Phase 2 SSH inventory, APT update listing, Docker PHP inventory, JSON reports.
Phase 3 CVE research screen using the public NVD 2.0 API, with published dates, descriptions, and CVSS metadata.
NVD records are keyword-search candidates only, NOT confirmed vulnerabilities on your servers.
No Ubuntu package revision/backport matching is performed; no server is marked secure.
Scripts/build.sh for unsigned local Debug builds and optional launch.
Scripts/release.sh for Release build, Developer ID signing, DMG, notarization and stapling.

Build

./Scripts/build.sh
LAUNCH_AFTER_BUILD=0 CONFIGURATION=Release ./Scripts/build.sh

Release

Configure a notarytool keychain profile on your Mac, then run:

NOTARY_PROFILE=your-profile ./Scripts/release.sh

The script auto-detects a Developer ID Application identity, or use SIGNING_IDENTITY. Release artifacts go to dist/. No automatic upload or publication.

Security

SSH requires existing known_hosts entries and key-based authentication. Scans are read-only. NVD results are for research, not a substitute for vendor-specific package advisories.

Known limitations

Not built/tested with Xcode in this environment. CVE discovery is broad keyword search and may include unrelated products or omit relevant vulnerabilities. NVD may rate-limit requests. Automatic backport assessment is a future phase.

Version 1.4 security investigation

The SSH audit collects at most 40 recently modified PHP paths from /var/www and up to 30 matching Nginx error lines when accessible. It never modifies remote files. Access may be limited by permissions. The scan is not a compromise determination.

Branding

The app icon is compiled from PHPGuard/Assets.xcassets/AppIcon.appiconset. The DMG includes a branded image at .background/PHPGuard-Installer.png; this is an included asset, not a custom Finder DMG window background layout.

Phase 1.5

Import JSON scans using the dashboard button. Re-scan servers to collect structured Docker evidence. A missing PHP binary inside a container is not a vulnerability. Package version comparisons do not verify vendor CVE fixes.

1.7 security triage

New scans include securityTriage and dockerCoverage fields in exported JSON. These are advisory inventory notes, not CVE confirmation.