feat: add security audit automation scripts and detailed vulnerability documentation

Scripts/git_init.sh

@@ -0,0 +1,81 @@
+#!/bin/sh
+# ============================================================================
+#  Ghaymah CLI v2 Audit — Git Initialization Script
+#  Author : Ziad Mahmoud Ahmed Abdelgwad
+#  Usage  : sh git_init.sh
+# ============================================================================
+
+set -eu
+WORKSPACE="/root/ghaymah-v2-test"
+cd "$WORKSPACE"
+
+echo ""
+echo "╔══════════════════════════════════════════════════════════════╗"
+echo "║   Ghaymah CLI v2 — Git Repository Initialization           ║"
+echo "╚══════════════════════════════════════════════════════════════╝"
+echo ""
+
+# ── Step 1: Initialize the repository ────────────────────────────────────────
+echo "[1/4] Initializing Git repository..."
+git init
+echo "      ✔  Git repository initialized"
+
+# ── Step 2: Configure Git identity (adjust as needed) ────────────────────────
+echo ""
+echo "[2/4] Configuring Git identity..."
+git config user.name "Ziad Mahmoud Ahmed Abdelgwad"
+git config user.email "your-email@example.com"
+echo "      ✔  Git user configured"
+echo "      ⚠  Update user.email if needed: git config user.email \"you@example.com\""
+
+# ── Step 3: Stage all files ──────────────────────────────────────────────────
+echo ""
+echo "[3/4] Staging files..."
+git add -A
+echo "      ✔  All files staged"
+echo ""
+echo "      Files staged (excluding .gitignore patterns):"
+git status --short
+
+# ── Step 4: Initial commit ───────────────────────────────────────────────────
+echo ""
+echo "[4/4] Creating initial commit..."
+git commit -m "🛡️ feat: Ghaymah CLI v2 — Security & QA Audit Repository
+
+Comprehensive security audit of the Ghaymah CLI v2 and web platform.
+
+Findings:
+  - [CRITICAL] T1552: Dockerfile & .env Credential Leakage
+  - [CRITICAL] OWASP A07: Missing OTP & Unverified Password Change
+  - [HIGH]     T1539: Session Token Revocation Bypass
+  - [MED/HIGH] CWE-400: Configuration Poisoning DoS (Pipeline Hang)
+
+Includes:
+  - 8 Proof-of-Concept applications (PoC_Apps/)
+  - Visual evidence & screenshots (Assets/Screenshots/)
+  - Full PDF audit report (Reports/)
+  - Mermaid.js attack flow diagrams in README
+
+Auditor: Ziad Mahmoud Ahmed Abdelgwad — Cybersecurity Specialist"
+
+echo ""
+echo "      ✔  Initial commit created"
+
+# ── Post-init instructions ───────────────────────────────────────────────────
+echo ""
+echo "╔══════════════════════════════════════════════════════════════╗"
+echo "║   ✅  Repository initialized successfully!                 ║"
+echo "╚══════════════════════════════════════════════════════════════╝"
+echo ""
+echo "  Next steps — Add your remote and push:"
+echo ""
+echo "    git remote add origin https://github.com/gitpasha/ghaymah-v2-test.git"
+echo "    git branch -M main"
+echo "    git push -u origin main"
+echo ""
+echo "  Or if using SSH:"
+echo ""
+echo "    git remote add origin git@github.com:gitpasha/ghaymah-v2-test.git"
+echo "    git branch -M main"
+echo "    git push -u origin main"
+echo ""