update

internal/api/handlers.go

···
 
 // ===== GLOBAL DID HANDLER =====
 
-// extractHandle safely extracts the handle from a PLC operation
-func extractHandle(op *plc.PLCOperation) string {
-	if op == nil || op.Operation == nil {
-		return ""
-	}
-
-	// Get "alsoKnownAs"
-	aka, ok := op.Operation["alsoKnownAs"].([]interface{})
-	if !ok {
-		return ""
-	}
-
-	// Find the handle (e.g., "at://handle.bsky.social")
-	for _, item := range aka {
-		if handle, ok := item.(string); ok {
-			if strings.HasPrefix(handle, "at://") {
-				return strings.TrimPrefix(handle, "at://")
-			}
-		}
-	}
-	return ""
-}
-
-// extractPDS safely extracts the PDS endpoint from a PLC operation
-func extractPDS(op *plc.PLCOperation) string {
-	if op == nil || op.Operation == nil {
-		return ""
-	}
-
-	// Get "services"
-	services, ok := op.Operation["services"].(map[string]interface{})
-	if !ok {
-		return ""
-	}
-
-	// Get "atproto_pds"
-	pdsService, ok := services["atproto_pds"].(map[string]interface{})
-	if !ok {
-		return ""
-	}
-
-	// Get "endpoint"
-	if endpoint, ok := pdsService["endpoint"].(string); ok {
-		return endpoint
-	}
-
-	return ""
-}
-
 // handleGetGlobalDID provides a consolidated view of a DID
 func (s *Server) handleGetGlobalDID(w http.ResponseWriter, r *http.Request) {
 	resp := newResponse(w)
···
 	did := vars["did"]
 	ctx := r.Context()
 
-	// --- 1. Get Combined DID Info (from dids and pds_repos) ---
+	// Get DID info (now includes handle and pds from database)
 	didInfo, err := s.db.GetGlobalDIDInfo(ctx, did)
 	if err != nil {
 		if err == sql.ErrNoRows {
-			// Check if DID indexing is disabled (from config)
 			if !s.plcIndexDIDs {
 				resp.error("DID not found. Note: DID indexing is disabled in configuration.", http.StatusNotFound)
 			} else {
···
 		return
 	}
 
-	// --- 2. Get Latest PLC Operation (from plc_bundles) ---
+	// Optionally include latest operation details if requested
 	var latestOperation *plc.PLCOperation
-	if len(didInfo.BundleNumbers) > 0 {
+	if r.URL.Query().Get("include_operation") == "true" && len(didInfo.BundleNumbers) > 0 {
 		lastBundleNum := didInfo.BundleNumbers[len(didInfo.BundleNumbers)-1]
 		ops, err := s.bundleManager.LoadBundleOperations(ctx, lastBundleNum)
 		if err != nil {
···
 		}
 	}
 
-	// --- 3. Extract Handle and PDS from latest operation ---
-	currentHandle := extractHandle(latestOperation)
-	currentPDS := extractPDS(latestOperation)
-
-	// --- 4. Combine and Respond ---
-	resp.json(map[string]interface{}{
+	result := map[string]interface{}{
 		"did":                  didInfo.DID,
-		"handle":               currentHandle, // NEW
-		"current_pds":          currentPDS,    // NEW
+		"handle":               didInfo.Handle,     // From database!
+		"current_pds":          didInfo.CurrentPDS, // From database!
 		"plc_index_created_at": didInfo.CreatedAt,
 		"plc_bundle_history":   didInfo.BundleNumbers,
-		"pds_hosting_on":       didInfo.HostingOn, // This is the historical list from pds_repos
-		"latest_plc_operation": latestOperation,
-	})
+		"pds_hosting_on":       didInfo.HostingOn,
+	}
+
+	// Only include operation if requested
+	if latestOperation != nil {
+		result["latest_plc_operation"] = latestOperation
+	}
+
+	resp.json(result)
 }
 
 // ===== DID HANDLERS =====

internal/plc/bundle.go

···
 	// NEW: Only index DIDs if enabled
 	if bm.indexDIDs {
 		start := time.Now()
+
+		// Extract handle and PDS for each DID using centralized helper
+		didInfoMap := ExtractDIDInfoMap(bf.operations)
+
 		if err := bm.db.AddBundleDIDs(ctx, bundleNum, dids); err != nil {
 			log.Error("Failed to index DIDs for bundle %06d: %v", bundleNum, err)
 			// Don't return error - bundle is already created
 		} else {
+			// Update handle and PDS for each DID
+			for did, info := range didInfoMap {
+				// Validate handle length before saving
+				validHandle := ValidateHandle(info.Handle)
+
+				if err := bm.db.UpsertDID(ctx, did, bundleNum, validHandle, info.PDS); err != nil {
+					log.Error("Failed to update DID %s metadata: %v", did, err)
+				}
+			}
+
 			elapsed := time.Since(start)
 			log.Verbose("✓ Indexed %d unique DIDs for bundle %06d in %v", len(dids), bundleNum, elapsed)
 		}

internal/plc/helpers.go

···
+package plc
+
+import "strings"
+
+// MaxHandleLength is the maximum allowed handle length for database storage
+const MaxHandleLength = 500
+
+// ExtractHandle safely extracts the handle from a PLC operation
+func ExtractHandle(op *PLCOperation) string {
+	if op == nil || op.Operation == nil {
+		return ""
+	}
+
+	// Get "alsoKnownAs"
+	aka, ok := op.Operation["alsoKnownAs"].([]interface{})
+	if !ok {
+		return ""
+	}
+
+	// Find the handle (e.g., "at://handle.bsky.social")
+	for _, item := range aka {
+		if handle, ok := item.(string); ok {
+			if strings.HasPrefix(handle, "at://") {
+				return strings.TrimPrefix(handle, "at://")
+			}
+		}
+	}
+	return ""
+}
+
+// ValidateHandle checks if a handle is valid for database storage
+// Returns empty string if handle is too long
+func ValidateHandle(handle string) string {
+	if len(handle) > MaxHandleLength {
+		return ""
+	}
+	return handle
+}
+
+// ExtractPDS safely extracts the PDS endpoint from a PLC operation
+func ExtractPDS(op *PLCOperation) string {
+	if op == nil || op.Operation == nil {
+		return ""
+	}
+
+	// Get "services"
+	services, ok := op.Operation["services"].(map[string]interface{})
+	if !ok {
+		return ""
+	}
+
+	// Get "atproto_pds"
+	pdsService, ok := services["atproto_pds"].(map[string]interface{})
+	if !ok {
+		return ""
+	}
+
+	// Get "endpoint"
+	if endpoint, ok := pdsService["endpoint"].(string); ok {
+		return endpoint
+	}
+
+	return ""
+}
+
+// DIDInfo contains extracted metadata from a PLC operation
+type DIDInfo struct {
+	Handle string
+	PDS    string
+}
+
+// ExtractDIDInfo extracts both handle and PDS from an operation
+func ExtractDIDInfo(op *PLCOperation) DIDInfo {
+	return DIDInfo{
+		Handle: ExtractHandle(op),
+		PDS:    ExtractPDS(op),
+	}
+}
+
+// ExtractDIDInfoMap creates a map of DID -> info from operations
+// Processes in reverse order to get the latest state for each DID
+func ExtractDIDInfoMap(ops []PLCOperation) map[string]DIDInfo {
+	infoMap := make(map[string]DIDInfo)
+
+	// Process in reverse to get latest state
+	for i := len(ops) - 1; i >= 0; i-- {
+		op := ops[i]
+		if _, exists := infoMap[op.DID]; !exists {
+			infoMap[op.DID] = ExtractDIDInfo(&op)
+		}
+	}
+
+	return infoMap
+}

internal/plc/scanner.go

···
 		return err
 	}
 
+	// NEW: Create/update DID records immediately when adding to mempool
+	for _, op := range ops {
+		info := ExtractDIDInfo(&op)
+
+		// Validate handle length before saving
+		validHandle := ValidateHandle(info.Handle)
+		if info.Handle != "" && validHandle == "" {
+			log.Verbose("Skipping invalid handle for DID %s (length: %d)", op.DID, len(info.Handle))
+		}
+
+		if err := s.db.UpsertDIDFromMempool(ctx, op.DID, validHandle, info.PDS); err != nil {
+			log.Error("Failed to upsert DID %s in mempool: %v", op.DID, err)
+			// Don't fail the whole operation, just log
+		}
+	}
+
 	// Process for endpoint discovery
 	batchCounts, err := s.processBatch(ctx, ops)
 	s.mergeCounts(counts, batchCounts)

internal/storage/db.go

···
 	GetPLCMetrics(ctx context.Context, limit int) ([]*PLCMetrics, error)
 	GetEndpointStats(ctx context.Context) (*EndpointStats, error)
 
-	// DID operations
-	UpsertDID(ctx context.Context, did string, bundleNum int) error
+	// DID operations - UPDATED SIGNATURES
+	UpsertDID(ctx context.Context, did string, bundleNum int, handle, pds string) error
+	UpsertDIDFromMempool(ctx context.Context, did string, handle, pds string) error
 	GetDIDRecord(ctx context.Context, did string) (*DIDRecord, error)
 	GetGlobalDIDInfo(ctx context.Context, did string) (*GlobalDIDInfo, error)
 	AddBundleDIDs(ctx context.Context, bundleNum int, dids []string) error
···
 
 	// PDS Repo operations
 	UpsertPDSRepos(ctx context.Context, endpointID int64, repos []PDSRepoData) error
-	GetPDSRepos(ctx context.Context, endpointID int64, activeOnly bool, limit int, offset int) ([]*PDSRepo, error) // Updated
+	GetPDSRepos(ctx context.Context, endpointID int64, activeOnly bool, limit int, offset int) ([]*PDSRepo, error)
 	GetReposByDID(ctx context.Context, did string) ([]*PDSRepo, error)
 	GetPDSRepoStats(ctx context.Context, endpointID int64) (map[string]interface{}, error)
 

internal/storage/postgres.go

···
     CREATE INDEX IF NOT EXISTS idx_mempool_did ON plc_mempool(did);
     CREATE UNIQUE INDEX IF NOT EXISTS idx_mempool_cid ON plc_mempool(cid);
 
-    -- Minimal dids table
-    CREATE TABLE IF NOT EXISTS dids (
-        did TEXT PRIMARY KEY,
-        bundle_numbers JSONB NOT NULL DEFAULT '[]'::jsonb,
-        created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
-    );
+	-- Minimal dids table
+	CREATE TABLE IF NOT EXISTS dids (
+		did TEXT PRIMARY KEY,
+		handle TEXT,
+		pds TEXT,
+		bundle_numbers JSONB NOT NULL DEFAULT '[]'::jsonb,
+		created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+		updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+	);
 
-    CREATE INDEX IF NOT EXISTS idx_dids_bundle_numbers ON dids USING gin(bundle_numbers);
-    CREATE INDEX IF NOT EXISTS idx_dids_created_at ON dids(created_at);
+	CREATE INDEX IF NOT EXISTS idx_dids_bundle_numbers ON dids USING gin(bundle_numbers);
+	CREATE INDEX IF NOT EXISTS idx_dids_created_at ON dids(created_at);
+	CREATE INDEX IF NOT EXISTS idx_dids_handle ON dids(handle);
+	CREATE INDEX IF NOT EXISTS idx_dids_pds ON dids(pds);
 
 	-- PDS Repositories table
     CREATE TABLE IF NOT EXISTS pds_repos (
···
 
 // ===== DID OPERATIONS =====
 
-func (p *PostgresDB) UpsertDID(ctx context.Context, did string, bundleNum int) error {
+func (p *PostgresDB) UpsertDID(ctx context.Context, did string, bundleNum int, handle, pds string) error {
 	query := `
-		INSERT INTO dids (did, bundle_numbers, created_at)
-		VALUES ($1, jsonb_build_array($2), CURRENT_TIMESTAMP)
+		INSERT INTO dids (did, handle, pds, bundle_numbers, created_at)
+		VALUES ($1, $2, $3, jsonb_build_array($4::integer), CURRENT_TIMESTAMP)
 		ON CONFLICT(did) DO UPDATE SET
+			handle = EXCLUDED.handle,
+			pds = EXCLUDED.pds,
 			bundle_numbers = CASE 
-				WHEN dids.bundle_numbers ? $2::text THEN dids.bundle_numbers
-				ELSE dids.bundle_numbers || jsonb_build_array($2)
-			END
+				WHEN dids.bundle_numbers @> jsonb_build_array($4::integer) THEN dids.bundle_numbers
+				ELSE dids.bundle_numbers || jsonb_build_array($4::integer)
+			END,
+			updated_at = CURRENT_TIMESTAMP
 	`
-	_, err := p.db.ExecContext(ctx, query, did, bundleNum)
+	_, err := p.db.ExecContext(ctx, query, did, handle, pds, bundleNum)
+	return err
+}
+
+// UpsertDIDFromMempool creates/updates DID record without adding to bundle_numbers
+func (p *PostgresDB) UpsertDIDFromMempool(ctx context.Context, did string, handle, pds string) error {
+	query := `
+		INSERT INTO dids (did, handle, pds, bundle_numbers, created_at)
+		VALUES ($1, $2, $3, '[]'::jsonb, CURRENT_TIMESTAMP)
+		ON CONFLICT(did) DO UPDATE SET
+			handle = EXCLUDED.handle,
+			pds = EXCLUDED.pds,
+			updated_at = CURRENT_TIMESTAMP
+	`
+	_, err := p.db.ExecContext(ctx, query, did, handle, pds)
 	return err
 }
 
 func (p *PostgresDB) GetDIDRecord(ctx context.Context, did string) (*DIDRecord, error) {
 	query := `
-		SELECT did, bundle_numbers, created_at
+		SELECT did, handle, pds, bundle_numbers, created_at
 		FROM dids
 		WHERE did = $1
 	`
 
 	var record DIDRecord
 	var bundleNumbersJSON []byte
+	var handle, pds sql.NullString
 
 	err := p.db.QueryRowContext(ctx, query, did).Scan(
 		&record.DID,
+		&handle,
+		&pds,
 		&bundleNumbersJSON,
 		&record.CreatedAt,
 	)
 	if err != nil {
 		return nil, err
+	}
+
+	if handle.Valid {
+		record.Handle = handle.String
+	}
+	if pds.Valid {
+		record.CurrentPDS = pds.String
 	}
 
 	if err := json.Unmarshal(bundleNumbersJSON, &record.BundleNumbers); err != nil {
···
 
 // GetGlobalDIDInfo retrieves consolidated DID info from 'dids' and 'pds_repos'
 func (p *PostgresDB) GetGlobalDIDInfo(ctx context.Context, did string) (*GlobalDIDInfo, error) {
-	// This query now includes a CTE to find primary endpoints and filters
-	// the 'hosting_on' aggregation to only include repos from those endpoints.
 	query := `
 		WITH primary_endpoints AS (
-		  -- First, get the ID of every "primary" PDS.
-		  -- A primary PDS is the one with the earliest 'discovered_at' timestamp
-		  -- for a given 'server_did'.
 		  SELECT DISTINCT ON (COALESCE(server_did, id::text))
 			id
 		  FROM endpoints
···
 		)
 		SELECT
 		  d.did,
+		  d.handle,
+		  d.pds,
 		  d.bundle_numbers,
 		  d.created_at,
 		  COALESCE(
···
 			  )
 			ORDER BY pr.last_seen DESC
 			) FILTER (
-				-- This filter clause ensures we only aggregate repos
-				-- where the endpoint_id is in our list of primary endpoints.
 				WHERE pr.id IS NOT NULL AND pe.id IS NOT NULL
 			),
 			'[]'::jsonb
···
 		LEFT JOIN
 		  endpoints e ON pr.endpoint_id = e.id
 		LEFT JOIN
-		  -- We join the primary_endpoints CTE. 'pe.id' will be NON-NULL
-		  -- only if the repo's endpoint_id (pr.endpoint_id) is a primary one.
 		  primary_endpoints pe ON pr.endpoint_id = pe.id
 		WHERE
 		  d.did = $1
 		GROUP BY
-		  d.did, d.bundle_numbers, d.created_at
+		  d.did, d.handle, d.pds, d.bundle_numbers, d.created_at
 	`
 
 	var info GlobalDIDInfo
 	var bundleNumbersJSON []byte
 	var hostingOnJSON []byte
+	var handle, pds sql.NullString
 
 	err := p.db.QueryRowContext(ctx, query, did).Scan(
 		&info.DID,
+		&handle,
+		&pds,
 		&bundleNumbersJSON,
 		&info.CreatedAt,
 		&hostingOnJSON,
 	)
 	if err != nil {
-		return nil, err // This will correctly be sql.ErrNoRows if not in 'dids'
+		return nil, err
+	}
+
+	if handle.Valid {
+		info.Handle = handle.String
+	}
+	if pds.Valid {
+		info.CurrentPDS = pds.String
 	}
 
 	if err := json.Unmarshal(bundleNumbersJSON, &info.BundleNumbers); err != nil {

utils/vuln-scanner-parallel.sh

···
+#!/bin/bash
+
+# Configuration
+API_HOST="${API_HOST:-http://localhost:8080}"
+TIMEOUT=5
+PARALLEL_JOBS=20
+OUTPUT_DIR="./pds_scan_results"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+RESULTS_FILE="${OUTPUT_DIR}/scan_${TIMESTAMP}.txt"
+FOUND_FILE="${OUTPUT_DIR}/found_${TIMESTAMP}.txt"
+
+# Paths to check
+PATHS=(
+    "/info.php"
+    "/phpinfo.php"
+    "/test.php"
+    "/admin"
+    "/admin.php"
+    "/wp-admin"
+    "/robots.txt"
+    "/.env"
+    "/.git/config"
+    "/config.php"
+    "/backup"
+    "/db.sql"
+    "/.DS_Store"
+    "/server-status"
+    "/.well-known/security.txt"
+)
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+# Check dependencies
+if ! command -v jq &> /dev/null; then
+    echo -e "${RED}Error: jq is required${NC}"
+    echo "Install: sudo apt-get install jq"
+    exit 1
+fi
+
+if ! command -v parallel &> /dev/null; then
+    echo -e "${RED}Error: GNU parallel is required${NC}"
+    echo "Install: sudo apt-get install parallel (or brew install parallel)"
+    exit 1
+fi
+
+mkdir -p "$OUTPUT_DIR"
+
+echo -e "${BLUE}╔════════════════════════════════════════╗${NC}"
+echo -e "${BLUE}║   PDS Security Scanner (Parallel)     ║${NC}"
+echo -e "${BLUE}╚════════════════════════════════════════╝${NC}"
+echo ""
+echo "API Host: $API_HOST"
+echo "Timeout: ${TIMEOUT}s per request"
+echo "Parallel jobs: ${PARALLEL_JOBS}"
+echo "Paths to check: ${#PATHS[@]}"
+echo ""
+
+# Scan function - will be called by GNU parallel
+scan_endpoint() {
+    local endpoint="$1"
+    local timeout="$2"
+    shift 2
+    local paths=("$@")
+    
+    for path in "${paths[@]}"; do
+        url="${endpoint}${path}"
+        
+        response=$(curl -s -o /dev/null -w "%{http_code}" \
+            --max-time "$timeout" \
+            --connect-timeout "$timeout" \
+            --retry 0 \
+            -A "Mozilla/5.0 (Security Scanner)" \
+            "$url" 2>/dev/null)
+        
+        if [ -n "$response" ] && [ "$response" != "404" ] && [ "$response" != "000" ]; then
+            if [ "$response" = "200" ] || [ "$response" = "301" ] || [ "$response" = "302" ]; then
+                echo "FOUND|$endpoint|$path|$response"
+            elif [ "$response" != "403" ] && [ "$response" != "401" ]; then
+                echo "MAYBE|$endpoint|$path|$response"
+            fi
+        fi
+    done
+}
+
+export -f scan_endpoint
+
+# Fetch active PDS endpoints
+echo -e "${YELLOW}Fetching active PDS endpoints...${NC}"
+ENDPOINTS=$(curl -s "${API_HOST}/api/v1/pds?status=online&limit=10000" | \
+    jq -r '.[].endpoint' 2>/dev/null)
+
+if [ -z "$ENDPOINTS" ]; then
+    echo -e "${RED}Error: Could not fetch endpoints from API${NC}"
+    echo "Check that the API is running at: $API_HOST"
+    exit 1
+fi
+
+ENDPOINT_COUNT=$(echo "$ENDPOINTS" | wc -l | tr -d ' ')
+echo -e "${GREEN}✓ Found ${ENDPOINT_COUNT} active PDS endpoints${NC}"
+echo ""
+
+# Write header to results file
+{
+    echo "PDS Security Scan Results"
+    echo "========================="
+    echo "Scan started: $(date)"
+    echo "Endpoints scanned: ${ENDPOINT_COUNT}"
+    echo "Paths checked: ${#PATHS[@]}"
+    echo "Parallel jobs: ${PARALLEL_JOBS}"
+    echo ""
+    echo "Results:"
+    echo "--------"
+} > "$RESULTS_FILE"
+
+# Run parallel scan
+echo -e "${YELLOW}Starting parallel scan...${NC}"
+echo -e "${BLUE}(This may take a few minutes depending on endpoint count)${NC}"
+echo ""
+
+echo "$ENDPOINTS" | \
+    parallel \
+        -j "$PARALLEL_JOBS" \
+        --bar \
+        --joblog "${OUTPUT_DIR}/joblog_${TIMESTAMP}.txt" \
+        scan_endpoint {} "$TIMEOUT" "${PATHS[@]}" \
+    >> "$RESULTS_FILE"
+
+echo ""
+echo -e "${YELLOW}Processing results...${NC}"
+
+# Count results
+FOUND_COUNT=$(grep -c "^FOUND|" "$RESULTS_FILE" 2>/dev/null || echo 0)
+MAYBE_COUNT=$(grep -c "^MAYBE|" "$RESULTS_FILE" 2>/dev/null || echo 0)
+
+# Extract found URLs to separate file
+{
+    echo "Found URLs (HTTP 200/301/302)"
+    echo "=============================="
+    echo "Scan: $(date)"
+    echo ""
+} > "$FOUND_FILE"
+
+grep "^FOUND|" "$RESULTS_FILE" 2>/dev/null | while IFS='|' read -r status endpoint path code; do
+    echo "$endpoint$path [$code]"
+done >> "$FOUND_FILE"
+
+# Create summary at end of results file
+{
+    echo ""
+    echo "Summary"
+    echo "======="
+    echo "Scan completed: $(date)"
+    echo "Total endpoints scanned: ${ENDPOINT_COUNT}"
+    echo "Total paths checked: $((ENDPOINT_COUNT * ${#PATHS[@]}))"
+    echo "Found (200/301/302): ${FOUND_COUNT}"
+    echo "Maybe (other codes): ${MAYBE_COUNT}"
+} >> "$RESULTS_FILE"
+
+# Display summary
+echo ""
+echo -e "${BLUE}╔════════════════════════════════════════╗${NC}"
+echo -e "${BLUE}║            Scan Complete!              ║${NC}"
+echo -e "${BLUE}╚════════════════════════════════════════╝${NC}"
+echo ""
+echo -e "Endpoints scanned:        ${GREEN}${ENDPOINT_COUNT}${NC}"
+echo -e "Paths checked per site:   ${BLUE}${#PATHS[@]}${NC}"
+echo -e "Total requests made:      ${BLUE}$((ENDPOINT_COUNT * ${#PATHS[@]}))${NC}"
+echo ""
+echo -e "Results:"
+echo -e "  ${GREEN}✓ Found (200/301/302):${NC}  ${FOUND_COUNT}"
+echo -e "  ${YELLOW}? Maybe (other):${NC}       ${MAYBE_COUNT}"
+echo ""
+echo "Files created:"
+echo "  Full results:  $RESULTS_FILE"
+echo "  Found URLs:    $FOUND_FILE"
+echo "  Job log:       ${OUTPUT_DIR}/joblog_${TIMESTAMP}.txt"
+
+# Show sample of found URLs if any
+if [ "$FOUND_COUNT" -gt 0 ]; then
+    echo ""
+    echo -e "${RED}⚠ SECURITY ALERT: Found exposed paths!${NC}"
+    echo ""
+    echo "Sample findings (first 10):"
+    grep "^FOUND|" "$RESULTS_FILE" 2>/dev/null | head -10 | while IFS='|' read -r status endpoint path code; do
+        echo -e "  ${RED}✗${NC} $endpoint${RED}$path${NC} [$code]"
+    done
+    
+    if [ "$FOUND_COUNT" -gt 10 ]; then
+        echo ""
+        echo "  ... and $((FOUND_COUNT - 10)) more (see $FOUND_FILE)"
+    fi
+fi
+
+echo ""

utils/vuln-scanner.sh

···
+#!/bin/bash
+
+# Configuration
+API_HOST="${API_HOST:-http://localhost:8080}"
+TIMEOUT=5
+OUTPUT_DIR="./pds_scan_results"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+RESULTS_FILE="${OUTPUT_DIR}/scan_${TIMESTAMP}.txt"
+FOUND_FILE="${OUTPUT_DIR}/found_${TIMESTAMP}.txt"
+
+# Paths to check (one per line for easier editing)
+PATHS=(
+    "/info.php"
+    "/phpinfo.php"
+    "/test.php"
+    "/admin"
+    "/admin.php"
+    "/wp-admin"
+    "/robots.txt"
+    "/.env"
+    "/.git/config"
+    "/config.php"
+    "/backup"
+    "/db.sql"
+    "/.DS_Store"
+    "/server-status"
+    "/.well-known/security.txt"
+)
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+mkdir -p "$OUTPUT_DIR"
+
+echo -e "${BLUE}=== PDS Security Scanner ===${NC}"
+echo "API Host: $API_HOST"
+echo "Timeout: ${TIMEOUT}s"
+echo "Scanning for ${#PATHS[@]} paths"
+echo "Results: $RESULTS_FILE"
+echo ""
+
+# Fetch active PDS endpoints
+echo -e "${YELLOW}Fetching active PDS endpoints...${NC}"
+ENDPOINTS=$(curl -s "${API_HOST}/api/v1/pds?status=online&limit=10000" | \
+    jq -r '.[].endpoint' 2>/dev/null)
+
+if [ -z "$ENDPOINTS" ]; then
+    echo -e "${RED}Error: Could not fetch endpoints from API${NC}"
+    exit 1
+fi
+
+ENDPOINT_COUNT=$(echo "$ENDPOINTS" | wc -l)
+echo -e "${GREEN}Found ${ENDPOINT_COUNT} active PDS endpoints${NC}"
+echo ""
+
+# Write header
+echo "PDS Security Scan - $(date)" > "$RESULTS_FILE"
+echo "========================================" >> "$RESULTS_FILE"
+echo "" >> "$RESULTS_FILE"
+
+# Counters
+CURRENT=0
+TOTAL_FOUND=0
+TOTAL_MAYBE=0
+
+# Scan each endpoint sequentially
+while IFS= read -r endpoint; do
+    CURRENT=$((CURRENT + 1))
+    
+    echo -e "${BLUE}[$CURRENT/$ENDPOINT_COUNT]${NC} Scanning: $endpoint"
+    
+    # Scan each path
+    for path in "${PATHS[@]}"; do
+        url="${endpoint}${path}"
+        
+        # Make request with timeout
+        response=$(curl -s -o /dev/null -w "%{http_code}" \
+            --max-time "$TIMEOUT" \
+            --connect-timeout "$TIMEOUT" \
+            -L \
+            -A "Mozilla/5.0 (Security Scanner)" \
+            "$url" 2>/dev/null)
+        
+        # Check response
+        if [ -n "$response" ] && [ "$response" != "404" ] && [ "$response" != "000" ]; then
+            if [ "$response" = "200" ] || [ "$response" = "301" ] || [ "$response" = "302" ]; then
+                echo -e "  ${GREEN}✓ FOUND${NC} $path ${YELLOW}[$response]${NC}"
+                echo "FOUND: $endpoint$path [$response]" >> "$RESULTS_FILE"
+                echo "$endpoint$path" >> "$FOUND_FILE"
+                TOTAL_FOUND=$((TOTAL_FOUND + 1))
+            elif [ "$response" != "403" ]; then
+                echo -e "  ${YELLOW}? MAYBE${NC} $path ${YELLOW}[$response]${NC}"
+                echo "MAYBE: $endpoint$path [$response]" >> "$RESULTS_FILE"
+                TOTAL_MAYBE=$((TOTAL_MAYBE + 1))
+            fi
+        fi
+    done
+    
+    echo "" >> "$RESULTS_FILE"
+    
+done <<< "$ENDPOINTS"
+
+# Summary
+echo ""
+echo -e "${BLUE}========================================${NC}"
+echo -e "${GREEN}Scan Complete!${NC}"
+echo "Scanned: ${ENDPOINT_COUNT} endpoints"
+echo "Paths checked per endpoint: ${#PATHS[@]}"
+echo -e "${GREEN}Found (200/301/302): ${TOTAL_FOUND}${NC}"
+echo -e "${YELLOW}Maybe (other codes): ${TOTAL_MAYBE}${NC}"
+echo ""
+echo "Full results: $RESULTS_FILE"
+[ -f "$FOUND_FILE" ] && echo "Found URLs: $FOUND_FILE"