Updates to scanner

README.md

@@ -1,18 +1,31 @@
-# PHPGuard — Phase 2
+# PHPGuard 1.2 — Phase 3
 
-Native SwiftUI macOS application for **read-only** SSH inventory of PHP installations on Linux servers.
+Native macOS SwiftUI PHP inventory and CVE research tool.
 
-## New in Phase 2
-- APT PHP package upgrade inventory (no automatic updates)
-- PHP version discovery inside accessible running Docker containers
-- Per-server findings and status of package/Docker checks
-- Existing SSH inventory, scan history, and JSON export retained
+## Included
+- Phase 2 SSH inventory, APT update listing, Docker PHP inventory, JSON reports.
+- Phase 3 **CVE research** screen using the public NVD 2.0 API, with published dates, descriptions, and CVSS metadata.
+- NVD records are keyword-search **candidates only**, NOT confirmed vulnerabilities on your servers.
+- No Ubuntu package revision/backport matching is performed; no server is marked secure.
+- `Scripts/build.sh` for unsigned local Debug builds and optional launch.
+- `Scripts/release.sh` for Release build, Developer ID signing, DMG, notarization and stapling.
 
-## Security interpretation
-**This is not a CVE scanner yet.** Available upgrades are not necessarily security updates; the absence of upgrades is not evidence of safety. Vendor backports and security advisories must be checked before labelling an installation vulnerable or patched. Docker inspection only checks running containers with a `php` executable accessible on PATH. No compromise detection is performed.
+## Build
+```bash
+./Scripts/build.sh
+LAUNCH_AFTER_BUILD=0 CONFIGURATION=Release ./Scripts/build.sh
+```
 
-## Open in Xcode
-Unzip the archive, open `PHPGuard/PHPGuard.xcodeproj`, select My Mac, and build. macOS 15+; the build has not been verified in Xcode in this environment.
+## Release
+Configure a notarytool keychain profile on your Mac, then run:
+```bash
+NOTARY_PROFILE=your-profile ./Scripts/release.sh
+```
+The script auto-detects a Developer ID Application identity, or use `SIGNING_IDENTITY`.
+Release artifacts go to `dist/`. No automatic upload or publication.
 
-## SSH
-The app invokes `/usr/bin/ssh` with BatchMode and StrictHostKeyChecking. Configure working key-based SSH access in Terminal first. Remote scripts are read-only; APT's upgrade listing may refresh no metadata and uses currently cached package lists. Docker access depends on remote user permissions.
+## Security
+SSH requires existing known_hosts entries and key-based authentication. Scans are read-only. NVD results are for research, not a substitute for vendor-specific package advisories.
+
+## Known limitations
+Not built/tested with Xcode in this environment. CVE discovery is broad keyword search and may include unrelated products or omit relevant vulnerabilities. NVD may rate-limit requests. Automatic backport assessment is a future phase.