3
+        uses: trufflesecurity/trufflehog@6f3c981e7b77f235fd2702dd74af25fc4b72bf11 # v3.96.0
         with:
           extra_args: --results=verified,unknown

.github/workflows/helm-chart-checks.yml

@@ -38,12 +38,12 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
       - name: Update chart dependencies
         run: helm dependency update ${{ env.CHART_PATH }}

.github/workflows/helm-chart-release.yml

@@ -31,23 +31,26 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
 
-      - name: Set appVersion from release tag
+      - name: Set chart version and appVersion from release tag
         run: |
-          RELEASE_TAG="${GITHUB_EVENT_RELEASE_TAG_NAME}"
-          echo "Setting appVersion to ${RELEASE_TAG}"
-          sed -i "s/^appVersion:.*/appVersion: \"${RELEASE_TAG}\"/" ${{ env.CHART_PATH }}/Chart.yaml
+          # Strip any leading "v" so the chart version is valid SemVer 2.
+          RELEASE_TAG="${GITHUB_EVENT_RELEASE_TAG_NAME#v}"
+          echo "Setting chart version and appVersion to ${RELEASE_TAG}"
+          # Publish an immutable chart version per release instead of the static
+          # 0.0.1 in source, so every release is a distinct, addressable artifact.
+          yq -i ".version = \"${RELEASE_TAG}\" | .appVersion = \"${RELEASE_TAG}\"" ${{ env.CHART_PATH }}/Chart.yaml
         env:
           GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
 
       - name: Login to GHCR
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${GITHUB_ACTOR} --password-stdin
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
 
       - name: Update chart dependencies
         run: helm dependency update ${{ env.CHART_PATH }}

.github/workflows/labeler.yml

@@ -32,7 +32,7 @@ jobs:
           egress-policy: audit
 
       - name: Apply labels to PR
-        uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+        uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         with:
           sync-labels: true
 
@@ -85,10 +85,10 @@ jobs:
 
           # Check if author is in the org members list
           if printf '%s\n' "${ORG_MEMBERS[@]}" | grep -q "^${AUTHOR}$"; then
-            echo "is_member=true" >> $GITHUB_OUTPUT
+            echo "is_member=true" >> "$GITHUB_OUTPUT"
             echo "$AUTHOR is an organization member"
           else
-            echo "is_member=false" >> $GITHUB_OUTPUT
+            echo "is_member=false" >> "$GITHUB_OUTPUT"
             echo "$AUTHOR is not an organization member"
           fi
 

.github/workflows/markdown-lint.yml

@@ -36,7 +36,7 @@ jobs:
             release-assets.githubusercontent.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 

.github/workflows/mcp-container-build-push.yml

@@ -41,6 +41,7 @@ jobs:
     timeout-minutes: 5
     outputs:
       short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
+      created: ${{ steps.set-short-sha.outputs.created }}
     permissions:
       contents: read
     steps:
@@ -51,7 +52,9 @@ jobs:
 
       - name: Calculate short SHA
         id: set-short-sha
-        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
+        run: |
+          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
+          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -69,7 +72,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -110,48 +113,51 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            github.com:443
-            registry-1.docker.io:443
             auth.docker.io:443
+            files.pythonhosted.org:443
+            ghcr.io:443
+            github.com:443
+            pkg-containers.githubusercontent.com:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            ghcr.io:443
-            pkg-containers.githubusercontent.com:443
-            files.pythonhosted.org:443
             pypi.org:443
+            registry-1.docker.io:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build and push MCP container for ${{ matrix.arch }}
         id: container-push
         if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ env.WORKING_DIRECTORY }}
           push: true
+          sbom: true
+          # max, not the default min: min records little beyond the build ref.
+          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
           labels: |
-            org.opencontainers.image.title=Prowler MCP Server
+            org.opencontainers.image.title=Prowler MCP
             org.opencontainers.image.description=Model Context Protocol server for Prowler
             org.opencontainers.image.vendor=ProwlerPro, Inc.
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
             org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ github.event_name == 'release' && github.event.release.published_at || github.event.head_commit.timestamp }}
-            ${{ github.event_name == 'release' && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
+            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
+            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -169,15 +175,15 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            registry-1.docker.io:443
             auth.docker.io:443
+            github.com:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            github.com:443
+            registry-1.docker.io:443
             release-assets.githubusercontent.com:443
 
       - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -187,9 +193,9 @@ jobs:
         run: |
           docker buildx imagetools create \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
+            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -197,10 +203,10 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
+            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -232,7 +238,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -240,9 +246,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> $GITHUB_OUTPUT
+            echo "outcome=success" >> "$GITHUB_OUTPUT"
           else
-            echo "outcome=failure" >> $GITHUB_OUTPUT
+            echo "outcome=failure" >> "$GITHUB_OUTPUT"
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}

.github/workflows/mcp-container-checks.yml

@@ -40,7 +40,7 @@ jobs:
             github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -53,7 +53,7 @@ jobs:
 
       - name: Lint Dockerfile with Hadolint
         if: steps.dockerfile-changed.outputs.any_changed == 'true'
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
         with:
           dockerfile: mcp_server/Dockerfile
 
@@ -87,9 +87,12 @@ jobs:
             get.trivy.dev:443
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
+            raw.githubusercontent.com:443
+            grype.anchore.io:443
+            get.anchore.io:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -98,7 +101,12 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: mcp_server/**
+          files: |
+            mcp_server/**
+            .github/actions/trivy-scan/**
+            .github/actions/grype-scan/**
+            .grype.yaml
+            .github/scripts/grype-pr-comment.js
           files_ignore: |
             mcp_server/README.md
             mcp_server/CHANGELOG.md
@@ -106,11 +114,11 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build MCP container
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ env.MCP_WORKING_DIR }}
           push: false
@@ -125,5 +133,13 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
-          severity: 'CRITICAL'
+          fail-on-severity: 'high'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Scan MCP container with Grype
+        if: steps.check-changes.outputs.any_changed == 'true'
+        uses: ./.github/actions/grype-scan
+        with:
+          image-name: ${{ env.IMAGE_NAME }}
+          image-tag: ${{ github.sha }}
+          fail-on-severity: 'high'

.github/workflows/mcp-pypi-release.yml

@@ -72,17 +72,17 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           enable-cache: false
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -113,7 +113,7 @@ jobs:
 
       - name: Publish prowler-mcp package to PyPI
         if: steps.pypi-check.outputs.skip != 'true'
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: ${{ env.WORKING_DIRECTORY }}/dist/
           print-hash: true

.github/workflows/mcp-security.yml

@@ -45,7 +45,7 @@ jobs:
             osv-vulnerabilities.storage.googleapis.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch

.github/workflows/mcp-tests.yml

@@ -0,0 +1,99 @@
+name: 'MCP: Tests'
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'v5.*'
+  pull_request:
+    branches:
+      - 'master'
+      - 'v5.*'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  MCP_WORKING_DIR: ./mcp_server
+
+permissions: {}
+
+jobs:
+  mcp-tests:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    strategy:
+      matrix:
+        # requires-python is >=3.12 while the shipped image is 3.13; testing both
+        # is what keeps that floor honest.
+        python-version:
+          - '3.12'
+          - '3.13'
+    defaults:
+      run:
+        working-directory: ./mcp_server
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: block
+          # hub.prowler.com and raw.githubusercontent.com are deliberately absent:
+          # the suite mocks every outbound call, so a real one must fail the job.
+          # The sentry.io entry is not the test suite: the Codecov uploader sends
+          # its own telemetry there, so api-tests.yml and sdk-tests.yml allow it too.
+          allowed-endpoints: >
+            github.com:443
+            pypi.org:443
+            files.pythonhosted.org:443
+            cli.codecov.io:443
+            keybase.io:443
+            ingest.codecov.io:443
+            o26192.ingest.us.sentry.io:443
+            storage.googleapis.com:443
+            api.github.com:443
+
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          # zizmor: ignore[artipacked]
+          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
+
+      - name: Check for MCP server changes
+        id: check-changes
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
+        with:
+          files: |
+            mcp_server/**
+            .github/workflows/mcp-tests.yml
+            codecov.yml
+          files_ignore: |
+            mcp_server/README.md
+            mcp_server/CHANGELOG.md
+            mcp_server/changelog.d/**
+            mcp_server/AGENTS.md
+            mcp_server/Dockerfile
+            mcp_server/.dockerignore
+            mcp_server/entrypoint.sh
+
+      - name: Setup Python with uv
+        if: steps.check-changes.outputs.any_changed == 'true'
+        uses: ./.github/actions/setup-python-uv
+        with:
+          python-version: ${{ matrix.python-version }}
+          working-directory: ./mcp_server
+
+      - name: Run tests with pytest
+        if: steps.check-changes.outputs.any_changed == 'true'
+        run: uv run pytest --cov=./prowler_mcp_server --cov-report=xml tests
+
+      - name: Upload coverage reports to Codecov
+        if: steps.check-changes.outputs.any_changed == 'true'
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        with:
+          flags: mcp

.github/workflows/nightly-arm64-container-builds.yml

@@ -53,15 +53,15 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build ${{ matrix.component }} container (linux/arm64)
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}

.github/workflows/pr-check-changelog.yml

@@ -39,7 +39,7 @@ jobs:
             files.pythonhosted.org:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 1
           persist-credentials: false
@@ -63,9 +63,9 @@ jobs:
 
       - name: Set up Python
         if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: '3.12'
+          python-version: '3.12.13'
 
       - name: Test changelog attribution
         if: steps.changed-files.outputs.any_changed == 'true'
@@ -93,7 +93,7 @@ jobs:
             github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 1
           # zizmor: ignore[artipacked]
@@ -129,7 +129,6 @@ jobs:
           handwritten_changelogs=""
 
           all_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n')
-          added=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" | tr ' ' '\n')
           added_or_renamed=$(printf '%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
           added_modified_or_renamed=$(printf '%s\n%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
 

.github/workflows/pr-check-compliance-mapping.yml

@@ -43,7 +43,7 @@ jobs:
             github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 1
           # zizmor: ignore[artipacked]
@@ -111,7 +111,7 @@ jobs:
             done
 
             if [ -n "$found_in" ]; then
-              found_in=$(echo "$found_in" | sed 's/, $//')
+              found_in="${found_in%, }"
               MAPPED="${MAPPED}- \`${check_id}\` (\`${provider}\`): ${found_in}"$'\n'
             else
               UNMAPPED="${UNMAPPED}- \`${check_id}\` (\`${provider}\`)"$'\n'

.github/workflows/pr-conflict-checker.yml

@@ -33,7 +33,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout PR head
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
@@ -74,15 +74,15 @@ jobs:
           done <<< "$STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES"
 
           if [ "$HAS_CONFLICTS" = true ]; then
-            echo "has_conflicts=true" >> $GITHUB_OUTPUT
+            echo "has_conflicts=true" >> "$GITHUB_OUTPUT"
             {
               echo "conflict_files<<EOF"
               echo "$CONFLICT_FILES"
               echo "EOF"
-            } >> $GITHUB_OUTPUT
+            } >> "$GITHUB_OUTPUT"
             echo "Conflict markers detected"
           else
-            echo "has_conflicts=false" >> $GITHUB_OUTPUT
+            echo "has_conflicts=false" >> "$GITHUB_OUTPUT"
             echo "No conflict markers found in changed files"
           fi
         env:

.github/workflows/pr-merged.yml

@@ -36,7 +36,7 @@ jobs:
         id: vars
         run: |
           SHORT_SHA="${GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA}"
-          echo "short_sha=${SHORT_SHA::7}" >> $GITHUB_OUTPUT
+          echo "short_sha=${SHORT_SHA::7}" >> "$GITHUB_OUTPUT"
         env:
           GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
 
@@ -46,6 +46,7 @@ jobs:
           token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
           repository: ${{ secrets.CLOUD_DISPATCH }}
           event-type: prowler-pull-request-merged
+          # repository_dispatch caps client_payload at 10 properties; this is exactly at the cap.
           client-payload: |
             {
               "PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}",
@@ -54,8 +55,8 @@ jobs:
               "PROWLER_PR_TITLE": ${{ toJson(github.event.pull_request.title) }},
               "PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }},
               "PROWLER_PR_BODY": ${{ toJson(github.event.pull_request.body) }},
-              "PROWLER_PR_URL": ${{ toJson(github.event.pull_request.html_url) }},
               "PROWLER_PR_MERGED_BY": "${{ github.event.pull_request.merged_by.login }}",
-              "PROWLER_PR_BASE_BRANCH": ${{ toJson(github.event.pull_request.base.ref) }},
-              "PROWLER_PR_HEAD_BRANCH": ${{ toJson(github.event.pull_request.head.ref) }}
+              "PROWLER_PR_STACK_NUMBER": "${{ github.event.pull_request.stack.number }}",
+              "PROWLER_PR_STACK_POSITION": "${{ github.event.pull_request.stack.position }}",
+              "PROWLER_PR_STACK_SIZE": "${{ github.event.pull_request.stack.size }}"
             }

.github/workflows/prepare-release.yml

@@ -25,6 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
+      actions: write
       contents: write
       pull-requests: write
     steps:
@@ -33,8 +34,14 @@ jobs:
       with:
         egress-policy: audit
 
+    - name: Enable release freeze
+      env:
+        GH_TOKEN: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+      run: |
+        gh variable set RELEASE_FREEZE --body true --repo "${GITHUB_REPOSITORY}"
+
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         fetch-depth: 0
         token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
@@ -70,7 +77,7 @@ jobs:
 
           echo "Prowler version: $PROWLER_VERSION"
           echo "Branch name: $BRANCH_NAME"
-          echo "Is minor release: $([ $PATCH_VERSION -eq 0 ] && echo 'true' || echo 'false')"
+          echo "Is minor release: $([ "$PATCH_VERSION" -eq 0 ] && echo 'true' || echo 'false')"
         else
           echo "Invalid version syntax: '$PROWLER_VERSION' (must be N.N.N)" >&2
           exit 1
@@ -100,7 +107,8 @@ jobs:
           if [ -f "$changelog_file" ]; then
             # Extract version that matches this Prowler release
             # Format: ## [version] (Prowler X.Y.Z) or ## [vversion] (Prowler vX.Y.Z)
-            local version=$(grep '^## \[' "$changelog_file" | grep "(Prowler v\?${prowler_version})" | head -1 | sed 's/^## \[\(.*\)\].*/\1/' | sed 's/^v//' | tr -d '[:space:]')
+            local version
+            version=$(grep '^## \[' "$changelog_file" | grep "(Prowler v\?${prowler_version})" | head -1 | sed 's/^## \[\(.*\)\].*/\1/' | sed 's/^v//' | tr -d '[:space:]')
             echo "$version"
           else
             echo ""
@@ -171,55 +179,55 @@ jobs:
 
         # Determine if components have changes for this specific release
         if [ -n "$SDK_VERSION" ]; then
-          echo "HAS_SDK_CHANGES=true" >> $GITHUB_ENV
+          echo "HAS_SDK_CHANGES=true" >> "$GITHUB_ENV"
           HAS_SDK_CHANGES="true"
           echo "✓ SDK changes detected - version: $SDK_VERSION"
           extract_changelog "prowler/CHANGELOG.md" "$SDK_VERSION" "prowler_changelog.md"
         else
-          echo "HAS_SDK_CHANGES=false" >> $GITHUB_ENV
+          echo "HAS_SDK_CHANGES=false" >> "$GITHUB_ENV"
           HAS_SDK_CHANGES="false"
           echo "ℹ No SDK changes for this release"
           touch "prowler_changelog.md"
         fi
 
         if [ -n "$API_VERSION" ]; then
-          echo "HAS_API_CHANGES=true" >> $GITHUB_ENV
+          echo "HAS_API_CHANGES=true" >> "$GITHUB_ENV"
           HAS_API_CHANGES="true"
           echo "✓ API changes detected - version: $API_VERSION"
           extract_changelog "api/CHANGELOG.md" "$API_VERSION" "api_changelog.md"
         else
-          echo "HAS_API_CHANGES=false" >> $GITHUB_ENV
+          echo "HAS_API_CHANGES=false" >> "$GITHUB_ENV"
           HAS_API_CHANGES="false"
           echo "ℹ No API changes for this release"
           touch "api_changelog.md"
         fi
 
         if [ -n "$UI_VERSION" ]; then
-          echo "HAS_UI_CHANGES=true" >> $GITHUB_ENV
+          echo "HAS_UI_CHANGES=true" >> "$GITHUB_ENV"
           HAS_UI_CHANGES="true"
           echo "✓ UI changes detected - version: $UI_VERSION"
           extract_changelog "ui/CHANGELOG.md" "$UI_VERSION" "ui_changelog.md"
         else
-          echo "HAS_UI_CHANGES=false" >> $GITHUB_ENV
+          echo "HAS_UI_CHANGES=false" >> "$GITHUB_ENV"
           HAS_UI_CHANGES="false"
           echo "ℹ No UI changes for this release"
           touch "ui_changelog.md"
         fi
 
         if [ -n "$MCP_VERSION" ]; then
-          echo "HAS_MCP_CHANGES=true" >> $GITHUB_ENV
+          echo "HAS_MCP_CHANGES=true" >> "$GITHUB_ENV"
           HAS_MCP_CHANGES="true"
           echo "✓ MCP changes detected - version: $MCP_VERSION"
           extract_changelog "mcp_server/CHANGELOG.md" "$MCP_VERSION" "mcp_changelog.md"
         else
-          echo "HAS_MCP_CHANGES=false" >> $GITHUB_ENV
+          echo "HAS_MCP_CHANGES=false" >> "$GITHUB_ENV"
           HAS_MCP_CHANGES="false"
           echo "ℹ No MCP changes for this release"
           touch "mcp_changelog.md"
         fi
 
         # Combine changelogs in order: UI, API, SDK, MCP
-        > combined_changelog.md
+        : > combined_changelog.md
 
         if [ "$HAS_UI_CHANGES" = "true" ] && [ -s "ui_changelog.md" ]; then
           echo "## UI" >> combined_changelog.md
@@ -368,7 +376,7 @@ jobs:
           no-changelog
 
     - name: Create draft release
-      uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+      uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
       with:
         tag_name: ${{ env.PROWLER_VERSION }}
         name: Prowler ${{ env.PROWLER_VERSION }}
@@ -382,3 +390,4 @@ jobs:
       if: always()
       run: |
         rm -f prowler_changelog.md api_changelog.md ui_changelog.md mcp_changelog.md combined_changelog.md
+

.github/workflows/release-freeze-gate.yml

@@ -0,0 +1,45 @@
+name: 'Tools: Release Freeze Gate'
+
+on:
+  pull_request:
+    branches:
+      - 'master'
+    types:
+      - opened
+      - synchronize
+      - reopened
+      - ready_for_review
+  merge_group:
+    branches:
+      - 'master'
+    types:
+      - checks_requested
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  release-freeze-gate:
+    name: release-freeze-gate
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Check release freeze status
+        env:
+          RELEASE_FREEZE: ${{ vars.RELEASE_FREEZE }}
+        run: |
+          case "${RELEASE_FREEZE}" in
+            true|TRUE|True)
+              echo "::error::Release freeze is active. Merges to master are temporarily blocked."
+              echo "Set the RELEASE_FREEZE repository variable to false when the release is complete."
+              exit 1
+              ;;
+            *)
+              echo "Release freeze is not active."
+              ;;
+          esac

.github/workflows/renovate-config-validate.yml

@@ -45,12 +45,12 @@ jobs:
             releases.astral.sh:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
 
       - name: Install prek
         run: uv tool install "prek==${PREK_VERSION}"

.github/workflows/sdk-check-duplicate-test-names.yml

@@ -32,7 +32,7 @@ jobs:
             github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 

.github/workflows/sdk-code-quality.yml

@@ -42,7 +42,7 @@ jobs:
             files.pythonhosted.org:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch

.github/workflows/sdk-codeql.yml

@@ -63,17 +63,17 @@ jobs:
             uploads.github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/sdk-codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: '/language:${{ matrix.language }}'

.github/workflows/sdk-container-build-push.yml

@@ -54,6 +54,7 @@ jobs:
     timeout-minutes: 5
     outputs:
       prowler_version: ${{ steps.get-prowler-version.outputs.prowler_version }}
+      created: ${{ steps.get-prowler-version.outputs.created }}
       latest_tag: ${{ steps.get-prowler-version.outputs.latest_tag }}
       stable_tag: ${{ steps.get-prowler-version.outputs.stable_tag }}
     permissions:
@@ -64,12 +65,12 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            files.pythonhosted.org:443
             github.com:443
             pypi.org:443
-            files.pythonhosted.org:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -86,6 +87,7 @@ jobs:
           fi
           echo "latest_tag=latest" >> "${GITHUB_OUTPUT}"
           echo "stable_tag=stable" >> "${GITHUB_OUTPUT}"
+          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -103,7 +105,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -146,38 +148,38 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
+            _http._tcp.deb.debian.org:443
+            aka.ms:443
             api.ecr-public.us-east-1.amazonaws.com:443
-            public.ecr.aws:443
-            sts.amazonaws.com:443
-            sts.us-east-1.amazonaws.com:443
-            registry-1.docker.io:443
+            auth.docker.io:443
+            cdn.powershellgallery.com:443
+            debian.map.fastlydns.net:80
+            files.pythonhosted.org:443
+            github.com:443
+            powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            auth.docker.io:443
-            debian.map.fastlydns.net:80
-            github.com:443
-            release-assets.githubusercontent.com:443
+            public.ecr.aws:443
             pypi.org:443
-            files.pythonhosted.org:443
+            registry-1.docker.io:443
+            release-assets.githubusercontent.com:443
+            sts.amazonaws.com:443
+            sts.us-east-1.amazonaws.com:443
             www.powershellgallery.com:443
-            aka.ms:443
-            cdn.powershellgallery.com:443
-            _http._tcp.deb.debian.org:443
-            powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.PUBLIC_ECR_PUSH_ROLE_ARN }}
@@ -188,19 +190,30 @@ jobs:
           registry-type: public
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build and push SDK container for ${{ matrix.arch }}
         id: container-push
         if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ${{ env.DOCKERFILE_PATH }}
           push: true
+          sbom: true
+          # max, not the default min: min records little beyond the build ref.
+          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.latest_tag }}-${{ matrix.arch }}
+          labels: |
+            org.opencontainers.image.title=Prowler CLI
+            org.opencontainers.image.description=Open Source security tool for cloud security assessments, audits, incident response, continuous monitoring, hardening and forensics readiness
+            org.opencontainers.image.vendor=ProwlerPro, Inc.
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
+            org.opencontainers.image.version=${{ needs.setup.outputs.prowler_version }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -219,26 +232,26 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            registry-1.docker.io:443
+            api.ecr-public.us-east-1.amazonaws.com:443
             auth.docker.io:443
-            public.ecr.aws:443
+            github.com:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            github.com:443
+            public.ecr.aws:443
+            registry-1.docker.io:443
             release-assets.githubusercontent.com:443
-            api.ecr-public.us-east-1.amazonaws.com:443
             sts.amazonaws.com:443
             sts.us-east-1.amazonaws.com:443
 
 
       - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: us-east-1
           role-to-assume: ${{ secrets.PUBLIC_ECR_PUSH_ROLE_ARN }}
@@ -252,10 +265,10 @@ jobs:
         if: github.event_name == 'push'
         run: |
           docker buildx imagetools create \
-            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG} \
-            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG} \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64 \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64
+            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}" \
+            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64"
         env:
           NEEDS_SETUP_OUTPUTS_LATEST_TAG: ${{ needs.setup.outputs.latest_tag }}
 
@@ -263,12 +276,12 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
-            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG} \
-            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
-            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG} \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64 \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64
+            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
+            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG}" \
+            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
+            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG}" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64"
         env:
           NEEDS_SETUP_OUTPUTS_PROWLER_VERSION: ${{ needs.setup.outputs.prowler_version }}
           NEEDS_SETUP_OUTPUTS_STABLE_TAG: ${{ needs.setup.outputs.stable_tag }}
@@ -277,7 +290,7 @@ jobs:
       # Push to toniblyx/prowler only for current version (latest/stable/release tags)
       - name: Login to DockerHub (toniblyx)
         if: needs.setup.outputs.latest_tag == 'latest'
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.TONIBLYX_DOCKERHUB_USERNAME }}
           password: ${{ secrets.TONIBLYX_DOCKERHUB_PASSWORD }}
@@ -293,7 +306,7 @@ jobs:
         if: needs.setup.outputs.latest_tag == 'latest' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
         run: |
           docker buildx imagetools create \
-            -t ${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
+            -t "${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
             -t ${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:stable \
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:stable
         env:
@@ -302,7 +315,7 @@ jobs:
       # Re-login as prowlercloud for cleanup of intermediate tags
       - name: Login to DockerHub (prowlercloud)
         if: always()
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -335,7 +348,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -343,9 +356,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> $GITHUB_OUTPUT
+            echo "outcome=success" >> "$GITHUB_OUTPUT"
           else
-            echo "outcome=failure" >> $GITHUB_OUTPUT
+            echo "outcome=failure" >> "$GITHUB_OUTPUT"
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}

.github/workflows/sdk-container-checks.yml

@@ -42,7 +42,7 @@ jobs:
             github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -55,7 +55,7 @@ jobs:
 
       - name: Lint Dockerfile with Hadolint
         if: steps.dockerfile-changed.outputs.any_changed == 'true'
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
         with:
           dockerfile: Dockerfile
           ignore: DL3013
@@ -83,6 +83,10 @@ jobs:
             api.github.com:443
             mirror.gcr.io:443
             check.trivy.dev:443
+            raw.githubusercontent.com:443
+            objects.githubusercontent.com:443
+            grype.anchore.io:443
+            get.anchore.io:443
             debian.map.fastlydns.net:80
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
@@ -98,7 +102,7 @@ jobs:
             releases.astral.sh:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -113,6 +117,10 @@ jobs:
             pyproject.toml
             uv.lock
             .github/workflows/sdk-container-checks.yml
+            .github/actions/trivy-scan/**
+            .github/actions/grype-scan/**
+            .grype.yaml
+            .github/scripts/grype-pr-comment.js
           files_ignore: |
             prowler/CHANGELOG.md
             prowler/changelog.d/**
@@ -120,11 +128,11 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build SDK container
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: false
@@ -139,5 +147,13 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
-          severity: 'CRITICAL'
+          fail-on-severity: 'high'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Scan SDK container with Grype
+        if: steps.check-changes.outputs.any_changed == 'true'
+        uses: ./.github/actions/grype-scan
+        with:
+          image-name: ${{ env.IMAGE_NAME }}
+          image-tag: ${{ github.sha }}
+          fail-on-severity: 'high'

.github/workflows/sdk-pypi-release.yml

@@ -71,7 +71,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -85,7 +85,7 @@ jobs:
         run: uv build
 
       - name: Publish Prowler package to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           print-hash: true
 
@@ -107,7 +107,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -129,6 +129,6 @@ jobs:
         run: uv build
 
       - name: Publish prowler-cloud package to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           print-hash: true

.github/workflows/sdk-refresh-aws-services-regions.yml

@@ -32,13 +32,13 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: 'master'
           persist-credentials: false
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -47,7 +47,7 @@ jobs:
         run: pip install boto3
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: ${{ secrets.DEV_IAM_ROLE_ARN }}

.github/workflows/sdk-refresh-oci-regions.yml

@@ -30,13 +30,13 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: 'master'
           persist-credentials: false
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'

.github/workflows/sdk-security.yml

@@ -52,7 +52,7 @@ jobs:
             osv-vulnerabilities.storage.googleapis.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch

.github/workflows/sdk-tests.yml

@@ -64,7 +64,7 @@ jobs:
             aka.ms:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -216,7 +216,8 @@ jobs:
           elif [ -z "${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}" ]; then
             echo "No AWS service paths detected; skipping AWS tests."
           else
-            uv run pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml ${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}
+            read -ra service_paths <<< "${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}"
+            uv run pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml "${service_paths[@]}"
           fi
         env:
           STEPS_AWS_SERVICES_OUTPUTS_RUN_ALL: ${{ steps.aws-services.outputs.run_all }}
@@ -224,7 +225,7 @@ jobs:
 
       - name: Upload AWS coverage to Codecov
         if: steps.changed-aws.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -248,7 +249,7 @@ jobs:
 
       - name: Upload Azure coverage to Codecov
         if: steps.changed-azure.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -272,7 +273,7 @@ jobs:
 
       - name: Upload GCP coverage to Codecov
         if: steps.changed-gcp.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -296,7 +297,7 @@ jobs:
 
       - name: Upload Kubernetes coverage to Codecov
         if: steps.changed-kubernetes.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -320,7 +321,7 @@ jobs:
 
       - name: Upload GitHub coverage to Codecov
         if: steps.changed-github.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -344,7 +345,7 @@ jobs:
 
       - name: Upload Okta coverage to Codecov
         if: steps.changed-okta.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -368,7 +369,7 @@ jobs:
 
       - name: Upload NHN coverage to Codecov
         if: steps.changed-nhn.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -392,7 +393,7 @@ jobs:
 
       - name: Upload M365 coverage to Codecov
         if: steps.changed-m365.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -416,7 +417,7 @@ jobs:
 
       - name: Upload IaC coverage to Codecov
         if: steps.changed-iac.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -440,7 +441,7 @@ jobs:
 
       - name: Upload MongoDB Atlas coverage to Codecov
         if: steps.changed-mongodbatlas.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -464,7 +465,7 @@ jobs:
 
       - name: Upload OCI coverage to Codecov
         if: steps.changed-oraclecloud.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -488,7 +489,7 @@ jobs:
 
       - name: Upload OpenStack coverage to Codecov
         if: steps.changed-openstack.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -512,7 +513,7 @@ jobs:
 
       - name: Upload Google Workspace coverage to Codecov
         if: steps.changed-googleworkspace.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -536,7 +537,7 @@ jobs:
 
       - name: Upload Vercel coverage to Codecov
         if: steps.changed-vercel.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -560,7 +561,7 @@ jobs:
 
       - name: Upload Scaleway coverage to Codecov
         if: steps.changed-scaleway.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -584,7 +585,7 @@ jobs:
 
       - name: Upload StackIT coverage to Codecov
         if: steps.changed-stackit.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -608,7 +609,7 @@ jobs:
 
       - name: Upload Linode coverage to Codecov
         if: steps.changed-linode.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -632,7 +633,7 @@ jobs:
 
       - name: Upload E2E Networks coverage to Codecov
         if: steps.changed-e2enetworks.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -643,7 +644,7 @@ jobs:
       - name: Check if External Provider files changed
         if: steps.check-changes.outputs.any_changed == 'true'
         id: changed-external
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
+        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
           files: |
             ./prowler/providers/common/**
@@ -659,7 +660,7 @@ jobs:
       - name: Upload External Provider coverage to Codecov
         if: steps.changed-external.outputs.any_changed == 'true'
 
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -683,7 +684,7 @@ jobs:
 
       - name: Upload Lib coverage to Codecov
         if: steps.changed-lib.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:
@@ -707,7 +708,7 @@ jobs:
 
       - name: Upload Config coverage to Codecov
         if: steps.changed-config.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
         with:

.github/workflows/test-impact-analysis.yml

@@ -61,7 +61,7 @@ jobs:
             files.pythonhosted.org:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -71,9 +71,9 @@ jobs:
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
-          python-version: '3.12.13'
+          python-version: '3.14.6'
 
       - name: Install PyYAML
         run: pip install pyyaml
@@ -84,7 +84,8 @@ jobs:
           echo "Changed files:"
           echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n'
           echo ""
-          python .github/scripts/test-impact.py ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}
+          read -ra changed <<< "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}"
+          python .github/scripts/test-impact.py "${changed[@]}"
         env:
           STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
 
@@ -92,21 +93,21 @@ jobs:
         id: set-flags
         run: |
           if [[ -n "${STEPS_IMPACT_OUTPUTS_SDK_TESTS}" ]]; then
-            echo "has-sdk-tests=true" >> $GITHUB_OUTPUT
+            echo "has-sdk-tests=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has-sdk-tests=false" >> $GITHUB_OUTPUT
+            echo "has-sdk-tests=false" >> "$GITHUB_OUTPUT"
           fi
 
           if [[ -n "${STEPS_IMPACT_OUTPUTS_API_TESTS}" ]]; then
-            echo "has-api-tests=true" >> $GITHUB_OUTPUT
+            echo "has-api-tests=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has-api-tests=false" >> $GITHUB_OUTPUT
+            echo "has-api-tests=false" >> "$GITHUB_OUTPUT"
           fi
 
           if [[ -n "${STEPS_IMPACT_OUTPUTS_UI_E2E}" ]]; then
-            echo "has-ui-e2e=true" >> $GITHUB_OUTPUT
+            echo "has-ui-e2e=true" >> "$GITHUB_OUTPUT"
           else
-            echo "has-ui-e2e=false" >> $GITHUB_OUTPUT
+            echo "has-ui-e2e=false" >> "$GITHUB_OUTPUT"
           fi
         env:
           STEPS_IMPACT_OUTPUTS_SDK_TESTS: ${{ steps.impact.outputs.sdk-tests }}
@@ -115,22 +116,22 @@ jobs:
 
       - name: Summary
         run: |
-          echo "## Test Impact Analysis" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "## Test Impact Analysis" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
 
           if [[ "${STEPS_IMPACT_OUTPUTS_RUN_ALL}" == "true" ]]; then
-            echo "🚨 **Critical path changed - running ALL tests**" >> $GITHUB_STEP_SUMMARY
+            echo "🚨 **Critical path changed - running ALL tests**" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "### Affected Modules" >> $GITHUB_STEP_SUMMARY
-            echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### Affected Modules" >> "$GITHUB_STEP_SUMMARY"
+            echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
+            echo "" >> "$GITHUB_STEP_SUMMARY"
 
-            echo "### Tests to Run" >> $GITHUB_STEP_SUMMARY
-            echo "| Category | Paths |" >> $GITHUB_STEP_SUMMARY
-            echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
-            echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "### Tests to Run" >> "$GITHUB_STEP_SUMMARY"
+            echo "| Category | Paths |" >> "$GITHUB_STEP_SUMMARY"
+            echo "|----------|-------|" >> "$GITHUB_STEP_SUMMARY"
+            echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
+            echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
           fi
 
         env:

.github/workflows/ui-codeql.yml

@@ -59,17 +59,17 @@ jobs:
             uploads.github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/ui-codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: '/language:${{ matrix.language }}'

.github/workflows/ui-container-build-push.yml

@@ -41,17 +41,20 @@ jobs:
     timeout-minutes: 5
     outputs:
       short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
+      created: ${{ steps.set-short-sha.outputs.created }}
     permissions:
       contents: read
     steps:
-      - name: Harden the runner (Audit all outbound calls)
+      - name: Harden Runner
         uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
-          egress-policy: audit
+          egress-policy: block
 
       - name: Calculate short SHA
         id: set-short-sha
-        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
+        run: |
+          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
+          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -69,7 +72,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -111,42 +114,53 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            registry-1.docker.io:443
-            production.cloudflare.docker.com:443
-            production.cloudfront.docker.com:443
             auth.docker.io:443
-            registry.npmjs.org:443
             dl-cdn.alpinelinux.org:443
             fonts.googleapis.com:443
             fonts.gstatic.com:443
             github.com:443
+            production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
+            registry-1.docker.io:443
+            registry.npmjs.org:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build and push UI container for ${{ matrix.arch }}
         id: container-push
         if: github.event_name == 'push' || github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ env.WORKING_DIRECTORY }}
           build-args: |
             NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('v{0}', env.RELEASE_TAG) || needs.setup.outputs.short-sha }}
           push: true
+          sbom: true
+          # max, not the default min: min records little beyond the build ref.
+          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
+          labels: |
+            org.opencontainers.image.title=Prowler Local Server UI
+            org.opencontainers.image.description=Web UI for Prowler Local Server (Next.js)
+            org.opencontainers.image.vendor=ProwlerPro, Inc.
+            org.opencontainers.image.source=https://github.com/${{ github.repository }}
+            org.opencontainers.image.revision=${{ github.sha }}
+            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
+            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -164,15 +178,15 @@ jobs:
         with:
           egress-policy: block
           allowed-endpoints: >
-            github.com:443
-            release-assets.githubusercontent.com:443
-            registry-1.docker.io:443
             auth.docker.io:443
+            github.com:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
+            registry-1.docker.io:443
+            release-assets.githubusercontent.com:443
 
       - name: Login to DockerHub
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -182,9 +196,9 @@ jobs:
         run: |
           docker buildx imagetools create \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
+            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -192,10 +206,10 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
+            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
-            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
+            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -227,7 +241,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -235,9 +249,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> $GITHUB_OUTPUT
+            echo "outcome=success" >> "$GITHUB_OUTPUT"
           else
-            echo "outcome=failure" >> $GITHUB_OUTPUT
+            echo "outcome=failure" >> "$GITHUB_OUTPUT"
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}

.github/workflows/ui-container-checks.yml

@@ -40,7 +40,7 @@ jobs:
             github.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -53,7 +53,7 @@ jobs:
 
       - name: Lint Dockerfile with Hadolint
         if: steps.dockerfile-changed.outputs.any_changed == 'true'
-        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        uses: hadolint/hadolint-action@2a66e89f53d0771bb131a7fa31f3136336094aa6 # v3.4.0
         with:
           dockerfile: ui/Dockerfile
           ignore: DL3018
@@ -88,9 +88,12 @@ jobs:
             get.trivy.dev:443
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
+            raw.githubusercontent.com:443
+            grype.anchore.io:443
+            get.anchore.io:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -99,7 +102,12 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: ui/**
+          files: |
+            ui/**
+            .github/actions/trivy-scan/**
+            .github/actions/grype-scan/**
+            .grype.yaml
+            .github/scripts/grype-pr-comment.js
           files_ignore: |
             ui/CHANGELOG.md
             ui/changelog.d/**
@@ -108,11 +116,11 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build UI container
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ env.UI_WORKING_DIR }}
           target: prod
@@ -130,5 +138,13 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-critical: 'true'
-          severity: 'CRITICAL'
+          fail-on-severity: 'high'
+          severity: 'CRITICAL,HIGH'
+
+      - name: Scan UI container with Grype
+        if: steps.check-changes.outputs.any_changed == 'true'
+        uses: ./.github/actions/grype-scan
+        with:
+          image-name: ${{ env.IMAGE_NAME }}
+          image-tag: ${{ github.sha }}
+          fail-on-severity: 'high'

.github/workflows/ui-e2e-tests-v2.yml

@@ -36,6 +36,7 @@ jobs:
     needs: impact-analysis
     if: |
       github.repository == 'prowler-cloud/prowler' &&
+      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) &&
       (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
     runs-on: ubuntu-latest
     env:
@@ -101,25 +102,123 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Show test scope
         run: |
-          echo "## E2E Test Scope" >> $GITHUB_STEP_SUMMARY
+          echo "## E2E Test Scope" >> "$GITHUB_STEP_SUMMARY"
           if [[ "${RUN_ALL_TESTS}" == "true" ]]; then
-            echo "Running **ALL** E2E tests (critical path changed)" >> $GITHUB_STEP_SUMMARY
+            echo "Running **ALL** E2E tests (critical path changed)" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "Running tests matching: \`${E2E_TEST_PATHS}\`" >> $GITHUB_STEP_SUMMARY
+            echo "Running tests matching: \`${E2E_TEST_PATHS}\`" >> "$GITHUB_STEP_SUMMARY"
           fi
           echo ""
-          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
+          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
         env:
           NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }}
 
+      - name: Validate E2E prerequisites
+        shell: bash
+        run: |
+          declare -A required=()
+
+          suite_selected() {
+            [[ "${RUN_ALL_TESTS}" == "true" ]] ||
+              [[ " ${E2E_TEST_PATHS} " == *"ui/tests/$1/"* ]]
+          }
+
+          require_vars() {
+            local variable
+            for variable in "$@"; do
+              required["${variable}"]=1
+            done
+          }
+
+          if suite_selected auth || suite_selected providers ||
+            suite_selected invitations || suite_selected scans ||
+            suite_selected navigation; then
+            require_vars E2E_ADMIN_USER E2E_ADMIN_PASSWORD
+          fi
+
+          if suite_selected sign-up; then
+            require_vars E2E_NEW_USER_PASSWORD
+          fi
+
+          if suite_selected invitations; then
+            require_vars E2E_NEW_USER_PASSWORD E2E_ORGANIZATION_ID
+          fi
+
+          if suite_selected scans; then
+            require_vars \
+              E2E_AWS_PROVIDER_ACCOUNT_ID \
+              E2E_AWS_PROVIDER_ACCESS_KEY \
+              E2E_AWS_PROVIDER_SECRET_KEY
+          fi
+
+          if suite_selected providers; then
+            require_vars \
+              E2E_AWS_PROVIDER_ACCOUNT_ID \
+              E2E_AWS_PROVIDER_ACCESS_KEY \
+              E2E_AWS_PROVIDER_SECRET_KEY \
+              E2E_AWS_PROVIDER_ROLE_ARN \
+              E2E_AZURE_SUBSCRIPTION_ID \
+              E2E_AZURE_CLIENT_ID \
+              E2E_AZURE_SECRET_ID \
+              E2E_AZURE_TENANT_ID \
+              E2E_M365_DOMAIN_ID \
+              E2E_M365_CLIENT_ID \
+              E2E_M365_SECRET_ID \
+              E2E_M365_TENANT_ID \
+              E2E_M365_CERTIFICATE_CONTENT \
+              E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY \
+              E2E_GCP_PROJECT_ID \
+              E2E_GITHUB_APP_ID \
+              E2E_GITHUB_BASE64_APP_PRIVATE_KEY \
+              E2E_GITHUB_USERNAME \
+              E2E_GITHUB_PERSONAL_ACCESS_TOKEN \
+              E2E_GITHUB_ORGANIZATION \
+              E2E_GITHUB_ORGANIZATION_ACCESS_TOKEN \
+              E2E_OCI_TENANCY_ID \
+              E2E_OCI_USER_ID \
+              E2E_OCI_FINGERPRINT \
+              E2E_OCI_KEY_CONTENT \
+              E2E_ALIBABACLOUD_ACCOUNT_ID \
+              E2E_ALIBABACLOUD_ACCESS_KEY_ID \
+              E2E_ALIBABACLOUD_ACCESS_KEY_SECRET \
+              E2E_ALIBABACLOUD_ROLE_ARN \
+              E2E_OKTA_DOMAIN \
+              E2E_OKTA_CLIENT_ID \
+              E2E_OKTA_BASE64_PRIVATE_KEY \
+              E2E_GOOGLEWORKSPACE_CUSTOMER_ID \
+              E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON \
+              E2E_GOOGLEWORKSPACE_DELEGATED_USER \
+              E2E_VERCEL_TEAM_ID \
+              E2E_VERCEL_API_TOKEN
+          fi
+
+          missing=()
+          if (( ${#required[@]} > 0 )); then
+            while IFS= read -r variable; do
+              [[ -z "${!variable:-}" ]] && missing+=("${variable}")
+            done < <(printf '%s\n' "${!required[@]}" | sort)
+          fi
+
+          if (( ${#missing[@]} > 0 )); then
+            echo "Missing required E2E variables:"
+            printf ' - %s\n' "${missing[@]}"
+            {
+              echo "## Missing E2E prerequisites"
+              printf -- "- \`%s\`\n" "${missing[@]}"
+            } >> "${GITHUB_STEP_SUMMARY}"
+            exit 1
+          fi
+
+          echo "E2E prerequisite preflight passed."
+
       - name: Create k8s Kind Cluster
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
         with:
           cluster_name: kind
 
@@ -134,7 +233,7 @@ jobs:
           yq -i '.services.worker.networks = ["kind","default"]' docker-compose.yml
 
       - name: Fix API data directory permissions
-        run: docker run --rm -v $(pwd)/_data/api:/data alpine chown -R 1000:1000 /data
+        run: docker run --rm -v "$(pwd)/_data/api:/data" alpine chown -R 1000:1000 /data
 
       - name: Add AWS credentials for testing
         run: |
@@ -168,7 +267,7 @@ jobs:
           timeout=150
           elapsed=0
           while [ $elapsed -lt $timeout ]; do
-            if curl -s ${UI_API_BASE_URL}/docs >/dev/null 2>&1; then
+            if curl -s "${UI_API_BASE_URL}/docs" >/dev/null 2>&1; then
               echo "Prowler API is ready!"
               exit 0
             fi
@@ -191,7 +290,7 @@ jobs:
           '
 
       - name: Setup Node.js
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: 'ui/.nvmrc'
 
@@ -202,10 +301,10 @@ jobs:
           run_install: false
 
       - name: Get pnpm store directory
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
 
       - name: Setup pnpm and Next.js cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ${{ env.STORE_PATH }}
@@ -225,7 +324,7 @@ jobs:
         run: pnpm run build
 
       - name: Cache Playwright browsers
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         id: playwright-cache
         with:
           path: ~/.cache/ms-playwright
@@ -288,11 +387,12 @@ jobs:
             fi
             TEST_PATHS=$(echo "$VALID_PATHS" | tr '\n' ' ')
             echo "Resolved test paths: $TEST_PATHS"
-            pnpm exec playwright test $TEST_PATHS
+            read -ra test_paths <<< "$TEST_PATHS"
+            pnpm exec playwright test "${test_paths[@]}"
           fi
 
       - name: Upload test reports
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: failure()
         with:
           name: playwright-report
@@ -304,6 +404,29 @@ jobs:
         run: |
           docker compose down -v || true
 
+  # Fork pull requests cannot access the secrets required by the E2E suites.
+  fork-e2e-unavailable:
+    needs: impact-analysis
+    if: |
+      github.repository == 'prowler-cloud/prowler' &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.fork == true &&
+      (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        with:
+          egress-policy: audit
+
+      - name: Report unavailable E2E tests
+        run: |
+          echo "## E2E Tests Skipped" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "UI E2E tests require repository secrets and cannot run for fork pull requests." >> "$GITHUB_STEP_SUMMARY"
+
   # Skip job - provides clear feedback when no E2E tests needed
   skip-e2e:
     needs: impact-analysis
@@ -322,12 +445,12 @@ jobs:
 
       - name: No E2E tests needed
         run: |
-          echo "## E2E Tests Skipped" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "No UI E2E tests needed for this change." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "To run all tests, modify a file in a critical path (e.g., \`ui/lib/**\`)." >> $GITHUB_STEP_SUMMARY
+          echo "## E2E Tests Skipped" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "No UI E2E tests needed for this change." >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "To run all tests, modify a file in a critical path (e.g., \`ui/lib/**\`)." >> "$GITHUB_STEP_SUMMARY"
         env:
           NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }}

.github/workflows/ui-security.yml

@@ -45,7 +45,7 @@ jobs:
             osv-vulnerabilities.storage.googleapis.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch

.github/workflows/ui-tests.yml

@@ -50,7 +50,7 @@ jobs:
             playwright.download.prss.microsoft.com:443
 
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           # zizmor: ignore[artipacked]
           persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
@@ -99,7 +99,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: 'ui/.nvmrc'
 
@@ -113,11 +113,11 @@ jobs:
       - name: Get pnpm store directory
         if: steps.check-changes.outputs.any_changed == 'true'
         shell: bash
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
 
       - name: Setup pnpm and Next.js cache
         if: steps.check-changes.outputs.any_changed == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ${{ env.STORE_PATH }}
@@ -157,7 +157,8 @@ jobs:
           echo "${STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES}"
           # Convert space-separated to vitest related format (remove ui/ prefix for relative paths)
           CHANGED_FILES=$(echo "${STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | sed 's|^ui/||' | tr '\n' ' ')
-          pnpm exec vitest related $CHANGED_FILES --run --project unit
+          read -ra changed <<< "$CHANGED_FILES"
+          pnpm exec vitest related "${changed[@]}" --run --project unit
         env:
           STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-source.outputs.all_changed_files }}
 
@@ -170,7 +171,7 @@ jobs:
       - name: Cache Playwright browsers
         if: steps.check-changes.outputs.any_changed == 'true'
         id: playwright-cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-chromium-${{ hashFiles('ui/pnpm-lock.yaml') }}
@@ -181,9 +182,9 @@ jobs:
         if: steps.check-changes.outputs.any_changed == 'true' && steps.playwright-cache.outputs.cache-hit != 'true'
         run: pnpm exec playwright install chromium
 
-      - name: Run browser tests
+      - name: Run integration tests
         if: steps.check-changes.outputs.any_changed == 'true'
-        run: pnpm run test:browser
+        run: pnpm run test:integration
 
       - name: Build application
         if: steps.check-changes.outputs.any_changed == 'true'

.gitignore

@@ -173,3 +173,5 @@ GEMINI.md
 # Docker
 docker-compose.override.yml
 docker-compose-dev.override.yml
+# Local Pi runtime state
+.atl/

.grype.yaml

@@ -0,0 +1,62 @@
+# Findings excluded from the Grype gate, each with a reason.
+# Anything not listed here blocks the pull request at critical or high severity.
+# Pairs are explicit: a new CVE against an already-listed package still blocks.
+#
+# Every entry below has a published fix we cannot take. Findings with no fix at all are
+# not listed: the scan runs with only-fixed, so they never reach the gate.
+
+ignore:
+
+  # Modules compiled into the Trivy binary we ship.
+  # Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
+  - vulnerability: CVE-2026-56852
+    package:
+      name: golang.org/x/text
+  - vulnerability: GHSA-hrxh-6v49-42gf
+    package:
+      name: google.golang.org/grpc
+  - vulnerability: CVE-2026-50151
+    package:
+      name: oras.land/oras-go/v2
+
+  # Shipped inside the PowerShell tarball, in its bundled MicrosoftTeams module.
+  # Not a dependency we declare, and not one we can upgrade independently.
+  - vulnerability: CVE-2026-26127
+    package:
+      name: Microsoft.Bcl.Memory
+
+
+  # The CPython interpreter, compiled into the official base image.
+  # TEMPORARY, unlike the entries above: moving to Python 3.13 clears seven of these, and
+  # that is a runtime upgrade pending its own evaluation. The remaining three need 3.15 and
+  # are unfixable either way -- the MCP image already runs 3.13.14 and still reports them.
+  - vulnerability: CVE-2026-11940
+    package:
+      name: python
+  - vulnerability: CVE-2026-11972
+    package:
+      name: python
+  - vulnerability: CVE-2026-15308
+    package:
+      name: python
+  - vulnerability: CVE-2026-3298
+    package:
+      name: python
+  - vulnerability: CVE-2026-3644
+    package:
+      name: python
+  - vulnerability: CVE-2026-4224
+    package:
+      name: python
+  - vulnerability: CVE-2026-4786
+    package:
+      name: python
+  - vulnerability: CVE-2026-6100
+    package:
+      name: python
+  - vulnerability: CVE-2026-7210
+    package:
+      name: python
+  - vulnerability: CVE-2026-9669
+    package:
+      name: python

.pre-commit-config.yaml

@@ -47,6 +47,14 @@ repos:
         priority: 20
 
   ## GITHUB ACTIONS
+  - repo: https://github.com/rhysd/actionlint
+    rev: v1.7.12
+    hooks:
+      - id: actionlint
+        # SC2129 only suggests grouping consecutive redirects; not worth restructuring for.
+        args: ['-shellcheck=-e SC2129']
+        priority: 30
+
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
     rev: v1.24.1
     hooks:

.trivyignore

@@ -1,109 +0,0 @@
-# Trivy ignore file for prowlercloud/prowler SDK container image.
-# Each entry below documents (a) the affected package and why it ships in the
-# image, (b) why the CVE is not exploitable in Prowler's runtime, and (c) the
-# upstream fix status. Entries carry an expiry so they auto-force re-review.
-# Entries are scoped per-package so suppressions cannot drift onto unrelated
-# packages that may be assigned the same CVE in the future.
-#
-# Scanned by: .github/actions/trivy-scan via .github/workflows/sdk-container-checks.yml
-
-# CVE-2026-42496 — perl-archive-tar path traversal via crafted symlinks.
-# CVE-2026-8376  — perl heap buffer overflow when compiling regex.
-# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
-# Why ignored: perl-base is part of Debian's "Essential: yes" set; it cannot be
-# removed without breaking dpkg. The Prowler SDK does not invoke perl at runtime;
-# neither vulnerable code path (Archive::Tar parsing or regex compilation of
-# attacker-controlled input) is reachable from Prowler. No Debian bookworm fix
-# is available yet.
-CVE-2026-42496 pkg:perl exp:2026-08-15
-CVE-2026-42496 pkg:perl-base exp:2026-08-15
-CVE-2026-42496 pkg:perl-modules-5.36 exp:2026-08-15
-CVE-2026-42496 pkg:libperl5.36 exp:2026-08-15
-CVE-2026-8376 pkg:perl exp:2026-08-15
-CVE-2026-8376 pkg:perl-base exp:2026-08-15
-CVE-2026-8376 pkg:perl-modules-5.36 exp:2026-08-15
-CVE-2026-8376 pkg:libperl5.36 exp:2026-08-15
-
-# CVE-2026-13221 - Perl regex trie overflow.
-# Packages: perl, perl-base, perl-modules-5.36, libperl5.36.
-# Why ignored: upstream confirms Perl 5.36.0 is not affected; the regression
-# was introduced after this version. Debian currently marks bookworm as
-# vulnerable, which causes Trivy to report a false positive.
-# Ref: https://github.com/Perl/perl5/issues/23388
-CVE-2026-13221 pkg:perl exp:2026-08-15
-CVE-2026-13221 pkg:perl-base exp:2026-08-15
-CVE-2026-13221 pkg:perl-modules-5.36 exp:2026-08-15
-CVE-2026-13221 pkg:libperl5.36 exp:2026-08-15
-
-# CVE-2025-7458 — SQLite integer overflow.
-# Package: libsqlite3-0.
-# Why ignored: transitive dependency of CPython's stdlib sqlite3 module. The
-# Prowler SDK does not open user-supplied SQLite databases; SQLite usage is
-# internal and bounded. No Debian bookworm fix is available.
-CVE-2025-7458 pkg:libsqlite3-0 exp:2026-08-15
-
-# CVE-2026-43185 — Linux kernel ksmbd signedness bug.
-# Package: linux-libc-dev.
-# Why ignored: linux-libc-dev ships kernel headers for build-time compilation,
-# not a running kernel. Containers execute against the host kernel, so these
-# headers are inert at runtime. The upstream fix landed in kernel 7.0-rc2 and
-# has not been backported to Debian's 6.1 LTS line.
-CVE-2026-43185 pkg:linux-libc-dev exp:2026-08-15
-
-# CVE-2023-45853 — zlib MiniZip integer overflow / heap overflow in
-# zipOpenNewFileInZip4_64.
-# Packages: zlib1g, zlib1g-dev.
-# Why ignored: Debian Security Tracker status for bookworm is <ignored>, with
-# the published rationale "contrib/minizip not built and src:zlib not producing
-# binary packages" — i.e. the vulnerable symbol is not present in the libz.so
-# shipped by Debian. Real-not-affected, not unpatched. Upstream fix is in
-# zlib 1.3.1, available in Debian trixie (13); migrating the base image would
-# clear it fully.
-# Ref: https://security-tracker.debian.org/tracker/CVE-2023-45853
-CVE-2023-45853 pkg:zlib1g exp:2026-08-15
-CVE-2023-45853 pkg:zlib1g-dev exp:2026-08-15
-
-# CVE-2026-55200 — libssh2 out-of-bounds write in ssh2_transport_read() due to
-# an unchecked packet_length field in transport.c (heap corruption, possible RCE).
-# Package: libssh2-1.
-# Why ignored: libssh2-1 is pulled in only as a transitive dependency of libcurl4
-# (installed in the SDK Dockerfile for the networking/PowerShell stack). The
-# vulnerable path is reached exclusively when libssh2 acts as an SSH/SCP/SFTP
-# client parsing transport packets from a server. Prowler never uses libcurl's
-# SSH/SCP/SFTP transports; it talks to cloud provider HTTPS endpoints only, so the
-# affected code is unreachable at runtime. Fixed upstream in libssh2 commit
-# 97acf3df (PR #2052); no Debian bookworm fix is available yet.
-# Ref: https://security-tracker.debian.org/tracker/CVE-2026-55200
-CVE-2026-55200 pkg:libssh2-1 exp:2026-08-15
-
-# --- API container image (api/Dockerfile) ---
-# The entries below are specific to the Prowler API image, which ships
-# PowerShell and additional build tooling on top of the same bookworm base.
-
-# CVE-2026-7210 — CPython/Expat hash-flooding denial of service in
-# `xml.parsers.expat` and `xml.etree.ElementTree`.
-# Packages: the Debian system Python 3.11 (python3.11*, libpython3.11*).
-# Why ignored: the API runs under the Python 3.12 interpreter shipped in its
-# `.venv`; the system `python3.11` is only present because `python3-dev` is
-# pulled in to compile native extensions (xmlsec, lxml) and is never executed
-# at runtime. The vulnerable path requires parsing attacker-controlled XML with
-# the affected interpreter, which Prowler does not do with the system Python.
-# Full mitigation also needs libexpat >= 2.8.0; no Debian bookworm fix yet.
-CVE-2026-7210 pkg:python3.11 exp:2026-08-15
-CVE-2026-7210 pkg:python3.11-dev exp:2026-08-15
-CVE-2026-7210 pkg:python3.11-minimal exp:2026-08-15
-CVE-2026-7210 pkg:libpython3.11 exp:2026-08-15
-CVE-2026-7210 pkg:libpython3.11-dev exp:2026-08-15
-CVE-2026-7210 pkg:libpython3.11-minimal exp:2026-08-15
-CVE-2026-7210 pkg:libpython3.11-stdlib exp:2026-08-15
-
-# CVE-2026-33278 — Unbound DNSSEC validator use-after-free (DoS, possible RCE).
-# CVE-2026-42960 — Unbound DNS cache poisoning via promiscuous additional records.
-# Package: libunbound8.
-# Why ignored: libunbound8 is a transitive apt dependency of the TLS/networking
-# stack (GnuTLS DANE support); only the shared library ships in the image. Both
-# vulnerabilities require operating a live Unbound recursive DNSSEC validator
-# that processes attacker-influenced DNS responses. Prowler never starts an
-# Unbound resolver, so neither code path is reachable. No Debian bookworm fix yet.
-CVE-2026-33278 pkg:libunbound8 exp:2026-08-15
-CVE-2026-42960 pkg:libunbound8 exp:2026-08-15

.trivyignore.yaml

@@ -0,0 +1,143 @@
+# Trivy suppressions for the prowlercloud/prowler SDK and API container images.
+#
+# This file replaces the classic .trivyignore, which parsed only the CVE id: the
+# `pkg:` selector written on each line was documentation and the entry suppressed
+# its CVE across every package in the image. The `purls` field below is honoured,
+# so each entry is scoped to the package it names. Verified against Trivy 0.71.2:
+# an entry given the wrong purl leaves the finding reported, where the classic
+# format suppressed it.
+#
+# `expired_at` forces re-review. Keep the dates staggered.
+#
+# The four entries below are currently redundant: the scan runs with ignore-unfixed,
+# and none of them has a published fix, so they never reach the gate either way. They
+# are kept because the reasoning is what justifies accepting them, and because they
+# apply again the moment any of them gains a fix we do not take.
+#
+# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
+# binary package built from that source, so perl-base is flagged for modules only
+# perl-modules-* ships. Neither image installs those, and nothing in either
+# invokes perl.
+#
+# Why these four are accepted rather than fixed (reviewed 2026-07-31):
+#
+#   1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
+#      Debian marks CVE-2026-42496 "fix_deferred" and the other three "affected".
+#      A newer base image, apt upgrade, or a newer Debian release changes nothing.
+#   2. The package cannot be removed. "Essential: yes" means removal needs
+#      dpkg --force-remove-essential, which breaks apt for anything built
+#      downstream from these images.
+#   3. Changing base distribution was evaluated and rejected. Alpine drops perl
+#      entirely, but PowerShell publishes no linux-musl-arm64 build in any
+#      release, so M365 scanning would break on arm64 -- which is what we run in
+#      production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
+#      are a paid tier, so builds would not be reproducibly pinnable.
+#
+# Not-invoked claim verified by sweeping both images for files with a perl
+# shebang, shell/python callers of perl, ELF binaries containing "perl", and
+# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
+# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
+# runtime, plus one build-time script inside the ExchangeOnlineManagement
+# PowerShell module that is never invoked.
+
+vulnerabilities:
+  # Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
+  - id: CVE-2026-42496
+    purls:
+      - "pkg:deb/debian/perl-base"
+    expired_at: 2027-01-31
+
+  # Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
+  - id: CVE-2026-57433
+    purls:
+      - "pkg:deb/debian/perl-base"
+    expired_at: 2027-01-31
+
+  # Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
+  - id: CVE-2026-8376
+    purls:
+      - "pkg:deb/debian/perl-base"
+    expired_at: 2027-01-31
+
+  # Regex trie bug giving silently wrong matches above 65535 alternation branches.
+  # perl 5.40.1 is in range, so this rests on nothing invoking perl. Short expiry
+  # to force a re-look. Ref: https://github.com/Perl/perl5/issues/23388
+  - id: CVE-2026-13221
+    purls:
+      - "pkg:deb/debian/perl-base"
+    expired_at: 2026-11-30
+
+  # Declared in the SPDX manifest that ships inside PowerShell's MicrosoftTeams module
+  # (Modules/MicrosoftTeams/7.9.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
+  # SBOM and reports what it declares, which is not the same as what the image contains:
+  # there is no Node runtime and no node_modules anywhere in the image, and the .NET
+  # assemblies target net472, a Windows-only framework. Nothing here is reachable, and none
+  # of it is a dependency we declare -- only Microsoft can change the module's contents.
+  - id: CVE-2020-0606
+    purls:
+      - "pkg:nuget/Microsoft.WindowsDesktop.App.Ref"
+    expired_at: 2027-01-31
+  - id: CVE-2019-0820
+    purls:
+      - "pkg:nuget/System.Text.RegularExpressions"
+    expired_at: 2027-01-31
+  - id: CVE-2026-47302
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml"
+    expired_at: 2027-01-31
+  - id: CVE-2026-47304
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml"
+    expired_at: 2027-01-31
+  - id: CVE-2026-50525
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml"
+    expired_at: 2027-01-31
+  - id: CVE-2026-50527
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml"
+    expired_at: 2027-01-31
+  - id: CVE-2026-50648
+    purls:
+      - "pkg:nuget/System.Security.Cryptography.Xml"
+    expired_at: 2027-01-31
+  - id: CVE-2026-13676
+    purls:
+      - "pkg:npm/fast-uri"
+    expired_at: 2027-01-31
+  - id: CVE-2026-16221
+    purls:
+      - "pkg:npm/fast-uri"
+    expired_at: 2027-01-31
+  - id: CVE-2026-18446
+    purls:
+      - "pkg:npm/fast-uri"
+    expired_at: 2027-01-31
+  - id: CVE-2026-69192
+    purls:
+      - "pkg:npm/ip-address"
+    expired_at: 2027-01-31
+
+  # Modules compiled into the Trivy binary the images ship. The binary is pinned by version
+  # and verified by checksum in the Dockerfile; only a rebuild by its vendor moves these.
+  - id: CVE-2026-56852
+    purls:
+      - "pkg:golang/golang.org/x/text"
+    expired_at: 2026-12-31
+  - id: GHSA-hrxh-6v49-42gf
+    purls:
+      - "pkg:golang/google.golang.org/grpc"
+    expired_at: 2026-12-31
+  - id: CVE-2026-50151
+    purls:
+      - "pkg:golang/oras.land/oras-go/v2"
+    expired_at: 2026-12-31
+  - id: CVE-2026-50163
+    purls:
+      - "pkg:golang/oras.land/oras-go/v2"
+    expired_at: 2026-12-31
+  - id: CVE-2026-39822
+    purls:
+      - "pkg:golang/stdlib"
+    expired_at: 2026-12-31
+

AGENTS.md

@@ -62,6 +62,7 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Action | Skill |
 |--------|-------|
 | Add changelog entry for a PR or feature | `prowler-changelog` |
+| Adding ConfigRequirements guardrails to compliance requirements | `prowler-compliance` |
 | Adding DRF pagination or permissions | `django-drf` |
 | Adding a compliance output formatter (per-provider class + table dispatcher) | `prowler-compliance` |
 | Adding indexes or constraints to database tables | `django-migration-psql` |
@@ -84,6 +85,7 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Creating ViewSets, serializers, or filters in api/ | `django-drf` |
 | Creating Zod schemas | `zod-4` |
 | Creating a git commit | `prowler-commit` |
+| Creating a universal (multi-provider) compliance framework | `prowler-compliance` |
 | Creating new checks | `prowler-sdk-check` |
 | Creating new skills | `skill-creator` |
 | Creating or reviewing Django migrations | `django-migration-psql` |

Dockerfile

@@ -1,22 +1,30 @@
-FROM python:3.12.13-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS build
+FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
 
-ARG POWERSHELL_VERSION=7.5.0
+ARG POWERSHELL_VERSION=7.5.9
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1
 
-ARG TRIVY_VERSION=0.71.2
+ARG TRIVY_VERSION=0.72.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 
+# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
+ARG TRIVY_SHA256_AMD64=bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea
+ARG TRIVY_SHA256_ARM64=2ca2c023109c2db6b2b77366b6717291452d4531167377d95c79547f0c8e3467
+ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0
+ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56
+ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
+ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d
+
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    wget libicu72 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
+    wget libicu76 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
     build-essential pkg-config libzstd-dev zlib1g-dev \
     && rm -rf /var/lib/apt/lists/*
 
@@ -29,6 +37,9 @@ RUN ARCH=$(uname -m) && \
     else \
         echo "Unsupported architecture: $ARCH" && exit 1 ; \
     fi && \
+    if [ "$ARCH" = "x86_64" ]; then EXPECT="$POWERSHELL_SHA256_AMD64" ; else EXPECT="$POWERSHELL_SHA256_ARM64" ; fi && \
+    echo "$EXPECT  /tmp/powershell.tar.gz" > /tmp/powershell.sha256 && \
+    sha256sum -c /tmp/powershell.sha256 && rm /tmp/powershell.sha256 && \
     mkdir -p /opt/microsoft/powershell/7 && \
     tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 && \
     chmod +x /opt/microsoft/powershell/7/pwsh && \
@@ -45,6 +56,9 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for Trivy: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_ARCH}.tar.gz" -O /tmp/trivy.tar.gz && \
+    if [ "$ARCH" = "x86_64" ]; then EXPECT="$TRIVY_SHA256_AMD64" ; else EXPECT="$TRIVY_SHA256_ARM64" ; fi && \
+    echo "$EXPECT  /tmp/trivy.tar.gz" > /tmp/trivy.sha256 && \
+    sha256sum -c /tmp/trivy.sha256 && rm /tmp/trivy.sha256 && \
     tar zxf /tmp/trivy.tar.gz -C /tmp && \
     mv /tmp/trivy /usr/local/bin/trivy && \
     chmod +x /usr/local/bin/trivy && \
@@ -63,6 +77,9 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for zizmor: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-${ZIZMOR_ARCH}.tar.gz" -O /tmp/zizmor.tar.gz && \
+    if [ "$ARCH" = "x86_64" ]; then EXPECT="$ZIZMOR_SHA256_AMD64" ; else EXPECT="$ZIZMOR_SHA256_ARM64" ; fi && \
+    echo "$EXPECT  /tmp/zizmor.tar.gz" > /tmp/zizmor.sha256 && \
+    sha256sum -c /tmp/zizmor.sha256 && rm /tmp/zizmor.sha256 && \
     mkdir -p /tmp/zizmor-extract && \
     tar zxf /tmp/zizmor.tar.gz -C /tmp/zizmor-extract && \
     mv /tmp/zizmor-extract/zizmor /usr/local/bin/zizmor && \
@@ -89,7 +106,7 @@ ENV HOME='/home/prowler'
 ENV PATH="${HOME}/.local/bin:${PATH}"
 #hadolint ignore=DL3013
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.11.14
+    pip install --no-cache-dir uv==0.12.0
 
 RUN uv sync --locked --compile-bytecode && \
     rm -rf ~/.cache/uv
@@ -105,6 +122,9 @@ RUN apt-get purge -y --auto-remove \
     pkg-config \
     libzstd-dev \
     zlib1g-dev \
+    wget \
+    gnupg \
+    apt-transport-https \
     && rm -rf /var/lib/apt/lists/*
 
 USER prowler
@@ -113,5 +133,15 @@ USER prowler
 RUN pip uninstall dash-html-components -y && \
     pip uninstall dash-core-components -y
 
+USER root
+
+# pip is build-only; the entrypoint runs the venv directly.
+RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
+    /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
+    /home/prowler/.local/lib/python3.12/site-packages/pip \
+    /home/prowler/.local/lib/python3.12/site-packages/pip-*.dist-info \
+    /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
+    /home/prowler/.local/bin/pip /home/prowler/.local/bin/pip3 /home/prowler/.local/bin/pip3.12
+
 USER prowler
 ENTRYPOINT ["/home/prowler/.venv/bin/prowler"]

Makefile

@@ -34,6 +34,9 @@ test:   ## Test with pytest
 	rm -rf .coverage && \
 	pytest -n auto -vvv -s --cov=./prowler --cov-report=xml tests
 
+test-mcp: ## Test MCP server with pytest (mirrors CI)
+	cd mcp_server && uv run pytest --cov=./prowler_mcp_server --cov-report=term-missing tests
+
 coverage: ## Show Test Coverage
 	coverage run --skip-covered -m pytest -v && \
 	coverage report -m && \

README.md

@@ -6,7 +6,10 @@
   <b><i>Prowler</b> is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.
 </p>
 <p align="center">
-<b>Secure ANY cloud at AI Speed at <a href="https://prowler.com">prowler.com</i></b>
+<b>The Agentic Cloud Defender</i></b>
+</p>
+<p align="center">
+<a href="https://cloud.prowler.com/sign-up">Try Prowler Cloud</a>
 </p>
 
 <p align="center">
@@ -56,7 +59,7 @@ Prowler includes hundreds of built-in controls to ensure compliance with standar
 
 ## Prowler Cloud & Prowler Local Server
 
-[Prowler Cloud](https://cloud.prowler.com/) and Prowler Local Server, its self-hosted open-source version, are web applications that simplify running Prowler across your cloud provider accounts. They provide a user-friendly interface to visualize the results and streamline your security assessments.
+[Prowler Cloud](https://cloud.prowler.com/sign-up) and Prowler Local Server, its self-hosted open-source version, are web applications that simplify running Prowler across your cloud provider accounts. They provide a user-friendly interface to visualize the results and streamline your security assessments.
 
 ![Prowler Cloud](docs/images/products/overview.png)
 ![Risk Pipeline](docs/images/products/risk-pipeline.png)
@@ -123,24 +126,25 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 
 | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/user-guide/compliance/tutorials/compliance) | [Categories](https://docs.prowler.com/user-guide/cli/tutorials/misc#categories) | Support | Interface |
 |---|---|---|---|---|---|---|
-| AWS | 615 | 86 | 47 | 19 | Official | UI, API, CLI |
-| Azure | 190 | 22 | 21 | 16 | Official | UI, API, CLI |
+| AWS | 621 | 86 | 47 | 19 | Official | UI, API, CLI |
+| Azure | 191 | 22 | 21 | 16 | Official | UI, API, CLI |
 | GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |
-| Kubernetes | 90 | 7 | 8 | 11 | Official | UI, API, CLI |
+| Kubernetes | 92 | 7 | 8 | 11 | Official | UI, API, CLI |
 | GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |
-| M365 | 109 | 10 | 6 | 10 | Official | UI, API, CLI |
+| M365 | 111 | 10 | 6 | 10 | Official | UI, API, CLI |
 | OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |
 | Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |
 | Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |
 | IaC | [See `trivy` docs.](https://trivy.dev/latest/docs/coverage/iac/) | N/A | N/A | N/A | Official | UI, API, CLI |
 | MongoDB Atlas | 10 | 3 | 1 | 8 | Official | UI, API, CLI |
 | LLM | [See `promptfoo` docs.](https://www.promptfoo.dev/docs/red-team/plugins/) | N/A | N/A | N/A | Official | CLI |
-| Image | N/A | N/A | N/A | N/A | Official | CLI, API |
+| Image | N/A | N/A | N/A | N/A | Official | UI, API, CLI |
 | Google Workspace | 65 | 11 | 3 | 6 | Official | UI, API, CLI |
 | OpenStack | 34 | 5 | 1 | 9 | Official | UI, API, CLI |
 | Vercel | 26 | 6 | 1 | 8 | Official | UI, API, CLI |
 | Okta | 29 | 8 | 2 | 2 | Official | UI, API, CLI |
 | Linode [Contact us](https://prowler.com/contact) | 10 | 3 | 1 | 4 | Unofficial | CLI |
+| Huawei Cloud [Contact us](https://prowler.com/contact) | 25 | 10 | 1 | 6 | Unofficial | CLI |
 | E2E Networks [Contact us](https://prowler.com/contact) | 27 | 6 | 0 | 2 | Unofficial | CLI |
 | Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 1 | 1 | Unofficial | CLI |
 | StackIT [Contact us](https://prowler.com/contact) | 7 | 2 | 1 | 3 | Unofficial | CLI |

action.yml

@@ -167,7 +167,7 @@ runs:
 
     - name: Upload SARIF to GitHub Code Scanning
       if: always() && inputs.upload-sarif == 'true' && steps.find-sarif.outputs.sarif_path != ''
-      uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+      uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
       with:
         sarif_file: ${{ steps.find-sarif.outputs.sarif_path }}
         category: ${{ inputs.sarif-category }}

api/CHANGELOG.md

@@ -4,6 +4,94 @@ All notable changes to the **Prowler API** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [1.39.0] (Prowler v5.38.0)
+
+### 🚀 Added
+
+- Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service PassRole escalations (Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, Step Functions), CodeDeploy and Step Functions existing-resource abuse, role permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection [(#12237)](https://github.com/prowler-cloud/prowler/pull/12237)
+- Attack Paths query metadata now carries an outcome (Code execution, Privilege escalation, Public exposure, or Resource inventory), exposed on the queries endpoint so the graph can show a terminal outcome node [(#12344)](https://github.com/prowler-cloud/prowler/pull/12344)
+- Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352)
+
+### 🔄 Changed
+
+- Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal [(#12346)](https://github.com/prowler-cloud/prowler/pull/12346)
+
+### 🐞 Fixed
+
+- Compliance report output directory failures are now logged with the exception attached and fingerprinted by `errno` in Sentry, so `ENOSPC`, `ENOENT` and `EACCES` no longer share a single issue [(#12142)](https://github.com/prowler-cloud/prowler/pull/12142)
+- Restored the SDK dependency to `@master` now that the dependency bumps have landed there, and regenerated the lock. The API image no longer builds against a temporary integration branch [(#12309)](https://github.com/prowler-cloud/prowler/pull/12309)
+
+### 🔐 Security
+
+- The API container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it [(#12334)](https://github.com/prowler-cloud/prowler/pull/12334)
+- Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 [(#12340)](https://github.com/prowler-cloud/prowler/pull/12340)
+- Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356)
+
+---
+
+## [1.38.1] (Prowler v5.37.1)
+
+### 🐞 Fixed
+
+- Entra Conditional Access guest-user checks no longer report false FAILs in M365 scans: microsoft-kiota packages overridden to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list [(#12315)](https://github.com/prowler-cloud/prowler/pull/12315)
+
+### 🔐 Security
+
+- The API container image now builds on Debian 13 (trixie), taking its critical CVE count from 18 to 4 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Bumped PowerShell, Trivy and uv in the API container image, clearing 14 high-severity CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Bumped `workos` and `pyopenssl` so the API can move to `cryptography` 48.0.1 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Removed `gnupg` and `apt-transport-https` from the API container image [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- The API container image no longer ships `git`; removing it also dropped `perl`, `perl-modules`, `libperl` and `liberror-perl`, clearing 12 critical CVEs. Only `perl-base` remains, which Debian marks Essential and cannot be removed [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Removed `pip` from the API container image, clearing two high-severity CVEs in the vendored copies of `setuptools` and `msgpack` [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+- Bumped `pillow` to 12.3.0, `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
+
+---
+
+## [1.38.0] (Prowler v5.37.0)
+
+### 🚀 Added
+
+- Attack Paths: four AWS privilege-escalation detection queries from pathfinding.cloud: cross-account role trust (STS-002), wildcard role trust (STS-003), user permissions-boundary removal (IAM-022), and IAM Identity Center permission-set escalation (SSO-001) [(#11460)](https://github.com/prowler-cloud/prowler/pull/11460)
+
+### 🐞 Fixed
+
+- Attack Paths IAM privilege-escalation queries no longer build an all-nodes × all-resource-items cartesian product, fixing runtime errors and timeouts on accounts with many IAM roles, users, or groups [(#12136)](https://github.com/prowler-cloud/prowler/pull/12136)
+- `task_args` serialization no longer returns HTTP 500 errors when Celery truncates stored task keyword arguments [(#12165)](https://github.com/prowler-cloud/prowler/pull/12165)
+- Attack Paths predefined queries on migrated graphs are now scoped with the provider label, letting the graph database seed from its label index instead of a global label scan and preventing query timeouts on Neptune [(#12167)](https://github.com/prowler-cloud/prowler/pull/12167)
+- Authentication with an API key whose owning user was deleted now returns `401` instead of an unhandled `AttributeError`, and user deletion now revokes the user's API keys across all their tenants [(#12210)](https://github.com/prowler-cloud/prowler/pull/12210)
+- AWS Security Hub integrations now persist successful connection checks during finding delivery so their connection status and last checked timestamp stay current [(#12212)](https://github.com/prowler-cloud/prowler/pull/12212)
+- SAML users without a `userType` attribute and without an existing role in the SAML tenant now receive a least-privilege `read_only` fallback role; a numeric suffix is used when that name belongs to a role with different permissions [(#12223)](https://github.com/prowler-cloud/prowler/pull/12223)
+- Social signups create users and authentication records in one database transaction, preventing incomplete accounts when provisioning fails [(#12245)](https://github.com/prowler-cloud/prowler/pull/12245)
+- Requesting integrations with a sparse fieldset that leaves out `configuration` no longer returns HTTP 500 errors when the tenant has a Jira integration [(#12261)](https://github.com/prowler-cloud/prowler/pull/12261)
+
+### 🔐 Security
+
+- Provider deletion and connection checks, scan creation, provider secrets, provider groups, and daily schedules now respect role provider-group visibility [(#12216)](https://github.com/prowler-cloud/prowler/pull/12216)
+
+---
+
+## [1.37.0] (Prowler v5.36.0)
+
+### 🔄 Changed
+
+- OCI provider secrets no longer require `region`; legacy `region` input is accepted for backwards compatibility but ignored before storing or scanning [(#11741)](https://github.com/prowler-cloud/prowler/pull/11741)
+- Compliance overview ingest now runs in a single transaction per scan with a configurable `COPY` batch size (`DJANGO_COMPLIANCE_COPY_BATCH_SIZE`, default 2000), reducing write pressure on the database [(#11875)](https://github.com/prowler-cloud/prowler/pull/11875)
+
+### 🐞 Fixed
+
+- Scan findings now recover resources missing from the in-memory cache after resource pre-resolution, preventing valid findings from being skipped [(#12002)](https://github.com/prowler-cloud/prowler/pull/12002)
+- Tenant-wide integrations that are not attached to any provider, such as Jira, are now visible and manageable by roles with `manage_integrations` and without unlimited visibility [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
+- Output generation now removes the scan's temporary output directory before writing, so a re-run of the task for the same scan (e.g. broker redelivery after a worker is killed mid-run) no longer appends to the previous run's files and duplicates finding rows in the exported CSV and other outputs [(#12097)](https://github.com/prowler-cloud/prowler/pull/12097)
+
+### 🔐 Security
+
+- Integration responses no longer disclose providers outside the visibility of the role, including the resources sideloaded through `?include=providers` [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
+- Integration connection checks, Jira issue type lookups and Jira dispatches now resolve the integration through the provider visibility of the role instead of the whole tenant [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
+- Roles without unlimited visibility can no longer attach an integration to providers they cannot see, nor edit or delete an integration bound to them [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
+- Kubernetes kubeconfig validation now rejects legacy `auth-provider.config.cmd-path` command authentication in Prowler Cloud/API [(#12091)](https://github.com/prowler-cloud/prowler/pull/12091)
+
+---
+
 ## [1.36.0] (Prowler v5.35.0)
 
 ### 🐞 Fixed

api/Dockerfile

@@ -1,23 +1,31 @@
-FROM python:3.12.13-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b AS build
+FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/api"
 
-ARG POWERSHELL_VERSION=7.5.0
+ARG POWERSHELL_VERSION=7.5.9
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
 # Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
 ENV POWERSHELL_TELEMETRY_OPTOUT=1
 
-ARG TRIVY_VERSION=0.71.2
+ARG TRIVY_VERSION=0.72.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 
+# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
+ARG TRIVY_SHA256_AMD64=bbb64b9695866ce4a7a8f5c9592002c5961cab378577fa3f8a040df362b9b2ea
+ARG TRIVY_SHA256_ARM64=2ca2c023109c2db6b2b77366b6717291452d4531167377d95c79547f0c8e3467
+ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0
+ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56
+ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
+ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d
+
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
     wget \
     git \
-    libicu72 \
+    libicu76 \
     gcc \
     g++ \
     make \
@@ -28,7 +36,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libtool \
     libxslt1-dev \
     python3-dev \
-    git \
     && rm -rf /var/lib/apt/lists/*
 
 # Install PowerShell
@@ -40,6 +47,9 @@ RUN ARCH=$(uname -m) && \
     else \
         echo "Unsupported architecture: $ARCH" && exit 1 ; \
     fi && \
+    if [ "$ARCH" = "x86_64" ]; then EXPECT="$POWERSHELL_SHA256_AMD64" ; else EXPECT="$POWERSHELL_SHA256_ARM64" ; fi && \
+    echo "$EXPECT  /tmp/powershell.tar.gz" > /tmp/powershell.sha256 && \
+    sha256sum -c /tmp/powershell.sha256 && rm /tmp/powershell.sha256 && \
     mkdir -p /opt/microsoft/powershell/7 && \
     tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 && \
     chmod +x /opt/microsoft/powershell/7/pwsh && \
@@ -56,6 +66,9 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for Trivy: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_ARCH}.tar.gz" -O /tmp/trivy.tar.gz && \
+    if [ "$ARCH" = "x86_64" ]; then EXPECT="$TRIVY_SHA256_AMD64" ; else EXPECT="$TRIVY_SHA256_ARM64" ; fi && \
+    echo "$EXPECT  /tmp/trivy.tar.gz" > /tmp/trivy.sha256 && \
+    sha256sum -c /tmp/trivy.sha256 && rm /tmp/trivy.sha256 && \
     tar zxf /tmp/trivy.tar.gz -C /tmp && \
     mv /tmp/trivy /usr/local/bin/trivy && \
     chmod +x /usr/local/bin/trivy && \
@@ -74,6 +87,9 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for zizmor: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-${ZIZMOR_ARCH}.tar.gz" -O /tmp/zizmor.tar.gz && \
+    if [ "$ARCH" = "x86_64" ]; then EXPECT="$ZIZMOR_SHA256_AMD64" ; else EXPECT="$ZIZMOR_SHA256_ARM64" ; fi && \
+    echo "$EXPECT  /tmp/zizmor.tar.gz" > /tmp/zizmor.sha256 && \
+    sha256sum -c /tmp/zizmor.sha256 && rm /tmp/zizmor.sha256 && \
     mkdir -p /tmp/zizmor-extract && \
     tar zxf /tmp/zizmor.tar.gz -C /tmp/zizmor-extract && \
     mv /tmp/zizmor-extract/zizmor /usr/local/bin/zizmor && \
@@ -94,7 +110,7 @@ RUN mkdir -p /tmp/prowler_api_output
 COPY --chown=prowler:prowler pyproject.toml uv.lock ./
 
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.11.14
+    pip install --no-cache-dir uv==0.12.0
 
 ENV PATH="/home/prowler/.local/bin:$PATH"
 
@@ -102,24 +118,41 @@ ENV PATH="/home/prowler/.local/bin:$PATH"
 RUN uv sync --locked --no-install-project && \
     rm -rf ~/.cache/uv
 
-RUN .venv/bin/python .venv/lib/python3.12/site-packages/prowler/providers/m365/lib/powershell/m365_powershell.py
+# Invoked as a module so the base image's Python minor version is not baked
+# into a site-packages path.
+RUN .venv/bin/python -m prowler.providers.m365.lib.powershell.m365_powershell
 
 USER root
 
 # Remove build-only packages from the final image after Python dependencies are installed.
+# git is only needed by uv sync for the `prowler @ git+...` dependency; purging it drops perl too.
+# wget stays: the compose healthcheck shells out to it.
 RUN apt-get purge -y --auto-remove \
     gcc \
     g++ \
+    git \
     make \
     libxml2-dev \
     libxmlsec1-dev \
     libxmlsec1-openssl \
+    libxmlsec1t64 \
+    libxmlsec1t64-openssl \
     pkg-config \
     libtool \
     libxslt1-dev \
     python3-dev \
+    gnupg \
+    apt-transport-https \
     && rm -rf /var/lib/apt/lists/*
 
+# pip is build-only; the entrypoint runs uv against the prepared venv. uv stays.
+RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
+    /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
+    /home/prowler/.local/lib/python3.12/site-packages/pip \
+    /home/prowler/.local/lib/python3.12/site-packages/pip-*.dist-info \
+    /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
+    /home/prowler/.local/bin/pip /home/prowler/.local/bin/pip3 /home/prowler/.local/bin/pip3.12
+
 USER prowler
 
 COPY --chown=prowler:prowler src/backend/ ./backend/

api/changelog.d/saml-acs-post-only.fixed.md

@@ -0,0 +1 @@
+`/api/v1/accounts/saml/{organization_slug}/acs/` rejects non-POST requests before SAML response processing

api/changelog.d/tenant-deletion-transaction.fixed.md

@@ -0,0 +1 @@
+Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails

api/changelog.d/users-me-active-membership.changed.md

@@ -0,0 +1 @@
+`GET /api/v1/users/me` membership relationships identify the active tenant with `meta.active` for JWT and API key authentication

api/pyproject.toml

@@ -63,7 +63,7 @@ dependencies = [
   "werkzeug (==3.1.7)",
   "sqlparse (==0.5.5)",
   "fonttools (==4.62.1)",
-  "uvicorn-worker (==0.4.0)",
+  "uvicorn-worker (==0.4.0)"
 ]
 description = "Prowler's API (Django/DRF)"
 license = "Apache-2.0"
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.36.0"
+version = "1.40.0"
 
 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.
@@ -92,6 +92,8 @@ extend-select = [
 
 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
+# workos and pyopenssl run ahead of master: the versions master pins cap cryptography
+# below 48, so both were bumped to versions that allow it (PROWLER-2310).
 constraint-dependencies = [
   "about-time==4.2.1",
   "adal==1.2.7",
@@ -99,7 +101,7 @@ constraint-dependencies = [
   "aiobotocore==2.25.1",
   "aiofiles==24.1.0",
   "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.14.0",
+  "aiohttp==3.14.3",
   "aioitertools==0.13.0",
   "aiosignal==1.4.0",
   "alibabacloud-actiontrail20200706==2.4.1",
@@ -128,7 +130,7 @@ constraint-dependencies = [
   "alibabacloud-sls20201230==5.9.0",
   "alibabacloud-sts20150401==1.1.6",
   "alibabacloud-tea==0.4.3",
-  "alibabacloud-tea-openapi==0.4.4",
+  "alibabacloud-tea-openapi==0.4.5",
   "alibabacloud-tea-util==0.3.14",
   "alibabacloud-tea-xml==0.0.3",
   "alibabacloud-vpc20160428==6.13.0",
@@ -210,9 +212,9 @@ constraint-dependencies = [
   "coverage==7.5.4",
   "cron-descriptor==1.4.5",
   "crowdstrike-falconpy==1.6.0",
-  "cryptography==46.0.7",
+  "cryptography==50.0.0",
   "cycler==0.12.1",
-  "darabonba-core==1.0.5",
+  "darabonba-core==1.0.8",
   "dash==3.1.1",
   "dash-bootstrap-components==2.0.3",
   "debugpy==1.8.20",
@@ -277,7 +279,7 @@ constraint-dependencies = [
   "h2==4.3.0",
   "hpack==4.1.0",
   "httpcore==1.0.9",
-  "httplib2==0.31.2",
+  "httplib2==0.32.0",
   "httpx==0.28.1",
   "humanfriendly==10.0",
   "hyperframe==6.1.0",
@@ -314,13 +316,13 @@ constraint-dependencies = [
   "matplotlib==3.10.8",
   "mccabe==0.7.0",
   "mdurl==0.1.2",
-  "microsoft-kiota-abstractions==1.9.9",
-  "microsoft-kiota-authentication-azure==1.9.9",
-  "microsoft-kiota-http==1.9.9",
-  "microsoft-kiota-serialization-form==1.9.9",
-  "microsoft-kiota-serialization-json==1.9.9",
-  "microsoft-kiota-serialization-multipart==1.9.9",
-  "microsoft-kiota-serialization-text==1.9.9",
+  "microsoft-kiota-abstractions==1.9.10",
+  "microsoft-kiota-authentication-azure==1.9.10",
+  "microsoft-kiota-http==1.9.10",
+  "microsoft-kiota-serialization-form==1.9.10",
+  "microsoft-kiota-serialization-json==1.9.10",
+  "microsoft-kiota-serialization-multipart==1.9.10",
+  "microsoft-kiota-serialization-text==1.9.10",
   "microsoft-security-utilities-secret-masker==1.0.0b4",
   "msal==1.35.0b1",
   "msal-extensions==1.2.0",
@@ -337,7 +339,7 @@ constraint-dependencies = [
   "nltk==3.9.4",
   "numpy==2.2.6",
   "oauthlib==3.3.1",
-  "oci==2.169.0",
+  "oci==2.183.0",
   "openai==1.109.1",
   "openstacksdk==4.2.0",
   "opentelemetry-api==1.39.1",
@@ -349,7 +351,7 @@ constraint-dependencies = [
   "pagerduty==6.1.0",
   "pandas==2.2.3",
   "pbr==7.0.3",
-  "pillow==12.2.0",
+  "pillow==12.3.0",
   "pkginfo==1.12.1.2",
   "platformdirs==4.5.1",
   "plotly==6.5.2",
@@ -365,8 +367,8 @@ constraint-dependencies = [
   "psycopg2-binary==2.9.9",
   "py-deviceid==0.1.1",
   "py-iam-expand==0.3.0",
-  "py-ocsf-models==0.8.1",
-  "pyasn1==0.6.3",
+  "py-ocsf-models==0.10.0",
+  "pyasn1==0.6.4",
   "pyasn1-modules==0.4.2",
   "pycodestyle==2.14.0",
   "pycparser==3.0",
@@ -378,7 +380,7 @@ constraint-dependencies = [
   "pylint==3.2.5",
   "pymsalruntime==0.18.1",
   "pynacl==1.6.2",
-  "pyopenssl==26.0.0",
+  "pyopenssl==26.2.0",
   "pyparsing==3.3.2",
   "pyreadline3==3.5.4",
   "pysocks==1.7.1",
@@ -447,7 +449,7 @@ constraint-dependencies = [
   "wcwidth==0.5.3",
   "websocket-client==1.9.0",
   "werkzeug==3.1.7",
-  "workos==6.0.8",
+  "workos==8.3.0",
   "wrapt==1.17.3",
   "xlsxwriter==3.2.9",
   "xmlsec==1.3.17",
@@ -466,10 +468,13 @@ constraint-dependencies = [
 # 0.138.1 requires azure-mgmt-containerservice>=41.0.0. Attack Paths does not
 # ingest Azure today, so override the Cartography dependency to the Prowler pin.
 #
-# prowler@master hard-pins microsoft-kiota-abstractions==1.9.2 in [project.dependencies].
-# The microsoft-kiota-http security bump to 1.9.9 (GHSA-7j59-v9qr-6fq9) requires
-# microsoft-kiota-abstractions>=1.9.9, which a constraint cannot satisfy against the
-# SDK's hard pin; override it to the patched, kiota-aligned version.
+# prowler@master hard-pins the microsoft-kiota packages in [project.dependencies].
+# microsoft-kiota-serialization-json 1.9.10 fixes get_collection_of_enum_values
+# returning [] for flags enums serialized as CSV strings (microsoft/kiota-python#515),
+# which broke the Entra Conditional Access guest-user checks; the kiota packages
+# release in lockstep and 1.9.10 requires microsoft-kiota-abstractions>=1.9.10, which
+# a constraint cannot satisfy against the SDK's hard pins, so override the whole set
+# to 1.9.10 until the SDK bump propagates to the pinned master rev.
 #
 # prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
 # dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
@@ -480,8 +485,16 @@ constraint-dependencies = [
 # that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
 override-dependencies = [
   "okta==3.4.2",
+  # alibabacloud-tea-openapi 0.4.5 caps cryptography below 49 and is the latest release.
+  "cryptography==50.0.0",
   "azure-mgmt-containerservice==34.1.0",
-  "microsoft-kiota-abstractions==1.9.9",
+  "microsoft-kiota-abstractions==1.9.10",
+  "microsoft-kiota-authentication-azure==1.9.10",
+  "microsoft-kiota-http==1.9.10",
+  "microsoft-kiota-serialization-form==1.9.10",
+  "microsoft-kiota-serialization-json==1.9.10",
+  "microsoft-kiota-serialization-multipart==1.9.10",
+  "microsoft-kiota-serialization-text==1.9.10",
   "dulwich==1.2.5",
   "pyjwt[crypto]==2.13.0"
 ]

api/src/backend/api/adapters.py

@@ -1,7 +1,7 @@
 from allauth.account.models import EmailAddress
 from allauth.core.exceptions import ImmediateHttpResponse
 from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
-from api.db_router import MainRouter
+from api.db_router import MainRouter, write_db_alias
 from api.db_utils import rls_transaction
 from api.models import (
     Membership,
@@ -107,7 +107,10 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
         and is about to be saved to the DB for the first time.
         """
         with transaction.atomic(using=MainRouter.admin_db):
-            user = super().save_user(request, sociallogin, form)
+            # Allauth saves the user without an explicit alias. Route that save
+            # through admin so every signup record shares this transaction.
+            with write_db_alias(MainRouter.admin_db):
+                user = super().save_user(request, sociallogin, form)
             provider = sociallogin.provider.id
             extra = sociallogin.account.extra_data
 

api/src/backend/api/attack_paths/__init__.py

@@ -1,5 +1,6 @@
 from api.attack_paths.queries import (
     AttackPathsQueryDefinition,
+    AttackPathsQueryOutcome,
     AttackPathsQueryParameterDefinition,
     get_queries_for_provider,
     get_query_by_id,
@@ -7,6 +8,7 @@ from api.attack_paths.queries import (
 
 __all__ = [
     "AttackPathsQueryDefinition",
+    "AttackPathsQueryOutcome",
     "AttackPathsQueryParameterDefinition",
     "get_queries_for_provider",
     "get_query_by_id",

api/src/backend/api/attack_paths/queries/__init__.py

@@ -4,11 +4,13 @@ from api.attack_paths.queries.registry import (
 )
 from api.attack_paths.queries.types import (
     AttackPathsQueryDefinition,
+    AttackPathsQueryOutcome,
     AttackPathsQueryParameterDefinition,
 )
 
 __all__ = [
     "AttackPathsQueryDefinition",
+    "AttackPathsQueryOutcome",
     "AttackPathsQueryParameterDefinition",
     "get_queries_for_provider",
     "get_query_by_id",

api/src/backend/api/attack_paths/queries/types.py

@@ -1,4 +1,38 @@
 from dataclasses import dataclass, field
+from enum import Enum
+
+
+@dataclass(frozen=True)
+class AttackPathsQueryOutcomeMeta:
+    """Display metadata for an outcome kind.
+
+    `label` and `partial` are properties of the outcome *kind*, not of an
+    individual query, so they live here once and every query just references a
+    kind. `partial` marks a latent/posture outcome (e.g. inventory) that the UI
+    renders as a marker rather than a full realized outcome.
+    """
+
+    kind: str
+    label: str
+    partial: bool = False
+
+
+class AttackPathsQueryOutcome(Enum):
+    """The terminal impact an attack-path query leads to.
+
+    Set per query and exposed by the API so the UI can render the graph's
+    terminal outcome node. The taxonomy is shared with Prowler Hub's attack-path
+    diagram (whose terminal labels match these values).
+    """
+
+    CODE_EXECUTION = AttackPathsQueryOutcomeMeta("code_execution", "Code execution")
+    PRIVILEGE_ESCALATION = AttackPathsQueryOutcomeMeta(
+        "privilege_escalation", "Privilege escalation"
+    )
+    PUBLIC_EXPOSURE = AttackPathsQueryOutcomeMeta("public_exposure", "Public exposure")
+    RESOURCE_INVENTORY = AttackPathsQueryOutcomeMeta(
+        "resource_inventory", "Resource inventory", partial=True
+    )
 
 
 @dataclass
@@ -36,4 +70,5 @@ class AttackPathsQueryDefinition:
     provider: str
     cypher: str
     attribution: AttackPathsQueryAttribution | None = None
+    outcome: AttackPathsQueryOutcome | None = None
     parameters: list[AttackPathsQueryParameterDefinition] = field(default_factory=list)

api/src/backend/api/attack_paths/views_helpers.py

@@ -115,7 +115,26 @@ def execute_query(
         # TODO: drop after Neptune cutover
         # Route reads by the scan row's recorded sink, not by current settings.
         backend = sink_module.get_backend_for_scan(scan)
-        graph = backend.execute_read_query(database_name, definition.cypher, parameters)
+
+        cypher = definition.cypher
+        # Every synced node carries a `_Provider_{uuid}` isolation label (the
+        # sync labels the whole provider subgraph). Injecting it into the
+        # predefined query's node patterns gives the planner a selective label
+        # index to seed from instead of a global label scan (`:AWSRole` across
+        # every tenant), which on Neptune is the difference between a sub-second
+        # plan and a query that times out. The custom-query path relies on this
+        # same injection.
+        #
+        # Restrict it to migrated scans: that catalog runs on the Neptune sink
+        # where the plan blowup happens, while the pre-cutover legacy catalog
+        # runs on the old sink and is dropped after the cutover, so leave it
+        # byte-for-byte unchanged. This only affects the query plan, not
+        # isolation - `_serialize_graph` already label-filters both catalogs.
+        # TODO: drop the is_migrated guard after Neptune cutover
+        if scan.is_migrated:
+            cypher = inject_provider_label(cypher, provider_id)
+
+        graph = backend.execute_read_query(database_name, cypher, parameters)
         return _serialize_graph(graph, provider_id)
 
     except graph_database.WriteQueryNotAllowedException:

api/src/backend/api/authentication.py

@@ -1,3 +1,4 @@
+import logging
 from math import isfinite
 from uuid import UUID
 
@@ -5,6 +6,7 @@ from api.db_router import MainRouter
 from api.models import TenantAPIKey, TenantAPIKeyManager
 from cryptography.fernet import InvalidToken
 from django.core.exceptions import ObjectDoesNotExist
+from django.db import transaction
 from django.utils import timezone
 from drf_simple_apikey.backends import APIKeyAuthentication as BaseAPIKeyAuth
 from drf_simple_apikey.crypto import get_crypto
@@ -14,6 +16,16 @@ from rest_framework.exceptions import AuthenticationFailed
 from rest_framework.request import Request
 from rest_framework_simplejwt.authentication import JWTAuthentication
 
+logger = logging.getLogger(__name__)
+
+
+class OrphanedAPIKeyError(Exception):
+    """Raised when an API key outlived the user that owns it.
+
+    Handled by `authenticate`, which commits the revocation written while detecting it
+    and then rejects the request with `AuthenticationFailed`.
+    """
+
 
 class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
     model = TenantAPIKey
@@ -24,10 +36,13 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
     def _authenticate_credentials(self, request, key):
         """
         Override to use admin connection, bypassing RLS during authentication.
+
+        Returns the validated API key row, locked with `select_for_update`, so callers
+        must run inside `transaction.atomic(using=MainRouter.admin_db)`.
         """
         try:
             payload = self.key_crypto.decrypt(key)
-        except ValueError:
+        except (ValueError, InvalidToken):
             raise AuthenticationFailed("Invalid API Key.")
 
         if not isinstance(payload, dict):
@@ -52,13 +67,33 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
             raise AuthenticationFailed("API Key has already expired.")
 
         try:
-            api_key = self.model.objects.using(MainRouter.admin_db).get(id=api_key_pk)
+            api_key = (
+                self.model.objects.using(MainRouter.admin_db)
+                .select_for_update()
+                .get(id=api_key_pk)
+            )
         except ObjectDoesNotExist:
             raise AuthenticationFailed("No entity matching this api key.")
 
         if api_key.revoked:
             raise AuthenticationFailed("This API Key has been revoked.")
 
+        # `entity` is nullable and `on_delete=SET_NULL` leaves the key behind when its
+        # owner is deleted, so a key can outlive its user. Reject it here: further down
+        # the authentication would return `None` as the authenticated user, which blows
+        # up while building the auth dict and surfaces as a 500 instead of a 401.
+        # Revoke it as well, so it stops showing up as active and later attempts fail
+        # the `revoked` check above like any other revoked key.
+        if api_key.entity_id is None:
+            api_key.revoked = True
+            api_key.save(update_fields=["revoked"], using=MainRouter.admin_db)
+            logger.warning(
+                "Revoked orphaned API key: prefix=%s tenant=%s",
+                api_key.prefix,
+                api_key.tenant_id,
+            )
+            raise OrphanedAPIKeyError
+
         client_ip = request.META.get(package_settings.IP_ADDRESS_HEADER)
         if api_key.blacklisted_ips and client_ip in api_key.blacklisted_ips:
             raise AuthenticationFailed("Access denied from blacklisted IP.")
@@ -66,7 +101,7 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
         if api_key.whitelisted_ips and client_ip not in api_key.whitelisted_ips:
             raise AuthenticationFailed("Access restricted to specific IP addresses.")
 
-        return api_key.entity, key
+        return api_key
 
     def authenticate(self, request: Request):
         prefixed_key = self.get_key(request)
@@ -77,36 +112,34 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
         except ValueError:
             raise AuthenticationFailed("Invalid API Key.")
 
-        try:
-            entity, _ = self._authenticate_credentials(request, key)
-        except InvalidToken:
-            raise AuthenticationFailed("Invalid API Key.")
+        # Validation, the `last_used_at` update and the auth claims all read the same
+        # row, locked until the transaction ends. Looking the key up a second time to
+        # build the claims used to leave a window where a key revoked or orphaned right
+        # after passing validation still authenticated.
+        with transaction.atomic(using=MainRouter.admin_db):
+            try:
+                api_key = self._authenticate_credentials(request, key)
+            except OrphanedAPIKeyError:
+                # Rejected below instead of here: leaving the block normally commits
+                # the revocation `_authenticate_credentials` wrote, while raising from
+                # inside would roll it back.
+                pass
+            else:
+                # The prefix used to be checked by the second lookup
+                if api_key.prefix != prefix:
+                    raise AuthenticationFailed("Invalid API Key.")
 
-        # Get the API key instance to update last_used_at and retrieve tenant info
-        # We need to decrypt again to get the pk (already validated by _authenticate_credentials)
-        payload = self.key_crypto.decrypt(key)
-        api_key_pk = payload["_pk"]
+                api_key.last_used_at = timezone.now()
+                api_key.save(update_fields=["last_used_at"], using=MainRouter.admin_db)
 
-        # Convert string UUID back to UUID object for lookup
-        if isinstance(api_key_pk, str):
-            api_key_pk = UUID(api_key_pk)
+                entity = api_key.entity
+                return entity, {
+                    "tenant_id": str(api_key.tenant_id),
+                    "sub": str(entity.id),
+                    "api_key_prefix": api_key.prefix,
+                }
 
-        try:
-            api_key_instance = TenantAPIKey.objects.using(MainRouter.admin_db).get(
-                id=api_key_pk, prefix=prefix
-            )
-        except TenantAPIKey.DoesNotExist:
-            raise AuthenticationFailed("Invalid API Key.")
-
-        # Update last_used_at
-        api_key_instance.last_used_at = timezone.now()
-        api_key_instance.save(update_fields=["last_used_at"], using=MainRouter.admin_db)
-
-        return entity, {
-            "tenant_id": str(api_key_instance.tenant_id),
-            "sub": str(api_key_instance.entity.id),
-            "api_key_prefix": prefix,
-        }
+        raise AuthenticationFailed("No entity matching this api key.")
 
 
 class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):

api/src/backend/api/base_views.py

@@ -3,9 +3,10 @@ from api.db_router import MainRouter, reset_read_db_alias, set_read_db_alias
 from api.db_utils import POSTGRES_USER_VAR, rls_transaction
 from api.filters import CustomDjangoFilterBackend
 from api.models import Role, UserRoleRelationship
-from api.rbac.permissions import HasPermissions
+from api.rbac.permissions import HasPermissions, get_role
 from django.conf import settings
 from django.db import transaction
+from django.utils.functional import cached_property
 from rest_framework import permissions
 from rest_framework.exceptions import NotAuthenticated
 from rest_framework.filters import SearchFilter
@@ -100,6 +101,11 @@ class BaseRLSViewSet(BaseViewSet):
         context["tenant_id"] = self.request.tenant_id
         return context
 
+    @cached_property
+    def user_role(self):
+        """Role of the requesting user in the active tenant, resolved once per request."""
+        return get_role(self.request.user, self.request.tenant_id)
+
 
 class BaseTenantViewset(BaseViewSet):
     def dispatch(self, request, *args, **kwargs):

api/src/backend/api/celery_utils.py

@@ -0,0 +1,40 @@
+import ast
+import json
+from typing import Any
+
+_UNPARSED = object()
+
+
+def decode_celery_field(value: Any, default: Any) -> Any:
+    """Decode a Celery result field and require JSON-serializable output."""
+    decoded = value
+    for _ in range(2):
+        if not isinstance(decoded, str):
+            break
+
+        text = decoded.strip()
+        if not text:
+            decoded = default
+            break
+
+        parsed = _UNPARSED
+        for parser in (json.loads, ast.literal_eval):
+            try:
+                parsed = parser(text)
+                break
+            except (TypeError, ValueError, SyntaxError):
+                continue
+
+        if parsed is _UNPARSED:
+            raise ValueError("Unable to decode Celery result field")
+        decoded = parsed
+
+    decoded = default if decoded is None else decoded
+    try:
+        json.dumps(decoded, allow_nan=False)
+    except (TypeError, ValueError) as error:
+        raise ValueError(
+            "Decoded Celery result field is not JSON serializable"
+        ) from error
+
+    return decoded

api/src/backend/api/db_router.py

@@ -1,3 +1,4 @@
+from contextlib import contextmanager
 from contextvars import ContextVar
 
 from django.conf import settings
@@ -5,6 +6,7 @@ from django.conf import settings
 ALLOWED_APPS = ("django", "socialaccount", "account", "authtoken", "silk")
 
 _read_db_alias = ContextVar("read_db_alias", default=None)
+_write_db_alias = ContextVar("write_db_alias", default=None)
 
 
 def set_read_db_alias(alias: str | None):
@@ -22,6 +24,30 @@ def reset_read_db_alias(token) -> None:
         _read_db_alias.reset(token)
 
 
+def set_write_db_alias(alias: str | None):
+    if not alias:
+        return None
+    return _write_db_alias.set(alias)
+
+
+def get_write_db_alias() -> str | None:
+    return _write_db_alias.get()
+
+
+def reset_write_db_alias(token) -> None:
+    if token is not None:
+        _write_db_alias.reset(token)
+
+
+@contextmanager
+def write_db_alias(alias: str | None):
+    token = set_write_db_alias(alias)
+    try:
+        yield
+    finally:
+        reset_write_db_alias(token)
+
+
 class MainRouter:
     default_db = "default"
     admin_db = "admin"
@@ -43,6 +69,9 @@ class MainRouter:
         model_table_name = model._meta.db_table
         if any(model_table_name.startswith(f"{app}_") for app in ALLOWED_APPS):
             return self.admin_db
+        write_alias = get_write_db_alias()
+        if write_alias:
+            return write_alias
         return None
 
     def allow_migrate(self, db, app_label, model_name=None, **hints):  # noqa: F841

api/src/backend/api/rbac/permissions.py

@@ -1,8 +1,8 @@
 from enum import Enum
 
 from api.db_router import MainRouter
-from api.models import Provider, Role, User
-from django.db.models import QuerySet
+from api.models import Integration, Provider, Role, User
+from django.db.models import Q, QuerySet
 from rest_framework.exceptions import PermissionDenied
 from rest_framework.permissions import BasePermission
 
@@ -83,3 +83,32 @@ def get_providers(role: Role) -> QuerySet[Provider]:
     return Provider.objects.filter(
         tenant_id=tenant_id, provider_groups__in=provider_groups
     ).distinct()
+
+
+def get_integrations(
+    role: Role, providers: QuerySet[Provider] | None = None
+) -> QuerySet[Integration]:
+    """
+    Return a distinct queryset of Integrations visible to the given role.
+
+    Integrations with no providers attached are tenant-wide, as is always the case for
+    Jira, and stay visible regardless of the provider visibility of the role. Integrations
+    attached to providers are only visible when the role can access at least one of them.
+
+    Args:
+        role: A Role instance.
+        providers: Optional queryset of the providers accessible by the role, to reuse
+            an already resolved `get_providers(role)` result within the same request.
+
+    Returns:
+        A QuerySet of Integration objects visible to the role.
+    """
+    queryset = Integration.objects.filter(tenant_id=role.tenant_id)
+    if role.unlimited_visibility:
+        return queryset
+
+    if providers is None:
+        providers = get_providers(role)
+    return queryset.filter(
+        Q(providers__isnull=True) | Q(providers__in=providers)
+    ).distinct()

api/src/backend/api/signals.py

@@ -1,3 +1,4 @@
+from api.db_router import MainRouter
 from api.db_utils import delete_related_daily_task
 from api.models import (
     LighthouseProviderConfiguration,
@@ -47,8 +48,15 @@ def revoke_user_api_keys(sender, instance, **kwargs):  # noqa: F841
 
     The entity field will be set to NULL by on_delete=SET_NULL,
     but we explicitly revoke the keys to prevent further use.
+
+    The update runs on the admin connection because `api_keys` is RLS protected and its
+    policy denies every row when `api.tenant_id` is unset. Users are deleted through the
+    admin connection and may belong to several tenants, so going through the default
+    connection would silently revoke nothing, or only the keys of the active tenant.
     """
-    TenantAPIKey.objects.filter(entity=instance).update(revoked=True)
+    TenantAPIKey.objects.using(MainRouter.admin_db).filter(entity=instance).update(
+        revoked=True
+    )
 
 
 @receiver(post_delete, sender=Membership)
@@ -58,8 +66,12 @@ def revoke_membership_api_keys(sender, instance, **kwargs):  # noqa: F841
 
     When a membership is deleted, all API keys created by that user
     in that tenant should be revoked to prevent further access.
+
+    Uses the admin connection for the same reason as `revoke_user_api_keys`: the RLS
+    policy on `api_keys` denies every row when `api.tenant_id` is unset, which is the
+    case when the membership is removed as a cascade of a user deletion.
     """
-    TenantAPIKey.objects.filter(
+    TenantAPIKey.objects.using(MainRouter.admin_db).filter(
         entity_id=instance.user_id, tenant_id=instance.tenant_id
     ).update(revoked=True)
 

api/src/backend/api/specs/v1.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.36.0
+  version: 1.40.0
   description: |-
     Prowler API specification.
 
@@ -6629,8 +6629,10 @@ paths:
   /api/v1/integrations:
     get:
       operationId: api_v1_integrations_list
-      description: Retrieve a list of all configured integrations with options for
-        filtering by various criteria.
+      description: |-
+        Retrieve a list of all configured integrations with options for filtering by various criteria.
+
+        Integrations attached to one or more providers are only returned when the role can access at least one of those providers, and each integration lists only the providers visible to the role. Integrations not attached to any provider, such as Jira, are tenant-wide and are returned for every role.
       summary: List all integrations
       parameters:
       - in: query
@@ -6781,7 +6783,8 @@ paths:
     post:
       operationId: api_v1_integrations_create
       description: Register a new integration with the system, providing necessary
-        configuration details.
+        configuration details. Only providers visible to the role can be attached
+        to the integration.
       summary: Create a new integration
       tags:
       - Integration
@@ -6810,7 +6813,7 @@ paths:
     post:
       operationId: api_v1_integrations_jira_dispatches_create
       description: |-
-        Send a set of filtered findings to the given integration. At least one finding filter must be provided.
+        Send a set of filtered findings to the given integration. At least one finding filter must be provided. Jira integrations are tenant-wide and do not require unlimited visibility, while the findings sent are limited to the providers the role can access.
 
         ## Known Limitations
 
@@ -6883,7 +6886,8 @@ paths:
     get:
       operationId: api_v1_integrations_jira_issue_types_retrieve
       description: Fetch the available issue types from Jira for a given project key
-        and update the integration configuration.
+        and update the integration configuration. Jira integrations are tenant-wide
+        and do not require unlimited visibility.
       summary: Get available issue types for a Jira project
       parameters:
       - in: query
@@ -6924,7 +6928,8 @@ paths:
     get:
       operationId: api_v1_integrations_retrieve
       description: Fetch detailed information about a specific integration by its
-        ID.
+        ID. Integrations outside the provider visibility of the role are reported
+        the same way as one that does not exist.
       summary: Retrieve integration details
       parameters:
       - in: query
@@ -6978,7 +6983,8 @@ paths:
     patch:
       operationId: api_v1_integrations_partial_update
       description: Modify certain fields of an existing integration without affecting
-        other settings.
+        other settings. Integrations attached to providers outside the visibility
+        of the role cannot be modified by it.
       summary: Partially update an integration
       parameters:
       - in: path
@@ -7013,7 +7019,8 @@ paths:
           description: ''
     delete:
       operationId: api_v1_integrations_destroy
-      description: Remove an integration from the system by its ID.
+      description: Remove an integration from the system by its ID. Integrations attached
+        to providers outside the visibility of the role cannot be deleted by it.
       summary: Delete an integration
       parameters:
       - in: path
@@ -7033,7 +7040,9 @@ paths:
   /api/v1/integrations/{id}/connection:
     post:
       operationId: api_v1_integrations_connection_create
-      description: Try to verify integration connection
+      description: Try to verify integration connection. Integrations outside the
+        provider visibility of the role are reported the same way as one that does
+        not exist.
       summary: Check integration connection
       parameters:
       - in: path

api/src/backend/api/tests/integration/test_authentication.py

@@ -4,8 +4,11 @@ from datetime import UTC, datetime, timedelta
 from uuid import uuid4
 
 import pytest
+from api.db_router import MainRouter
 from api.models import Membership, Role, TenantAPIKey, User, UserRoleRelationship
+from api.signals import revoke_membership_api_keys, revoke_user_api_keys
 from conftest import TEST_PASSWORD, get_api_tokens, get_authorization_header
+from django.db.utils import ConnectionDoesNotExist
 from django.urls import reverse
 from drf_simple_apikey.crypto import get_crypto
 from rest_framework.test import APIClient
@@ -625,6 +628,34 @@ class TestAPIKeyErrors:
         assert response.status_code == 401
         assert "API Key has been revoked." in response.json()["errors"][0]["detail"]
 
+    def test_orphaned_api_key_rejected(
+        self, create_test_user, tenants_fixture, api_keys_fixture
+    ):
+        """Key whose owning user was deleted returns 401 instead of 500."""
+        client = APIClient()
+
+        api_key = api_keys_fixture[0]
+        # `on_delete=SET_NULL` leaves the key behind with no entity when the owner goes
+        TenantAPIKey.objects.filter(id=api_key.id).update(entity=None)
+
+        api_key_headers = get_api_key_header(api_key._raw_key)
+        response = client.get(reverse("provider-list"), headers=api_key_headers)
+
+        assert response.status_code == 401
+        assert (
+            "No entity matching this api key." in response.json()["errors"][0]["detail"]
+        )
+
+        # The orphaned key is revoked on use; retries fail the regular revoked check
+        api_key.refresh_from_db()
+        assert api_key.revoked is True
+
+        retry_response = client.get(reverse("provider-list"), headers=api_key_headers)
+        assert retry_response.status_code == 401
+        assert (
+            "API Key has been revoked." in retry_response.json()["errors"][0]["detail"]
+        )
+
     def test_non_existent_api_key(self, create_test_user, tenants_fixture):
         """Key UUID doesn't exist in database."""
         client = APIClient()
@@ -817,6 +848,93 @@ class TestAPIKeyTenantIsolation:
         error_detail = response_json["errors"][0]["detail"]
         assert "revoked" in error_detail.lower()
 
+    def test_deleting_user_revokes_api_keys_in_every_tenant(self, tenants_fixture):
+        """Deleting a user revokes their keys in all their tenants, not just one."""
+        first_tenant, second_tenant = tenants_fixture[0], tenants_fixture[1]
+
+        test_user = User.objects.create_user(
+            name="multi_tenant_user",
+            email="multi_tenant_user@prowler.com",
+            password=TEST_PASSWORD,
+        )
+        for tenant in (first_tenant, second_tenant):
+            Membership.objects.create(
+                user=test_user, tenant=tenant, role=Membership.RoleChoices.OWNER
+            )
+
+        first_key, _ = TenantAPIKey.objects.create_api_key(
+            name="Key in first tenant", tenant_id=first_tenant.id, entity=test_user
+        )
+        second_key, _ = TenantAPIKey.objects.create_api_key(
+            name="Key in second tenant", tenant_id=second_tenant.id, entity=test_user
+        )
+
+        test_user.delete()
+
+        first_key.refresh_from_db()
+        second_key.refresh_from_db()
+        assert first_key.revoked is True
+        assert second_key.revoked is True
+        # `on_delete=SET_NULL` orphans the keys, so revoking them is what keeps them
+        # from authenticating
+        assert first_key.entity_id is None
+        assert second_key.entity_id is None
+
+    def test_revoke_user_api_keys_uses_the_admin_connection(
+        self, monkeypatch, tenants_fixture
+    ):
+        """The revocation must not go through the default connection.
+
+        `api_keys` is RLS protected and its policy denies every row when `api.tenant_id`
+        is unset, which is the case while a user is deleted through the admin
+        connection: the update would silently revoke nothing and leave usable orphaned
+        keys behind.
+
+        Pointing `admin_db` at a missing alias is the only way to assert the connection
+        here, because the test suite runs on a single superuser database with
+        `MainRouter.admin_db` patched to "default" (see `conftest.py`), so RLS never
+        applies and both connections are otherwise indistinguishable.
+        """
+        test_user = User.objects.create_user(
+            name="admin_connection_user",
+            email="admin_connection_user@prowler.com",
+            password=TEST_PASSWORD,
+        )
+        Membership.objects.create(user=test_user, tenant=tenants_fixture[0])
+        TenantAPIKey.objects.create_api_key(
+            name="Key for admin connection check",
+            tenant_id=tenants_fixture[0].id,
+            entity=test_user,
+        )
+
+        monkeypatch.setattr(MainRouter, "admin_db", "missing_admin_alias")
+
+        with pytest.raises(ConnectionDoesNotExist):
+            revoke_user_api_keys(sender=User, instance=test_user)
+
+    def test_revoke_membership_api_keys_uses_the_admin_connection(
+        self, monkeypatch, tenants_fixture
+    ):
+        """Same as the user deletion case: this receiver also runs as its cascade."""
+        test_user = User.objects.create_user(
+            name="admin_connection_membership_user",
+            email="admin_connection_membership_user@prowler.com",
+            password=TEST_PASSWORD,
+        )
+        membership = Membership.objects.create(
+            user=test_user, tenant=tenants_fixture[0]
+        )
+        TenantAPIKey.objects.create_api_key(
+            name="Key for membership admin connection check",
+            tenant_id=tenants_fixture[0].id,
+            entity=test_user,
+        )
+
+        monkeypatch.setattr(MainRouter, "admin_db", "missing_admin_alias")
+
+        with pytest.raises(ConnectionDoesNotExist):
+            revoke_membership_api_keys(sender=Membership, instance=membership)
+
 
 @pytest.mark.django_db
 class TestAPIKeyLifecycle:
@@ -1472,8 +1590,8 @@ class TestAPIKeyMultiTenantWorkflows:
         tenant1 = tenants_fixture[0]
         tenant2 = tenants_fixture[1]
 
-        Membership.objects.create(user=user, tenant=tenant1)
-        Membership.objects.create(user=user, tenant=tenant2)
+        membership1 = Membership.objects.create(user=user, tenant=tenant1)
+        membership2 = Membership.objects.create(user=user, tenant=tenant2)
 
         role1 = Role.objects.create(
             tenant_id=tenant1.id,
@@ -1528,6 +1646,27 @@ class TestAPIKeyMultiTenantWorkflows:
         assert me_response1.json()["data"]["id"] == str(user.id)
         assert me_response2.json()["data"]["id"] == str(user.id)
 
+        memberships1 = {
+            item["id"]: item["meta"]["active"]
+            for item in me_response1.json()["data"]["relationships"]["memberships"][
+                "data"
+            ]
+        }
+        memberships2 = {
+            item["id"]: item["meta"]["active"]
+            for item in me_response2.json()["data"]["relationships"]["memberships"][
+                "data"
+            ]
+        }
+        assert memberships1 == {
+            str(membership1.id): True,
+            str(membership2.id): False,
+        }
+        assert memberships2 == {
+            str(membership1.id): False,
+            str(membership2.id): True,
+        }
+
     def test_api_key_cannot_access_different_tenant_resources(
         self, tenants_fixture, aws_provider
     ):

api/src/backend/api/tests/test_adapters.py

@@ -10,10 +10,12 @@ from allauth.socialaccount import app_settings as socialaccount_app_settings
 from allauth.socialaccount.internal.flows.login import complete_login
 from allauth.socialaccount.models import SocialAccount, SocialLogin
 from api.adapters import ProwlerSocialAccountAdapter
-from api.db_router import MainRouter
+from api.db_router import MainRouter, get_write_db_alias
 from api.models import Invitation, Membership, SAMLConfiguration, Tenant
 from django.contrib.auth import get_user_model
 from django.core import mail
+from django.db import connections
+from django.db import router as django_router
 
 User = get_user_model()
 
@@ -382,6 +384,65 @@ class TestProwlerSocialAccountAdapter:
             role=Membership.RoleChoices.MEMBER,
         ).exists()
 
+    def test_save_user_routes_initial_allauth_write_to_admin_and_resets_on_error(
+        self, rf
+    ):
+        adapter = ProwlerSocialAccountAdapter()
+        request = rf.get("/")
+        request.session = {}
+        sociallogin = _oauth_sociallogin(
+            User(name="Frank", email="frank-routing@example.com")
+        )
+
+        def fail_after_checking_write_route(*_args, **_kwargs):
+            assert (
+                MainRouter().db_for_write(User, instance=sociallogin.user)
+                == MainRouter.admin_db
+            )
+            raise RuntimeError("Stop after checking the write route.")
+
+        with (
+            patch("api.adapters.super") as mock_super,
+            patch("api.adapters.transaction.atomic"),
+            patch.object(MainRouter, "admin_db", "admin"),
+            pytest.raises(RuntimeError, match="Stop after checking the write route"),
+        ):
+            mock_super.return_value.save_user.side_effect = (
+                fail_after_checking_write_route
+            )
+            adapter.save_user(request, sociallogin)
+
+        assert get_write_db_alias() is None
+
+    def test_save_user_rolls_back_all_signup_records_on_downstream_error(self, rf):
+        adapter = ProwlerSocialAccountAdapter()
+        request = rf.post("/")
+        request.session = {}
+        email = "frank-rollback@example.com"
+        sociallogin = _real_oauth_sociallogin(
+            User(name="Frank", email=email),
+            uid="frank-rollback-google-account",
+        )
+        tenants_before = Tenant.objects.count()
+
+        with (
+            patch(
+                "api.adapters.rls_transaction",
+                side_effect=RuntimeError("Simulated downstream failure."),
+            ),
+            pytest.raises(RuntimeError, match="Simulated downstream failure"),
+        ):
+            adapter.save_user(request, sociallogin)
+
+        assert not User.objects.filter(email=email).exists()
+        assert not SocialAccount.objects.filter(
+            provider="google",
+            uid="frank-rollback-google-account",
+        ).exists()
+        assert not EmailAddress.objects.filter(email=email).exists()
+        assert Tenant.objects.count() == tenants_before
+        assert get_write_db_alias() is None
+
     def test_save_user_saml_sets_session_flag(self, rf):
         adapter = ProwlerSocialAccountAdapter()
         request = rf.get("/")
@@ -402,3 +463,104 @@ class TestProwlerSocialAccountAdapter:
                     mock_super.return_value.save_user.return_value = mock_user
                     adapter.save_user(request, sociallogin)
                     assert request.session["saml_user_created"] == "123"
+
+
+@pytest.mark.requires_test_admin_alias
+@pytest.mark.django_db(transaction=True, databases=["default", "admin"])
+class TestProwlerSocialAccountAdapterMultiDatabase:
+    @staticmethod
+    def _production_router():
+        return patch.object(django_router, "routers", [MainRouter()])
+
+    def test_save_user_rolls_back_across_production_database_aliases(self, rf):
+        adapter = ProwlerSocialAccountAdapter()
+        request = rf.post("/")
+        request.session = {}
+        email = "frank-multidb-rollback@example.com"
+        sociallogin = _real_oauth_sociallogin(
+            User(name="Frank", email=email),
+            uid="frank-multidb-rollback-google-account",
+        )
+        tenants_before = Tenant.objects.using("admin").count()
+
+        assert connections["default"] is not connections["admin"]
+        assert (
+            connections["default"].settings_dict["NAME"]
+            == connections["admin"].settings_dict["NAME"]
+        )
+
+        def fail_after_allauth_save(*_args, **_kwargs):
+            assert sociallogin.user._state.db == MainRouter.admin_db
+            assert connections["default"].get_autocommit()
+            assert not connections["admin"].get_autocommit()
+            raise RuntimeError("Simulated downstream failure.")
+
+        with (
+            patch.object(MainRouter, "admin_db", "admin"),
+            self._production_router(),
+            patch("api.adapters.rls_transaction", side_effect=fail_after_allauth_save),
+            pytest.raises(RuntimeError, match="Simulated downstream failure"),
+        ):
+            adapter.save_user(request, sociallogin)
+
+        assert connections["default"].get_autocommit()
+        assert connections["admin"].get_autocommit()
+        assert not User.objects.using("default").filter(email=email).exists()
+        assert not User.objects.using("admin").filter(email=email).exists()
+        assert (
+            not SocialAccount.objects.using("admin")
+            .filter(
+                provider="google",
+                uid="frank-multidb-rollback-google-account",
+            )
+            .exists()
+        )
+        assert not EmailAddress.objects.using("admin").filter(email=email).exists()
+        assert Tenant.objects.using("admin").count() == tenants_before
+        assert get_write_db_alias() is None
+
+    def test_save_user_commits_complete_signup_across_production_aliases(self, rf):
+        adapter = ProwlerSocialAccountAdapter()
+        request = rf.post("/")
+        request.session = {}
+        email = "frank-multidb-success@example.com"
+        sociallogin = _real_oauth_sociallogin(
+            User(name="Frank", email=email),
+            uid="frank-multidb-success-google-account",
+        )
+
+        with (
+            patch.object(MainRouter, "admin_db", "admin"),
+            self._production_router(),
+        ):
+            user = adapter.save_user(request, sociallogin)
+
+        user = User.objects.using("admin").get(id=user.id)
+        assert user.email == email
+        assert (
+            SocialAccount.objects.using("admin")
+            .filter(
+                user_id=user.id,
+                provider="google",
+                uid="frank-multidb-success-google-account",
+            )
+            .exists()
+        )
+        assert (
+            EmailAddress.objects.using("admin")
+            .filter(
+                user_id=user.id,
+                email=email,
+                verified=True,
+            )
+            .exists()
+        )
+        assert (
+            Membership.objects.using("admin")
+            .filter(
+                user_id=user.id,
+                role=Membership.RoleChoices.OWNER,
+            )
+            .exists()
+        )
+        assert get_write_db_alias() is None

api/src/backend/api/tests/test_attack_paths.py

@@ -154,6 +154,88 @@ def test_execute_query_serializes_graph(
     assert result["relationships"][0]["label"] == "OWNS"
 
 
+def test_execute_query_injects_provider_label_when_migrated(
+    attack_paths_query_definition_factory,
+    sink_backend_stub,
+):
+    # On migrated graphs the predefined cypher must be scoped with the
+    # provider label so the planner seeds from the label index instead of a
+    # global label scan (the Neptune cartesian/timeout fix).
+    definition = attack_paths_query_definition_factory(
+        id="aws-iam",
+        name="IAM",
+        short_description="Short desc",
+        description="",
+        cypher="MATCH (aws:AWSAccount)--(target_role:AWSRole) RETURN target_role",
+        parameters=[],
+    )
+    provider_id = "test-provider-123"
+    plabel = get_provider_label(provider_id)
+    parameters = {"provider_uid": "123"}
+
+    graph_result = MagicMock()
+    graph_result.nodes = []
+    graph_result.relationships = []
+    sink_backend_stub.execute_read_query.return_value = graph_result
+
+    # Injection is gated on `is_migrated`, not the sink (it is a pure string
+    # transform), so `neo4j` exercises the same code path as Neptune here.
+    views_helpers.execute_query(
+        "db-tenant-test",
+        definition,
+        parameters,
+        provider_id=provider_id,
+        scan=MagicMock(is_migrated=True, sink_backend="neo4j"),
+    )
+
+    executed_cypher = sink_backend_stub.execute_read_query.call_args[0][1]
+    assert executed_cypher != definition.cypher
+    # Both node patterns are scoped - not just one. Asserting the exact rewrite
+    # (rather than `f":{plabel}" in executed_cypher`, which a partial injection
+    # would still satisfy) proves every node got the label and that injection
+    # inserted labels and nothing else.
+    assert executed_cypher == (
+        f"MATCH (aws:AWSAccount:{plabel})--(target_role:AWSRole:{plabel}) "
+        "RETURN target_role"
+    )
+    # Parameters are passed through untouched.
+    assert sink_backend_stub.execute_read_query.call_args[0][2] == parameters
+
+
+def test_execute_query_does_not_inject_label_when_deprecated(
+    attack_paths_query_definition_factory,
+    sink_backend_stub,
+):
+    # The pre-cutover legacy catalog runs on the old sink and is removed after
+    # the Neptune cutover, so it must run verbatim (no injection).
+    definition = attack_paths_query_definition_factory(
+        id="aws-iam",
+        name="IAM",
+        short_description="Short desc",
+        description="",
+        cypher="MATCH (aws:AWSAccount)--(target_role:AWSRole) RETURN target_role",
+        parameters=[],
+    )
+    parameters = {"provider_uid": "123"}
+
+    graph_result = MagicMock()
+    graph_result.nodes = []
+    graph_result.relationships = []
+    sink_backend_stub.execute_read_query.return_value = graph_result
+
+    views_helpers.execute_query(
+        "db-tenant-test",
+        definition,
+        parameters,
+        provider_id="test-provider-123",
+        scan=MagicMock(is_migrated=False, sink_backend="neo4j"),
+    )
+
+    sink_backend_stub.execute_read_query.assert_called_once_with(
+        "db-tenant-test", definition.cypher, parameters
+    )
+
+
 def test_execute_query_wraps_graph_errors(
     attack_paths_query_definition_factory,
     sink_backend_stub,

api/src/backend/api/tests/test_attack_paths_queries.py

@@ -0,0 +1,292 @@
+"""
+Structural validation tests for Attack Paths query definitions.
+
+These tests verify that each query in the AWS_QUERIES registry meets the
+schema and convention requirements documented in
+`docs/developer-guide/attack-paths-queries.mdx` without requiring a live
+graph connection. They deliberately assert the conventions that keep queries
+functional and Neptune-compatible: list-typed policy properties are reached
+through `HAS_*` child-item traversals (never read as node fields), predicate
+functions unsupported on Neptune (`any`/`all`/`none`, regex `=~`) are absent,
+the finding probe is typed and filters only on `status`, and the `RETURN`
+shape preserves the `paths, dpf, dpfr` contract.
+"""
+
+import re
+
+import pytest
+from api.attack_paths.queries.aws import (
+    AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY,
+    AWS_QUERIES,
+    AWS_SSO_PRIVESC_PERMISSION_SET_ESCALATION,
+    AWS_STS_PRIVESC_CROSS_ACCOUNT_TRUST,
+    AWS_STS_PRIVESC_WILDCARD_TRUST,
+)
+from api.attack_paths.queries.types import (
+    AttackPathsQueryDefinition,
+    AttackPathsQueryOutcome,
+)
+
+# The pathfinding.cloud privilege-escalation queries added for PROWLER-2278.
+NEW_PATHFINDING_QUERIES = [
+    AWS_STS_PRIVESC_CROSS_ACCOUNT_TRUST,
+    AWS_STS_PRIVESC_WILDCARD_TRUST,
+    AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY,
+    AWS_SSO_PRIVESC_PERMISSION_SET_ESCALATION,
+]
+
+# Cypher keywords that indicate a mutating query (not allowed; queries are read-only).
+MUTATING_KEYWORDS = re.compile(
+    r"\b(CREATE|MERGE|SET|DELETE|REMOVE|DETACH)\b", re.IGNORECASE
+)
+
+# CALL subquery: unsupported by Neptune openCypher.
+CALL_SUBQUERY_PATTERN = re.compile(r"\bCALL\s*\{", re.IGNORECASE)
+
+# Predicate functions that are not part of the openCypher spec and fail on Neptune.
+NEPTUNE_UNSUPPORTED_PREDICATES = re.compile(r"\b(any|all|none)\s*\(", re.IGNORECASE)
+
+# The list-typed policy properties that are exploded into child item nodes at sync
+# time and popped off the parent, so reading them as a field always yields null.
+NORMALIZED_STATEMENT_FIELDS = ("action", "resource", "notaction", "notresource")
+
+
+class TestNewPathfindingQueriesRegistered:
+    """Every new query is present in the AWS_QUERIES registry."""
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_query_in_registry(self, query):
+        assert query in AWS_QUERIES
+
+
+class TestNewPathfindingQueriesSchema:
+    """Required fields and naming conventions for each new query."""
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_is_query_definition_instance(self, query):
+        assert isinstance(query, AttackPathsQueryDefinition)
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_id_is_kebab_case(self, query):
+        assert re.match(r"^[a-z0-9]+(-[a-z0-9]+)*$", query.id), (
+            f"Query id '{query.id}' is not kebab-case"
+        )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_id_starts_with_aws(self, query):
+        assert query.id.startswith("aws-")
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_provider_is_aws(self, query):
+        assert query.provider == "aws"
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_has_name(self, query):
+        assert query.name and len(query.name) > 5
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_has_short_description(self, query):
+        assert query.short_description and len(query.short_description) > 10
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_has_description(self, query):
+        assert query.description and len(query.description) > 20
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_has_attribution(self, query):
+        assert query.attribution is not None
+        assert "pathfinding.cloud" in query.attribution.text
+        assert query.attribution.link.startswith("https://pathfinding.cloud/paths/")
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_parameters_is_list(self, query):
+        assert isinstance(query.parameters, list)
+
+
+class TestNewPathfindingQueriesCypher:
+    """Cypher content, conventions, and Neptune compatibility."""
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_not_empty(self, query):
+        assert query.cypher and len(query.cypher.strip()) > 0
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_under_10000_chars(self, query):
+        assert len(query.cypher) < 10000, (
+            f"Query {query.id} exceeds 10,000 character limit "
+            f"({len(query.cypher)} chars)"
+        )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_uses_provider_uid_parameter(self, query):
+        assert "$provider_uid" in query.cypher, (
+            f"Query {query.id} missing $provider_uid parameter"
+        )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_finding_label_interpolated(self, query):
+        # The f-string should have interpolated PROWLER_FINDING_LABEL already.
+        assert "PROWLER_FINDING_LABEL" not in query.cypher, (
+            f"Query {query.id} has unresolved PROWLER_FINDING_LABEL "
+            "(f-string not applied)"
+        )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_finding_probe_is_typed_and_status_scoped(self, query):
+        # The finding probe must be typed HAS_FINDING (so Neptune applies an inline
+        # edge filter) and gate on FAIL status only. ProwlerFinding nodes carry no
+        # provider_uid property, so a probe that filters on it never matches.
+        assert re.search(
+            r"-\[pfr:HAS_FINDING\]-\(pf:ProwlerFinding \{status: 'FAIL'\}\)",
+            query.cypher,
+        ), f"Query {query.id} does not use the typed, status-scoped finding probe"
+        assert "provider_uid:$provider_uid}" not in query.cypher.replace(" ", ""), (
+            f"Query {query.id} filters the finding node on a non-existent "
+            "provider_uid property"
+        )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_is_read_only(self, query):
+        cypher_no_comments = _strip_comment_lines(query.cypher)
+        match = MUTATING_KEYWORDS.search(cypher_no_comments)
+        assert match is None, (
+            f"Query {query.id} contains mutating keyword: '{match.group()}'"
+        )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_no_call_subquery(self, query):
+        assert not CALL_SUBQUERY_PATTERN.search(query.cypher), (
+            f"Query {query.id} uses a CALL subquery (not Neptune-compatible)"
+        )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_no_neptune_unsupported_predicates(self, query):
+        match = NEPTUNE_UNSUPPORTED_PREDICATES.search(query.cypher)
+        assert match is None, (
+            f"Query {query.id} uses '{match.group().strip()}' predicate function; "
+            "use size([x IN list WHERE pred]) > 0 for Neptune compatibility"
+        )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_no_regex_operator(self, query):
+        assert "=~" not in query.cypher, (
+            f"Query {query.id} uses the regex operator '=~'; "
+            "use CONTAINS / STARTS WITH for Neptune compatibility"
+        )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_does_not_read_normalized_list_fields(self, query):
+        # action/resource/notaction/notresource are materialized as child item nodes
+        # and popped off AWSPolicyStatement, so `stmt.action` etc. are always null.
+        for field in NORMALIZED_STATEMENT_FIELDS:
+            assert not re.search(rf"\.{field}\b", query.cypher), (
+                f"Query {query.id} reads the normalized list field "
+                f"'.{field}' as a node property; traverse the HAS_"
+                f"{field.upper()} edge to the child item node instead"
+            )
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_preserves_return_contract(self, query):
+        assert re.search(
+            r"RETURN paths, collect\(DISTINCT pf\) as dpf, "
+            r"collect\(DISTINCT pfr\) as dpfr",
+            query.cypher,
+        ), f"Query {query.id} does not preserve the 'paths, dpf, dpfr' RETURN contract"
+
+    @pytest.mark.parametrize("query", NEW_PATHFINDING_QUERIES, ids=lambda q: q.id)
+    def test_cypher_anchored_on_account(self, query):
+        assert "(aws:AWSAccount {id: $provider_uid})" in query.cypher, (
+            f"Query {query.id} is not anchored on the AWSAccount node"
+        )
+
+
+class TestNewPathfindingQueriesAccuracy:
+    """Query-specific contracts that prevent known false positives."""
+
+    def test_wildcard_trust_is_presented_as_a_manual_review_candidate(self):
+        query = AWS_STS_PRIVESC_WILDCARD_TRUST
+        text = f"{query.name} {query.short_description} {query.description}".lower()
+        assert all(
+            word in text
+            for word in ("potential", "effect", "condition", "manual review")
+        )
+
+    def test_permissions_boundary_removal_is_scoped_to_the_same_user(self):
+        query = AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY
+        assert "(principal:AWSUser)" in query.cypher
+        assert (
+            "(stmt)-[:HAS_RESOURCE]->(res:AWSPolicyStatementResourceItem)"
+            in query.cypher
+        )
+        assert "principal.arn" in query.cypher
+        assert "manual review" in query.description.lower()
+
+    def test_permission_set_escalation_requires_global_resources(self):
+        query = AWS_SSO_PRIVESC_PERMISSION_SET_ESCALATION
+        for suffix in ("", "2", "3"):
+            resource_match = (
+                f"(stmt{suffix})-[:HAS_RESOURCE]->"
+                f"(res{suffix}:AWSPolicyStatementResourceItem)"
+            )
+            assert resource_match in query.cypher
+            assert f"WHERE res{suffix}.value = '*'" in query.cypher
+
+
+class TestAllQueriesUniqueIds:
+    """No duplicate IDs in the full registry."""
+
+    def test_no_duplicate_ids_in_aws_queries(self):
+        ids = [q.id for q in AWS_QUERIES]
+        duplicates = sorted({qid for qid in ids if ids.count(qid) > 1})
+        assert not duplicates, f"Duplicate query IDs found: {duplicates}"
+
+
+class TestQueryOutcomes:
+    """Every query carries a valid outcome (the graph's terminal impact)."""
+
+    def test_every_query_has_an_outcome(self):
+        # Completeness guard: a new query must be given an outcome, so the UI can
+        # always render a terminal outcome node.
+        missing = [q.id for q in AWS_QUERIES if q.outcome is None]
+        assert not missing, f"Queries without an outcome: {missing}"
+
+    def test_every_outcome_is_a_valid_member(self):
+        for query in AWS_QUERIES:
+            assert isinstance(query.outcome, AttackPathsQueryOutcome)
+            assert query.outcome.value.kind
+            assert query.outcome.value.label
+
+    @pytest.mark.parametrize(
+        "query, expected",
+        [
+            (
+                AWS_STS_PRIVESC_CROSS_ACCOUNT_TRUST,
+                AttackPathsQueryOutcome.PRIVILEGE_ESCALATION,
+            ),
+            (
+                AWS_IAM_PRIVESC_DELETE_USER_PERMISSIONS_BOUNDARY,
+                AttackPathsQueryOutcome.PRIVILEGE_ESCALATION,
+            ),
+        ],
+        ids=lambda v: getattr(v, "id", getattr(v, "name", "")),
+    )
+    def test_representative_outcomes(self, query, expected):
+        assert query.outcome is expected
+
+    def test_inventory_outcome_is_partial(self):
+        assert AttackPathsQueryOutcome.RESOURCE_INVENTORY.value.partial is True
+
+    def test_realized_outcomes_are_not_partial(self):
+        for outcome in (
+            AttackPathsQueryOutcome.CODE_EXECUTION,
+            AttackPathsQueryOutcome.PRIVILEGE_ESCALATION,
+            AttackPathsQueryOutcome.PUBLIC_EXPOSURE,
+        ):
+            assert outcome.value.partial is False
+
+
+def _strip_comment_lines(cypher: str) -> str:
+    """Drop `//` comment lines so keyword scans ignore prose in comments."""
+    return "\n".join(
+        line for line in cypher.split("\n") if not line.strip().startswith("//")
+    )

api/src/backend/api/tests/test_attack_paths_service_privesc_queries.py

@@ -0,0 +1,133 @@
+"""
+Structural validation for the pathfinding.cloud service privilege-escalation
+Attack Paths queries added in PROWLER-2279.
+
+These assert the conventions documented in
+`docs/developer-guide/attack-paths-queries.mdx`: list-typed policy properties are
+reached through `HAS_*` child-item traversals (never read as node fields),
+predicate functions unsupported on Neptune (`any`/`all`/`none`, regex `=~`) are
+absent, the finding probe is typed and filters only on `status`, and the
+`RETURN` shape preserves the `paths, dpf, dpfr` contract.
+"""
+
+import re
+
+import pytest
+from api.attack_paths.queries.aws import AWS_QUERIES
+from api.attack_paths.queries.types import AttackPathsQueryDefinition
+
+# IDs of the queries introduced for PROWLER-2279 (pathfinding.cloud coverage).
+PATHFINDING_2279_QUERY_IDS = [
+    "aws-batch-privesc-passrole-submit-job",
+    "aws-braket-privesc-passrole-create-job",
+    "aws-cognito-privesc-passrole-set-identity-pool-roles",
+    "aws-ecs-privesc-passrole-start-existing-task",
+    "aws-emr-privesc-passrole-run-job-flow",
+    "aws-emrserverless-privesc-passrole-start-job",
+    "aws-gamelift-privesc-passrole-create-fleet",
+    "aws-glue-privesc-passrole-create-session",
+    "aws-imagebuilder-privesc-passrole-create-image",
+    "aws-kinesisanalytics-privesc-passrole-create-application",
+    "aws-omics-privesc-passrole-start-run",
+    "aws-scheduler-privesc-passrole-create-schedule",
+    "aws-ssm-privesc-passrole-automation",
+    "aws-stepfunctions-privesc-passrole-create-state-machine",
+    "aws-batch-privesc-submit-existing-job",
+    "aws-codedeploy-privesc-create-deployment",
+    "aws-stepfunctions-privesc-update-state-machine",
+    "aws-iam-privesc-delete-role-boundary-assume-role",
+    "aws-sso-privesc-attach-managed-policy-permission-set",
+    "aws-sso-privesc-put-inline-policy-permission-set",
+]
+
+_BY_ID = {q.id: q for q in AWS_QUERIES}
+NEW_QUERIES = [_BY_ID[qid] for qid in PATHFINDING_2279_QUERY_IDS if qid in _BY_ID]
+
+NEPTUNE_UNSUPPORTED_PREDICATES = re.compile(r"\b(any|all|none)\s*\(", re.IGNORECASE)
+NORMALIZED_STATEMENT_FIELDS = ("action", "resource", "notaction", "notresource")
+
+
+def test_all_2279_queries_registered():
+    missing = [qid for qid in PATHFINDING_2279_QUERY_IDS if qid not in _BY_ID]
+    assert not missing, f"queries not registered in AWS_QUERIES: {missing}"
+
+
+class TestServicePrivescQuerySchema:
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_is_query_definition(self, query):
+        assert isinstance(query, AttackPathsQueryDefinition)
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_id_kebab_and_aws_prefixed(self, query):
+        assert query.id.startswith("aws-")
+        assert re.match(r"^[a-z0-9]+(-[a-z0-9]+)*$", query.id)
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_provider_is_aws(self, query):
+        assert query.provider == "aws"
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_has_metadata(self, query):
+        assert query.name and len(query.name) > 5
+        assert query.short_description and len(query.short_description) > 10
+        assert query.description and len(query.description) > 20
+        assert isinstance(query.parameters, list)
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_attribution_links_pathfinding(self, query):
+        assert query.attribution is not None
+        assert "pathfinding.cloud" in query.attribution.text
+        assert query.attribution.link.startswith("https://pathfinding.cloud/paths/")
+
+
+class TestServicePrivescQueryCypher:
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_anchored_and_provider_scoped(self, query):
+        assert "(aws:AWSAccount {id: $provider_uid})" in query.cypher
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_finding_label_interpolated(self, query):
+        assert "PROWLER_FINDING_LABEL" not in query.cypher
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_typed_status_scoped_finding_probe(self, query):
+        assert re.search(
+            r"-\[pfr:HAS_FINDING\]-\(pf:ProwlerFinding \{status: 'FAIL'\}\)",
+            query.cypher,
+        ), f"{query.id} lacks the typed, status-scoped finding probe"
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_return_contract(self, query):
+        assert re.search(
+            r"RETURN paths, collect\(DISTINCT pf\) as dpf, "
+            r"collect\(DISTINCT pfr\) as dpfr",
+            query.cypher,
+        )
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_no_neptune_unsupported_predicates(self, query):
+        m = NEPTUNE_UNSUPPORTED_PREDICATES.search(query.cypher)
+        assert m is None, f"{query.id} uses '{m.group().strip()}' (not Neptune-safe)"
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_no_regex_operator(self, query):
+        assert "=~" not in query.cypher
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_does_not_read_normalized_list_fields(self, query):
+        for field in NORMALIZED_STATEMENT_FIELDS:
+            assert not re.search(rf"\.{field}\b", query.cypher), (
+                f"{query.id} reads normalized list field '.{field}' as a property; "
+                f"traverse the HAS_{field.upper()} edge instead"
+            )
+
+    @pytest.mark.parametrize("query", NEW_QUERIES, ids=lambda q: q.id)
+    def test_read_only(self, query):
+        no_comments = "\n".join(
+            line
+            for line in query.cypher.split("\n")
+            if not line.strip().startswith("//")
+        )
+        assert not re.search(
+            r"\b(CREATE|MERGE|SET|DELETE|REMOVE|DETACH)\b", no_comments, re.IGNORECASE
+        )

api/src/backend/api/tests/test_authentication.py

@@ -4,11 +4,17 @@ from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
 import pytest
-from api.authentication import SSEAuthentication, TenantAPIKeyAuthentication
+from api.authentication import (
+    OrphanedAPIKeyError,
+    SSEAuthentication,
+    TenantAPIKeyAuthentication,
+)
 from api.db_router import MainRouter
 from api.models import TenantAPIKey
+from django.db import connections
 from django.db.models.query import QuerySet
 from django.test import RequestFactory
+from django.test.utils import CaptureQueriesContext
 from rest_framework.exceptions import AuthenticationFailed
 
 
@@ -38,13 +44,12 @@ class TestTenantAPIKeyAuthentication:
         request = request_factory.get("/")
 
         # Call the method
-        entity, auth_dict = auth_backend._authenticate_credentials(
-            request, encrypted_key
-        )
+        validated_key = auth_backend._authenticate_credentials(request, encrypted_key)
 
         # Verify that the entity is the user associated with the API key
-        assert entity == api_key.entity
-        assert entity.id == api_key.entity.id
+        assert validated_key.id == api_key.id
+        assert validated_key.entity == api_key.entity
+        assert validated_key.entity.id == api_key.entity.id
 
     def test_authenticate_credentials_restores_manager_on_success(
         self, auth_backend, api_keys_fixture, request_factory
@@ -231,6 +236,120 @@ class TestTenantAPIKeyAuthentication:
 
         assert str(exc_info.value.detail) == "This API Key has been revoked."
 
+    def test_authenticate_credentials_orphaned_api_key(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test credential validation fails when the owning user no longer exists."""
+        api_key = api_keys_fixture[0]
+        _, encrypted_key = api_key._raw_key.split(TenantAPIKey.objects.separator, 1)
+
+        # `entity` is what `on_delete=SET_NULL` leaves behind when the owner is deleted
+        TenantAPIKey.objects.filter(id=api_key.id).update(entity=None)
+
+        request = request_factory.get("/")
+
+        with pytest.raises(OrphanedAPIKeyError):
+            auth_backend._authenticate_credentials(request, encrypted_key)
+
+        # The orphaned key is revoked on use, so it stops showing up as active
+        api_key.refresh_from_db()
+        assert api_key.revoked is True
+
+    def test_authenticate_orphaned_api_key(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test authentication fails with a key whose owning user was deleted.
+
+        Regression test: this used to raise `AttributeError: 'NoneType' object has no
+        attribute 'id'` while building the auth dict, which DRF re-raises as
+        `WrappedAttributeError` and turns into a 500 instead of a 401.
+        """
+        api_key = api_keys_fixture[0]
+        raw_key = api_key._raw_key
+
+        TenantAPIKey.objects.filter(id=api_key.id).update(entity=None)
+
+        request = request_factory.get("/")
+        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {raw_key}"
+
+        with pytest.raises(AuthenticationFailed) as exc_info:
+            auth_backend.authenticate(request)
+
+        assert str(exc_info.value.detail) == "No entity matching this api key."
+
+        # The orphaned key is revoked on use; retries fail the regular revoked check
+        api_key.refresh_from_db()
+        assert api_key.revoked is True
+
+        with pytest.raises(AuthenticationFailed) as exc_info:
+            auth_backend.authenticate(request)
+
+        assert str(exc_info.value.detail) == "This API Key has been revoked."
+
+    def test_authenticate_reads_the_api_key_once_under_a_row_lock(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test the API key is read a single time and the row is locked.
+
+        Validation, the `last_used_at` update and the claims must all come from the
+        same authoritative row: a second, unlocked lookup would reopen the window
+        where a key revoked in between still authenticates.
+        """
+        api_key = api_keys_fixture[0]
+
+        request = request_factory.get("/")
+        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"
+
+        with CaptureQueriesContext(connections[MainRouter.admin_db]) as captured:
+            auth_backend.authenticate(request)
+
+        api_key_selects = [
+            query["sql"]
+            for query in captured.captured_queries
+            if query["sql"].startswith("SELECT") and '"api_keys"' in query["sql"]
+        ]
+
+        assert len(api_key_selects) == 1
+        assert "FOR UPDATE" in api_key_selects[0]
+
+    def test_authenticate_ignores_revocation_after_the_locked_read(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test the claims describe the row that was validated, not a later state.
+
+        Regression test: the key used to be looked up again to build the auth dict,
+        without rechecking `revoked` or `entity`. A key revoked or orphaned between
+        both reads still authenticated, and the claims came from that stale row. With
+        a single locked read the write below cannot land mid-authentication, and the
+        revocation only takes effect on the next request.
+        """
+        api_key = api_keys_fixture[0]
+        entity_at_validation = api_key.entity
+        original_save = TenantAPIKey.save
+
+        def revoke_and_orphan_before_saving(instance, *args, **kwargs):
+            # Runs after validation, right before the claims are built: the exact
+            # window a concurrent revocation or user deletion used to slip into
+            TenantAPIKey.objects.filter(id=api_key.id).update(revoked=True, entity=None)
+            return original_save(instance, *args, **kwargs)
+
+        request = request_factory.get("/")
+        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"
+
+        with patch.object(TenantAPIKey, "save", revoke_and_orphan_before_saving):
+            entity, auth_dict = auth_backend.authenticate(request)
+
+        assert entity == entity_at_validation
+        assert auth_dict["sub"] == str(entity_at_validation.id)
+        assert auth_dict["tenant_id"] == str(api_key.tenant_id)
+        assert auth_dict["api_key_prefix"] == api_key.prefix
+
+        # The revoked key is rejected from the next request on
+        with pytest.raises(AuthenticationFailed) as exc_info:
+            auth_backend.authenticate(request)
+
+        assert str(exc_info.value.detail) == "This API Key has been revoked."
+
     def test_authenticate_expired_api_key(
         self, auth_backend, create_test_user, tenants_fixture, request_factory
     ):

api/src/backend/api/tests/test_cypher_sanitizer.py

@@ -1,5 +1,6 @@
 """Unit tests for the Cypher sanitizer (validation + provider-label injection)."""
 
+import re
 from unittest.mock import patch
 
 import pytest
@@ -22,6 +23,38 @@ def _inject(cypher: str) -> str:
         return inject_provider_label(cypher, PROVIDER_ID)
 
 
+# String literals and line comments can contain parentheses that look like node
+# patterns; strip them first. Implemented here independently of the sanitizer so
+# the node count is an oracle for the injector rather than a copy of its regexes.
+_STRING_OR_COMMENT_RE = re.compile(r"'(?:[^'\\]|\\.)*'|\"(?:[^\"\\]|\\.)*\"|//[^\n]*")
+
+# A node pattern is `(`, not preceded by a word char (which would make it a
+# function call), wrapping an optional variable, zero or more `:Label`s and an
+# optional `{property map}` - and nothing else, which excludes parenthesized
+# expressions such as `(a OR b)` in a WHERE clause.
+_NODE_PATTERN_RE = re.compile(
+    r"(?<![\w`])\("
+    r"\s*(?:[a-zA-Z_]\w*)?"
+    r"(?:\s*:\s*(?:`[^`]*`|[a-zA-Z_]\w*))*"
+    r"(?:\s*\{[^{}]*\})?"
+    r"\s*\)"
+)
+
+
+def _count_node_patterns(cypher: str) -> int:
+    """Count node patterns in a query, independently of the injector.
+
+    Injection appends exactly one provider label per node pattern, so the
+    number of injected labels must equal this count - proving *every* node is
+    scoped, not just one."""
+    stripped = _STRING_OR_COMMENT_RE.sub("", cypher)
+    return sum(
+        1
+        for match in _NODE_PATTERN_RE.finditer(stripped)
+        if match.group(0)[1:-1].strip()
+    )
+
+
 def test_generic_inject_label_reuses_provider_injection_pipeline():
     result = inject_label("MATCH (n:AWSRole)--(m) RETURN n, m", "_Tenant_test")
 
@@ -427,3 +460,66 @@ class TestValidation:
     )
     def test_allows_clean_queries(self, cypher):
         validate_custom_query(cypher)
+
+
+# ---------------------------------------------------------------------------
+# Predefined-catalog injection (Option 1: label-scoped predefined queries)
+# ---------------------------------------------------------------------------
+
+
+def _all_predefined_queries():
+    """Every predefined query in the migrated catalog, as (id, cypher)."""
+    from api.attack_paths.queries.registry import _QUERY_DEFINITIONS
+
+    return [
+        (definition.id, definition.cypher)
+        for definitions in _QUERY_DEFINITIONS.values()
+        for definition in definitions
+    ]
+
+
+_PREDEFINED_QUERIES = _all_predefined_queries()
+
+
+class TestPredefinedCatalogInjection:
+    """`execute_query` injects the provider label into predefined queries on
+    migrated graphs. The injection must be *lossless* for every catalog query:
+    it may only insert `:_Provider_{uuid}` tokens and must not otherwise alter
+    the cypher (which would corrupt a hand-authored query). This runs over the
+    whole catalog so a regex regression is caught for all queries at once.
+
+    Injection is a pure string transform, so it is sink-independent (the same
+    result is sent to Neo4j and Neptune)."""
+
+    def test_catalog_is_not_empty(self):
+        # Guard against the parametrized tests silently covering nothing.
+        assert len(_PREDEFINED_QUERIES) > 0
+
+    @pytest.mark.parametrize(
+        "cypher",
+        [cypher for _, cypher in _PREDEFINED_QUERIES],
+        ids=[query_id for query_id, _ in _PREDEFINED_QUERIES],
+    )
+    def test_injection_is_lossless(self, cypher):
+        injected = _inject(cypher)
+
+        # Every node pattern is scoped - not just one. A partial-injection
+        # regression that missed some nodes would still satisfy a bare
+        # `f":{LABEL}" in injected` check, so assert the label count matches the
+        # number of node patterns.
+        assert injected.count(f":{LABEL}") == _count_node_patterns(cypher)
+        # Stripping the injected tokens restores the query verbatim, proving
+        # injection changed nothing but the labels.
+        assert injected.replace(f":{LABEL}", "") == cypher
+
+    @pytest.mark.parametrize(
+        "cypher",
+        [cypher for _, cypher in _PREDEFINED_QUERIES],
+        ids=[query_id for query_id, _ in _PREDEFINED_QUERIES],
+    )
+    def test_injection_preserves_parameter_placeholders(self, cypher):
+        # Label injection must never touch `$param` bindings.
+        original_params = sorted(set(re.findall(r"\$\w+", cypher)))
+        injected_params = sorted(set(re.findall(r"\$\w+", _inject(cypher))))
+
+        assert injected_params == original_params

api/src/backend/api/tests/test_database.py

@@ -1,7 +1,13 @@
-from unittest.mock import patch
+from unittest.mock import Mock, patch
 
 import pytest
-from api.db_router import MainRouter
+from api.db_router import (
+    MainRouter,
+    get_write_db_alias,
+    reset_write_db_alias,
+    set_write_db_alias,
+    write_db_alias,
+)
 from api.rls import Tenant
 from config.django.base import DATABASE_ROUTERS as PROD_DATABASE_ROUTERS
 from django.conf import settings
@@ -26,6 +32,66 @@ class TestMainDatabaseRouter:
         assert router.allow_migrate_model(MainRouter.admin_db, api_model)
         assert not router.allow_migrate_model("default", api_model)
 
+    def test_scoped_write_alias_routes_api_models(self, router):
+        token = set_write_db_alias(MainRouter.admin_db)
+        try:
+            assert get_write_db_alias() == MainRouter.admin_db
+            assert router.db_for_write(Tenant) == MainRouter.admin_db
+        finally:
+            reset_write_db_alias(token)
+
+        assert get_write_db_alias() is None
+        assert router.db_for_write(Tenant) == "default"
+
+    def test_scoped_write_alias_restores_nested_context(self, router):
+        outer_token = set_write_db_alias("outer")
+        try:
+            assert router.db_for_write(Tenant) == "outer"
+
+            inner_token = set_write_db_alias(MainRouter.admin_db)
+            try:
+                assert router.db_for_write(Tenant) == MainRouter.admin_db
+            finally:
+                reset_write_db_alias(inner_token)
+
+            assert router.db_for_write(Tenant) == "outer"
+        finally:
+            reset_write_db_alias(outer_token)
+
+        assert get_write_db_alias() is None
+        assert router.db_for_write(Tenant) == "default"
+
+    def test_scoped_write_alias_does_not_override_admin_models(self, router):
+        token = set_write_db_alias("other")
+        try:
+            assert (
+                router.db_for_write(MigrationRecorder.Migration) == MainRouter.admin_db
+            )
+        finally:
+            reset_write_db_alias(token)
+
+        assert get_write_db_alias() is None
+
+    def test_write_db_alias_context_manager_resets_after_error(self, router):
+        fail = Mock(side_effect=RuntimeError("Simulated failure"))
+
+        with pytest.raises(RuntimeError, match="Simulated failure"):
+            with write_db_alias(MainRouter.admin_db):
+                assert get_write_db_alias() == MainRouter.admin_db
+                assert router.db_for_write(Tenant) == MainRouter.admin_db
+                fail()
+
+        fail.assert_called_once_with()
+        assert get_write_db_alias() is None
+        assert router.db_for_write(Tenant) == "default"
+
+    def test_write_db_alias_context_manager_ignores_empty_alias(self, router):
+        with write_db_alias(None):
+            assert get_write_db_alias() is None
+            assert router.db_for_write(Tenant) == "default"
+
+        assert get_write_db_alias() is None
+
     def test_router_django_models(self, router):
         assert router.db_for_read(MigrationRecorder.Migration) == MainRouter.admin_db
         assert not router.db_for_read(MigrationRecorder.Migration) == "default"

api/src/backend/api/tests/test_rbac.py

@@ -2,12 +2,17 @@ import json
 from unittest.mock import ANY, Mock, patch
 
 import pytest
+from api.db_utils import rls_transaction
 from api.models import (
+    Integration,
+    IntegrationProviderRelationship,
     Membership,
     ProviderGroup,
     ProviderGroupMembership,
+    ProviderSecret,
     Role,
     RoleProviderGroupRelationship,
+    Scan,
     User,
     UserRoleRelationship,
 )
@@ -664,6 +669,612 @@ class TestLimitedVisibility:
             limited_admin_user, tenants_fixture[0]
         )
 
+    @pytest.fixture
+    def hidden_provider_secret(self, aws_provider_pair):
+        hidden_provider = aws_provider_pair[1]
+        return ProviderSecret.objects.create(
+            tenant_id=hidden_provider.tenant_id,
+            provider=hidden_provider,
+            secret_type=ProviderSecret.TypeChoices.STATIC,
+            secret={
+                "aws_access_key_id": "hidden-key",
+                "aws_secret_access_key": "hidden-secret",
+            },
+            name="Hidden provider secret",
+        )
+
+    @pytest.fixture
+    def limited_provider_group(self, limited_admin_user):
+        return ProviderGroup.objects.get(name="limited_visibility_group")
+
+    @patch("api.v1.views.enqueue_scan_execution_on_commit")
+    def test_scan_create_out_of_scope_provider_is_rejected(
+        self,
+        mock_enqueue_scan,
+        authenticated_client_rbac_limited,
+        aws_provider_pair,
+    ):
+        hidden_provider = aws_provider_pair[1]
+
+        response = authenticated_client_rbac_limited.post(
+            reverse("scan-list"),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "scans",
+                        "attributes": {"name": "Out of scope scan"},
+                        "relationships": {
+                            "provider": {
+                                "data": {
+                                    "type": "providers",
+                                    "id": str(hidden_provider.id),
+                                }
+                            }
+                        },
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert not Scan.objects.filter(
+            provider=hidden_provider, name="Out of scope scan"
+        ).exists()
+        mock_enqueue_scan.assert_not_called()
+
+    @patch("api.v1.views.enqueue_scan_execution_on_commit")
+    def test_scan_create_in_scope_provider_is_accepted(
+        self,
+        mock_enqueue_scan,
+        authenticated_client_rbac_limited,
+        aws_provider,
+    ):
+        response = authenticated_client_rbac_limited.post(
+            reverse("scan-list"),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "scans",
+                        "attributes": {"name": "In scope scan"},
+                        "relationships": {
+                            "provider": {
+                                "data": {
+                                    "type": "providers",
+                                    "id": str(aws_provider.id),
+                                }
+                            }
+                        },
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        assert Scan.objects.filter(provider=aws_provider, name="In scope scan").exists()
+        mock_enqueue_scan.assert_called_once()
+
+    def test_provider_secret_retrieve_out_of_scope_returns_404(
+        self,
+        authenticated_client_rbac_limited,
+        hidden_provider_secret,
+    ):
+        response = authenticated_client_rbac_limited.get(
+            reverse(
+                "providersecret-detail",
+                kwargs={"pk": hidden_provider_secret.id},
+            )
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_provider_secret_list_excludes_out_of_scope_provider(
+        self,
+        authenticated_client_rbac_limited,
+        hidden_provider_secret,
+    ):
+        response = authenticated_client_rbac_limited.get(reverse("providersecret-list"))
+
+        assert response.status_code == status.HTTP_200_OK
+        assert str(hidden_provider_secret.id) not in {
+            item["id"] for item in response.json()["data"]
+        }
+
+    def test_provider_secret_create_out_of_scope_provider_is_rejected(
+        self,
+        authenticated_client_rbac_limited,
+        aws_provider_pair,
+    ):
+        hidden_provider = aws_provider_pair[1]
+        response = authenticated_client_rbac_limited.post(
+            reverse("providersecret-list"),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "provider-secrets",
+                        "attributes": {
+                            "name": "Out of scope secret",
+                            "secret_type": ProviderSecret.TypeChoices.STATIC,
+                            "secret": {
+                                "aws_access_key_id": "hidden-key",
+                                "aws_secret_access_key": "hidden-secret",
+                            },
+                        },
+                        "relationships": {
+                            "provider": {
+                                "data": {
+                                    "type": "providers",
+                                    "id": str(hidden_provider.id),
+                                }
+                            }
+                        },
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert not ProviderSecret.objects.filter(provider=hidden_provider).exists()
+
+    def test_provider_secret_create_in_scope_provider_is_accepted(
+        self,
+        authenticated_client_rbac_limited,
+        aws_provider,
+    ):
+        response = authenticated_client_rbac_limited.post(
+            reverse("providersecret-list"),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "provider-secrets",
+                        "attributes": {
+                            "name": "In scope secret",
+                            "secret_type": ProviderSecret.TypeChoices.STATIC,
+                            "secret": {
+                                "aws_access_key_id": "visible-key",
+                                "aws_secret_access_key": "visible-secret",
+                            },
+                        },
+                        "relationships": {
+                            "provider": {
+                                "data": {
+                                    "type": "providers",
+                                    "id": str(aws_provider.id),
+                                }
+                            }
+                        },
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        assert ProviderSecret.objects.filter(provider=aws_provider).exists()
+
+    def test_provider_secret_update_out_of_scope_returns_404(
+        self,
+        authenticated_client_rbac_limited,
+        hidden_provider_secret,
+    ):
+        response = authenticated_client_rbac_limited.patch(
+            reverse(
+                "providersecret-detail",
+                kwargs={"pk": hidden_provider_secret.id},
+            ),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "provider-secrets",
+                        "id": str(hidden_provider_secret.id),
+                        "attributes": {"name": "Updated hidden secret"},
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+        hidden_provider_secret.refresh_from_db()
+        assert hidden_provider_secret.name == "Hidden provider secret"
+
+    def test_provider_secret_delete_out_of_scope_returns_404(
+        self,
+        authenticated_client_rbac_limited,
+        hidden_provider_secret,
+    ):
+        response = authenticated_client_rbac_limited.delete(
+            reverse(
+                "providersecret-detail",
+                kwargs={"pk": hidden_provider_secret.id},
+            )
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+        assert ProviderSecret.objects.filter(id=hidden_provider_secret.id).exists()
+
+    def test_provider_group_create_out_of_scope_provider_is_rejected(
+        self,
+        authenticated_client_rbac_limited,
+        aws_provider_pair,
+    ):
+        hidden_provider = aws_provider_pair[1]
+        response = authenticated_client_rbac_limited.post(
+            reverse("providergroup-list"),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "provider-groups",
+                        "attributes": {"name": "Out of scope group"},
+                        "relationships": {
+                            "providers": {
+                                "data": [
+                                    {
+                                        "type": "providers",
+                                        "id": str(hidden_provider.id),
+                                    }
+                                ]
+                            }
+                        },
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert not ProviderGroup.objects.filter(name="Out of scope group").exists()
+
+    def test_provider_group_create_in_scope_provider_is_accepted(
+        self,
+        authenticated_client_rbac_limited,
+        aws_provider,
+    ):
+        response = authenticated_client_rbac_limited.post(
+            reverse("providergroup-list"),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "provider-groups",
+                        "attributes": {"name": "In scope group"},
+                        "relationships": {
+                            "providers": {
+                                "data": [
+                                    {
+                                        "type": "providers",
+                                        "id": str(aws_provider.id),
+                                    }
+                                ]
+                            }
+                        },
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        provider_group = ProviderGroup.objects.get(name="In scope group")
+        assert set(provider_group.providers.all()) == {aws_provider}
+
+    def test_provider_group_update_out_of_scope_provider_is_rejected(
+        self,
+        authenticated_client_rbac_limited,
+        limited_provider_group,
+        aws_provider_pair,
+    ):
+        visible_provider, hidden_provider = aws_provider_pair
+        response = authenticated_client_rbac_limited.patch(
+            reverse(
+                "providergroup-detail",
+                kwargs={"pk": limited_provider_group.id},
+            ),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "provider-groups",
+                        "id": str(limited_provider_group.id),
+                        "relationships": {
+                            "providers": {
+                                "data": [
+                                    {
+                                        "type": "providers",
+                                        "id": str(hidden_provider.id),
+                                    }
+                                ]
+                            }
+                        },
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert set(limited_provider_group.providers.all()) == {visible_provider}
+
+    def test_provider_group_relationship_create_out_of_scope_provider_is_rejected(
+        self,
+        authenticated_client_rbac_limited,
+        limited_provider_group,
+        aws_provider_pair,
+    ):
+        hidden_provider = aws_provider_pair[1]
+        response = authenticated_client_rbac_limited.post(
+            reverse(
+                "provider_group-providers-relationship",
+                kwargs={"pk": limited_provider_group.id},
+            ),
+            data={
+                "data": [
+                    {"type": "providers", "id": str(hidden_provider.id)},
+                ]
+            },
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert not ProviderGroupMembership.objects.filter(
+            provider_group=limited_provider_group,
+            provider=hidden_provider,
+        ).exists()
+
+    def test_provider_group_relationship_update_out_of_scope_provider_is_rejected(
+        self,
+        authenticated_client_rbac_limited,
+        limited_provider_group,
+        aws_provider_pair,
+    ):
+        visible_provider, hidden_provider = aws_provider_pair
+        response = authenticated_client_rbac_limited.patch(
+            reverse(
+                "provider_group-providers-relationship",
+                kwargs={"pk": limited_provider_group.id},
+            ),
+            data={
+                "data": [
+                    {"type": "providers", "id": str(hidden_provider.id)},
+                ]
+            },
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert set(limited_provider_group.providers.all()) == {visible_provider}
+
+    def test_provider_group_relationship_create_in_scope_provider_is_accepted(
+        self,
+        authenticated_client_rbac_limited,
+        limited_provider_group,
+        aws_provider_pair,
+    ):
+        additional_provider = aws_provider_pair[1]
+        additional_group = ProviderGroup.objects.create(
+            tenant_id=additional_provider.tenant_id,
+            name="Additional visible group",
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=additional_provider.tenant_id,
+            provider_group=additional_group,
+            provider=additional_provider,
+        )
+        RoleProviderGroupRelationship.objects.create(
+            tenant_id=additional_provider.tenant_id,
+            role=limited_provider_group.roles.get(),
+            provider_group=additional_group,
+        )
+
+        response = authenticated_client_rbac_limited.post(
+            reverse(
+                "provider_group-providers-relationship",
+                kwargs={"pk": limited_provider_group.id},
+            ),
+            data={
+                "data": [
+                    {"type": "providers", "id": str(additional_provider.id)},
+                ]
+            },
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        assert ProviderGroupMembership.objects.filter(
+            provider_group=limited_provider_group,
+            provider=additional_provider,
+        ).exists()
+
+    def test_provider_group_relationship_delete_out_of_scope_group_returns_404(
+        self,
+        authenticated_client_rbac_limited,
+        aws_provider_pair,
+    ):
+        hidden_provider = aws_provider_pair[1]
+        hidden_group = ProviderGroup.objects.create(
+            tenant_id=hidden_provider.tenant_id,
+            name="Unassigned provider group",
+        )
+        ProviderGroupMembership.objects.create(
+            tenant_id=hidden_provider.tenant_id,
+            provider_group=hidden_group,
+            provider=hidden_provider,
+        )
+
+        response = authenticated_client_rbac_limited.delete(
+            reverse(
+                "provider_group-providers-relationship",
+                kwargs={"pk": hidden_group.id},
+            )
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+        assert ProviderGroupMembership.objects.filter(
+            provider_group=hidden_group,
+            provider=hidden_provider,
+        ).exists()
+
+    @patch("api.v1.views.Task.objects.get")
+    @patch("api.v1.views.delete_provider_task.delay")
+    def test_provider_delete_out_of_scope_returns_404(
+        self,
+        mock_delete_task,
+        mock_task_get,
+        authenticated_client_rbac_limited,
+        aws_provider_pair,
+        tasks_fixture,
+    ):
+        hidden_provider = aws_provider_pair[1]
+        prowler_task = tasks_fixture[0]
+        mock_delete_task.return_value.id = prowler_task.id
+        mock_task_get.return_value = prowler_task
+
+        response = authenticated_client_rbac_limited.delete(
+            reverse("provider-detail", kwargs={"pk": hidden_provider.id})
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+        hidden_provider.refresh_from_db()
+        assert hidden_provider.is_deleted is False
+        mock_delete_task.assert_not_called()
+        mock_task_get.assert_not_called()
+
+    @patch("api.v1.views.Task.objects.get")
+    @patch("api.v1.views.delete_provider_task.delay")
+    def test_provider_delete_in_scope_returns_202(
+        self,
+        mock_delete_task,
+        mock_task_get,
+        authenticated_client_rbac_limited,
+        aws_provider,
+        tasks_fixture,
+    ):
+        prowler_task = tasks_fixture[0]
+        mock_delete_task.return_value.id = prowler_task.id
+        mock_task_get.return_value = prowler_task
+
+        response = authenticated_client_rbac_limited.delete(
+            reverse("provider-detail", kwargs={"pk": aws_provider.id})
+        )
+
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        mock_delete_task.assert_called_once_with(
+            provider_id=str(aws_provider.id), tenant_id=ANY
+        )
+        mock_task_get.assert_called_once_with(id=prowler_task.id)
+
+    @patch("api.v1.views.Task.objects.get")
+    @patch("api.v1.views.check_provider_connection_task.delay")
+    def test_provider_connection_out_of_scope_returns_404(
+        self,
+        mock_provider_connection,
+        mock_task_get,
+        authenticated_client_rbac_limited,
+        aws_provider_pair,
+        tasks_fixture,
+    ):
+        hidden_provider = aws_provider_pair[1]
+        prowler_task = tasks_fixture[0]
+        mock_provider_connection.return_value.id = prowler_task.id
+        mock_task_get.return_value = prowler_task
+
+        response = authenticated_client_rbac_limited.post(
+            reverse("provider-connection", kwargs={"pk": hidden_provider.id})
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+        mock_provider_connection.assert_not_called()
+        mock_task_get.assert_not_called()
+
+    @patch("api.v1.views.Task.objects.get")
+    @patch("api.v1.views.check_provider_connection_task.delay")
+    def test_provider_connection_in_scope_returns_202(
+        self,
+        mock_provider_connection,
+        mock_task_get,
+        authenticated_client_rbac_limited,
+        aws_provider,
+        tasks_fixture,
+    ):
+        prowler_task = tasks_fixture[0]
+        mock_provider_connection.return_value.id = prowler_task.id
+        mock_task_get.return_value = prowler_task
+
+        response = authenticated_client_rbac_limited.post(
+            reverse("provider-connection", kwargs={"pk": aws_provider.id})
+        )
+
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        mock_provider_connection.assert_called_once_with(
+            provider_id=str(aws_provider.id), tenant_id=ANY
+        )
+        mock_task_get.assert_called_once_with(id=prowler_task.id)
+
+    @patch("api.v1.views.Task.objects.get")
+    @patch("api.v1.views.schedule_provider_scan")
+    def test_schedule_daily_out_of_scope_returns_404(
+        self,
+        mock_schedule_scan,
+        mock_task_get,
+        authenticated_client_rbac_limited,
+        aws_provider_pair,
+        tasks_fixture,
+    ):
+        hidden_provider = aws_provider_pair[1]
+        prowler_task = tasks_fixture[0]
+        mock_schedule_scan.return_value.id = prowler_task.id
+        mock_task_get.return_value = prowler_task
+
+        response = authenticated_client_rbac_limited.post(
+            reverse("schedule-daily"),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "daily-schedules",
+                        "attributes": {"provider_id": str(hidden_provider.id)},
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.wsgi_request.content_type == "application/vnd.api+json"
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+        mock_schedule_scan.assert_not_called()
+        mock_task_get.assert_not_called()
+
+    @patch("api.v1.views.Task.objects.get")
+    @patch("api.v1.views.schedule_provider_scan")
+    def test_schedule_daily_in_scope_returns_202(
+        self,
+        mock_schedule_scan,
+        mock_task_get,
+        authenticated_client_rbac_limited,
+        aws_provider,
+        tasks_fixture,
+    ):
+        prowler_task = tasks_fixture[0]
+        mock_schedule_scan.return_value.id = prowler_task.id
+        mock_task_get.return_value = prowler_task
+
+        response = authenticated_client_rbac_limited.post(
+            reverse("schedule-daily"),
+            data=json.dumps(
+                {
+                    "data": {
+                        "type": "daily-schedules",
+                        "attributes": {"provider_id": str(aws_provider.id)},
+                    }
+                }
+            ),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.wsgi_request.content_type == "application/vnd.api+json"
+        assert response.status_code == status.HTTP_202_ACCEPTED
+        mock_schedule_scan.assert_called_once_with(aws_provider)
+        mock_task_get.assert_called_once_with(id=prowler_task.id)
+
     def test_integrations(
         self, authenticated_client_rbac_limited, integrations_fixture
     ):
@@ -681,6 +1292,363 @@ class TestLimitedVisibility:
             response.json()["data"]["relationships"]["providers"]["meta"]["count"] == 1
         )
 
+    @pytest.fixture
+    def out_of_scope_integration(self, tenants_fixture, provider_factory):
+        tenant_id = tenants_fixture[0].id
+        integration = Integration.objects.create(
+            tenant_id=tenant_id,
+            enabled=True,
+            connected=True,
+            integration_type=Integration.IntegrationChoices.AMAZON_S3,
+            configuration={
+                "bucket_name": "bucket",
+                "output_directory": "output",
+            },
+            credentials={"aws_access_key_id": "key"},
+        )
+        IntegrationProviderRelationship.objects.create(
+            tenant_id=tenant_id,
+            integration=integration,
+            provider=provider_factory(),
+        )
+        return integration
+
+    def test_integrations_list_includes_tenant_wide_integration(
+        self,
+        authenticated_client_rbac_limited,
+        integrations_fixture,
+        jira_integration_fixture,
+        aws_provider_pair,
+    ):
+        # Integration 2 is attached to both providers, so make both visible to the role
+        # to assert the provider join does not duplicate it in the listing
+        ProviderGroupMembership.objects.create(
+            tenant_id=aws_provider_pair[1].tenant_id,
+            provider=aws_provider_pair[1],
+            provider_group=ProviderGroup.objects.get(name="limited_visibility_group"),
+        )
+
+        response = authenticated_client_rbac_limited.get(reverse("integration-list"))
+
+        assert response.status_code == status.HTTP_200_OK
+        integration_ids = [item["id"] for item in response.json()["data"]]
+        # The tenant-wide Jira integration is visible without unlimited visibility
+        assert str(jira_integration_fixture.id) in integration_ids
+        # Integrations attached to more than one visible provider are not duplicated
+        assert integration_ids.count(str(integrations_fixture[1].id)) == 1
+        assert response.json()["meta"]["pagination"]["count"] == len(integration_ids)
+
+    def test_integrations_list_without_provider_groups_keeps_tenant_wide_integration(
+        self,
+        authenticated_client_rbac_limited,
+        integrations_fixture,
+        jira_integration_fixture,
+    ):
+        # A role with no provider group at all sees no provider, but still needs Jira
+        RoleProviderGroupRelationship.objects.all().delete()
+
+        response = authenticated_client_rbac_limited.get(reverse("integration-list"))
+
+        assert response.status_code == status.HTTP_200_OK
+        integration_ids = [item["id"] for item in response.json()["data"]]
+        assert integration_ids == [str(jira_integration_fixture.id)]
+
+    def test_integrations_include_providers_hides_out_of_scope_providers(
+        self, authenticated_client_rbac_limited, integrations_fixture, aws_provider_pair
+    ):
+        # Integration 2 is related to provider1 (visible) and provider2 (not visible)
+        hidden_provider = aws_provider_pair[1]
+
+        response = authenticated_client_rbac_limited.get(
+            reverse("integration-list"), {"include": "providers"}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        included_ids = {item["id"] for item in response.json().get("included", [])}
+        assert str(aws_provider_pair[0].id) in included_ids
+        # Sideloaded resources must not disclose the provider the role cannot see
+        assert str(hidden_provider.id) not in included_ids
+
+    def test_integrations_list_with_sparse_fields(
+        self,
+        authenticated_client_rbac_limited,
+        integrations_fixture,
+        jira_integration_fixture,
+    ):
+        response = authenticated_client_rbac_limited.get(
+            reverse("integration-list"), {"fields[integrations]": "enabled"}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert str(jira_integration_fixture.id) in [
+            item["id"] for item in response.json()["data"]
+        ]
+        assert all(
+            list(item["attributes"].keys()) == ["enabled"]
+            for item in response.json()["data"]
+        )
+
+    def test_integrations_list_excludes_out_of_scope_integration(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.get(reverse("integration-list"))
+
+        assert response.status_code == status.HTTP_200_OK
+        integration_ids = [item["id"] for item in response.json()["data"]]
+        assert str(out_of_scope_integration.id) not in integration_ids
+
+    def test_integration_detail_out_of_scope_returns_404(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.get(
+            reverse("integration-detail", kwargs={"pk": out_of_scope_integration.id})
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_integration_connection_out_of_scope_returns_404(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.post(
+            reverse(
+                "integration-connection", kwargs={"pk": out_of_scope_integration.id}
+            )
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_integration_update_allowed_when_fully_visible(
+        self,
+        authenticated_client_rbac_limited,
+        integrations_fixture,
+        jira_integration_fixture,
+    ):
+        # Integration 1 is only related to provider1, which the role can access
+        integration = integrations_fixture[0]
+        payload = {
+            "data": {
+                "type": "integrations",
+                "id": str(integration.id),
+                "attributes": {
+                    "enabled": False,
+                    # integration_type is `amazon_s3`
+                    "credentials": {"aws_access_key_id": "new_value"},
+                    "configuration": {
+                        "bucket_name": "new_bucket_name",
+                        "output_directory": "new_output_directory",
+                    },
+                },
+            }
+        }
+
+        response = authenticated_client_rbac_limited.patch(
+            reverse("integration-detail", kwargs={"pk": integration.id}),
+            data=json.dumps(payload),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        integration.refresh_from_db()
+        assert integration.enabled is False
+
+        # Tenant-wide integrations have no provider restricting the role
+        payload = {
+            "data": {
+                "type": "integrations",
+                "id": str(jira_integration_fixture.id),
+                "attributes": {"enabled": False},
+            }
+        }
+
+        response = authenticated_client_rbac_limited.patch(
+            reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id}),
+            data=json.dumps(payload),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        with rls_transaction(str(jira_integration_fixture.tenant_id)):
+            jira_integration_fixture.refresh_from_db()
+        assert jira_integration_fixture.enabled is False
+
+    def test_integration_create_rejects_out_of_scope_provider(
+        self, authenticated_client_rbac_limited, aws_provider_pair
+    ):
+        # provider2 is not in any provider group assigned to the role
+        payload = {
+            "data": {
+                "type": "integrations",
+                "attributes": {
+                    "integration_type": "amazon_s3",
+                    "configuration": {
+                        "bucket_name": "attacker_bucket",
+                        "output_directory": "output",
+                    },
+                    "credentials": {"aws_access_key_id": "key"},
+                },
+                "relationships": {
+                    "providers": {
+                        "data": [
+                            {"type": "providers", "id": str(aws_provider_pair[1].id)}
+                        ]
+                    }
+                },
+            }
+        }
+
+        response = authenticated_client_rbac_limited.post(
+            reverse("integration-list"),
+            data=json.dumps(payload),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert not Integration.objects.filter(
+            integrationproviderrelationship__provider=aws_provider_pair[1],
+            configuration__bucket_name="attacker_bucket",
+        ).exists()
+
+    @pytest.mark.parametrize("submitted_providers", [True, False])
+    def test_integration_update_denied_when_shared_with_hidden_provider(
+        self,
+        authenticated_client_rbac_limited,
+        integrations_fixture,
+        aws_provider_pair,
+        submitted_providers,
+    ):
+        # Integration 2 is related to provider1 (visible) and provider2 (not visible).
+        # Editing it would reach beyond the visibility of the role, just like deleting
+        # it, so both are rejected consistently
+        integration = integrations_fixture[1]
+        visible_provider, hidden_provider = aws_provider_pair
+        payload = {
+            "data": {
+                "type": "integrations",
+                "id": str(integration.id),
+                "attributes": {
+                    "enabled": False,
+                    # integration_type is `amazon_s3`
+                    "credentials": {"aws_access_key_id": "new_value"},
+                    "configuration": {
+                        "bucket_name": "new_bucket_name",
+                        "output_directory": "new_output_directory",
+                    },
+                },
+            }
+        }
+        if submitted_providers:
+            payload["data"]["relationships"] = {
+                "providers": {
+                    "data": [{"type": "providers", "id": str(visible_provider.id)}]
+                }
+            }
+
+        response = authenticated_client_rbac_limited.patch(
+            reverse("integration-detail", kwargs={"pk": integration.id}),
+            data=json.dumps(payload),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+        integration.refresh_from_db()
+        assert integration.enabled is True
+        assert integration.providers.filter(id=hidden_provider.id).exists()
+        assert integration.providers.filter(id=visible_provider.id).exists()
+
+    def test_integration_delete_denied_when_shared_with_hidden_provider(
+        self, authenticated_client_rbac_limited, integrations_fixture
+    ):
+        # Integration 2 is related to provider1 (visible) and provider2 (not visible)
+        integration = integrations_fixture[1]
+
+        response = authenticated_client_rbac_limited.delete(
+            reverse("integration-detail", kwargs={"pk": integration.id})
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+        assert Integration.objects.filter(id=integration.id).exists()
+
+    def test_integration_delete_allowed_when_fully_visible(
+        self,
+        authenticated_client_rbac_limited,
+        integrations_fixture,
+        jira_integration_fixture,
+    ):
+        # Integration 1 is only related to provider1, which the role can access
+        integration = integrations_fixture[0]
+
+        response = authenticated_client_rbac_limited.delete(
+            reverse("integration-detail", kwargs={"pk": integration.id})
+        )
+
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        assert not Integration.objects.filter(id=integration.id).exists()
+
+        # Tenant-wide integrations have no provider restricting the role
+        response = authenticated_client_rbac_limited.delete(
+            reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id})
+        )
+
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+
+    def test_jira_issue_types_allowed_without_unlimited_visibility(
+        self, authenticated_client_rbac_limited, jira_integration_fixture
+    ):
+        with patch("api.v1.views.initialize_prowler_integration") as mock_jira:
+            mock_jira.return_value.get_available_issue_types.return_value = ["Task"]
+            response = authenticated_client_rbac_limited.get(
+                reverse(
+                    "integration-jira-issue-types",
+                    kwargs={"integration_pk": jira_integration_fixture.id},
+                ),
+                {"project_key": "TEST"},
+            )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json()["data"]["attributes"]["issue_types"] == ["Task"]
+
+    def test_jira_issue_types_out_of_scope_returns_404(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.get(
+            reverse(
+                "integration-jira-issue-types",
+                kwargs={"integration_pk": out_of_scope_integration.id},
+            ),
+            {"project_key": "TEST"},
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_jira_dispatches_out_of_scope_returns_404(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.post(
+            reverse(
+                "integration-jira-dispatches",
+                kwargs={"integration_pk": out_of_scope_integration.id},
+            ),
+            data=json.dumps({}),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_jira_dispatches_allowed_without_unlimited_visibility(
+        self, authenticated_client_rbac_limited, jira_integration_fixture
+    ):
+        response = authenticated_client_rbac_limited.post(
+            reverse(
+                "integration-jira-dispatches",
+                kwargs={"integration_pk": jira_integration_fixture.id},
+            ),
+            data=json.dumps({}),
+            content_type="application/vnd.api+json",
+        )
+
+        # The integration is reachable: the request fails on payload validation, not RBAC
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+
     @pytest.mark.usefixtures("scan_summaries_fixture")
     def test_overviews_providers(
         self,

api/src/backend/api/tests/test_sentry.py

@@ -1,9 +1,10 @@
+import errno
 import logging
 from unittest.mock import MagicMock, patch
 
 import pytest
 from config.settings import sentry as sentry_settings
-from config.settings.sentry import before_send
+from config.settings.sentry import before_send, errno_fingerprint
 
 
 def test_initialize_sentry_skips_without_dsn():
@@ -188,3 +189,165 @@ def test_before_send_passes_non_defunct_neo4j_log():
     event = MagicMock()
 
     assert before_send(event, hint) == event
+
+
+def _filesystem_hint(exception, msg="Error generating output directory"):
+    """Build the hint the logging integration sends for a filesystem failure."""
+    exc_info = (type(exception), exception, exception.__traceback__)
+    log_record = _make_log_record(msg)
+    log_record.exc_info = exc_info
+    setattr(
+        log_record,
+        sentry_settings.ERROR_CATEGORY_ATTRIBUTE,
+        sentry_settings.FILESYSTEM_ERROR_CATEGORY,
+    )
+    return {"log_record": log_record, "exc_info": exc_info}
+
+
+@pytest.mark.parametrize(
+    ("error_number", "message", "expected_suffix"),
+    [
+        (errno.ENOSPC, "No space left on device", "errno:ENOSPC"),
+        (errno.ENOENT, "No such file or directory", "errno:ENOENT"),
+        (errno.EACCES, "Permission denied", "errno:EACCES"),
+    ],
+)
+def test_before_send_fingerprints_oserror_by_errno(
+    error_number, message, expected_suffix
+):
+    """Filesystem failures raised from the same call site must not be merged."""
+    event = {}
+
+    result = before_send(event, _filesystem_hint(OSError(error_number, message)))
+
+    assert result is event
+    assert event["fingerprint"] == ["{{ default }}", expected_suffix]
+
+
+def test_before_send_fingerprints_differ_per_errno():
+    """ENOSPC and ENOENT from the same call site produce different issues."""
+    enospc_event = {}
+    enoent_event = {}
+
+    before_send(
+        enospc_event, _filesystem_hint(OSError(errno.ENOSPC, "No space left on device"))
+    )
+    before_send(
+        enoent_event,
+        _filesystem_hint(OSError(errno.ENOENT, "No such file or directory")),
+    )
+
+    assert enospc_event["fingerprint"] != enoent_event["fingerprint"]
+
+
+def test_before_send_fingerprints_wrapped_oserror():
+    """The errno is found even when the OSError is wrapped by another error."""
+    try:
+        try:
+            raise OSError(errno.ENOSPC, "No space left on device")
+        except OSError as os_error:
+            raise RuntimeError("Error generating output directory") from os_error
+    except RuntimeError as wrapper:
+        event = {}
+        before_send(event, _filesystem_hint(wrapper))
+
+    assert event["fingerprint"] == ["{{ default }}", "errno:ENOSPC"]
+
+
+def test_before_send_does_not_fingerprint_non_oserror():
+    """Non-filesystem exceptions keep Sentry's default grouping."""
+    event = {}
+
+    result = before_send(event, _filesystem_hint(ValueError("boom")))
+
+    assert result is event
+    assert "fingerprint" not in event
+
+
+def test_before_send_does_not_fingerprint_unrelated_oserror_log():
+    """Only records declaring the filesystem category opt into the errno grouping."""
+    exception = OSError(errno.ENOSPC, "No space left on device")
+    log_record = _make_log_record("Unrelated failure")
+    exc_info = (OSError, exception, None)
+    log_record.exc_info = exc_info
+    event = {}
+
+    result = before_send(event, {"log_record": log_record, "exc_info": exc_info})
+
+    assert result is event
+    assert "fingerprint" not in event
+
+
+def test_before_send_does_not_fingerprint_exception_events():
+    """Exception events without a log record keep Sentry's default grouping."""
+    event = {}
+
+    result = before_send(
+        event,
+        {"exc_info": (OSError, OSError(errno.ENOSPC, "No space left on device"), None)},
+    )
+
+    assert result is event
+    assert "fingerprint" not in event
+
+
+@pytest.mark.parametrize("fingerprint", [["scope-fingerprint"], []])
+def test_before_send_keeps_existing_fingerprint(fingerprint):
+    """A fingerprint set by a scope or an integration is never overwritten."""
+    expected_fingerprint = fingerprint.copy()
+    event = {"fingerprint": fingerprint}
+
+    before_send(
+        event, _filesystem_hint(OSError(errno.ENOSPC, "No space left on device"))
+    )
+
+    assert event["fingerprint"] == expected_fingerprint
+
+
+def test_before_send_ignores_suppressed_context():
+    """`raise ... from None` hides the context, so it must not group the event."""
+    try:
+        try:
+            raise OSError(errno.ENOSPC, "No space left on device")
+        except OSError:
+            raise RuntimeError("Error generating output directory") from None
+    except RuntimeError as wrapper:
+        event = {}
+        before_send(event, _filesystem_hint(wrapper))
+
+    assert "fingerprint" not in event
+
+
+def test_errno_fingerprint_follows_implicit_context():
+    """An implicit `raise` during handling still exposes the original errno."""
+    try:
+        try:
+            raise OSError(errno.EACCES, "Permission denied")
+        except OSError:
+            raise RuntimeError("Error generating output directory")
+    except RuntimeError as wrapper:
+        assert errno_fingerprint(wrapper) == "errno:EACCES"
+
+
+def test_before_send_does_not_fingerprint_oserror_without_errno():
+    """An OSError without errno has nothing to split the issue by."""
+    event = {}
+
+    before_send(event, _filesystem_hint(OSError("no errno here")))
+
+    assert "fingerprint" not in event
+
+
+def test_errno_fingerprint_uses_raw_number_for_unknown_errno():
+    """Unmapped errno values still split the issue instead of being dropped."""
+    assert errno_fingerprint(OSError(9999, "unknown")) == "errno:9999"
+
+
+def test_errno_fingerprint_stops_on_self_referencing_chain():
+    """A cyclic exception chain must not hang the fingerprint lookup."""
+    first = ValueError("first")
+    second = ValueError("second")
+    first.__cause__ = second
+    second.__cause__ = first
+
+    assert errno_fingerprint(first) is None

api/src/backend/api/tests/test_serializers.py

@@ -3,8 +3,16 @@ from api.v1.serializer_utils.integrations import (
     JiraCredentialSerializer,
     S3ConfigSerializer,
 )
-from api.v1.serializers import ImageProviderSecret, KubernetesProviderSecret
+from api.v1.serializer_utils.providers import ProviderSecretField
+from api.v1.serializers import (
+    ImageProviderSecret,
+    IntegrationSerializer,
+    IntegrationUpdateSerializer,
+    KubernetesProviderSecret,
+    OracleCloudProviderSecret,
+)
 from rest_framework.exceptions import ValidationError
+from rest_framework.test import APIRequestFactory
 
 
 class TestS3ConfigSerializer:
@@ -190,6 +198,64 @@ class TestImageProviderSecret:
         assert "non_field_errors" in serializer.errors
 
 
+class TestOracleCloudProviderSecret:
+    def valid_secret(self, **overrides):
+        secret = {
+            "user": "ocid1.user.oc1..aaaaaaaexample",
+            "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+        }
+        secret.update(overrides)
+        return secret
+
+    def test_accepts_regionless_secret(self):
+        serializer = OracleCloudProviderSecret(data=self.valid_secret())
+
+        assert serializer.is_valid(), serializer.errors
+        assert "region" not in serializer.validated_data
+
+    def test_accepts_and_ignores_region_field(self):
+        secret = self.valid_secret(region="us-phoenix-1")
+        serializer = OracleCloudProviderSecret(data=secret)
+
+        assert serializer.is_valid(), serializer.errors
+
+        assert "region" not in serializer.validated_data
+
+    @pytest.mark.parametrize(
+        "legacy_field, legacy_value",
+        [
+            ("region", None),
+            ("region", ""),
+            ("region", {"name": "us-ashburn-1"}),
+        ],
+    )
+    def test_accepts_and_ignores_any_legacy_region_value(
+        self, legacy_field, legacy_value
+    ):
+        serializer = OracleCloudProviderSecret(
+            data=self.valid_secret(**{legacy_field: legacy_value})
+        )
+
+        assert serializer.is_valid(), serializer.errors
+
+        assert legacy_field not in serializer.validated_data
+
+
+class TestProviderSecretFieldSchema:
+    def test_oraclecloud_schema_includes_legacy_region_field(self):
+        schema = ProviderSecretField._spectacular_annotation["field"]
+        oraclecloud_schema = next(
+            credential_schema
+            for credential_schema in schema["oneOf"]
+            if credential_schema["title"]
+            == "Oracle Cloud Infrastructure (OCI) API Key Credentials"
+        )
+
+        assert oraclecloud_schema["properties"]["region"]["deprecated"] is True
+
+
 class TestKubernetesProviderSecret:
     def test_valid_static_kubeconfig_is_accepted(self):
         kubeconfig_content = """
@@ -246,6 +312,36 @@ current-context: test-context
         assert not serializer.is_valid()
         assert "kubeconfig_content" in serializer.errors
 
+    def test_kubeconfig_with_auth_provider_cmd_path_is_rejected(self):
+        kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster:
+      server: https://kubernetes.example.test
+users:
+  - name: test-user
+    user:
+      auth-provider:
+        name: gcp
+        config:
+          cmd-path: /bin/sh
+contexts:
+  - name: test-context
+    context:
+      cluster: test-cluster
+      user: test-user
+current-context: test-context
+"""
+
+        serializer = KubernetesProviderSecret(
+            data={"kubeconfig_content": kubeconfig_content}
+        )
+
+        assert not serializer.is_valid()
+        assert "kubeconfig_content" in serializer.errors
+
     def test_malformed_kubeconfig_is_rejected(self):
         serializer = KubernetesProviderSecret(
             data={"kubeconfig_content": "apiVersion: ["}
@@ -259,3 +355,25 @@ current-context: test-context
 
         assert not serializer.is_valid()
         assert "kubeconfig_content" in serializer.errors
+
+
+@pytest.mark.django_db
+class TestIntegrationSerializerJiraDomain:
+    """The serialized Jira `domain` must not reach the model instance."""
+
+    @pytest.mark.parametrize(
+        "serializer_class", [IntegrationSerializer, IntegrationUpdateSerializer]
+    )
+    def test_to_representation_does_not_mutate_configuration(
+        self, serializer_class, jira_integration_fixture
+    ):
+        # `IntegrationUpdateSerializer` exposes a `HyperlinkedIdentityField`
+        context = {"request": APIRequestFactory().get("/")}
+        representation = serializer_class(
+            jira_integration_fixture, context=context
+        ).data
+
+        assert representation["configuration"]["domain"] == "test"
+        assert jira_integration_fixture.configuration == {
+            "projects": {"TEST": "Test project"}
+        }

api/src/backend/api/tests/test_utils.py

@@ -171,6 +171,53 @@ class TestInitializeProwlerProvider:
             key="value", mutelist_content={"key": "value"}
         )
 
+    @patch("api.utils.return_prowler_provider")
+    def test_initialize_oraclecloud_provider_removes_region_string(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret.secret = {
+            "user": "ocid1.user.oc1..fake",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..fake",
+            "region": "us-ashburn-1",
+        }
+        mock_return_prowler_provider.return_value = MagicMock()
+
+        initialize_prowler_provider(provider)
+
+        mock_return_prowler_provider.return_value.assert_called_once_with(
+            user="ocid1.user.oc1..fake",
+            fingerprint="00:11:22:33:44:55:66:77",
+            key_content="fake-base64-key-content",
+            tenancy="ocid1.tenancy.oc1..fake",
+        )
+
+    @patch("api.utils.return_prowler_provider")
+    def test_initialize_oraclecloud_provider_without_region_omits_scan_filter(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret.secret = {
+            "user": "ocid1.user.oc1..fake",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..fake",
+        }
+        mock_return_prowler_provider.return_value = MagicMock()
+
+        initialize_prowler_provider(provider)
+
+        mock_return_prowler_provider.return_value.assert_called_once_with(
+            user="ocid1.user.oc1..fake",
+            fingerprint="00:11:22:33:44:55:66:77",
+            key_content="fake-base64-key-content",
+            tenancy="ocid1.tenancy.oc1..fake",
+        )
+
 
 class TestProwlerProviderConnectionTest:
     @patch("api.utils.return_prowler_provider")
@@ -185,6 +232,37 @@ class TestProwlerProviderConnectionTest:
             key="value", provider_id="1234567890", raise_on_exception=False
         )
 
+    @patch("api.utils.return_prowler_provider")
+    def test_oraclecloud_connection_test_uses_direct_credentials_without_region(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.uid = "ocid1.tenancy.oc1..aaaaaaaexample"
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret.secret = {
+            "user": "ocid1.user.oc1..aaaaaaaexample",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+        }
+        mock_return_prowler_provider.return_value = MagicMock()
+
+        prowler_provider_connection_test(provider)
+
+        mock_return_prowler_provider.return_value.test_connection.assert_called_once_with(
+            user="ocid1.user.oc1..aaaaaaaexample",
+            fingerprint="00:11:22:33:44:55:66:77",
+            key_content="fake-base64-key-content",
+            tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
+            region=getattr(
+                OraclecloudProvider,
+                "_bootstrap_region",
+                OraclecloudProvider._home_region,
+            ),
+            provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
+            raise_on_exception=False,
+        )
+
     @pytest.mark.django_db
     @patch("api.utils.return_prowler_provider")
     def test_prowler_provider_connection_test_without_secret(
@@ -356,7 +434,7 @@ class TestGetProwlerProviderKwargs:
         expected_result = {**secret_dict, **expected_extra_kwargs}
         assert result == expected_result
 
-    def test_get_prowler_provider_kwargs_oraclecloud_converts_region_string_to_set(
+    def test_get_prowler_provider_kwargs_oraclecloud_removes_region(
         self,
     ):
         secret_dict = {
@@ -377,8 +455,13 @@ class TestGetProwlerProviderKwargs:
 
         result = get_prowler_provider_kwargs(provider)
 
-        expected_result = {**secret_dict, "region": {"us-ashburn-1"}}
-        assert result == expected_result
+        assert result == {
+            "user": "ocid1.user.oc1..fake",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----",
+            "tenancy": "ocid1.tenancy.oc1..fake",
+            "pass_phrase": "fake-passphrase",
+        }
 
     def test_get_prowler_provider_kwargs_with_mutelist(self):
         provider_uid = "provider_uid"

api/src/backend/api/tests/test_views.py

@@ -3,9 +3,11 @@ import io
 import json
 import os
 import tempfile
+from concurrent.futures import ThreadPoolExecutor
 from datetime import UTC, date, datetime, timedelta
 from decimal import Decimal
 from pathlib import Path
+from threading import Event, Lock
 from types import SimpleNamespace
 from unittest.mock import ANY, MagicMock, Mock, patch
 from urllib.parse import parse_qs, urlparse
@@ -17,10 +19,12 @@ from allauth.account.models import EmailAddress
 from allauth.socialaccount.models import SocialAccount, SocialApp
 from api.attack_paths import (
     AttackPathsQueryDefinition,
+    AttackPathsQueryOutcome,
     AttackPathsQueryParameterDefinition,
 )
 from api.compliance import get_compliance_frameworks
 from api.db_router import MainRouter
+from api.db_utils import rls_transaction
 from api.models import (
     AttackSurfaceOverview,
     ComplianceOverviewSummary,
@@ -65,6 +69,7 @@ from api.v1.views import (
 )
 from botocore.exceptions import ClientError, NoCredentialsError
 from celery import states
+from celery.utils.saferepr import saferepr
 from conftest import (
     API_JSON_CONTENT_TYPE,
     TEST_PASSWORD,
@@ -73,8 +78,9 @@ from conftest import (
     today_after_n_days,
 )
 from django.conf import settings
-from django.db import connection
+from django.db import close_old_connections, connection, connections
 from django.db.models import Count
+from django.db.models.signals import pre_delete
 from django.http import JsonResponse
 from django.test import RequestFactory
 from django.test.utils import CaptureQueriesContext
@@ -514,6 +520,50 @@ class TestUserViewSet:
         assert error_field in response.json()["errors"][0]["source"]["pointer"]
 
 
+@pytest.mark.requires_test_admin_alias
+@pytest.mark.django_db(transaction=True, databases=["default", "admin"])
+class TestTenantDeletionTransactions:
+    @patch("api.v1.views.delete_tenant_task.apply_async")
+    def test_delete_rolls_back_memberships_when_user_cleanup_fails(
+        self,
+        delete_tenant_mock,
+        authenticated_client,
+        tenants_fixture,
+    ):
+        assert connections["default"] is not connections["admin"]
+
+        _, tenant, _ = tenants_fixture
+        exclusive_user = User.objects.create_user(
+            name="exclusive user",
+            password=TEST_PASSWORD,
+            email="exclusive-user@example.com",
+        )
+        membership = Membership.objects.create(
+            user=exclusive_user,
+            tenant=tenant,
+            role=Membership.RoleChoices.MEMBER,
+        )
+
+        def fail_user_cleanup(*, instance, **kwargs):
+            if instance.pk == exclusive_user.pk:
+                raise RuntimeError("Simulated user cleanup failure.")
+
+        pre_delete.connect(fail_user_cleanup, sender=User)
+        try:
+            with (
+                patch.object(MainRouter, "admin_db", "admin"),
+                pytest.raises(RuntimeError, match=r"Simulated user cleanup failure\."),
+            ):
+                authenticated_client.delete(
+                    reverse("tenant-detail", kwargs={"pk": tenant.id})
+                )
+        finally:
+            pre_delete.disconnect(fail_user_cleanup, sender=User)
+
+        assert Membership.objects.using("admin").filter(pk=membership.pk).exists()
+        delete_tenant_mock.assert_not_called()
+
+
 @pytest.mark.django_db
 class TestTenantViewSet:
     @pytest.fixture
@@ -2917,6 +2967,48 @@ class TestProviderGroupViewSet:
 
 @pytest.mark.django_db
 class TestProviderSecretViewSet:
+    @staticmethod
+    def _oraclecloud_secret(**overrides):
+        secret = {
+            "user": "ocid1.user.oc1..aaaaaaaakldibrbov4ubh25aqdeiroklxjngwka7u6w7no3glmdq3n5sxtkq",
+            "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+            "key_content": "test-key-content",
+            "tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
+        }
+        secret.update(overrides)
+        return secret
+
+    def _create_oraclecloud_secret(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+        secret,
+        name="OCI Secret",
+    ):
+        data = {
+            "data": {
+                "type": "provider-secrets",
+                "attributes": {
+                    "name": name,
+                    "secret_type": ProviderSecret.TypeChoices.STATIC,
+                    "secret": secret,
+                },
+                "relationships": {
+                    "provider": {
+                        "data": {
+                            "type": "providers",
+                            "id": str(oraclecloud_provider.id),
+                        }
+                    }
+                },
+            }
+        }
+        return authenticated_client.post(
+            reverse("providersecret-list"),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+
     def test_provider_secrets_list(self, authenticated_client, provider_secret_fixture):
         response = authenticated_client.get(reverse("providersecret-list"))
         assert response.status_code == status.HTTP_200_OK
@@ -3076,7 +3168,6 @@ current-context: test-context
                     "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
                     "key_content": "-----BEGIN RSA PRIVATE KEY-----\ntest-key-content\n-----END RSA PRIVATE KEY-----",
                     "tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
-                    "region": "us-ashburn-1",
                 },
             ),
             # OCI with API key credentials (with key_file)
@@ -3088,7 +3179,6 @@ current-context: test-context
                     "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
                     "key_file": "/path/to/oci_api_key.pem",
                     "tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
-                    "region": "us-ashburn-1",
                 },
             ),
             # OCI with API key credentials (with passphrase)
@@ -3100,7 +3190,6 @@ current-context: test-context
                     "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
                     "key_content": "-----BEGIN RSA PRIVATE KEY-----\ntest-encrypted-key\n-----END RSA PRIVATE KEY-----",
                     "tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
-                    "region": "us-ashburn-1",
                     "pass_phrase": "my-secure-passphrase",
                 },
             ),
@@ -3258,6 +3347,103 @@ current-context: test-context
             == data["data"]["relationships"]["provider"]["data"]["id"]
         )
 
+    def test_provider_secrets_create_oraclecloud_without_region_stores_no_region(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+    ):
+        response = self._create_oraclecloud_secret(
+            authenticated_client,
+            oraclecloud_provider,
+            self._oraclecloud_secret(),
+        )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        provider_secret = ProviderSecret.objects.get()
+        assert "region" not in provider_secret.secret
+
+    def test_provider_secrets_create_oraclecloud_accepts_and_ignores_region(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+    ):
+        response = self._create_oraclecloud_secret(
+            authenticated_client,
+            oraclecloud_provider,
+            self._oraclecloud_secret(
+                key_content="  test-key-content  ", region=" us-ashburn-1 "
+            ),
+        )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        provider_secret = ProviderSecret.objects.get()
+        assert provider_secret.secret["key_content"] == "test-key-content"
+        assert "region" not in provider_secret.secret
+
+    def test_provider_secrets_update_oraclecloud_without_region_stores_no_region(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+    ):
+        create_response = self._create_oraclecloud_secret(
+            authenticated_client,
+            oraclecloud_provider,
+            self._oraclecloud_secret(),
+        )
+        provider_secret = ProviderSecret.objects.get(
+            id=create_response.json()["data"]["id"]
+        )
+        data = {
+            "data": {
+                "type": "provider-secrets",
+                "id": str(provider_secret.id),
+                "attributes": {"secret": self._oraclecloud_secret()},
+            }
+        }
+
+        response = authenticated_client.patch(
+            reverse("providersecret-detail", kwargs={"pk": provider_secret.id}),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        provider_secret.refresh_from_db()
+        assert "region" not in provider_secret.secret
+
+    def test_provider_secrets_update_oraclecloud_accepts_and_ignores_region(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+    ):
+        create_response = self._create_oraclecloud_secret(
+            authenticated_client,
+            oraclecloud_provider,
+            self._oraclecloud_secret(),
+        )
+        provider_secret = ProviderSecret.objects.get(
+            id=create_response.json()["data"]["id"]
+        )
+        data = {
+            "data": {
+                "type": "provider-secrets",
+                "id": str(provider_secret.id),
+                "attributes": {
+                    "secret": self._oraclecloud_secret(region=" us-ashburn-1 ")
+                },
+            }
+        }
+
+        response = authenticated_client.patch(
+            reverse("providersecret-detail", kwargs={"pk": provider_secret.id}),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        provider_secret.refresh_from_db()
+        assert "region" not in provider_secret.secret
+
     @pytest.mark.parametrize(
         "attributes, error_code, error_pointer",
         (
@@ -4907,11 +5093,60 @@ class TestTaskViewSet:
             reverse("task-detail", kwargs={"pk": task1.id}),
         )
         assert response.status_code == status.HTTP_200_OK
+        assert response.json()["data"]["attributes"]["task_args"] == {
+            "kwarg1": "value1"
+        }
         assert (
             response.json()["data"]["attributes"]["name"]
             == task1.task_runner_task.task_name
         )
 
+    def test_tasks_retrieve_hides_tenant_id(
+        self, authenticated_client, tasks_fixture, tenants_fixture
+    ):
+        task, *_ = tasks_fixture
+        task.task_runner_task.task_kwargs = json.dumps(
+            repr(
+                {
+                    "tenant_id": str(tenants_fixture[0].id),
+                    "enabled": True,
+                    "scan_id": None,
+                    "label": "True North",
+                }
+            )
+        )
+        task.task_runner_task.save(update_fields=["task_kwargs"])
+
+        response = authenticated_client.get(
+            reverse("task-detail", kwargs={"pk": task.id}),
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json()["data"]["attributes"]["task_args"] == {
+            "enabled": True,
+            "scan_id": None,
+            "label": "True North",
+        }
+
+    def test_tasks_retrieve_with_truncated_kwargs_returns_empty_task_args(
+        self, authenticated_client, tasks_fixture
+    ):
+        task, *_ = tasks_fixture
+        kwargs_repr = saferepr(
+            {"finding_ids": [str(uuid4()) for _ in range(30)]}, maxlen=1024
+        )
+        assert "..." in kwargs_repr
+        task.task_runner_task.task_kwargs = json.dumps(kwargs_repr)
+        task.task_runner_task.save(update_fields=["task_kwargs"])
+
+        response = authenticated_client.get(
+            reverse("task-detail", kwargs={"pk": task.id}),
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.headers["Content-Type"] == API_JSON_CONTENT_TYPE
+        assert response.json()["data"]["attributes"]["task_args"] == {}
+
     def test_tasks_invalid_retrieve(self, authenticated_client):
         response = authenticated_client.get(
             reverse("task-detail", kwargs={"pk": "invalid_id"})
@@ -5199,6 +5434,72 @@ class TestAttackPathsScanViewSet:
         assert payload[0]["attributes"]["name"] == "RDS inventory"
         assert payload[0]["attributes"]["parameters"][0]["name"] == "ip"
 
+    def test_attack_paths_queries_expose_outcome(
+        self,
+        authenticated_client,
+        aws_provider,
+        scans_fixture,
+        create_attack_paths_scan,
+    ):
+        provider = aws_provider
+        attack_paths_scan = create_attack_paths_scan(
+            provider,
+            scan=scans_fixture[0],
+        )
+
+        definitions = [
+            AttackPathsQueryDefinition(
+                id="aws-lambda-passrole",
+                name="Lambda passrole",
+                short_description="Pass a role to a new Lambda function.",
+                description="Pass a role to a new Lambda function and run code as it.",
+                provider=provider.provider,
+                cypher="MATCH (n) RETURN n",
+                outcome=AttackPathsQueryOutcome.CODE_EXECUTION,
+            ),
+            AttackPathsQueryDefinition(
+                id="aws-rds-inventory",
+                name="RDS inventory",
+                short_description="List account RDS assets.",
+                description="List account RDS assets.",
+                provider=provider.provider,
+                cypher="MATCH (n) RETURN n",
+                outcome=AttackPathsQueryOutcome.RESOURCE_INVENTORY,
+            ),
+            AttackPathsQueryDefinition(
+                id="aws-no-outcome",
+                name="No outcome",
+                short_description="A query without an outcome.",
+                description="A query without an outcome.",
+                provider=provider.provider,
+                cypher="MATCH (n) RETURN n",
+            ),
+        ]
+
+        with patch("api.v1.views.get_queries_for_provider", return_value=definitions):
+            response = authenticated_client.get(
+                reverse(
+                    "attack-paths-scans-queries", kwargs={"pk": attack_paths_scan.id}
+                )
+            )
+
+        assert response.status_code == status.HTTP_200_OK
+        outcomes = {
+            item["id"]: item["attributes"]["outcome"]
+            for item in response.json()["data"]
+        }
+        assert outcomes["aws-lambda-passrole"] == {
+            "kind": "code_execution",
+            "label": "Code execution",
+            "partial": False,
+        }
+        assert outcomes["aws-rds-inventory"] == {
+            "kind": "resource_inventory",
+            "label": "Resource inventory",
+            "partial": True,
+        }
+        assert outcomes["aws-no-outcome"] is None
+
     def test_attack_paths_queries_returns_404_when_catalog_missing(
         self,
         authenticated_client,
@@ -13310,6 +13611,73 @@ class TestIntegrationViewSet:
                 f"Expected type '{expected_type}' not found in included data"
             )
 
+    # Serializing a Jira integration reads `configuration` to add the domain from the
+    # credentials, and a sparse fieldset can leave that field out of the representation
+
+    def test_integrations_list_sparse_fields_without_configuration(
+        self, authenticated_client, jira_integration_fixture
+    ):
+        response = authenticated_client.get(
+            reverse("integration-list"),
+            {"fields[integrations]": "enabled,integration_type"},
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        attributes = response.json()["data"][0]["attributes"]
+        assert sorted(attributes.keys()) == ["enabled", "integration_type"]
+
+    def test_integrations_retrieve_sparse_fields_without_configuration(
+        self, authenticated_client, jira_integration_fixture
+    ):
+        response = authenticated_client.get(
+            reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id}),
+            {"fields[integrations]": "enabled,integration_type"},
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert "configuration" not in response.json()["data"]["attributes"]
+
+    def test_integrations_partial_update_sparse_fields_without_configuration(
+        self, authenticated_client, jira_integration_fixture
+    ):
+        data = {
+            "data": {
+                "type": "integrations",
+                "id": str(jira_integration_fixture.id),
+                "attributes": {"enabled": False},
+            }
+        }
+
+        url = reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id})
+        response = authenticated_client.patch(
+            f"{url}?fields[integrations]=enabled,integration_type",
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert "configuration" not in response.json()["data"]["attributes"]
+        with rls_transaction(str(jira_integration_fixture.tenant_id)):
+            jira_integration_fixture.refresh_from_db()
+        assert jira_integration_fixture.enabled is False
+        # Omitting `configuration` from the fieldset must not rewrite it, and the
+        # serialized `domain` must not leak into the stored value
+        assert jira_integration_fixture.configuration == {
+            "projects": {"TEST": "Test project"}
+        }
+
+    def test_integrations_retrieve_jira_keeps_domain_in_configuration(
+        self, authenticated_client, jira_integration_fixture
+    ):
+        response = authenticated_client.get(
+            reverse("integration-detail", kwargs={"pk": jira_integration_fixture.id})
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        configuration = response.json()["data"]["attributes"]["configuration"]
+        assert configuration["domain"] == "test"
+        assert configuration["projects"] == {"TEST": "Test project"}
+
     @pytest.mark.parametrize(
         "integration_type, configuration, credentials",
         [
@@ -14305,6 +14673,37 @@ class TestSAMLConfigurationViewSet:
         assert not SAMLConfiguration.objects.filter(id=config.id).exists()
 
 
+@pytest.mark.django_db
+class TestSAMLACSView:
+    def test_get_is_not_allowed(self, client, saml_setup):
+        response = client.get(
+            reverse(
+                "saml_acs",
+                kwargs={"organization_slug": saml_setup["domain"]},
+            )
+        )
+
+        assert response.status_code == status.HTTP_405_METHOD_NOT_ALLOWED
+        assert response.headers["Allow"] == "POST"
+        assert "saml-acs-session" not in response.cookies
+
+    def test_post_is_forwarded_to_allauth(self, client, saml_setup):
+        response = client.post(
+            reverse(
+                "saml_acs",
+                kwargs={"organization_slug": saml_setup["domain"]},
+            ),
+            data={"SAMLResponse": "test-saml-response"},
+        )
+
+        assert response.status_code == status.HTTP_302_FOUND
+        assert response.url == reverse(
+            "saml_finish_acs",
+            kwargs={"organization_slug": saml_setup["domain"]},
+        )
+        assert "saml-acs-session" in response.cookies
+
+
 @pytest.mark.django_db
 class TestTenantFinishACSView:
     def test_dispatch_skips_if_user_not_authenticated(self, monkeypatch):
@@ -14657,19 +15056,94 @@ class TestTenantFinishACSView:
         # Verify no new role was created
         assert Role.objects.using(MainRouter.admin_db).count() == roles_before
 
-    def test_dispatch_assigns_no_role_to_new_user_when_usertype_missing(
+    @pytest.mark.parametrize(
+        (
+            "existing_role_attributes",
+            "existing_suffixes",
+            "expected_role_name",
+            "expected_role_created",
+        ),
+        [
+            (None, (), "read_only", True),
+            ({"unlimited_visibility": True}, (), "read_only", False),
+            (
+                {"manage_users": True, "unlimited_visibility": True},
+                (
+                    ("read_only_0", {"unlimited_visibility": True}),
+                    ("read_only_1", {"unlimited_visibility": True}),
+                ),
+                "read_only_0",
+                False,
+            ),
+            (
+                {"manage_users": True, "unlimited_visibility": True},
+                (
+                    (
+                        "read_only_0",
+                        {"manage_users": True, "unlimited_visibility": True},
+                    ),
+                    ("read_only_1", {"unlimited_visibility": True}),
+                ),
+                "read_only_1",
+                False,
+            ),
+            ({"unlimited_visibility": False}, (), "read_only_0", True),
+        ],
+        ids=[
+            "creates-role",
+            "reuses-safe-role",
+            "reuses-first-safe-suffixed-role",
+            "skips-unsafe-suffixed-role",
+            "avoids-restricted-visibility",
+        ],
+    )
+    def test_dispatch_assigns_read_only_role_when_usertype_missing(
         self,
         create_test_user,
         tenants_fixture,
         saml_setup,
         settings,
         monkeypatch,
+        existing_role_attributes,
+        existing_suffixes,
+        expected_role_name,
+        expected_role_created,
     ):
-        """Test that a user without roles gets none assigned when userType is missing"""
+        """Test safe fallback role assignment when userType is missing"""
         monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
         user = create_test_user
         tenant = tenants_fixture[0]
-        roles_before = Role.objects.using(MainRouter.admin_db).count()
+        other_tenant = tenants_fixture[1]
+
+        other_tenant_role = Role.objects.using(MainRouter.admin_db).create(
+            name="read_only",
+            tenant=other_tenant,
+            unlimited_visibility=True,
+        )
+        other_tenant_relationship = UserRoleRelationship.objects.using(
+            MainRouter.admin_db
+        ).create(
+            user=user,
+            role=other_tenant_role,
+            tenant=other_tenant,
+        )
+
+        existing_role = None
+        if existing_role_attributes is not None:
+            existing_role = Role.objects.using(MainRouter.admin_db).create(
+                name="read_only",
+                tenant=tenant,
+                **existing_role_attributes,
+            )
+        for role_name, role_attributes in existing_suffixes:
+            Role.objects.using(MainRouter.admin_db).create(
+                name=role_name,
+                tenant=tenant,
+                **role_attributes,
+            )
+        roles_before = (
+            Role.objects.using(MainRouter.admin_db).filter(tenant=tenant).count()
+        )
 
         social_account = SocialAccount(
             user=user,
@@ -14722,12 +15196,44 @@ class TestTenantFinishACSView:
 
         assert response.status_code == 302
 
-        # Verify no role was created or assigned
-        assert Role.objects.using(MainRouter.admin_db).count() == roles_before
-        assert not (
+        # Verify the fallback role was created or reused with read-only access
+        expected_role_count = roles_before + expected_role_created
+        assert (
+            Role.objects.using(MainRouter.admin_db).filter(tenant=tenant).count()
+            == expected_role_count
+        )
+        role = Role.objects.using(MainRouter.admin_db).get(
+            name=expected_role_name, tenant=tenant
+        )
+        if existing_role is not None and expected_role_name == "read_only":
+            assert role == existing_role
+        assert not role.manage_users
+        assert not role.manage_account
+        assert not role.manage_billing
+        assert not role.manage_providers
+        assert not role.manage_integrations
+        assert not role.manage_scans
+        assert role.unlimited_visibility
+        assert (
+            UserRoleRelationship.objects.using(MainRouter.admin_db)
+            .filter(user=user, role=role, tenant_id=tenant.id)
+            .exists()
+        )
+        assert (
+            UserRoleRelationship.objects.using(MainRouter.admin_db)
+            .filter(
+                id=other_tenant_relationship.id,
+                user=user,
+                role=other_tenant_role,
+                tenant_id=other_tenant.id,
+            )
+            .exists()
+        )
+        assert (
             UserRoleRelationship.objects.using(MainRouter.admin_db)
             .filter(user=user, tenant_id=tenant.id)
-            .exists()
+            .count()
+            == 1
         )
 
         # Membership is still created so the user belongs to the tenant
@@ -14737,6 +15243,131 @@ class TestTenantFinishACSView:
             .exists()
         )
 
+    @pytest.mark.django_db(transaction=True)
+    def test_dispatch_serializes_concurrent_fallback_role_assignment(
+        self,
+        create_test_user,
+        tenants_fixture,
+        saml_setup,
+        monkeypatch,
+    ):
+        """Test concurrent callbacks assign only one fallback role"""
+        monkeypatch.setenv("SAML_SSO_CALLBACK_URL", "http://localhost/sso-complete")
+        user = create_test_user
+        tenant = tenants_fixture[0]
+
+        Role.objects.using(MainRouter.admin_db).create(
+            name="read_only",
+            tenant=tenant,
+            manage_users=True,
+            unlimited_visibility=True,
+        )
+
+        social_account = SocialAccount(
+            user=user,
+            provider="saml",
+            extra_data={
+                "firstName": ["John"],
+                "lastName": ["Doe"],
+                "organization": ["testing_company"],
+            },
+        )
+        # Without the user lock, both callbacks reach this query before either
+        # creates a fallback. With the lock, the first callback times out here
+        # while the second waits for the transaction to finish.
+        second_role_check_reached = Event()
+        concurrent_role_checks_detected = Event()
+        role_check_count_lock = Lock()
+        role_check_count = 0
+        original_role_check = TenantFinishACSView._user_has_tenant_role
+
+        def synchronize_role_checks(user_id, tenant_id):
+            nonlocal role_check_count
+            with role_check_count_lock:
+                role_check_count += 1
+                is_first_role_check = role_check_count == 1
+                if role_check_count == 2:
+                    second_role_check_reached.set()
+            if is_first_role_check and second_role_check_reached.wait(timeout=1):
+                concurrent_role_checks_detected.set()
+            return original_role_check(user_id, tenant_id)
+
+        def dispatch_callback():
+            close_old_connections()
+            try:
+                thread_user = User.objects.using(MainRouter.admin_db).get(pk=user.pk)
+                request = RequestFactory().get(
+                    reverse(
+                        "saml_finish_acs",
+                        kwargs={"organization_slug": saml_setup["domain"]},
+                    )
+                )
+                request.user = thread_user
+                request.session = {}
+                response = TenantFinishACSView.as_view()(
+                    request, organization_slug=saml_setup["domain"]
+                )
+                return response
+            finally:
+                close_old_connections()
+
+        with (
+            patch(
+                "allauth.socialaccount.providers.saml.views.get_app_or_404"
+            ) as mock_get_app_or_404,
+            patch(
+                "allauth.socialaccount.models.SocialApp.objects.get"
+            ) as mock_socialapp_get,
+            patch(
+                "allauth.socialaccount.models.SocialAccount.objects.get"
+            ) as mock_sa_get,
+            patch("api.models.SAMLDomainIndex.objects.get") as mock_saml_domain_get,
+            patch("api.models.SAMLConfiguration.objects.get") as mock_saml_config_get,
+            patch("api.models.User.objects.get") as mock_user_get,
+            patch.object(
+                TenantFinishACSView,
+                "_user_has_tenant_role",
+                side_effect=synchronize_role_checks,
+            ),
+        ):
+            mock_get_app_or_404.return_value = MagicMock(
+                provider="saml",
+                client_id=saml_setup["domain"],
+                name="Test App",
+                settings={},
+            )
+            mock_sa_get.return_value = social_account
+            mock_socialapp_get.return_value = MagicMock(provider_id="saml")
+            mock_saml_domain_get.return_value = SimpleNamespace(tenant_id=tenant.id)
+            mock_saml_config_get.return_value = SimpleNamespace(
+                email_domain=saml_setup["domain"], tenant=tenant
+            )
+            mock_user_get.side_effect = lambda *_args, **_kwargs: User.objects.using(
+                MainRouter.admin_db
+            ).get(pk=user.pk)
+
+            with ThreadPoolExecutor(max_workers=2) as executor:
+                responses = list(executor.map(lambda _: dispatch_callback(), range(2)))
+
+        assert role_check_count == 2
+        assert not concurrent_role_checks_detected.is_set()
+        for response in responses:
+            assert response.status_code == status.HTTP_302_FOUND
+            parsed_redirect = urlparse(response.url)
+            assert parsed_redirect.path == "/sso-complete"
+            assert set(parse_qs(parsed_redirect.query)) == {"id"}
+        relationships = UserRoleRelationship.objects.using(MainRouter.admin_db).filter(
+            user=user, tenant_id=tenant.id
+        )
+        assert relationships.count() == 1
+        assert relationships.get().role.name == "read_only_0"
+        assert (
+            Role.objects.using(MainRouter.admin_db)
+            .filter(tenant=tenant, name__startswith="read_only_")
+            .count()
+            == 1
+        )
+
     def test_dispatch_skips_role_mapping_when_last_manage_account_user_maps_to_new_role(
         self,
         create_test_user,
@@ -15612,6 +16243,23 @@ class TestTenantApiKeyViewSet:
         data = response.json()["data"]
         assert len(data) == len(api_keys_fixture)
 
+    def test_api_keys_list_with_orphaned_key(
+        self, authenticated_client, api_keys_fixture
+    ):
+        """Test listing keys whose owner was deleted: `entity` is serialized as null."""
+        orphaned_key = api_keys_fixture[0]
+        TenantAPIKey.objects.filter(id=orphaned_key.id).update(entity=None)
+
+        response = authenticated_client.get(reverse("api-key-list"))
+
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        assert len(data) == len(api_keys_fixture)
+        serialized_key = next(
+            item for item in data if item["id"] == str(orphaned_key.id)
+        )
+        assert serialized_key["relationships"]["entity"]["data"] is None
+
     def test_api_keys_list_empty(self, authenticated_client, tenants_fixture):
         """Test listing API keys when none exist returns empty list."""
         response = authenticated_client.get(reverse("api-key-list"))

api/src/backend/api/utils.py

@@ -252,12 +252,6 @@ def get_prowler_provider_kwargs(
             **prowler_provider_kwargs,
             "filter_accounts": [provider.uid],
         }
-    elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
-        if isinstance(prowler_provider_kwargs.get("region"), str):
-            prowler_provider_kwargs = {
-                **prowler_provider_kwargs,
-                "region": {prowler_provider_kwargs["region"]},
-            }
     elif provider.provider == Provider.ProviderChoices.OPENSTACK.value:
         # clouds_yaml_content, clouds_yaml_cloud and provider_id are validated
         # in the provider itself, so it's not needed here.
@@ -288,6 +282,11 @@ def get_prowler_provider_kwargs(
                 **{k: v for k, v in prowler_provider_kwargs.items() if v},
             }
 
+    elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+        prowler_provider_kwargs = _normalize_oraclecloud_provider_kwargs(
+            prowler_provider_kwargs
+        )
+
     if mutelist_processor:
         mutelist_content = mutelist_processor.configuration.get("Mutelist", {})
         # IaC and Image providers don't support mutelist (both use Trivy's built-in logic)
@@ -300,6 +299,40 @@ def get_prowler_provider_kwargs(
     return prowler_provider_kwargs
 
 
+def _normalize_oraclecloud_provider_kwargs(secret: dict) -> dict:
+    """Normalize external OCI secret fields into SDK provider kwargs."""
+    prowler_provider_kwargs = secret.copy()
+    prowler_provider_kwargs.pop("region", None)
+
+    return prowler_provider_kwargs
+
+
+def _normalize_oraclecloud_connection_test_kwargs(secret: dict) -> dict:
+    """Normalize external OCI secret fields into test_connection kwargs."""
+    from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvider
+
+    prowler_provider_kwargs = secret.copy()
+    prowler_provider_kwargs.pop("region", None)
+
+    if (
+        prowler_provider_kwargs.get("user")
+        and prowler_provider_kwargs.get("fingerprint")
+        and prowler_provider_kwargs.get("tenancy")
+        and (
+            prowler_provider_kwargs.get("key_content")
+            or prowler_provider_kwargs.get("key_file")
+        )
+    ):
+        # Connection validation needs one OCI endpoint, but scans remain unfiltered.
+        prowler_provider_kwargs["region"] = getattr(
+            OraclecloudProvider,
+            "_bootstrap_region",
+            OraclecloudProvider._home_region,
+        )
+
+    return prowler_provider_kwargs
+
+
 def initialize_prowler_provider(
     provider: Provider,
     mutelist_processor: Processor | None = None,
@@ -402,6 +435,15 @@ def prowler_provider_connection_test(provider: Provider) -> Connection:
         if prowler_provider_kwargs.get("registry_token"):
             image_kwargs["registry_token"] = prowler_provider_kwargs["registry_token"]
         return prowler_provider.test_connection(**image_kwargs)
+    elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+        oraclecloud_kwargs = _normalize_oraclecloud_connection_test_kwargs(
+            prowler_provider_kwargs
+        )
+        return prowler_provider.test_connection(
+            **oraclecloud_kwargs,
+            provider_id=provider.uid,
+            raise_on_exception=False,
+        )
     else:
         return prowler_provider.test_connection(
             **prowler_provider_kwargs,