🛡️ feat: Ghaymah CLI v2 — Security & QA Audit Repository

Comprehensive security audit of the Ghaymah CLI v2 and web platform.

Findings:
  - [CRITICAL] T1552: Dockerfile & .env Credential Leakage
  - [CRITICAL] OWASP A07: Missing OTP & Unverified Password Change
  - [HIGH]     T1539: Session Token Revocation Bypass
  - [MED/HIGH] CWE-400: Configuration Poisoning DoS (Pipeline Hang)

Includes:
  - 8 Proof-of-Concept applications (PoC_Apps/)
  - Visual evidence & screenshots (Assets/Screenshots/)
  - Full PDF audit report (Reports/)
  - Mermaid.js attack flow diagrams in README

Auditor: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist

organize.sh

@@ -0,0 +1,161 @@
+#!/bin/bash
+# ============================================================================
+#  Ghaymah CLI v2 — Audit Workspace Organizer
+#  Author : Ziad Mahmoud Ahmed Abdelgwad
+#  Date   : 2026-08-19
+#  Purpose: Restructure the raw audit workspace into a clean, professional
+#           directory layout suitable for version control and publication.
+# ============================================================================
+
+set -euo pipefail
+WORKSPACE="/root/ghaymah-v2-test"
+cd "$WORKSPACE"
+
+echo ""
+echo "╔══════════════════════════════════════════════════════════════╗"
+echo "║   Ghaymah CLI v2 — Workspace Organizer                     ║"
+echo "╚══════════════════════════════════════════════════════════════╝"
+echo ""
+
+# ── Step 1: Create the target directory structure ────────────────────────────
+echo "[1/5] Creating directory structure..."
+mkdir -p PoC_Apps
+mkdir -p Assets/Screenshots
+mkdir -p Reports
+echo "      ✔  PoC_Apps/"
+echo "      ✔  Assets/Screenshots/"
+echo "      ✔  Reports/"
+
+# ── Step 2: Move all PoC application folders into PoC_Apps ───────────────────
+echo ""
+echo "[2/5] Moving PoC application folders → PoC_Apps/"
+
+for dir in test-app test-app-2 test-app-3 test-app-5 test-app-clean test-app-final; do
+    if [ -d "$dir" ]; then
+        mv "$dir" PoC_Apps/
+        echo "      ✔  $dir → PoC_Apps/$dir"
+    else
+        echo "      ⚠  $dir not found, skipping."
+    fi
+done
+
+for dir in broken-docker-test invalid-docker-test; do
+    if [ -d "$dir" ]; then
+        mv "$dir" PoC_Apps/
+        echo "      ✔  $dir → PoC_Apps/$dir"
+    else
+        echo "      ⚠  $dir not found, skipping."
+    fi
+done
+
+# ── Step 3: Migrate screenshots ─────────────────────────────────────────────
+echo ""
+echo "[3/5] Migrating screenshots → Assets/Screenshots/"
+
+if [ -d "screenshoots" ]; then
+    # Copy contents into the properly-named directory
+    cp -r screenshoots/* Assets/Screenshots/ 2>/dev/null || true
+    # Remove the old misspelled directory
+    rm -rf screenshoots
+    echo "      ✔  screenshoots/* → Assets/Screenshots/"
+    echo "      ✔  Removed old 'screenshoots' directory"
+else
+    echo "      ⚠  screenshoots/ not found, skipping."
+fi
+
+# Rename screenshot files with cleaner names (spaces → underscores)
+cd Assets/Screenshots
+for f in *; do
+    clean_name=$(echo "$f" | tr ' ' '_')
+    if [ "$f" != "$clean_name" ]; then
+        mv "$f" "$clean_name"
+        echo "      ✔  Renamed: $f → $clean_name"
+    fi
+done
+cd "$WORKSPACE"
+
+# ── Step 4: Move the audit report ───────────────────────────────────────────
+echo ""
+echo "[4/5] Moving audit report → Reports/"
+
+if [ -f "Ghaymah_CLI_v2_Audit_Report.pdf" ]; then
+    mv Ghaymah_CLI_v2_Audit_Report.pdf Reports/
+    echo "      ✔  Ghaymah_CLI_v2_Audit_Report.pdf → Reports/"
+fi
+
+# Clean up Zone.Identifier files (Windows artifact)
+find . -name "*.Zone.Identifier" -delete 2>/dev/null || true
+echo "      ✔  Cleaned up .Zone.Identifier files"
+
+# ── Step 5: Generate .gitignore ──────────────────────────────────────────────
+echo ""
+echo "[5/5] Generating .gitignore..."
+
+cat > .gitignore << 'GITIGNORE'
+# ============================================================================
+#  Ghaymah CLI v2 Audit — .gitignore
+# ============================================================================
+
+# ── CLI Binary (large / proprietary) ────────────────────────────────────────
+gy-linux-amd64
+
+# ── Windows Zone.Identifier metadata ────────────────────────────────────────
+*.Zone.Identifier
+*:Zone.Identifier
+
+# ── Sensitive environment files ─────────────────────────────────────────────
+.env
+.env.*
+!.env.example
+
+# ── OS-generated files ──────────────────────────────────────────────────────
+.DS_Store
+Thumbs.db
+Desktop.ini
+
+# ── IDE / Editor files ──────────────────────────────────────────────────────
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# ── Node / build artifacts ──────────────────────────────────────────────────
+node_modules/
+dist/
+build/
+*.log
+GITIGNORE
+
+echo "      ✔  .gitignore created"
+
+# ── Summary ──────────────────────────────────────────────────────────────────
+echo ""
+echo "╔══════════════════════════════════════════════════════════════╗"
+echo "║   ✅  Workspace organization complete!                     ║"
+echo "╚══════════════════════════════════════════════════════════════╝"
+echo ""
+echo "Final structure:"
+echo ""
+echo "  ghaymah-v2-test/"
+echo "  ├── Assets/"
+echo "  │   └── Screenshots/"
+echo "  │       ├── docker.png"
+echo "  │       ├── env.png"
+echo "  │       ├── logs.png"
+echo "  │       └── Screenshot_*.png"
+echo "  ├── PoC_Apps/"
+echo "  │   ├── test-app/"
+echo "  │   ├── test-app-2/"
+echo "  │   ├── test-app-3/"
+echo "  │   ├── test-app-5/"
+echo "  │   ├── test-app-clean/"
+echo "  │   ├── test-app-final/"
+echo "  │   ├── broken-docker-test/"
+echo "  │   └── invalid-docker-test/"
+echo "  ├── Reports/"
+echo "  │   └── Ghaymah_CLI_v2_Audit_Report.pdf"
+echo "  ├── .gitignore"
+echo "  ├── organize.sh"
+echo "  └── README.md"
+echo ""