fix(html): escape provider data in reports (#12247)

Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>

.env

@@ -158,7 +158,7 @@ SENTRY_RELEASE=local
 # REO_DEV_CLIENT_ID=
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.35.1
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.36.1
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"

.github/workflows/api-container-checks.yml

@@ -113,6 +113,15 @@ jobs:
             api/changelog.d/**
             api/AGENTS.md
 
+      # api-container-build-push.yml resolves the SDK pin to the branch tip
+      # before building, so match it here and scan what ships. Push only: PRs
+      # stay deterministic against the committed lock.
+      - name: Refresh prowler SDK pin to current branch tip
+        if: steps.check-changes.outputs.any_changed == 'true' && github.event_name == 'push'
+        run: |
+          pip install --no-cache-dir "uv==0.11.14"
+          (cd api && uv lock --upgrade-package prowler)
+
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

AGENTS.md

@@ -62,6 +62,7 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Action | Skill |
 |--------|-------|
 | Add changelog entry for a PR or feature | `prowler-changelog` |
+| Adding ConfigRequirements guardrails to compliance requirements | `prowler-compliance` |
 | Adding DRF pagination or permissions | `django-drf` |
 | Adding a compliance output formatter (per-provider class + table dispatcher) | `prowler-compliance` |
 | Adding indexes or constraints to database tables | `django-migration-psql` |
@@ -84,6 +85,7 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 | Creating ViewSets, serializers, or filters in api/ | `django-drf` |
 | Creating Zod schemas | `zod-4` |
 | Creating a git commit | `prowler-commit` |
+| Creating a universal (multi-provider) compliance framework | `prowler-compliance` |
 | Creating new checks | `prowler-sdk-check` |
 | Creating new skills | `skill-creator` |
 | Creating or reviewing Django migrations | `django-migration-psql` |

README.md

@@ -123,19 +123,19 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 
 | Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/user-guide/compliance/tutorials/compliance) | [Categories](https://docs.prowler.com/user-guide/cli/tutorials/misc#categories) | Support | Interface |
 |---|---|---|---|---|---|---|
-| AWS | 615 | 86 | 47 | 19 | Official | UI, API, CLI |
-| Azure | 190 | 22 | 21 | 16 | Official | UI, API, CLI |
+| AWS | 621 | 86 | 47 | 19 | Official | UI, API, CLI |
+| Azure | 191 | 22 | 21 | 16 | Official | UI, API, CLI |
 | GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |
-| Kubernetes | 90 | 7 | 8 | 11 | Official | UI, API, CLI |
+| Kubernetes | 92 | 7 | 8 | 11 | Official | UI, API, CLI |
 | GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |
-| M365 | 109 | 10 | 6 | 10 | Official | UI, API, CLI |
+| M365 | 111 | 10 | 6 | 10 | Official | UI, API, CLI |
 | OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |
 | Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |
 | Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |
 | IaC | [See `trivy` docs.](https://trivy.dev/latest/docs/coverage/iac/) | N/A | N/A | N/A | Official | UI, API, CLI |
 | MongoDB Atlas | 10 | 3 | 1 | 8 | Official | UI, API, CLI |
 | LLM | [See `promptfoo` docs.](https://www.promptfoo.dev/docs/red-team/plugins/) | N/A | N/A | N/A | Official | CLI |
-| Image | N/A | N/A | N/A | N/A | Official | CLI, API |
+| Image | N/A | N/A | N/A | N/A | Official | UI, API, CLI |
 | Google Workspace | 65 | 11 | 3 | 6 | Official | UI, API, CLI |
 | OpenStack | 34 | 5 | 1 | 9 | Official | UI, API, CLI |
 | Vercel | 26 | 6 | 1 | 8 | Official | UI, API, CLI |

api/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to the **Prowler API** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [1.37.0] (Prowler v5.36.0)
+
+### 🔄 Changed
+
+- OCI provider secrets no longer require `region`; legacy `region` input is accepted for backwards compatibility but ignored before storing or scanning [(#11741)](https://github.com/prowler-cloud/prowler/pull/11741)
+- Compliance overview ingest now runs in a single transaction per scan with a configurable `COPY` batch size (`DJANGO_COMPLIANCE_COPY_BATCH_SIZE`, default 2000), reducing write pressure on the database [(#11875)](https://github.com/prowler-cloud/prowler/pull/11875)
+
+### 🐞 Fixed
+
+- Scan findings now recover resources missing from the in-memory cache after resource pre-resolution, preventing valid findings from being skipped [(#12002)](https://github.com/prowler-cloud/prowler/pull/12002)
+- Tenant-wide integrations that are not attached to any provider, such as Jira, are now visible and manageable by roles with `manage_integrations` and without unlimited visibility [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
+- Output generation now removes the scan's temporary output directory before writing, so a re-run of the task for the same scan (e.g. broker redelivery after a worker is killed mid-run) no longer appends to the previous run's files and duplicates finding rows in the exported CSV and other outputs [(#12097)](https://github.com/prowler-cloud/prowler/pull/12097)
+
+### 🔐 Security
+
+- Integration responses no longer disclose providers outside the visibility of the role, including the resources sideloaded through `?include=providers` [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
+- Integration connection checks, Jira issue type lookups and Jira dispatches now resolve the integration through the provider visibility of the role instead of the whole tenant [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
+- Roles without unlimited visibility can no longer attach an integration to providers they cannot see, nor edit or delete an integration bound to them [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
+- Kubernetes kubeconfig validation now rejects legacy `auth-provider.config.cmd-path` command authentication in Prowler Cloud/API [(#12091)](https://github.com/prowler-cloud/prowler/pull/12091)
+
+---
+
 ## [1.36.0] (Prowler v5.35.0)
 
 ### 🐞 Fixed

api/Dockerfile

@@ -102,7 +102,9 @@ ENV PATH="/home/prowler/.local/bin:$PATH"
 RUN uv sync --locked --no-install-project && \
     rm -rf ~/.cache/uv
 
-RUN .venv/bin/python .venv/lib/python3.12/site-packages/prowler/providers/m365/lib/powershell/m365_powershell.py
+# Invoked as a module so the base image's Python minor version is not baked
+# into a site-packages path.
+RUN .venv/bin/python -m prowler.providers.m365.lib.powershell.m365_powershell
 
 USER root
 

api/changelog.d/12210.fixed.md

@@ -0,0 +1 @@
+Authentication with an API key whose owning user was deleted now returns `401` instead of an unhandled `AttributeError`, and user deletion now revokes the user's API keys across all their tenants

api/changelog.d/security-hub-connection-status.fixed.md

@@ -0,0 +1 @@
+AWS Security Hub integrations now persist successful connection checks during finding delivery so their connection status and last checked timestamp stay current

api/changelog.d/synthetic-resource-cache-miss.fixed.md

@@ -1 +0,0 @@
-Scan findings now recover resources missing from the in-memory cache after resource pre-resolution, preventing valid findings from being skipped

api/pyproject.toml

@@ -45,7 +45,7 @@ dependencies = [
   "gunicorn==26.0.0",
   "uvloop==0.22.1",
   "lxml==6.1.0",
-  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.35",
+  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.36",
   "psycopg2-binary==2.9.9",
   "pytest-celery[redis] (==1.3.0)",
   "sentry-sdk[django] (==2.56.0)",
@@ -71,7 +71,7 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.36.1"
+version = "1.37.1"
 
 # Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
 # target-version tracks this project's lowest supported Python.

api/src/backend/api/authentication.py

@@ -1,3 +1,4 @@
+import logging
 from math import isfinite
 from uuid import UUID
 
@@ -5,6 +6,7 @@ from api.db_router import MainRouter
 from api.models import TenantAPIKey, TenantAPIKeyManager
 from cryptography.fernet import InvalidToken
 from django.core.exceptions import ObjectDoesNotExist
+from django.db import transaction
 from django.utils import timezone
 from drf_simple_apikey.backends import APIKeyAuthentication as BaseAPIKeyAuth
 from drf_simple_apikey.crypto import get_crypto
@@ -14,6 +16,16 @@ from rest_framework.exceptions import AuthenticationFailed
 from rest_framework.request import Request
 from rest_framework_simplejwt.authentication import JWTAuthentication
 
+logger = logging.getLogger(__name__)
+
+
+class OrphanedAPIKeyError(Exception):
+    """Raised when an API key outlived the user that owns it.
+
+    Handled by `authenticate`, which commits the revocation written while detecting it
+    and then rejects the request with `AuthenticationFailed`.
+    """
+
 
 class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
     model = TenantAPIKey
@@ -24,10 +36,13 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
     def _authenticate_credentials(self, request, key):
         """
         Override to use admin connection, bypassing RLS during authentication.
+
+        Returns the validated API key row, locked with `select_for_update`, so callers
+        must run inside `transaction.atomic(using=MainRouter.admin_db)`.
         """
         try:
             payload = self.key_crypto.decrypt(key)
-        except ValueError:
+        except (ValueError, InvalidToken):
             raise AuthenticationFailed("Invalid API Key.")
 
         if not isinstance(payload, dict):
@@ -52,13 +67,33 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
             raise AuthenticationFailed("API Key has already expired.")
 
         try:
-            api_key = self.model.objects.using(MainRouter.admin_db).get(id=api_key_pk)
+            api_key = (
+                self.model.objects.using(MainRouter.admin_db)
+                .select_for_update()
+                .get(id=api_key_pk)
+            )
         except ObjectDoesNotExist:
             raise AuthenticationFailed("No entity matching this api key.")
 
         if api_key.revoked:
             raise AuthenticationFailed("This API Key has been revoked.")
 
+        # `entity` is nullable and `on_delete=SET_NULL` leaves the key behind when its
+        # owner is deleted, so a key can outlive its user. Reject it here: further down
+        # the authentication would return `None` as the authenticated user, which blows
+        # up while building the auth dict and surfaces as a 500 instead of a 401.
+        # Revoke it as well, so it stops showing up as active and later attempts fail
+        # the `revoked` check above like any other revoked key.
+        if api_key.entity_id is None:
+            api_key.revoked = True
+            api_key.save(update_fields=["revoked"], using=MainRouter.admin_db)
+            logger.warning(
+                "Revoked orphaned API key: prefix=%s tenant=%s",
+                api_key.prefix,
+                api_key.tenant_id,
+            )
+            raise OrphanedAPIKeyError
+
         client_ip = request.META.get(package_settings.IP_ADDRESS_HEADER)
         if api_key.blacklisted_ips and client_ip in api_key.blacklisted_ips:
             raise AuthenticationFailed("Access denied from blacklisted IP.")
@@ -66,7 +101,7 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
         if api_key.whitelisted_ips and client_ip not in api_key.whitelisted_ips:
             raise AuthenticationFailed("Access restricted to specific IP addresses.")
 
-        return api_key.entity, key
+        return api_key
 
     def authenticate(self, request: Request):
         prefixed_key = self.get_key(request)
@@ -77,36 +112,34 @@ class TenantAPIKeyAuthentication(BaseAPIKeyAuth):
         except ValueError:
             raise AuthenticationFailed("Invalid API Key.")
 
-        try:
-            entity, _ = self._authenticate_credentials(request, key)
-        except InvalidToken:
-            raise AuthenticationFailed("Invalid API Key.")
+        # Validation, the `last_used_at` update and the auth claims all read the same
+        # row, locked until the transaction ends. Looking the key up a second time to
+        # build the claims used to leave a window where a key revoked or orphaned right
+        # after passing validation still authenticated.
+        with transaction.atomic(using=MainRouter.admin_db):
+            try:
+                api_key = self._authenticate_credentials(request, key)
+            except OrphanedAPIKeyError:
+                # Rejected below instead of here: leaving the block normally commits
+                # the revocation `_authenticate_credentials` wrote, while raising from
+                # inside would roll it back.
+                pass
+            else:
+                # The prefix used to be checked by the second lookup
+                if api_key.prefix != prefix:
+                    raise AuthenticationFailed("Invalid API Key.")
 
-        # Get the API key instance to update last_used_at and retrieve tenant info
-        # We need to decrypt again to get the pk (already validated by _authenticate_credentials)
-        payload = self.key_crypto.decrypt(key)
-        api_key_pk = payload["_pk"]
+                api_key.last_used_at = timezone.now()
+                api_key.save(update_fields=["last_used_at"], using=MainRouter.admin_db)
 
-        # Convert string UUID back to UUID object for lookup
-        if isinstance(api_key_pk, str):
-            api_key_pk = UUID(api_key_pk)
+                entity = api_key.entity
+                return entity, {
+                    "tenant_id": str(api_key.tenant_id),
+                    "sub": str(entity.id),
+                    "api_key_prefix": api_key.prefix,
+                }
 
-        try:
-            api_key_instance = TenantAPIKey.objects.using(MainRouter.admin_db).get(
-                id=api_key_pk, prefix=prefix
-            )
-        except TenantAPIKey.DoesNotExist:
-            raise AuthenticationFailed("Invalid API Key.")
-
-        # Update last_used_at
-        api_key_instance.last_used_at = timezone.now()
-        api_key_instance.save(update_fields=["last_used_at"], using=MainRouter.admin_db)
-
-        return entity, {
-            "tenant_id": str(api_key_instance.tenant_id),
-            "sub": str(api_key_instance.entity.id),
-            "api_key_prefix": prefix,
-        }
+        raise AuthenticationFailed("No entity matching this api key.")
 
 
 class CombinedJWTOrAPIKeyAuthentication(BaseAuthentication):

api/src/backend/api/base_views.py

@@ -3,9 +3,10 @@ from api.db_router import MainRouter, reset_read_db_alias, set_read_db_alias
 from api.db_utils import POSTGRES_USER_VAR, rls_transaction
 from api.filters import CustomDjangoFilterBackend
 from api.models import Role, UserRoleRelationship
-from api.rbac.permissions import HasPermissions
+from api.rbac.permissions import HasPermissions, get_role
 from django.conf import settings
 from django.db import transaction
+from django.utils.functional import cached_property
 from rest_framework import permissions
 from rest_framework.exceptions import NotAuthenticated
 from rest_framework.filters import SearchFilter
@@ -100,6 +101,11 @@ class BaseRLSViewSet(BaseViewSet):
         context["tenant_id"] = self.request.tenant_id
         return context
 
+    @cached_property
+    def user_role(self):
+        """Role of the requesting user in the active tenant, resolved once per request."""
+        return get_role(self.request.user, self.request.tenant_id)
+
 
 class BaseTenantViewset(BaseViewSet):
     def dispatch(self, request, *args, **kwargs):

api/src/backend/api/rbac/permissions.py

@@ -1,8 +1,8 @@
 from enum import Enum
 
 from api.db_router import MainRouter
-from api.models import Provider, Role, User
-from django.db.models import QuerySet
+from api.models import Integration, Provider, Role, User
+from django.db.models import Q, QuerySet
 from rest_framework.exceptions import PermissionDenied
 from rest_framework.permissions import BasePermission
 
@@ -83,3 +83,32 @@ def get_providers(role: Role) -> QuerySet[Provider]:
     return Provider.objects.filter(
         tenant_id=tenant_id, provider_groups__in=provider_groups
     ).distinct()
+
+
+def get_integrations(
+    role: Role, providers: QuerySet[Provider] | None = None
+) -> QuerySet[Integration]:
+    """
+    Return a distinct queryset of Integrations visible to the given role.
+
+    Integrations with no providers attached are tenant-wide, as is always the case for
+    Jira, and stay visible regardless of the provider visibility of the role. Integrations
+    attached to providers are only visible when the role can access at least one of them.
+
+    Args:
+        role: A Role instance.
+        providers: Optional queryset of the providers accessible by the role, to reuse
+            an already resolved `get_providers(role)` result within the same request.
+
+    Returns:
+        A QuerySet of Integration objects visible to the role.
+    """
+    queryset = Integration.objects.filter(tenant_id=role.tenant_id)
+    if role.unlimited_visibility:
+        return queryset
+
+    if providers is None:
+        providers = get_providers(role)
+    return queryset.filter(
+        Q(providers__isnull=True) | Q(providers__in=providers)
+    ).distinct()

api/src/backend/api/signals.py

@@ -1,3 +1,4 @@
+from api.db_router import MainRouter
 from api.db_utils import delete_related_daily_task
 from api.models import (
     LighthouseProviderConfiguration,
@@ -47,8 +48,15 @@ def revoke_user_api_keys(sender, instance, **kwargs):  # noqa: F841
 
     The entity field will be set to NULL by on_delete=SET_NULL,
     but we explicitly revoke the keys to prevent further use.
+
+    The update runs on the admin connection because `api_keys` is RLS protected and its
+    policy denies every row when `api.tenant_id` is unset. Users are deleted through the
+    admin connection and may belong to several tenants, so going through the default
+    connection would silently revoke nothing, or only the keys of the active tenant.
     """
-    TenantAPIKey.objects.filter(entity=instance).update(revoked=True)
+    TenantAPIKey.objects.using(MainRouter.admin_db).filter(entity=instance).update(
+        revoked=True
+    )
 
 
 @receiver(post_delete, sender=Membership)
@@ -58,8 +66,12 @@ def revoke_membership_api_keys(sender, instance, **kwargs):  # noqa: F841
 
     When a membership is deleted, all API keys created by that user
     in that tenant should be revoked to prevent further access.
+
+    Uses the admin connection for the same reason as `revoke_user_api_keys`: the RLS
+    policy on `api_keys` denies every row when `api.tenant_id` is unset, which is the
+    case when the membership is removed as a cascade of a user deletion.
     """
-    TenantAPIKey.objects.filter(
+    TenantAPIKey.objects.using(MainRouter.admin_db).filter(
         entity_id=instance.user_id, tenant_id=instance.tenant_id
     ).update(revoked=True)
 

api/src/backend/api/specs/v1.yaml

@@ -1,7 +1,7 @@
 openapi: 3.0.3
 info:
   title: Prowler API
-  version: 1.36.1
+  version: 1.37.1
   description: |-
     Prowler API specification.
 
@@ -6629,8 +6629,10 @@ paths:
   /api/v1/integrations:
     get:
       operationId: api_v1_integrations_list
-      description: Retrieve a list of all configured integrations with options for
-        filtering by various criteria.
+      description: |-
+        Retrieve a list of all configured integrations with options for filtering by various criteria.
+
+        Integrations attached to one or more providers are only returned when the role can access at least one of those providers, and each integration lists only the providers visible to the role. Integrations not attached to any provider, such as Jira, are tenant-wide and are returned for every role.
       summary: List all integrations
       parameters:
       - in: query
@@ -6781,7 +6783,8 @@ paths:
     post:
       operationId: api_v1_integrations_create
       description: Register a new integration with the system, providing necessary
-        configuration details.
+        configuration details. Only providers visible to the role can be attached
+        to the integration.
       summary: Create a new integration
       tags:
       - Integration
@@ -6810,7 +6813,7 @@ paths:
     post:
       operationId: api_v1_integrations_jira_dispatches_create
       description: |-
-        Send a set of filtered findings to the given integration. At least one finding filter must be provided.
+        Send a set of filtered findings to the given integration. At least one finding filter must be provided. Jira integrations are tenant-wide and do not require unlimited visibility, while the findings sent are limited to the providers the role can access.
 
         ## Known Limitations
 
@@ -6883,7 +6886,8 @@ paths:
     get:
       operationId: api_v1_integrations_jira_issue_types_retrieve
       description: Fetch the available issue types from Jira for a given project key
-        and update the integration configuration.
+        and update the integration configuration. Jira integrations are tenant-wide
+        and do not require unlimited visibility.
       summary: Get available issue types for a Jira project
       parameters:
       - in: query
@@ -6924,7 +6928,8 @@ paths:
     get:
       operationId: api_v1_integrations_retrieve
       description: Fetch detailed information about a specific integration by its
-        ID.
+        ID. Integrations outside the provider visibility of the role are reported
+        the same way as one that does not exist.
       summary: Retrieve integration details
       parameters:
       - in: query
@@ -6978,7 +6983,8 @@ paths:
     patch:
       operationId: api_v1_integrations_partial_update
       description: Modify certain fields of an existing integration without affecting
-        other settings.
+        other settings. Integrations attached to providers outside the visibility
+        of the role cannot be modified by it.
       summary: Partially update an integration
       parameters:
       - in: path
@@ -7013,7 +7019,8 @@ paths:
           description: ''
     delete:
       operationId: api_v1_integrations_destroy
-      description: Remove an integration from the system by its ID.
+      description: Remove an integration from the system by its ID. Integrations attached
+        to providers outside the visibility of the role cannot be deleted by it.
       summary: Delete an integration
       parameters:
       - in: path
@@ -7033,7 +7040,9 @@ paths:
   /api/v1/integrations/{id}/connection:
     post:
       operationId: api_v1_integrations_connection_create
-      description: Try to verify integration connection
+      description: Try to verify integration connection. Integrations outside the
+        provider visibility of the role are reported the same way as one that does
+        not exist.
       summary: Check integration connection
       parameters:
       - in: path

api/src/backend/api/tests/integration/test_authentication.py

@@ -4,8 +4,11 @@ from datetime import UTC, datetime, timedelta
 from uuid import uuid4
 
 import pytest
+from api.db_router import MainRouter
 from api.models import Membership, Role, TenantAPIKey, User, UserRoleRelationship
+from api.signals import revoke_membership_api_keys, revoke_user_api_keys
 from conftest import TEST_PASSWORD, get_api_tokens, get_authorization_header
+from django.db.utils import ConnectionDoesNotExist
 from django.urls import reverse
 from drf_simple_apikey.crypto import get_crypto
 from rest_framework.test import APIClient
@@ -625,6 +628,34 @@ class TestAPIKeyErrors:
         assert response.status_code == 401
         assert "API Key has been revoked." in response.json()["errors"][0]["detail"]
 
+    def test_orphaned_api_key_rejected(
+        self, create_test_user, tenants_fixture, api_keys_fixture
+    ):
+        """Key whose owning user was deleted returns 401 instead of 500."""
+        client = APIClient()
+
+        api_key = api_keys_fixture[0]
+        # `on_delete=SET_NULL` leaves the key behind with no entity when the owner goes
+        TenantAPIKey.objects.filter(id=api_key.id).update(entity=None)
+
+        api_key_headers = get_api_key_header(api_key._raw_key)
+        response = client.get(reverse("provider-list"), headers=api_key_headers)
+
+        assert response.status_code == 401
+        assert (
+            "No entity matching this api key." in response.json()["errors"][0]["detail"]
+        )
+
+        # The orphaned key is revoked on use; retries fail the regular revoked check
+        api_key.refresh_from_db()
+        assert api_key.revoked is True
+
+        retry_response = client.get(reverse("provider-list"), headers=api_key_headers)
+        assert retry_response.status_code == 401
+        assert (
+            "API Key has been revoked." in retry_response.json()["errors"][0]["detail"]
+        )
+
     def test_non_existent_api_key(self, create_test_user, tenants_fixture):
         """Key UUID doesn't exist in database."""
         client = APIClient()
@@ -817,6 +848,93 @@ class TestAPIKeyTenantIsolation:
         error_detail = response_json["errors"][0]["detail"]
         assert "revoked" in error_detail.lower()
 
+    def test_deleting_user_revokes_api_keys_in_every_tenant(self, tenants_fixture):
+        """Deleting a user revokes their keys in all their tenants, not just one."""
+        first_tenant, second_tenant = tenants_fixture[0], tenants_fixture[1]
+
+        test_user = User.objects.create_user(
+            name="multi_tenant_user",
+            email="multi_tenant_user@prowler.com",
+            password=TEST_PASSWORD,
+        )
+        for tenant in (first_tenant, second_tenant):
+            Membership.objects.create(
+                user=test_user, tenant=tenant, role=Membership.RoleChoices.OWNER
+            )
+
+        first_key, _ = TenantAPIKey.objects.create_api_key(
+            name="Key in first tenant", tenant_id=first_tenant.id, entity=test_user
+        )
+        second_key, _ = TenantAPIKey.objects.create_api_key(
+            name="Key in second tenant", tenant_id=second_tenant.id, entity=test_user
+        )
+
+        test_user.delete()
+
+        first_key.refresh_from_db()
+        second_key.refresh_from_db()
+        assert first_key.revoked is True
+        assert second_key.revoked is True
+        # `on_delete=SET_NULL` orphans the keys, so revoking them is what keeps them
+        # from authenticating
+        assert first_key.entity_id is None
+        assert second_key.entity_id is None
+
+    def test_revoke_user_api_keys_uses_the_admin_connection(
+        self, monkeypatch, tenants_fixture
+    ):
+        """The revocation must not go through the default connection.
+
+        `api_keys` is RLS protected and its policy denies every row when `api.tenant_id`
+        is unset, which is the case while a user is deleted through the admin
+        connection: the update would silently revoke nothing and leave usable orphaned
+        keys behind.
+
+        Pointing `admin_db` at a missing alias is the only way to assert the connection
+        here, because the test suite runs on a single superuser database with
+        `MainRouter.admin_db` patched to "default" (see `conftest.py`), so RLS never
+        applies and both connections are otherwise indistinguishable.
+        """
+        test_user = User.objects.create_user(
+            name="admin_connection_user",
+            email="admin_connection_user@prowler.com",
+            password=TEST_PASSWORD,
+        )
+        Membership.objects.create(user=test_user, tenant=tenants_fixture[0])
+        TenantAPIKey.objects.create_api_key(
+            name="Key for admin connection check",
+            tenant_id=tenants_fixture[0].id,
+            entity=test_user,
+        )
+
+        monkeypatch.setattr(MainRouter, "admin_db", "missing_admin_alias")
+
+        with pytest.raises(ConnectionDoesNotExist):
+            revoke_user_api_keys(sender=User, instance=test_user)
+
+    def test_revoke_membership_api_keys_uses_the_admin_connection(
+        self, monkeypatch, tenants_fixture
+    ):
+        """Same as the user deletion case: this receiver also runs as its cascade."""
+        test_user = User.objects.create_user(
+            name="admin_connection_membership_user",
+            email="admin_connection_membership_user@prowler.com",
+            password=TEST_PASSWORD,
+        )
+        membership = Membership.objects.create(
+            user=test_user, tenant=tenants_fixture[0]
+        )
+        TenantAPIKey.objects.create_api_key(
+            name="Key for membership admin connection check",
+            tenant_id=tenants_fixture[0].id,
+            entity=test_user,
+        )
+
+        monkeypatch.setattr(MainRouter, "admin_db", "missing_admin_alias")
+
+        with pytest.raises(ConnectionDoesNotExist):
+            revoke_membership_api_keys(sender=Membership, instance=membership)
+
 
 @pytest.mark.django_db
 class TestAPIKeyLifecycle:

api/src/backend/api/tests/test_authentication.py

@@ -4,11 +4,17 @@ from unittest.mock import MagicMock, patch
 from uuid import uuid4
 
 import pytest
-from api.authentication import SSEAuthentication, TenantAPIKeyAuthentication
+from api.authentication import (
+    OrphanedAPIKeyError,
+    SSEAuthentication,
+    TenantAPIKeyAuthentication,
+)
 from api.db_router import MainRouter
 from api.models import TenantAPIKey
+from django.db import connections
 from django.db.models.query import QuerySet
 from django.test import RequestFactory
+from django.test.utils import CaptureQueriesContext
 from rest_framework.exceptions import AuthenticationFailed
 
 
@@ -38,13 +44,12 @@ class TestTenantAPIKeyAuthentication:
         request = request_factory.get("/")
 
         # Call the method
-        entity, auth_dict = auth_backend._authenticate_credentials(
-            request, encrypted_key
-        )
+        validated_key = auth_backend._authenticate_credentials(request, encrypted_key)
 
         # Verify that the entity is the user associated with the API key
-        assert entity == api_key.entity
-        assert entity.id == api_key.entity.id
+        assert validated_key.id == api_key.id
+        assert validated_key.entity == api_key.entity
+        assert validated_key.entity.id == api_key.entity.id
 
     def test_authenticate_credentials_restores_manager_on_success(
         self, auth_backend, api_keys_fixture, request_factory
@@ -231,6 +236,120 @@ class TestTenantAPIKeyAuthentication:
 
         assert str(exc_info.value.detail) == "This API Key has been revoked."
 
+    def test_authenticate_credentials_orphaned_api_key(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test credential validation fails when the owning user no longer exists."""
+        api_key = api_keys_fixture[0]
+        _, encrypted_key = api_key._raw_key.split(TenantAPIKey.objects.separator, 1)
+
+        # `entity` is what `on_delete=SET_NULL` leaves behind when the owner is deleted
+        TenantAPIKey.objects.filter(id=api_key.id).update(entity=None)
+
+        request = request_factory.get("/")
+
+        with pytest.raises(OrphanedAPIKeyError):
+            auth_backend._authenticate_credentials(request, encrypted_key)
+
+        # The orphaned key is revoked on use, so it stops showing up as active
+        api_key.refresh_from_db()
+        assert api_key.revoked is True
+
+    def test_authenticate_orphaned_api_key(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test authentication fails with a key whose owning user was deleted.
+
+        Regression test: this used to raise `AttributeError: 'NoneType' object has no
+        attribute 'id'` while building the auth dict, which DRF re-raises as
+        `WrappedAttributeError` and turns into a 500 instead of a 401.
+        """
+        api_key = api_keys_fixture[0]
+        raw_key = api_key._raw_key
+
+        TenantAPIKey.objects.filter(id=api_key.id).update(entity=None)
+
+        request = request_factory.get("/")
+        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {raw_key}"
+
+        with pytest.raises(AuthenticationFailed) as exc_info:
+            auth_backend.authenticate(request)
+
+        assert str(exc_info.value.detail) == "No entity matching this api key."
+
+        # The orphaned key is revoked on use; retries fail the regular revoked check
+        api_key.refresh_from_db()
+        assert api_key.revoked is True
+
+        with pytest.raises(AuthenticationFailed) as exc_info:
+            auth_backend.authenticate(request)
+
+        assert str(exc_info.value.detail) == "This API Key has been revoked."
+
+    def test_authenticate_reads_the_api_key_once_under_a_row_lock(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test the API key is read a single time and the row is locked.
+
+        Validation, the `last_used_at` update and the claims must all come from the
+        same authoritative row: a second, unlocked lookup would reopen the window
+        where a key revoked in between still authenticates.
+        """
+        api_key = api_keys_fixture[0]
+
+        request = request_factory.get("/")
+        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"
+
+        with CaptureQueriesContext(connections[MainRouter.admin_db]) as captured:
+            auth_backend.authenticate(request)
+
+        api_key_selects = [
+            query["sql"]
+            for query in captured.captured_queries
+            if query["sql"].startswith("SELECT") and '"api_keys"' in query["sql"]
+        ]
+
+        assert len(api_key_selects) == 1
+        assert "FOR UPDATE" in api_key_selects[0]
+
+    def test_authenticate_ignores_revocation_after_the_locked_read(
+        self, auth_backend, api_keys_fixture, request_factory
+    ):
+        """Test the claims describe the row that was validated, not a later state.
+
+        Regression test: the key used to be looked up again to build the auth dict,
+        without rechecking `revoked` or `entity`. A key revoked or orphaned between
+        both reads still authenticated, and the claims came from that stale row. With
+        a single locked read the write below cannot land mid-authentication, and the
+        revocation only takes effect on the next request.
+        """
+        api_key = api_keys_fixture[0]
+        entity_at_validation = api_key.entity
+        original_save = TenantAPIKey.save
+
+        def revoke_and_orphan_before_saving(instance, *args, **kwargs):
+            # Runs after validation, right before the claims are built: the exact
+            # window a concurrent revocation or user deletion used to slip into
+            TenantAPIKey.objects.filter(id=api_key.id).update(revoked=True, entity=None)
+            return original_save(instance, *args, **kwargs)
+
+        request = request_factory.get("/")
+        request.META["HTTP_AUTHORIZATION"] = f"Api-Key {api_key._raw_key}"
+
+        with patch.object(TenantAPIKey, "save", revoke_and_orphan_before_saving):
+            entity, auth_dict = auth_backend.authenticate(request)
+
+        assert entity == entity_at_validation
+        assert auth_dict["sub"] == str(entity_at_validation.id)
+        assert auth_dict["tenant_id"] == str(api_key.tenant_id)
+        assert auth_dict["api_key_prefix"] == api_key.prefix
+
+        # The revoked key is rejected from the next request on
+        with pytest.raises(AuthenticationFailed) as exc_info:
+            auth_backend.authenticate(request)
+
+        assert str(exc_info.value.detail) == "This API Key has been revoked."
+
     def test_authenticate_expired_api_key(
         self, auth_backend, create_test_user, tenants_fixture, request_factory
     ):

api/src/backend/api/tests/test_rbac.py

@@ -3,6 +3,8 @@ from unittest.mock import ANY, Mock, patch
 
 import pytest
 from api.models import (
+    Integration,
+    IntegrationProviderRelationship,
     Membership,
     ProviderGroup,
     ProviderGroupMembership,
@@ -681,6 +683,363 @@ class TestLimitedVisibility:
             response.json()["data"]["relationships"]["providers"]["meta"]["count"] == 1
         )
 
+    @pytest.fixture
+    def jira_integration(self, tenants_fixture):
+        # Jira is a tenant-wide integration: it is not attached to any provider
+        return Integration.objects.create(
+            tenant_id=tenants_fixture[0].id,
+            enabled=True,
+            connected=True,
+            integration_type=Integration.IntegrationChoices.JIRA,
+            configuration={"projects": {"TEST": "Test project"}},
+            credentials={
+                "domain": "test",
+                "user_mail": "a@b.com",
+                "api_token": "token",
+            },
+        )
+
+    @pytest.fixture
+    def out_of_scope_integration(self, tenants_fixture, provider_factory):
+        tenant_id = tenants_fixture[0].id
+        integration = Integration.objects.create(
+            tenant_id=tenant_id,
+            enabled=True,
+            connected=True,
+            integration_type=Integration.IntegrationChoices.AMAZON_S3,
+            configuration={
+                "bucket_name": "bucket",
+                "output_directory": "output",
+            },
+            credentials={"aws_access_key_id": "key"},
+        )
+        IntegrationProviderRelationship.objects.create(
+            tenant_id=tenant_id,
+            integration=integration,
+            provider=provider_factory(),
+        )
+        return integration
+
+    def test_integrations_list_includes_tenant_wide_integration(
+        self,
+        authenticated_client_rbac_limited,
+        integrations_fixture,
+        jira_integration,
+        aws_provider_pair,
+    ):
+        # Integration 2 is attached to both providers, so make both visible to the role
+        # to assert the provider join does not duplicate it in the listing
+        ProviderGroupMembership.objects.create(
+            tenant_id=aws_provider_pair[1].tenant_id,
+            provider=aws_provider_pair[1],
+            provider_group=ProviderGroup.objects.get(name="limited_visibility_group"),
+        )
+
+        response = authenticated_client_rbac_limited.get(reverse("integration-list"))
+
+        assert response.status_code == status.HTTP_200_OK
+        integration_ids = [item["id"] for item in response.json()["data"]]
+        # The tenant-wide Jira integration is visible without unlimited visibility
+        assert str(jira_integration.id) in integration_ids
+        # Integrations attached to more than one visible provider are not duplicated
+        assert integration_ids.count(str(integrations_fixture[1].id)) == 1
+        assert response.json()["meta"]["pagination"]["count"] == len(integration_ids)
+
+    def test_integrations_list_without_provider_groups_keeps_tenant_wide_integration(
+        self, authenticated_client_rbac_limited, integrations_fixture, jira_integration
+    ):
+        # A role with no provider group at all sees no provider, but still needs Jira
+        RoleProviderGroupRelationship.objects.all().delete()
+
+        response = authenticated_client_rbac_limited.get(reverse("integration-list"))
+
+        assert response.status_code == status.HTTP_200_OK
+        integration_ids = [item["id"] for item in response.json()["data"]]
+        assert integration_ids == [str(jira_integration.id)]
+
+    def test_integrations_include_providers_hides_out_of_scope_providers(
+        self, authenticated_client_rbac_limited, integrations_fixture, aws_provider_pair
+    ):
+        # Integration 2 is related to provider1 (visible) and provider2 (not visible)
+        hidden_provider = aws_provider_pair[1]
+
+        response = authenticated_client_rbac_limited.get(
+            reverse("integration-list"), {"include": "providers"}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        included_ids = {item["id"] for item in response.json().get("included", [])}
+        assert str(aws_provider_pair[0].id) in included_ids
+        # Sideloaded resources must not disclose the provider the role cannot see
+        assert str(hidden_provider.id) not in included_ids
+
+    def test_integrations_list_with_sparse_fields(
+        self, authenticated_client_rbac_limited, integrations_fixture
+    ):
+        response = authenticated_client_rbac_limited.get(
+            reverse("integration-list"), {"fields[integrations]": "enabled"}
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert all(
+            list(item["attributes"].keys()) == ["enabled"]
+            for item in response.json()["data"]
+        )
+
+    def test_integrations_list_excludes_out_of_scope_integration(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.get(reverse("integration-list"))
+
+        assert response.status_code == status.HTTP_200_OK
+        integration_ids = [item["id"] for item in response.json()["data"]]
+        assert str(out_of_scope_integration.id) not in integration_ids
+
+    def test_integration_detail_out_of_scope_returns_404(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.get(
+            reverse("integration-detail", kwargs={"pk": out_of_scope_integration.id})
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_integration_connection_out_of_scope_returns_404(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.post(
+            reverse(
+                "integration-connection", kwargs={"pk": out_of_scope_integration.id}
+            )
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_integration_update_allowed_when_fully_visible(
+        self, authenticated_client_rbac_limited, integrations_fixture, jira_integration
+    ):
+        # Integration 1 is only related to provider1, which the role can access
+        integration = integrations_fixture[0]
+        payload = {
+            "data": {
+                "type": "integrations",
+                "id": str(integration.id),
+                "attributes": {
+                    "enabled": False,
+                    # integration_type is `amazon_s3`
+                    "credentials": {"aws_access_key_id": "new_value"},
+                    "configuration": {
+                        "bucket_name": "new_bucket_name",
+                        "output_directory": "new_output_directory",
+                    },
+                },
+            }
+        }
+
+        response = authenticated_client_rbac_limited.patch(
+            reverse("integration-detail", kwargs={"pk": integration.id}),
+            data=json.dumps(payload),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        integration.refresh_from_db()
+        assert integration.enabled is False
+
+        # Tenant-wide integrations have no provider restricting the role
+        payload = {
+            "data": {
+                "type": "integrations",
+                "id": str(jira_integration.id),
+                "attributes": {"enabled": False},
+            }
+        }
+
+        response = authenticated_client_rbac_limited.patch(
+            reverse("integration-detail", kwargs={"pk": jira_integration.id}),
+            data=json.dumps(payload),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        jira_integration.refresh_from_db()
+        assert jira_integration.enabled is False
+
+    def test_integration_create_rejects_out_of_scope_provider(
+        self, authenticated_client_rbac_limited, aws_provider_pair
+    ):
+        # provider2 is not in any provider group assigned to the role
+        payload = {
+            "data": {
+                "type": "integrations",
+                "attributes": {
+                    "integration_type": "amazon_s3",
+                    "configuration": {
+                        "bucket_name": "attacker_bucket",
+                        "output_directory": "output",
+                    },
+                    "credentials": {"aws_access_key_id": "key"},
+                },
+                "relationships": {
+                    "providers": {
+                        "data": [
+                            {"type": "providers", "id": str(aws_provider_pair[1].id)}
+                        ]
+                    }
+                },
+            }
+        }
+
+        response = authenticated_client_rbac_limited.post(
+            reverse("integration-list"),
+            data=json.dumps(payload),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+        assert not Integration.objects.filter(
+            integrationproviderrelationship__provider=aws_provider_pair[1],
+            configuration__bucket_name="attacker_bucket",
+        ).exists()
+
+    @pytest.mark.parametrize("submitted_providers", [True, False])
+    def test_integration_update_denied_when_shared_with_hidden_provider(
+        self,
+        authenticated_client_rbac_limited,
+        integrations_fixture,
+        aws_provider_pair,
+        submitted_providers,
+    ):
+        # Integration 2 is related to provider1 (visible) and provider2 (not visible).
+        # Editing it would reach beyond the visibility of the role, just like deleting
+        # it, so both are rejected consistently
+        integration = integrations_fixture[1]
+        visible_provider, hidden_provider = aws_provider_pair
+        payload = {
+            "data": {
+                "type": "integrations",
+                "id": str(integration.id),
+                "attributes": {
+                    "enabled": False,
+                    # integration_type is `amazon_s3`
+                    "credentials": {"aws_access_key_id": "new_value"},
+                    "configuration": {
+                        "bucket_name": "new_bucket_name",
+                        "output_directory": "new_output_directory",
+                    },
+                },
+            }
+        }
+        if submitted_providers:
+            payload["data"]["relationships"] = {
+                "providers": {
+                    "data": [{"type": "providers", "id": str(visible_provider.id)}]
+                }
+            }
+
+        response = authenticated_client_rbac_limited.patch(
+            reverse("integration-detail", kwargs={"pk": integration.id}),
+            data=json.dumps(payload),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+        integration.refresh_from_db()
+        assert integration.enabled is True
+        assert integration.providers.filter(id=hidden_provider.id).exists()
+        assert integration.providers.filter(id=visible_provider.id).exists()
+
+    def test_integration_delete_denied_when_shared_with_hidden_provider(
+        self, authenticated_client_rbac_limited, integrations_fixture
+    ):
+        # Integration 2 is related to provider1 (visible) and provider2 (not visible)
+        integration = integrations_fixture[1]
+
+        response = authenticated_client_rbac_limited.delete(
+            reverse("integration-detail", kwargs={"pk": integration.id})
+        )
+
+        assert response.status_code == status.HTTP_403_FORBIDDEN
+        assert Integration.objects.filter(id=integration.id).exists()
+
+    def test_integration_delete_allowed_when_fully_visible(
+        self, authenticated_client_rbac_limited, integrations_fixture, jira_integration
+    ):
+        # Integration 1 is only related to provider1, which the role can access
+        integration = integrations_fixture[0]
+
+        response = authenticated_client_rbac_limited.delete(
+            reverse("integration-detail", kwargs={"pk": integration.id})
+        )
+
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+        assert not Integration.objects.filter(id=integration.id).exists()
+
+        # Tenant-wide integrations have no provider restricting the role
+        response = authenticated_client_rbac_limited.delete(
+            reverse("integration-detail", kwargs={"pk": jira_integration.id})
+        )
+
+        assert response.status_code == status.HTTP_204_NO_CONTENT
+
+    def test_jira_issue_types_allowed_without_unlimited_visibility(
+        self, authenticated_client_rbac_limited, jira_integration
+    ):
+        with patch("api.v1.views.initialize_prowler_integration") as mock_jira:
+            mock_jira.return_value.get_available_issue_types.return_value = ["Task"]
+            response = authenticated_client_rbac_limited.get(
+                reverse(
+                    "integration-jira-issue-types",
+                    kwargs={"integration_pk": jira_integration.id},
+                ),
+                {"project_key": "TEST"},
+            )
+
+        assert response.status_code == status.HTTP_200_OK
+        assert response.json()["data"]["attributes"]["issue_types"] == ["Task"]
+
+    def test_jira_issue_types_out_of_scope_returns_404(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.get(
+            reverse(
+                "integration-jira-issue-types",
+                kwargs={"integration_pk": out_of_scope_integration.id},
+            ),
+            {"project_key": "TEST"},
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_jira_dispatches_out_of_scope_returns_404(
+        self, authenticated_client_rbac_limited, out_of_scope_integration
+    ):
+        response = authenticated_client_rbac_limited.post(
+            reverse(
+                "integration-jira-dispatches",
+                kwargs={"integration_pk": out_of_scope_integration.id},
+            ),
+            data=json.dumps({}),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_404_NOT_FOUND
+
+    def test_jira_dispatches_allowed_without_unlimited_visibility(
+        self, authenticated_client_rbac_limited, jira_integration
+    ):
+        response = authenticated_client_rbac_limited.post(
+            reverse(
+                "integration-jira-dispatches",
+                kwargs={"integration_pk": jira_integration.id},
+            ),
+            data=json.dumps({}),
+            content_type="application/vnd.api+json",
+        )
+
+        # The integration is reachable: the request fails on payload validation, not RBAC
+        assert response.status_code == status.HTTP_400_BAD_REQUEST
+
     @pytest.mark.usefixtures("scan_summaries_fixture")
     def test_overviews_providers(
         self,

api/src/backend/api/tests/test_serializers.py

@@ -3,7 +3,12 @@ from api.v1.serializer_utils.integrations import (
     JiraCredentialSerializer,
     S3ConfigSerializer,
 )
-from api.v1.serializers import ImageProviderSecret, KubernetesProviderSecret
+from api.v1.serializer_utils.providers import ProviderSecretField
+from api.v1.serializers import (
+    ImageProviderSecret,
+    KubernetesProviderSecret,
+    OracleCloudProviderSecret,
+)
 from rest_framework.exceptions import ValidationError
 
 
@@ -190,6 +195,64 @@ class TestImageProviderSecret:
         assert "non_field_errors" in serializer.errors
 
 
+class TestOracleCloudProviderSecret:
+    def valid_secret(self, **overrides):
+        secret = {
+            "user": "ocid1.user.oc1..aaaaaaaexample",
+            "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+        }
+        secret.update(overrides)
+        return secret
+
+    def test_accepts_regionless_secret(self):
+        serializer = OracleCloudProviderSecret(data=self.valid_secret())
+
+        assert serializer.is_valid(), serializer.errors
+        assert "region" not in serializer.validated_data
+
+    def test_accepts_and_ignores_region_field(self):
+        secret = self.valid_secret(region="us-phoenix-1")
+        serializer = OracleCloudProviderSecret(data=secret)
+
+        assert serializer.is_valid(), serializer.errors
+
+        assert "region" not in serializer.validated_data
+
+    @pytest.mark.parametrize(
+        "legacy_field, legacy_value",
+        [
+            ("region", None),
+            ("region", ""),
+            ("region", {"name": "us-ashburn-1"}),
+        ],
+    )
+    def test_accepts_and_ignores_any_legacy_region_value(
+        self, legacy_field, legacy_value
+    ):
+        serializer = OracleCloudProviderSecret(
+            data=self.valid_secret(**{legacy_field: legacy_value})
+        )
+
+        assert serializer.is_valid(), serializer.errors
+
+        assert legacy_field not in serializer.validated_data
+
+
+class TestProviderSecretFieldSchema:
+    def test_oraclecloud_schema_includes_legacy_region_field(self):
+        schema = ProviderSecretField._spectacular_annotation["field"]
+        oraclecloud_schema = next(
+            credential_schema
+            for credential_schema in schema["oneOf"]
+            if credential_schema["title"]
+            == "Oracle Cloud Infrastructure (OCI) API Key Credentials"
+        )
+
+        assert oraclecloud_schema["properties"]["region"]["deprecated"] is True
+
+
 class TestKubernetesProviderSecret:
     def test_valid_static_kubeconfig_is_accepted(self):
         kubeconfig_content = """
@@ -246,6 +309,36 @@ current-context: test-context
         assert not serializer.is_valid()
         assert "kubeconfig_content" in serializer.errors
 
+    def test_kubeconfig_with_auth_provider_cmd_path_is_rejected(self):
+        kubeconfig_content = """
+apiVersion: v1
+kind: Config
+clusters:
+  - name: test-cluster
+    cluster:
+      server: https://kubernetes.example.test
+users:
+  - name: test-user
+    user:
+      auth-provider:
+        name: gcp
+        config:
+          cmd-path: /bin/sh
+contexts:
+  - name: test-context
+    context:
+      cluster: test-cluster
+      user: test-user
+current-context: test-context
+"""
+
+        serializer = KubernetesProviderSecret(
+            data={"kubeconfig_content": kubeconfig_content}
+        )
+
+        assert not serializer.is_valid()
+        assert "kubeconfig_content" in serializer.errors
+
     def test_malformed_kubeconfig_is_rejected(self):
         serializer = KubernetesProviderSecret(
             data={"kubeconfig_content": "apiVersion: ["}

api/src/backend/api/tests/test_utils.py

@@ -171,6 +171,53 @@ class TestInitializeProwlerProvider:
             key="value", mutelist_content={"key": "value"}
         )
 
+    @patch("api.utils.return_prowler_provider")
+    def test_initialize_oraclecloud_provider_removes_region_string(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret.secret = {
+            "user": "ocid1.user.oc1..fake",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..fake",
+            "region": "us-ashburn-1",
+        }
+        mock_return_prowler_provider.return_value = MagicMock()
+
+        initialize_prowler_provider(provider)
+
+        mock_return_prowler_provider.return_value.assert_called_once_with(
+            user="ocid1.user.oc1..fake",
+            fingerprint="00:11:22:33:44:55:66:77",
+            key_content="fake-base64-key-content",
+            tenancy="ocid1.tenancy.oc1..fake",
+        )
+
+    @patch("api.utils.return_prowler_provider")
+    def test_initialize_oraclecloud_provider_without_region_omits_scan_filter(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret.secret = {
+            "user": "ocid1.user.oc1..fake",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..fake",
+        }
+        mock_return_prowler_provider.return_value = MagicMock()
+
+        initialize_prowler_provider(provider)
+
+        mock_return_prowler_provider.return_value.assert_called_once_with(
+            user="ocid1.user.oc1..fake",
+            fingerprint="00:11:22:33:44:55:66:77",
+            key_content="fake-base64-key-content",
+            tenancy="ocid1.tenancy.oc1..fake",
+        )
+
 
 class TestProwlerProviderConnectionTest:
     @patch("api.utils.return_prowler_provider")
@@ -185,6 +232,37 @@ class TestProwlerProviderConnectionTest:
             key="value", provider_id="1234567890", raise_on_exception=False
         )
 
+    @patch("api.utils.return_prowler_provider")
+    def test_oraclecloud_connection_test_uses_direct_credentials_without_region(
+        self, mock_return_prowler_provider
+    ):
+        provider = MagicMock()
+        provider.uid = "ocid1.tenancy.oc1..aaaaaaaexample"
+        provider.provider = Provider.ProviderChoices.ORACLECLOUD.value
+        provider.secret.secret = {
+            "user": "ocid1.user.oc1..aaaaaaaexample",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "fake-base64-key-content",
+            "tenancy": "ocid1.tenancy.oc1..aaaaaaaexample",
+        }
+        mock_return_prowler_provider.return_value = MagicMock()
+
+        prowler_provider_connection_test(provider)
+
+        mock_return_prowler_provider.return_value.test_connection.assert_called_once_with(
+            user="ocid1.user.oc1..aaaaaaaexample",
+            fingerprint="00:11:22:33:44:55:66:77",
+            key_content="fake-base64-key-content",
+            tenancy="ocid1.tenancy.oc1..aaaaaaaexample",
+            region=getattr(
+                OraclecloudProvider,
+                "_bootstrap_region",
+                OraclecloudProvider._home_region,
+            ),
+            provider_id="ocid1.tenancy.oc1..aaaaaaaexample",
+            raise_on_exception=False,
+        )
+
     @pytest.mark.django_db
     @patch("api.utils.return_prowler_provider")
     def test_prowler_provider_connection_test_without_secret(
@@ -356,7 +434,7 @@ class TestGetProwlerProviderKwargs:
         expected_result = {**secret_dict, **expected_extra_kwargs}
         assert result == expected_result
 
-    def test_get_prowler_provider_kwargs_oraclecloud_converts_region_string_to_set(
+    def test_get_prowler_provider_kwargs_oraclecloud_removes_region(
         self,
     ):
         secret_dict = {
@@ -377,8 +455,13 @@ class TestGetProwlerProviderKwargs:
 
         result = get_prowler_provider_kwargs(provider)
 
-        expected_result = {**secret_dict, "region": {"us-ashburn-1"}}
-        assert result == expected_result
+        assert result == {
+            "user": "ocid1.user.oc1..fake",
+            "fingerprint": "00:11:22:33:44:55:66:77",
+            "key_content": "-----BEGIN PRIVATE KEY-----\nfake\n-----END PRIVATE KEY-----",
+            "tenancy": "ocid1.tenancy.oc1..fake",
+            "pass_phrase": "fake-passphrase",
+        }
 
     def test_get_prowler_provider_kwargs_with_mutelist(self):
         provider_uid = "provider_uid"

api/src/backend/api/tests/test_views.py

@@ -2917,6 +2917,48 @@ class TestProviderGroupViewSet:
 
 @pytest.mark.django_db
 class TestProviderSecretViewSet:
+    @staticmethod
+    def _oraclecloud_secret(**overrides):
+        secret = {
+            "user": "ocid1.user.oc1..aaaaaaaakldibrbov4ubh25aqdeiroklxjngwka7u6w7no3glmdq3n5sxtkq",
+            "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
+            "key_content": "test-key-content",
+            "tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
+        }
+        secret.update(overrides)
+        return secret
+
+    def _create_oraclecloud_secret(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+        secret,
+        name="OCI Secret",
+    ):
+        data = {
+            "data": {
+                "type": "provider-secrets",
+                "attributes": {
+                    "name": name,
+                    "secret_type": ProviderSecret.TypeChoices.STATIC,
+                    "secret": secret,
+                },
+                "relationships": {
+                    "provider": {
+                        "data": {
+                            "type": "providers",
+                            "id": str(oraclecloud_provider.id),
+                        }
+                    }
+                },
+            }
+        }
+        return authenticated_client.post(
+            reverse("providersecret-list"),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+
     def test_provider_secrets_list(self, authenticated_client, provider_secret_fixture):
         response = authenticated_client.get(reverse("providersecret-list"))
         assert response.status_code == status.HTTP_200_OK
@@ -3076,7 +3118,6 @@ current-context: test-context
                     "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
                     "key_content": "-----BEGIN RSA PRIVATE KEY-----\ntest-key-content\n-----END RSA PRIVATE KEY-----",
                     "tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
-                    "region": "us-ashburn-1",
                 },
             ),
             # OCI with API key credentials (with key_file)
@@ -3088,7 +3129,6 @@ current-context: test-context
                     "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
                     "key_file": "/path/to/oci_api_key.pem",
                     "tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
-                    "region": "us-ashburn-1",
                 },
             ),
             # OCI with API key credentials (with passphrase)
@@ -3100,7 +3140,6 @@ current-context: test-context
                     "fingerprint": "aa:bb:cc:dd:ee:ff:00:11:22:33:44:55:66:77:88:99",
                     "key_content": "-----BEGIN RSA PRIVATE KEY-----\ntest-encrypted-key\n-----END RSA PRIVATE KEY-----",
                     "tenancy": "ocid1.tenancy.oc1..aaaaaaaa3dwoazoox4q7wrvriywpokp5grlhgnkwtyt6dmwyou7no6mdmzda",
-                    "region": "us-ashburn-1",
                     "pass_phrase": "my-secure-passphrase",
                 },
             ),
@@ -3258,6 +3297,103 @@ current-context: test-context
             == data["data"]["relationships"]["provider"]["data"]["id"]
         )
 
+    def test_provider_secrets_create_oraclecloud_without_region_stores_no_region(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+    ):
+        response = self._create_oraclecloud_secret(
+            authenticated_client,
+            oraclecloud_provider,
+            self._oraclecloud_secret(),
+        )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        provider_secret = ProviderSecret.objects.get()
+        assert "region" not in provider_secret.secret
+
+    def test_provider_secrets_create_oraclecloud_accepts_and_ignores_region(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+    ):
+        response = self._create_oraclecloud_secret(
+            authenticated_client,
+            oraclecloud_provider,
+            self._oraclecloud_secret(
+                key_content="  test-key-content  ", region=" us-ashburn-1 "
+            ),
+        )
+
+        assert response.status_code == status.HTTP_201_CREATED
+        provider_secret = ProviderSecret.objects.get()
+        assert provider_secret.secret["key_content"] == "test-key-content"
+        assert "region" not in provider_secret.secret
+
+    def test_provider_secrets_update_oraclecloud_without_region_stores_no_region(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+    ):
+        create_response = self._create_oraclecloud_secret(
+            authenticated_client,
+            oraclecloud_provider,
+            self._oraclecloud_secret(),
+        )
+        provider_secret = ProviderSecret.objects.get(
+            id=create_response.json()["data"]["id"]
+        )
+        data = {
+            "data": {
+                "type": "provider-secrets",
+                "id": str(provider_secret.id),
+                "attributes": {"secret": self._oraclecloud_secret()},
+            }
+        }
+
+        response = authenticated_client.patch(
+            reverse("providersecret-detail", kwargs={"pk": provider_secret.id}),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        provider_secret.refresh_from_db()
+        assert "region" not in provider_secret.secret
+
+    def test_provider_secrets_update_oraclecloud_accepts_and_ignores_region(
+        self,
+        authenticated_client,
+        oraclecloud_provider,
+    ):
+        create_response = self._create_oraclecloud_secret(
+            authenticated_client,
+            oraclecloud_provider,
+            self._oraclecloud_secret(),
+        )
+        provider_secret = ProviderSecret.objects.get(
+            id=create_response.json()["data"]["id"]
+        )
+        data = {
+            "data": {
+                "type": "provider-secrets",
+                "id": str(provider_secret.id),
+                "attributes": {
+                    "secret": self._oraclecloud_secret(region=" us-ashburn-1 ")
+                },
+            }
+        }
+
+        response = authenticated_client.patch(
+            reverse("providersecret-detail", kwargs={"pk": provider_secret.id}),
+            data=json.dumps(data),
+            content_type="application/vnd.api+json",
+        )
+
+        assert response.status_code == status.HTTP_200_OK
+        provider_secret.refresh_from_db()
+        assert "region" not in provider_secret.secret
+
     @pytest.mark.parametrize(
         "attributes, error_code, error_pointer",
         (
@@ -15612,6 +15748,23 @@ class TestTenantApiKeyViewSet:
         data = response.json()["data"]
         assert len(data) == len(api_keys_fixture)
 
+    def test_api_keys_list_with_orphaned_key(
+        self, authenticated_client, api_keys_fixture
+    ):
+        """Test listing keys whose owner was deleted: `entity` is serialized as null."""
+        orphaned_key = api_keys_fixture[0]
+        TenantAPIKey.objects.filter(id=orphaned_key.id).update(entity=None)
+
+        response = authenticated_client.get(reverse("api-key-list"))
+
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        assert len(data) == len(api_keys_fixture)
+        serialized_key = next(
+            item for item in data if item["id"] == str(orphaned_key.id)
+        )
+        assert serialized_key["relationships"]["entity"]["data"] is None
+
     def test_api_keys_list_empty(self, authenticated_client, tenants_fixture):
         """Test listing API keys when none exist returns empty list."""
         response = authenticated_client.get(reverse("api-key-list"))

api/src/backend/api/utils.py

@@ -252,12 +252,6 @@ def get_prowler_provider_kwargs(
             **prowler_provider_kwargs,
             "filter_accounts": [provider.uid],
         }
-    elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
-        if isinstance(prowler_provider_kwargs.get("region"), str):
-            prowler_provider_kwargs = {
-                **prowler_provider_kwargs,
-                "region": {prowler_provider_kwargs["region"]},
-            }
     elif provider.provider == Provider.ProviderChoices.OPENSTACK.value:
         # clouds_yaml_content, clouds_yaml_cloud and provider_id are validated
         # in the provider itself, so it's not needed here.
@@ -288,6 +282,11 @@ def get_prowler_provider_kwargs(
                 **{k: v for k, v in prowler_provider_kwargs.items() if v},
             }
 
+    elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+        prowler_provider_kwargs = _normalize_oraclecloud_provider_kwargs(
+            prowler_provider_kwargs
+        )
+
     if mutelist_processor:
         mutelist_content = mutelist_processor.configuration.get("Mutelist", {})
         # IaC and Image providers don't support mutelist (both use Trivy's built-in logic)
@@ -300,6 +299,40 @@ def get_prowler_provider_kwargs(
     return prowler_provider_kwargs
 
 
+def _normalize_oraclecloud_provider_kwargs(secret: dict) -> dict:
+    """Normalize external OCI secret fields into SDK provider kwargs."""
+    prowler_provider_kwargs = secret.copy()
+    prowler_provider_kwargs.pop("region", None)
+
+    return prowler_provider_kwargs
+
+
+def _normalize_oraclecloud_connection_test_kwargs(secret: dict) -> dict:
+    """Normalize external OCI secret fields into test_connection kwargs."""
+    from prowler.providers.oraclecloud.oraclecloud_provider import OraclecloudProvider
+
+    prowler_provider_kwargs = secret.copy()
+    prowler_provider_kwargs.pop("region", None)
+
+    if (
+        prowler_provider_kwargs.get("user")
+        and prowler_provider_kwargs.get("fingerprint")
+        and prowler_provider_kwargs.get("tenancy")
+        and (
+            prowler_provider_kwargs.get("key_content")
+            or prowler_provider_kwargs.get("key_file")
+        )
+    ):
+        # Connection validation needs one OCI endpoint, but scans remain unfiltered.
+        prowler_provider_kwargs["region"] = getattr(
+            OraclecloudProvider,
+            "_bootstrap_region",
+            OraclecloudProvider._home_region,
+        )
+
+    return prowler_provider_kwargs
+
+
 def initialize_prowler_provider(
     provider: Provider,
     mutelist_processor: Processor | None = None,
@@ -402,6 +435,15 @@ def prowler_provider_connection_test(provider: Provider) -> Connection:
         if prowler_provider_kwargs.get("registry_token"):
             image_kwargs["registry_token"] = prowler_provider_kwargs["registry_token"]
         return prowler_provider.test_connection(**image_kwargs)
+    elif provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+        oraclecloud_kwargs = _normalize_oraclecloud_connection_test_kwargs(
+            prowler_provider_kwargs
+        )
+        return prowler_provider.test_connection(
+            **oraclecloud_kwargs,
+            provider_id=provider.uid,
+            raise_on_exception=False,
+        )
     else:
         return prowler_provider.test_connection(
             **prowler_provider_kwargs,

api/src/backend/api/v1/serializer_utils/integrations.py

@@ -1,7 +1,9 @@
 import os
 import re
 
+from api.models import Integration, IntegrationProviderRelationship, Provider
 from api.v1.serializer_utils.base import BaseValidateSerializer
+from django.db import transaction
 from drf_spectacular.utils import extend_schema_field
 from rest_framework_json_api import serializers
 
@@ -10,6 +12,24 @@ ATLASSIAN_SITE_NAME_REGEX = re.compile(
 )
 
 
+def replace_integration_providers(
+    integration: Integration, providers: list[Provider], tenant_id: str
+) -> None:
+    """Replace the provider relationships of an integration with the given set."""
+    # Atomic on its own, so callers without an ambient transaction cannot leave the
+    # integration with no relationships if the recreation fails halfway
+    with transaction.atomic():
+        IntegrationProviderRelationship.objects.filter(integration=integration).delete()
+        IntegrationProviderRelationship.objects.bulk_create(
+            [
+                IntegrationProviderRelationship(
+                    integration=integration, provider=provider, tenant_id=tenant_id
+                )
+                for provider in providers
+            ]
+        )
+
+
 class S3ConfigSerializer(BaseValidateSerializer):
     bucket_name = serializers.CharField()
     output_directory = serializers.CharField(allow_blank=True)

api/src/backend/api/v1/serializer_utils/providers.py

@@ -214,7 +214,7 @@ from rest_framework_json_api import serializers
                     "kubeconfig_content": {
                         "type": "string",
                         "description": "The content of the Kubernetes kubeconfig file, encoded as a string. "
-                        "Kubeconfig exec authentication is not supported in Prowler Cloud for security reasons.",
+                        "Kubeconfig command-based authentication is not supported in Prowler Cloud for security reasons.",
                     }
                 },
                 "required": ["kubeconfig_content"],
@@ -295,16 +295,21 @@ from rest_framework_json_api import serializers
                         "type": "string",
                         "description": "The OCID of the tenancy.",
                     },
-                    "region": {
-                        "type": "string",
-                        "description": "The OCI region identifier (e.g., us-ashburn-1, us-phoenix-1).",
-                    },
                     "pass_phrase": {
                         "type": "string",
                         "description": "The passphrase for the private key, if encrypted.",
                     },
+                    "region": {
+                        "type": "string",
+                        "deprecated": True,
+                        "description": "Legacy OCI region field accepted for backwards compatibility but ignored; OCI scans all regions.",
+                    },
                 },
-                "required": ["user", "fingerprint", "tenancy", "region"],
+                "required": ["user", "fingerprint", "tenancy"],
+                "anyOf": [
+                    {"required": ["key_file"]},
+                    {"required": ["key_content"]},
+                ],
             },
             {
                 "type": "object",

api/src/backend/api/v1/serializers.py

@@ -47,6 +47,7 @@ from api.v1.serializer_utils.integrations import (
     JiraCredentialSerializer,
     S3ConfigSerializer,
     SecurityHubConfigSerializer,
+    replace_integration_providers,
 )
 from api.v1.serializer_utils.lighthouse import (
     BedrockCredentialsSerializer,
@@ -1568,14 +1569,14 @@ class FindingMetadataSerializer(BaseSerializerV1):
 
 
 # Provider secrets
-KUBERNETES_KUBECONFIG_EXEC_ERROR = (
-    "Kubernetes kubeconfig exec authentication is not supported in Prowler Cloud "
-    "for security reasons."
+KUBERNETES_KUBECONFIG_UNSUPPORTED_COMMAND_AUTH_ERROR = (
+    "Kubernetes kubeconfig command-based authentication is not supported in "
+    "Prowler Cloud for security reasons."
 )
 KUBERNETES_KUBECONFIG_INVALID_ERROR = "Invalid Kubernetes kubeconfig content."
 
 
-def kubeconfig_contains_exec_auth(kubeconfig: dict) -> bool:
+def kubeconfig_contains_unsupported_command_auth(kubeconfig: dict) -> bool:
     users = kubeconfig.get("users", [])
     if not isinstance(users, list):
         raise ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)
@@ -1591,6 +1592,17 @@ def kubeconfig_contains_exec_auth(kubeconfig: dict) -> bool:
         if "exec" in user:
             return True
 
+        auth_provider = user.get("auth-provider", {})
+        if not isinstance(auth_provider, dict):
+            continue
+
+        auth_provider_config = auth_provider.get("config", {})
+        if not isinstance(auth_provider_config, dict):
+            continue
+
+        if "cmd-path" in auth_provider_config:
+            return True
+
     return False
 
 
@@ -1672,6 +1684,7 @@ class BaseWriteProviderSecretSerializer(BaseWriteSerializer):
                 validation_error.detail[f"secret/{key}"] = value
                 del validation_error.detail[key]
             raise validation_error
+        return serializer.validated_data
 
 
 class AwsProviderSecret(serializers.Serializer):
@@ -1786,8 +1799,10 @@ class KubernetesProviderSecret(serializers.Serializer):
         if not isinstance(kubeconfig, dict):
             raise serializers.ValidationError(KUBERNETES_KUBECONFIG_INVALID_ERROR)
 
-        if kubeconfig_contains_exec_auth(kubeconfig):
-            raise serializers.ValidationError(KUBERNETES_KUBECONFIG_EXEC_ERROR)
+        if kubeconfig_contains_unsupported_command_auth(kubeconfig):
+            raise serializers.ValidationError(
+                KUBERNETES_KUBECONFIG_UNSUPPORTED_COMMAND_AUTH_ERROR
+            )
 
         return kubeconfig_content
 
@@ -1813,14 +1828,32 @@ class IacProviderSecret(serializers.Serializer):
         resource_name = "provider-secrets"
 
 
+class LegacyOCIRegionField(serializers.Field):
+    def to_internal_value(self, data):
+        return data
+
+    def to_representation(self, value):
+        return value
+
+
 class OracleCloudProviderSecret(serializers.Serializer):
     user = serializers.CharField()
     fingerprint = serializers.CharField()
     key_file = serializers.CharField(required=False)
     key_content = serializers.CharField(required=False)
     tenancy = serializers.CharField()
-    region = serializers.CharField()
     pass_phrase = serializers.CharField(required=False)
+    region = LegacyOCIRegionField(required=False, allow_null=True)
+
+    def validate(self, attrs):
+        attrs.pop("region", None)
+
+        if "key_file" not in attrs and "key_content" not in attrs:
+            raise serializers.ValidationError(
+                {"key_file": "Either key_file or key_content must be provided."}
+            )
+
+        return attrs
 
     class Meta:
         resource_name = "provider-secrets"
@@ -1965,7 +1998,11 @@ class ProviderSecretCreateSerializer(RLSSerializer, BaseWriteProviderSecretSeria
         secret = attrs.get("secret")
 
         validated_attrs = super().validate(attrs)
-        self.validate_secret_based_on_provider(provider.provider, secret_type, secret)
+        validated_secret = self.validate_secret_based_on_provider(
+            provider.provider, secret_type, secret
+        )
+        if provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+            validated_attrs["secret"] = validated_secret
         return validated_attrs
 
 
@@ -1997,7 +2034,11 @@ class ProviderSecretUpdateSerializer(BaseWriteProviderSecretSerializer):
         secret = attrs.get("secret")
 
         validated_attrs = super().validate(attrs)
-        self.validate_secret_based_on_provider(provider.provider, secret_type, secret)
+        validated_secret = self.validate_secret_based_on_provider(
+            provider.provider, secret_type, secret
+        )
+        if provider.provider == Provider.ProviderChoices.ORACLECLOUD.value:
+            validated_attrs["secret"] = validated_secret
         return validated_attrs
 
 
@@ -2716,6 +2757,37 @@ class ScheduleDailyCreateSerializer(BaseSerializerV1):
 # Integrations
 
 
+class IntegrationProviderVisibilityMixin:
+    """
+    Keep the `providers` relationship within the provider visibility of the role.
+
+    The view injects `allowed_providers` in the serializer context: `None` when the role
+    has unlimited visibility, and the queryset of visible providers otherwise. Roles with
+    limited visibility can neither attach providers they cannot see nor discover, through
+    the serialized output, the ones already attached.
+    """
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        allowed_providers = self.context.get("allowed_providers")
+        if allowed_providers is not None:
+            self.fields["providers"].child_relation.queryset = allowed_providers
+
+    def hide_restricted_providers(self, representation: dict) -> dict:
+        allowed_providers = self.context.get("allowed_providers")
+        # `providers` is missing when the request asks for a subset of the fields
+        if allowed_providers is None or "providers" not in representation:
+            return representation
+
+        allowed_provider_ids = {str(provider.id) for provider in allowed_providers}
+        representation["providers"] = [
+            provider
+            for provider in representation["providers"]
+            if provider["id"] in allowed_provider_ids
+        ]
+        return representation
+
+
 class BaseWriteIntegrationSerializer(BaseWriteSerializer):
     def validate(self, attrs):
         integration_type = attrs.get("integration_type")
@@ -2848,7 +2920,7 @@ class BaseWriteIntegrationSerializer(BaseWriteSerializer):
             )
 
 
-class IntegrationSerializer(RLSSerializer):
+class IntegrationSerializer(IntegrationProviderVisibilityMixin, RLSSerializer):
     """
     Serializer for the Integration model.
     """
@@ -2877,15 +2949,9 @@ class IntegrationSerializer(RLSSerializer):
     }
 
     def to_representation(self, instance):
-        representation = super().to_representation(instance)
-        allowed_providers = self.context.get("allowed_providers")
-        if allowed_providers:
-            allowed_provider_ids = {str(provider.id) for provider in allowed_providers}
-            representation["providers"] = [
-                provider
-                for provider in representation["providers"]
-                if provider["id"] in allowed_provider_ids
-            ]
+        representation = self.hide_restricted_providers(
+            super().to_representation(instance)
+        )
         if instance.integration_type == Integration.IntegrationChoices.JIRA:
             representation["configuration"].update(
                 {"domain": instance.credentials.get("domain")}
@@ -2893,7 +2959,9 @@ class IntegrationSerializer(RLSSerializer):
         return representation
 
 
-class IntegrationCreateSerializer(BaseWriteIntegrationSerializer):
+class IntegrationCreateSerializer(
+    IntegrationProviderVisibilityMixin, BaseWriteIntegrationSerializer
+):
     credentials = IntegrationCredentialField(write_only=True)
     configuration = IntegrationConfigField()
     providers = serializers.ResourceRelatedField(
@@ -2944,22 +3012,18 @@ class IntegrationCreateSerializer(BaseWriteIntegrationSerializer):
         tenant_id = self.context.get("tenant_id")
 
         providers = validated_data.pop("providers", [])
-        integration = Integration.objects.create(tenant_id=tenant_id, **validated_data)
-
-        through_model_instances = [
-            IntegrationProviderRelationship(
-                integration=integration,
-                provider=provider,
-                tenant_id=tenant_id,
+        with transaction.atomic():
+            integration = Integration.objects.create(
+                tenant_id=tenant_id, **validated_data
             )
-            for provider in providers
-        ]
-        IntegrationProviderRelationship.objects.bulk_create(through_model_instances)
+            replace_integration_providers(integration, providers, tenant_id)
 
         return integration
 
 
-class IntegrationUpdateSerializer(BaseWriteIntegrationSerializer):
+class IntegrationUpdateSerializer(
+    IntegrationProviderVisibilityMixin, BaseWriteIntegrationSerializer
+):
     credentials = IntegrationCredentialField(write_only=True, required=False)
     configuration = IntegrationConfigField(required=False)
     providers = serializers.ResourceRelatedField(
@@ -3004,15 +3068,13 @@ class IntegrationUpdateSerializer(BaseWriteIntegrationSerializer):
 
     def update(self, instance, validated_data):
         tenant_id = self.context.get("tenant_id")
-        if validated_data.get("providers") is not None:
-            instance.providers.clear()
-            new_relationships = [
-                IntegrationProviderRelationship(
-                    integration=instance, provider=provider, tenant_id=tenant_id
-                )
-                for provider in validated_data["providers"]
-            ]
-            IntegrationProviderRelationship.objects.bulk_create(new_relationships)
+        # Relationships are replaced here, so they are kept out of the default
+        # `ModelSerializer.update()`, which would otherwise reset them all. The view
+        # rejects updates on integrations shared with providers hidden to the role, so
+        # every existing relationship is visible to the requester at this point
+        providers = validated_data.pop("providers", None)
+        if providers is not None:
+            replace_integration_providers(instance, providers, tenant_id)
 
         # Preserve regions field for Security Hub integrations
         if instance.integration_type == Integration.IntegrationChoices.AWS_SECURITY_HUB:
@@ -3024,7 +3086,9 @@ class IntegrationUpdateSerializer(BaseWriteIntegrationSerializer):
         return super().update(instance, validated_data)
 
     def to_representation(self, instance):
-        representation = super().to_representation(instance)
+        representation = self.hide_restricted_providers(
+            super().to_representation(instance)
+        )
         # Ensure JIRA integrations show updated domain in configuration from credentials
         if instance.integration_type == Integration.IntegrationChoices.JIRA:
             representation["configuration"].update(

api/src/backend/api/v1/views.py

@@ -124,7 +124,12 @@ from api.models import (
     UserRoleRelationship,
 )
 from api.pagination import ComplianceOverviewPagination
-from api.rbac.permissions import Permissions, get_providers, get_role
+from api.rbac.permissions import (
+    Permissions,
+    get_integrations,
+    get_providers,
+    get_role,
+)
 from api.renderers import APIJSONRenderer, PlainTextRenderer
 from api.rls import Tenant
 from api.utils import (
@@ -281,6 +286,7 @@ from django.shortcuts import redirect
 from django.urls import reverse
 from django.utils.dateparse import parse_date
 from django.utils.decorators import method_decorator
+from django.utils.functional import cached_property
 from django.views.decorators.cache import cache_control
 from django_celery_beat.models import PeriodicTask
 from drf_spectacular.settings import spectacular_settings
@@ -6652,27 +6658,34 @@ class ScheduleViewSet(BaseRLSViewSet):
     list=extend_schema(
         tags=["Integration"],
         summary="List all integrations",
-        description="Retrieve a list of all configured integrations with options for filtering by various criteria.",
+        description="Retrieve a list of all configured integrations with options for filtering by various criteria.\n\n"
+        "Integrations attached to one or more providers are only returned when the role can access at least one of "
+        "those providers, and each integration lists only the providers visible to the role. Integrations not "
+        "attached to any provider, such as Jira, are tenant-wide and are returned for every role.",
     ),
     retrieve=extend_schema(
         tags=["Integration"],
         summary="Retrieve integration details",
-        description="Fetch detailed information about a specific integration by its ID.",
+        description="Fetch detailed information about a specific integration by its ID. Integrations outside the "
+        "provider visibility of the role are reported the same way as one that does not exist.",
     ),
     create=extend_schema(
         tags=["Integration"],
         summary="Create a new integration",
-        description="Register a new integration with the system, providing necessary configuration details.",
+        description="Register a new integration with the system, providing necessary configuration details. Only "
+        "providers visible to the role can be attached to the integration.",
     ),
     partial_update=extend_schema(
         tags=["Integration"],
         summary="Partially update an integration",
-        description="Modify certain fields of an existing integration without affecting other settings.",
+        description="Modify certain fields of an existing integration without affecting other settings. Integrations "
+        "attached to providers outside the visibility of the role cannot be modified by it.",
     ),
     destroy=extend_schema(
         tags=["Integration"],
         summary="Delete an integration",
-        description="Remove an integration from the system by its ID.",
+        description="Remove an integration from the system by its ID. Integrations attached to providers outside "
+        "the visibility of the role cannot be deleted by it.",
     ),
 )
 @method_decorator(CACHE_DECORATOR, name="list")
@@ -6685,18 +6698,27 @@ class IntegrationViewSet(BaseRLSViewSet):
     ordering = ["integration_type", "-inserted_at"]
     # RBAC required permissions
     required_permissions = [Permissions.MANAGE_INTEGRATIONS]
-    allowed_providers = None
+
+    @cached_property
+    def allowed_providers(self):
+        """
+        Providers the role can access, or None when it has unlimited visibility.
+
+        Resolved per request and independently of the action, so that writes are scoped
+        as tightly as reads.
+        """
+        if self.user_role.unlimited_visibility:
+            return None
+        return get_providers(self.user_role)
 
     def get_queryset(self):
-        user_roles = get_role(self.request.user, self.request.tenant_id)
-        if user_roles.unlimited_visibility:
-            # User has unlimited visibility, return all integrations
-            queryset = Integration.objects.filter(tenant_id=self.request.tenant_id)
-        else:
-            # User lacks permission, filter providers based on provider groups associated with the role
-            allowed_providers = get_providers(user_roles)
-            queryset = Integration.objects.filter(providers__in=allowed_providers)
-            self.allowed_providers = allowed_providers
+        queryset = get_integrations(self.user_role, providers=self.allowed_providers)
+        if self.allowed_providers is not None and self.action in ("list", "retrieve"):
+            # Restrict the relationship itself, so that the providers hidden to the role
+            # are left out of the sideloaded resources of `?include=providers` too
+            queryset = queryset.prefetch_related(
+                Prefetch("providers", queryset=self.allowed_providers)
+            )
         return queryset
 
     def get_serializer_class(self):
@@ -6711,16 +6733,33 @@ class IntegrationViewSet(BaseRLSViewSet):
         context["allowed_providers"] = self.allowed_providers
         return context
 
+    def get_object(self):
+        instance = super().get_object()
+        # Writes on an integration shared with providers hidden to the role would reach
+        # beyond its visibility, so both editing and deleting are rejected consistently
+        if (
+            self.action in ("partial_update", "destroy")
+            and self.allowed_providers is not None
+            and instance.providers.exclude(
+                id__in=self.allowed_providers.values("id")
+            ).exists()
+        ):
+            raise PermissionDenied(
+                "The integration is attached to providers outside the visibility of your role."
+            )
+        return instance
+
     @extend_schema(
         tags=["Integration"],
         summary="Check integration connection",
-        description="Try to verify integration connection",
+        description="Try to verify integration connection. Integrations outside the provider visibility of the role "
+        "are reported the same way as one that does not exist.",
         request=None,
         responses={202: OpenApiResponse(response=TaskSerializer)},
     )
     @action(detail=True, methods=["post"], url_name="connection")
     def connection(self, request, pk=None):
-        get_object_or_404(Integration, pk=pk)
+        get_object_or_404(self.get_queryset(), pk=pk)
         with transaction.atomic():
             task = check_integration_connection_task.delay(
                 integration_id=pk, tenant_id=self.request.tenant_id
@@ -6743,7 +6782,8 @@ class IntegrationViewSet(BaseRLSViewSet):
         tags=["Integration"],
         summary="Send findings to a Jira integration",
         description="Send a set of filtered findings to the given integration. At least one finding filter must be "
-        "provided.\n\n"
+        "provided. Jira integrations are tenant-wide and do not require unlimited visibility, while the findings "
+        "sent are limited to the providers the role can access.\n\n"
         "## Known Limitations\n\n"
         "### Issue Types with Required Custom Fields\n\n"
         "Certain Jira issue types (such as Epic) may require mandatory custom fields that Prowler does not "
@@ -6787,24 +6827,37 @@ class IntegrationJiraViewSet(BaseRLSViewSet):
             return []
         return super().get_filter_backends()
 
-    def get_queryset(self):
-        tenant_id = self.request.tenant_id
-        user_roles = get_role(self.request.user, self.request.tenant_id)
-        if user_roles.unlimited_visibility:
-            # User has unlimited visibility, return all findings
-            queryset = Finding.all_objects.filter(tenant_id=tenant_id)
-        else:
-            # User lacks permission, filter findings based on provider groups associated with the role
-            queryset = Finding.all_objects.filter(
-                scan__provider__in=get_providers(user_roles)
-            )
+    @cached_property
+    def allowed_providers(self):
+        """
+        Providers the role can access, or None when it has unlimited visibility.
 
-        return queryset
+        Resolved once per request and shared between the findings queryset and the
+        integration lookup.
+        """
+        if self.user_role.unlimited_visibility:
+            return None
+        return get_providers(self.user_role)
+
+    def get_queryset(self):
+        if self.allowed_providers is None:
+            # User has unlimited visibility, return all findings
+            return Finding.all_objects.filter(tenant_id=self.request.tenant_id)
+        # Findings are limited to the providers the role can access
+        return Finding.all_objects.filter(scan__provider__in=self.allowed_providers)
+
+    def get_integration(self, integration_pk):
+        """Retrieve the integration, honoring the provider visibility of the user's role."""
+        return get_object_or_404(
+            get_integrations(self.user_role, providers=self.allowed_providers),
+            pk=integration_pk,
+        )
 
     @extend_schema(
         tags=["Integration"],
         summary="Get available issue types for a Jira project",
-        description="Fetch the available issue types from Jira for a given project key and update the integration configuration.",
+        description="Fetch the available issue types from Jira for a given project key and update the integration "
+        "configuration. Jira integrations are tenant-wide and do not require unlimited visibility.",
         parameters=[
             OpenApiParameter(
                 name="project_key",
@@ -6817,7 +6870,7 @@ class IntegrationJiraViewSet(BaseRLSViewSet):
     )
     @action(detail=False, methods=["get"], url_name="issue-types")
     def issue_types(self, request, integration_pk=None):
-        integration = get_object_or_404(Integration, pk=integration_pk)
+        integration = self.get_integration(integration_pk)
 
         project_key = request.query_params.get("project_key")
         if not project_key:
@@ -6862,23 +6915,23 @@ class IntegrationJiraViewSet(BaseRLSViewSet):
 
     @action(detail=False, methods=["post"], url_name="dispatches")
     def dispatches(self, request, integration_pk=None):
-        get_object_or_404(Integration, pk=integration_pk)
+        self.get_integration(integration_pk)
         serializer = self.get_serializer(
             data=request.data, context={"integration_id": integration_pk}
         )
         serializer.is_valid(raise_exception=True)
 
-        if self.filter_queryset(self.get_queryset()).count() == 0:
-            raise ValidationError(
-                {"findings": "No findings match the provided filters"}
-            )
-
         finding_ids = [
             str(finding_id)
             for finding_id in self.filter_queryset(self.get_queryset()).values_list(
                 "id", flat=True
             )
         ]
+        if not finding_ids:
+            raise ValidationError(
+                {"findings": "No findings match the provided filters"}
+            )
+
         project_key = serializer.validated_data["project_key"]
         issue_type = serializer.validated_data["issue_type"]
 

api/src/backend/tasks/jobs/integrations.py

@@ -1,5 +1,6 @@
 import os
 import time
+from datetime import UTC, datetime
 from glob import glob
 
 from api.db_router import READ_REPLICA_ALIAS, MainRouter
@@ -214,8 +215,10 @@ def get_security_hub_client_from_integration(
         for region in set(all_security_hub_regions):
             regions_status[region] = region in connection.enabled_regions
 
-        # Save regions information in the integration configuration
+        # Persist the successful connection check and regions information
         with rls_transaction(tenant_id, using=MainRouter.default_db):
+            integration.connected = True
+            integration.connection_last_checked_at = datetime.now(tz=UTC)
             integration.configuration["regions"] = regions_status
             integration.save()
 

api/src/backend/tasks/jobs/scan.py

@@ -7,7 +7,7 @@ import re
 import time
 import uuid
 from collections import defaultdict
-from collections.abc import Iterable
+from collections.abc import Callable, Iterable
 from datetime import UTC, datetime
 from typing import Any
 
@@ -50,6 +50,7 @@ from celery.utils.log import get_task_logger
 from config.django.base import DJANGO_FINDINGS_BATCH_SIZE
 from config.env import env
 from config.settings.celery import CELERY_DEADLOCK_ATTEMPTS
+from django.core.exceptions import ImproperlyConfigured
 from django.db import DatabaseError, IntegrityError, OperationalError, transaction
 from django.db.models import (
     Case,
@@ -100,6 +101,16 @@ COMPLIANCE_REQUIREMENT_COPY_COLUMNS = (
 FINDINGS_MICRO_BATCH_SIZE = env.int("DJANGO_FINDINGS_MICRO_BATCH_SIZE", default=3000)
 # Controls how many rows each ORM bulk_create/bulk_update call sends to Postgres.
 SCAN_DB_BATCH_SIZE = env.int("DJANGO_SCAN_DB_BATCH_SIZE", default=1000)
+# Rows per COPY statement when ingesting compliance requirement overviews. All
+# batches of a scan share one transaction/commit; the batch size only bounds the
+# client-side CSV buffer and how long each individual COPY statement runs on the
+# writer (memory footprint, lock time and slow-statement logging under load).
+COMPLIANCE_COPY_BATCH_SIZE = env.int("DJANGO_COMPLIANCE_COPY_BATCH_SIZE", default=2000)
+if COMPLIANCE_COPY_BATCH_SIZE < 1:
+    raise ImproperlyConfigured(
+        "DJANGO_COMPLIANCE_COPY_BATCH_SIZE must be a positive integer, got "
+        f"{COMPLIANCE_COPY_BATCH_SIZE}"
+    )
 # Throttle scan progress persistence: minimum progress delta (fraction 0-1)
 # between two persisted progress updates.
 PROGRESS_THROTTLE_DELTA = env.float("DJANGO_SCAN_PROGRESS_THROTTLE_DELTA", default=0.01)
@@ -357,30 +368,36 @@ def _bulk_update_resource_failed_findings_counts(
                 raise
 
 
-def _copy_compliance_requirement_rows(
-    tenant_id: str, rows: list[dict[str, Any]]
-) -> None:
-    """Stream compliance requirement rows into Postgres using COPY.
+class ComplianceRowScopeError(ValueError):
+    """A compliance requirement row does not belong to the scan being ingested."""
 
-    We leverage the admin connection (when available) to bypass the COPY + RLS
-    restriction, writing only the fields required by
-    ``ComplianceRequirementOverview``.
 
-    Args:
-        tenant_id: Target tenant UUID.
-        rows: List of row dictionaries prepared by
-            :func:`create_compliance_requirements`.
+def _compliance_requirement_rows_to_csv(
+    rows: list[dict[str, Any]], tenant_id: str, scan_id: str
+) -> io.StringIO:
+    """Serialize compliance requirement rows into a CSV buffer for COPY.
+
+    COPY runs on the admin connection, which bypasses RLS, so every row is
+    checked against the expected tenant/scan before it is written: a mismatched
+    row would otherwise be inserted verbatim into another tenant's data.
     """
-
     csv_buffer = io.StringIO()
     writer = csv.writer(csv_buffer)
 
     datetime_now = datetime.now(tz=UTC)
     for row in rows:
+        row_tenant_id = str(row.get("tenant_id"))
+        row_scan_id = str(row.get("scan_id"))
+        if row_tenant_id != tenant_id or row_scan_id != scan_id:
+            raise ComplianceRowScopeError(
+                "Compliance requirement row does not belong to the scan being "
+                f"ingested (expected tenant {tenant_id} / scan {scan_id}, got "
+                f"tenant {row_tenant_id} / scan {row_scan_id})"
+            )
         writer.writerow(
             [
                 str(row.get("id")),
-                str(row.get("tenant_id")),
+                row_tenant_id,
                 (row.get("inserted_at") or datetime_now).isoformat(),
                 row.get("compliance_id") or "",
                 row.get("framework") or "",
@@ -394,65 +411,100 @@ def _copy_compliance_requirement_rows(
                 row.get("total_checks", 0),
                 row.get("passed_findings", 0),
                 row.get("total_findings", 0),
-                str(row.get("scan_id")),
+                row_scan_id,
             ]
         )
 
     csv_buffer.seek(0)
+    return csv_buffer
+
+
+def _copy_compliance_requirement_rows(
+    tenant_id: str, scan_id: str, rows: Iterable[dict[str, Any]], batch_size: int
+) -> int:
+    """Replace a scan's compliance requirement rows using batched COPY.
+
+    We leverage the admin connection (when available) to bypass the COPY + RLS
+    restriction. The scan's DELETE and every COPY batch run on one connection
+    inside a single transaction with a single commit, so the writer takes one
+    fsync per scan instead of one per batch, and a failed ingest rolls back
+    without committing a partial delete/insert (which a retry would otherwise
+    delete again, feeding dead rows to autovacuum).
+
+    Args:
+        tenant_id: Target tenant UUID.
+        scan_id: Scan whose previous rows are replaced.
+        rows: Iterable of row dictionaries, consumed lazily batch by batch.
+        batch_size: Number of rows per COPY statement.
+
+    Returns:
+        int: total number of rows staged and committed.
+
+    Raises:
+        ComplianceRowScopeError: A row belongs to another tenant or scan.
+    """
+    # Normalized once so the per-row scope check compares like with like even if
+    # the caller passes UUID instances instead of strings.
+    tenant_id = str(tenant_id)
+    scan_id = str(scan_id)
+    total_rows = 0
+    batch_num = 0
     copy_sql = (
         "COPY compliance_requirements_overviews ("
         + ", ".join(COMPLIANCE_REQUIREMENT_COPY_COLUMNS)
         + ") FROM STDIN WITH (FORMAT CSV, DELIMITER ',', QUOTE '\"', ESCAPE '\"', NULL '\\N')"
     )
 
-    try:
-        with psycopg_connection(MainRouter.admin_db) as connection:
-            connection.autocommit = False
-            try:
-                with connection.cursor() as cursor:
-                    cursor.execute(SET_CONFIG_QUERY, [POSTGRES_TENANT_VAR, tenant_id])
-                    cursor.copy_expert(copy_sql, csv_buffer)
-                connection.commit()
-            except Exception:
-                connection.rollback()
-                raise
-    finally:
-        csv_buffer.close()
+    with psycopg_connection(MainRouter.admin_db) as connection:
+        connection.autocommit = False
+        try:
+            with connection.cursor() as cursor:
+                cursor.execute(SET_CONFIG_QUERY, [POSTGRES_TENANT_VAR, tenant_id])
+                # Idempotent re-run: clearing this scan's rows inside the same
+                # transaction keeps delete + reinsert atomic.
+                cursor.execute(
+                    "DELETE FROM compliance_requirements_overviews "
+                    "WHERE tenant_id = %s AND scan_id = %s",
+                    [tenant_id, scan_id],
+                )
+                for batch, _is_last in batched(rows, batch_size):
+                    if not batch:
+                        continue
+                    batch_num += 1
+                    csv_buffer = _compliance_requirement_rows_to_csv(
+                        batch, tenant_id, scan_id
+                    )
+                    try:
+                        cursor.copy_expert(copy_sql, csv_buffer)
+                    finally:
+                        csv_buffer.close()
+                    total_rows += len(batch)
+                    logger.info(
+                        f"Compliance COPY batch {batch_num}: staged {len(batch)} rows "
+                        f"({total_rows} total)"
+                    )
+            connection.commit()
+        except Exception:
+            connection.rollback()
+            raise
+
+    return total_rows
 
 
-def _persist_compliance_requirement_rows(
-    tenant_id: str, rows: Iterable[dict[str, Any]], batch_size: int = 10000
+def _bulk_create_compliance_requirement_rows(
+    tenant_id: str, scan_id: str, rows: Iterable[dict[str, Any]], batch_size: int
 ) -> int:
-    """Persist compliance requirement rows using batched COPY with ORM fallback.
+    """Replace a scan's compliance requirement rows via the ORM.
 
-    ``rows`` is consumed lazily in batches, so peak memory stays at ~``batch_size``
-    rows instead of the full set. A batch that fails COPY falls back to an ORM
-    ``bulk_create`` of just that batch.
-
-    Args:
-        tenant_id: Target tenant UUID.
-        rows: Iterable of row dictionaries reflecting the compliance overview
-            state for a scan.
-        batch_size: Number of rows per COPY batch (default: 10000).
-
-    Returns:
-        int: total number of rows persisted.
+    Fallback for when COPY is unavailable; the delete and every ``bulk_create``
+    share one RLS transaction so the replacement stays atomic.
     """
     total_rows = 0
-    batch_num = 0
-
-    for batch, _is_last in batched(rows, batch_size):
-        if not batch:
-            continue
-        batch_num += 1
-        try:
-            _copy_compliance_requirement_rows(tenant_id, batch)
-        except Exception as error:
-            logger.exception(
-                f"COPY bulk insert for compliance requirements batch {batch_num} "
-                "failed; falling back to ORM bulk_create for this batch",
-                exc_info=error,
-            )
+    with rls_transaction(tenant_id):
+        ComplianceRequirementOverview.objects.filter(scan_id=scan_id).delete()
+        for batch, _is_last in batched(rows, batch_size):
+            if not batch:
+                continue
             fallback_objects = [
                 ComplianceRequirementOverview(
                     id=row["id"],
@@ -474,20 +526,58 @@ def _persist_compliance_requirement_rows(
                 )
                 for row in batch
             ]
-            with rls_transaction(tenant_id):
-                ComplianceRequirementOverview.objects.bulk_create(
-                    fallback_objects, batch_size=500
-                )
-
-        total_rows += len(batch)
-        logger.info(
-            f"Compliance COPY batch {batch_num}: inserted {len(batch)} rows "
-            f"({total_rows} total)"
-        )
-
+            ComplianceRequirementOverview.objects.bulk_create(
+                fallback_objects, batch_size=500
+            )
+            total_rows += len(batch)
     return total_rows
 
 
+def _persist_compliance_requirement_rows(
+    tenant_id: str,
+    scan_id: str,
+    rows_factory: Callable[[], Iterable[dict[str, Any]]],
+    batch_size: int | None = None,
+) -> int:
+    """Persist a scan's compliance requirement rows, replacing any previous ones.
+
+    ``rows_factory`` must return a fresh row iterator on every call: the COPY
+    path consumes it lazily in batches (peak memory ~``batch_size`` rows), and
+    if COPY fails the whole ingest falls back to a single ORM transaction that
+    re-iterates the rows.
+
+    Args:
+        tenant_id: Target tenant UUID.
+        scan_id: Scan whose compliance overview rows are being replaced.
+        rows_factory: Callable returning an iterable of row dictionaries.
+        batch_size: Rows per COPY/bulk_create batch (default:
+            ``COMPLIANCE_COPY_BATCH_SIZE``).
+
+    Returns:
+        int: total number of rows persisted.
+    """
+    if batch_size is None:
+        batch_size = COMPLIANCE_COPY_BATCH_SIZE
+
+    try:
+        return _copy_compliance_requirement_rows(
+            tenant_id, scan_id, rows_factory(), batch_size
+        )
+    except ComplianceRowScopeError:
+        # Cross-tenant/scan rows are a bug in the caller, not a COPY failure:
+        # retrying through the ORM would persist the very rows we rejected.
+        raise
+    except Exception as error:
+        logger.exception(
+            "COPY bulk insert for compliance requirements failed; "
+            "falling back to ORM bulk_create",
+            exc_info=error,
+        )
+        return _bulk_create_compliance_requirement_rows(
+            tenant_id, scan_id, rows_factory(), batch_size
+        )
+
+
 def _create_compliance_summaries(
     tenant_id: str, scan_id: str, requirement_statuses: dict
 ) -> None:
@@ -1013,15 +1103,19 @@ def _process_finding_micro_batch(
                         # Denormalized resource arrays populated directly on insert
                         # (was previously a separate bulk_update; saves a CASE WHEN
                         # over thousands of rows per micro-batch).
-                        resource_regions=[resource_instance.region]
-                        if resource_instance.region
-                        else [],
-                        resource_services=[resource_instance.service]
-                        if resource_instance.service
-                        else [],
-                        resource_types=[resource_instance.type]
-                        if resource_instance.type
-                        else [],
+                        resource_regions=(
+                            [resource_instance.region]
+                            if resource_instance.region
+                            else []
+                        ),
+                        resource_services=(
+                            [resource_instance.service]
+                            if resource_instance.service
+                            else []
+                        ),
+                        resource_types=(
+                            [resource_instance.type] if resource_instance.type else []
+                        ),
                     )
                     findings_to_create.append(finding_instance)
                     resource_denormalized_data.append(
@@ -1838,8 +1932,10 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                 )
 
             # Yield rows lazily (consumed batch-by-batch by COPY) so peak memory
-            # stays bounded; tally requirement_statuses in the same pass.
+            # stays bounded; tally requirement_statuses in the same pass. The
+            # ORM fallback re-iterates from scratch, so the tally resets first.
             def _iter_compliance_requirement_rows():
+                requirement_statuses.clear()
                 for region in regions:
                     region_stats = region_requirement_stats.get(region, {})
                     region_findings = findings_count_by_compliance.get(region, {})
@@ -1903,12 +1999,10 @@ def create_compliance_requirements(tenant_id: str, scan_id: str):
                                 "total_findings": total_findings,
                             }
 
-            # Idempotent re-run: clear this scan's rows before re-inserting.
-            with rls_transaction(tenant_id):
-                ComplianceRequirementOverview.objects.filter(scan_id=scan_id).delete()
-
+            # The delete of the scan's previous rows happens inside the same
+            # transaction as the inserts (see _copy_compliance_requirement_rows).
             requirements_created = _persist_compliance_requirement_rows(
-                tenant_id, _iter_compliance_requirement_rows()
+                tenant_id_str, scan_id_str, _iter_compliance_requirement_rows
             )
 
         # Create pre-aggregated summaries for fast compliance overview lookups

api/src/backend/tasks/tasks.py

@@ -797,12 +797,34 @@ def generate_outputs_task(scan_id: str, provider_id: str, tenant_id: str):
         if name not in frameworks_bulk and universal_bulk[name].outputs
     }
     frameworks_avail = get_compliance_frameworks(provider_type)
+    # Idempotency: a previous run of this task for the same scan may have left
+    # output files behind (e.g. broker redelivery after a worker was killed
+    # mid-run with task_acks_late, or a successful run on a deployment without
+    # S3 where the tmp dir is not removed). Output writers open files in append
+    # mode with a deterministic path (derived from scan.started_at), so reusing
+    # them would append every finding row again and duplicate the CSV/output
+    # rows. Start from a clean slate before (re)generating.
+    scan_tmp_dir = _scan_tmp_output_directory(tenant_id, scan_id)
+    if os.path.exists(scan_tmp_dir):
+        rmtree(scan_tmp_dir, ignore_errors=True)
+        # The writers below open output files in append mode with deterministic
+        # paths (derived from scan.started_at). Any stale file that survives the
+        # cleanup would get every finding row appended again, which is the exact
+        # duplication this guards against. Continuing is therefore unsafe: abort
+        # so `ScanReportRLSTask.on_failure` removes the tmp dir and the retry
+        # starts from a clean slate instead of publishing duplicated rows.
+        if os.path.exists(scan_tmp_dir):
+            raise RuntimeError(
+                "Could not remove stale output directory for scan "
+                f"{scan_id} before generating outputs; aborting to avoid "
+                "duplicated rows in appended outputs."
+            )
+
     out_dir, comp_dir = _generate_output_directory(
         DJANGO_TMP_OUTPUT_DIRECTORY, provider_uid, tenant_id, scan_id
     )
     # Removed on success here and on failure by ScanReportRLSTask.on_failure,
     # so partial artifacts do not accumulate and fill the disk (ENOSPC).
-    scan_tmp_dir = _scan_tmp_output_directory(tenant_id, scan_id)
 
     def get_writer(writer_map, name, factory, is_last):
         """

api/src/backend/tasks/tests/test_integrations.py

@@ -1,3 +1,4 @@
+from datetime import UTC, datetime
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -671,6 +672,8 @@ class TestSecurityHubIntegrationUploads:
         mock_integration = MagicMock()
         mock_integration.configuration = {"send_only_fails": True}
         mock_integration.credentials = {}  # Empty credentials, use provider
+        mock_integration.connected = False
+        mock_integration.connection_last_checked_at = None
 
         # Mock tenant_id
         tenant_id = "550e8400-e29b-41d4-a716-446655440000"  # Valid UUID
@@ -723,12 +726,22 @@ class TestSecurityHubIntegrationUploads:
             # Configure the test_connection to return our mock_connection
             mock_security_hub_class.test_connection = mock_test_connection
 
+            checked_at_before = datetime.now(tz=UTC)
             connected, security_hub = get_security_hub_client_from_integration(
                 mock_integration, tenant_id, mock_findings
             )
+            checked_at_after = datetime.now(tz=UTC)
 
         assert connected is True
         assert security_hub == mock_security_hub
+        assert mock_integration.connected is True
+        assert mock_integration.connection_last_checked_at.tzinfo is UTC
+        assert (
+            checked_at_before
+            <= mock_integration.connection_last_checked_at
+            <= checked_at_after
+        )
+        mock_integration.save.assert_called_once()
 
         # Verify SecurityHub was called once to create the client
         assert mock_security_hub_class.call_count == 1

api/src/backend/tasks/tests/test_scan.py

@@ -30,6 +30,7 @@ from prowler.lib.check.models import Severity
 from prowler.lib.outputs.finding import Status
 from tasks.jobs.scan import (
     _ATTACK_SURFACE_MAPPING_CACHE,
+    ComplianceRowScopeError,
     _aggregate_findings_by_region,
     _bulk_update_resource_failed_findings_counts,
     _copy_compliance_requirement_rows,
@@ -2938,9 +2939,9 @@ class TestCreateComplianceRequirements:
             create_compliance_requirements(tenant_id, scan_id)
 
             mock_persist.assert_called_once()
-            persisted_rows = mock_persist.call_args[0][1]
+            rows_factory = mock_persist.call_args[0][2]
             requirement_row = next(
-                row for row in persisted_rows if row["requirement_id"] == "1.1"
+                row for row in rows_factory() if row["requirement_id"] == "1.1"
             )
             assert requirement_row["requirement_status"] == "FAIL"
 
@@ -3078,18 +3079,26 @@ class TestComplianceRequirementCopy:
         }
 
         with patch.object(MainRouter, "admin_db", "admin"):
-            _copy_compliance_requirement_rows(str(row["tenant_id"]), [row])
+            _copy_compliance_requirement_rows(
+                str(row["tenant_id"]), str(row["scan_id"]), [row], 2000
+            )
 
         mock_psycopg_connection.assert_called_once_with("admin")
         connection.cursor.assert_called_once()
-        cursor.execute.assert_called_once()
+        # One execute for set_config plus one for the scan's DELETE.
+        assert cursor.execute.call_count == 2
+        delete_sql, delete_params = cursor.execute.call_args_list[1][0]
+        assert "DELETE FROM compliance_requirements_overviews" in delete_sql
+        assert delete_params == [str(row["tenant_id"]), str(row["scan_id"])]
         cursor.copy_expert.assert_called_once()
+        connection.commit.assert_called_once()
 
         csv_rows = list(csv.reader(StringIO(captured["data"])))
         assert csv_rows[0][0] == str(row["id"])
         assert csv_rows[0][5] == ""
         assert csv_rows[0][-1] == str(row["scan_id"])
 
+    @patch("tasks.jobs.scan.ComplianceRequirementOverview.objects.filter")
     @patch("tasks.jobs.scan.ComplianceRequirementOverview.objects.bulk_create")
     @patch("tasks.jobs.scan.rls_transaction")
     @patch(
@@ -3097,7 +3106,7 @@ class TestComplianceRequirementCopy:
         side_effect=Exception("copy failed"),
     )
     def test_persist_compliance_requirement_rows_fallback(
-        self, mock_copy, mock_rls_transaction, mock_bulk_create
+        self, mock_copy, mock_rls_transaction, mock_bulk_create, mock_filter
     ):
         inserted_at = datetime.now(UTC)
         row = {
@@ -3118,16 +3127,22 @@ class TestComplianceRequirementCopy:
         }
 
         tenant_id = row["tenant_id"]
+        scan_id = str(row["scan_id"])
 
         ctx = MagicMock()
         ctx.__enter__.return_value = None
         ctx.__exit__.return_value = False
         mock_rls_transaction.return_value = ctx
 
-        _persist_compliance_requirement_rows(tenant_id, [row])
+        _persist_compliance_requirement_rows(tenant_id, scan_id, lambda: [row])
 
-        mock_copy.assert_called_once_with(tenant_id, [row])
+        mock_copy.assert_called_once()
+        assert mock_copy.call_args[0][0] == tenant_id
+        assert mock_copy.call_args[0][1] == scan_id
         mock_rls_transaction.assert_called_once_with(tenant_id)
+        # The fallback replaces the scan's rows: delete + insert atomically.
+        mock_filter.assert_called_once_with(scan_id=scan_id)
+        mock_filter.return_value.delete.assert_called_once()
         mock_bulk_create.assert_called_once()
 
         args, kwargs = mock_bulk_create.call_args
@@ -3139,13 +3154,18 @@ class TestComplianceRequirementCopy:
 
     @patch("tasks.jobs.scan.ComplianceRequirementOverview.objects.bulk_create")
     @patch("tasks.jobs.scan.rls_transaction")
-    @patch("tasks.jobs.scan._copy_compliance_requirement_rows")
+    @patch("tasks.jobs.scan._copy_compliance_requirement_rows", return_value=0)
     def test_persist_compliance_requirement_rows_no_rows(
         self, mock_copy, mock_rls_transaction, mock_bulk_create
     ):
-        _persist_compliance_requirement_rows(str(uuid.uuid4()), [])
+        # Even with no rows the COPY path runs: it must clear the scan's
+        # previous rows so a re-run with fewer findings drops stale data.
+        total = _persist_compliance_requirement_rows(
+            str(uuid.uuid4()), str(uuid.uuid4()), lambda: []
+        )
 
-        mock_copy.assert_not_called()
+        assert total == 0
+        mock_copy.assert_called_once()
         mock_rls_transaction.assert_not_called()
         mock_bulk_create.assert_not_called()
 
@@ -3234,11 +3254,12 @@ class TestComplianceRequirementCopy:
         ]
 
         with patch.object(MainRouter, "admin_db", "admin"):
-            _copy_compliance_requirement_rows(tenant_id, rows)
+            _copy_compliance_requirement_rows(tenant_id, str(scan_id), rows, 2000)
 
         mock_psycopg_connection.assert_called_once_with("admin")
         connection.cursor.assert_called_once()
-        cursor.execute.assert_called_once()
+        # set_config + DELETE of the scan's previous rows.
+        assert cursor.execute.call_count == 2
         cursor.copy_expert.assert_called_once()
 
         csv_rows = list(csv.reader(StringIO(captured["data"])))
@@ -3268,6 +3289,60 @@ class TestComplianceRequirementCopy:
         assert csv_rows[2][5] == "2.0"
         assert csv_rows[2][9] == "MANUAL"
 
+    @patch("tasks.jobs.scan.psycopg_connection")
+    def test_copy_compliance_requirement_rows_batches_share_one_transaction(
+        self, mock_psycopg_connection, settings
+    ):
+        """Every COPY batch runs on the same connection with a single commit."""
+        settings.DATABASES.setdefault("admin", settings.DATABASES["default"])
+
+        connection = MagicMock()
+        cursor = MagicMock()
+        cursor_context = MagicMock()
+        cursor_context.__enter__.return_value = cursor
+        cursor_context.__exit__.return_value = False
+        connection.cursor.return_value = cursor_context
+        connection.__enter__.return_value = connection
+        connection.__exit__.return_value = False
+
+        context_manager = MagicMock()
+        context_manager.__enter__.return_value = connection
+        context_manager.__exit__.return_value = False
+        mock_psycopg_connection.return_value = context_manager
+
+        tenant_id = str(uuid.uuid4())
+        scan_id = str(uuid.uuid4())
+        inserted_at = datetime.now(UTC)
+        rows = [
+            {
+                "id": uuid.uuid4(),
+                "tenant_id": tenant_id,
+                "inserted_at": inserted_at,
+                "compliance_id": "cisa_aws",
+                "framework": "CISA",
+                "version": "1.0",
+                "description": f"Requirement {index}",
+                "region": "us-east-1",
+                "requirement_id": f"req-{index}",
+                "requirement_status": "PASS",
+                "passed_checks": 1,
+                "failed_checks": 0,
+                "total_checks": 1,
+                "scan_id": scan_id,
+            }
+            for index in range(3)
+        ]
+
+        with patch.object(MainRouter, "admin_db", "admin"):
+            total = _copy_compliance_requirement_rows(tenant_id, scan_id, rows, 1)
+
+        assert total == 3
+        # One connection, three COPY statements, one commit for the whole scan.
+        mock_psycopg_connection.assert_called_once_with("admin")
+        assert cursor.copy_expert.call_count == 3
+        connection.commit.assert_called_once()
+        connection.rollback.assert_not_called()
+
     @patch("tasks.jobs.scan.psycopg_connection")
     def test_copy_compliance_requirement_rows_null_values(
         self, mock_psycopg_connection, settings
@@ -3315,7 +3390,9 @@ class TestComplianceRequirementCopy:
         }
 
         with patch.object(MainRouter, "admin_db", "admin"):
-            _copy_compliance_requirement_rows(str(row["tenant_id"]), [row])
+            _copy_compliance_requirement_rows(
+                str(row["tenant_id"]), str(row["scan_id"]), [row], 2000
+            )
 
         csv_rows = list(csv.reader(StringIO(captured["data"])))
         assert len(csv_rows) == 1
@@ -3371,7 +3448,9 @@ class TestComplianceRequirementCopy:
         }
 
         with patch.object(MainRouter, "admin_db", "admin"):
-            _copy_compliance_requirement_rows(str(row["tenant_id"]), [row])
+            _copy_compliance_requirement_rows(
+                str(row["tenant_id"]), str(row["scan_id"]), [row], 2000
+            )
 
         # Verify CSV was generated (csv module handles escaping automatically)
         csv_rows = list(csv.reader(StringIO(captured["data"])))
@@ -3432,7 +3511,9 @@ class TestComplianceRequirementCopy:
 
         before_call = datetime.now(UTC)
         with patch.object(MainRouter, "admin_db", "admin"):
-            _copy_compliance_requirement_rows(str(row["tenant_id"]), [row])
+            _copy_compliance_requirement_rows(
+                str(row["tenant_id"]), str(row["scan_id"]), [row], 2000
+            )
         after_call = datetime.now(UTC)
 
         csv_rows = list(csv.reader(StringIO(captured["data"])))
@@ -3485,12 +3566,84 @@ class TestComplianceRequirementCopy:
 
         with patch.object(MainRouter, "admin_db", "admin"):
             with pytest.raises(Exception, match="COPY command failed"):
-                _copy_compliance_requirement_rows(str(row["tenant_id"]), [row])
+                _copy_compliance_requirement_rows(
+                    str(row["tenant_id"]), str(row["scan_id"]), [row], 2000
+                )
 
         # Verify rollback was called
         connection.rollback.assert_called_once()
         connection.commit.assert_not_called()
 
+    @pytest.mark.parametrize("mismatched_field", ["tenant_id", "scan_id"])
+    @patch("tasks.jobs.scan.psycopg_connection")
+    def test_copy_compliance_requirement_rows_rejects_out_of_scope_rows(
+        self, mock_psycopg_connection, mismatched_field, settings
+    ):
+        """COPY bypasses RLS, so rows from another tenant/scan must be rejected."""
+        settings.DATABASES.setdefault("admin", settings.DATABASES["default"])
+
+        connection = MagicMock()
+        cursor = MagicMock()
+        cursor_context = MagicMock()
+        cursor_context.__enter__.return_value = cursor
+        cursor_context.__exit__.return_value = False
+        connection.cursor.return_value = cursor_context
+        connection.__enter__.return_value = connection
+        connection.__exit__.return_value = False
+
+        context_manager = MagicMock()
+        context_manager.__enter__.return_value = connection
+        context_manager.__exit__.return_value = False
+        mock_psycopg_connection.return_value = context_manager
+
+        tenant_id = str(uuid.uuid4())
+        scan_id = str(uuid.uuid4())
+        row = {
+            "id": uuid.uuid4(),
+            "tenant_id": tenant_id,
+            "compliance_id": "test",
+            "framework": "Test",
+            "version": "1.0",
+            "description": "desc",
+            "region": "us-east-1",
+            "requirement_id": "req-1",
+            "requirement_status": "PASS",
+            "passed_checks": 1,
+            "failed_checks": 0,
+            "total_checks": 1,
+            "scan_id": scan_id,
+        }
+        row[mismatched_field] = str(uuid.uuid4())
+
+        with patch.object(MainRouter, "admin_db", "admin"):
+            with pytest.raises(ComplianceRowScopeError):
+                _copy_compliance_requirement_rows(tenant_id, scan_id, [row], 2000)
+
+        cursor.copy_expert.assert_not_called()
+        connection.rollback.assert_called_once()
+        connection.commit.assert_not_called()
+
+    @patch("tasks.jobs.scan.ComplianceRequirementOverview")
+    @patch("tasks.jobs.scan.rls_transaction")
+    @patch(
+        "tasks.jobs.scan._copy_compliance_requirement_rows",
+        side_effect=ComplianceRowScopeError("out of scope"),
+    )
+    def test_persist_compliance_requirement_rows_does_not_fall_back_on_scope_error(
+        self, mock_copy, mock_rls_transaction, mock_model
+    ):
+        """A scope violation is a caller bug: the ORM fallback must not persist it."""
+        tenant_id = str(uuid.uuid4())
+        scan_id = str(uuid.uuid4())
+
+        with pytest.raises(ComplianceRowScopeError):
+            _persist_compliance_requirement_rows(tenant_id, scan_id, lambda: [])
+
+        mock_copy.assert_called_once()
+        mock_rls_transaction.assert_not_called()
+        mock_model.objects.filter.assert_not_called()
+        mock_model.objects.bulk_create.assert_not_called()
+
     @patch("tasks.jobs.scan.psycopg_connection")
     def test_copy_compliance_requirement_rows_transaction_rollback_on_set_config_error(
         self, mock_psycopg_connection, settings
@@ -3533,7 +3686,9 @@ class TestComplianceRequirementCopy:
 
         with patch.object(MainRouter, "admin_db", "admin"):
             with pytest.raises(Exception, match="SET prowler.tenant_id failed"):
-                _copy_compliance_requirement_rows(str(row["tenant_id"]), [row])
+                _copy_compliance_requirement_rows(
+                    str(row["tenant_id"]), str(row["scan_id"]), [row], 2000
+                )
 
         # Verify rollback was called
         connection.rollback.assert_called_once()
@@ -3579,7 +3734,9 @@ class TestComplianceRequirementCopy:
         }
 
         with patch.object(MainRouter, "admin_db", "admin"):
-            _copy_compliance_requirement_rows(str(row["tenant_id"]), [row])
+            _copy_compliance_requirement_rows(
+                str(row["tenant_id"]), str(row["scan_id"]), [row], 2000
+            )
 
         # Verify commit was called and rollback was not
         connection.commit.assert_called_once()
@@ -3590,9 +3747,10 @@ class TestComplianceRequirementCopy:
     @patch("tasks.jobs.scan._copy_compliance_requirement_rows")
     def test_persist_compliance_requirement_rows_success(self, mock_copy):
         """Test successful COPY path without fallback to ORM."""
-        mock_copy.return_value = None  # Success, no exception
+        mock_copy.return_value = 1  # Success, no exception
 
         tenant_id = str(uuid.uuid4())
+        scan_id = str(uuid.uuid4())
         rows = [
             {
                 "id": uuid.uuid4(),
@@ -3608,16 +3766,21 @@ class TestComplianceRequirementCopy:
                 "passed_checks": 1,
                 "failed_checks": 0,
                 "total_checks": 1,
-                "scan_id": uuid.uuid4(),
+                "scan_id": scan_id,
             }
         ]
 
-        _persist_compliance_requirement_rows(tenant_id, rows)
+        total = _persist_compliance_requirement_rows(tenant_id, scan_id, lambda: rows)
 
-        # Verify COPY was called
-        mock_copy.assert_called_once_with(tenant_id, rows)
+        assert total == 1
+        mock_copy.assert_called_once()
+        copy_args = mock_copy.call_args[0]
+        assert copy_args[0] == tenant_id
+        assert copy_args[1] == scan_id
+        assert list(copy_args[2]) == rows
 
     @patch("tasks.jobs.scan.logger")
+    @patch("tasks.jobs.scan.ComplianceRequirementOverview.objects.filter")
     @patch("tasks.jobs.scan.ComplianceRequirementOverview.objects.bulk_create")
     @patch("tasks.jobs.scan.rls_transaction")
     @patch(
@@ -3625,7 +3788,12 @@ class TestComplianceRequirementCopy:
         side_effect=Exception("COPY failed"),
     )
     def test_persist_compliance_requirement_rows_fallback_logging(
-        self, mock_copy, mock_rls_transaction, mock_bulk_create, mock_logger
+        self,
+        mock_copy,
+        mock_rls_transaction,
+        mock_bulk_create,
+        mock_filter,
+        mock_logger,
     ):
         """Test logger.exception is called when COPY fails and fallback occurs."""
         tenant_id = str(uuid.uuid4())
@@ -3651,7 +3819,9 @@ class TestComplianceRequirementCopy:
         ctx.__exit__.return_value = False
         mock_rls_transaction.return_value = ctx
 
-        _persist_compliance_requirement_rows(tenant_id, [row])
+        _persist_compliance_requirement_rows(
+            tenant_id, str(row["scan_id"]), lambda: [row]
+        )
 
         # Verify logger.exception was called
         mock_logger.exception.assert_called_once()
@@ -3660,6 +3830,7 @@ class TestComplianceRequirementCopy:
         assert "falling back to ORM" in args[0]
         assert kwargs.get("exc_info") is not None
 
+    @patch("tasks.jobs.scan.ComplianceRequirementOverview.objects.filter")
     @patch("tasks.jobs.scan.ComplianceRequirementOverview.objects.bulk_create")
     @patch("tasks.jobs.scan.rls_transaction")
     @patch(
@@ -3667,7 +3838,7 @@ class TestComplianceRequirementCopy:
         side_effect=Exception("copy failed"),
     )
     def test_persist_compliance_requirement_rows_fallback_multiple_rows(
-        self, mock_copy, mock_rls_transaction, mock_bulk_create
+        self, mock_copy, mock_rls_transaction, mock_bulk_create, mock_filter
     ):
         """Test ORM fallback with multiple rows."""
         tenant_id = str(uuid.uuid4())
@@ -3714,10 +3885,14 @@ class TestComplianceRequirementCopy:
         ctx.__exit__.return_value = False
         mock_rls_transaction.return_value = ctx
 
-        _persist_compliance_requirement_rows(tenant_id, rows)
+        total = _persist_compliance_requirement_rows(
+            tenant_id, str(scan_id), lambda: rows
+        )
 
-        mock_copy.assert_called_once_with(tenant_id, rows)
+        assert total == 2
+        mock_copy.assert_called_once()
         mock_rls_transaction.assert_called_once_with(tenant_id)
+        mock_filter.assert_called_once_with(scan_id=str(scan_id))
         mock_bulk_create.assert_called_once()
 
         args, kwargs = mock_bulk_create.call_args
@@ -3741,6 +3916,7 @@ class TestComplianceRequirementCopy:
         assert objects[1].passed_checks == 2
         assert objects[1].failed_checks == 3
 
+    @patch("tasks.jobs.scan.ComplianceRequirementOverview.objects.filter")
     @patch("tasks.jobs.scan.ComplianceRequirementOverview.objects.bulk_create")
     @patch("tasks.jobs.scan.rls_transaction")
     @patch(
@@ -3748,7 +3924,7 @@ class TestComplianceRequirementCopy:
         side_effect=Exception("copy failed"),
     )
     def test_persist_compliance_requirement_rows_fallback_all_fields(
-        self, mock_copy, mock_rls_transaction, mock_bulk_create
+        self, mock_copy, mock_rls_transaction, mock_bulk_create, mock_filter
     ):
         """Test ORM fallback correctly maps all fields from row dict to model."""
         tenant_id = str(uuid.uuid4())
@@ -3778,7 +3954,7 @@ class TestComplianceRequirementCopy:
         ctx.__exit__.return_value = False
         mock_rls_transaction.return_value = ctx
 
-        _persist_compliance_requirement_rows(tenant_id, [row])
+        _persist_compliance_requirement_rows(tenant_id, str(scan_id), lambda: [row])
 
         args, kwargs = mock_bulk_create.call_args
         objects = args[0]

api/src/backend/tasks/tests/test_tasks.py

@@ -420,6 +420,124 @@ class TestGenerateOutputs:
             assert result == {"upload": False}
             mock_scan_update.return_value.update.assert_called_once()
 
+    def test_generate_outputs_removes_previous_run_artifacts(self):
+        """Regression for PROWLER-2266.
+
+        Output writers open files in append mode with a deterministic path
+        (derived from scan.started_at). If this task runs again for the same
+        scan (e.g. broker redelivery after a worker is killed mid-run with
+        task_acks_late), reusing the leftover files appends every finding row
+        again, duplicating rows in the CSV/output while the API console keeps
+        showing a single finding. The task must start from a clean slate by
+        removing the scan's tmp output directory before (re)generating.
+        """
+        import tempfile
+        from pathlib import Path
+
+        with tempfile.TemporaryDirectory() as tmp_root:
+            # Simulate artifacts left behind by a previous run of the same scan.
+            scan_tmp_dir = Path(tmp_root) / self.tenant_id / self.scan_id
+            scan_tmp_dir.mkdir(parents=True)
+            stale_artifact = scan_tmp_dir / "prowler-output-aws-20260723120000.csv"
+            stale_artifact.write_text("HEADER\nold-finding-row\n")
+
+            with (
+                patch("tasks.tasks.DJANGO_TMP_OUTPUT_DIRECTORY", tmp_root),
+                patch("tasks.tasks.ScanSummary.objects.filter") as mock_filter,
+                patch("tasks.tasks.Provider.objects.get"),
+                patch("tasks.tasks.initialize_prowler_provider"),
+                patch("tasks.tasks.Compliance.get_bulk"),
+                patch("tasks.tasks.get_compliance_frameworks"),
+                patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
+                patch("tasks.tasks.Finding.all_objects.filter") as mock_findings,
+                patch(
+                    "tasks.tasks._generate_output_directory",
+                    return_value=("/tmp/test/out", "/tmp/test/comp"),
+                ),
+                patch("tasks.tasks.FindingOutput._transform_findings_stats"),
+                patch("tasks.tasks.FindingOutput.transform_api_finding"),
+                patch(
+                    "tasks.tasks.OUTPUT_FORMATS_MAPPING",
+                    {
+                        "json": {
+                            "class": MagicMock(name="Writer"),
+                            "suffix": ".json",
+                            "kwargs": {},
+                        }
+                    },
+                ),
+                patch("tasks.tasks.COMPLIANCE_CLASS_MAP", {"aws": []}),
+                patch(
+                    "tasks.tasks._compress_output_files", return_value="/tmp/compressed"
+                ),
+                patch("tasks.tasks._upload_to_s3", return_value=None),
+                patch("tasks.tasks.Scan.all_objects.filter"),
+            ):
+                mock_filter.return_value.exists.return_value = True
+                mock_findings.return_value.order_by.return_value.iterator.return_value = [
+                    [MagicMock()],
+                    True,
+                ]
+
+                generate_outputs_task(
+                    scan_id=self.scan_id,
+                    provider_id=self.provider_id,
+                    tenant_id=self.tenant_id,
+                )
+
+            # The stale artifacts from the previous run must be gone, so the
+            # append-mode writers cannot duplicate rows onto them.
+            assert not stale_artifact.exists()
+            assert not scan_tmp_dir.exists()
+
+    def test_generate_outputs_aborts_when_stale_cleanup_fails(self):
+        """Regression for PROWLER-2266.
+
+        If the stale output directory cannot be removed (e.g. permission error),
+        the leftover files would be reopened in append mode and every finding
+        row would be duplicated. The task must abort instead of continuing and
+        publishing duplicated rows, so the retry can start from a clean slate.
+        """
+        import tempfile
+        from pathlib import Path
+
+        with tempfile.TemporaryDirectory() as tmp_root:
+            scan_tmp_dir = Path(tmp_root) / self.tenant_id / self.scan_id
+            scan_tmp_dir.mkdir(parents=True)
+            stale_artifact = scan_tmp_dir / "prowler-output-aws-20260723120000.csv"
+            stale_artifact.write_text("HEADER\nold-finding-row\n")
+
+            with (
+                patch("tasks.tasks.DJANGO_TMP_OUTPUT_DIRECTORY", tmp_root),
+                patch("tasks.tasks.ScanSummary.objects.filter") as mock_filter,
+                patch("tasks.tasks.Provider.objects.get"),
+                patch("tasks.tasks.initialize_prowler_provider"),
+                patch("tasks.tasks.Compliance.get_bulk"),
+                patch("tasks.tasks.get_compliance_frameworks"),
+                patch("tasks.tasks.get_prowler_provider_compliance", return_value={}),
+                # `rmtree(ignore_errors=True)` swallows the failure and leaves the
+                # directory behind; simulate that with a no-op so the guard fires.
+                patch("tasks.tasks.rmtree"),
+                patch("tasks.tasks._generate_output_directory") as mock_gen_dir,
+                patch("tasks.tasks._compress_output_files") as mock_compress,
+                patch("tasks.tasks._upload_to_s3") as mock_upload,
+                patch("tasks.tasks.Scan.all_objects.filter") as mock_scan_update,
+            ):
+                mock_filter.return_value.exists.return_value = True
+
+                with pytest.raises(RuntimeError, match="stale output directory"):
+                    generate_outputs_task(
+                        scan_id=self.scan_id,
+                        provider_id=self.provider_id,
+                        tenant_id=self.tenant_id,
+                    )
+
+            # The task must abort before generating/publishing any output.
+            mock_gen_dir.assert_not_called()
+            mock_compress.assert_not_called()
+            mock_upload.assert_not_called()
+            mock_scan_update.assert_not_called()
+
     def test_generate_outputs_triggers_html_extra_update(self):
         mock_finding_output = MagicMock()
         mock_finding_output.compliance = {"cis": ["requirement-1", "requirement-2"]}

api/uv.lock

@@ -4673,8 +4673,8 @@ wheels = [
 
 [[package]]
 name = "prowler"
-version = "5.35.0"
-source = { git = "https://github.com/prowler-cloud/prowler.git?rev=v5.35#1459046985908c099bd2b2e279530e8a47bccdf8" }
+version = "5.36.0"
+source = { git = "https://github.com/prowler-cloud/prowler.git?rev=v5.36#2298d4a3f881abe9e2266195f764b60d34af07eb" }
 dependencies = [
     { name = "alibabacloud-actiontrail20200706" },
     { name = "alibabacloud-credentials" },
@@ -4762,7 +4762,7 @@ dependencies = [
 
 [[package]]
 name = "prowler-api"
-version = "1.36.1"
+version = "1.37.1"
 source = { virtual = "." }
 dependencies = [
     { name = "cartography" },
@@ -4862,7 +4862,7 @@ requires-dist = [
     { name = "matplotlib", specifier = "==3.10.8" },
     { name = "neo4j", specifier = "==6.1.0" },
     { name = "openai", specifier = "==1.109.1" },
-    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=v5.35" },
+    { name = "prowler", git = "https://github.com/prowler-cloud/prowler.git?rev=v5.36" },
     { name = "psycopg2-binary", specifier = "==2.9.9" },
     { name = "pytest-celery", extras = ["redis"], specifier = "==1.3.0" },
     { name = "reportlab", specifier = "==4.4.10" },

docs/developer-guide/environment-variables.mdx

@@ -36,6 +36,9 @@ The former build-time variables map to the new runtime variables as follows:
 | `NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID` | `UI_GOOGLE_TAG_MANAGER_ID` |
 | `NEXT_PUBLIC_SENTRY_DSN`, `SENTRY_DSN` | `UI_SENTRY_DSN` |
 | `NEXT_PUBLIC_SENTRY_ENVIRONMENT`, `SENTRY_ENVIRONMENT` | `UI_SENTRY_ENVIRONMENT` |
+| `NEXT_PUBLIC_IS_CLOUD_ENV` | `UI_CLOUD_ENABLED` |
+
+`UI_CLOUD_ENABLED` is a plain runtime boolean flag that enables Prowler Cloud behavior when set to the exact string `"true"` and defaults to off; unlike the other renamed variables it has no legacy fallback, so `NEXT_PUBLIC_IS_CLOUD_ENV` is no longer read.
 
 The build-time-only Sentry variables used for source-map upload — `SENTRY_ORG`, `SENTRY_PROJECT`, `SENTRY_AUTH_TOKEN`, and `SENTRY_RELEASE` — keep their names, as they are not part of Prowler Local Server's runtime configuration.
 

docs/docs.json

@@ -80,7 +80,24 @@
               {
                 "group": "Prowler for AI Agents",
                 "pages": [
-                  "getting-started/products/prowler-claude-code-plugin"
+                  "user-guide/ai-agents/index",
+                  "user-guide/ai-agents/claude-code",
+                  "user-guide/ai-agents/claude-desktop",
+                  "user-guide/ai-agents/codex",
+                  "user-guide/ai-agents/cursor",
+                  "user-guide/ai-agents/vscode"
+                ]
+              },
+              {
+                "group": "Prowler for MSPs and MSSPs",
+                "pages": [
+                  "getting-started/products/prowler-for-msps",
+                  "user-guide/tutorials/prowler-for-msps-sign-up",
+                  "user-guide/tutorials/prowler-for-msps-organization",
+                  "user-guide/tutorials/prowler-for-msps-team",
+                  "user-guide/tutorials/prowler-for-msps-customers",
+                  "user-guide/tutorials/prowler-for-msps-billing",
+                  "user-guide/tutorials/prowler-for-msps-branding"
                 ]
               }
             ]
@@ -195,6 +212,17 @@
               }
             ]
           },
+          {
+            "group": "Prowler for MSPs and MSSPs",
+            "pages": [
+              "user-guide/tutorials/prowler-for-msps-sign-up",
+              "user-guide/tutorials/prowler-for-msps-organization",
+              "user-guide/tutorials/prowler-for-msps-team",
+              "user-guide/tutorials/prowler-for-msps-customers",
+              "user-guide/tutorials/prowler-for-msps-billing",
+              "user-guide/tutorials/prowler-for-msps-branding"
+            ]
+          },
           {
             "group": "Prowler Lighthouse AI",
             "pages": [
@@ -217,7 +245,12 @@
           {
             "group": "Prowler for AI Agents",
             "pages": [
-              "getting-started/products/prowler-claude-code-plugin"
+              "user-guide/ai-agents/index",
+              "user-guide/ai-agents/claude-code",
+              "user-guide/ai-agents/claude-desktop",
+              "user-guide/ai-agents/codex",
+              "user-guide/ai-agents/cursor",
+              "user-guide/ai-agents/vscode"
             ]
           },
           {
@@ -660,6 +693,10 @@
     {
       "source": "/user-guide/tutorials/prowler-cloud-public-ips",
       "destination": "/security/networking"
+    },
+    {
+      "source": "/getting-started/products/prowler-claude-code-plugin",
+      "destination": "/user-guide/ai-agents/claude-code"
     }
   ]
 }

docs/getting-started/basic-usage/prowler-mcp.mdx

@@ -23,6 +23,28 @@ Most users should use the **Cloud MCP Server** — it needs no installation and
 - **Cloud MCP Server (HTTP)**: the managed server at `https://mcp.prowler.com/mcp` (or your own self-hosted HTTP server).
 - **Local MCP Server (STDIO)**: local installation only (runs as a subprocess of your MCP client).
 
+### Step-by-Step Guides Per Agent
+
+The tabs below are a quick configuration reference. For a walkthrough with screenshots, troubleshooting, and client-specific caveats, follow the dedicated guide for your agent:
+
+<CardGroup cols={2}>
+  <Card title="Claude Code" icon="terminal" href="/user-guide/ai-agents/claude-code">
+    Plugin vs. MCP-only, and which Claude surfaces work
+  </Card>
+  <Card title="Claude Desktop App (Chat)" icon="comment" href="/user-guide/ai-agents/claude-desktop">
+    The Chat tab, via a local bridge
+  </Card>
+  <Card title="Codex" icon="code" href="/user-guide/ai-agents/codex">
+    CLI and the VS Code extension
+  </Card>
+  <Card title="Cursor" icon="arrow-pointer" href="/user-guide/ai-agents/cursor">
+    Global and project scopes
+  </Card>
+  <Card title="VS Code / Copilot" icon="microsoft" href="/user-guide/ai-agents/vscode">
+    Agent mode with secure key prompts
+  </Card>
+</CardGroup>
+
 ## Cloud MCP Server Configuration (Recommended)
 
 Connect to the **Cloud MCP Server** at `https://mcp.prowler.com/mcp` over HTTP. This is the recommended path — no installation, always up to date. The same configuration works for a self-hosted HTTP server: just swap the URL.
@@ -76,67 +98,6 @@ Connect to the **Cloud MCP Server** at `https://mcp.prowler.com/mcp` over HTTP.
     The `mcp-remote` tool acts as a bridge for clients that don't support HTTP natively. Learn more at [mcp-remote on npm](https://www.npmjs.com/package/mcp-remote).
     </Info>
   </Tab>
-
-  <Tab title="Claude Desktop">
-    1. Open Claude Desktop settings
-    2. Go to "Developer" tab
-    3. Click in "Edit Config" button
-    4. Edit the `claude_desktop_config.json` file with your favorite editor
-    5. Install a reviewed version of `mcp-remote` in a dedicated local workspace:
-    ```bash
-    mkdir -p ~/.local/share/prowler-mcp-bridge
-    cd ~/.local/share/prowler-mcp-bridge
-    npm init -y
-    npm install --save-exact mcp-remote@0.1.38
-    ```
-    6. Add the following configuration:
-    ```json
-    {
-      "mcpServers": {
-        "prowler": {
-          "command": "/absolute/path/to/.local/share/prowler-mcp-bridge/node_modules/.bin/mcp-remote",
-          "args": [
-            "https://mcp.prowler.com/mcp",
-            "--header",
-            "Authorization: Bearer ${PROWLER_API_KEY}"
-          ],
-          "env": {
-            "PROWLER_API_KEY": "<your-api-key-here>"
-          }
-        }
-      }
-    }
-    ```
-  </Tab>
-
-  <Tab title="Claude Code">
-    Run the following command:
-    ```bash
-    export PROWLER_API_KEY="<your-api-key-here>"
-    claude mcp add --transport http prowler https://mcp.prowler.com/mcp --header "Authorization: Bearer $PROWLER_API_KEY" --scope user
-    ```
-  </Tab>
-
-  <Tab title="Cursor">
-    1. Open Cursor settings
-    2. Go to "Tools & MCP"
-    3. Click in "New MCP Server" button
-    4. Add to the JSON Configuration the following:
-    ```json
-    {
-      "mcpServers": {
-        "prowler": {
-          "url": "https://mcp.prowler.com/mcp",
-          "headers": {
-            "Authorization": "Bearer <your-api-key-here>"
-          }
-        }
-      }
-    }
-    ```
-  </Tab>
-
-
 </Tabs>
 
 ## Local MCP Server Configuration

docs/getting-started/installation/prowler-app.mdx

@@ -128,8 +128,8 @@ To update the environment file:
 Edit the `.env` file and change version values:
 
 ```env
-PROWLER_UI_VERSION="5.34.0"
-PROWLER_API_VERSION="5.34.0"
+PROWLER_UI_VERSION="5.35.0"
+PROWLER_API_VERSION="5.35.0"
 ```
 
 <Note>

docs/getting-started/products/index.mdx

@@ -18,7 +18,7 @@ Read the [public announcement of the Prowler product families](https://prowler-w
 | Prowler Private Cloud | Prowler Cloud deployed in your own environment. Formerly Prowler Enterprise. See [pricing](https://prowler.com/pricing). |
 | [Prowler Hub](https://hub.prowler.com) | Free public library of versioned checks, cloud service artifacts, and compliance frameworks. |
 | [Prowler Lighthouse AI](/getting-started/products/prowler-cloud-lighthouse) | AI security analyst capabilities within Prowler Cloud and Prowler Private Cloud. |
-| [Prowler MCP](/getting-started/products/prowler-mcp) | MCP server that connects AI assistants and agents to Prowler, including IDE plugins such as [Prowler for Claude Code](/getting-started/products/prowler-claude-code-plugin). |
+| [Prowler MCP](/getting-started/products/prowler-mcp) | MCP server that connects AI assistants and agents to Prowler, including IDE plugins such as [Prowler for Claude Code](/user-guide/ai-agents/claude-code). |
 
 {/* Unreleased products. Uncomment these rows in the Prowler Products table when announced:
 | Prowler Registry | Distribution service for Prowler content such as checks and compliance frameworks. Free and paid tiers. |

docs/getting-started/products/prowler-claude-code-plugin.mdx

@@ -1,102 +0,0 @@
----
-title: 'Prowler for Claude Code'
-sidebarTitle: 'Claude Code'
----
-
-End-to-end cloud security and compliance from inside [Claude Code](https://www.claude.com/product/claude-code), powered by the [Prowler MCP server](/getting-started/products/prowler-mcp). The plugin lets Claude walk a Prowler Cloud-connected account through a compliance assessment and remediate findings until the chosen security or industry framework is compliant.
-
-<Warning>
-**Preview**: this plugin is under active development. Please report issues on [GitHub](https://github.com/prowler-cloud/prowler/issues) or join the [Slack community](https://goto.prowler.com/slack) for feedback.
-</Warning>
-
-## Requirements
-
-<CardGroup cols={3}>
-  <Card title="Claude Code" icon="terminal">
-    Installed and signed in. See the [official install guide](https://www.claude.com/product/claude-code).
-  </Card>
-  <Card title="Prowler Cloud account" icon="cloud">
-    The free tier is enough to start. Sign up at [cloud.prowler.com](https://cloud.prowler.com).
-  </Card>
-  <Card title="Prowler API key" icon="key">
-    Create one at [cloud.prowler.com/profile](https://cloud.prowler.com/profile).
-  </Card>
-</CardGroup>
-
-## Installation
-
-<Tabs>
-  <Tab title="From GitHub (recommended)">
-    Inside a Claude Code session:
-
-    ```text
-    /plugin marketplace add prowler-cloud/prowler
-    /plugin install prowler@prowler-plugins
-    ```
-  </Tab>
-  <Tab title="From a local clone">
-    If you already have the repository checked out:
-
-    ```text
-    /plugin marketplace add /absolute/path/to/prowler
-    /plugin install prowler@prowler-plugins
-    ```
-  </Tab>
-</Tabs>
-
-## Configuration
-
-On first install, Claude Code prompts for your **Prowler API key**. The value is stored securely (macOS keychain or `~/.claude/.credentials.json`) and used to authenticate against Prowler Cloud.
-
-<Note>
-To rotate the key, uninstall and reinstall the plugin — Claude Code will prompt again.
-</Note>
-
-## Verify the installation
-
-In a Claude Code session:
-
-```text
-/mcp          → "prowler" appears as a connected server
-/plugin       → "prowler" enabled, skill listed as prowler:framework-compliance-triage
-```
-
-If `/mcp` reports the `prowler` server as failed, the most common cause is a rejected API key — re-issue one in Prowler Cloud and reinstall the plugin so it re-prompts.
-
-## Usage
-
-Open a conversation that mentions the framework you want to comply with. Examples:
-
-- *"Make my AWS production account compliant with CIS 4.0."*
-- *"Make my current Terraform project compliant with Prowler ThreatScore Compliance Framework based on the latest scan results."*
-- *"Help me get to 100% on PCI-DSS for this GCP project."*
-
-You pick a **primary tool** (Terraform, gh / az / aws CLI, web console, or mixed) and a **mode**:
-
-<CardGroup cols={2}>
-  <Card title="Claude-assisted (default)" icon="hand">
-    Claude shows each fix — target resource, exact commands, side effects, reversibility — and waits for your go-ahead before applying.
-  </Card>
-  <Card title="Claude autonomous" icon="robot">
-    Claude presents a single up-front plan grouped by shared fixes, waits for one confirmation, then proceeds. It pauses mid-loop if a fix has wide blast radius or a finding is not applicable.
-  </Card>
-</CardGroup>
-
-Claude tracks progress in a markdown report under `.prowler/` at your project root — one file per framework × account. Open it any time to see exactly where the flow is. When all findings are addressed, Claude proposes a fresh Prowler scan to verify everything end-to-end.
-
-## Uninstalling
-
-```text
-/plugin uninstall prowler@prowler-plugins
-/plugin marketplace remove prowler-plugins
-```
-
-The stored API key is removed automatically.
-
-## Troubleshooting
-
-| Symptom | Likely cause | Fix |
-| --- | --- | --- |
-| `/mcp` shows `prowler` as failed | Rejected API key | Generate a new one in Prowler Cloud and reinstall the plugin to re-prompt. |
-| Skill not invoked when expected | The skill description didn't match the prompt | Mention the framework name plus "compliance" or "compliant" in your prompt. |
-| "Framework not supported" | Prowler Hub does not list the framework for that provider | Open an issue or PR at [github.com/prowler-cloud/prowler](https://github.com/prowler-cloud/prowler). |

docs/getting-started/products/prowler-for-msps.mdx

@@ -0,0 +1,78 @@
+---
+title: "Prowler for MSPs and MSSPs"
+sidebarTitle: "Overview"
+---
+
+Prowler for MSPs and MSSPs is a dedicated console for Managed Service Providers (MSPs), Managed Security Service Providers (MSSPs), resellers and consultants who run cloud security for other organizations. It lets a provider onboard customers, group them, manage a team, and operate each customer's Prowler Cloud tenant on their behalf.
+
+The console is available at [partners.prowler.com](https://partners.prowler.com).
+
+<Card title="Sign Up for Prowler for MSPs and MSSPs" icon="rocket" href="https://partners.prowler.com/sign-up" />
+
+## What You Get
+
+* **Customer onboarding:** provision a Prowler Cloud tenant for each customer, with a billing plan selected up front.
+* **Delegated access:** open any customer's Prowler Cloud tenant from the console. Every action is attributed to you acting on behalf of that customer.
+* **Team and roles:** invite team members by email and assign a role that governs what they can do.
+* **Consolidated billing:** each customer carries its own plan, with month-to-date revenue reported across every customer.
+* **Branding:** upload your logo to appear alongside Prowler branding in the console.
+
+## Core Concepts
+
+Three objects make up the model. Getting these straight makes the rest of the documentation easy to follow.
+
+| Object | What it is |
+|---|---|
+| **Partner organization** | The provider's own company. The top-level container for everything below, created at sign-up. |
+| **Customer** | One of the provider's customers. Each customer maps to a Prowler Cloud tenant and carries its own billing plan. |
+| **Team member** | A user in the partner organization, holding a role that governs what they can do. |
+
+## How It Relates to Prowler Cloud
+
+| | Prowler Cloud | Prowler for MSPs and MSSPs |
+|---|---|---|
+| **Audience** | End customers | MSPs, MSSPs, resellers, consultants |
+| **Console** | [cloud.prowler.com](https://cloud.prowler.com) | [partners.prowler.com](https://partners.prowler.com) |
+| **Scope** | One organization's own cloud accounts | Many customer organizations |
+| **Billing** | Each organization pays for itself | The provider manages a plan per customer |
+| **Branding** | Prowler-branded | Your logo alongside Prowler branding |
+
+Your customers keep signing in to Prowler Cloud with their own users. Provider-side access is **additive** — it does not replace or restrict customer-side users.
+
+## The Console at a Glance
+
+Signing in lands you on the **Dashboard**. The sidebar carries:
+
+| Entry | What it does | Visible to |
+|---|---|---|
+| **Dashboard** | Partner Insights, a Billing Overview card and an Active Customers table | Everyone |
+| **Customers** | Add customers, review their posture and billing, and open their Prowler Cloud tenant | Everyone |
+| **Team** | Invite, re-invite, disable and remove team members | Roles with **Manage members** |
+| **Settings** | Profile, Partner Code, branding and security | Everyone; editing requires **Manage settings** |
+
+![Prowler for MSPs and MSSPs dashboard](/images/prowler-for-msps/dashboard.png)
+
+**Partner Insights** is the top row: **Total Customers**, broken down into active and non-paid; **Cloud Accounts**, broken down by cloud provider; and **Monitored Resources**, with a note on organizations whose critical risk has grown. Each card carries a 30-day trend.
+
+Below it, **Billing Overview** reports monthly expenses against the previous month and splits revenue for the period into annual, monthly and overage. **Active Customers** lists your customers with their provider count, resource count and last completed scan, and carries its own **Add Customer** button.
+
+## Getting Access
+
+Sign-up is self-service, approval is not. Register at [partners.prowler.com/sign-up](https://partners.prowler.com/sign-up), then verify your email address — the organization sits in **Pending email verification** until you do, and the Prowler team does not review it before that. Verifying moves the organization to **Pending approval**. Once approved, you can invite your team and start onboarding customers.
+
+## Next Steps
+
+<Columns cols={2}>
+  <Card title="Sign Up and Sign In" icon="user-plus" href="/user-guide/tutorials/prowler-for-msps-sign-up">
+    Register, verify your email, and get approved.
+  </Card>
+  <Card title="Your Partner Organization" icon="briefcase" href="/user-guide/tutorials/prowler-for-msps-organization">
+    Lifecycle, settings, Partner Code and closing your organization.
+  </Card>
+  <Card title="Onboarding Customers" icon="building" href="/user-guide/tutorials/prowler-for-msps-customers">
+    Add customers and open their Prowler Cloud tenants.
+  </Card>
+  <Card title="Managing Your Team" icon="users" href="/user-guide/tutorials/prowler-for-msps-team">
+    Invite team members and assign roles.
+  </Card>
+</Columns>

docs/getting-started/products/prowler-mcp.mdx

@@ -26,7 +26,7 @@ The fastest way to get started is the **Cloud MCP Server** at `https://mcp.prowl
 ```
 
 <Card title="Connect Your MCP Client to the Cloud MCP Server" icon="cloud" href="/getting-started/basic-usage/prowler-mcp#cloud-mcp-server-configuration-recommended" horizontal>
-  Step-by-step setup for Claude Desktop, Claude Code, Cursor, and other clients.
+  Step-by-step setup for Claude Code, Codex, Cursor, VS Code, and other agents.
 </Card>
 
 <Note>

docs/introduction.mdx

@@ -83,7 +83,7 @@ Prowler supports a wide range of providers organized by category:
 
 | Provider                                                            | Support  | Audit Scope/Entities | Interface |
 | ------------------------------------------------------------------- | -------- | -------------------- | --------- |
-| [Image](/user-guide/providers/image/getting-started-image)          | Official | Container Images / Registries | CLI, API  |
+| [Image](/user-guide/providers/image/getting-started-image)          | Official | Container Images / Registries | UI, API, CLI |
 
 ### Custom Providers (Prowler Private Cloud Only)
 

docs/style.css

@@ -84,6 +84,7 @@ li[data-title="Prowler Lighthouse AI"] > button span:first-child::after,
 li[data-title="Providers"] > button span:first-child::after,
 li[data-title="Scans"] > button span:first-child::after,
 li[data-title="Prowler MCP"] > button span:first-child::after,
+li[data-title="Prowler for AI Agents"] > button span:first-child::after,
 div:has(+ ul a[href="/security/encryption"]) h3 span::after,
 li[id="/user-guide/compliance/tutorials/cross-provider-compliance"] a > div > div > span:first-child::after,
 li[id="/user-guide/tutorials/prowler-alerts"] a > div > div > span:first-child::after,

docs/user-guide/ai-agents/claude-code.mdx

@@ -0,0 +1,294 @@
+---
+title: "Connect Claude Code to Prowler MCP Server"
+sidebarTitle: "Claude Code"
+---
+
+Connect [Claude Code](https://www.claude.com/product/claude-code) to the Prowler Cloud MCP Server at `https://mcp.prowler.com/mcp`.
+
+## Where Claude Code Runs
+
+Claude Code runs in two places. Both read the same configuration file, so you set it up **once from a terminal** and it works in both.
+
+| Surface | How you open it | Reads | Covered by |
+|---|---|---|---|
+| **Claude Code CLI** | `claude` in a terminal | `~/.claude.json` | This guide |
+| **Claude Code in the desktop app** | The **Code** tab inside the Claude app | `~/.claude.json` — the same file | This guide, [set up from a terminal](#claude-code-in-the-desktop-app-code-tab) |
+| **Claude app Chat** | The **Chat** tab inside the Claude app | `claude_desktop_config.json` | [Claude App Chat](/user-guide/ai-agents/claude-desktop) — a separate setup |
+
+<Warning>
+**The Chat tab is not Claude Code.** It is a different product surface with its own configuration file and its own connection method (a local bridge). Nothing on this page applies to it. If you want Prowler in Chat, use the [Claude App Chat](/user-guide/ai-agents/claude-desktop) guide instead.
+</Warning>
+
+## Choose Your Setup
+
+There are two ways to connect. Both end with the same MCP Server connection, the difference is what comes with it.
+
+| | 🔌 **Prowler Plugin** | ⚙️ **MCP Connection Only** |
+|---|---|---|
+| **What you get** | The MCP connection **plus** the official Prowler skills for cloud security tasks | The MCP connection |
+| **Setup** | Two slash commands, prompts for the API key | One `claude mcp add` command |
+| **Guided workflows** | ✅ Skills drive multi-step security work end to end | ❌ You drive the conversation |
+| **Best for** | Structured cloud security work, such as taking an account to compliance | Ad-hoc queries and your own workflows |
+| **Where to use it** | Claude Code CLI | Claude Code CLI, and the **recommended setup for the desktop app's [Code tab](#claude-code-in-the-desktop-app-code-tab)** |
+
+<Note>
+**The plugin already includes the MCP connection.** If you install the plugin, do **not** also run `claude mcp add` — you would end up with the server configured twice.
+</Note>
+
+## Prerequisites
+
+- **Claude Code** installed and signed in. See the [official install guide](https://www.claude.com/product/claude-code).
+- **A Prowler Cloud account.** The free tier is enough to start. Sign up at [cloud.prowler.com](https://cloud.prowler.com).
+
+## Get Your Prowler API Key
+
+Create an API key in Prowler Cloud and copy it. The key begins with `pk_` and is shown only once. Check the [API Keys](/user-guide/tutorials/prowler-app-api-keys#creating-api-keys) guide for details.
+
+---
+
+# Option 1: Install the Prowler Plugin
+
+<Warning>
+**Preview**: this plugin is under active development. Please report issues on [GitHub](https://github.com/prowler-cloud/prowler/issues) or join the [Slack community](https://goto.prowler.com/slack) for feedback.
+</Warning>
+
+End-to-end cloud security from inside Claude Code, powered by the Prowler MCP server. The plugin bundles the official Prowler skills, task-specific workflows that let Claude carry out multi-step security work against a Prowler Cloud-connected account, rather than answering one question at a time.
+
+### Included Skills
+
+| Skill | What it does |
+| --- | --- |
+| `prowler:framework-compliance-triage` | Walks an account through a compliance assessment and remediates findings until the chosen security or industry framework is compliant. |
+
+<Note>
+More skills are on the way. Installing the plugin keeps you current — new skills arrive with plugin updates, no extra configuration required.
+</Note>
+
+## Installation (Claude Code CLI)
+
+<Tabs>
+  <Tab title="From GitHub (recommended)">
+    Inside a Claude Code session:
+
+    ```text
+    /plugin marketplace add prowler-cloud/prowler
+    /plugin install prowler@prowler-plugins
+    ```
+  </Tab>
+  <Tab title="From a local clone">
+    If you already have the repository checked out:
+
+    ```text
+    /plugin marketplace add /absolute/path/to/prowler
+    /plugin install prowler@prowler-plugins
+    ```
+  </Tab>
+</Tabs>
+
+On first install, Claude Code prompts for your **Prowler API key**. The value is stored securely (macOS keychain or `~/.claude/.credentials.json`) and used to authenticate against Prowler Cloud.
+
+## Verify the Installation
+
+In a Claude Code session:
+
+```text
+/mcp          → "prowler" appears as a connected server
+/plugin       → "prowler" enabled, with the bundled Prowler skills listed
+```
+
+If `/mcp` reports the `prowler` server as failed, the most common cause is a rejected API key, re-issue one in Prowler Cloud and reinstall the plugin so it re-prompts.
+
+## Usage
+
+Describe the security task you want done and Claude selects the matching skill.
+
+### Framework Compliance Triage
+
+Mention the framework you want to comply with:
+
+- *"Make my AWS production account compliant with CIS 4.0."*
+- *"Make my current Terraform project compliant with Prowler ThreatScore Compliance Framework based on the latest scan results."*
+- *"Help me get to 100% on PCI-DSS for this GCP project."*
+
+You pick a **primary tool** (Terraform, gh / az / aws CLI, web console, or mixed) and a **mode**:
+
+<CardGroup cols={2}>
+  <Card title="Claude-assisted (default)" icon="hand">
+    Claude shows each fix — target resource, exact commands, side effects, reversibility — and waits for your go-ahead before applying.
+  </Card>
+  <Card title="Claude autonomous" icon="robot">
+    Claude presents a single up-front plan grouped by shared fixes, waits for one confirmation, then proceeds. It pauses mid-loop if a fix has wide blast radius or a finding is not applicable.
+  </Card>
+</CardGroup>
+
+Claude tracks progress in a markdown report under `.prowler/` at your project root — one file per framework × account. Open it any time to see exactly where the flow is. When all findings are addressed, Claude proposes a fresh Prowler scan to verify everything end-to-end.
+
+## Uninstalling
+
+```text
+/plugin uninstall prowler@prowler-plugins
+/plugin marketplace remove prowler-plugins
+```
+
+The stored API key is removed automatically.
+
+---
+
+# Option 2: Connect the MCP Server Only
+
+Choose this when you want Prowler's tools available without the Prowler skills.
+
+## Add the Server
+
+Claude Code connects to remote HTTP MCP servers natively and supports custom headers, so no bridge is required.
+
+```bash
+export PROWLER_API_KEY="pk_your_api_key_here"
+
+claude mcp add --transport http prowler https://mcp.prowler.com/mcp \
+  --header "Authorization: Bearer $PROWLER_API_KEY" \
+  --scope user
+```
+
+<Frame>
+  <img src="/images/prowler-mcp/claude/claude-code-mcp-add.png" alt="Terminal showing the claude mcp add command and its confirmation output" />
+</Frame>
+
+<Warning>
+**Always pass `--scope user`.** The default scope is `local`, which binds the server to the single directory you ran the command in. A locally-scoped server does not load when you open Claude Code anywhere else — this is the most common reason Prowler tools appear to vanish.
+</Warning>
+
+| Scope | Loads in | Shared | Stored in |
+|-------|----------|--------|-----------|
+| `user` | All your projects | No | `~/.claude.json`, top-level `mcpServers` |
+| `project` | Current project only | Yes, via version control | `.mcp.json` in the project root |
+| `local` (default) | Current project only | No | `~/.claude.json`, under that project's entry |
+
+When the same server name exists in more than one scope, precedence is **local → project → user**. The winning entry is used whole; fields are not merged.
+
+<Warning>
+Avoid `--scope project` for Prowler. That writes `.mcp.json` into your repository, and committing the file would publish your API key.
+</Warning>
+
+<Note>
+**Local server:** Replace the URL with your own HTTP endpoint. Everything else stays the same.
+</Note>
+
+## Verify the Connection
+
+```bash
+claude mcp get prowler   # shows which scope holds the definition
+claude mcp list          # lists all servers and their status
+```
+
+Inside a Claude Code session, run `/mcp` to see connected servers and their tools.
+
+<Frame>
+  <img src="/images/prowler-mcp/claude/claude-code-mcp-command.png" alt="Claude Code session showing the /mcp command output with the Prowler server connected" />
+</Frame>
+
+## Start Using Prowler MCP
+
+- *"Show me all critical findings from my AWS accounts"*
+- *"What does the S3 bucket public access check do?"*
+- *"Onboard this new AWS account in my Prowler organization"*
+
+<Frame>
+  <img src="/images/prowler-mcp/claude/claude-code-prowler-query.png" alt="Claude Code answering a question about critical findings using Prowler MCP tools" />
+</Frame>
+
+---
+
+# Claude Code in the Desktop App (Code Tab)
+
+The **Code** tab in the Claude desktop app runs the same Claude Code as the CLI, and reads the same `~/.claude.json`. There is no separate Prowler setup for it — you configure it **from a terminal** and the Code tab picks it up.
+
+<Note>
+**Use [Option 2](#option-2-connect-the-mcp-server-only) with `--scope user` here.** It is the recommended setup for the Code tab. The Prowler plugin ([Option 1](#option-1-install-the-prowler-plugin)) is not the recommended route for the desktop app — install it in the Claude Code CLI instead.
+</Note>
+
+<Warning>
+**You cannot do this from inside the app.** The desktop app has no interface for adding an MCP server to a Claude Code session. **Settings → Connectors** configures the **Chat** tab, not the **Code** tab, so anything added there never reaches Claude Code. Trying to configure it from the app is the main reason this appears not to work.
+</Warning>
+
+<Steps>
+  <Step title="Add the server at user scope from a terminal">
+    In a normal terminal — not inside the app:
+
+    ```bash
+    export PROWLER_API_KEY="pk_your_api_key_here"
+
+    claude mcp add --transport http prowler https://mcp.prowler.com/mcp \
+      --header "Authorization: Bearer $PROWLER_API_KEY" \
+      --scope user
+    ```
+
+    `--scope user` is what makes this work. It writes to `~/.claude.json`, the file the Code tab reads.
+  </Step>
+
+  <Step title="Confirm it landed at user scope">
+    ```bash
+    claude mcp get prowler
+    ```
+
+    The scope must be `user`. A `local`-scoped server is bound to the directory you ran the command in and will not load in an app session opened elsewhere.
+  </Step>
+
+  <Step title="Restart the Claude app">
+    Quit the app completely and reopen it. Configuration is read at startup.
+  </Step>
+
+  <Step title="Verify in the Code tab">
+    Open a **Code** tab session and ask for a Prowler tool: "Do you have access to the Prowler MCP tools?", it should respond with a list of available tools or confirming that it has access.
+  </Step>
+</Steps>
+
+---
+
+# Claude App Chat (Chat Tab)
+
+Not covered by this page. The **Chat** tab is a separate surface: it does not read `~/.claude.json`, so a server added with `claude mcp add` appears in the CLI and in the Code tab but **never** in Chat. That is expected behavior, not a broken setup.
+
+Chat reads `claude_desktop_config.json` and reaches the Prowler MCP Server through a local bridge.
+
+<Card title="Connect the Claude App Chat" icon="comment" href="/user-guide/ai-agents/claude-desktop" horizontal>
+  Separate guide: local bridge and its own configuration file
+</Card>
+
+---
+
+# Troubleshooting
+
+| Symptom | Likely cause | Fix |
+| --- | --- | --- |
+| `/mcp` shows `prowler` as failed | Rejected API key | Generate a new one in Prowler Cloud. With the plugin, reinstall it to re-prompt. |
+| No MCP servers configured | Server added at `local` scope from another directory | Run `claude mcp get prowler`, then re-add with `--scope user`. |
+| A stale entry overrides a working one | Precedence is local → project → user | `claude mcp remove prowler --scope local` |
+| Tools appear in the CLI but not in the app's **Code** tab | Server added at `local` scope, or the app was not restarted | Re-add with `--scope user`, then quit and reopen the app. See [Claude Code in the Desktop App](#claude-code-in-the-desktop-app-code-tab). |
+| Tools appear in the **Code** tab but not the **Chat** tab | Chat is a different surface with its own config file | Expected. Set Chat up separately, see [Claude App Chat](/user-guide/ai-agents/claude-desktop). |
+| No way to add the server from inside the app | The app has no MCP interface for Claude Code sessions | Configure it from a terminal with `--scope user`, then restart the app. See [Claude Code in the Desktop App](#claude-code-in-the-desktop-app-code-tab). |
+| Skill not invoked when expected | The prompt didn't match any skill's description | Name the task explicitly. For compliance triage, mention the framework plus "compliance" or "compliant". |
+| "Framework not supported" | Prowler Hub does not list the framework for that provider | Open an issue or PR at [github.com/prowler-cloud/prowler](https://github.com/prowler-cloud/prowler). |
+
+### Authentication Fails With 401
+
+- Confirm the header value includes the `Bearer ` prefix.
+- Check that `PROWLER_API_KEY` was set when you ran `claude mcp add` — the shell expands it at that moment and stores the resulting literal value. If the variable was empty, the stored header reads `Bearer ` with nothing after it. Verify with `claude mcp get prowler`.
+- Confirm the key has not been revoked in Prowler Cloud.
+
+## Next Steps
+
+<CardGroup cols={2}>
+  <Card title="Tools Reference" icon="wrench" href="/getting-started/basic-usage/prowler-mcp-tools">
+    Explore all available tools and capabilities
+  </Card>
+  <Card title="All MCP Clients" icon="plug" href="/getting-started/basic-usage/prowler-mcp">
+    Configuration reference for every supported client
+  </Card>
+</CardGroup>
+
+## Getting Help
+
+- Search for existing [GitHub issues](https://github.com/prowler-cloud/prowler/issues)
+- Ask for help in our [Slack community](https://goto.prowler.com/slack)
+- Report a new issue on [GitHub](https://github.com/prowler-cloud/prowler/issues/new)

docs/user-guide/ai-agents/claude-desktop.mdx

@@ -0,0 +1,142 @@
+---
+title: "Connect the Claude App Chat to Prowler MCP Server"
+sidebarTitle: "Claude App (Chat)"
+---
+
+Connect the **Chat** tab of the Claude desktop app to the Prowler Cloud MCP Server at `https://mcp.prowler.com/mcp`.
+
+<Warning>
+**This page covers the Chat tab only.** Looking for **Claude Code** — either the CLI or the app's **Code** tab? Those are a different surface, with a different configuration file and a different connection method. See [Connect Claude Code](/user-guide/ai-agents/claude-code).
+</Warning>
+
+## Prerequisites
+
+- **Claude desktop app** installed and signed in.
+- **Node.js and npm**, to install the bridge.
+- **A Prowler Cloud account.** The free tier is enough to start. Sign up at [cloud.prowler.com](https://cloud.prowler.com).
+
+## Why "Add Custom Connector" Does Not Work
+
+The app's **Settings → Connectors → Add custom connector** dialog is the obvious place to paste an MCP URL, but it does not fit the Prowler Cloud MCP Server for two independent reasons:
+
+1. **Connectors authenticate with OAuth.** Authenticating with a fixed API key sent as a request header is a separate mechanism that Anthropic documents as **beta**, rolled out on request. Without it, the dialog offers a URL and OAuth client credentials, with nowhere to supply `Authorization: Bearer pk_...`.
+2. **Connectors do not connect from your machine.** Claude reaches your MCP server from Anthropic's cloud infrastructure rather than your local device. A Prowler MCP Server on `localhost`, behind a VPN, or restricted by an IP allowlist is unreachable that way regardless of authentication.
+
+Use a local bridge instead, as described below.
+
+## Step 1: Get Your Prowler API Key
+
+Create an API key in Prowler Cloud and copy it. The key begins with `pk_` and is shown only once. Check the [API Keys](/user-guide/tutorials/prowler-app-api-keys#creating-api-keys) guide for details.
+
+## Step 2: Install the Bridge
+
+`mcp-remote` presents the remote HTTP server to Claude as a local STDIO server and injects the `Authorization` header. Install a pinned version into a dedicated directory:
+
+```bash
+mkdir -p ~/.local/share/prowler-mcp-bridge
+cd ~/.local/share/prowler-mcp-bridge
+npm init -y
+npm install --save-exact mcp-remote@0.1.38
+```
+
+<Warning>
+Do not configure Claude to run `npx mcp-remote` directly. `npx` can fetch and execute a new version on every launch, which means unreviewed code runs with access to your API key. Install a pinned version and point Claude at the installed binary.
+</Warning>
+
+<Note>
+`mcp-remote` is community-maintained and is not an Anthropic product. Review it before use.
+</Note>
+
+## Step 3: Edit the Configuration File
+
+In the Claude app, go to **Settings → Developer** and click **Edit Config**. This reveals `claude_desktop_config.json`:
+
+- **macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`
+- **Windows:** `%APPDATA%\Claude\claude_desktop_config.json`
+
+<Frame>
+  <img src="/images/prowler-mcp/claude/claude-desktop-developer-settings.png" alt="Claude app Settings Developer tab showing the Edit Config button" />
+</Frame>
+
+Add the following, replacing the `command` path with the absolute path to the installed binary and the placeholder with your API key:
+
+```json
+{
+  "mcpServers": {
+    "prowler": {
+      "command": "/absolute/path/to/.local/share/prowler-mcp-bridge/node_modules/.bin/mcp-remote",
+      "args": [
+        "https://mcp.prowler.com/mcp",
+        "--header",
+        "Authorization: Bearer ${PROWLER_API_KEY}"
+      ],
+      "env": {
+        "PROWLER_API_KEY": "pk_your_api_key_here"
+      }
+    }
+  }
+}
+```
+
+<Note>
+**Local server:** Replace the URL with your own HTTP endpoint. Everything else stays the same.
+</Note>
+
+## Step 4: Restart the App
+
+Quit the Claude app completely and reopen it. Configuration is read at startup.
+
+## Step 5: Start Using Prowler MCP
+
+Open a Chat conversation and ask questions that use the Prowler tools:
+
+- *"Show me all critical findings from my AWS accounts"*
+- *"What does the S3 bucket public access check do?"*
+- *"Summarize my CIS compliance status by provider"*
+
+<Frame>
+  <img src="/images/prowler-mcp/claude/claude-desktop-prowler-tools.png" alt="Claude app chat showing the Prowler MCP tools available" />
+</Frame>
+
+## Troubleshooting
+
+### Server Does Not Appear After Editing the Config
+
+- Quit and reopen the app entirely — closing the window is not enough on macOS.
+- Confirm `claude_desktop_config.json` is valid JSON.
+- Confirm the `command` path points at a real executable. A wrong path surfaces as the server failing to start rather than as an auth error.
+
+### Tools Appear in Claude Code but Not in Chat
+
+Expected. The Chat tab does not read `~/.claude.json`, so servers added with `claude mcp add` never appear here. The Chat tab needs an entry in `claude_desktop_config.json`, which is what this guide sets up.
+
+### Authentication Fails With 401
+
+- Confirm the header value includes the `Bearer ` prefix.
+- Confirm the key has not been revoked in Prowler Cloud.
+
+### Checking the Logs
+
+- **macOS:** `~/Library/Logs/Claude/mcp*.log`
+- **Windows:** `%APPDATA%\Claude\logs\mcp*.log`
+
+```bash
+tail -f ~/Library/Logs/Claude/mcp*.log
+```
+
+## Next Steps
+
+<CardGroup cols={2}>
+  <Card title="Tools Reference" icon="wrench" href="/getting-started/basic-usage/prowler-mcp-tools">
+    Explore all available tools and capabilities
+  </Card>
+  <Card title="All MCP Clients" icon="plug" href="/getting-started/basic-usage/prowler-mcp">
+    Configuration reference for every supported client
+  </Card>
+</CardGroup>
+
+## Getting Help
+
+- Search for existing [GitHub issues](https://github.com/prowler-cloud/prowler/issues)
+- Ask for help in our [Slack community](https://goto.prowler.com/slack)
+- Report a new issue on [GitHub](https://github.com/prowler-cloud/prowler/issues/new)

docs/user-guide/ai-agents/codex.mdx

@@ -0,0 +1,188 @@
+---
+title: "Connect Codex / ChatGPT Desktop to Prowler MCP Server"
+sidebarTitle: "Codex / ChatGPT"
+---
+
+Connect [OpenAI Codex](https://learn.chatgpt.com/docs/extend/mcp) to the Prowler Cloud MCP Server at `https://mcp.prowler.com/mcp` so Codex can query findings, inspect checks, and manage your Prowler providers.
+
+## Which Codex Surfaces Work
+
+Codex keeps MCP servers in one file, `~/.codex/config.toml`. You can set it up from either the **Codex / ChatGPT desktop app** or the **Codex CLI** — both write to that same file, so pick whichever you already use.
+
+| Surface | Set it up here | Notes |
+|---------|----------------|-------|
+| **[Codex / ChatGPT desktop app](https://learn.chatgpt.com/docs/app)** (macOS, Windows) | ✅ Yes | **Settings → MCP servers** |
+| **Codex CLI** (terminal) | ✅ Yes | `codex mcp` commands |
+| **Codex IDE extension** (VS Code) | Inherits | Works automatically once the app or CLI is configured |
+| **ChatGPT on the web** | ❌ No | Does not read local Codex configuration |
+
+<Note>
+**Codex and ChatGPT share one desktop app.** Since July 2026 the standalone Codex app and the ChatGPT desktop app are the same application: Codex is a dedicated coding surface inside it, alongside Chat and Work. If you already had the Codex app, updating turns it into the new ChatGPT desktop app and it still opens in Codex. Either way, this guide applies.
+
+Not to be confused with **ChatGPT Classic**, the name given to the previous-generation ChatGPT desktop app.
+</Note>
+
+<Note>
+**Configure once, use everywhere.** The Codex documentation states that the ChatGPT desktop app, Codex CLI, and IDE extension "share this configuration. Once you configure your MCP servers, you can switch among those clients without redoing setup." Set the server up in the app or the CLI and the IDE extension picks it up with no extra work.
+</Note>
+
+## Prerequisites
+
+- **The Codex / ChatGPT desktop app, or Codex CLI 0.46.0 or later.** Remote MCP servers over streamable HTTP were added to the CLI in 0.46.0 — check with `codex --version` and upgrade if needed.
+- **A Prowler Cloud account.** The free tier is enough to start. Sign up at [cloud.prowler.com](https://cloud.prowler.com).
+
+## Step 1: Get Your Prowler API Key
+
+Create an API key in Prowler Cloud and copy it. The key begins with `pk_` and is shown only once. Check the [API Keys](/user-guide/tutorials/prowler-app-api-keys#creating-api-keys) guide for details.
+
+## Step 2: Add the Prowler MCP Server
+
+The Prowler MCP Server needs two request headers: `Authorization` to authenticate you, and `User-Agent` because Codex does not send one by default.
+
+Each tab below is a complete setup — follow the one that matches the surface you use.
+
+<Tabs>
+  <Tab title="Codex / ChatGPT desktop app">
+    1. Open **Settings** and select **Plugins → MCPs**
+    2. Click **Add server**
+    3. Enter `prowler` as the name and choose type **Streamable HTTP**
+    4. Enter the URL `https://mcp.prowler.com/mcp`
+    5. Add two headers:
+
+       | Header | Value |
+       |--------|-------|
+       | `Authorization` | `Bearer pk_your_api_key_here` |
+       | `User-Agent` | `codex` |
+
+    6. Save the server
+
+    <Frame>
+      <img src="/images/prowler-mcp/codex/codex-app-mcp-servers.png" alt="Codex / ChatGPT desktop app Settings showing the MCP servers panel with the Add server dialog and both headers filled in" />
+    </Frame>
+
+    <Note>
+    **Enter the key directly here rather than using an environment variable.** Codex can read credentials from an environment variable, but desktop applications do not reliably inherit variables exported in a shell profile — on macOS an app launched from Finder or the Dock typically sees none of them. Pasting the key into the dialog is the approach that works consistently in the app.
+    </Note>
+
+    <Warning>
+    **This stores your API key in plain text** in `~/.codex/config.toml`. Treat that file accordingly: exclude it from dotfile repositories and config sync, and create the key from an account with the minimum permissions you need so its exposure is limited. Revoke and re-issue the key in Prowler Cloud if the file is ever shared.
+    </Warning>
+  </Tab>
+
+  <Tab title="Codex CLI">
+    Register the server:
+
+    ```bash
+    codex mcp add prowler --url https://mcp.prowler.com/mcp
+    ```
+
+    Codex confirms with `Added global MCP server 'prowler'.`
+
+    Then add both headers by hand, since `codex mcp add` has no flag for headers. Open `~/.codex/config.toml` and complete the entry:
+
+    ```toml
+    [mcp_servers.prowler]
+    url = "https://mcp.prowler.com/mcp"
+    http_headers = { Authorization = "Bearer pk_your_api_key_here", "User-Agent" = "codex" }
+    ```
+
+    <Note>
+    **Write the key literally rather than using an environment variable.** This is the form that works across every Codex surface. All of them read this same file, but only the CLI reliably sees variables exported in your shell profile — see the warning below.
+    </Note>
+
+    <Warning>
+    **This stores your API key in plain text** in `~/.codex/config.toml`. Treat that file accordingly: exclude it from dotfile repositories and config sync, and create the key from an account with the minimum permissions you need so its exposure is limited. Revoke and re-issue the key in Prowler Cloud if the file is ever shared.
+    </Warning>
+  </Tab>
+</Tabs>
+
+Restart Codex once you are done.
+
+<Note>
+**Local server:** Replace the URL with your own HTTP endpoint. Everything else stays the same.
+</Note>
+
+## Step 3: Verify the Connection
+
+Run `/mcp` in the app or in a CLI session to list connected servers and their tools.
+
+<Frame>
+  <img src="/images/prowler-mcp/codex/codex-mcp-slash-command.png" alt="Codex composer showing the /mcp command output with Prowler tools listed" />
+</Frame>
+
+From the CLI you can also inspect the stored entry directly:
+
+```bash
+codex mcp list          # one row per server, with status and auth
+codex mcp get prowler   # full entry, header values masked
+```
+
+<Warning>
+**Verify rather than assume.** Codex silently ignores unrecognized keys in `config.toml` — a misspelled key name produces no error at all, and the server simply never receives your credentials. Always confirm with `codex mcp get prowler` after editing the file by hand.
+</Warning>
+
+## Step 4: Start Using Prowler MCP
+
+Ask Codex questions that use the Prowler tools:
+
+- *"Show me all critical findings from my AWS accounts"*
+- *"What does the S3 bucket public access check do?"*
+- *"List my connected Prowler providers and their last scan date"*
+
+<Frame>
+  <img src="/images/prowler-mcp/codex/codex-prowler-query.png" alt="Codex answering a question about critical findings using Prowler MCP tools" />
+</Frame>
+
+## Troubleshooting
+
+### Startup Fails With HTTP 403 Forbidden
+
+Codex reports a handshake failure on startup, with an HTML error page rather than a JSON response:
+
+```
+⚠ MCP client for `prowler` failed to start: MCP startup failed: handshaking with MCP server
+  failed: ... unexpected server response: HTTP 403: <html>
+  <head><title>403 Forbidden</title></head>
+```
+
+The `User-Agent` header is missing. Codex's HTTP client does not send one, and requests without it are rejected before reaching the MCP server. Note this is a **403**, not a 401 — so it is not an API key problem. Add the header as shown in [Step 2](#step-2-add-the-prowler-mcp-server); the value itself does not matter, only that the header is present.
+
+### Authentication Fails With 401
+
+- Run `codex mcp get prowler` and confirm the entry has the headers you expect. Values are masked, but a missing header shows as `-`.
+- If you used a literal header, confirm the value starts with `Bearer ` and contains the full key.
+- **If it works in the CLI but fails in the desktop app or the VS Code extension, you are almost certainly using an environment variable.** Those surfaces do not inherit your shell profile. Switch that entry to a literal `Authorization` header as shown in [Step 2](#step-2-add-the-prowler-mcp-server).
+- If you use an environment variable, verify it is set in the environment Codex was launched from: `echo $PROWLER_API_KEY`.
+- With `env_http_headers` the variable must include the `Bearer ` prefix. With `bearer_token_env_var` it must **not** — Codex adds the prefix itself.
+- Confirm the key has not been revoked in Prowler Cloud.
+
+### Server Not Listed
+
+- Confirm your Codex CLI version is 0.46.0 or later with `codex --version`.
+- Run `codex mcp get prowler`. If it reports the server is not found, the entry was not written or the TOML table name is misspelled.
+- Check for a typo in the key names. Codex ignores unknown keys without warning.
+
+### Project-Scoped Config Is Ignored
+
+A `.codex/config.toml` inside a project is loaded **only when the project is trusted**. If your entry lives there and does nothing, trust the project or move the entry to `~/.codex/config.toml`.
+
+### Tools Do Not Appear After Editing the Config
+
+Restart Codex. Configuration is read at startup. In the app, quit completely and reopen it, sometimes just clous the window is not enough.
+
+## Next Steps
+
+<CardGroup cols={2}>
+  <Card title="Tools Reference" icon="wrench" href="/getting-started/basic-usage/prowler-mcp-tools">
+    Explore all available tools and capabilities
+  </Card>
+  <Card title="All MCP Clients" icon="plug" href="/getting-started/basic-usage/prowler-mcp">
+    Configuration reference for every supported client
+  </Card>
+</CardGroup>
+
+## Getting Help
+
+- Search for existing [GitHub issues](https://github.com/prowler-cloud/prowler/issues)
+- Ask for help in our [Slack community](https://goto.prowler.com/slack)
+- Report a new issue on [GitHub](https://github.com/prowler-cloud/prowler/issues/new)

docs/user-guide/ai-agents/cursor.mdx

@@ -0,0 +1,171 @@
+---
+title: "Connect Cursor to Prowler MCP Server"
+sidebarTitle: "Cursor"
+---
+
+Connect [Cursor](https://cursor.com/docs/mcp) to the Prowler Cloud MCP Server at `https://mcp.prowler.com/mcp` so the Cursor agent can query findings, inspect security checks, and manage your Prowler providers while you work.
+
+Cursor supports remote MCP servers over HTTP natively, so no bridge or local installation is required.
+
+## Prerequisites
+
+- **Cursor** installed and authenticated. See the [official install guide](https://cursor.com/download).
+- **A Prowler Cloud account.** The free tier is enough to start. Sign up at [cloud.prowler.com](https://cloud.prowler.com).
+
+## Step 1: Get Your Prowler API Key
+
+Create an API key in Prowler Cloud and copy it. The key begins with `pk_` and is shown only once. Check the [API Keys](/user-guide/tutorials/prowler-app-api-keys#creating-api-keys) guide for details.
+
+## Step 2: Add the Prowler MCP Server
+
+Cursor reads MCP servers from an `mcp.json` file. Choose the scope that fits your use case:
+
+| Scope | File | Applies to |
+|-------|------|------------|
+| **Global** | `~/.cursor/mcp.json` | Every project you open in Cursor |
+| **Project** | `.cursor/mcp.json` in the project root | That project only |
+
+Both files are merged. If the same server name appears in both, the project-level entry takes priority.
+
+For Prowler, the **global** scope is usually the right choice — your findings are not tied to a single repository, and it keeps the API key out of any project directory that might be committed.
+
+<Steps>
+  <Step title="Open the MCP settings">
+    From Agent Window open **Customize** in the Cursor sidebar, then select the MCP section.
+
+    On earlier versions, press `Cmd + Shift + J` (macOS) or `Ctrl + Shift + J` (Windows/Linux) to open Cursor Settings, then click **Tools & MCP** in the sidebar.
+
+
+  </Step>
+
+  <Step title="Add a new MCP server">
+    Click **New MCP Server** (or **Add Custom MCP**). Cursor opens `mcp.json` in the editor.
+
+    <Frame>
+      <img src="/images/prowler-mcp/cursor/cursor-customize-page.png" alt="Cursor Customize page with the MCP section open" />
+    </Frame>
+  </Step>
+
+  <Step title="Add the Prowler configuration">
+    Paste the following, replacing the placeholder with your API key:
+
+    ```json
+    {
+      "mcpServers": {
+        "prowler": {
+          "url": "https://mcp.prowler.com/mcp",
+          "headers": {
+            "Authorization": "Bearer <your-api-key-here>"
+          }
+        }
+      }
+    }
+    ```
+
+    Save the file. Cursor picks up the change and connects to the server.
+
+    <Frame>
+      <img src="/images/prowler-mcp/cursor/cursor-mcp-json.png" alt="Cursor editor showing the completed mcp.json with the Prowler server entry" />
+    </Frame>
+  </Step>
+</Steps>
+
+<Note>
+**Local server:** Replace the URL with your own HTTP endpoint. Everything else stays the same.
+</Note>
+
+### Keeping the API Key Out of the File
+
+Cursor resolves variables in the `command`, `args`, `env`, `url`, and `headers` fields, so you can reference an environment variable instead of writing the key into `mcp.json`:
+
+```json
+{
+  "mcpServers": {
+    "prowler": {
+      "url": "https://mcp.prowler.com/mcp",
+      "headers": {
+        "Authorization": "Bearer ${env:PROWLER_API_KEY}"
+      }
+    }
+  }
+}
+```
+
+Export the variable in your shell profile (`~/.zshrc`, `~/.bashrc`, or equivalent):
+
+```bash
+export PROWLER_API_KEY="pk_your_api_key_here"
+```
+
+<Note>
+The syntax is `${env:NAME}`, not a bare `${NAME}`. Restart Cursor after changing your shell profile so it inherits the new value.
+</Note>
+
+<Warning>
+The `envFile` option does **not** work for remote servers — it is STDIO-only. Use `${env:...}` interpolation with variables set in your shell profile instead.
+</Warning>
+
+This form is strongly recommended when using a **project-scoped** `.cursor/mcp.json`, since that file may be committed to version control.
+
+## Step 3: Verify the Connection
+
+Return to the MCP settings. The `prowler` server should be listed as enabled, with the Prowler tools shown beneath it.
+
+<Frame>
+  <img src="/images/prowler-mcp/cursor/cursor-prowler-connected.png" alt="Cursor MCP settings showing the Prowler server connected with its tools listed" />
+</Frame>
+
+## Step 4: Start Using Prowler MCP
+
+Open the chat panel and ask questions that use the Prowler tools:
+
+- *"Show me all critical findings from my AWS accounts"*
+- *"What does the S3 bucket public access check do?"*
+- *"Which of my providers failed the most CIS checks in the last scan?"*
+
+Cursor asks for approval before running an MCP tool the first time.
+
+<Frame>
+  <img src="/images/prowler-mcp/cursor/cursor-prowler-query.png" alt="Cursor chat answering a question about critical findings using Prowler MCP tools" />
+</Frame>
+
+You can toggle individual tools on or off from the tools list at the top of the chat panel, which is useful for keeping the active tool count down.
+
+## Troubleshooting
+
+### Server Does Not Connect
+
+- Check that `mcp.json` is valid JSON. A trailing comma or missing brace prevents the whole file from loading.
+- Open **MCP Logs** in the Output panel for the specific error.
+- Confirm the URL is exactly `https://mcp.prowler.com/mcp`.
+
+### Authentication Fails With 401
+
+- Verify the header value includes the `Bearer ` prefix: `"Bearer pk_..."`, not just the key.
+- Confirm the key has not been revoked in Prowler Cloud.
+- If using `${env:PROWLER_API_KEY}`, check the variable is set in the environment Cursor inherits. Restart Cursor after editing your shell profile — a value exported only in an already-open terminal will not reach the app.
+
+### The Entire `mcp.json` Is Ignored
+
+Remove any `"type": "streamable-http"` field. One such entry causes the Cursor CLI to drop every server in the file silently.
+
+### Some Prowler Tools Are Missing
+
+Cursor limits how many tools it exposes to the agent at once. With several MCP servers enabled you may exceed it, and some tools become unavailable. Disable servers you are not using, or turn off individual tools from the chat panel's tools list.
+
+## Next Steps
+
+<CardGroup cols={2}>
+  <Card title="Tools Reference" icon="wrench" href="/getting-started/basic-usage/prowler-mcp-tools">
+    Explore all available tools and capabilities
+  </Card>
+  <Card title="All MCP Clients" icon="plug" href="/getting-started/basic-usage/prowler-mcp">
+    Configuration reference for every supported client
+  </Card>
+</CardGroup>
+
+## Getting Help
+
+- Search for existing [GitHub issues](https://github.com/prowler-cloud/prowler/issues)
+- Ask for help in our [Slack community](https://goto.prowler.com/slack)
+- Report a new issue on [GitHub](https://github.com/prowler-cloud/prowler/issues/new)

docs/user-guide/ai-agents/index.mdx

@@ -0,0 +1,49 @@
+---
+title: "Connect Your AI Agent to Prowler"
+sidebarTitle: "Overview"
+description: "Pick your AI agent and follow its guide to connect it to the Prowler Cloud MCP Server."
+---
+
+Connect your AI agent to the Prowler Cloud MCP Server at `https://mcp.prowler.com/mcp` so it can query findings, inspect security checks, and manage your Prowler providers.
+
+Pick your agent below. Each guide is a full walkthrough with screenshots, verification steps, and the caveats specific to that client.
+
+<CardGroup cols={2}>
+  <Card title="Claude Code" icon="terminal" href="/user-guide/ai-agents/claude-code">
+    Plugin and MCP-only choices, and which Claude surfaces work
+  </Card>
+  <Card title="Claude Desktop App (Chat)" icon="comment" href="/user-guide/ai-agents/claude-desktop">
+    The Chat tab, via a local bridge
+  </Card>
+  <Card title="Codex / ChatGPT Desktop App" icon="code" href="/user-guide/ai-agents/codex">
+    ChatGPT Desktop App, Codex CLI, the VS Code extension through same config file
+  </Card>
+  <Card title="Cursor" icon="arrow-pointer" href="/user-guide/ai-agents/cursor">
+    Agentic code editor. Global and project scopes
+  </Card>
+  <Card title="VS Code / Copilot" icon="microsoft" href="/user-guide/ai-agents/vscode">
+    Agent mode with secure key prompts
+  </Card>
+</CardGroup>
+
+## Before You Start
+
+All guides need the same two things:
+
+- A **Prowler Cloud account** with at least one cloud provider connected. [Sign up](https://cloud.prowler.com) if you do not have one.
+- A **Prowler API key**, created in Prowler Cloud. The key begins with `pk_` and is shown only once. See the [API Keys](/user-guide/tutorials/prowler-app-api-keys#creating-api-keys) guide.
+
+<Note>
+Using an agent that is not listed here? Any MCP-compatible client can connect. See the [generic configuration reference](/getting-started/basic-usage/prowler-mcp#cloud-mcp-server-configuration-recommended) for the raw connection details.
+</Note>
+
+## Next Steps
+
+<CardGroup cols={2}>
+  <Card title="What Is Prowler MCP" icon="cloud" href="/getting-started/products/prowler-mcp">
+    How the MCP Server fits into Prowler
+  </Card>
+  <Card title="Configuration Reference" icon="gear" href="/getting-started/basic-usage/prowler-mcp">
+    Cloud and local server options, all clients
+  </Card>
+</CardGroup>

docs/user-guide/ai-agents/vscode.mdx

@@ -0,0 +1,145 @@
+---
+title: "Connect VS Code and GitHub Copilot to Prowler MCP Server"
+sidebarTitle: "VS Code / Copilot"
+---
+
+Connect [Visual Studio Code](https://code.visualstudio.com/docs/agents/reference/mcp-configuration) and GitHub Copilot agent mode to the Prowler Cloud MCP Server at `https://mcp.prowler.com/mcp` so Copilot can query findings, inspect security checks, and manage your Prowler providers.
+
+## Prerequisites
+
+- **VS Code 1.102 or later.** MCP support became generally available in 1.102.
+- **GitHub Copilot** enabled, with access to agent mode.
+- **A Prowler Cloud account.** The free tier is enough to start. Sign up at [cloud.prowler.com](https://cloud.prowler.com).
+
+## Step 1: Get Your Prowler API Key
+
+Create an API key in Prowler Cloud and copy it. The key begins with `pk_` and is shown only once. Check the [API Keys](/user-guide/tutorials/prowler-app-api-keys#creating-api-keys) guide for details.
+
+## Step 2: Add the Prowler MCP Server
+
+VS Code stores MCP servers in an `mcp.json` file. Choose the scope that fits your use case:
+
+| Scope | How to open it | Applies to |
+|-------|----------------|------------|
+| **User** | Command palette → **MCP: Open User Configuration** | Every workspace |
+| **Workspace** | `.vscode/mcp.json` in the project root | That workspace only |
+
+For Prowler, the **user** scope is usually the right choice — your findings are not tied to a single repository, and it keeps the API key out of any project directory that might be committed.
+
+<Steps>
+  <Step title="Open the MCP configuration">
+    Open the command palette with `Cmd + Shift + P` (macOS) or `Ctrl + Shift + P` (Windows/Linux), then run **MCP: Open User Configuration**.
+
+    VS Code opens your user-level `mcp.json`. Use this command rather than navigating to the file by hand — the file lives inside your active profile folder, and the path differs per profile.
+
+    <Frame>
+      <img src="/images/prowler-mcp/vscode/vscode-command-palette.png" alt="VS Code command palette showing the MCP: Open User Configuration command" />
+    </Frame>
+  </Step>
+
+  <Step title="Add the Prowler configuration">
+    Paste the following. This version prompts you for the API key on first use and stores it securely, so the key is never written into the file:
+
+    ```json
+    {
+      "inputs": [
+        {
+          "type": "promptString",
+          "id": "prowler-api-key",
+          "description": "Prowler API Key",
+          "password": true
+        }
+      ],
+      "servers": {
+        "prowler": {
+          "type": "http",
+          "url": "https://mcp.prowler.com/mcp",
+          "headers": {
+            "Authorization": "Bearer ${input:prowler-api-key}"
+          }
+        }
+      }
+    }
+    ```
+
+    Save the file.
+
+    <Frame>
+      <img src="/images/prowler-mcp/vscode/vscode-mcp-json.png" alt="VS Code editor showing the completed mcp.json with the Prowler server entry" />
+    </Frame>
+  </Step>
+
+  <Step title="Enter your API key">
+    Start the server. VS Code prompts for the Prowler API key. Paste it and press Enter — VS Code stores it securely and does not ask again.
+  </Step>
+
+</Steps>
+
+<Warning>
+**The root key is `servers`, not `mcpServers`.** VS Code uses a different schema from Cursor, Claude, and most other clients. Copying a `mcpServers` snippet from elsewhere silently fails to register the server.
+</Warning>
+
+<Note>
+**Local server:** Replace the URL with your own HTTP endpoint. Everything else stays the same.
+</Note>
+
+## Step 3: Verify the Connection
+
+Run **MCP: List Servers** from the command palette. The `prowler` server should appear as running.
+
+<Frame>
+  <img src="/images/prowler-mcp/vscode/vscode-list-servers.png" alt="VS Code MCP: List Servers output showing the Prowler server running" />
+</Frame>
+
+Select the server to start, stop, or restart it, and to view its output log if the connection fails.
+
+## Step 4: Start Using Prowler MCP
+
+Open the Chat view and switch the mode selector to **Agent**. Click the tools icon to confirm the Prowler tools are available, then ask:
+
+- *"Show me all critical findings from my AWS accounts"*
+- *"What does the S3 bucket public access check do?"*
+- *"Summarize my CIS compliance status by provider"*
+
+<Frame>
+  <img src="/images/prowler-mcp/vscode/vscode-agent-tools.png" alt="VS Code Copilot Chat in agent mode showing the Prowler tools in the tools picker" />
+</Frame>
+
+Copilot asks for confirmation before running an MCP tool for the first time.
+
+## Troubleshooting
+
+### Server Does Not Appear
+
+- Confirm the root key is `servers`, not `mcpServers`.
+- Confirm each server entry has `"type": "http"`.
+- Check that `mcp.json` is valid JSON.
+- Verify your VS Code version is 1.102 or later.
+
+### Authentication Fails With 401
+
+- Verify the header value includes the `Bearer ` prefix.
+- Confirm the key has not been revoked in Prowler Cloud.
+- If you mistyped the key at the prompt, run **MCP: List Servers**, select `prowler`, and restart it to be prompted again.
+
+### Tools Do Not Appear in Chat
+
+- Make sure the Chat view is in **Agent** mode. MCP tools are not available in Ask mode.
+- Open the tools picker and confirm the Prowler tools are enabled.
+
+## Next Steps
+
+<CardGroup cols={2}>
+  <Card title="Tools Reference" icon="wrench" href="/getting-started/basic-usage/prowler-mcp-tools">
+    Explore all available tools and capabilities
+  </Card>
+  <Card title="All MCP Clients" icon="plug" href="/getting-started/basic-usage/prowler-mcp">
+    Configuration reference for every supported client
+  </Card>
+</CardGroup>
+
+## Getting Help
+
+- Search for existing [GitHub issues](https://github.com/prowler-cloud/prowler/issues)
+- Ask for help in our [Slack community](https://goto.prowler.com/slack)
+- Report a new issue on [GitHub](https://github.com/prowler-cloud/prowler/issues/new)

docs/user-guide/cli/tutorials/parallel-execution.mdx

@@ -184,7 +184,7 @@ $combinedCsv | Export-Csv -Path "CombinedCSV.csv" -NoTypeInformation
 
 ## TODO: Additional Improvements
 
-Some services need to instantiate another service to perform a check. For instance, `cloudwatch` will instantiate Prowler's `iam` service to perform the `cloudwatch_cross_account_sharing_disabled` check. When the `iam` service is instantiated, it will perform the `__init__` function, and pull all the information required for that service. This provides an opportunity for an improvement in the above script to group related services together so that the `iam` services (or any other cross-service references) isn't repeatedily instantiated by grouping dependant services together. A complete mapping between these services still needs to be further investigated, but these are the cross-references that have been noted:
+Some services need to instantiate another service to perform a check. For instance, `cloudwatch` will instantiate Prowler's `iam` service to perform the `cloudwatch_cross_account_sharing_disabled` check. When the `iam` service is instantiated, it will perform the `__init__` function, and pull all the information required for that service. This provides an opportunity for an improvement in the above script to group related services together so that the `iam` services (or any other cross-service references) aren't repeatedly instantiated by grouping dependent services together. A complete mapping between these services still needs to be further investigated, but these are the cross-references that have been noted:
 
 * inspector2 needs lambda and ec2
 * cloudwatch needs iam

docs/user-guide/cli/tutorials/reporting.mdx

@@ -114,7 +114,7 @@ The CSV format follows a standardized structure across all providers. The follow
 
 #### CSV Headers Mapping
 
-The following table shows the mapping between the CSV headers and the the providers fields:
+The following table shows the mapping between the CSV headers and the providers fields:
 
 | Open Source Consolidated| AWS| GCP| AZURE| KUBERNETES
 |----------|----------|----------|----------|----------

docs/user-guide/providers/oci/authentication.mdx

@@ -434,7 +434,7 @@ prowler oci --oci-config-file /path/to/config
 
 **Cause**: Insufficient IAM permissions
 
-**Solution**: Add required policies (see [Required Permissions](./getting-started-oci.md#required-permissions))
+**Solution**: Add required policies (see [Required Permissions](/user-guide/providers/oci/getting-started-oci#required-permissions))
 
 ### Configuration Validation
 

docs/user-guide/providers/oci/getting-started-oci.mdx

@@ -58,7 +58,7 @@ Before you begin, ensure you have:
 
 ### Authentication
 
-Prowler supports multiple authentication methods for OCI. For detailed authentication setup, see the [OCI Authentication Guide](./authentication).
+Prowler supports multiple authentication methods for OCI. For detailed authentication setup, see the [OCI Authentication Guide](/user-guide/providers/oci/authentication).
 
 **Note:** OCI Session Authentication and Config File Authentication both use the same `~/.oci/config` file. The difference is how the config file is generated - automatically via browser (session auth) or manually with API keys.
 
@@ -107,7 +107,7 @@ The easiest and most secure method is using OCI session authentication, which au
 
 #### Alternative: Manual API Key Setup
 
-If you prefer to manually generate API keys instead of using browser-based session authentication, see the detailed instructions in the [Authentication Guide](./authentication#config-file-authentication-manual-api-key-setup).
+If you prefer to manually generate API keys instead of using browser-based session authentication, see the detailed instructions in the [Authentication Guide](/user-guide/providers/oci/authentication#config-file-authentication-manual-api-key-setup).
 
 **Note:** Both methods use the same `~/.oci/config` file - the difference is that manual setup uses static API keys while session authentication uses temporary session tokens.
 

docs/user-guide/tutorials/prowler-app-jira-integration.mdx

@@ -24,6 +24,12 @@ When enabled and configured:
 1. Security findings can be manually sent to Jira from the Findings table.
 2. Each finding creates a Jira work item with all the check's metadata, including guidance on how to remediate it.
 
+## Prerequisites
+
+<VersionBadge version="5.36.0" />
+
+Configuring and using the Jira integration requires the **Manage Integrations** permission. The Jira integration is tenant-wide, so it does not require **Unlimited Visibility** or any specific Provider Group. Findings sent to Jira are still limited to the providers the role can access.
+
 ## Configuration
 
 To configure Jira integration in Prowler Cloud:

docs/user-guide/tutorials/prowler-app-rbac.mdx

@@ -128,7 +128,7 @@ To resend the invitation to the user, it is necessary to explicitly **delete the
 
 ## Managing Groups and Roles
 
-Roles combine administrative permissions with provider visibility. Administrative permissions control the actions a role can perform. Provider Groups and Unlimited Visibility control the providers, resources, findings, scans, and compliance results the role can access.
+Roles combine administrative permissions with provider visibility. Administrative permissions control the actions a role can perform. Provider Groups and Unlimited Visibility control the providers, resources, findings, scans, compliance results, and integrations the role can access.
 
 <Note>
 **Only users that have the _Manage Account_ or _admin_ permission can access this section.**
@@ -142,6 +142,12 @@ New roles have no provider visibility by default. Assign at least one Provider G
 
 **Unlimited Visibility** grants organization-wide visibility across every provider, regardless of the Provider Groups assigned to the role. It does not grant administrative permissions.
 
+#### Integration Visibility
+
+<VersionBadge version="5.36.0" />
+
+Integrations follow the visibility of the providers attached to them: a role can see an integration when it can access at least one of its providers, and only the providers visible to that role are listed on the integration. Editing or deleting an integration attached to providers outside the visibility of the role is not allowed. Integrations that are not attached to any provider, such as Jira, are tenant-wide and remain available to every role with the **Manage Integrations** permission.
+
 #### Creating a Provider Group
 
 Follow these steps to create a provider group in your account:

docs/user-guide/tutorials/prowler-for-msps-billing.mdx

@@ -0,0 +1,62 @@
+---
+title: "Billing and Customer Plans in Prowler for MSPs and MSSPs"
+sidebarTitle: "Billing and Plans"
+---
+
+Each customer carries its own billing plan, set when the customer is created and changed later from the **Customers** page. This page covers both, and where the resulting revenue is reported.
+
+## Permissions
+
+Managing customer plans requires a role with **Manage billing**, held today by both **Superadmin** and **Organization Admin**. See [Managing Your Team](/user-guide/tutorials/prowler-for-msps-team).
+
+## Customer Plans
+
+Plans are chosen in the **Set Their Billing Plan** step of the Add Customer wizard. A customer starts on a trial or on one of the paid plans, billed monthly or annually.
+
+Each plan card in the wizard shows its own price, included usage and overage rate. For current pricing, see [prowler.com/pricing](https://prowler.com/pricing).
+
+### Provider Accounts on the Annual Plan
+
+The annual plan is paid upfront for a fixed number of cloud provider accounts, between **1 and 20**. You set that count when you pick the plan. The monthly plan does not require an upfront provider account count.
+
+## Change a Customer's Plan
+
+Open the actions menu on a customer's row and choose **Change plan**.
+
+<Warning>
+**Plan changes are one way: trial to paid.** The action is only offered while a customer is on trial or its trial has expired. Once a customer holds a paid subscription, **Change plan** no longer appears on the row, and the trial is never a valid target.
+</Warning>
+
+The **Change Plan** dialog opens on **Choose your plan**, with the same **Monthly** and **Annual** toggle used when the customer was created.
+
+![Change Plan dialog](/images/prowler-for-msps/change-plan-dialog.png)
+
+Select a plan and confirm with **Change Plan**. Choosing the annual plan also asks for the upfront provider account count. The change is submitted to Prowler Cloud and applied asynchronously; the customer's row updates once it lands. If it fails, a message explains why:
+
+| Message | Cause |
+|---|---|
+| Cloud accounts count is required | The annual plan was selected without a provider account count. |
+| Cloud accounts count out of range | The count is outside 1–20. |
+| Company name is required | The customer record has no usable company name. |
+| Customer not found | The customer no longer exists or is not linked to a tenant. |
+
+## Revenue Reporting
+
+Billing figures surface in two places.
+
+**On the Customers page**, stat cards above the table summarize **Billing active** — how many customers hold an active subscription — and **Total MTD** per currency, with a percentage change against last month. The cards appear once a customer has billing activity.
+
+![Billing stat cards above the customers table](/images/prowler-for-msps/customers-table.png)
+
+**On the Dashboard**, the **Billing Overview** card reports monthly expenses against the previous month and splits revenue for the period into annual, monthly and overage, giving the same picture across every customer.
+
+## Next Steps
+
+<Columns cols={2}>
+  <Card title="Onboarding Customers" icon="building" href="/user-guide/tutorials/prowler-for-msps-customers">
+    Add customers and open their Prowler Cloud tenants.
+  </Card>
+  <Card title="Your Partner Organization" icon="briefcase" href="/user-guide/tutorials/prowler-for-msps-organization">
+    Lifecycle, settings, Partner Code and closing your organization.
+  </Card>
+</Columns>

docs/user-guide/tutorials/prowler-for-msps-branding.mdx

@@ -0,0 +1,66 @@
+---
+title: "Customizing Your Branding in Prowler for MSPs and MSSPs"
+sidebarTitle: "Branding"
+---
+
+Upload your company logo to have it displayed alongside Prowler branding in the console. Branding is managed from **Settings → Branding** and requires a role with **Manage settings**.
+
+## Upload a Logo
+
+Open **Settings → Branding**, click **Upload Logo**, and pick your file. The logo replaces the placeholder immediately and a confirmation appears.
+
+![Settings Branding tab](/images/prowler-for-msps/settings-branding.png)
+
+### Logo Requirements
+
+| Requirement | Value |
+|---|---|
+| **Formats** | PNG or SVG |
+| **Maximum file size** | 512 KB |
+| **Dimensions** | 200 × 60 pixels — a hard limit for PNG, not checked for SVG |
+
+<Warning>
+Two limits on this screen are looser than what the server accepts:
+
+* The upload dialog accepts files up to 1 MB, but anything above **512 KB** is rejected.
+* The page describes 200 × 60 pixels as a recommended size. For PNG it is a **maximum**: a larger PNG is rejected with *"PNG dimensions must not exceed 200×60 px."* SVG is exempt from the dimension check.
+
+Keep PNG logos within both limits to avoid an upload that appears to start and then fails.
+</Warning>
+
+A wide, horizontal logo with a transparent background renders best. SVG stays crisp at every size, is not subject to the dimension limit, and is the better choice where you have it.
+
+<Note>
+Uploaded SVG files are sanitized on the server. Scripts, external references and other active content are stripped before the file is stored.
+</Note>
+
+## Replace or Remove a Logo
+
+Uploading a new file replaces the current one. **Remove Logo** deletes it and returns the console to the default Prowler branding. Both take effect immediately for everyone on your team.
+
+## Logo Placement Preview
+
+Below the upload controls, **Logo Placement Preview** renders your logo underneath the Prowler wordmark, showing how the two are intended to sit together in a Prowler Cloud organization. With no logo uploaded, the slot shows a *Your Logo* placeholder.
+
+<Note>
+The preview is rendered locally in the console. Uploading a logo does not currently push it to Prowler Cloud.
+</Note>
+
+## Where Your Logo Appears
+
+Your logo is shown alongside Prowler branding within the console for your team.
+
+<Warning>
+**Branding does not extend to Prowler Cloud.** Customers signing in at [cloud.prowler.com](https://cloud.prowler.com) see the standard Prowler interface. White-labeling Prowler Cloud is not supported.
+</Warning>
+
+## Next Steps
+
+<Columns cols={2}>
+  <Card title="Your Partner Organization" icon="briefcase" href="/user-guide/tutorials/prowler-for-msps-organization">
+    Lifecycle, settings, Partner Code and closing your organization.
+  </Card>
+  <Card title="Managing Your Team" icon="users" href="/user-guide/tutorials/prowler-for-msps-team">
+    Invite team members and assign roles.
+  </Card>
+</Columns>

docs/user-guide/tutorials/prowler-for-msps-customers.mdx

@@ -0,0 +1,104 @@
+---
+title: "Onboarding Customers and Accessing Their Tenants"
+sidebarTitle: "Onboarding Customers"
+---
+
+Adding a customer in Prowler for MSPs and MSSPs provisions a Prowler Cloud tenant for that organization and links it to yours. From then on you can open that tenant from the console and work inside it on the customer's behalf.
+
+## Add a Customer
+
+Select **Customers** in the sidebar, then click **Add Customer** to open a three-step wizard.
+
+<Note>
+Adding a customer is restricted to the Superadmin role. Organization Admins manage existing customers but do not see the **Add Customer** button.
+</Note>
+
+<Steps>
+  <Step title="Create A Customer Profile">
+    Enter the **Customer Business Name** and confirm the **Region**. The name must be unique within your partner organization; a duplicate is rejected inline. Click **Next**.
+
+    ![Adding A New Customer, step one](/images/prowler-for-msps/add-customer-profile.png)
+  </Step>
+
+  <Step title="Set Their Billing Plan">
+    Under **Choose your plan**, switch between **Monthly** and **Annual** and pick the plan the customer starts on. Click **Create Customer**. See [Billing and Customer Plans](/user-guide/tutorials/prowler-for-msps-billing) for what the annual plan asks for.
+
+    ![Adding A New Customer, choosing a plan](/images/prowler-for-msps/add-customer-billing.png)
+  </Step>
+
+  <Step title="Launch Their Customer Workspace">
+    A banner confirms the outcome — created on trial, or subscribed to a paid plan — and the tenant is created and linked to your organization. Click **Go To Organization** to head straight there and start connecting cloud providers, or **Close** to return to the customer list.
+
+    ![Adding A New Customer, confirmation](/images/prowler-for-msps/add-customer-launch.png)
+  </Step>
+</Steps>
+
+Provisioning is asynchronous. The customer's row shows **Provisioning** until the tenant is ready, then switches to **Active**.
+
+## The Customers View
+
+**My Customers** lists every customer you can reach.
+
+![My Customers page](/images/prowler-for-msps/customers-table.png)
+
+Each row carries:
+
+| Column | What it shows |
+|---|---|
+| **Customer Business Name** | The customer's name |
+| **Providers** | Icons for each cloud provider connected in their tenant |
+| **Cloud Accounts** | Number of provider accounts under scan |
+| **Resources** | Resources discovered by the latest scan |
+| **Failed Findings** | Failed findings from the latest scan |
+| **Billing Type** | The customer's current plan, shown as **Trial**, **Pro Monthly** or **Pro Annual** |
+| **MTD** | Month-to-date spend |
+| **Last Month Expenses** | Previous month's total |
+| **Status** | **Active**, **Provisioning** or **Inactive** |
+| **Last scan completed** | When the most recent scan finished |
+
+A customer shows as **Provisioning** while its tenant is being created, and **Inactive** once it has been marked for removal.
+
+Above the table, search by name and filter by provider or status. The download button at the top right of the table exports the list.
+
+## Open a Customer's Prowler Cloud Tenant
+
+Open the actions menu at the end of a customer's row and choose **Access Organization**. You are redirected into that customer's tenant in Prowler Cloud, signed in as yourself acting on their behalf.
+
+While you are in the tenant you see what a customer administrator sees, and every action is recorded in the Prowler Cloud audit log against both your identity and the customer you are acting for.
+
+Opening a tenant requires a role with **Access tenants**. The action fails with a clear message if you lack permission, if the customer no longer exists, or if the tenant is not ready.
+
+![Customer row actions menu](/images/prowler-for-msps/customer-row-actions.png)
+
+**Change plan** only appears while the customer is on trial or its trial has expired. See [Billing and Customer Plans](/user-guide/tutorials/prowler-for-msps-billing).
+
+## Edit a Customer
+
+Choose **Edit** from the row actions to open the **Edit customer** panel and rename the customer. The new name must still be unique within the partner organization.
+
+## Link an Existing Customer with Your Partner Code
+
+Each approved partner organization carries a **Partner Code**, shown on **Settings → Profile** with the helper text *"Share this code with customers to link their accounts."* A customer who already runs Prowler Cloud can use that code to request a link to you, rather than having you provision a fresh tenant.
+
+<Note>
+The customer-side flow that consumes the Partner Code is rolling out progressively in Prowler Cloud. Confirm availability with your Prowler contact before sharing the code.
+</Note>
+
+## Customer Self-Access
+
+Your customers keep signing in to [cloud.prowler.com](https://cloud.prowler.com) with their own users. Your access is additive — it neither replaces nor restricts theirs.
+
+## Remove a Customer
+
+Removing a customer detaches it from your partner organization and moves it to **Inactive**. It does not delete the customer's data in Prowler Cloud; contact Prowler to arrange the offboarding of the tenant itself.
+
+## Next Steps
+
+<Columns cols={2}>
+  <Card title="Billing and Customer Plans" icon="credit-card" href="/user-guide/tutorials/prowler-for-msps-billing">
+    Customer plans and revenue reporting.
+  </Card>
+  <Card title="Managing Your Team" icon="users" href="/user-guide/tutorials/prowler-for-msps-team">
+    Invite team members and assign roles.
+  </Card>
+</Columns>

docs/user-guide/tutorials/prowler-for-msps-organization.mdx

@@ -0,0 +1,90 @@
+---
+title: "Managing Your Partner Organization"
+sidebarTitle: "Your Partner Organization"
+---
+
+Your partner organization is the top-level container in Prowler for MSPs and MSSPs. It holds your team, your branding, your Partner Code and every customer whose Prowler Cloud tenant you operate.
+
+## Lifecycle
+
+A partner organization moves through four states:
+
+| State | Meaning |
+|---|---|
+| **Pending email verification** | The first administrator has signed up but has not yet clicked the verification link. |
+| **Pending approval** | Email verified. Prowler is reviewing the application. |
+| **Active** | Approved. The organization can sign in, invite team members and onboard customers. |
+| **Rejected** | Prowler reviewed and declined the application. The account cannot sign in. |
+
+A rejection email carries the reason, categorized as **Incomplete documentation**, **Not eligible**, **Duplicate** or **Other**.
+
+## Settings
+
+Open **Settings** from the sidebar. The page has three tabs — **Profile**, **Branding** and **Security** — though what you can do in them depends on your role.
+
+Every signed-in user can view the settings and change their own password. Editing the organization itself requires a role with **Manage settings**; without it, only the **Security** tab is available.
+
+### Profile
+
+The **Profile** tab shows the **Partner Information** card: your organization name, its current status, the date it joined, the Partner Code and an editable **Company Name**.
+
+![Settings Profile tab](/images/prowler-for-msps/settings-profile.png)
+
+* **Partner Code** — a read-only, Prowler-issued identifier in the form `PRW-00000`. The helper text reads *"Share this code with customers to link their accounts."* Copy it with the button at the end of the row.
+* **Company Name** — the display name used in the console, in invitations and in outbound email. Edit it and click **Save Changes**.
+
+### Branding
+
+Upload your logo. See [Customizing Your Branding](/user-guide/tutorials/prowler-for-msps-branding).
+
+### Security
+
+Change your own password. Roles with **Manage settings** — Superadmin today — also reach the Danger zone described below. An Organization Admin sees the password form only.
+
+## Customer Capacity
+
+Each partner organization has a cap on how many customers it can hold at once. The default is **50**. To raise it, contact Prowler.
+
+## Closing Your Organization
+
+Deleting a partner organization is a request, not an immediate action.
+
+<Steps>
+  <Step title="Open the Danger zone">
+    Go to **Settings → Security**. The Danger zone and its **Delete Partner** action require a role with **Manage settings**.
+  </Step>
+
+  <Step title="File the request">
+    Optionally give a reason in **Reason for deletion**, then type `DELETE` in the confirmation field to enable the button and submit.
+  </Step>
+
+  <Step title="Wait for review">
+    Filing the request notifies the Prowler team and sends a confirmation to the requester. The Danger zone then reports that a deletion request is already pending review. You and your team keep full access while it is pending.
+  </Step>
+
+  <Step title="Offboard with Prowler">
+    The Prowler team coordinates the offboarding from there, including what happens to each customer tenant and when your organization is closed. Closing removes the partner organization, its team memberships and its branding assets, and invalidates every session.
+  </Step>
+</Steps>
+
+<Note>
+Closing a partner organization does not delete customer data in Prowler Cloud on its own. The Prowler team confirms the handling of each customer tenant as part of the offboarding.
+</Note>
+
+## Ownership
+
+One user is the **owner** of the partner organization — by default, whoever signed up. Ownership can be transferred to another team member, who keeps the Superadmin role. The owner cannot be removed from the team while they hold ownership.
+
+## Next Steps
+
+<Columns cols={2}>
+  <Card title="Managing Your Team" icon="users" href="/user-guide/tutorials/prowler-for-msps-team">
+    Invite team members and assign roles.
+  </Card>
+  <Card title="Customizing Your Branding" icon="palette" href="/user-guide/tutorials/prowler-for-msps-branding">
+    Upload your logo.
+  </Card>
+  <Card title="Onboarding Customers" icon="building" href="/user-guide/tutorials/prowler-for-msps-customers">
+    Add customers and open their Prowler Cloud tenants.
+  </Card>
+</Columns>

docs/user-guide/tutorials/prowler-for-msps-sign-up.mdx

@@ -0,0 +1,88 @@
+---
+title: "Sign Up and Sign In to Prowler for MSPs and MSSPs"
+sidebarTitle: "Sign Up and Sign In"
+---
+
+Sign-up for Prowler for MSPs and MSSPs is self-service, but activation requires approval from the Prowler team. The first administrator registers the partner organization; every other team member joins by invitation.
+
+## Sign Up
+
+<Steps>
+  <Step title="Open the sign-up page">
+    Go to [partners.prowler.com/sign-up](https://partners.prowler.com/sign-up), fill in **Full name**, **Company name**, **Email**, **Password** and **Confirm password**, then click **Create account**.
+
+    ![Create your account form](/images/prowler-for-msps/sign-up-form.png)
+  </Step>
+
+  <Step title="Verify your email">
+    Prowler sends a verification email containing a one-time link valid for **24 hours**. Click it to confirm the address; your partner organization then moves to **Pending approval**.
+
+    If the link expires, request a new one at [partners.prowler.com/resend-verification](https://partners.prowler.com/resend-verification). Issuing a fresh link invalidates any earlier unused link for the same account.
+  </Step>
+
+  <Step title="Wait for approval">
+    Prowler reviews every new application. You receive an email when the organization is approved — its status becomes **Active** — or when it is rejected, along with the reason.
+  </Step>
+
+  <Step title="Sign in">
+    Once approved, sign in at [partners.prowler.com](https://partners.prowler.com) with the email and password you chose. You land on the Dashboard.
+  </Step>
+</Steps>
+
+## Password Requirements
+
+Every password in the console — at sign-up, when accepting an invitation, and on reset — must satisfy all of the following:
+
+| Requirement | Rule |
+|---|---|
+| **Length** | At least 12 characters |
+| **Uppercase** | At least 1 uppercase letter |
+| **Lowercase** | At least 1 lowercase letter |
+| **Number** | At least 1 digit |
+| **Special character** | At least 1 special character |
+| **Not common** | Rejected if it appears on the common-password list |
+| **Not similar to your details** | Rejected if too close to your name or email |
+
+## Sign In
+
+Sign in at [partners.prowler.com](https://partners.prowler.com) with your email and password, then click **Login**. Select **Remember me** to keep the session alive longer between visits.
+
+![Sign In screen](/images/prowler-for-msps/sign-in-form.png)
+
+Sign-in fails while the partner organization is not yet active:
+
+| Message | What it means |
+|---|---|
+| Invalid email or password | The credentials do not match an account. |
+| Please verify your email before signing in | Email verification is still outstanding. Open the verification email or request a fresh link. |
+| Your partner application is still under review | Prowler has not approved the application yet. |
+| Your partner application was not approved | The application was rejected. The account cannot sign in. |
+
+## Reset a Forgotten Password
+
+Click **Forgot Password?** on the sign-in screen and enter your email. Prowler sends a reset link valid for **15 minutes**. The reset page asks for a new password and a confirmation; on success you return to sign-in.
+
+<Note>
+The confirmation banner appears whether or not the email matches an account, so the screen never reveals which addresses are registered. Requesting a new link invalidates any earlier unused one.
+</Note>
+
+## Sessions
+
+Access tokens are short-lived — **30 minutes** by default — and refresh automatically while you are active. The refresh window is **24 hours**, extended to **7 days** when you select **Remember me**. Refresh tokens rotate on every refresh and the previous one is revoked.
+
+If a refresh fails — after long inactivity, a revoked token, or a server restart — you return to the sign-in screen with a `RefreshAccessTokenError` notice. Sign in again to continue.
+
+## Sign Out
+
+Open the user avatar in the top-right corner of any page and select **Sign out**. The session is cleared and you return to the sign-in form.
+
+## Next Steps
+
+<Columns cols={2}>
+  <Card title="Managing Your Team" icon="users" href="/user-guide/tutorials/prowler-for-msps-team">
+    Invite team members and assign roles.
+  </Card>
+  <Card title="Your Partner Organization" icon="briefcase" href="/user-guide/tutorials/prowler-for-msps-organization">
+    Lifecycle, settings, Partner Code and closing your organization.
+  </Card>
+</Columns>

docs/user-guide/tutorials/prowler-for-msps-team.mdx

@@ -0,0 +1,85 @@
+---
+title: "Managing Your Team in Prowler for MSPs and MSSPs"
+sidebarTitle: "Managing Your Team"
+---
+
+Each partner organization has its own team and its own role catalog. Administrators invite team members by email and assign each one a role that governs what they can do.
+
+## Roles
+
+Two roles ship with every partner organization:
+
+* **Superadmin** — full account management. Invites members, adds and manages customers, edits branding and settings, and opens customer tenants.
+* **Organization Admin** — manages customers and billing, and opens customer tenants. Cannot invite members, change organization settings, or add new customers.
+
+Each role is a set of permission flags:
+
+| Permission | What it allows | Superadmin | Organization Admin |
+|---|---|:---:|:---:|
+| **Manage members** | Invite, re-invite, disable, enable and remove team members | ✓ | |
+| **Manage settings** | Edit the organization profile and branding | ✓ | |
+| **Manage billing** | Manage customer plans | ✓ | ✓ |
+| **Manage organizations** | Remove customers and edit their details | ✓ | ✓ |
+| **Access tenants** | Open a customer's Prowler Cloud tenant | ✓ | ✓ |
+
+<Note>
+The Prowler Cloud-side permission level for a team member is provisioned automatically as **Manager** and is managed in Prowler Cloud, not here. There is no Cloud role to pick at invitation time.
+</Note>
+
+## Invite a Team Member
+
+<Steps>
+  <Step title="Open Team">
+    Select **Team** in the sidebar. The entry only appears for roles with **Manage members**.
+  </Step>
+
+  <Step title="Send the invitation">
+    Click **Invite User**, enter the **Email**, pick a **User Role**, then click **Send Invite**. Each role option in the selector carries a one-line description of what it grants.
+
+    ![Invite User dialog](/images/prowler-for-msps/invite-user-dialog.png)
+  </Step>
+
+  <Step title="Track the invitation">
+    The team table lists **Name**, **Email**, **Role**, **Status** and **User Event**. An invitation is **Pending**, **Accepted**, **Expired** or **Revoked**.
+  </Step>
+</Steps>
+
+The invitee receives an email with a one-time link, valid for **7 days**, that opens a public acceptance page. There they set their full name and a password, accept, and are sent to the sign-in screen.
+
+An email address can hold only one pending invitation at a time.
+
+## Re-Invite or Revoke
+
+For a **Pending** or **Expired** invitation, **Re-invite** sends a fresh link and resets the expiry. **Revoke** invalidates the invitation immediately — the recipient can no longer accept it.
+
+To re-issue an invitation that is still pending, use **Re-invite** rather than sending a second one.
+
+## Disable, Enable or Remove a Member
+
+Active members carry a **Disable** action. Disabling revokes access immediately but keeps the row in the table, flagged as disabled, so the audit trail survives.
+
+A disabled member can be:
+
+* **Enabled** — access is restored as it was.
+* **Re-invited** — a fresh invitation brings them back as a new active member. The invite dialog opens pre-filled with their address and its title changes to **Re-invite user**.
+
+<Warning>
+The organization owner cannot be removed from the team while they hold ownership. Transfer ownership first.
+</Warning>
+
+## Notes
+
+* The first administrator is created during sign-up and becomes the owner.
+* An email address can hold only one active membership in a given partner organization.
+* Permissions are scoped to one partner organization. A session for one organization carries no permissions in another.
+
+## Next Steps
+
+<Columns cols={2}>
+  <Card title="Onboarding Customers" icon="building" href="/user-guide/tutorials/prowler-for-msps-customers">
+    Add customers and open their Prowler Cloud tenants.
+  </Card>
+  <Card title="Billing and Customer Plans" icon="credit-card" href="/user-guide/tutorials/prowler-for-msps-billing">
+    Customer plans and revenue reporting.
+  </Card>
+</Columns>

prowler/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to the **Prowler SDK** are documented in this file.
 
 <!-- changelog: release notes start -->
 
+## [5.36.0] (Prowler v5.36.0)
+
+### 🚀 Added
+
+- `sagemaker_notebook_instance_no_secrets` check for AWS provider, scanning SageMaker notebook instance lifecycle configuration scripts (`OnCreate` and `OnStart`) for hardcoded secrets such as API keys, passwords, tokens, and connection strings [(#11843)](https://github.com/prowler-cloud/prowler/pull/11843)
+
+### 🔄 Changed
+
+- Jira output rendering supports grouped Finding Group issues with caller-provided links and capped or uncapped finding copy [(#12035)](https://github.com/prowler-cloud/prowler/pull/12035)
+
+### 🐞 Fixed
+
+- Fix invalid escape sequence `SyntaxWarning` raised on startup by the S3 bucket name validation regex [(#12041)](https://github.com/prowler-cloud/prowler/pull/12041)
+- Alibaba Cloud SSH and RDP security group checks no longer produce false negatives when allowed rules use capitalized `Policy="Accept"` values [(#12049)](https://github.com/prowler-cloud/prowler/pull/12049)
+
+---
+
 ## [5.35.0] (Prowler v5.35.0)
 
 ### 🚀 Added

prowler/changelog.d/alibabacloud-security-group-policy-case.fixed.md

@@ -1 +0,0 @@
-Alibaba Cloud SSH and RDP security group checks no longer produce false negatives when allowed rules use capitalized `Policy="Accept"` values

prowler/changelog.d/gcp-cloudfunction-gen2-iam-thread-safety.fixed.md

@@ -0,0 +1 @@
+GCP Cloud Functions gen2 IAM policy retrieval now uses a per-request HTTP client, preventing a process crash from concurrent thread-unsafe `httplib2` access when a project has several gen2 functions

prowler/changelog.d/gcp-firewall-multiport.fixed.md

@@ -0,0 +1 @@
+GCP firewall SSH and RDP checks now detect exposed target ports in any position within multi-port rules

prowler/changelog.d/html-report-xss.security.md

@@ -0,0 +1 @@
+HTML reports escape provider-originated finding fields to prevent stored cross-site scripting through malicious cloud resource tags

prowler/changelog.d/jira-adf-metadata.fixed.md

@@ -0,0 +1 @@
+Jira descriptions with inline code nested in bold or italic Markdown now render as valid ADF

prowler/changelog.d/kingfisher-lf-line-indexing.fixed.md

@@ -0,0 +1 @@
+Secret ignore patterns now use Kingfisher-compatible LF line indexing for scanned content containing ASCII control characters

prowler/config/config.py

@@ -49,7 +49,7 @@ class _MutableTimestamp:
 
 timestamp = _MutableTimestamp(datetime.today())
 timestamp_utc = _MutableTimestamp(datetime.now(timezone.utc))
-prowler_version = "5.35.1"
+prowler_version = "5.36.1"
 html_logo_url = "https://github.com/prowler-cloud/prowler/"
 square_logo_img = "https://raw.githubusercontent.com/prowler-cloud/prowler/dc7d2d5aeb92fdf12e8604f42ef6472cd3e8e889/docs/img/prowler-logo-black.png"
 aws_logo = "https://user-images.githubusercontent.com/38561120/235953920-3e3fba08-0795-41dc-b480-9bea57db9f2e.png"

prowler/lib/outputs/html/html.py

@@ -1,5 +1,7 @@
+import re
 import sys
 from io import TextIOWrapper
+from urllib.parse import urlparse
 
 import markdown
 from markupsafe import escape
@@ -16,6 +18,33 @@ from prowler.lib.outputs.output import Finding, Output
 from prowler.lib.outputs.utils import parse_html_string, unroll_dict
 from prowler.providers.common.provider import Provider
 
+_SAFE_URL_SCHEMES = {"http", "https"}
+
+
+def _safe_url(url: str) -> str:
+    """Return url if its scheme is http/https, otherwise return empty string."""
+    if not url:
+        return ""
+    scheme = urlparse(url).scheme.lower()
+    return url if scheme in _SAFE_URL_SCHEMES else ""
+
+
+def _strip_unsafe_links(html_content: str) -> str:
+    """Replace <a href> tags whose href is not http/https with their link text."""
+
+    def _replace(match: re.Match) -> str:
+        href = match.group("href")
+        body = match.group("body")
+        safe = _safe_url(href)
+        return f'<a href="{safe}">{body}</a>' if safe else body
+
+    return re.sub(
+        r'<a\s[^>]*href="(?P<href>[^"]*)"[^>]*>(?P<body>.*?)</a>',
+        _replace,
+        html_content,
+        flags=re.IGNORECASE | re.DOTALL,
+    )
+
 
 class HTML(Output):
     @staticmethod
@@ -52,7 +81,7 @@ class HTML(Output):
             html_content = html_content.replace("<p>", "")
             html_content = html_content.replace("</p>", "")
 
-        return html_content
+        return _strip_unsafe_links(html_content)
 
     def transform(self, findings: list[Finding]) -> None:
         """Transforms the findings into the HTML format.
@@ -77,16 +106,16 @@ class HTML(Output):
                 self._data.append(f"""
                         <tr class="{row_class}">
                             <td>{finding_status}</td>
-                            <td>{finding.metadata.Severity.value}</td>
-                            <td>{finding.metadata.ServiceName}</td>
-                            <td>{finding.region.lower()}</td>
-                            <td>{finding.metadata.CheckID.replace("_", "<wbr />_")}</td>
-                            <td>{finding.metadata.CheckTitle}</td>
-                            <td>{finding.resource_uid.replace("<", "&lt;").replace(">", "&gt;").replace("_", "<wbr />_")}</td>
-                            <td>{parse_html_string(unroll_dict(finding.resource_tags))}</td>
-                            <td>{finding.status_extended.replace("<", "&lt;").replace(">", "&gt;").replace("_", "<wbr />_")}</td>
-                            <td><p class="show-read-more">{HTML.process_markdown(finding.metadata.Risk)}</p></td>
-                            <td><p class="show-read-more">{HTML.process_markdown(finding.metadata.Remediation.Recommendation.Text)}</p> <a class="read-more" href="{finding.metadata.Remediation.Recommendation.Url}"><i class="fas fa-external-link-alt"></i></a></td>
+                            <td>{str(escape(finding.metadata.Severity.value))}</td>
+                            <td>{str(escape(finding.metadata.ServiceName))}</td>
+                            <td>{str(escape(finding.region.lower()))}</td>
+                            <td>{str(escape(finding.metadata.CheckID)).replace("_", "<wbr />_")}</td>
+                            <td>{str(escape(finding.metadata.CheckTitle))}</td>
+                            <td>{str(escape(finding.resource_uid)).replace("_", "<wbr />_")}</td>
+                            <td>{parse_html_string(str(escape(unroll_dict(finding.resource_tags))))}</td>
+                            <td>{str(escape(finding.status_extended)).replace("_", "<wbr />_")}</td>
+                            <td><p class="show-read-more">{HTML.process_markdown(str(escape(finding.metadata.Risk)))}</p></td>
+                            <td><p class="show-read-more">{HTML.process_markdown(str(escape(finding.metadata.Remediation.Recommendation.Text)))}</p> <a class="read-more" href="{str(escape(_safe_url(finding.metadata.Remediation.Recommendation.Url)))}"><i class="fas fa-external-link-alt"></i></a></td>
                             <td><p class="show-read-more">{parse_html_string(unroll_dict(finding.compliance, separator=": "))}</p></td>
                         </tr>
                         """)

prowler/lib/outputs/jira/jira.py

@@ -203,7 +203,9 @@ class MarkdownToADFConverter:
             if token_type == "text":
                 result.extend(self._text_to_nodes(token.content, marks_stack))
             elif token_type == "code_inline":
-                marks = self._clone_marks(marks_stack)
+                marks = self._clone_marks(
+                    [mark for mark in marks_stack if mark["type"] == "link"]
+                )
                 marks.append({"type": "code"})
                 result.append(self._create_text_node(token.content, marks))
             elif token_type in {"softbreak", "hardbreak"}:
@@ -417,6 +419,19 @@ class Jira:
                 message=init_error, file=os.path.basename(__file__)
             )
 
+    @staticmethod
+    def _sanitize_summary(summary: str) -> str:
+        """Normalize and truncate a Jira issue summary.
+
+        Args:
+            summary: Raw summary text.
+
+        Returns:
+            The summary collapsed to one line and limited to Jira's 255-character
+            summary maximum.
+        """
+        return " ".join(summary.split())[:255]
+
     @staticmethod
     def _build_code_block_content(code_value: str) -> Optional[Dict]:
         if not code_value:
@@ -1155,6 +1170,101 @@ class Jira:
             return "#0000FF"
         return "#000000"  # Default black color for unknown severities
 
+    @staticmethod
+    def _adf_colored_strong_marks(color_mark_type: str, color: str) -> list[dict]:
+        """Build ADF marks for bold text with a Jira color mark.
+
+        Args:
+            color_mark_type: Jira ADF color mark type, such as textColor or
+                backgroundColor.
+            color: Hex color value for the mark.
+
+        Returns:
+            ADF marks for strong colored text.
+        """
+        return [
+            {"type": "strong"},
+            {"type": color_mark_type, "attrs": {"color": color}},
+        ]
+
+    def _adf_severity_marks(
+        self, severity: str = "", severity_color: str | None = None
+    ) -> list[dict]:
+        """Build ADF marks for severity text.
+
+        Args:
+            severity: Finding severity used to derive a color when severity_color
+                is not provided.
+            severity_color: Optional explicit severity color.
+
+        Returns:
+            ADF marks for highlighted severity text.
+        """
+        color = severity_color or self.get_severity_color(str(severity).lower())
+        return self._adf_colored_strong_marks("backgroundColor", color)
+
+    def _adf_status_marks(
+        self, status: str = "", status_color: str | None = None
+    ) -> list[dict]:
+        """Build ADF marks for status text.
+
+        Args:
+            status: Finding status used to derive a color when status_color is
+                not provided.
+            status_color: Optional explicit status color.
+
+        Returns:
+            ADF marks for colored status text.
+        """
+        color = status_color or self.get_color_from_status(str(status).upper())
+        return self._adf_colored_strong_marks("textColor", color)
+
+    @staticmethod
+    def _adf_text_node(text: str, marks: list[dict] | None = None) -> dict:
+        """Build an ADF text node.
+
+        Args:
+            text: Text content for the node.
+            marks: Optional ADF marks to apply to the text.
+
+        Returns:
+            ADF text node with optional marks.
+        """
+        node = {"type": "text", "text": text}
+        if marks:
+            node["marks"] = marks
+        return node
+
+    def _adf_severity_text_node(
+        self, severity: str = "", severity_color: str | None = None
+    ) -> dict:
+        """Build an ADF text node for severity.
+
+        Args:
+            severity: Severity text to render.
+            severity_color: Optional explicit severity color.
+
+        Returns:
+            ADF text node with severity marks.
+        """
+        return self._adf_text_node(
+            severity, self._adf_severity_marks(severity, severity_color)
+        )
+
+    def _adf_status_text_node(
+        self, status: str = "", status_color: str | None = None
+    ) -> dict:
+        """Build an ADF text node for status.
+
+        Args:
+            status: Status text to render.
+            status_color: Optional explicit status color.
+
+        Returns:
+            ADF text node with status marks.
+        """
+        return self._adf_text_node(status, self._adf_status_marks(status, status_color))
+
     def get_adf_description(
         self,
         check_id: str = "",
@@ -1293,19 +1403,9 @@ class Jira:
                             {
                                 "type": "paragraph",
                                 "content": [
-                                    {
-                                        "type": "text",
-                                        "text": severity,
-                                        "marks": [
-                                            {"type": "strong"},
-                                            {
-                                                "type": "backgroundColor",
-                                                "attrs": {
-                                                    "color": severity_color,
-                                                },
-                                            },
-                                        ],
-                                    }
+                                    self._adf_severity_text_node(
+                                        severity, severity_color
+                                    )
                                 ],
                             }
                         ],
@@ -1338,17 +1438,7 @@ class Jira:
                             {
                                 "type": "paragraph",
                                 "content": [
-                                    {
-                                        "type": "text",
-                                        "text": status,
-                                        "marks": [
-                                            {"type": "strong"},
-                                            {
-                                                "type": "textColor",
-                                                "attrs": {"color": status_color},
-                                            },
-                                        ],
-                                    }
+                                    self._adf_status_text_node(status, status_color)
                                 ],
                             }
                         ],
@@ -1872,6 +1962,239 @@ class Jira:
             ],
         }
 
+    def get_grouped_adf_description(
+        self,
+        check_id: str = "",
+        check_title: str = "",
+        check_description: str = "",
+        severity: str = "",
+        status: str = "",
+        provider: str = "",
+        service: str = "",
+        affected_failing_resources: int = 0,
+        last_seen: str = "",
+        failing_for: str = "",
+        grouped_resources: list[dict] | None = None,
+        resources_total: int = 0,
+        resources_shown: int = 0,
+        finding_group_url: str = "",
+        finding_group_link_text: str = "",
+        risk: str = "",
+        recommendation_text: str = "",
+        recommendation_url: str = "",
+    ) -> dict:
+        """Build a Jira ADF description for a grouped finding issue.
+
+        Args:
+            check_id: Finding check ID.
+            check_title: Finding check title.
+            check_description: Finding check description.
+            severity: Finding group severity.
+            status: Finding group status.
+            provider: Cloud provider name.
+            service: Provider service name.
+            affected_failing_resources: Number of failing resources in the group.
+            last_seen: Last time the finding group was seen.
+            failing_for: Duration the finding group has been failing.
+            grouped_resources: Resource rows to include in the grouped issue.
+            resources_total: Total number of resources in the group.
+            resources_shown: Number of resources rendered in this Jira issue.
+            finding_group_url: Optional URL for the full finding group.
+            finding_group_link_text: Optional link text for finding_group_url.
+            risk: Risk description for the check.
+            recommendation_text: Remediation recommendation text.
+            recommendation_url: Optional remediation recommendation URL.
+
+        Returns:
+            Jira ADF document describing the finding group.
+        """
+
+        def _safe(value) -> str:
+            return str(value) if value not in (None, "") else "-"
+
+        def _text(value, marks: list[dict] | None = None) -> dict:
+            node = {"type": "text", "text": _safe(value)}
+            if marks:
+                node["marks"] = marks
+            return node
+
+        def _paragraph(value, marks: list[dict] | None = None) -> dict:
+            return {"type": "paragraph", "content": [_text(value, marks)]}
+
+        def _cell(value, marks: list[dict] | None = None) -> dict:
+            return {"type": "tableCell", "content": [_paragraph(value, marks)]}
+
+        def _content_cell(content: list[dict]) -> dict:
+            return {"type": "tableCell", "content": content}
+
+        def _append_link(content: list[dict], url: str) -> list[dict]:
+            if not url:
+                return content
+
+            link_node = {
+                "type": "text",
+                "text": url,
+                "marks": [{"type": "link", "attrs": {"href": url}}],
+            }
+            if content and content[-1].get("type") == "paragraph":
+                paragraph_content = content[-1].setdefault("content", [])
+                if paragraph_content:
+                    last_inline = paragraph_content[-1]
+                    if last_inline.get("type") != "text" or not last_inline.get(
+                        "text", ""
+                    ).endswith(" "):
+                        paragraph_content.append({"type": "text", "text": " "})
+                paragraph_content.append(link_node)
+            else:
+                content.append({"type": "paragraph", "content": [link_node]})
+            return content
+
+        def _row(cells: list[dict]) -> dict:
+            return {"type": "tableRow", "content": cells}
+
+        strong = [{"type": "strong"}]
+        code = [{"type": "code"}]
+        severity_marks = self._adf_severity_marks(severity)
+        status_marks = self._adf_status_marks(status)
+        recommendation_content = _append_link(
+            self._markdown_converter.convert(_safe(recommendation_text)),
+            recommendation_url,
+        )
+        main_rows = [
+            _row([_cell("Check Id", strong), _cell(check_id, code)]),
+            _row([_cell("Check Title", strong), _cell(check_title)]),
+            _row([_cell("Severity", strong), _cell(severity, severity_marks)]),
+            _row([_cell("Status", strong), _cell(status, status_marks)]),
+            _row([_cell("Provider", strong), _cell(provider, code)]),
+            _row([_cell("Service", strong), _cell(service, code)]),
+            _row(
+                [
+                    _cell("Affected Failing Resources", strong),
+                    _cell(affected_failing_resources, strong),
+                ]
+            ),
+            _row([_cell("Last Seen", strong), _cell(last_seen)]),
+            _row([_cell("Failing For", strong), _cell(failing_for)]),
+            _row(
+                [
+                    _cell("Risk", strong),
+                    _content_cell(self._markdown_converter.convert(_safe(risk))),
+                ]
+            ),
+            _row(
+                [
+                    _cell("Recommendation", strong),
+                    _content_cell(recommendation_content),
+                ]
+            ),
+        ]
+
+        resource_rows = [
+            _row(
+                [
+                    _cell("Resource", strong),
+                    _cell("Resource UID", strong),
+                    _cell("Provider", strong),
+                    _cell("Service", strong),
+                    _cell("Account / Tenant", strong),
+                    _cell("Status", strong),
+                    _cell("Severity", strong),
+                    _cell("Region", strong),
+                    _cell("Last Seen", strong),
+                    _cell("Failing For", strong),
+                    _cell("Triage", strong),
+                ]
+            )
+        ]
+        for resource in grouped_resources or []:
+            resource_status = resource.get("status")
+            resource_severity = str(resource.get("severity", "")).upper()
+            resource_status_marks = self._adf_status_marks(resource_status)
+            resource_severity_marks = self._adf_severity_marks(resource_severity)
+            resource_rows.append(
+                _row(
+                    [
+                        _cell(resource.get("resource_name"), code),
+                        _cell(resource.get("resource_uid"), code),
+                        _cell(resource.get("provider"), code),
+                        _cell(resource.get("service"), code),
+                        _cell(resource.get("provider_account"), code),
+                        _cell(resource_status, resource_status_marks),
+                        _cell(resource_severity, resource_severity_marks),
+                        _cell(resource.get("region"), code),
+                        _cell(resource.get("last_seen")),
+                        _cell(resource.get("failing_for")),
+                        _cell(resource.get("triage")),
+                    ]
+                )
+            )
+
+        content = [
+            _paragraph("Prowler has discovered the following Finding Group:"),
+            {"type": "table", "attrs": {"layout": "full-width"}, "content": main_rows},
+        ]
+
+        content.extend(
+            [
+                {
+                    "type": "heading",
+                    "attrs": {"level": 2},
+                    "content": [_text("Affected failing resources")],
+                },
+                {
+                    "type": "table",
+                    "attrs": {"layout": "full-width"},
+                    "content": resource_rows,
+                },
+            ]
+        )
+
+        if resources_total > resources_shown:
+            remaining_content = [
+                _text(f"Showing {resources_shown} of {resources_total} Findings.")
+            ]
+            if finding_group_url and finding_group_link_text:
+                remaining_content = [
+                    _text(
+                        f"Showing {resources_shown} of {resources_total} Findings "
+                        "in this Jira issue. "
+                    ),
+                    _text(
+                        finding_group_link_text,
+                        [
+                            {
+                                "type": "link",
+                                "attrs": {"href": finding_group_url},
+                            }
+                        ],
+                    ),
+                ]
+            content.append(
+                {
+                    "type": "paragraph",
+                    "content": remaining_content,
+                }
+            )
+        elif finding_group_url and finding_group_link_text:
+            content.append(
+                {
+                    "type": "paragraph",
+                    "content": [
+                        _text(
+                            finding_group_link_text,
+                            [
+                                {
+                                    "type": "link",
+                                    "attrs": {"href": finding_group_url},
+                                }
+                            ],
+                        ),
+                    ],
+                }
+            )
+
+        return {"type": "doc", "version": 1, "content": content}
+
     def send_findings(
         self,
         findings: list[Finding] = None,
@@ -1965,7 +2288,7 @@ class Jira:
                     summary_parts.append(finding.resource_uid)
 
                 summary = " - ".join(summary_parts[1:])
-                summary = f"{summary_parts[0]} {summary}"[:255]
+                summary = self._sanitize_summary(f"{summary_parts[0]} {summary}")
 
                 payload = {
                     "fields": {
@@ -2048,11 +2371,13 @@ class Jira:
         self,
         check_id: str = "",
         check_title: str = "",
+        check_description: str = "",
         severity: str = "",
         status: str = "",
         status_extended: str = "",
         provider: str = "",
         region: str = "",
+        service: str = "",
         resource_uid: str = "",
         resource_name: str = "",
         risk: str = "",
@@ -2069,6 +2394,14 @@ class Jira:
         issue_labels: list[str] = "",
         finding_url: str = "",
         tenant_info: str = "",
+        affected_failing_resources: int = 0,
+        grouped_resources: list[dict] | None = None,
+        resources_total: int = 0,
+        resources_shown: int = 0,
+        last_seen: str = "",
+        failing_for: str = "",
+        finding_group_url: str = "",
+        finding_group_link_text: str = "",
     ) -> bool:
         """
         Send the finding to Jira
@@ -2076,11 +2409,13 @@ class Jira:
         Args:
             - check_id: The check ID
             - check_title: The check title
+            - check_description: The check description
             - severity: The severity
             - status: The status
             - status_extended: The status extended
             - provider: The provider
             - region: The region
+            - service: The service
             - resource_uid: The resource UID
             - resource_name: The resource name
             - risk: The risk
@@ -2097,6 +2432,15 @@ class Jira:
             - issue_labels: The issue labels
             - finding_url: The finding URL
             - tenant_info: The tenant info
+            - affected_failing_resources: The number of affected failing resources
+            - grouped_resources: The grouped resources to render, or None for a
+              single finding issue
+            - resources_total: The total resources in the finding group
+            - resources_shown: The resources shown in the Jira issue
+            - last_seen: The last time the finding group was seen
+            - failing_for: The duration the finding group has been failing
+            - finding_group_url: The finding group URL
+            - finding_group_link_text: The link text for the finding group URL
 
         Raises:
             - JiraRefreshTokenError: Failed to refresh the access token
@@ -2140,40 +2484,66 @@ class Jira:
 
             status_color = self.get_color_from_status(status)
             severity_color = self.get_severity_color(severity.lower())
-            adf_description = self.get_adf_description(
-                check_id=check_id,
-                check_title=check_title,
-                severity=severity.upper(),
-                severity_color=severity_color,
-                status=status,
-                status_color=status_color,
-                status_extended=status_extended,
-                provider=provider,
-                region=region,
-                resource_uid=resource_uid,
-                resource_name=resource_name,
-                risk=risk,
-                recommendation_text=recommendation_text,
-                recommendation_url=recommendation_url,
-                remediation_code_native_iac=remediation_code_native_iac,
-                remediation_code_terraform=remediation_code_terraform,
-                remediation_code_cli=remediation_code_cli,
-                remediation_code_other=remediation_code_other,
-                resource_tags=resource_tags,
-                compliance=compliance,
-                finding_url=finding_url,
-                tenant_info=tenant_info,
-            )
+            if grouped_resources is not None:
+                adf_description = self.get_grouped_adf_description(
+                    check_id=check_id,
+                    check_title=check_title,
+                    check_description=check_description,
+                    severity=severity.upper(),
+                    status=status,
+                    provider=provider,
+                    service=service,
+                    affected_failing_resources=affected_failing_resources,
+                    last_seen=last_seen,
+                    failing_for=failing_for,
+                    grouped_resources=grouped_resources,
+                    resources_total=resources_total,
+                    resources_shown=resources_shown,
+                    finding_group_url=finding_group_url,
+                    finding_group_link_text=finding_group_link_text,
+                    risk=risk,
+                    recommendation_text=recommendation_text,
+                    recommendation_url=recommendation_url,
+                )
+            else:
+                adf_description = self.get_adf_description(
+                    check_id=check_id,
+                    check_title=check_title,
+                    severity=severity.upper(),
+                    severity_color=severity_color,
+                    status=status,
+                    status_color=status_color,
+                    status_extended=status_extended,
+                    provider=provider,
+                    region=region,
+                    resource_uid=resource_uid,
+                    resource_name=resource_name,
+                    risk=risk,
+                    recommendation_text=recommendation_text,
+                    recommendation_url=recommendation_url,
+                    remediation_code_native_iac=remediation_code_native_iac,
+                    remediation_code_terraform=remediation_code_terraform,
+                    remediation_code_cli=remediation_code_cli,
+                    remediation_code_other=remediation_code_other,
+                    resource_tags=resource_tags,
+                    compliance=compliance,
+                    finding_url=finding_url,
+                    tenant_info=tenant_info,
+                )
 
             summary_parts = ["[Prowler]"]
             if severity:
                 summary_parts.append(severity.upper())
             if check_id:
                 summary_parts.append(check_id)
-            if resource_uid:
+            if grouped_resources is not None:
+                summary_parts.append(
+                    f"{affected_failing_resources} affected failing resources"
+                )
+            elif resource_uid:
                 summary_parts.append(resource_uid)
             summary = " - ".join(summary_parts[1:])
-            summary = f"{summary_parts[0]} {summary}"[:255]
+            summary = self._sanitize_summary(f"{summary_parts[0]} {summary}")
 
             payload = {
                 "fields": {

prowler/lib/utils/utils.py

@@ -232,7 +232,10 @@ def _scan_batch_chunk(
                     encoding=encoding_format_utf_8,
                     errors="replace",
                 ) as f:
-                    source_lines_cache[file_name] = f.read().splitlines()
+                    # Kingfisher reports LF-delimited line numbers. Unlike
+                    # splitlines(), this does not treat ASCII control characters
+                    # such as FS, GS, and RS as additional line boundaries.
+                    source_lines_cache[file_name] = f.read().split("\n")
             return source_lines_cache[file_name]
 
         for entry in kingfisher_output.get("findings", []):