# PHPGuard 1.2 — Phase 3

Native macOS SwiftUI PHP inventory and CVE research tool.

## Included
- Phase 2 SSH inventory, APT update listing, Docker PHP inventory, JSON reports.
- Phase 3 **CVE research** screen using the public NVD 2.0 API, with published dates, descriptions, and CVSS metadata.
- NVD records are keyword-search **candidates only**, NOT confirmed vulnerabilities on your servers.
- No Ubuntu package revision/backport matching is performed; no server is marked secure.
- `Scripts/build.sh` for unsigned local Debug builds and optional launch.
- `Scripts/release.sh` for Release build, Developer ID signing, DMG, notarization and stapling.

## Build
```bash
./Scripts/build.sh
LAUNCH_AFTER_BUILD=0 CONFIGURATION=Release ./Scripts/build.sh
```

## Release
Configure a notarytool keychain profile on your Mac, then run:
```bash
NOTARY_PROFILE=your-profile ./Scripts/release.sh
```
The script auto-detects a Developer ID Application identity, or use `SIGNING_IDENTITY`.
Release artifacts go to `dist/`. No automatic upload or publication.

## Security
SSH requires existing known_hosts entries and key-based authentication. Scans are read-only. NVD results are for research, not a substitute for vendor-specific package advisories.

## Known limitations
Not built/tested with Xcode in this environment. CVE discovery is broad keyword search and may include unrelated products or omit relevant vulnerabilities. NVD may rate-limit requests. Automatic backport assessment is a future phase.


## Version 1.4 security investigation
The SSH audit collects at most 40 recently modified PHP paths from `/var/www` and up to 30 matching Nginx error lines when accessible. It never modifies remote files. Access may be limited by permissions. The scan is not a compromise determination.

## Branding
The app icon is compiled from `PHPGuard/Assets.xcassets/AppIcon.appiconset`. The DMG includes a branded image at `.background/PHPGuard-Installer.png`; this is an included asset, not a custom Finder DMG window background layout.

## Phase 1.5
Import JSON scans using the dashboard button. Re-scan servers to collect structured Docker evidence. A missing PHP binary inside a container is not a vulnerability. Package version comparisons do not verify vendor CVE fixes.


## 1.7 security triage
New scans include securityTriage and dockerCoverage fields in exported JSON. These are advisory inventory notes, not CVE confirmation.