fix(a11y): add focus trap to mobile navigation drawer

.audit-config.yaml

@@ -0,0 +1,28 @@
+# Dependency Vulnerability Audit Configuration
+# This file documents known vulnerabilities and their exceptions
+
+version: 1.0
+policy:
+  # Minimum severity to block CI (critical, high, medium, low)
+  min_severity_to_block: high
+
+  # Require approval for exceptions?
+  require_approval: true
+
+  # Auto-fail if exception expires
+  enforce_expiry: true
+
+  # Fail if any exception is close to expiry (days)
+  warn_before_expiry_days: 14
+
+# Documented exceptions with business justification
+# Format: CVE-XXXX-XXXXX or GHSA-xxxx-xxxx-xxxx
+exceptions: {}
+
+# Packages to exclude from audits (use sparingly!)
+excluded_packages: []
+
+# Alert channels for new vulnerabilities
+alerts:
+  slack_webhook: null
+  email_list: []

.env.example

@@ -14,6 +14,8 @@ SECUSCAN_BIND_PORT=8000
 
 # Docker Support
 SECUSCAN_DOCKER_ENABLED=false
+# Docker sandbox network (auto-created if absent; ICC disabled for isolation)
+SECUSCAN_DOCKER_NETWORK=restricted
 
 # Security Defaults
 SECUSCAN_SAFE_MODE_DEFAULT=true
@@ -22,6 +24,13 @@ SECUSCAN_ALLOW_LOOPBACK_SCANS=true
 # SECUSCAN_ALLOWED_NETWORKS=127.0.0.1,192.168.*.*,10.*.*.*,172.16.*.*
 # SECUSCAN_CORS_ALLOWED_ORIGINS=http://127.0.0.1:5173,http://localhost:5173
 
+# Network Policy & Admin Authentication
+# SECUSCAN_NETWORK_ALLOWLIST=
+# SECUSCAN_NETWORK_DENYLIST=169.254.169.254/32,127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
+# SECUSCAN_ENFORCE_NETWORK_POLICY=true
+# SECUSCAN_NETWORK_POLICY_FAILURE_MODE=block
+# SECUSCAN_ADMIN_API_KEY=replace-with-a-secure-admin-token
+
 # Credential Vault — REQUIRED before first run
 # Generate with: python -c "import secrets; print(secrets.token_hex(32))"
 # The server refuses to start the vault if this is unset.

.github/ISSUE_TEMPLATE/bug_report.md

@@ -2,7 +2,7 @@
 name: Bug report
 about: Create a report to help us improve SecuScan
 title: '[BUG] '
-labels: bug
+labels: type:bug, priority:medium
 assignees: ''
 
 ---

.github/ISSUE_TEMPLATE/documentation_task.md

@@ -2,7 +2,7 @@
 name: Documentation task
 about: Propose a documentation improvement contributors can pick up directly
 title: '[DOCS] '
-labels: documentation
+labels: type:docs, area:docs, priority:medium
 assignees: ''
 
 ---

.github/ISSUE_TEMPLATE/feature_request.md

@@ -2,7 +2,7 @@
 name: Feature request
 about: Suggest an idea for SecuScan
 title: '[FEAT] '
-labels: feature
+labels: type:feature, priority:medium
 assignees: ''
 
 ---

.github/ISSUE_TEMPLATE/help_wanted_task.md

@@ -2,7 +2,7 @@
 name: Help wanted task
 about: Create a scoped contributor task with clear implementation and verification notes
 title: '[TASK] '
-labels: help wanted
+labels: priority:medium
 assignees: ''
 
 ---

.github/workflows/catalog-sync-check.yml

@@ -0,0 +1,23 @@
+name: Plugin Catalog Sync Check
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  validate-catalog:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@v4
+
+    - name: Set up Python
+      uses: actions/setup-python@v5
+      with:
+        python-version: '3.11'
+
+    - name: Run Catalog Validation Script
+      run: python scripts/validate_plugins_catalog.py

.github/workflows/check-artifacts.yml

@@ -1,14 +1,24 @@
-name: Check for Frontend Artifacts
+name: Check for Committed Artifacts
 
 on:
   pull_request:
     branches: [main, dev]
+    paths:
+      - "frontend/**"
+      - "output/**"
+      - "data/**"
+      - "backend/data/**"
+      - "logs/**"
+      - "scripts/check-artifacts.sh"
+      - ".github/workflows/check-artifacts.yml"
 
 jobs:
   artifact-check:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-      - name: Run artifact check
-        run: bash scripts/check-artifacts.sh
+      - name: Run artifact guard
+        run: bash scripts/check-artifacts.sh origin/main

.github/workflows/ci.yml

@@ -43,6 +43,27 @@ jobs:
           git fetch origin "${{ github.base_ref }}" --depth=1
           git diff --check "origin/${{ github.base_ref }}"...HEAD
 
+  issue-template-label-validation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Validate issue template labels
+        run: python scripts/validate_issue_template_labels.py
+
+  doc-anchor-validation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Validate documentation anchors
+        run: python scripts/validate_doc_anchors.py
+
   backend-lint:
     needs: detect-changes
     if: needs.detect-changes.outputs.run_backend == 'true'
@@ -61,7 +82,29 @@ jobs:
       - name: Run backend lint baseline
         run: ruff check backend testing/backend
 
-  backend-tests:
+  backend-unit:
+    needs: [detect-changes, backend-lint, formatting-hygiene]
+    if: |
+      always() &&
+      needs.detect-changes.outputs.run_backend == 'true' &&
+      (needs.backend-lint.result == 'success' || needs.backend-lint.result == 'skipped') &&
+      (needs.formatting-hygiene.result == 'success' || needs.formatting-hygiene.result == 'skipped')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install backend system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libcairo2-dev pkg-config
+      - name: Install backend dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r backend/requirements.txt -r backend/requirements-dev.txt
+      - name: Run unit tests
+        run: pytest testing/backend/unit -q -m "not benchmark"
+
+  backend-integration:
     needs: [detect-changes, backend-lint, formatting-hygiene]
     if: |
       always() &&
@@ -80,8 +123,100 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -r backend/requirements.txt -r backend/requirements-dev.txt
-      - name: Run backend tests
-        run: pytest testing/backend -q -m "not benchmark"
+      - name: Run integration tests
+        run: pytest testing/backend/integration -q -m "not benchmark"
+
+  parser-contracts:
+    needs: [detect-changes, backend-lint, formatting-hygiene]
+    if: |
+      always() &&
+      needs.detect-changes.outputs.run_backend == 'true' &&
+      (needs.backend-lint.result == 'success' || needs.backend-lint.result == 'skipped') &&
+      (needs.formatting-hygiene.result == 'success' || needs.formatting-hygiene.result == 'skipped')
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        capability_group:
+          - network
+          - intrusive
+          - credentials
+          - exploit
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install backend system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libcairo2-dev pkg-config
+      - name: Install backend dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r backend/requirements.txt -r backend/requirements-dev.txt
+      - name: Run parser contract tests for capability group ${{ matrix.capability_group }}
+        run: |
+          echo "Running parser contract tests for capability group: ${{ matrix.capability_group }}"
+          PARSER_CAPABILITY_GROUP=${{ matrix.capability_group }} pytest testing/backend/integration/test_parser_output_contract.py -q
+  backend-tests:
+    needs:
+      - backend-unit
+      - backend-integration
+      - parser-contracts
+    runs-on: ubuntu-latest
+    if: |
+      always() &&
+      (needs.backend-unit.result == 'success' || needs.backend-unit.result == 'skipped') &&
+      (needs.backend-integration.result == 'success' || needs.backend-integration.result == 'skipped') &&
+      (needs.parser-contracts.result == 'success' || needs.parser-contracts.result == 'skipped')
+    steps:
+      - name: Backend test suites completed
+        run: echo "backend-unit, backend-integration, and parser-contracts completed"
+  backend-audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+      - name: Install backend system dependencies
+        run: sudo apt-get update && sudo apt-get install -y libcairo2-dev pkg-config
+      - name: Install backend dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r backend/requirements.txt -r backend/requirements-dev.txt
+
+      - name: Run pip-audit on backend
+        id: pip_audit
+        run: |
+          mkdir -p ${{ github.workspace }}/backend
+          pip-audit -r backend/requirements.txt --desc --format json > ${{ github.workspace }}/backend/pip-audit-report.json || {
+            EXIT_CODE=$?
+            echo "EXIT_CODE=$EXIT_CODE" >> $GITHUB_OUTPUT
+            exit 0  # Check severity next
+          }
+        continue-on-error: true
+
+      - name: Check pip-audit results
+        run: |
+          python ${{ github.workspace }}/scripts/check_pip_audit.py \
+            --report ${{ github.workspace }}/backend/pip-audit-report.json \
+            --config ${{ github.workspace }}/.audit-config.yaml
+
+      - name: Generate CycloneDX SBOM
+        run: |
+          python ${{ github.workspace }}/scripts/generate_sbom.py --output ${{ github.workspace }}/sbom.json --include-dev
+
+      - name: Upload pip-audit report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: pip-audit-report
+          path: ${{ github.workspace }}/backend/pip-audit-report.json
+
+      - name: Upload SBOM
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom
+          path: ${{ github.workspace }}/sbom.json
 
   benchmark:
     runs-on: ubuntu-latest
@@ -101,35 +236,60 @@ jobs:
         id: run_benchmarks
         run: python3 scripts/run_benchmarks.py
         continue-on-error: true
-      - name: Upload benchmark results artifact
+      - name: Upload benchmark comparison artifacts
+        if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: benchmark-results
-          path: benchmark_results.json
+          name: benchmark-threshold-comparison
+          path: |
+            benchmark_results.json
+            benchmark_threshold_comparison.json
       - name: Add warning annotation on failure
         if: steps.run_benchmarks.outcome == 'failure'
         run: |
           echo "::warning::Performance benchmark thresholds exceeded or benchmarks failed to run. Check the job logs for details."
-
   frontend-checks:
     needs: [detect-changes, formatting-hygiene]
     if: |
       always() &&
       needs.detect-changes.outputs.run_frontend == 'true' &&
       (needs.formatting-hygiene.result == 'success' || needs.formatting-hygiene.result == 'skipped')
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [20, 22]
+
     defaults:
       run:
         working-directory: frontend
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: "20"
+          node-version: ${{ matrix.node-version }}
           cache: "npm"
           cache-dependency-path: frontend/package-lock.json
       - name: Install frontend dependencies
         run: npm ci
+      - name: Run npm audit
+        id: npm_audit
+        run: |
+          npm audit --json > ${{ github.workspace }}/frontend/npm-audit-report.json || {
+            EXIT_CODE=$?
+            echo "EXIT_CODE=$EXIT_CODE" >> $GITHUB_OUTPUT
+            exit 0  # Check severity next
+          }
+        continue-on-error: true
+      - name: Install Python YAML library
+        run: pip install pyyaml
+      - name: Check npm audit results
+        run: python ${{ github.workspace }}/scripts/check_npm_audit.py --report ${{ github.workspace }}/frontend/npm-audit-report.json --config ${{ github.workspace }}/.audit-config.yaml
+      - name: Upload npm-audit report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: npm-audit-report
+          path: frontend/npm-audit-report.json
       - name: Run frontend TypeScript typecheck
         run: npm run typecheck
       - name: Note TypeScript typecheck in job summary