Initial deployment: Gradio frontend with Modal backend - Multi-language security scanner with parallel processing

.gitattributes

@@ -0,0 +1,35 @@
+*.7z filter=lfs diff=lfs merge=lfs -text
+*.arrow filter=lfs diff=lfs merge=lfs -text
+*.bin filter=lfs diff=lfs merge=lfs -text
+*.bz2 filter=lfs diff=lfs merge=lfs -text
+*.ckpt filter=lfs diff=lfs merge=lfs -text
+*.ftz filter=lfs diff=lfs merge=lfs -text
+*.gz filter=lfs diff=lfs merge=lfs -text
+*.h5 filter=lfs diff=lfs merge=lfs -text
+*.joblib filter=lfs diff=lfs merge=lfs -text
+*.lfs.* filter=lfs diff=lfs merge=lfs -text
+*.mlmodel filter=lfs diff=lfs merge=lfs -text
+*.model filter=lfs diff=lfs merge=lfs -text
+*.msgpack filter=lfs diff=lfs merge=lfs -text
+*.npy filter=lfs diff=lfs merge=lfs -text
+*.npz filter=lfs diff=lfs merge=lfs -text
+*.onnx filter=lfs diff=lfs merge=lfs -text
+*.ot filter=lfs diff=lfs merge=lfs -text
+*.parquet filter=lfs diff=lfs merge=lfs -text
+*.pb filter=lfs diff=lfs merge=lfs -text
+*.pickle filter=lfs diff=lfs merge=lfs -text
+*.pkl filter=lfs diff=lfs merge=lfs -text
+*.pt filter=lfs diff=lfs merge=lfs -text
+*.pth filter=lfs diff=lfs merge=lfs -text
+*.rar filter=lfs diff=lfs merge=lfs -text
+*.safetensors filter=lfs diff=lfs merge=lfs -text
+saved_model/**/* filter=lfs diff=lfs merge=lfs -text
+*.tar.* filter=lfs diff=lfs merge=lfs -text
+*.tar filter=lfs diff=lfs merge=lfs -text
+*.tflite filter=lfs diff=lfs merge=lfs -text
+*.tgz filter=lfs diff=lfs merge=lfs -text
+*.wasm filter=lfs diff=lfs merge=lfs -text
+*.xz filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
+*.zst filter=lfs diff=lfs merge=lfs -text
+*tfevents* filter=lfs diff=lfs merge=lfs -text

.gitignore

@@ -0,0 +1,33 @@
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+*.so
+.Python
+env/
+venv/
+ENV/
+.venv
+
+# Gradio
+flagged/
+gradio_cached_examples/
+
+# Testing
+.pytest_cache/
+*.log
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Local environment files (example only, actual secrets in HF Spaces UI)
+.env
+.env.local

README.md

@@ -0,0 +1,75 @@
+---
+title: Security Auditor
+emoji: 🔒
+colorFrom: red
+colorTo: orange
+sdk: gradio
+sdk_version: 4.0.0
+app_file: app.py
+pinned: false
+license: mit
+short_description: AI-powered security vulnerability scanner with serverless Modal.com backend
+---
+
+# Security Auditor 🔒
+
+AI-powered security vulnerability scanner with serverless backend powered by Modal.com.
+
+## Features
+
+✨ **Multi-Language Support**: Python, JavaScript, Java, C/C++, Go, Ruby, PHP, and more
+
+⚡ **Parallel Processing**: Scan hundreds of files in seconds using Modal.com serverless containers
+
+📊 **Comprehensive Reports**: Export findings as JSON or Markdown
+
+🔍 **100+ Vulnerability Patterns**: Detects SQL injection, XSS, hardcoded secrets, insecure crypto, and more
+
+## Architecture
+
+- **Frontend**: Gradio (hosted on HuggingFace Spaces)
+- **Backend**: FastAPI + Modal.com (serverless infrastructure)
+- **Parallel Processing**: Up to 100+ concurrent scans via Modal's elastic scaling
+
+## How It Works
+
+1. **Single File Scan**: Paste code directly into the interface
+2. **Batch Scan**: Upload multiple files or entire project directories
+3. **Results**: View vulnerabilities organized by severity (Critical, High, Medium, Low)
+4. **Export**: Download detailed reports in JSON or Markdown format
+
+## Performance
+
+- **Single File**: ~2-5 seconds
+- **100 Files**: ~5-15 seconds (10-100x faster than sequential)
+- **500 Files**: ~10-30 seconds
+- **1500+ Files**: ~30-90 seconds
+
+## Security & Privacy
+
+- No persistent storage of uploaded code
+- All scans run in isolated, ephemeral containers
+- Containers destroyed immediately after scanning
+- HTTPS encryption for all communications
+
+## Usage
+
+1. **Quick Scan**: Paste code in the "Scan Code" tab
+2. **Project Scan**: Upload files in the "Scan Directory" tab
+3. **Review**: Check findings organized by severity
+4. **Export**: Download reports for documentation
+
+## Technology Stack
+
+- **Static Analysis**: Custom SAST engine with pattern matching
+- **Backend**: FastAPI on Modal.com serverless platform
+- **Frontend**: Gradio for interactive web interface
+- **Deployment**: HuggingFace Spaces (frontend) + Modal.com (backend)
+
+## License
+
+MIT License - Feel free to use and modify for your projects!
+
+---
+
+**Powered by Modal.com serverless infrastructure** ⚡

app.py

@@ -0,0 +1,10 @@
+"""
+HuggingFace Spaces Entry Point for Security Auditor
+Launches the Gradio interface with Modal backend integration
+"""
+
+from gradio_app import SecurityAuditorApp
+
+if __name__ == "__main__":
+    app = SecurityAuditorApp()
+    app.interface.launch()

gradio_app.py

@@ -0,0 +1,1611 @@
+"""
+Modern Gradio Web Interface for Security Auditor
+Based on design mockups in assets/ folder
+"""
+
+import gradio as gr
+import asyncio
+import tempfile
+import shutil
+from pathlib import Path
+from datetime import datetime
+from typing import List, Dict
+import uuid
+import os
+import sys
+import time
+import threading
+import json
+import base64
+import re
+import httpx
+from concurrent.futures import ThreadPoolExecutor
+import multiprocessing
+
+# Import existing security checker (for local mode compatibility)
+from security_checker import SecurityChecker, RiskLevel
+
+# Modal backend URL - set via environment variable or use local default
+MODAL_BACKEND_URL = os.getenv("MODAL_BACKEND_URL", "http://localhost:8000")
+USE_MODAL_BACKEND = os.getenv("USE_MODAL_BACKEND", "false").lower() == "true"
+
+# Configuration for hybrid parallel processing
+PARALLEL_FILE_READING_WORKERS = min(multiprocessing.cpu_count() * 2, 16)
+PARALLEL_CHUNK_LIMIT = 3  # Max concurrent Modal API calls
+CHUNK_SIZE = 500  # Files per chunk
+
+
+class ModalScanResult:
+    """
+    Adapter class to convert Modal backend API responses to ScanResult-like format
+    for compatibility with existing UI code
+    """
+    def __init__(self, modal_response: dict, target: str, files_scanned: int = 1):
+        self.target = target
+        self.scan_type = "local"
+        self.files_scanned = files_scanned
+        self.errors = []
+
+        # Convert Modal response vulnerabilities to Vulnerability objects
+        if modal_response.get("success") and "findings" in modal_response:
+            vuln_data = modal_response["findings"].get("vulnerabilities", [])
+            self.vulnerabilities = []
+            for v in vuln_data:
+                # Create a simple object with attributes matching Vulnerability
+                vuln_obj = type('Vulnerability', (), v)()
+                vuln_obj.risk_level = type('RiskLevel', (), {'value': v.get('risk_level', 'INFO'), 'name': v.get('risk_level', 'INFO')})()
+                self.vulnerabilities.append(vuln_obj)
+        else:
+            self.vulnerabilities = []
+            if not modal_response.get("success"):
+                self.errors.append(modal_response.get("summary", {}).get("error", "Unknown error"))
+
+    def summary(self) -> dict:
+        """Generate a summary compatible with UI expectations"""
+        summary = {level.value: 0 for level in RiskLevel}
+        for vuln in self.vulnerabilities:
+            if hasattr(vuln, 'risk_level'):
+                summary[vuln.risk_level.value] += 1
+
+        return {
+            "target": self.target,
+            "scan_type": self.scan_type,
+            "duration_seconds": 0,  # Not tracked in this simple adapter
+            "files_scanned": self.files_scanned,
+            "total_vulnerabilities": len(self.vulnerabilities),
+            **summary
+        }
+
+# Import custom theme and UI components
+from theme import create_security_auditor_theme
+from ui_components import (
+    create_severity_badge,
+    create_finding_card,
+    create_summary_section,
+    create_empty_state,
+    create_loading_state
+)
+
+
+class ModernSecurityAuditorApp:
+    """
+    Modern Gradio web interface for Security Auditor.
+    Based on design mockups in assets/ folder.
+    """
+
+    def __init__(self):
+        # Only instantiate SecurityChecker if not using Modal backend
+        self.use_modal_backend = USE_MODAL_BACKEND
+        self.modal_backend_url = MODAL_BACKEND_URL
+        if not self.use_modal_backend:
+            self.checker = SecurityChecker()
+        else:
+            self.checker = None  # Not needed when using Modal backend
+        self.active_sessions = {}
+        self.cleanup_interval = 3600  # 1 hour
+        self.max_upload_size_mb = 100
+        self._help_html = self._prepare_help_content()
+
+    @staticmethod
+    def read_single_file(file_path: Path, target_path: Path, supported_extensions: set) -> dict:
+        """Read a single file - designed for parallel execution"""
+        try:
+            if file_path.suffix not in supported_extensions:
+                return None
+            with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
+                code = f.read()
+                return {
+                    "code": code,
+                    "language": file_path.suffix[1:],  # Remove the dot
+                    "filename": str(file_path.relative_to(target_path))
+                }
+        except Exception as e:
+            print(f"Error reading {file_path}: {e}")
+            return None
+
+    async def read_files_parallel(self, file_paths: List[Path], target_path: Path, max_workers: int = 8) -> List[dict]:
+        """Read multiple files in parallel using ThreadPoolExecutor"""
+        supported_extensions = {'.py', '.js', '.java', '.go', '.php', '.rb', '.rs', '.cpp', '.c', '.ts', '.jsx', '.tsx'}
+        loop = asyncio.get_event_loop()
+
+        with ThreadPoolExecutor(max_workers=max_workers) as executor:
+            tasks = [
+                loop.run_in_executor(
+                    executor,
+                    self.read_single_file,
+                    file_path,
+                    target_path,
+                    supported_extensions
+                )
+                for file_path in file_paths
+            ]
+            results = await asyncio.gather(*tasks)
+
+        # Filter out None results (errors or unsupported files)
+        return [r for r in results if r is not None]
+
+    async def process_chunks_parallel(self, chunks: List[List[dict]]) -> List[dict]:
+        """Process multiple chunks in parallel via Modal backend with rate limiting"""
+        semaphore = asyncio.Semaphore(PARALLEL_CHUNK_LIMIT)
+
+        async def _scan_with_limit(chunk):
+            async with semaphore:
+                return await self._scan_batch_via_modal(chunk)
+
+        tasks = [_scan_with_limit(chunk) for chunk in chunks]
+        results = await asyncio.gather(*tasks, return_exceptions=True)
+
+        # Handle any exceptions
+        valid_results = []
+        for i, result in enumerate(results):
+            if isinstance(result, Exception):
+                print(f"Chunk {i+1} failed: {result}")
+            else:
+                valid_results.append(result)
+
+        return valid_results
+
+    async def _scan_code_via_modal(self, code: str, language: str = "python") -> dict:
+        """
+        Call Modal backend API to scan code
+
+        Args:
+            code: Source code to scan
+            language: Programming language (default: python)
+
+        Returns:
+            Dict with scan results from Modal backend
+        """
+        try:
+            async with httpx.AsyncClient(timeout=300.0) as client:
+                response = await client.post(
+                    f"{self.modal_backend_url}/scan",
+                    json={
+                        "code": code,
+                        "language": language,
+                        "scan_type": "all"
+                    }
+                )
+                response.raise_for_status()
+                return response.json()
+        except httpx.HTTPError as e:
+            raise Exception(f"Modal backend error: {str(e)}")
+        except Exception as e:
+            raise Exception(f"Failed to connect to Modal backend: {str(e)}")
+
+    async def _scan_batch_via_modal(self, batch_files: List[Dict]) -> dict:
+        """
+        Call Modal backend API to scan multiple files in parallel using batch endpoint
+
+        Args:
+            batch_files: List of dicts with 'code', 'language', and 'filename' keys
+
+        Returns:
+            Dict with batch scan results from Modal backend
+        """
+        try:
+            # Extended timeout for batch processing (10 minutes)
+            async with httpx.AsyncClient(timeout=600.0) as client:
+                response = await client.post(
+                    f"{self.modal_backend_url}/scan/batch",
+                    json=batch_files
+                )
+                response.raise_for_status()
+                return response.json()
+        except httpx.HTTPError as e:
+            raise Exception(f"Modal batch backend error: {str(e)}")
+        except Exception as e:
+            raise Exception(f"Failed to connect to Modal batch backend: {str(e)}")
+
+    def _prepare_help_content(self):
+        """Read help.html and embed images as base64 data URIs for self-contained display."""
+        help_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), "help.html")
+        img_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "assets", "docimages")
+
+        try:
+            with open(help_path, "r", encoding="utf-8") as f:
+                html = f.read()
+        except FileNotFoundError:
+            return "<html><body><h1>Help file not found</h1></body></html>"
+
+        def replace_img_src(match):
+            filename = match.group(1)
+            img_path = os.path.join(img_dir, filename)
+            try:
+                with open(img_path, "rb") as img_f:
+                    b64 = base64.b64encode(img_f.read()).decode("ascii")
+                return f'src="data:image/png;base64,{b64}"'
+            except FileNotFoundError:
+                return match.group(0)
+
+        html = re.sub(r'src="/helpimg/([^"]+)"', replace_img_src, html)
+        return html
+
+    def create_interface(self) -> gr.Blocks:
+        """Create modern Gradio interface matching design mockups."""
+
+        self.theme = create_security_auditor_theme()
+
+        # Prepare help HTML as JSON-safe string for client-side Blob URL
+        self._help_js = json.dumps(self._help_html)
+
+        # Custom CSS for additional styling
+        self.custom_css = """
+        /* Tabler Icons CDN */
+        @import url('https://cdn.jsdelivr.net/npm/@tabler/icons-webfont@latest/tabler-icons.min.css');
+
+        /* Anthropic-inspired Theme Overrides */
+        :root {
+            --anthropic-cream: #faf9f6;
+            --anthropic-slate: #131314;
+            --anthropic-terracotta: #d97757;
+            --anthropic-terracotta-hover: #cc6944;
+            --anthropic-gray: #6b7280;
+            --anthropic-border: #e5e7eb;
+        }
+
+        /* Logo and branding - Anthropic style */
+        .logo-container {
+            display: flex;
+            align-items: center;
+            gap: 12px;
+            padding: 20px 24px;
+            border-bottom: 1px solid var(--anthropic-border);
+            background: var(--anthropic-cream);
+        }
+
+        .logo-icon {
+            width: 40px;
+            height: 40px;
+            background: var(--anthropic-slate);
+            border-radius: 6px;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            color: white;
+        }
+
+        .logo-icon svg {
+            width: 24px;
+            height: 24px;
+            stroke: white;
+        }
+
+        /* Section headers - cleaner, less shouty */
+        .section-header {
+            font-size: 13px;
+            font-weight: 600;
+            color: var(--anthropic-gray);
+            text-transform: none;
+            letter-spacing: normal;
+            margin: 20px 0 12px 0;
+            display: flex;
+            align-items: center;
+            gap: 8px;
+        }
+
+        .section-header svg {
+            width: 18px;
+            height: 18px;
+            stroke: var(--anthropic-gray);
+        }
+
+        /* Mode selector header */
+        .mode-selector-header {
+            font-size: 13px;
+            font-weight: 600;
+            color: var(--anthropic-gray);
+            text-transform: none;
+            letter-spacing: normal;
+            margin-bottom: 12px;
+            display: flex;
+            align-items: center;
+            gap: 8px;
+        }
+
+        .mode-selector-header svg {
+            width: 18px;
+            height: 18px;
+            stroke: var(--anthropic-gray);
+        }
+
+        /* Gradio overrides */
+        .gradio-container {
+            max-width: 1400px !important;
+        }
+
+        /* Card styling */
+        .card-title {
+            margin: 0 0 8px 0;
+            font-size: 16px;
+            font-weight: 600;
+            color: var(--anthropic-slate);
+            display: flex;
+            align-items: center;
+            gap: 8px;
+        }
+
+        .card-title svg {
+            width: 20px;
+            height: 20px;
+            stroke: var(--anthropic-terracotta);
+        }
+
+        .card-description {
+            margin: 0 0 16px 0;
+            color: var(--anthropic-gray);
+            font-size: 14px;
+        }
+
+        /* NVD Toggle Switch Styling */
+        .nvd-toggle {
+            margin: 0 !important;
+            padding: 0 !important;
+        }
+
+        .nvd-toggle input[type="checkbox"] {
+            appearance: none;
+            -webkit-appearance: none;
+            width: 48px;
+            height: 26px;
+            background: #e5e7eb;          
+            border-radius: 13px;
+            position: relative;
+            cursor: pointer;
+            transition: background 0.3s ease;
+            margin: 0;
+        }
+
+        .nvd-toggle input[type="checkbox"]:checked {
+            background: var(--anthropic-terracotta);
+        }
+
+        .nvd-toggle input[type="checkbox"]::before {
+            content: "";
+            position: absolute;
+            width: 22px;
+            height: 22px;
+            border-radius: 50%;
+            background: white;
+            top: 2px;
+            left: 2px;
+            transition: left 0.3s ease;
+            box-shadow: 0 2px 4px rgba(0, 0, 0, 0.2);
+        }
+
+        .nvd-toggle input[type="checkbox"]:checked::before {
+            left: 24px;
+        }
+
+        .nvd-toggle label {
+            display: flex;
+            align-items: center;
+            cursor: pointer;
+        }
+
+        /* Tooltip positioning */
+        .info-icon-tooltip {
+            position: relative;
+        }
+
+        /* Show tooltip on hover over the NVD label row */
+        .nvd-label-row:hover .info-tooltip-text {
+            visibility: visible !important;
+            opacity: 1 !important;
+        }
+
+        /* Info badge - subtle, minimal */
+        .info-badge {
+            display: flex;
+            align-items: center;
+            gap: 12px;
+            padding: 16px;
+            background: #ffffff;
+            border: 1px solid var(--anthropic-border);
+            border-radius: 6px;
+            margin-top: 20px;
+        }
+
+        .info-badge-icon svg {
+            width: 24px;
+            height: 24px;
+            stroke: var(--anthropic-terracotta);
+        }
+
+        .info-badge-content {
+            flex: 1;
+        }
+
+        .info-badge-title {
+            font-size: 14px;
+            font-weight: 600;
+            color: var(--anthropic-slate);
+            margin-bottom: 2px;
+        }
+
+        .info-badge-subtitle {
+            font-size: 12px;
+            color: var(--anthropic-gray);
+        }
+
+        /* Analyze button - Anthropic terracotta */
+        .analyze-button {
+            height: 100% !important;
+            min-height: 56px !important;
+            font-size: 15px !important;
+            font-weight: 600 !important;
+            display: flex !important;
+            align-items: center !important;
+            justify-content: center !important;
+            gap: 8px !important;
+            background: var(--anthropic-terracotta) !important;
+            border: none !important;
+            border-radius: 6px !important;
+            transition: background 0.2s ease !important;
+        }
+
+        .analyze-button:hover {
+            background: var(--anthropic-terracotta-hover) !important;
+        }
+
+        .analyze-button svg {
+            width: 20px;
+            height: 20px;
+            stroke: white;
+        }
+
+        /* Reset button - prominent */
+        .reset-button {
+            min-height: 44px !important;
+            font-size: 15px !important;
+            font-weight: 600 !important;
+            background: var(--anthropic-terracotta) !important;
+            border: none !important;
+            border-radius: 6px !important;
+            color: white !important;
+            transition: background 0.2s ease !important;
+        }
+
+        .reset-button:hover {
+            background: var(--anthropic-terracotta-hover) !important;
+        }
+
+        /* Help button - outlined, distinct from primary actions */
+        .help-button {
+            min-height: 44px !important;
+            font-size: 15px !important;
+            font-weight: 600 !important;
+            background: transparent !important;
+            border: 2px solid var(--anthropic-border) !important;
+            border-radius: 6px !important;
+            color: var(--anthropic-gray) !important;
+            transition: all 0.2s ease !important;
+            margin-top: 8px !important;
+        }
+
+        .help-button:hover {
+            border-color: var(--anthropic-terracotta) !important;
+            color: var(--anthropic-terracotta) !important;
+            background: rgba(217, 119, 87, 0.05) !important;
+        }
+
+        /* Export button styling */
+        .export-button {
+            display: inline-flex !important;
+            align-items: center !important;
+            gap: 6px !important;
+        }
+
+        /* Button icons via pseudo-elements */
+        .analyze-button::before {
+            content: "";
+            display: inline-block;
+            width: 20px;
+            height: 20px;
+            background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='20' height='20' viewBox='0 0 24 24' fill='none' stroke='white' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Ccircle cx='11' cy='11' r='8'%3E%3C/circle%3E%3Cpath d='m21 21-4.35-4.35'%3E%3C/path%3E%3C/svg%3E");
+            background-size: contain;
+            background-repeat: no-repeat;
+        }
+
+        .export-button::before {
+            content: "";
+            display: inline-block;
+            width: 18px;
+            height: 18px;
+            background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='18' height='18' viewBox='0 0 24 24' fill='none' stroke='white' stroke-width='2' stroke-linecap='round' stroke-linejoin='round'%3E%3Cpath d='M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4'%3E%3C/path%3E%3Cpolyline points='7 10 12 15 17 10'%3E%3C/polyline%3E%3Cline x1='12' y1='15' x2='12' y2='3'%3E%3C/line%3E%3C/svg%3E");
+            background-size: contain;
+            background-repeat: no-repeat;
+        }
+
+        /* Severity badges - static visual indicators */
+        .severity-badge {
+            position: relative;
+        }
+
+        /* JavaScript for moving NVD toggle */
+        <script>
+        document.addEventListener('DOMContentLoaded', function() {
+            // Move NVD toggle into the container
+            setTimeout(function() {
+                const container = document.getElementById('nvd-toggle-container');
+                const toggle = document.querySelector('.nvd-toggle');
+                if (container && toggle) {
+                    container.appendChild(toggle);
+                }
+            }, 100);
+        });
+        </script>
+        """
+
+        with gr.Blocks(title="Security Auditor") as app:
+
+            # Header with logo
+            gr.HTML("""
+            <div class="logo-container">
+                <div class="logo-icon">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"
+                         fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                        <rect x="3" y="11" width="18" height="11" rx="2" ry="2"></rect>
+                        <path d="M7 11V7a5 5 0 0 1 10 0v4"></path>
+                    </svg>
+                </div>
+                <div>
+                    <h1 style="margin: 0; font-size: 18px; font-weight: 700; color: #131314;">Security Auditor</h1>
+                </div>
+            </div>
+            """)
+
+            gr.Markdown("## Scan your application code for security vulnerabilities and get remediation guidance")
+
+            # Main layout
+            with gr.Row():
+                # Sidebar
+                with gr.Column(scale=1, min_width=250):
+                    # Analysis Mode with integrated settings
+                    with gr.Group():
+                        gr.HTML('''<div class="mode-selector-header">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24"
+                                 fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                <line x1="12" y1="20" x2="12" y2="10"></line>
+                                <line x1="18" y1="20" x2="18" y2="4"></line>
+                                <line x1="6" y1="20" x2="6" y2="16"></line>
+                            </svg>
+                            Analysis Mode
+                        </div>''')
+
+                        scan_mode = gr.Radio(
+                            choices=["Local Directory", "Remote URL"],
+                            value="Local Directory",
+                            label="",
+                            container=False,
+                            interactive=True
+                        )
+
+                        # NVD Enrichment toggle with info icon - side by side layout
+                        gr.HTML('''
+                        <div style="display: flex; align-items: center; justify-content: space-between; margin-top: 16px; gap: 12px;">
+                            <div class="nvd-label-row" style="display: flex; align-items: center; gap: 8px; flex-shrink: 1; min-width: 0; cursor: default;">
+                                <span style="
+                                    font-size: 14px;
+                                    font-weight: 600;
+                                    color: #131314;
+                                    white-space: nowrap;
+                                ">NVD Enriched Scan Results</span>
+                                <div class="info-icon-tooltip" style="position: relative; display: inline-flex; align-items: center; flex-shrink: 0;">
+                                    <svg class="info-icon" xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24"
+                                         fill="none" stroke="#6b7280" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                                         style="cursor: pointer; display: block;"
+                                         onclick="toggleTooltip(this)">
+                                        <circle cx="12" cy="12" r="10"></circle>
+                                        <line x1="12" y1="16" x2="12" y2="12"></line>
+                                        <line x1="12" y1="8" x2="12.01" y2="8"></line>
+                                    </svg>
+                                    <div class="info-tooltip-text" style="
+                                        visibility: hidden;
+                                        opacity: 0;
+                                        position: absolute;
+                                        bottom: calc(100% + 8px);
+                                        left: 50%;
+                                        transform: translateX(-50%);
+                                        background: #131314;
+                                        color: white;
+                                        padding: 12px 16px;
+                                        border-radius: 6px;
+                                        font-size: 13px;
+                                        font-weight: 400;
+                                        white-space: normal;
+                                        width: 280px;
+                                        line-height: 1.5;
+                                        z-index: 9999;
+                                        transition: opacity 0.2s, visibility 0.2s;
+                                        box-shadow: 0 4px 12px rgba(0, 0, 0, 0.25);
+                                    ">
+                                        Enriches scan results with related Common Vulnerabilities and Exposures (CVE) references from the National Vulnerability Database (NVD).
+                                    </div>
+                                </div>
+                            </div>
+                            <div id="nvd-toggle-container" style="flex-shrink: 0;"></div>
+                        </div>
+                        <script>
+                        (function() {
+                            var outsideClickHandler = null;
+
+                            window.toggleTooltip = function(icon) {
+                                var tooltip = icon.nextElementSibling;
+                                var isVisible = tooltip.style.visibility === 'visible';
+
+                                // Hide all tooltips first
+                                document.querySelectorAll('.info-tooltip-text').forEach(function(t) {
+                                    t.style.visibility = 'hidden';
+                                    t.style.opacity = '0';
+                                });
+
+                                // Remove any existing outside click handler
+                                if (outsideClickHandler) {
+                                    document.removeEventListener('click', outsideClickHandler);
+                                    outsideClickHandler = null;
+                                }
+
+                                if (!isVisible) {
+                                    tooltip.style.visibility = 'visible';
+                                    tooltip.style.opacity = '1';
+
+                                    setTimeout(function() {
+                                        outsideClickHandler = function(e) {
+                                            if (!icon.contains(e.target) && !tooltip.contains(e.target)) {
+                                                tooltip.style.visibility = 'hidden';
+                                                tooltip.style.opacity = '0';
+                                                document.removeEventListener('click', outsideClickHandler);
+                                                outsideClickHandler = null;
+                                            }
+                                        };
+                                        document.addEventListener('click', outsideClickHandler);
+                                    }, 100);
+                                }
+                            };
+                        })();
+                        </script>
+                        ''')
+
+                        nvd_enrichment = gr.Checkbox(
+                            label=None,
+                            value=True,
+                            elem_classes=["nvd-toggle"],
+                            container=False,
+                            show_label=False
+                        )
+
+                    
+                    # Not necessary to display Actions label with custom lightbolt icon as there is only one action.
+                    # gr.HTML('''<div class="section-header">
+                    #     <svg xmlns="http://www.w3.org/2000/svg" width="18" height="18" viewBox="0 0 24 24"
+                    #          fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                    #         <polygon points="13 2 3 14 12 14 11 22 21 10 12 10 13 2"></polygon>
+                    #     </svg>
+                    #     Actions
+                    # </div>''')
+
+                    reset_btn = gr.Button("Reset", variant="primary", size="lg", elem_classes=["reset-button"])
+
+                    help_btn = gr.Button("Help", variant="secondary", size="lg", elem_classes=["help-button"])
+
+                    # Info badge - Engine information
+                    gr.HTML('''
+                    <div class="info-badge">
+                        <div class="info-badge-icon">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"
+                                 fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                <path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"></path>
+                            </svg>
+                        </div>
+                        <div class="info-badge-content">
+                            <div class="info-badge-title">SAST + DAST + NVD</div>
+                            <div class="info-badge-subtitle">40+ Vulnerability Checks</div>
+                        </div>
+                    </div>
+                    ''')
+
+                # Main content area
+                with gr.Column(scale=3):
+
+                    # Input section (changes based on mode)
+                    with gr.Group():
+                        # Local Directory mode
+                        with gr.Column(visible=True) as local_mode:
+                            gr.HTML("""
+                            <div style="background: white; border: 1px solid #e5e7eb; border-radius: 12px; padding: 20px; margin-bottom: 16px;">
+                                <h3 class="card-title">
+                                    <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24"
+                                         fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                        <path d="M22 19a2 2 0 0 1-2 2H4a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h5l2 3h9a2 2 0 0 1 2 2z"></path>
+                                    </svg>
+                                    Application Directory
+                                </h3>
+                                <p class="card-description">Scan local directory containing the application code.</p>
+                            </div>
+                            """)
+
+                            file_upload = gr.File(
+                                label="Upload Files - Total Size Maximum 25 MB",
+                                file_count="multiple",
+                                file_types=[".py", ".js", ".ts", ".java", ".php", ".go", ".rb", ".c", ".cpp", ".cs", ".swift", ".kt", ".scala", ".rs", ".jsx", ".tsx"],
+                                height=120
+                            )
+
+                            gr.HTML("""
+                            <p style="color: #9ca3af; font-size: 12px; margin: -8px 0 16px 0; line-height: 1.5;">
+                                Accepted: .py, .js, .ts, .java, .php, .go, .rb, .c, .cpp, .cs, .swift, .kt, .scala, .rs, .jsx, .tsx
+                            </p>
+                            """)
+
+                            directory_path = gr.Textbox(
+                                label="Or Enter Directory Path",
+                                placeholder="C:/Projects/my-application",
+                                lines=2,
+                                max_lines=3
+                            )
+
+                            analyze_btn_local = gr.Button(
+                                "Analyze",
+                                variant="primary",
+                                size="lg",
+                                elem_classes=["analyze-button"]
+                            )
+
+                        # Remote URL mode
+                        with gr.Column(visible=False) as url_mode:
+                            gr.HTML("""
+                            <div style="background: white; border: 1px solid #e5e7eb; border-radius: 12px; padding: 20px; margin-bottom: 16px;">
+                                <h3 class="card-title">
+                                    <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24"
+                                         fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                                        <circle cx="12" cy="12" r="10"></circle>
+                                        <line x1="2" y1="12" x2="22" y2="12"></line>
+                                        <path d="M12 2a15.3 15.3 0 0 1 4 10 15.3 15.3 0 0 1-4 10 15.3 15.3 0 0 1-4-10 15.3 15.3 0 0 1 4-10z"></path>
+                                    </svg>
+                                    Application URL
+                                </h3>
+                                <p class="card-description">Scan remote web application or deployment.</p>
+                            </div>
+                            """)
+
+                            web_url = gr.Textbox(
+                                label="Web Application URL",
+                                placeholder="https://your-app.example.com",
+                                lines=2,
+                                max_lines=3
+                            )
+
+                            analyze_btn_url = gr.Button(
+                                "Analyze",
+                                variant="primary",
+                                size="lg",
+                                elem_classes=["analyze-button"]
+                            )
+
+                    # Progress indicator
+                    progress_box = gr.HTML(value=create_empty_state())
+
+                    # Results section
+                    results_section = gr.Column(visible=False)
+                    with results_section:
+                        # Analysis Summary
+                        summary_html = gr.HTML()
+
+                        # Security Findings
+                        gr.HTML("""
+                        <h2 style="
+                            margin: 16px 0 13px 0;
+                            font-size: 20px;
+                            font-weight: 700;
+                            color: #131314;
+                            display: flex;
+                            align-items: center;
+                            gap: 8px;
+                        ">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24"
+                                 fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                                 style="stroke: #d97757;">
+                                <path d="M10.29 3.86L1.82 18a2 2 0 0 0 1.71 3h16.94a2 2 0 0 0 1.71-3L13.71 3.86a2 2 0 0 0-3.42 0z"></path>
+                                <line x1="12" y1="9" x2="12" y2="13"></line>
+                                <line x1="12" y1="17" x2="12.01" y2="17"></line>
+                            </svg>
+                            Security Findings
+                        </h2>
+                        """)
+
+                        findings_count = gr.HTML()
+                        findings_html = gr.HTML()
+
+                        # Export button
+                        with gr.Row():
+                            export_json_btn = gr.Button(
+                                "Export JSON Report",
+                                variant="primary",
+                                size="lg",
+                                elem_classes=["export-button"]
+                            )
+                            export_md_btn = gr.Button(
+                                "Export Markdown Report",
+                                variant="primary",
+                                size="lg",
+                                elem_classes=["export-button"]
+                            )
+
+                        download_file = gr.File(label="Download Report", visible=False)
+                        download_file_md = gr.File(label="Download Markdown Report", visible=False)
+
+            # Event handlers
+
+            def toggle_mode(mode):
+                """Toggle visibility based on selected mode."""
+                return {
+                    local_mode: gr.update(visible=(mode == "Local Directory")),
+                    url_mode: gr.update(visible=(mode == "Remote URL"))
+                }
+
+            scan_mode.change(
+                fn=toggle_mode,
+                inputs=[scan_mode],
+                outputs=[local_mode, url_mode]
+            )
+
+            def reset_interface():
+                """Reset the interface to initial state."""
+                return (
+                    create_empty_state(),  # progress_box
+                    gr.update(visible=False),  # results_section
+                    "",  # summary_html
+                    "",  # findings_count
+                    "",  # findings_html
+                    None,  # file_upload
+                    "",  # directory_path
+                    "",  # web_url
+                )
+
+            reset_btn.click(
+                fn=reset_interface,
+                outputs=[
+                    progress_box,
+                    results_section,
+                    summary_html,
+                    findings_count,
+                    findings_html,
+                    file_upload,
+                    directory_path,
+                    web_url
+                ]
+            )
+
+            help_btn.click(
+                fn=None,
+                inputs=[],
+                outputs=[],
+                js=f"() => {{ const html = {self._help_js}; const blob = new Blob([html], {{type:'text/html;charset=utf-8'}}); window.open(URL.createObjectURL(blob), '_blank'); }}"
+            )
+
+            def scan_local_files(files, dir_path, nvd_check):
+                """Handle local file/directory scanning."""
+                # Show loading state
+                yield (
+                    create_loading_state("Initializing scan..."),
+                    gr.update(visible=False),
+                    "", "", "", None, None
+                )
+
+                # Check if we have files or directory path
+                if not files and not dir_path:
+                    yield (
+                        """<div style="background: #fef2f2; border: 1px solid #fca5a5; border-radius: 12px; padding: 20px; color: #dc2626;">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24"
+                             fill="none" stroke="#dc2626" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                             style="display: inline-block; vertical-align: middle; margin-right: 8px;">
+                            <circle cx="12" cy="12" r="10"></circle>
+                            <line x1="15" y1="9" x2="9" y2="15"></line>
+                            <line x1="9" y1="9" x2="15" y2="15"></line>
+                        </svg>
+                        <strong>No input provided</strong><br/>
+                        Please upload files or enter a directory path.
+                        </div>""",
+                        gr.update(visible=False),
+                        "", "", "", None, None
+                    )
+                    return
+
+                # Create session
+                session_id = str(uuid.uuid4())
+                session_dir = Path(tempfile.mkdtemp(prefix=f"audit_{session_id}_"))
+
+                try:
+                    target_path = session_dir
+
+                    # If files uploaded, save them
+                    if files:
+                        yield (
+                            create_loading_state(f"Uploading {len(files)} files..."),
+                            gr.update(visible=False),
+                            "", "", "", None, None
+                        )
+                        for file in files:
+                            dest = session_dir / Path(file.name).name
+                            shutil.copy(file.name, dest)
+
+                    # If directory path provided, use it directly (if exists)
+                    elif dir_path and os.path.exists(dir_path):
+                        target_path = Path(dir_path)
+
+                    yield (
+                        create_loading_state("Scanning for vulnerabilities..."),
+                        gr.update(visible=False),
+                        "", "", "", None, None
+                    )
+
+                    # Run scan (Modal backend or local)
+                    if self.use_modal_backend:
+                        # Use Modal backend API with parallel batch processing
+                        loop = asyncio.new_event_loop()
+                        asyncio.set_event_loop(loop)
+
+                        # Collect all file paths first
+                        file_paths = [
+                            file_path
+                            for file_path in target_path.rglob("*")
+                            if file_path.is_file() and file_path.suffix in ['.py', '.js', '.java', '.go', '.php', '.rb', '.rs', '.cpp', '.c', '.ts', '.jsx', '.tsx']
+                        ]
+
+                        # Read files in parallel
+                        yield (
+                            create_loading_state(f"Reading {len(file_paths)} files in parallel..."),
+                            gr.update(visible=False),
+                            "", "", "", None, None
+                        )
+
+                        batch_files = loop.run_until_complete(
+                            self.read_files_parallel(file_paths, target_path, max_workers=PARALLEL_FILE_READING_WORKERS)
+                        )
+
+                        # Process files in parallel using batch endpoint
+                        # Split into chunks if batch is too large (Modal backend limit)
+                        all_vulnerabilities = []
+
+                        if len(batch_files) <= CHUNK_SIZE:
+                            # Single batch - process all files in parallel
+                            yield (
+                                create_loading_state(f"Processing {len(batch_files)} files in parallel on Modal..."),
+                                gr.update(visible=False),
+                                "", "", "", None, None
+                            )
+
+                            try:
+                                batch_result = loop.run_until_complete(
+                                    self._scan_batch_via_modal(batch_files)
+                                )
+
+                                if batch_result.get("success") and "results" in batch_result:
+                                    for file_result in batch_result["results"]:
+                                        if file_result.get("status") == "success" and "vulnerabilities" in file_result:
+                                            all_vulnerabilities.extend(file_result["vulnerabilities"])
+                                        elif file_result.get("status") == "error":
+                                            print(f"Error scanning {file_result.get('filename', 'unknown')}: {file_result.get('error', 'Unknown error')}")
+                            except Exception as e:
+                                print(f"Batch scan error: {e}")
+                                # Fall back to sequential processing on error
+                                for file_data in batch_files:
+                                    try:
+                                        modal_response = loop.run_until_complete(
+                                            self._scan_code_via_modal(file_data["code"], file_data["language"])
+                                        )
+                                        if modal_response.get("success") and "findings" in modal_response:
+                                            vulns = modal_response["findings"].get("vulnerabilities", [])
+                                            for v in vulns:
+                                                v["file_path"] = file_data["filename"]
+                                            all_vulnerabilities.extend(vulns)
+                                    except Exception as file_error:
+                                        print(f"Error scanning {file_data['filename']}: {file_error}")
+                        else:
+                            # Split into chunks and process all chunks in parallel
+                            chunks = [batch_files[i:i + CHUNK_SIZE] for i in range(0, len(batch_files), CHUNK_SIZE)]
+
+                            yield (
+                                create_loading_state(f"Processing {len(chunks)} chunks in parallel on Modal ({len(batch_files)} files total)..."),
+                                gr.update(visible=False),
+                                "", "", "", None, None
+                            )
+
+                            try:
+                                # Process all chunks in parallel
+                                chunk_results = loop.run_until_complete(
+                                    self.process_chunks_parallel(chunks)
+                                )
+
+                                # Aggregate results from all chunks
+                                for chunk_result in chunk_results:
+                                    if chunk_result.get("success") and "results" in chunk_result:
+                                        for file_result in chunk_result["results"]:
+                                            if file_result.get("status") == "success" and "vulnerabilities" in file_result:
+                                                all_vulnerabilities.extend(file_result["vulnerabilities"])
+                                            elif file_result.get("status") == "error":
+                                                print(f"Error scanning {file_result.get('filename', 'unknown')}: {file_result.get('error', 'Unknown error')}")
+                            except Exception as e:
+                                print(f"Parallel chunk processing error: {e}")
+
+                        loop.close()
+
+                        # Create result object compatible with UI
+                        result = ModalScanResult(
+                            {"success": True, "findings": {"vulnerabilities": all_vulnerabilities}},
+                            str(target_path),
+                            len(batch_files)
+                        )
+                    else:
+                        # Use local SecurityChecker with parallel processing
+                        loop = asyncio.new_event_loop()
+                        asyncio.set_event_loop(loop)
+
+                        # Determine number of workers based on CPU count
+                        import multiprocessing
+                        cpu_count = multiprocessing.cpu_count()
+                        max_workers = min(cpu_count * 2, 16)  # Use 2x CPU cores, max 16
+
+                        yield (
+                            create_loading_state(f"Scanning files in parallel (using {max_workers} workers)..."),
+                            gr.update(visible=False),
+                            "", "", "", None, None
+                        )
+
+                        result = loop.run_until_complete(
+                            self.checker.scan_local(
+                                str(target_path),
+                                include_nvd=nvd_check,
+                                max_workers=max_workers,
+                                use_parallel=True
+                            )
+                        )
+                        loop.close()
+
+                    # Generate HTML components
+                    summary = result.summary()
+                    summary_section = create_summary_section({
+                        'target': str(target_path),
+                        'files_scanned': result.files_scanned,
+                        'scan_type': 'local',
+                        'summary': summary
+                    })
+
+                    # Create filter script for severity badges
+                    filter_script = """
+                    <script>
+                    // Filter function called by severity badges
+                    window.filterBySeverityBadge = function(severity) {
+                        const allBadges = document.querySelectorAll('.severity-badge');
+                        const allCards = document.querySelectorAll('.finding-card');
+
+                        // Check if clicking the active badge (toggle off)
+                        const clickedBadge = document.querySelector('.severity-badge[data-severity="' + severity + '"]');
+                        const isActive = clickedBadge && clickedBadge.classList.contains('active');
+
+                        if (isActive) {
+                            // Show all findings
+                            allBadges.forEach(function(badge) {
+                                badge.classList.remove('active');
+                                badge.classList.remove('inactive');
+                            });
+                            allCards.forEach(function(card) {
+                                card.style.display = 'block';
+                            });
+                            updateFindingsCount(allCards.length);
+                        } else {
+                            // Filter by severity
+                            allBadges.forEach(function(badge) {
+                                if (badge.getAttribute('data-severity') === severity) {
+                                    badge.classList.add('active');
+                                    badge.classList.remove('inactive');
+                                } else {
+                                    badge.classList.remove('active');
+                                    badge.classList.add('inactive');
+                                }
+                            });
+
+                            var visibleCount = 0;
+                            allCards.forEach(function(card) {
+                                if (card.getAttribute('data-severity') === severity) {
+                                    card.style.display = 'block';
+                                    visibleCount++;
+                                } else {
+                                    card.style.display = 'none';
+                                }
+                            });
+
+                            updateFindingsCount(visibleCount);
+
+                            // Scroll to findings
+                            const firstCard = document.querySelector('.finding-card[style*="display: block"]');
+                            if (firstCard) {
+                                firstCard.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+                            }
+                        }
+                    }
+
+                    function updateFindingsCount(count) {
+                        const countElement = document.getElementById('findings-count-display');
+                        if (countElement) {
+                            countElement.innerHTML = 'Showing <strong>' + count + '</strong> finding' + (count !== 1 ? 's' : '');
+                        }
+                    }
+                    </script>
+                    """
+
+                    findings = ""
+                    if result.vulnerabilities:
+                        # Deduplicate vulnerabilities based on name, file, and line
+                        seen = set()
+                        unique_vulns = []
+                        for vuln in result.vulnerabilities:
+                            # Create unique key
+                            key = f"{vuln.name}|{vuln.file_path}|{vuln.line_number}"
+                            if key not in seen:
+                                seen.add(key)
+                                unique_vulns.append(vuln)
+
+                        findings_counter = f"""
+                        <div id="findings-count-display" style="
+                            color: #6b7280;
+                            font-size: 14px;
+                            margin: 13px 0 16px 0;
+                            padding: 12px;
+                            background: #f9fafb;
+                            border-radius: 8px;
+                        ">
+                            Showing <strong>{len(unique_vulns)}</strong> findings
+                        </div>
+                        """
+
+                        # Sort by severity
+                        severity_order = {
+                            RiskLevel.CRITICAL: 0,
+                            RiskLevel.HIGH: 1,
+                            RiskLevel.MEDIUM: 2,
+                            RiskLevel.LOW: 3,
+                            RiskLevel.INFO: 4
+                        }
+                        sorted_vulns = sorted(
+                            unique_vulns,
+                            key=lambda v: severity_order.get(v.risk_level, 5)
+                        )
+
+                        for vuln in sorted_vulns:
+                            findings += create_finding_card({
+                                'name': vuln.name,
+                                'risk_level': vuln.risk_level.name,
+                                'file_path': vuln.file_path,
+                                'line_number': vuln.line_number,
+                                'description': vuln.description,
+                                'cwe_id': vuln.cwe_id,
+                                'cve_ids': vuln.cve_ids,
+                                'remediation': vuln.remediation
+                            })
+                    else:
+                        findings_counter = ""
+                        findings = """
+                        <div style="
+                            background: #f0fdf4;
+                            border: 1px solid #86efac;
+                            border-radius: 12px;
+                            padding: 40px;
+                            text-align: center;
+                            color: #166534;
+                        ">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 24 24"
+                                 fill="none" stroke="#10b981" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                                 style="margin: 0 auto 16px; display: block;">
+                                <path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"></path>
+                                <polyline points="22 4 12 14.01 9 11.01"></polyline>
+                            </svg>
+                            <h3 style="margin: 0 0 8px 0; font-size: 20px; font-weight: 600;">No Vulnerabilities Found</h3>
+                            <p style="margin: 0; font-size: 14px;">Your code looks secure!</p>
+                        </div>
+                        """
+
+                    # Generate reports for download
+                    json_report = self.checker.generate_report(result, format="json")
+                    json_path = session_dir / "security_report.json"
+                    with open(json_path, 'w') as f:
+                        f.write(json_report)
+
+                    md_report = self.checker.generate_report(result, format="markdown")
+                    md_path = session_dir / "security_report.md"
+                    with open(md_path, 'w') as f:
+                        f.write(md_report)
+
+                    # Schedule cleanup
+                    self.active_sessions[session_id] = {
+                        'dir': session_dir,
+                        'created': datetime.now(),
+                        'json_path': json_path,
+                        'md_path': md_path
+                    }
+
+                    progress_msg = f"""
+                    <div style="
+                        background: #f0fdf4;
+                        border: 1px solid #86efac;
+                        border-radius: 12px;
+                        padding: 20px;
+                        color: #166534;
+                    ">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24"
+                             fill="none" stroke="#10b981" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                             style="display: inline-block; vertical-align: middle; margin-right: 8px;">
+                            <path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"></path>
+                            <polyline points="22 4 12 14.01 9 11.01"></polyline>
+                        </svg>
+                        <strong>Scan complete!</strong><br/>
+                        Files scanned: {result.files_scanned} | Vulnerabilities found: {summary['total_vulnerabilities']}
+                    </div>
+                    """
+
+                    yield (
+                        progress_msg,
+                        gr.update(visible=True),
+                        summary_section + filter_script,
+                        findings_counter,
+                        findings,
+                        str(json_path),
+                        str(md_path)
+                    )
+
+                except Exception as e:
+                    error_msg = f"""
+                    <div style="
+                        background: #fef2f2;
+                        border: 1px solid #fca5a5;
+                        border-radius: 12px;
+                        padding: 20px;
+                        color: #dc2626;
+                    ">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24"
+                             fill="none" stroke="#dc2626" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                             style="display: inline-block; vertical-align: middle; margin-right: 8px;">
+                            <circle cx="12" cy="12" r="10"></circle>
+                            <line x1="15" y1="9" x2="9" y2="15"></line>
+                            <line x1="9" y1="9" x2="15" y2="15"></line>
+                        </svg>
+                        <strong>Scan failed</strong><br/>
+                        {str(e)}
+                    </div>
+                    """
+                    yield (
+                        error_msg,
+                        gr.update(visible=False),
+                        "", "", "", None, None
+                    )
+
+            def scan_web_app(url, nvd_check):
+                """Handle web application scanning."""
+                yield (
+                    create_loading_state("Scanning web application..."),
+                    gr.update(visible=False),
+                    "", "", "", None, None
+                )
+
+                if not url:
+                    yield (
+                        """<div style="background: #fef2f2; border: 1px solid #fca5a5; border-radius: 12px; padding: 20px; color: #dc2626;">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24"
+                             fill="none" stroke="#dc2626" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                             style="display: inline-block; vertical-align: middle; margin-right: 8px;">
+                            <circle cx="12" cy="12" r="10"></circle>
+                            <line x1="15" y1="9" x2="9" y2="15"></line>
+                            <line x1="9" y1="9" x2="15" y2="15"></line>
+                        </svg>
+                        <strong>No URL provided</strong><br/>
+                        Please enter a web application URL.
+                        </div>""",
+                        gr.update(visible=False),
+                        "", "", "", None, None
+                    )
+                    return
+
+                try:
+                    # Ensure URL has protocol
+                    if not url.startswith(('http://', 'https://')):
+                        url = 'https://' + url
+
+                    # Run scan
+                    loop = asyncio.new_event_loop()
+                    asyncio.set_event_loop(loop)
+                    result = loop.run_until_complete(
+                        self.checker.scan_web(url, include_nvd=False)
+                    )
+                    loop.close()
+
+                    # Generate HTML components (similar to local scan)
+                    summary = result.summary()
+                    summary_section = create_summary_section({
+                        'target': url,
+                        'files_scanned': 0,
+                        'scan_type': 'web',
+                        'summary': summary
+                    })
+
+                    # Create filter script for severity badges
+                    filter_script = """
+                    <script>
+                    // Filter function called by severity badges
+                    window.filterBySeverityBadge = function(severity) {
+                        const allBadges = document.querySelectorAll('.severity-badge');
+                        const allCards = document.querySelectorAll('.finding-card');
+
+                        // Check if clicking the active badge (toggle off)
+                        const clickedBadge = document.querySelector('.severity-badge[data-severity="' + severity + '"]');
+                        const isActive = clickedBadge && clickedBadge.classList.contains('active');
+
+                        if (isActive) {
+                            // Show all findings
+                            allBadges.forEach(function(badge) {
+                                badge.classList.remove('active');
+                                badge.classList.remove('inactive');
+                            });
+                            allCards.forEach(function(card) {
+                                card.style.display = 'block';
+                            });
+                            updateFindingsCount(allCards.length);
+                        } else {
+                            // Filter by severity
+                            allBadges.forEach(function(badge) {
+                                if (badge.getAttribute('data-severity') === severity) {
+                                    badge.classList.add('active');
+                                    badge.classList.remove('inactive');
+                                } else {
+                                    badge.classList.remove('active');
+                                    badge.classList.add('inactive');
+                                }
+                            });
+
+                            var visibleCount = 0;
+                            allCards.forEach(function(card) {
+                                if (card.getAttribute('data-severity') === severity) {
+                                    card.style.display = 'block';
+                                    visibleCount++;
+                                } else {
+                                    card.style.display = 'none';
+                                }
+                            });
+
+                            updateFindingsCount(visibleCount);
+
+                            // Scroll to findings
+                            const firstCard = document.querySelector('.finding-card[style*="display: block"]');
+                            if (firstCard) {
+                                firstCard.scrollIntoView({ behavior: 'smooth', block: 'nearest' });
+                            }
+                        }
+                    }
+
+                    function updateFindingsCount(count) {
+                        const countElement = document.getElementById('findings-count-display');
+                        if (countElement) {
+                            countElement.innerHTML = 'Showing <strong>' + count + '</strong> finding' + (count !== 1 ? 's' : '');
+                        }
+                    }
+                    </script>
+                    """
+
+                    # Deduplicate vulnerabilities
+                    seen = set()
+                    unique_vulns = []
+                    for vuln in result.vulnerabilities:
+                        # Create unique key (for URL scans, line_number is usually 0, so use name and description)
+                        key = f"{vuln.name}|{vuln.description}"
+                        if key not in seen:
+                            seen.add(key)
+                            unique_vulns.append(vuln)
+
+                    findings_counter = f"""
+                    <div id="findings-count-display" style="color: #6b7280; font-size: 14px; margin: 13px 0 16px 0; padding: 12px; background: #f9fafb; border-radius: 8px;">
+                        Showing <strong>{len(unique_vulns)}</strong> findings
+                    </div>
+                    """
+
+                    findings = ""
+                    if unique_vulns:
+                        for vuln in unique_vulns:
+                            findings += create_finding_card({
+                                'name': vuln.name,
+                                'risk_level': vuln.risk_level.name,
+                                'file_path': url,
+                                'line_number': 0,
+                                'description': vuln.description,
+                                'cwe_id': vuln.cwe_id,
+                                'cve_ids': vuln.cve_ids,
+                                'remediation': vuln.remediation
+                            })
+                    else:
+                        findings_counter = ""
+                        findings = """
+                        <div style="background: #f0fdf4; border: 1px solid #86efac; border-radius: 12px; padding: 40px; text-align: center; color: #166534;">
+                            <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 24 24"
+                                 fill="none" stroke="#10b981" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                                 style="margin: 0 auto 16px; display: block;">
+                                <path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"></path>
+                                <polyline points="22 4 12 14.01 9 11.01"></polyline>
+                            </svg>
+                            <h3 style="margin: 0 0 8px 0;">No Issues Found</h3>
+                            <p style="margin: 0;">Web application appears to be configured securely.</p>
+                        </div>
+                        """
+
+                    # Generate report
+                    session_id = str(uuid.uuid4())
+                    session_dir = Path(tempfile.mkdtemp(prefix=f"audit_{session_id}_"))
+                    json_report = self.checker.generate_report(result, format="json")
+                    json_path = session_dir / "security_report.json"
+                    with open(json_path, 'w') as f:
+                        f.write(json_report)
+
+                    md_report = self.checker.generate_report(result, format="markdown")
+                    md_path = session_dir / "security_report.md"
+                    with open(md_path, 'w') as f:
+                        f.write(md_report)
+
+                    progress_msg = f"""
+                    <div style="background: #f0fdf4; border: 1px solid #86efac; border-radius: 12px; padding: 20px; color: #166534;">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24"
+                             fill="none" stroke="#10b981" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                             style="display: inline-block; vertical-align: middle; margin-right: 8px;">
+                            <path d="M22 11.08V12a10 10 0 1 1-5.93-9.14"></path>
+                            <polyline points="22 4 12 14.01 9 11.01"></polyline>
+                        </svg>
+                        <strong>Scan complete!</strong><br/>
+                        Vulnerabilities found: {summary['total_vulnerabilities']}
+                    </div>
+                    """
+
+                    yield (
+                        progress_msg,
+                        gr.update(visible=True),
+                        summary_section + filter_script,
+                        findings_counter,
+                        findings,
+                        str(json_path),
+                        str(md_path)
+                    )
+
+                except Exception as e:
+                    error_msg = f"""
+                    <div style="background: #fef2f2; border: 1px solid #fca5a5; border-radius: 12px; padding: 20px; color: #dc2626;">
+                        <svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24"
+                             fill="none" stroke="#dc2626" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                             style="display: inline-block; vertical-align: middle; margin-right: 8px;">
+                            <circle cx="12" cy="12" r="10"></circle>
+                            <line x1="15" y1="9" x2="9" y2="15"></line>
+                            <line x1="9" y1="9" x2="15" y2="15"></line>
+                        </svg>
+                        <strong>Scan failed</strong><br/>
+                        {str(e)}
+                    </div>
+                    """
+                    yield (
+                        error_msg,
+                        gr.update(visible=False),
+                        "", "", "", None, None
+                    )
+
+            # Connect event handlers
+            analyze_btn_local.click(
+                fn=scan_local_files,
+                inputs=[file_upload, directory_path, nvd_enrichment],
+                outputs=[
+                    progress_box,
+                    results_section,
+                    summary_html,
+                    findings_count,
+                    findings_html,
+                    download_file,
+                    download_file_md
+                ]
+            )
+
+            analyze_btn_url.click(
+                fn=scan_web_app,
+                inputs=[web_url, nvd_enrichment],
+                outputs=[
+                    progress_box,
+                    results_section,
+                    summary_html,
+                    findings_count,
+                    findings_html,
+                    download_file,
+                    download_file_md
+                ]
+            )
+
+            def export_json():
+                """Export JSON report."""
+                return gr.update(visible=True)
+
+            def export_markdown():
+                """Export Markdown report."""
+                return gr.update(visible=True)
+
+            export_json_btn.click(
+                fn=export_json,
+                outputs=[download_file]
+            )
+
+            export_md_btn.click(
+                fn=export_markdown,
+                outputs=[download_file_md]
+            )
+
+        return app
+
+    def cleanup_old_sessions(self):
+        """Remove sessions older than cleanup_interval."""
+        now = datetime.now()
+        to_remove = []
+
+        for session_id, session in self.active_sessions.items():
+            age = (now - session['created']).total_seconds()
+            if age > self.cleanup_interval:
+                shutil.rmtree(session['dir'], ignore_errors=True)
+                to_remove.append(session_id)
+
+        for session_id in to_remove:
+            del self.active_sessions[session_id]
+
+    def launch(self, **kwargs):
+        """Launch the Gradio application."""
+        # Start cleanup background task
+        def cleanup_loop():
+            while True:
+                time.sleep(600)  # Check every 10 minutes
+                self.cleanup_old_sessions()
+
+        cleanup_thread = threading.Thread(target=cleanup_loop, daemon=True)
+        cleanup_thread.start()
+
+        # Create and launch interface
+        interface = self.create_interface()
+        interface.queue()
+
+        # In Gradio 6.0, theme and css are passed to launch() instead of Blocks()
+        interface.launch(
+            theme=self.theme,
+            css=self.custom_css,
+            **kwargs
+        )
+
+
+def main():
+    """Main entry point."""
+    app = ModernSecurityAuditorApp()
+    app.launch(
+        server_name="0.0.0.0",
+        server_port=7860,
+        share=False
+    )
+
+
+if __name__ == "__main__":
+    main()

help.html

@@ -0,0 +1,539 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Security Auditor - Help Guide</title>
+    <style>
+        :root {
+            --bg: #faf9f6;
+            --text: #131314;
+            --accent: #d97757;
+            --accent-hover: #cc6944;
+            --gray: #6b7280;
+            --light-gray: #9ca3af;
+            --border: #e5e7eb;
+            --card-bg: #ffffff;
+            --critical: #dc2626;
+            --critical-bg: #fef2f2;
+            --critical-border: #fca5a5;
+            --high: #ea580c;
+            --high-bg: #fff7ed;
+            --high-border: #fdba74;
+            --medium: #d97706;
+            --medium-bg: #fffbeb;
+            --medium-border: #fcd34d;
+            --low: #0d9488;
+            --low-bg: #f0fdfa;
+            --low-border: #5eead4;
+            --info-color: #6b7280;
+            --info-bg: #f9fafb;
+            --info-border: #d1d5db;
+        }
+
+        * { margin: 0; padding: 0; box-sizing: border-box; }
+
+        body {
+            font-family: system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
+            background: var(--bg);
+            color: var(--text);
+            line-height: 1.7;
+            max-width: 920px;
+            margin: 0 auto;
+            padding: 40px 24px 60px;
+        }
+
+        /* Header */
+        .header {
+            display: flex;
+            align-items: center;
+            gap: 14px;
+            padding-bottom: 24px;
+            border-bottom: 1px solid var(--border);
+            margin-bottom: 32px;
+        }
+        .header-icon {
+            width: 44px;
+            height: 44px;
+            background: var(--text);
+            border-radius: 8px;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            flex-shrink: 0;
+        }
+        .header-icon svg { width: 24px; height: 24px; stroke: white; fill: none; }
+        .header-title { font-size: 24px; font-weight: 700; }
+        .header-subtitle { font-size: 14px; color: var(--gray); margin-top: 2px; }
+
+        /* Headings */
+        h2 {
+            font-size: 22px;
+            font-weight: 700;
+            margin: 48px 0 16px;
+            padding-bottom: 8px;
+            border-bottom: 2px solid var(--border);
+            display: flex;
+            align-items: center;
+            gap: 10px;
+        }
+        h2 .h-num {
+            display: inline-flex;
+            align-items: center;
+            justify-content: center;
+            width: 30px;
+            height: 30px;
+            background: var(--accent);
+            color: white;
+            border-radius: 50%;
+            font-size: 14px;
+            font-weight: 700;
+            flex-shrink: 0;
+        }
+        h3 {
+            font-size: 17px;
+            font-weight: 600;
+            margin: 28px 0 12px;
+            color: var(--text);
+        }
+
+        /* Paragraphs and lists */
+        p { margin: 0 0 14px; color: var(--text); }
+        ul, ol { margin: 0 0 16px; padding-left: 24px; }
+        li { margin: 6px 0; }
+
+        /* Links */
+        a { color: var(--accent); text-decoration: none; }
+        a:hover { color: var(--accent-hover); text-decoration: underline; }
+
+        /* Table of Contents */
+        .toc {
+            background: var(--card-bg);
+            border: 1px solid var(--border);
+            border-radius: 10px;
+            padding: 24px 28px;
+            margin: 0 0 40px;
+        }
+        .toc-title {
+            font-size: 15px;
+            font-weight: 700;
+            margin-bottom: 12px;
+            color: var(--text);
+        }
+        .toc ol { padding-left: 20px; margin: 0; }
+        .toc li { margin: 7px 0; font-size: 15px; }
+        .toc a { color: var(--accent); font-weight: 500; }
+
+        /* Cards */
+        .card {
+            background: var(--card-bg);
+            border: 1px solid var(--border);
+            border-radius: 10px;
+            padding: 20px 24px;
+            margin: 16px 0;
+        }
+        .card-label {
+            font-size: 12px;
+            font-weight: 600;
+            text-transform: uppercase;
+            letter-spacing: 0.05em;
+            color: var(--gray);
+            margin-bottom: 6px;
+        }
+
+        /* Steps */
+        .steps { counter-reset: step; list-style: none; padding-left: 0; }
+        .steps li {
+            counter-increment: step;
+            position: relative;
+            padding-left: 40px;
+            margin: 14px 0;
+        }
+        .steps li::before {
+            content: counter(step);
+            position: absolute;
+            left: 0;
+            top: 1px;
+            width: 26px;
+            height: 26px;
+            background: var(--accent);
+            color: white;
+            border-radius: 50%;
+            font-size: 13px;
+            font-weight: 700;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+        }
+
+        /* Severity badges */
+        .severity-sample {
+            display: inline-flex;
+            align-items: center;
+            gap: 8px;
+            padding: 8px 16px;
+            border-radius: 6px;
+            font-size: 13px;
+            font-weight: 600;
+            border: 2px solid;
+            margin: 4px 4px 4px 0;
+        }
+
+        /* Severity table */
+        .severity-table { width: 100%; border-collapse: collapse; margin: 16px 0; }
+        .severity-table th {
+            text-align: left;
+            padding: 12px 16px;
+            background: var(--bg);
+            border-bottom: 2px solid var(--border);
+            font-size: 13px;
+            font-weight: 600;
+            color: var(--gray);
+            text-transform: uppercase;
+            letter-spacing: 0.05em;
+        }
+        .severity-table td {
+            padding: 14px 16px;
+            border-bottom: 1px solid var(--border);
+            vertical-align: top;
+            font-size: 14px;
+        }
+        .severity-table tr:last-child td { border-bottom: none; }
+        .severity-tag {
+            display: inline-block;
+            padding: 3px 10px;
+            border-radius: 4px;
+            font-size: 12px;
+            font-weight: 700;
+            white-space: nowrap;
+        }
+
+        /* Screenshots */
+        .screenshot {
+            display: block;
+            max-width: 100%;
+            border: 1px solid var(--border);
+            border-radius: 10px;
+            margin: 20px 0;
+            box-shadow: 0 2px 8px rgba(0, 0, 0, 0.06);
+        }
+        .screenshot-caption {
+            font-size: 13px;
+            color: var(--gray);
+            text-align: center;
+            margin: -10px 0 20px;
+            font-style: italic;
+        }
+
+        /* Tip / Note boxes */
+        .tip {
+            background: var(--high-bg);
+            border-left: 4px solid var(--accent);
+            border-radius: 0 8px 8px 0;
+            padding: 14px 18px;
+            margin: 16px 0;
+            font-size: 14px;
+        }
+        .tip-label {
+            font-weight: 700;
+            color: var(--accent);
+            margin-bottom: 4px;
+        }
+
+        /* Footer */
+        .footer {
+            margin-top: 60px;
+            padding-top: 24px;
+            border-top: 1px solid var(--border);
+            text-align: center;
+            color: var(--gray);
+            font-size: 13px;
+        }
+
+        /* Keyboard shortcut styling */
+        kbd {
+            background: var(--bg);
+            border: 1px solid var(--border);
+            border-radius: 4px;
+            padding: 2px 6px;
+            font-size: 13px;
+            font-family: ui-monospace, 'SF Mono', Monaco, 'Cascadia Code', monospace;
+        }
+
+        /* Print */
+        @media print {
+            body { background: white; max-width: 100%; padding: 20px; }
+            .toc { break-after: page; }
+            .card, .severity-table tr { break-inside: avoid; }
+            .screenshot { max-width: 80%; margin: 12px auto; }
+            a { color: var(--text); }
+            h2 { break-after: avoid; }
+        }
+
+        /* Responsive */
+        @media (max-width: 640px) {
+            body { padding: 20px 16px 40px; }
+            .header-title { font-size: 20px; }
+            h2 { font-size: 19px; }
+            .severity-table th, .severity-table td { padding: 10px 10px; font-size: 13px; }
+        }
+    </style>
+</head>
+<body>
+
+    <!-- Header -->
+    <div class="header">
+        <div class="header-icon">
+            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <rect x="3" y="11" width="18" height="11" rx="2" ry="2"></rect>
+                <path d="M7 11V7a5 5 0 0 1 10 0v4"></path>
+            </svg>
+        </div>
+        <div>
+            <div class="header-title">Security Auditor</div>
+            <div class="header-subtitle">Help Guide</div>
+        </div>
+    </div>
+
+    <!-- Table of Contents -->
+    <nav class="toc">
+        <div class="toc-title">Contents</div>
+        <ol>
+            <li><a href="#getting-started">Getting Started</a></li>
+            <li><a href="#local-scan">Scanning a Local Directory</a></li>
+            <li><a href="#remote-scan">Scanning a Remote URL</a></li>
+            <li><a href="#understanding-results">Understanding Your Results</a></li>
+            <li><a href="#nvd-enrichment">National Vulnerability Database (NVD) Enrichment</a> <a href="https://nvd.nist.gov/general/cve-process" target="_blank" rel="noopener noreferrer">NVD CVE Process</a></li>
+            <li><a href="#severity-guide">Severity Levels Guide</a></li>
+        </ol>
+    </nav>
+
+    <!-- Section 1: Getting Started -->
+    <h2 id="getting-started"><span class="h-num">1</span> Getting Started</h2>
+
+    <p>
+        Security Auditor is a combined <strong>Static Application Security Testing (SAST)</strong> and
+        <strong>Dynamic Application Security Testing (DAST)</strong> platform that identifies security
+        vulnerabilities in your application code and web deployments. It performs <strong>40+ security checks</strong>
+        across two scanning modes.
+    </p>
+
+    <p>
+        The checks this tool performs overlap with the <strong><a href="https://owasp.org/www-project-top-ten/" target="_blank" rel="noopener noreferrer">Open Web Application Security Project (OWASP)</a></strong> Top Ten; many checks map to common OWASP categories such as Injection, Cross-Site Scripting (XSS), Broken Authentication, and Security Misconfiguration.
+    </p>
+
+    <div class="card">
+        <div class="card-label">Two Scanning Modes</div>
+        <ul>
+            <li><strong>Local Directory</strong> &mdash; Upload source code files or specify a directory path. The SAST engine scans your code for 28+ vulnerability patterns including SQL injection, XSS, command injection, hardcoded credentials, and more.</li>
+            <li><strong>Remote URL</strong> &mdash; Enter a web application URL. The DAST engine checks HTTP security headers, probes for exposed sensitive paths, verifies HTTPS configuration, and scans response content for information leaks.</li>
+        </ul>
+    </div>
+
+    <img src="/helpimg/NewGradioScreenshot_landingPage.png"
+         alt="Security Auditor landing page showing Local Directory mode selected"
+         class="screenshot" />
+    <p class="screenshot-caption">The Security Auditor landing page with Local Directory mode selected.</p>
+
+    <p>
+        <strong>Supported file types for local scanning:</strong><br />
+        <code>.py, .js, .ts, .java, .php, .go, .rb, .c, .cpp, .cs, .swift, .kt, .scala, .rs, .jsx, .tsx</code>
+    </p>
+
+    <!-- Section 2: Local Directory Scan -->
+    <h2 id="local-scan"><span class="h-num">2</span> Scanning a Local Directory</h2>
+
+    <p>Use this mode to scan application source code files for security vulnerabilities using static analysis.</p>
+
+    <ol class="steps">
+        <li>Select <strong>Local Directory</strong> in the Analysis Mode panel on the left sidebar.</li>
+        <li>Provide your code using one of two methods:
+            <ul>
+                <li><strong>Upload files</strong> &mdash; Drag and drop or click the upload area (total size maximum 25 MB).</li>
+                <li><strong>Enter a directory path</strong> &mdash; Type the full path to a local directory, e.g. <kbd>C:/Projects/my-application</kbd>.</li>
+            </ul>
+        </li>
+        <li>Optionally toggle <strong>NVD Enriched Scan Results</strong> on or off (see <a href="#nvd-enrichment">Section 5</a>).</li>
+        <li>Click the <strong>Analyze</strong> button.</li>
+        <li>Wait for the scan to complete. A progress indicator shows the current status.</li>
+    </ol>
+
+    <div class="tip">
+        <div class="tip-label">Tip</div>
+        When uploading files, you can select multiple files at once. The scanner analyses all uploaded files together, detecting cross-file vulnerability patterns.
+    </div>
+
+    <img src="/helpimg/NewGradioScreenshot_LocalAppResult.png"
+         alt="Local directory scan results showing Analysis Summary and Security Findings"
+         class="screenshot" />
+    <p class="screenshot-caption">Results from a local directory scan showing the Analysis Summary, severity badges, and individual finding cards.</p>
+
+    <!-- Section 3: Remote URL Scan -->
+    <h2 id="remote-scan"><span class="h-num">3</span> Scanning a Remote URL</h2>
+
+    <p>Use this mode to dynamically test a running web application for security misconfigurations and vulnerabilities.</p>
+
+    <ol class="steps">
+        <li>Select <strong>Remote URL</strong> in the Analysis Mode panel.</li>
+        <li>Enter the target web application URL in the <strong>Web Application URL</strong> field, e.g. <kbd>https://your-app.example.com</kbd>.</li>
+        <li>Click the <strong>Analyze</strong> button.</li>
+    </ol>
+
+    <h3>What Gets Checked</h3>
+    <div class="card">
+        <ul>
+            <li><strong>HTTP Security Headers</strong> &mdash; Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Strict-Transport-Security, Referrer-Policy, Permissions-Policy.</li>
+            <li><strong>Sensitive Path Exposure</strong> &mdash; Probes for common exposed paths such as <code>/.env</code>, <code>/.git/config</code>, <code>/admin</code>, <code>/phpinfo.php</code>, <code>/swagger.json</code>, and 15+ other paths.</li>
+            <li><strong>HTTPS Configuration</strong> &mdash; Verifies the application uses HTTPS rather than unencrypted HTTP.</li>
+            <li><strong>Response Content Analysis</strong> &mdash; Scans HTML responses for database error messages, stack trace disclosures, debug mode indicators, and sensitive data in comments.</li>
+            <li><strong>Server Version Disclosure</strong> &mdash; Detects if the server reveals its software version in response headers.</li>
+        </ul>
+    </div>
+
+    <img src="/helpimg/NewGradioScreenshot_RemoteURLResult.png"
+         alt="Remote URL scan results showing missing security headers and other findings"
+         class="screenshot" />
+    <p class="screenshot-caption">Results from a remote URL scan showing missing security headers and insecure HTTP connection findings.</p>
+
+    <!-- Section 4: Understanding Results -->
+    <h2 id="understanding-results"><span class="h-num">4</span> Understanding Your Results</h2>
+
+    <h3>Analysis Summary</h3>
+    <p>
+        After a scan completes, the <strong>Analysis Summary</strong> section appears at the top of the results. It
+        displays metadata about the scan and a count of findings grouped by severity level.
+    </p>
+    <div class="card">
+        <ul>
+            <li><strong>Target</strong> &mdash; The directory path or URL that was scanned.</li>
+            <li><strong>Files Analyzed</strong> &mdash; Number of source code files processed (local scans only).</li>
+            <li><strong>Total Findings</strong> &mdash; Total number of security issues detected.</li>
+            <li><strong>Analysis Type</strong> &mdash; Either <em>Local</em> (SAST) or <em>Web</em> (DAST).</li>
+        </ul>
+    </div>
+
+    <h3>Severity Badges</h3>
+    <p>
+        Below the metadata, colour-coded severity badges show how many findings fall into each severity level:
+    </p>
+    <p>
+        <span class="severity-sample" style="background: var(--critical-bg); color: var(--critical); border-color: var(--critical-border);">Critical</span>
+        <span class="severity-sample" style="background: var(--high-bg); color: var(--high); border-color: var(--high-border);">High</span>
+        <span class="severity-sample" style="background: var(--medium-bg); color: var(--medium); border-color: var(--medium-border);">Medium</span>
+        <span class="severity-sample" style="background: var(--low-bg); color: var(--low); border-color: var(--low-border);">Low</span>
+        <span class="severity-sample" style="background: var(--info-bg); color: var(--info-color); border-color: var(--info-border);">Info</span>
+    </p>
+
+    <h3>Finding Cards</h3>
+    <p>Each detected vulnerability is displayed as a finding card containing the following information:</p>
+    <div class="card">
+        <ul>
+            <li><strong>Vulnerability Name</strong> &mdash; The type of security issue (e.g. "SQL Injection", "Missing Security Header: Content-Security-Policy").</li>
+            <li><strong>Severity Tag</strong> &mdash; A colour-coded badge showing CRITICAL, HIGH, MEDIUM, LOW, or INFO.</li>
+            <li><strong>Common Weakness Enumeration (CWE) Reference</strong> &mdash; The identifier (e.g. CWE-89).</li>
+            <li><strong>CVE References</strong> &mdash; Related Common Vulnerabilities and Exposures entries (when NVD enrichment is enabled).</li>
+            <li><strong>File Path &amp; Line Number</strong> &mdash; Exact location in the source code (local scans) or the target URL (remote scans).</li>
+            <li><strong>Description</strong> &mdash; Explanation of the vulnerability and its potential impact.</li>
+            <li><strong>Remediation Guidance</strong> &mdash; Click the expandable section to view recommended fixes and best practices.</li>
+        </ul>
+    </div>
+
+    <h3>Exporting Reports</h3>
+    <p>
+        At the bottom of the results, two export options are available:
+    </p>
+    <ul>
+        <li><strong>Export JSON Report</strong> &mdash; Downloads a structured JSON file containing all scan data, suitable for integration with CI/CD pipelines or other security tools.</li>
+        <li><strong>Export Markdown Report</strong> &mdash; Downloads a Markdown report with findings grouped by severity, including file locations, code snippets, and remediation guidance. Ideal for pasting into vibe-coding platforms (Cursor, Lovable, Bolt, etc.) to fix identified issues.</li>
+    </ul>
+
+    <!-- Section 5: NVD Enrichment -->
+    <h2 id="nvd-enrichment"><span class="h-num">5</span> NVD Enrichment</h2>
+
+    <p>
+        The <strong>NVD Enriched Scan Results</strong> toggle in the sidebar controls whether scan findings are
+        enriched with data from the <strong><a href="https://nvd.nist.gov/general/cve-process" target="_blank" rel="noopener noreferrer">NVD</a></strong>, maintained by the <strong><a href="https://www.nist.gov/" target="_blank" rel="noopener noreferrer">National Institute of Standards and Technology (NIST)</a></strong>.
+    </p>
+
+    <div class="card">
+        <div class="card-label">What NVD Enrichment Adds</div>
+        <ul>
+                <li>Related <strong><a href="https://nvd.nist.gov/general/cve-process" target="_blank" rel="noopener noreferrer">Common Vulnerabilities and Exposures (CVE)</a></strong> references for each finding.</li>
+    </div>
+
+    <h3>When to Enable</h3>
+    <ul>
+        <li>Comprehensive security audits where you need full CVE context.</li>
+        <li>Compliance reporting that requires specific vulnerability references.</li>
+        <li>When you need detailed remediation guidance for each finding.</li>
+    </ul>
+
+    <h3>When to Disable</h3>
+    <ul>
+        <li>Quick scans where speed is the priority.</li>
+        <li>Offline environments without internet access.</li>
+        <li>When the NVD API is rate-limited or unavailable.</li>
+    </ul>
+
+    <div class="tip">
+        <div class="tip-label">Note</div>
+        NVD enrichment adds processing time to the scan. The toggle is enabled by default. You can disable it for faster scans and re-run with enrichment when needed.
+    </div>
+
+    <!-- Section 6: Severity Levels Guide -->
+    <h2 id="severity-guide"><span class="h-num">6</span> Severity Levels Guide</h2>
+
+    <p>
+        Findings are classified into five severity levels. Use this guide to prioritise remediation efforts.
+    </p>
+
+    <table class="severity-table">
+        <thead>
+            <tr>
+                <th style="width: 120px;">Severity</th>
+                <th>Description</th>
+                <th style="width: 200px;">Examples</th>
+            </tr>
+        </thead>
+        <tbody>
+            <tr>
+                <td><span class="severity-tag" style="background: var(--critical-bg); color: var(--critical);">CRITICAL</span></td>
+                <td>Immediate action required. These vulnerabilities can lead to full system compromise, data breaches, or remote code execution.</td>
+                <td>SQL Injection, Command Injection, Hardcoded Credentials, Insecure Deserialization</td>
+            </tr>
+            <tr>
+                <td><span class="severity-tag" style="background: var(--high-bg); color: var(--high);">HIGH</span></td>
+                <td>Serious vulnerabilities requiring prompt attention. These can lead to significant data exposure or unauthorized access.</td>
+                <td>Cross-Site Scripting (XSS), Path Traversal, SSRF, JWT Without Verification</td>
+            </tr>
+            <tr>
+                <td><span class="severity-tag" style="background: var(--medium-bg); color: var(--medium);">MEDIUM</span></td>
+                <td>Moderate risk requiring investigation. These may enable attacks under certain conditions or weaken security posture.</td>
+                <td>CORS Misconfiguration, Weak Cryptographic Algorithm, Open Redirect, Missing Content-Security-Policy</td>
+            </tr>
+            <tr>
+                <td><span class="severity-tag" style="background: var(--low-bg); color: var(--low);">LOW</span></td>
+                <td>Minor issues with lower priority. These represent defence-in-depth concerns or best practice violations.</td>
+                <td>Debug Mode Enabled, Missing Non-Critical Headers, Verbose Error Messages, Sensitive Data in Logs</td>
+            </tr>
+            <tr>
+                <td><span class="severity-tag" style="background: var(--info-bg); color: var(--info-color);">INFO</span></td>
+                <td>Informational findings with no direct security risk. These highlight areas for awareness or potential improvement.</td>
+                <td>Technology Detection, Configuration Notes, Server Version Disclosure</td>
+            </tr>
+        </tbody>
+    </table>
+
+    <div class="tip">
+        <div class="tip-label">Prioritisation Strategy</div>
+        Address <strong>Critical</strong> and <strong>High</strong> findings first, as they pose the greatest risk. Medium findings should be reviewed and scheduled for remediation. Low and Info findings can be addressed as part of regular maintenance cycles.
+    </div>
+
+    <!-- Footer -->
+    <div class="footer">
+        Security Auditor &middot; SAST + DAST Platform<br />
+    </div>
+
+
+</body>
+</html>

requirements.txt

@@ -0,0 +1,34 @@
+# Security Checker Dependencies
+# =============================
+
+# Core Dependencies (Required for running the application)
+# ---------------------------------------------------------
+
+# Core async HTTP client for NVD API and web scanning
+aiohttp>=3.8.0
+
+# YAML parsing (for config files)
+PyYAML>=6.0
+
+# For generating HTML reports
+jinja2>=3.1.0
+
+# For advanced pattern matching
+regex>=2023.0.0
+
+# For rich console output
+rich>=13.0.0
+
+# Gradio web interface
+gradio>=4.0.0
+
+# HTTP client for Modal backend API calls
+httpx>=0.27.0
+
+# Development Dependencies (Optional - only needed for development/testing)
+# ---------------------------------------------------------------------------
+# Uncomment the lines below if you need testing or type checking:
+#
+# pytest>=7.0.0
+# pytest-asyncio>=0.21.0
+# mypy>=1.0.0

security_checker.py

@@ -0,0 +1,1945 @@
+#!/usr/bin/env python3
+"""
+Security Checker Application
+============================
+A comprehensive security analysis tool that combines:
+1. Static Application Security Testing (SAST)
+2. NIST National Vulnerability Database (NVD) integration
+
+Think of this as a "security doctor" for your applications:
+- SAST = X-ray machine (looks inside without running)
+- NVD = Medical database (known vulnerabilities/diseases)
+- Report = Diagnosis with treatment plan
+
+Author: Security Checker Project
+"""
+
+import os
+import re
+import json
+import hashlib
+import asyncio
+import aiohttp
+from pathlib import Path
+from dataclasses import dataclass, field
+from typing import List, Dict, Optional, Tuple
+from enum import Enum
+from datetime import datetime
+from urllib.parse import urlparse
+import fnmatch
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+
+class RiskLevel(Enum):
+    """
+    Risk levels follow CVSS (Common Vulnerability Scoring System).
+    Think of it like triage in an emergency room:
+    - CRITICAL: Life-threatening, needs immediate attention
+    - HIGH: Serious condition, treat soon
+    - MEDIUM: Concerning, schedule treatment
+    - LOW: Minor issue, monitor
+    - INFO: Just a note for awareness
+    """
+    CRITICAL = "CRITICAL"  # CVSS 9.0-10.0
+    HIGH = "HIGH"          # CVSS 7.0-8.9
+    MEDIUM = "MEDIUM"      # CVSS 4.0-6.9
+    LOW = "LOW"            # CVSS 0.1-3.9
+    INFO = "INFO"          # Informational
+
+
+@dataclass
+class Vulnerability:
+    """
+    Represents a single vulnerability found in the code.
+    
+    Analogy: This is like a medical diagnosis report entry:
+    - name: Disease name
+    - description: What's wrong
+    - file_path: Where in the body (code) the problem is
+    - line_number: Exact location
+    - code_snippet: The problematic tissue sample
+    - risk_level: How serious is it
+    - remediation: Treatment plan
+    - cve_ids: Reference to known disease database (NVD)
+    """
+    name: str
+    description: str
+    file_path: str
+    line_number: int
+    code_snippet: str
+    risk_level: RiskLevel
+    remediation: str
+    cve_ids: List[str] = field(default_factory=list)
+    cwe_id: Optional[str] = None
+    confidence: str = "HIGH"  # HIGH, MEDIUM, LOW
+    
+    def to_dict(self) -> Dict:
+        return {
+            "name": self.name,
+            "description": self.description,
+            "file_path": self.file_path,
+            "line_number": self.line_number,
+            "code_snippet": self.code_snippet,
+            "risk_level": self.risk_level.value,
+            "remediation": self.remediation,
+            "cve_ids": self.cve_ids,
+            "cwe_id": self.cwe_id,
+            "confidence": self.confidence
+        }
+
+
+@dataclass
+class ScanResult:
+    """
+    Complete scan results - like a full medical report.
+    """
+    target: str
+    scan_type: str  # "local" or "web"
+    start_time: datetime
+    end_time: Optional[datetime] = None
+    vulnerabilities: List[Vulnerability] = field(default_factory=list)
+    files_scanned: int = 0
+    errors: List[str] = field(default_factory=list)
+    
+    def summary(self) -> Dict:
+        """Generate a summary of findings by risk level."""
+        summary = {level.value: 0 for level in RiskLevel}
+        for vuln in self.vulnerabilities:
+            summary[vuln.risk_level.value] += 1
+        return {
+            "target": self.target,
+            "scan_type": self.scan_type,
+            "duration_seconds": (self.end_time - self.start_time).total_seconds() if self.end_time else None,
+            "files_scanned": self.files_scanned,
+            "total_vulnerabilities": len(self.vulnerabilities),
+            "by_severity": summary,
+            "errors": len(self.errors)
+        }
+
+
+class SASTRule:
+    """
+    A single SAST detection rule.
+    
+    Analogy: Like a specific test in a medical lab
+    - pattern: What symptom to look for
+    - name: Name of the condition
+    - languages: Which "body types" this applies to
+    """
+    def __init__(
+        self,
+        name: str,
+        pattern: str,
+        description: str,
+        risk_level: RiskLevel,
+        remediation: str,
+        cwe_id: str,
+        languages: List[str],
+        false_positive_patterns: List[str] = None
+    ):
+        self.name = name
+        self.pattern = re.compile(pattern, re.IGNORECASE | re.MULTILINE)
+        self.description = description
+        self.risk_level = risk_level
+        self.remediation = remediation
+        self.cwe_id = cwe_id
+        self.languages = languages  # File extensions: ['.py', '.js', etc.]
+        self.false_positive_patterns = [
+            re.compile(fp, re.IGNORECASE) for fp in (false_positive_patterns or [])
+        ]
+    
+    def matches(self, code: str, file_ext: str) -> List[Tuple[int, str]]:
+        """
+        Find all matches in the code.
+        Returns list of (line_number, matched_snippet).
+        """
+        if file_ext not in self.languages:
+            return []
+        
+        matches = []
+        lines = code.split('\n')
+        
+        for i, line in enumerate(lines, 1):
+            if self.pattern.search(line):
+                # Check for false positives
+                is_false_positive = any(
+                    fp.search(line) for fp in self.false_positive_patterns
+                )
+                if not is_false_positive:
+                    # Get context (line before and after)
+                    start = max(0, i - 2)
+                    end = min(len(lines), i + 1)
+                    snippet = '\n'.join(lines[start:end])
+                    matches.append((i, snippet))
+        
+        return matches
+
+
+class SASTEngine:
+    """
+    Static Application Security Testing Engine
+    
+    Analogy: This is like a diagnostic imaging department
+    - Scans code without executing it (like X-ray/MRI)
+    - Looks for known vulnerability patterns
+    - Reports findings with locations
+    
+    How it works:
+    1. Load detection rules (what to look for)
+    2. Read source files
+    3. Match patterns against code
+    4. Report findings
+    """
+    
+    def __init__(self):
+        self.rules = self._load_rules()
+        self.file_extensions = {
+            '.py': 'python',
+            '.js': 'javascript',
+            '.ts': 'typescript',
+            '.jsx': 'javascript',
+            '.tsx': 'typescript',
+            '.java': 'java',
+            '.php': 'php',
+            '.rb': 'ruby',
+            '.go': 'go',
+            '.cs': 'csharp',
+            '.c': 'c',
+            '.cpp': 'cpp',
+            '.h': 'c',
+            '.hpp': 'cpp',
+            '.sql': 'sql',
+            '.html': 'html',
+            '.htm': 'html',
+            '.xml': 'xml',
+            '.yml': 'yaml',
+            '.yaml': 'yaml',
+            '.json': 'json',
+            '.sh': 'shell',
+            '.bash': 'shell',
+        }
+        
+        # Directories to skip (like avoiding scanning healthy tissue)
+        self.skip_dirs = {
+            'node_modules', 'venv', '.venv', 'env', '.env',
+            '__pycache__', '.git', '.svn', '.hg',
+            'dist', 'build', 'target', 'vendor',
+            '.idea', '.vscode', 'coverage'
+        }
+    
+    def _load_rules(self) -> List[SASTRule]:
+        """
+        Load vulnerability detection rules.
+        
+        These rules are like a checklist of known security problems.
+        Each rule defines:
+        - A pattern to match (regex)
+        - The type of vulnerability
+        - How severe it is
+        - How to fix it
+        """
+        return [
+            # ============================================================
+            # INJECTION VULNERABILITIES (The "contamination" category)
+            # Like checking for contaminants in food/medicine
+            # ============================================================
+            
+            SASTRule(
+                name="SQL Injection",
+                pattern=r"""(?:execute|cursor\.execute|query|raw|rawQuery|executeQuery)\s*\(\s*[f"'].*?%s.*?['"]\s*%|(?:execute|cursor\.execute)\s*\(\s*[f"'].*?\{.*?\}.*?['"]|(?:SELECT|INSERT|UPDATE|DELETE|DROP|CREATE|ALTER).*?['"]\s*\+\s*|f['"]\s*(?:SELECT|INSERT|UPDATE|DELETE).*?\{""",
+                description="Potential SQL Injection vulnerability. User input may be directly concatenated into SQL queries, allowing attackers to manipulate database operations.",
+                risk_level=RiskLevel.CRITICAL,
+                remediation="""Use parameterized queries or prepared statements:
+
+VULNERABLE:
+    cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
+    
+SECURE:
+    cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))
+    
+For ORMs, use built-in query builders instead of raw SQL.""",
+                cwe_id="CWE-89",
+                languages=['.py', '.java', '.php', '.js', '.ts', '.rb', '.go', '.cs'],
+                false_positive_patterns=[r'#.*SQL', r'//.*SQL', r'/\*.*SQL']
+            ),
+            
+            SASTRule(
+                name="Command Injection",
+                pattern=r"""(?:os\.system|os\.popen|subprocess\.call|subprocess\.run|subprocess\.Popen|exec|eval|Runtime\.getRuntime\(\)\.exec|shell_exec|system|passthru|popen)\s*\([^)]*(?:\+|%|\.format|\{|\$)""",
+                description="Potential Command Injection vulnerability. User input may be passed to system commands, allowing attackers to execute arbitrary commands.",
+                risk_level=RiskLevel.CRITICAL,
+                remediation="""Avoid passing user input to shell commands. If necessary:
+
+VULNERABLE:
+    os.system(f"ping {user_input}")
+    
+SECURE:
+    import shlex
+    subprocess.run(["ping", shlex.quote(user_input)], shell=False)
+    
+Best practice: Use libraries instead of shell commands when possible.""",
+                cwe_id="CWE-78",
+                languages=['.py', '.java', '.php', '.js', '.ts', '.rb', '.go', '.sh']
+            ),
+            
+            SASTRule(
+                name="XSS (Cross-Site Scripting)",
+                pattern=r"""(?:innerHTML|outerHTML|document\.write|\.html\(|v-html|dangerouslySetInnerHTML|\[innerHTML\])\s*=?\s*(?:[^;]*(?:\+|`|\$\{))""",
+                description="Potential Cross-Site Scripting (XSS) vulnerability. Untrusted data may be inserted into the DOM without proper encoding.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Sanitize and encode output before inserting into HTML:
+
+VULNERABLE:
+    element.innerHTML = userInput;
+    
+SECURE:
+    element.textContent = userInput;  // For text
+    // Or use a sanitization library like DOMPurify:
+    element.innerHTML = DOMPurify.sanitize(userInput);
+    
+For React, avoid dangerouslySetInnerHTML unless absolutely necessary.""",
+                cwe_id="CWE-79",
+                languages=['.js', '.ts', '.jsx', '.tsx', '.html', '.php']
+            ),
+            
+            SASTRule(
+                name="Path Traversal",
+                pattern=r"""(?:open|read|write|file_get_contents|file_put_contents|include|require|fopen|readFile|writeFile|createReadStream)\s*\([^)]*(?:\+|`|\$\{|\.\./)""",
+                description="Potential Path Traversal vulnerability. User input may be used to construct file paths, allowing attackers to access unauthorized files.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Validate and sanitize file paths:
+
+VULNERABLE:
+    with open(f"/uploads/{filename}") as f:
+    
+SECURE:
+    import os
+    safe_path = os.path.normpath(filename)
+    if '..' in safe_path or safe_path.startswith('/'):
+        raise ValueError("Invalid path")
+    full_path = os.path.join(UPLOAD_DIR, safe_path)
+    if not full_path.startswith(UPLOAD_DIR):
+        raise ValueError("Path traversal detected")""",
+                cwe_id="CWE-22",
+                languages=['.py', '.java', '.php', '.js', '.ts', '.rb', '.go']
+            ),
+            
+            SASTRule(
+                name="LDAP Injection",
+                pattern=r"""(?:ldap_search|ldap_bind|search_s|search_ext_s)\s*\([^)]*(?:\+|%|\.format|\{)""",
+                description="Potential LDAP Injection vulnerability. User input may be used in LDAP queries without proper escaping.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Escape special LDAP characters in user input:
+
+VULNERABLE:
+    ldap.search_s(base, scope, f"(uid={username})")
+    
+SECURE:
+    from ldap3.utils.conv import escape_filter_chars
+    safe_username = escape_filter_chars(username)
+    ldap.search_s(base, scope, f"(uid={safe_username})")""",
+                cwe_id="CWE-90",
+                languages=['.py', '.java', '.php', '.cs']
+            ),
+            
+            # ============================================================
+            # AUTHENTICATION & SESSION VULNERABILITIES
+            # Like checking if the locks and keys are secure
+            # ============================================================
+            
+            SASTRule(
+                name="Hardcoded Credentials",
+                pattern=r"""(?:password|passwd|pwd|secret|api_key|apikey|api_secret|access_token|auth_token|private_key)\s*[=:]\s*['"]\w{8,}['"]""",
+                description="Hardcoded credentials detected. Sensitive information should not be stored in source code.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Store credentials securely:
+
+VULNERABLE:
+    password = "MySecretPass123"
+    api_key = "sk-1234567890abcdef"
+    
+SECURE:
+    import os
+    password = os.environ.get('DB_PASSWORD')
+    api_key = os.environ.get('API_KEY')
+    
+Use environment variables, secrets managers (AWS Secrets Manager, 
+HashiCorp Vault), or encrypted configuration files.""",
+                cwe_id="CWE-798",
+                languages=['.py', '.java', '.php', '.js', '.ts', '.rb', '.go', '.cs', '.yml', '.yaml', '.json'],
+                false_positive_patterns=[r'example', r'placeholder', r'your_', r'<.*>', r'xxx', r'\$\{']
+            ),
+            
+            SASTRule(
+                name="Weak Password Hashing",
+                pattern=r"""(?:md5|sha1)\s*\(|hashlib\.(?:md5|sha1)\(|MessageDigest\.getInstance\s*\(\s*['"](MD5|SHA-?1)['"]|password.*=.*(?:md5|sha1)""",
+                description="Weak hashing algorithm used for passwords. MD5 and SHA1 are cryptographically broken for password storage.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Use strong password hashing algorithms:
+
+VULNERABLE:
+    hashed = hashlib.md5(password.encode()).hexdigest()
+    
+SECURE:
+    import bcrypt
+    hashed = bcrypt.hashpw(password.encode(), bcrypt.gensalt())
+    
+    # Or use argon2 (recommended):
+    from argon2 import PasswordHasher
+    ph = PasswordHasher()
+    hashed = ph.hash(password)
+    
+Recommended algorithms: Argon2, bcrypt, scrypt, PBKDF2""",
+                cwe_id="CWE-328",
+                languages=['.py', '.java', '.php', '.js', '.ts', '.rb', '.go', '.cs']
+            ),
+            
+            SASTRule(
+                name="JWT Without Verification",
+                pattern=r"""jwt\.decode\s*\([^)]*verify\s*=\s*False|algorithms\s*=\s*\[?\s*['"](none|HS256)['"]|\.decode\(\s*token\s*\)|jsonwebtoken\.decode\s*\(""",
+                description="JWT token decoded without proper verification or using weak/no algorithm.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Always verify JWT signatures:
+
+VULNERABLE:
+    payload = jwt.decode(token, verify=False)
+    payload = jwt.decode(token, algorithms=['none'])
+    
+SECURE:
+    payload = jwt.decode(
+        token, 
+        SECRET_KEY, 
+        algorithms=['RS256'],  # Use asymmetric algorithms
+        options={'verify_exp': True}
+    )
+    
+Use RS256 or ES256 instead of HS256 for better security.""",
+                cwe_id="CWE-347",
+                languages=['.py', '.js', '.ts', '.java', '.go']
+            ),
+            
+            SASTRule(
+                name="Session Fixation Risk",
+                pattern=r"""session\s*\[\s*['"].*['"]\s*\]\s*=.*request\.|req\.session\s*=.*req\.(body|query|params)|session_id\s*=.*(?:GET|POST|request)""",
+                description="Potential session fixation vulnerability. Session identifiers should be regenerated after authentication.",
+                risk_level=RiskLevel.MEDIUM,
+                remediation="""Regenerate session after authentication:
+
+VULNERABLE:
+    session['user_id'] = user.id  # Without regenerating
+    
+SECURE (Python/Flask):
+    from flask import session
+    session.regenerate()  # Regenerate session ID
+    session['user_id'] = user.id
+    
+SECURE (Node.js/Express):
+    req.session.regenerate((err) => {
+        req.session.userId = user.id;
+    });""",
+                cwe_id="CWE-384",
+                languages=['.py', '.js', '.ts', '.php', '.java']
+            ),
+            
+            # ============================================================
+            # CRYPTOGRAPHIC VULNERABILITIES
+            # Like checking if the safe is actually secure
+            # ============================================================
+            
+            SASTRule(
+                name="Weak Cryptographic Algorithm",
+                pattern=r"""(?:DES|RC4|RC2|Blowfish|IDEA)(?:\.|\s|Cipher)|Cipher\.getInstance\s*\(\s*['"](DES|RC4|Blowfish)['"]\)|from\s+Crypto\.Cipher\s+import\s+(DES|Blowfish)|cryptography.*(?:DES|RC4|Blowfish)""",
+                description="Weak cryptographic algorithm detected. DES, RC4, RC2, and Blowfish are considered insecure.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Use modern cryptographic algorithms:
+
+VULNERABLE:
+    from Crypto.Cipher import DES
+    cipher = DES.new(key, DES.MODE_CBC)
+    
+SECURE:
+    from cryptography.fernet import Fernet
+    # Or for low-level:
+    from cryptography.hazmat.primitives.ciphers import Cipher, algorithms
+    cipher = Cipher(algorithms.AES(key), modes.GCM(iv))
+    
+Recommended: AES-256-GCM, ChaCha20-Poly1305""",
+                cwe_id="CWE-327",
+                languages=['.py', '.java', '.js', '.ts', '.go', '.cs', '.php']
+            ),
+            
+            SASTRule(
+                name="Insecure Random Number Generator",
+                pattern=r"""(?:random\.random|random\.randint|Math\.random|rand\(\)|srand\(\)|mt_rand)\s*\(""",
+                description="Insecure random number generator used. These are not cryptographically secure and shouldn't be used for security purposes.",
+                risk_level=RiskLevel.MEDIUM,
+                remediation="""Use cryptographically secure random generators:
+
+VULNERABLE:
+    token = ''.join(random.choices(string.ascii_letters, k=32))
+    
+SECURE (Python):
+    import secrets
+    token = secrets.token_urlsafe(32)
+    
+SECURE (JavaScript):
+    const array = new Uint8Array(32);
+    crypto.getRandomValues(array);
+    
+SECURE (Java):
+    SecureRandom random = new SecureRandom();""",
+                cwe_id="CWE-338",
+                languages=['.py', '.js', '.ts', '.java', '.php', '.c', '.cpp'],
+                false_positive_patterns=[r'random\.seed', r'shuffle', r'sample']
+            ),
+            
+            SASTRule(
+                name="Hardcoded Cryptographic Key",
+                pattern=r"""(?:key|iv|nonce|salt)\s*[=:]\s*(?:b?['"]\w{16,}['"]|bytes\s*\(\s*['"]\w{16,}['"])""",
+                description="Hardcoded cryptographic key detected. Encryption keys should never be stored in source code.",
+                risk_level=RiskLevel.CRITICAL,
+                remediation="""Store cryptographic keys securely:
+
+VULNERABLE:
+    key = b'ThisIsASecretKey1234567890123456'
+    
+SECURE:
+    import os
+    key = os.environ.get('ENCRYPTION_KEY').encode()
+    
+    # Or use a key management system:
+    from aws_encryption_sdk import KMSMasterKeyProvider
+    key_provider = KMSMasterKeyProvider(key_ids=[KEY_ARN])
+    
+Best practice: Use Hardware Security Modules (HSM) or 
+Key Management Services (AWS KMS, Azure Key Vault).""",
+                cwe_id="CWE-321",
+                languages=['.py', '.java', '.js', '.ts', '.go', '.cs', '.php']
+            ),
+            
+            # ============================================================
+            # INSECURE DESERIALIZATION
+            # Like accepting packages without checking what's inside
+            # ============================================================
+            
+            SASTRule(
+                name="Insecure Deserialization (Python)",
+                pattern=r"""pickle\.loads?\s*\(|yaml\.(?:unsafe_)?load\s*\([^)]*(?!Loader\s*=\s*yaml\.SafeLoader)|marshal\.loads?\s*\(|shelve\.open\s*\(""",
+                description="Insecure deserialization detected. Deserializing untrusted data can lead to remote code execution.",
+                risk_level=RiskLevel.CRITICAL,
+                remediation="""Use safe deserialization methods:
+
+VULNERABLE:
+    data = pickle.loads(user_input)
+    config = yaml.load(file)
+    
+SECURE:
+    import json
+    data = json.loads(user_input)  # JSON is safe
+    
+    # For YAML, always use SafeLoader:
+    config = yaml.load(file, Loader=yaml.SafeLoader)
+    # Or better:
+    config = yaml.safe_load(file)
+    
+Never deserialize untrusted data with pickle/marshal.""",
+                cwe_id="CWE-502",
+                languages=['.py']
+            ),
+            
+            SASTRule(
+                name="Insecure Deserialization (Java)",
+                pattern=r"""ObjectInputStream\s*\(|readObject\s*\(\)|XMLDecoder\s*\(|XStream\.fromXML\s*\(|JSON\.parse\s*\(.*\)\.class""",
+                description="Insecure deserialization detected in Java. Can lead to remote code execution.",
+                risk_level=RiskLevel.CRITICAL,
+                remediation="""Validate and filter deserialization:
+
+VULNERABLE:
+    ObjectInputStream ois = new ObjectInputStream(input);
+    Object obj = ois.readObject();
+    
+SECURE:
+    // Use a whitelist filter
+    ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
+        "com.myapp.SafeClass;!*"
+    );
+    ois.setObjectInputFilter(filter);
+    
+    // Or use JSON/Protocol Buffers instead of Java serialization
+    
+Consider: Jackson with @JsonTypeInfo restrictions, 
+or Protocol Buffers for type-safe serialization.""",
+                cwe_id="CWE-502",
+                languages=['.java']
+            ),
+            
+            SASTRule(
+                name="Insecure Deserialization (JavaScript)",
+                pattern=r"""(?:eval|Function)\s*\(\s*(?:JSON\.parse|atob|decodeURIComponent)|node-serialize|serialize-javascript.*(?:eval|Function)|unserialize\s*\(""",
+                description="Insecure deserialization in JavaScript. Eval of untrusted data can lead to code execution.",
+                risk_level=RiskLevel.CRITICAL,
+                remediation="""Never eval deserialized data:
+
+VULNERABLE:
+    eval(JSON.parse(userInput).code);
+    const obj = serialize.unserialize(userInput);
+    
+SECURE:
+    const data = JSON.parse(userInput);
+    // Validate structure before use
+    if (typeof data.name !== 'string') {
+        throw new Error('Invalid data');
+    }
+    
+Avoid node-serialize and similar libraries with 
+eval-based deserialization.""",
+                cwe_id="CWE-502",
+                languages=['.js', '.ts']
+            ),
+            
+            # ============================================================
+            # INFORMATION DISCLOSURE
+            # Like leaving sensitive documents in public view
+            # ============================================================
+            
+            SASTRule(
+                name="Debug Mode Enabled",
+                pattern=r"""(?:DEBUG|debug)\s*[=:]\s*(?:True|true|1|['"](true|on|yes)['"])|app\.run\s*\([^)]*debug\s*=\s*True|FLASK_DEBUG\s*=\s*1""",
+                description="Debug mode appears to be enabled. This can expose sensitive information in production.",
+                risk_level=RiskLevel.MEDIUM,
+                remediation="""Disable debug mode in production:
+
+VULNERABLE:
+    app.run(debug=True)
+    DEBUG = True
+    
+SECURE:
+    import os
+    DEBUG = os.environ.get('DEBUG', 'False').lower() == 'true'
+    
+    # In production:
+    app.run(debug=False)
+    
+Use environment variables to control debug settings.""",
+                cwe_id="CWE-215",
+                languages=['.py', '.js', '.ts', '.java', '.php', '.rb', '.yml', '.yaml', '.json'],
+                false_positive_patterns=[r'#.*DEBUG', r'//.*DEBUG', r'debug.*log']
+            ),
+            
+            SASTRule(
+                name="Sensitive Data in Logs",
+                pattern=r"""(?:log(?:ger)?\.(?:info|debug|warn|error|critical)|print|console\.log|System\.out\.print)\s*\([^)]*(?:password|secret|token|key|credit.?card|ssn|api.?key)""",
+                description="Sensitive data may be written to logs. This can expose credentials and personal information.",
+                risk_level=RiskLevel.MEDIUM,
+                remediation="""Never log sensitive information:
+
+VULNERABLE:
+    logger.info(f"User login: {username}, password: {password}")
+    
+SECURE:
+    logger.info(f"User login: {username}")
+    # Or mask sensitive data:
+    logger.info(f"API key: {api_key[:4]}****")
+    
+Use structured logging with sensitive field filtering.""",
+                cwe_id="CWE-532",
+                languages=['.py', '.java', '.js', '.ts', '.rb', '.go', '.php']
+            ),
+            
+            SASTRule(
+                name="Stack Trace Exposure",
+                pattern=r"""(?:printStackTrace|traceback\.print_exc|console\.trace|e\.stack|err\.stack)\s*\(?\)?|except.*?:?\s*pass|rescue\s*=>\s*nil""",
+                description="Stack traces may be exposed to users or exceptions silently ignored.",
+                risk_level=RiskLevel.LOW,
+                remediation="""Handle exceptions properly without exposing internals:
+
+VULNERABLE:
+    except Exception as e:
+        return str(e)  # Exposes internal details
+        
+SECURE:
+    except Exception as e:
+        logger.exception("Operation failed")  # Log internally
+        return {"error": "An error occurred"}  # Generic message
+        
+Never expose full stack traces to end users.""",
+                cwe_id="CWE-209",
+                languages=['.py', '.java', '.js', '.ts', '.rb', '.php']
+            ),
+            
+            # ============================================================
+            # SECURITY MISCONFIGURATION
+            # Like leaving doors unlocked or windows open
+            # ============================================================
+            
+            SASTRule(
+                name="CORS Wildcard",
+                pattern=r"""(?:Access-Control-Allow-Origin|cors)\s*[=:]\s*['"]\*['"]|\.allowedOrigins\s*\(\s*['"]\*['"]|cors\s*\(\s*\{[^}]*origin\s*:\s*(?:true|['"]\*['"])""",
+                description="CORS configured to allow all origins. This can enable cross-site request attacks.",
+                risk_level=RiskLevel.MEDIUM,
+                remediation="""Restrict CORS to specific trusted origins:
+
+VULNERABLE:
+    Access-Control-Allow-Origin: *
+    cors({ origin: '*' })
+    
+SECURE:
+    cors({
+        origin: ['https://trusted-site.com'],
+        methods: ['GET', 'POST'],
+        credentials: true
+    })
+    
+Never use wildcard CORS with credentials.""",
+                cwe_id="CWE-942",
+                languages=['.py', '.java', '.js', '.ts', '.php', '.rb', '.go']
+            ),
+            
+            SASTRule(
+                name="SSL/TLS Verification Disabled",
+                pattern=r"""verify\s*[=:]\s*False|VERIFY_SSL\s*=\s*False|ssl\s*[=:]\s*False|rejectUnauthorized\s*[=:]\s*false|InsecureSkipVerify\s*[=:]\s*true|CURLOPT_SSL_VERIFYPEER.*false""",
+                description="SSL/TLS certificate verification is disabled. This makes the application vulnerable to man-in-the-middle attacks.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Always verify SSL/TLS certificates:
+
+VULNERABLE:
+    requests.get(url, verify=False)
+    https.request({rejectUnauthorized: false})
+    
+SECURE:
+    requests.get(url, verify=True)
+    # Or with custom CA:
+    requests.get(url, verify='/path/to/ca-bundle.crt')
+    
+If you need to use self-signed certs in development, 
+use environment-based configuration.""",
+                cwe_id="CWE-295",
+                languages=['.py', '.java', '.js', '.ts', '.go', '.php', '.rb']
+            ),
+            
+            SASTRule(
+                name="Insecure HTTP",
+                pattern=r"""['"](http://(?!localhost|127\.0\.0\.1|0\.0\.0\.0)[^'"]+)['"]""",
+                description="Insecure HTTP URL detected. Data transmitted over HTTP can be intercepted.",
+                risk_level=RiskLevel.LOW,
+                remediation="""Use HTTPS for all external communications:
+
+VULNERABLE:
+    api_url = "http://api.example.com/data"
+    
+SECURE:
+    api_url = "https://api.example.com/data"
+    
+Configure HSTS (HTTP Strict Transport Security) on your servers.""",
+                cwe_id="CWE-319",
+                languages=['.py', '.java', '.js', '.ts', '.go', '.php', '.rb', '.yml', '.yaml', '.json'],
+                false_positive_patterns=[r'#.*http://', r'//.*http://', r'example\.com', r'schema.*http://']
+            ),
+            
+            SASTRule(
+                name="Missing Security Headers",
+                pattern=r"""(?:Content-Security-Policy|X-Frame-Options|X-Content-Type-Options|Strict-Transport-Security)\s*[=:]\s*['"]['""]|no_header|disable.*header""",
+                description="Security headers may be missing or disabled. This can enable various attacks.",
+                risk_level=RiskLevel.LOW,
+                remediation="""Configure security headers:
+
+Add these headers to your responses:
+    Content-Security-Policy: default-src 'self'
+    X-Frame-Options: DENY
+    X-Content-Type-Options: nosniff
+    Strict-Transport-Security: max-age=31536000; includeSubDomains
+    X-XSS-Protection: 1; mode=block
+    
+Use helmet.js (Node), django-csp, or similar libraries.""",
+                cwe_id="CWE-693",
+                languages=['.py', '.java', '.js', '.ts', '.php', '.rb']
+            ),
+            
+            # ============================================================
+            # XML VULNERABILITIES
+            # XML parsers can be tricked into dangerous behavior
+            # ============================================================
+            
+            SASTRule(
+                name="XXE (XML External Entity)",
+                pattern=r"""(?:xml\.etree|lxml|xml\.dom|xml\.sax|XMLReader|DocumentBuilder|SAXParser|XMLParser).*(?:parse|read|load)|<!ENTITY|SYSTEM\s+['""]|resolve_entities\s*=\s*True""",
+                description="Potential XML External Entity (XXE) vulnerability. XML parsers should disable external entity processing.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Disable external entity processing:
+
+VULNERABLE (Python):
+    tree = etree.parse(xml_file)
+    
+SECURE (Python):
+    parser = etree.XMLParser(resolve_entities=False, no_network=True)
+    tree = etree.parse(xml_file, parser)
+    
+SECURE (Java):
+    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+    dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+    dbf.setExpandEntityReferences(false);""",
+                cwe_id="CWE-611",
+                languages=['.py', '.java', '.php', '.cs', '.rb']
+            ),
+            
+            # ============================================================
+            # SERVER-SIDE REQUEST FORGERY (SSRF)
+            # Like being tricked into making calls you shouldn't
+            # ============================================================
+            
+            SASTRule(
+                name="Server-Side Request Forgery (SSRF)",
+                pattern=r"""(?:requests\.get|urllib\.request\.urlopen|http\.get|fetch|axios\.get|HttpClient)\s*\([^)]*(?:request\.|req\.|params\.|query\.|body\.|input|GET|POST)""",
+                description="Potential SSRF vulnerability. User input may control server-side HTTP requests.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Validate and whitelist URLs:
+
+VULNERABLE:
+    url = request.args.get('url')
+    response = requests.get(url)
+    
+SECURE:
+    from urllib.parse import urlparse
+    
+    ALLOWED_HOSTS = ['api.trusted.com', 'data.trusted.com']
+    
+    parsed = urlparse(url)
+    if parsed.hostname not in ALLOWED_HOSTS:
+        raise ValueError("URL not allowed")
+    if parsed.scheme not in ['http', 'https']:
+        raise ValueError("Invalid scheme")
+    # Block internal IPs
+    if is_internal_ip(parsed.hostname):
+        raise ValueError("Internal URLs not allowed")""",
+                cwe_id="CWE-918",
+                languages=['.py', '.java', '.js', '.ts', '.go', '.php', '.rb']
+            ),
+            
+            # ============================================================
+            # ADDITIONAL COMMON VULNERABILITIES
+            # ============================================================
+            
+            SASTRule(
+                name="Unsafe Regex (ReDoS)",
+                pattern=r"""(?:re\.compile|new\s+RegExp|regex|pattern)\s*\([^)]*(?:\+\*|\*\+|\.+\*|\.+\+|\(\.\*\)|\(\.\+\)|(?:\[[^\]]*\]){2,}\*|\{\d+,\}\*|\{\d+,\}\+)""",
+                description="Potentially vulnerable regular expression that could cause ReDoS (Regular Expression Denial of Service).",
+                risk_level=RiskLevel.MEDIUM,
+                remediation="""Avoid nested quantifiers in regex:
+
+VULNERABLE:
+    pattern = re.compile(r'(a+)+b')  # Catastrophic backtracking
+    
+SECURE:
+    pattern = re.compile(r'a+b')  # Simple, efficient
+    
+    # Or use atomic groups/possessive quantifiers where supported
+    # Set timeouts for regex operations:
+    import regex
+    regex.match(pattern, text, timeout=1.0)""",
+                cwe_id="CWE-1333",
+                languages=['.py', '.java', '.js', '.ts', '.go', '.php', '.rb']
+            ),
+            
+            SASTRule(
+                name="Prototype Pollution",
+                pattern=r"""(?:Object\.assign|_\.merge|_\.extend|_\.defaults|jQuery\.extend|angular\.(?:merge|extend))\s*\([^,]*,\s*(?:req\.|request\.|params\.|body\.|input)|\[['"]__proto__['"]\]|\[['"]constructor['"]\]\.prototype""",
+                description="Potential prototype pollution vulnerability. Merging user input into objects can modify Object.prototype.",
+                risk_level=RiskLevel.HIGH,
+                remediation="""Validate and sanitize object keys:
+
+VULNERABLE:
+    Object.assign(target, req.body);
+    _.merge(config, userInput);
+    
+SECURE:
+    // Use Object.create(null) for prototype-less objects
+    const safeObj = Object.create(null);
+    
+    // Whitelist allowed properties
+    const allowed = ['name', 'email'];
+    for (const key of allowed) {
+        if (key in userInput) {
+            safeObj[key] = userInput[key];
+        }
+    }
+    
+    // Or use libraries like 'lodash' with safeguards""",
+                cwe_id="CWE-1321",
+                languages=['.js', '.ts']
+            ),
+            
+            SASTRule(
+                name="Open Redirect",
+                pattern=r"""(?:redirect|res\.redirect|header\s*\(\s*['""]Location|window\.location|document\.location)\s*[=(]\s*(?:req\.|request\.|params\.|query\.|input|GET|POST|\$_)""",
+                description="Potential open redirect vulnerability. User input controls redirect destination.",
+                risk_level=RiskLevel.MEDIUM,
+                remediation="""Validate redirect URLs:
+
+VULNERABLE:
+    redirect_url = request.args.get('next')
+    return redirect(redirect_url)
+    
+SECURE:
+    from urllib.parse import urlparse
+    
+    redirect_url = request.args.get('next', '/')
+    parsed = urlparse(redirect_url)
+    
+    # Only allow relative URLs or specific domains
+    if parsed.netloc and parsed.netloc != 'mysite.com':
+        redirect_url = '/'
+    
+    return redirect(redirect_url)""",
+                cwe_id="CWE-601",
+                languages=['.py', '.java', '.js', '.ts', '.php', '.rb']
+            ),
+            
+            SASTRule(
+                name="Mass Assignment",
+                pattern=r"""(?:\.update_attributes|\.update\(|\.create\(|\.build\(|Model\.create|\.save\()\s*\(?[^)]*(?:req\.|request\.|params\[|body\[|:permit\s*\(\s*!)""",
+                description="Potential mass assignment vulnerability. User input may modify unintended model attributes.",
+                risk_level=RiskLevel.MEDIUM,
+                remediation="""Whitelist allowed attributes:
+
+VULNERABLE (Rails):
+    User.create(params[:user])
+    
+SECURE (Rails):
+    User.create(params.require(:user).permit(:name, :email))
+    
+VULNERABLE (Django):
+    User.objects.create(**request.POST)
+    
+SECURE (Django):
+    User.objects.create(
+        name=request.POST.get('name'),
+        email=request.POST.get('email')
+    )
+    
+Always explicitly specify which fields can be mass-assigned.""",
+                cwe_id="CWE-915",
+                languages=['.py', '.rb', '.java', '.js', '.ts', '.php']
+            ),
+        ]
+    
+    def scan_file(self, file_path: str) -> List[Vulnerability]:
+        """
+        Scan a single file for vulnerabilities.
+        
+        Like running a specific diagnostic test on one tissue sample.
+        """
+        vulnerabilities = []
+        
+        try:
+            file_ext = Path(file_path).suffix.lower()
+            
+            if file_ext not in self.file_extensions:
+                return vulnerabilities
+            
+            with open(file_path, 'r', encoding='utf-8', errors='ignore') as f:
+                code = f.read()
+            
+            for rule in self.rules:
+                matches = rule.matches(code, file_ext)
+                for line_num, snippet in matches:
+                    vuln = Vulnerability(
+                        name=rule.name,
+                        description=rule.description,
+                        file_path=file_path,
+                        line_number=line_num,
+                        code_snippet=snippet,
+                        risk_level=rule.risk_level,
+                        remediation=rule.remediation,
+                        cwe_id=rule.cwe_id
+                    )
+                    vulnerabilities.append(vuln)
+        
+        except Exception as e:
+            # Log but don't fail on individual file errors
+            pass
+        
+        return vulnerabilities
+    
+    def scan_directory(self, directory: str, max_workers: int = 8, use_parallel: bool = True) -> Tuple[List[Vulnerability], int]:
+        """
+        Recursively scan a directory with optional parallel processing.
+
+        Like performing a full-body scan.
+
+        Args:
+            directory: Path to directory to scan
+            max_workers: Number of parallel workers (default: 8)
+            use_parallel: Whether to use parallel processing (default: True)
+
+        Returns:
+            Tuple of (vulnerabilities, files_scanned)
+        """
+        vulnerabilities = []
+        files_scanned = 0
+
+        # Collect all files to scan
+        files_to_scan = []
+        for root, dirs, files in os.walk(directory):
+            # Skip unwanted directories
+            dirs[:] = [d for d in dirs if d not in self.skip_dirs]
+
+            for file in files:
+                file_path = os.path.join(root, file)
+                file_ext = Path(file_path).suffix.lower()
+
+                if file_ext in self.file_extensions:
+                    files_to_scan.append(file_path)
+
+        if not use_parallel or len(files_to_scan) <= 1:
+            # Sequential processing (original behavior)
+            for file_path in files_to_scan:
+                files_scanned += 1
+                vulns = self.scan_file(file_path)
+                vulnerabilities.extend(vulns)
+        else:
+            # Parallel processing using ThreadPoolExecutor
+            with ThreadPoolExecutor(max_workers=max_workers) as executor:
+                # Submit all scan jobs
+                future_to_file = {
+                    executor.submit(self.scan_file, file_path): file_path
+                    for file_path in files_to_scan
+                }
+
+                # Collect results as they complete
+                for future in as_completed(future_to_file):
+                    file_path = future_to_file[future]
+                    try:
+                        vulns = future.result()
+                        vulnerabilities.extend(vulns)
+                        files_scanned += 1
+                    except Exception as e:
+                        # Log error but continue with other files
+                        print(f"Error scanning {file_path}: {e}")
+                        files_scanned += 1  # Count as scanned even if error
+
+        return vulnerabilities, files_scanned
+
+
+class NVDClient:
+    """
+    NIST National Vulnerability Database Client
+    
+    Analogy: This is like searching a medical journal database
+    - Searches for known vulnerabilities (diseases) by keyword
+    - Retrieves detailed information including severity scores
+    - Provides references to official documentation
+    
+    The NVD contains over 200,000 known vulnerabilities (CVEs)
+    with detailed descriptions, severity scores, and references.
+    """
+    
+    BASE_URL = "https://services.nvd.nist.gov/rest/json/cves/2.0"
+    
+    def __init__(self, api_key: Optional[str] = None):
+        """
+        Initialize NVD client.
+        
+        Args:
+            api_key: Optional NVD API key for higher rate limits.
+                    Get one free at: https://nvd.nist.gov/developers/request-an-api-key
+        """
+        self.api_key = api_key
+        self.rate_limit_delay = 0.6 if api_key else 6.0  # NVD rate limits
+    
+    async def search_vulnerabilities(
+        self,
+        keyword: Optional[str] = None,
+        cwe_id: Optional[str] = None,
+        severity: Optional[str] = None,
+        limit: int = 20
+    ) -> List[Dict]:
+        """
+        Search the NVD for vulnerabilities.
+        
+        Args:
+            keyword: Search term (e.g., "sql injection python")
+            cwe_id: CWE ID to filter by (e.g., "CWE-89")
+            severity: Severity level (LOW, MEDIUM, HIGH, CRITICAL)
+            limit: Maximum results to return
+        
+        Returns:
+            List of CVE entries with details
+        """
+        params = {"resultsPerPage": min(limit, 100)}
+        
+        if keyword:
+            params["keywordSearch"] = keyword
+        
+        if cwe_id:
+            # Format: CWE-89 -> CWE-89
+            params["cweId"] = cwe_id
+        
+        if severity:
+            params["cvssV3Severity"] = severity.upper()
+        
+        headers = {}
+        if self.api_key:
+            headers["apiKey"] = self.api_key
+        
+        try:
+            async with aiohttp.ClientSession() as session:
+                async with session.get(
+                    self.BASE_URL,
+                    params=params,
+                    headers=headers,
+                    timeout=aiohttp.ClientTimeout(total=30)
+                ) as response:
+                    if response.status == 200:
+                        data = await response.json()
+                        return self._parse_results(data)
+                    elif response.status == 403:
+                        return [{"error": "NVD API rate limited. Consider using an API key."}]
+                    else:
+                        return [{"error": f"NVD API error: {response.status}"}]
+        
+        except asyncio.TimeoutError:
+            return [{"error": "NVD API request timed out"}]
+        except Exception as e:
+            return [{"error": f"NVD API error: {str(e)}"}]
+    
+    def _parse_results(self, data: Dict) -> List[Dict]:
+        """Parse NVD API response into a cleaner format."""
+        results = []
+        
+        for vuln in data.get("vulnerabilities", []):
+            cve = vuln.get("cve", {})
+            cve_id = cve.get("id", "Unknown")
+            
+            # Get description
+            descriptions = cve.get("descriptions", [])
+            description = next(
+                (d["value"] for d in descriptions if d.get("lang") == "en"),
+                "No description available"
+            )
+            
+            # Get CVSS score and severity
+            metrics = cve.get("metrics", {})
+            cvss_data = None
+            severity = "UNKNOWN"
+            score = 0.0
+            
+            # Try CVSS v3.1, then v3.0, then v2.0
+            for version in ["cvssMetricV31", "cvssMetricV30", "cvssMetricV2"]:
+                if version in metrics and metrics[version]:
+                    cvss_data = metrics[version][0]
+                    if "cvssData" in cvss_data:
+                        score = cvss_data["cvssData"].get("baseScore", 0)
+                        severity = cvss_data["cvssData"].get("baseSeverity", "UNKNOWN")
+                    break
+            
+            # Get references
+            references = [
+                ref.get("url") for ref in cve.get("references", [])[:5]
+            ]
+            
+            # Get CWE IDs
+            cwes = []
+            for weakness in cve.get("weaknesses", []):
+                for desc in weakness.get("description", []):
+                    if desc.get("value", "").startswith("CWE-"):
+                        cwes.append(desc["value"])
+            
+            results.append({
+                "cve_id": cve_id,
+                "description": description[:500] + "..." if len(description) > 500 else description,
+                "severity": severity,
+                "cvss_score": score,
+                "cwes": cwes,
+                "references": references,
+                "published": cve.get("published", "Unknown"),
+                "last_modified": cve.get("lastModified", "Unknown")
+            })
+        
+        return results
+    
+    async def get_cve_details(self, cve_id: str) -> Optional[Dict]:
+        """
+        Get detailed information about a specific CVE.
+        
+        Args:
+            cve_id: CVE identifier (e.g., "CVE-2021-44228")
+        
+        Returns:
+            Detailed CVE information or None if not found
+        """
+        params = {"cveId": cve_id}
+        
+        headers = {}
+        if self.api_key:
+            headers["apiKey"] = self.api_key
+        
+        try:
+            async with aiohttp.ClientSession() as session:
+                async with session.get(
+                    self.BASE_URL,
+                    params=params,
+                    headers=headers,
+                    timeout=aiohttp.ClientTimeout(total=30)
+                ) as response:
+                    if response.status == 200:
+                        data = await response.json()
+                        results = self._parse_results(data)
+                        return results[0] if results else None
+                    return None
+        
+        except Exception:
+            return None
+    
+    async def find_related_cves(self, cwe_id: str, limit: int = 10) -> List[Dict]:
+        """
+        Find CVEs related to a specific CWE.
+        
+        This helps answer "What known attacks use this vulnerability type?"
+        
+        Args:
+            cwe_id: CWE identifier (e.g., "CWE-89")
+            limit: Maximum results
+        
+        Returns:
+            List of related CVEs
+        """
+        return await self.search_vulnerabilities(cwe_id=cwe_id, limit=limit)
+
+
+class WebAppScanner:
+    """
+    Web Application Scanner
+    
+    Analogy: Like a physical security inspector
+    - Checks doors and windows (endpoints)
+    - Tests locks (authentication)
+    - Looks for signs of vulnerability
+    
+    This performs basic web security checks without being intrusive.
+    For full web app testing, specialized tools like OWASP ZAP are recommended.
+    """
+    
+    def __init__(self):
+        self.common_paths = [
+            # Admin paths
+            "/admin", "/administrator", "/admin.php", "/admin.html",
+            "/wp-admin", "/cpanel", "/phpmyadmin",
+            # Sensitive files
+            "/.git/config", "/.env", "/config.php", "/wp-config.php",
+            "/.htaccess", "/web.config", "/robots.txt", "/sitemap.xml",
+            # Backup files
+            "/backup.zip", "/backup.sql", "/db.sql", "/database.sql",
+            # API endpoints
+            "/api", "/api/v1", "/graphql", "/swagger.json", "/openapi.json",
+            # Debug/test
+            "/debug", "/test", "/phpinfo.php", "/info.php",
+        ]
+        
+        self.security_headers = [
+            "Content-Security-Policy",
+            "X-Frame-Options",
+            "X-Content-Type-Options",
+            "X-XSS-Protection",
+            "Strict-Transport-Security",
+            "Referrer-Policy",
+            "Permissions-Policy"
+        ]
+    
+    async def scan_url(self, url: str) -> List[Vulnerability]:
+        """
+        Perform security scan on a web application.
+        
+        Args:
+            url: Target URL (e.g., "https://example.com")
+        
+        Returns:
+            List of discovered vulnerabilities
+        """
+        vulnerabilities = []
+        
+        # Normalize URL
+        if not url.startswith(('http://', 'https://')):
+            url = 'https://' + url
+        
+        parsed = urlparse(url)
+        base_url = f"{parsed.scheme}://{parsed.netloc}"
+        
+        async with aiohttp.ClientSession() as session:
+            # Check security headers
+            header_vulns = await self._check_security_headers(session, base_url)
+            vulnerabilities.extend(header_vulns)
+            
+            # Check for exposed sensitive files
+            exposure_vulns = await self._check_sensitive_paths(session, base_url)
+            vulnerabilities.extend(exposure_vulns)
+            
+            # Check HTTPS configuration
+            https_vulns = await self._check_https(session, url)
+            vulnerabilities.extend(https_vulns)
+            
+            # Check for common vulnerabilities in responses
+            content_vulns = await self._check_response_content(session, base_url)
+            vulnerabilities.extend(content_vulns)
+        
+        return vulnerabilities
+    
+    async def _check_security_headers(
+        self, session: aiohttp.ClientSession, url: str
+    ) -> List[Vulnerability]:
+        """Check for missing or misconfigured security headers."""
+        vulnerabilities = []
+        
+        try:
+            async with session.head(url, timeout=aiohttp.ClientTimeout(total=10)) as response:
+                headers = response.headers
+                
+                for header in self.security_headers:
+                    if header not in headers:
+                        vuln = Vulnerability(
+                            name=f"Missing Security Header: {header}",
+                            description=f"The {header} header is not set. This header helps protect against various attacks.",
+                            file_path=url,
+                            line_number=0,
+                            code_snippet=f"Response headers do not include {header}",
+                            risk_level=RiskLevel.LOW if header != "Content-Security-Policy" else RiskLevel.MEDIUM,
+                            remediation=self._get_header_remediation(header),
+                            cwe_id="CWE-693"
+                        )
+                        vulnerabilities.append(vuln)
+                
+                # Check for server version disclosure
+                if "Server" in headers and any(v in headers["Server"].lower() for v in ["apache/", "nginx/", "iis/"]):
+                    vuln = Vulnerability(
+                        name="Server Version Disclosure",
+                        description=f"Server header reveals version information: {headers['Server']}",
+                        file_path=url,
+                        line_number=0,
+                        code_snippet=f"Server: {headers['Server']}",
+                        risk_level=RiskLevel.INFO,
+                        remediation="Configure your web server to hide version information. In Apache, use 'ServerTokens Prod'. In Nginx, use 'server_tokens off'.",
+                        cwe_id="CWE-200"
+                    )
+                    vulnerabilities.append(vuln)
+        
+        except Exception:
+            pass
+        
+        return vulnerabilities
+    
+    async def _check_sensitive_paths(
+        self, session: aiohttp.ClientSession, base_url: str
+    ) -> List[Vulnerability]:
+        """Check for exposed sensitive files and directories."""
+        vulnerabilities = []
+        
+        async def check_path(path: str):
+            try:
+                url = f"{base_url}{path}"
+                async with session.get(
+                    url,
+                    timeout=aiohttp.ClientTimeout(total=5),
+                    allow_redirects=False
+                ) as response:
+                    if response.status == 200:
+                        return path, response.status
+                    return None
+            except Exception:
+                return None
+        
+        # Check paths concurrently
+        tasks = [check_path(path) for path in self.common_paths]
+        results = await asyncio.gather(*tasks)
+        
+        for result in results:
+            if result:
+                path, status = result
+                risk = RiskLevel.HIGH if any(
+                    s in path for s in ['.git', '.env', 'config', 'backup', 'sql']
+                ) else RiskLevel.MEDIUM
+                
+                vuln = Vulnerability(
+                    name=f"Exposed Sensitive Path: {path}",
+                    description=f"The path {path} is accessible and may expose sensitive information.",
+                    file_path=f"{base_url}{path}",
+                    line_number=0,
+                    code_snippet=f"HTTP {status} returned for {path}",
+                    risk_level=risk,
+                    remediation=f"Restrict access to {path} using web server configuration. Add authentication or remove from public access.",
+                    cwe_id="CWE-538"
+                )
+                vulnerabilities.append(vuln)
+        
+        return vulnerabilities
+    
+    async def _check_https(
+        self, session: aiohttp.ClientSession, url: str
+    ) -> List[Vulnerability]:
+        """Check HTTPS configuration."""
+        vulnerabilities = []
+        parsed = urlparse(url)
+        
+        if parsed.scheme == "http":
+            vuln = Vulnerability(
+                name="Insecure HTTP Connection",
+                description="The target is using HTTP instead of HTTPS. All data transmitted is unencrypted.",
+                file_path=url,
+                line_number=0,
+                code_snippet=f"URL scheme: {parsed.scheme}",
+                risk_level=RiskLevel.HIGH,
+                remediation="Enable HTTPS with a valid TLS certificate. Consider using Let's Encrypt for free certificates. Configure HSTS to prevent downgrade attacks.",
+                cwe_id="CWE-319"
+            )
+            vulnerabilities.append(vuln)
+        
+        return vulnerabilities
+    
+    async def _check_response_content(
+        self, session: aiohttp.ClientSession, base_url: str
+    ) -> List[Vulnerability]:
+        """Check response content for potential vulnerabilities."""
+        vulnerabilities = []
+        
+        try:
+            async with session.get(
+                base_url,
+                timeout=aiohttp.ClientTimeout(total=10)
+            ) as response:
+                if response.status == 200:
+                    content = await response.text()
+                    
+                    # Check for error messages that reveal information
+                    error_patterns = [
+                        (r"mysql_error|mysqli_error|pg_error", "Database Error Disclosure", "CWE-209"),
+                        (r"stack\s*trace|traceback|exception.*at\s+line", "Stack Trace Disclosure", "CWE-209"),
+                        (r"debug\s*=\s*true|debug_mode|development_mode", "Debug Mode Enabled", "CWE-215"),
+                        (r"<!--.*(?:password|api.?key|secret).*-->", "Sensitive Data in Comments", "CWE-615"),
+                    ]
+                    
+                    for pattern, name, cwe in error_patterns:
+                        if re.search(pattern, content, re.IGNORECASE):
+                            vuln = Vulnerability(
+                                name=name,
+                                description=f"The response contains {name.lower()} which may reveal sensitive information.",
+                                file_path=base_url,
+                                line_number=0,
+                                code_snippet=f"Pattern detected: {pattern}",
+                                risk_level=RiskLevel.MEDIUM,
+                                remediation=f"Remove {name.lower()} from production responses. Configure error handling to show generic messages.",
+                                cwe_id=cwe
+                            )
+                            vulnerabilities.append(vuln)
+        
+        except Exception:
+            pass
+        
+        return vulnerabilities
+    
+    def _get_header_remediation(self, header: str) -> str:
+        """Get specific remediation advice for missing headers."""
+        remediations = {
+            "Content-Security-Policy": "Add CSP header to control resource loading. Start with: Content-Security-Policy: default-src 'self'",
+            "X-Frame-Options": "Add: X-Frame-Options: DENY (or SAMEORIGIN if you need framing)",
+            "X-Content-Type-Options": "Add: X-Content-Type-Options: nosniff",
+            "X-XSS-Protection": "Add: X-XSS-Protection: 1; mode=block (note: deprecated in favor of CSP)",
+            "Strict-Transport-Security": "Add: Strict-Transport-Security: max-age=31536000; includeSubDomains",
+            "Referrer-Policy": "Add: Referrer-Policy: strict-origin-when-cross-origin",
+            "Permissions-Policy": "Add: Permissions-Policy: geolocation=(), microphone=(), camera=()"
+        }
+        return remediations.get(header, f"Configure the {header} header appropriately.")
+
+
+class SecurityChecker:
+    """
+    Main Security Checker - Orchestrates all scanning capabilities.
+    
+    Analogy: This is like a complete medical center
+    - Diagnostic imaging (SAST)
+    - Medical database (NVD)
+    - Physical examination (Web Scanner)
+    - Report generation (Results)
+    
+    Usage:
+        checker = SecurityChecker()
+        
+        # Scan local code
+        result = await checker.scan_local("/path/to/project")
+        
+        # Scan web app
+        result = await checker.scan_web("https://example.com")
+        
+        # Generate report
+        report = checker.generate_report(result)
+    """
+    
+    def __init__(self, nvd_api_key: Optional[str] = None):
+        self.sast_engine = SASTEngine()
+        self.nvd_client = NVDClient(api_key=nvd_api_key)
+        self.web_scanner = WebAppScanner()
+    
+    async def scan_local(self, path: str, include_nvd: bool = True, max_workers: int = 8, use_parallel: bool = True) -> ScanResult:
+        """
+        Scan a local directory for vulnerabilities.
+
+        Args:
+            path: Path to directory or file
+            include_nvd: Whether to enrich results with NVD data
+            max_workers: Number of parallel workers for file scanning (default: 8)
+            use_parallel: Whether to use parallel processing (default: True)
+
+        Returns:
+            ScanResult with all findings
+        """
+        result = ScanResult(
+            target=path,
+            scan_type="local",
+            start_time=datetime.now()
+        )
+
+        if not os.path.exists(path):
+            result.errors.append(f"Path does not exist: {path}")
+            result.end_time = datetime.now()
+            return result
+
+        # Run SAST scan
+        if os.path.isfile(path):
+            vulns = self.sast_engine.scan_file(path)
+            result.files_scanned = 1
+        else:
+            vulns, files_scanned = self.sast_engine.scan_directory(
+                path,
+                max_workers=max_workers,
+                use_parallel=use_parallel
+            )
+            result.files_scanned = files_scanned
+
+        # Enrich with NVD data if requested
+        if include_nvd and vulns:
+            vulns = await self._enrich_with_nvd(vulns)
+
+        result.vulnerabilities = vulns
+        result.end_time = datetime.now()
+
+        return result
+    
+    async def scan_web(self, url: str, include_nvd: bool = True) -> ScanResult:
+        """
+        Scan a web application for vulnerabilities.
+        
+        Args:
+            url: Target URL
+            include_nvd: Whether to enrich results with NVD data
+        
+        Returns:
+            ScanResult with all findings
+        """
+        result = ScanResult(
+            target=url,
+            scan_type="web",
+            start_time=datetime.now()
+        )
+        
+        try:
+            vulns = await self.web_scanner.scan_url(url)
+            
+            if include_nvd and vulns:
+                vulns = await self._enrich_with_nvd(vulns)
+            
+            result.vulnerabilities = vulns
+            result.files_scanned = 1  # One URL scanned
+        
+        except Exception as e:
+            result.errors.append(str(e))
+        
+        result.end_time = datetime.now()
+        return result
+    
+    async def _enrich_with_nvd(
+        self, vulnerabilities: List[Vulnerability]
+    ) -> List[Vulnerability]:
+        """
+        Enrich vulnerability findings with NVD data.
+        
+        This adds related CVEs to each finding, showing real-world
+        examples of the vulnerability being exploited.
+        """
+        # Group by CWE to reduce API calls
+        cwe_groups = {}
+        for vuln in vulnerabilities:
+            if vuln.cwe_id:
+                if vuln.cwe_id not in cwe_groups:
+                    cwe_groups[vuln.cwe_id] = []
+                cwe_groups[vuln.cwe_id].append(vuln)
+        
+        # Fetch CVEs for each CWE
+        for cwe_id, vuln_list in cwe_groups.items():
+            try:
+                cves = await self.nvd_client.find_related_cves(cwe_id, limit=5)
+                cve_ids = [cve.get("cve_id") for cve in cves if "error" not in cve]
+                
+                for vuln in vuln_list:
+                    vuln.cve_ids = cve_ids[:3]  # Add top 3 related CVEs
+                
+                # Rate limiting
+                await asyncio.sleep(self.nvd_client.rate_limit_delay)
+            
+            except Exception:
+                pass
+        
+        return vulnerabilities
+    
+    async def search_nvd(
+        self,
+        keyword: Optional[str] = None,
+        cwe_id: Optional[str] = None,
+        severity: Optional[str] = None
+    ) -> List[Dict]:
+        """
+        Search the NVD directly.
+        
+        Useful for researching specific vulnerabilities.
+        """
+        return await self.nvd_client.search_vulnerabilities(
+            keyword=keyword,
+            cwe_id=cwe_id,
+            severity=severity
+        )
+    
+    def generate_report(
+        self,
+        result: ScanResult,
+        format: str = "text"
+    ) -> str:
+        """
+        Generate a human-readable report.
+        
+        Args:
+            result: ScanResult from a scan
+            format: Output format ("text", "json", "html")
+        
+        Returns:
+            Formatted report string
+        """
+        if format == "json":
+            return self._generate_json_report(result)
+        elif format == "markdown":
+            return self._generate_markdown_report(result)
+        else:
+            return self._generate_text_report(result)
+    
+    def _generate_text_report(self, result: ScanResult) -> str:
+        """Generate plain text report."""
+        lines = [
+            "=" * 70,
+            "SECURITY SCAN REPORT",
+            "=" * 70,
+            "",
+            f"Target: {result.target}",
+            f"Scan Type: {result.scan_type.upper()}",
+            f"Start Time: {result.start_time.strftime('%Y-%m-%d %H:%M:%S')}",
+            f"End Time: {result.end_time.strftime('%Y-%m-%d %H:%M:%S') if result.end_time else 'N/A'}",
+            f"Files Scanned: {result.files_scanned}",
+            "",
+        ]
+        
+        # Summary
+        summary = result.summary()
+        lines.extend([
+            "-" * 70,
+            "SUMMARY",
+            "-" * 70,
+            f"Total Vulnerabilities: {summary['total_vulnerabilities']}",
+            "",
+            "By Severity:",
+        ])
+        
+        for severity, count in summary["by_severity"].items():
+            if count > 0:
+                lines.append(f"  {severity}: {count}")
+        
+        lines.append("")
+        
+        if result.errors:
+            lines.extend([
+                "-" * 70,
+                "ERRORS",
+                "-" * 70,
+            ])
+            for error in result.errors:
+                lines.append(f"  • {error}")
+            lines.append("")
+        
+        # Vulnerabilities by severity
+        if result.vulnerabilities:
+            lines.extend([
+                "-" * 70,
+                "DETAILED FINDINGS",
+                "-" * 70,
+                "",
+            ])
+            
+            # Sort by severity
+            severity_order = {
+                RiskLevel.CRITICAL: 0,
+                RiskLevel.HIGH: 1,
+                RiskLevel.MEDIUM: 2,
+                RiskLevel.LOW: 3,
+                RiskLevel.INFO: 4
+            }
+            
+            sorted_vulns = sorted(
+                result.vulnerabilities,
+                key=lambda v: severity_order.get(v.risk_level, 5)
+            )
+            
+            for i, vuln in enumerate(sorted_vulns, 1):
+                lines.extend([
+                    f"[{i}] {vuln.name}",
+                    f"    Severity: {vuln.risk_level.value}",
+                    f"    Location: {vuln.file_path}:{vuln.line_number}",
+                    f"    CWE: {vuln.cwe_id or 'N/A'}",
+                    "",
+                    f"    Description:",
+                    f"    {vuln.description}",
+                    "",
+                    f"    Code:",
+                    "    " + "-" * 40,
+                ])
+                
+                for line in vuln.code_snippet.split('\n'):
+                    lines.append(f"    {line}")
+                
+                lines.extend([
+                    "    " + "-" * 40,
+                    "",
+                    f"    Remediation:",
+                ])
+                
+                if vuln.remediation and vuln.remediation != "No known solution":
+                    for line in vuln.remediation.split('\n'):
+                        lines.append(f"    {line}")
+                else:
+                    lines.append("    No known solution")
+                
+                if vuln.cve_ids:
+                    lines.extend([
+                        "",
+                        f"    Related CVEs: {', '.join(vuln.cve_ids)}",
+                    ])
+                
+                lines.extend(["", ""])
+        
+        lines.extend([
+            "=" * 70,
+            "END OF REPORT",
+            "=" * 70,
+        ])
+        
+        return "\n".join(lines)
+    
+    def _generate_json_report(self, result: ScanResult) -> str:
+        """Generate JSON report."""
+        report = {
+            "target": result.target,
+            "scan_type": result.scan_type,
+            "start_time": result.start_time.isoformat(),
+            "end_time": result.end_time.isoformat() if result.end_time else None,
+            "summary": result.summary(),
+            "vulnerabilities": [v.to_dict() for v in result.vulnerabilities],
+            "errors": result.errors
+        }
+        return json.dumps(report, indent=2)
+    
+    def _generate_markdown_report(self, result: ScanResult) -> str:
+        """Generate Markdown report optimized for vibe-coding platforms."""
+        summary = result.summary()
+        severity_order = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"]
+
+        lines = []
+        lines.append("# Security Scan Report\n")
+        lines.append(f"**Target:** `{result.target}`  ")
+        lines.append(f"**Scan Type:** {result.scan_type.upper()}  ")
+        lines.append(f"**Date:** {result.start_time.strftime('%Y-%m-%d %H:%M:%S')}  ")
+        lines.append(f"**Files Scanned:** {result.files_scanned}  ")
+
+        # Summary line
+        counts = []
+        for sev in severity_order:
+            count = summary['by_severity'].get(sev, 0)
+            if count > 0:
+                counts.append(f"{count} {sev.capitalize()}")
+        total = summary['total_vulnerabilities']
+        lines.append(f"**Total Vulnerabilities:** {total}" + (f" ({', '.join(counts)})" if counts else ""))
+        lines.append("\n---\n")
+
+        if total == 0:
+            lines.append("No vulnerabilities found.\n")
+            return "\n".join(lines)
+
+        # Group vulnerabilities by severity
+        by_severity = {}
+        for vuln in result.vulnerabilities:
+            sev = vuln.risk_level.value
+            by_severity.setdefault(sev, []).append(vuln)
+
+        finding_num = 0
+        for sev in severity_order:
+            vulns = by_severity.get(sev, [])
+            if not vulns:
+                continue
+
+            lines.append(f"## {sev.capitalize()}\n")
+
+            for vuln in vulns:
+                finding_num += 1
+                cwe = f" ({vuln.cwe_id})" if vuln.cwe_id else ""
+                lines.append(f"### {finding_num}. {vuln.name}{cwe}\n")
+                lines.append(f"- **File:** `{vuln.file_path}:{vuln.line_number}`")
+                lines.append(f"- **Confidence:** {vuln.confidence}")
+                lines.append(f"- **Description:** {vuln.description}")
+
+                if vuln.code_snippet and vuln.code_snippet.strip():
+                    ext = os.path.splitext(vuln.file_path)[1].lstrip(".")
+                    lang = ext if ext else ""
+                    lines.append(f"- **Code:**")
+                    lines.append(f"  ```{lang}")
+                    lines.append(f"  {vuln.code_snippet.strip()}")
+                    lines.append(f"  ```")
+
+                if vuln.remediation:
+                    lines.append(f"- **Remediation:** {vuln.remediation.strip()}")
+
+                if vuln.cve_ids:
+                    lines.append(f"- **Related CVEs:** {', '.join(vuln.cve_ids)}")
+
+                lines.append("")
+
+        lines.append("---\n")
+        lines.append(f"*Generated by Security Auditor | {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}*\n")
+
+        return "\n".join(lines)
+
+
+# ============================================================
+# CLI Interface
+# ============================================================
+
+async def main():
+    """Command-line interface for the security checker."""
+    import argparse
+    
+    parser = argparse.ArgumentParser(
+        description="Security Checker - SAST and NVD-powered vulnerability scanner",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog="""
+Examples:
+  # Scan a local project
+  python security_checker.py /path/to/project
+  
+  # Scan a web application
+  python security_checker.py https://example.com --web
+  
+  # Generate HTML report
+  python security_checker.py /path/to/project --format html -o report.html
+  
+  # Search NVD for SQL injection vulnerabilities
+  python security_checker.py --nvd-search "sql injection" --severity HIGH
+        """
+    )
+    
+    parser.add_argument(
+        "target",
+        nargs="?",
+        help="Target to scan (local path or URL)"
+    )
+    
+    parser.add_argument(
+        "--web",
+        action="store_true",
+        help="Treat target as web URL"
+    )
+    
+    parser.add_argument(
+        "--format",
+        choices=["text", "json", "html"],
+        default="text",
+        help="Output format (default: text)"
+    )
+    
+    parser.add_argument(
+        "-o", "--output",
+        help="Output file (default: stdout)"
+    )
+    
+    parser.add_argument(
+        "--nvd-api-key",
+        help="NVD API key for higher rate limits"
+    )
+    
+    parser.add_argument(
+        "--no-nvd",
+        action="store_true",
+        help="Skip NVD enrichment"
+    )
+    
+    parser.add_argument(
+        "--nvd-search",
+        help="Search NVD for vulnerabilities by keyword"
+    )
+    
+    parser.add_argument(
+        "--severity",
+        choices=["LOW", "MEDIUM", "HIGH", "CRITICAL"],
+        help="Filter NVD search by severity"
+    )
+    
+    args = parser.parse_args()
+    
+    # Initialize checker
+    checker = SecurityChecker(nvd_api_key=args.nvd_api_key)
+    
+    # NVD search mode
+    if args.nvd_search:
+        print(f"Searching NVD for: {args.nvd_search}")
+        results = await checker.search_nvd(
+            keyword=args.nvd_search,
+            severity=args.severity
+        )
+        
+        if results and "error" not in results[0]:
+            for cve in results:
+                print(f"\n{cve['cve_id']} ({cve['severity']} - {cve['cvss_score']})")
+                print(f"  {cve['description'][:200]}...")
+                if cve['cwes']:
+                    print(f"  CWEs: {', '.join(cve['cwes'])}")
+        else:
+            print(f"Error: {results[0].get('error', 'Unknown error')}")
+        return
+    
+    # Require target for scanning
+    if not args.target:
+        parser.print_help()
+        return
+    
+    # Perform scan
+    print(f"Scanning: {args.target}")
+    print("This may take a moment...")
+    
+    if args.web or args.target.startswith(('http://', 'https://')):
+        result = await checker.scan_web(args.target, include_nvd=not args.no_nvd)
+    else:
+        result = await checker.scan_local(args.target, include_nvd=not args.no_nvd)
+    
+    # Generate report
+    report = checker.generate_report(result, format=args.format)
+    
+    # Output
+    if args.output:
+        with open(args.output, 'w') as f:
+            f.write(report)
+        print(f"Report saved to: {args.output}")
+    else:
+        print(report)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

theme.py

@@ -0,0 +1,84 @@
+"""
+Custom Gradio Theme for Security Auditor
+Based on design mockups in assets/ folder
+"""
+
+import gradio as gr
+
+def create_security_auditor_theme():
+    """
+    Create Anthropic.com-inspired theme for Security Auditor.
+
+    Color Palette:
+    - Background: Light cream #faf9f6 (Anthropic-inspired)
+    - Primary Text: Dark slate #131314
+    - Accent: Warm terracotta #d97757
+    - Cards: Pure white #ffffff
+    - Borders: Light gray #e5e7eb
+
+    Design Philosophy:
+    - Minimalist, clean aesthetic with generous whitespace
+    - Neutral palette with warm accents
+    - Subtle borders, no heavy shadows
+    - Accessibility-focused
+    """
+
+    theme = gr.themes.Soft(
+        primary_hue=gr.themes.colors.orange,
+        secondary_hue=gr.themes.colors.neutral,
+        neutral_hue=gr.themes.colors.neutral,
+        font=[
+            "system-ui",
+            "-apple-system",
+            "BlinkMacSystemFont",
+            "Segoe UI",
+            "Roboto",
+            "sans-serif"
+        ],
+        font_mono=[
+            "ui-monospace",
+            "SF Mono",
+            "Monaco",
+            "Cascadia Code",
+            "monospace"
+        ]
+    ).set(
+        # Background colors
+        body_background_fill="#faf9f6",  # Light cream
+        body_background_fill_dark="#131314",  # Dark mode fallback
+
+        # Block/Card styling
+        block_background_fill="#ffffff",
+        block_border_width="1px",
+        block_border_color="#e5e7eb",
+        block_shadow="none",  # Minimal shadows
+        block_radius="8px",  # Smaller radius for cleaner look
+
+        # Button styling - Anthropic style
+        button_primary_background_fill="#d97757",  # Warm terracotta
+        button_primary_background_fill_hover="#cc6944",  # Darker terracotta
+        button_primary_text_color="#ffffff",
+        button_primary_border_color="#d97757",
+
+        button_secondary_background_fill="transparent",  # Minimal secondary
+        button_secondary_background_fill_hover="rgba(217, 119, 87, 0.1)",
+        button_secondary_text_color="#131314",
+        button_secondary_border_color="#e5e7eb",
+
+        # Input styling
+        input_background_fill="#ffffff",
+        input_border_width="1px",
+        input_border_color="#e5e7eb",
+        input_shadow="none",
+        input_radius="6px",
+
+        # Text colors
+        body_text_color="#131314",  # Dark slate
+        body_text_color_subdued="#6b7280",  # Medium gray
+
+        # Link colors
+        link_text_color="#d97757",
+        link_text_color_hover="#cc6944"
+    )
+
+    return theme

ui_components.py

@@ -0,0 +1,474 @@
+"""
+UI Components for Security Auditor Gradio Interface
+Generates HTML for badges, cards, and sections matching design mockups
+"""
+
+from typing import Dict, List
+
+
+def create_severity_badge(severity: str, count: int = 0) -> str:
+    """
+    Create severity badge as a visual indicator.
+
+    Args:
+        severity: CRITICAL, HIGH, MEDIUM, LOW, INFO
+        count: Number of findings
+
+    Returns:
+        HTML string for severity badge
+    """
+    colors = {
+        "CRITICAL": {"bg": "#fef2f2", "text": "#dc2626", "border": "#fca5a5"},
+        "HIGH": {"bg": "#fff7ed", "text": "#ea580c", "border": "#fdba74"},
+        "MEDIUM": {"bg": "#fffbeb", "text": "#d97706", "border": "#fcd34d"},
+        "LOW": {"bg": "#f0fdfa", "text": "#0d9488", "border": "#5eead4"},
+        "INFO": {"bg": "#f9fafb", "text": "#6b7280", "border": "#d1d5db"}
+    }
+
+    color = colors.get(severity, colors["INFO"])
+
+    return f"""
+    <div
+        class="severity-badge"
+        data-severity="{severity}"
+        style="
+            display: inline-flex;
+            flex-direction: column;
+            align-items: center;
+            padding: 16px 24px;
+            background: {color['bg']};
+            border: 2px solid {color['border']};
+            border-radius: 6px;
+            min-width: 100px;
+        "
+    >
+        <div style="
+            font-size: 11px;
+            font-weight: 600;
+            color: {color['text']};
+            text-transform: capitalize;
+            letter-spacing: 0.05em;
+            margin-bottom: 8px;
+        ">{severity.capitalize()}</div>
+        <div style="
+            font-size: 32px;
+            font-weight: 700;
+            color: {color['text']};
+        ">{count}</div>
+    </div>
+    """
+
+
+def create_finding_card(vulnerability: Dict) -> str:
+    """
+    Create HTML for vulnerability finding card.
+
+    Args:
+        vulnerability: Dict with name, severity, file_path, line_number,
+                      description, cwe_id, cve_ids, remediation
+
+    Returns:
+        HTML string for finding card
+    """
+    severity_colors = {
+        "CRITICAL": "#dc2626",
+        "HIGH": "#ea580c",
+        "MEDIUM": "#d97706",
+        "LOW": "#0d9488",
+        "INFO": "#6b7280"
+    }
+
+    severity_bg = {
+        "CRITICAL": "#fef2f2",
+        "HIGH": "#fff7ed",
+        "MEDIUM": "#fffbeb",
+        "LOW": "#f0fdfa",
+        "INFO": "#f9fafb"
+    }
+
+    severity = vulnerability.get('risk_level', 'INFO')
+    color = severity_colors.get(severity, severity_colors['INFO'])
+    bg = severity_bg.get(severity, severity_bg['INFO'])
+
+    # Build CWE/CVE tags
+    tags_html = ""
+    if vulnerability.get('cwe_id'):
+        tags_html += f"""
+        <span style="
+            display: inline-block;
+            padding: 4px 12px;
+            background: #f3f4f6;
+            color: #4b5563;
+            border-radius: 6px;
+            font-size: 12px;
+            font-weight: 500;
+            margin-right: 8px;
+        ">{vulnerability['cwe_id']}</span>
+        """
+
+    for cve in vulnerability.get('cve_ids', [])[:3]:  # Show max 3 CVEs
+        tags_html += f"""
+        <span style="
+            display: inline-block;
+            padding: 4px 12px;
+            background: #fef2f2;
+            color: #dc2626;
+            border-radius: 6px;
+            font-size: 12px;
+            font-weight: 500;
+            margin-right: 8px;
+        ">{cve}</span>
+        """
+
+    # Build remediation section
+    remediation_html = ""
+    if vulnerability.get('remediation'):
+        # Truncate very long remediation text
+        remediation_text = vulnerability['remediation']
+        if len(remediation_text) > 500:
+            remediation_text = remediation_text[:500] + "..."
+
+        remediation_html = f"""
+        <details style="margin-top: 16px;" class="remediation-details">
+            <summary style="
+                cursor: pointer;
+                padding: 12px 16px;
+                background: #f9fafb;
+                border-radius: 8px;
+                font-weight: 600;
+                color: #374151;
+                user-select: none;
+                display: flex;
+                align-items: center;
+                justify-content: space-between;
+                gap: 8px;
+                transition: background 0.2s ease;
+            " onmouseover="this.style.background='#f3f4f6'" onmouseout="this.style.background='#f9fafb'">
+                <div style="display: flex; align-items: center; gap: 8px;">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24"
+                         fill="none" stroke="#d97757" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                        <path d="M14.7 6.3a1 1 0 0 0 0 1.4l1.6 1.6a1 1 0 0 0 1.4 0l3.77-3.77a6 6 0 0 1-7.94 7.94l-6.91 6.91a2.12 2.12 0 0 1-3-3l6.91-6.91a6 6 0 0 1 7.94-7.94l-3.76 3.76z"></path>
+                    </svg>
+                    <span>Remediation Guidance</span>
+                </div>
+                <svg class="chevron-icon" xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 24 24"
+                     fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                     style="transition: transform 0.2s ease;">
+                    <polyline points="6 9 12 15 18 9"></polyline>
+                </svg>
+            </summary>
+            <style>
+                details[open] .chevron-icon {{
+                    transform: rotate(180deg);
+                }}
+            </style>
+            <div style="
+                padding: 16px;
+                margin-top: 8px;
+                background: #f0fdf4;
+                border-left: 4px solid #10b981;
+                border-radius: 8px;
+            ">
+                <pre style="
+                    background: white;
+                    padding: 12px;
+                    border-radius: 6px;
+                    overflow-x: auto;
+                    font-size: 13px;
+                    line-height: 1.5;
+                    color: #1f2937;
+                    white-space: pre-wrap;
+                    word-wrap: break-word;
+                ">{remediation_text}</pre>
+            </div>
+        </details>
+        """
+
+    return f"""
+    <div class="finding-card" data-severity="{severity}" style="
+        background: white;
+        border: 1px solid #e5e7eb;
+        border-radius: 12px;
+        padding: 20px;
+        margin-bottom: 16px;
+        box-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1);
+    ">
+        <div style="display: flex; justify-content: space-between; align-items: start; margin-bottom: 12px;">
+            <h3 style="
+                margin: 0;
+                font-size: 18px;
+                font-weight: 600;
+                color: #111827;
+            ">{vulnerability.get('name', 'Unknown Vulnerability')}</h3>
+            <span style="
+                padding: 6px 12px;
+                background: {bg};
+                color: {color};
+                border-radius: 6px;
+                font-size: 12px;
+                font-weight: 600;
+                text-transform: uppercase;
+            ">{severity}</span>
+        </div>
+
+        <div style="margin-bottom: 12px;">
+            {tags_html}
+        </div>
+
+        <div style="
+            display: flex;
+            align-items: center;
+            gap: 8px;
+            margin-bottom: 12px;
+            color: #6b7280;
+            font-size: 14px;
+        ">
+            <svg xmlns="http://www.w3.org/2000/svg" width="14" height="14" viewBox="0 0 24 24"
+                 fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+                 style="flex-shrink: 0;">
+                <path d="M14 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V8z"></path>
+                <polyline points="14 2 14 8 20 8"></polyline>
+            </svg>
+            <span style="font-family: 'Fira Code', monospace; color: #374151;">{vulnerability.get('file_path', 'N/A')}:{vulnerability.get('line_number', 'N/A')}</span>
+        </div>
+
+        <p style="
+            margin: 0 0 16px 0;
+            color: #4b5563;
+            line-height: 1.6;
+            font-size: 14px;
+        ">{vulnerability.get('description', '')}</p>
+
+        {remediation_html}
+    </div>
+    """
+
+
+def create_summary_section(scan_result: Dict) -> str:
+    """
+    Create Analysis Summary section with proper alignment and sentence capitalization.
+
+    Args:
+        scan_result: Dict with target, files_scanned, scan_type, summary data
+
+    Returns:
+        HTML string for summary section
+    """
+    summary = scan_result.get('summary', {})
+
+    # Metadata row - Fixed alignment with grid layout
+    metadata_html = f"""
+    <div style="
+        display: grid;
+        grid-template-columns: repeat(4, minmax(0, 1fr));
+        gap: 24px;
+        margin-bottom: 24px;
+        padding: 16px;
+        background: #ffffff;
+        border: 1px solid #e5e7eb;
+        border-radius: 6px;
+    ">
+        <div style="display: flex; flex-direction: column; justify-content: center;">
+            <div style="
+                font-size: 12px;
+                font-weight: 600;
+                color: #6b7280;
+                margin-bottom: 8px;
+                line-height: 1.2;
+            ">Target</div>
+            <div style="
+                font-size: 14px;
+                font-weight: 600;
+                color: #131314;
+                font-family: ui-monospace, monospace;
+                white-space: nowrap;
+                overflow: hidden;
+                text-overflow: ellipsis;
+                line-height: 1.4;
+            " title="{scan_result.get('target', 'N/A')}">{scan_result.get('target', 'N/A')}</div>
+        </div>
+
+        <div style="display: flex; flex-direction: column; justify-content: center;">
+            <div style="
+                font-size: 12px;
+                font-weight: 600;
+                color: #6b7280;
+                margin-bottom: 8px;
+                line-height: 1.2;
+            ">Files analyzed</div>
+            <div style="
+                font-size: 24px;
+                font-weight: 700;
+                color: #131314;
+                line-height: 1.2;
+            ">{scan_result.get('files_scanned', 0)}</div>
+        </div>
+
+        <div style="display: flex; flex-direction: column; justify-content: center;">
+            <div style="
+                font-size: 12px;
+                font-weight: 600;
+                color: #6b7280;
+                margin-bottom: 8px;
+                line-height: 1.2;
+            ">Total findings</div>
+            <div style="
+                font-size: 28px;
+                font-weight: 700;
+                color: #dc2626;
+                line-height: 1.2;
+            ">{summary.get('total_vulnerabilities', 0)}</div>
+        </div>
+
+        <div style="display: flex; flex-direction: column; justify-content: center;">
+            <div style="
+                font-size: 12px;
+                font-weight: 600;
+                color: #6b7280;
+                margin-bottom: 8px;
+                line-height: 1.2;
+            ">Analysis type</div>
+            <div style="
+                font-size: 14px;
+                font-weight: 700;
+                color: #131314;
+                text-transform: capitalize;
+                line-height: 1.2;
+            ">{scan_result.get('scan_type', 'local')}</div>
+        </div>
+    </div>
+    """
+
+    # Severity badges row
+    by_severity = summary.get('by_severity', {})
+    badges_html = f"""
+    <div style="
+        display: flex;
+        gap: 16px;
+        flex-wrap: wrap;
+    ">
+        {create_severity_badge('CRITICAL', by_severity.get('CRITICAL', 0))}
+        {create_severity_badge('HIGH', by_severity.get('HIGH', 0))}
+        {create_severity_badge('MEDIUM', by_severity.get('MEDIUM', 0))}
+        {create_severity_badge('LOW', by_severity.get('LOW', 0))}
+        {create_severity_badge('INFO', by_severity.get('INFO', 0))}
+    </div>
+    """
+
+    return f"""
+    <div style="
+        background: white;
+        border: 1px solid #e5e7eb;
+        border-radius: 12px;
+        padding: 24px;
+        margin-bottom: 12px;
+        box-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1);
+    ">
+        <h2 style="
+            margin: 0 0 20px 0;
+            font-size: 20px;
+            font-weight: 700;
+            color: #131314;
+            display: flex;
+            align-items: center;
+            gap: 8px;
+        ">
+            <svg xmlns="http://www.w3.org/2000/svg" width="22" height="22" viewBox="0 0 24 24"
+                 fill="none" stroke="#d97757" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+                <path d="M9 11l3 3L22 4"></path>
+                <path d="M21 12v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V5a2 2 0 0 1 2-2h11"></path>
+            </svg>
+            Analysis Summary
+        </h2>
+
+        {metadata_html}
+        {badges_html}
+    </div>
+    """
+
+
+def create_empty_state() -> str:
+    """
+    Create HTML for empty state (no results yet).
+
+    Returns:
+        HTML string for empty state
+    """
+    return """
+    <div style="
+        background: white;
+        border: 2px dashed #e5e7eb;
+        border-radius: 12px;
+        padding: 60px 40px;
+        text-align: center;
+        margin: 40px 0;
+    ">
+        <svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 24 24"
+             fill="none" stroke="#6b7280" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"
+             style="margin: 0 auto 16px; display: block;">
+            <circle cx="11" cy="11" r="8"></circle>
+            <path d="m21 21-4.35-4.35"></path>
+        </svg>
+        <h3 style="
+            margin: 0 0 8px 0;
+            font-size: 20px;
+            font-weight: 600;
+            color: #131314;
+        ">Ready to Scan</h3>
+        <p style="
+            margin: 0;
+            color: #6b7280;
+            font-size: 14px;
+        ">Upload files or enter a URL to begin security analysis</p>
+    </div>
+    """
+
+
+def create_loading_state(message: str = "Scanning...") -> str:
+    """
+    Create HTML for loading state.
+
+    Args:
+        message: Loading message to display
+
+    Returns:
+        HTML string for loading state
+    """
+    return f"""
+    <div style="
+        background: white;
+        border: 1px solid #e5e7eb;
+        border-radius: 12px;
+        padding: 40px;
+        text-align: center;
+        margin: 40px 0;
+    ">
+        <div style="
+            display: inline-block;
+            width: 40px;
+            height: 40px;
+            border: 4px solid #f3f4f6;
+            border-top-color: #f59e0b;
+            border-radius: 50%;
+            animation: spin 1s linear infinite;
+            margin-bottom: 16px;
+        "></div>
+        <style>
+            @keyframes spin {{
+                0% {{ transform: rotate(0deg); }}
+                100% {{ transform: rotate(360deg); }}
+            }}
+        </style>
+        <h3 style="
+            margin: 0 0 8px 0;
+            font-size: 18px;
+            font-weight: 600;
+            color: #111827;
+        ">{message}</h3>
+        <p style="
+            margin: 0;
+            color: #6b7280;
+            font-size: 14px;
+        ">This may take a few moments...</p>
+    </div>
+    """