CI: private-IP check -> warning (network tool; secrets+key-files stay hard gates)

- BGP Hijack Alerting: HMAC-SHA256 signed webhooks, exponential backoff,
  6h dedup, /api/webhooks + /api/hijacks endpoints
- PDF Export (3 formats): Executive 3p / Technical 8p (full tables, check
  scores) / Full Report 10p (ASPA analysis + data provenance); 5min cache
- Comparison PDF: side-by-side ASN diff with shared IXPs + facilities
- ASPA Adoption Tracker: daily snapshots, trend history, linear regression
  forecast, /api/aspa-adoption-stats
- IPv6 Adoption per RIR: all 5 RIR delegation files, 24h cache,
  /api/ipv6-adoption-stats
- UI: two-tab adoption overlay (ASPA + IPv6 charts), PDF download buttons
  in action bar and comparison panel
- Bump version v0.6.1 → v0.6.5, add runtime cache files to .gitignore

.github/workflows/security-scan.yml

@@ -0,0 +1,40 @@
+name: security-scan
+
+# For network tooling repos: hard-fail on real secrets (gitleaks) and committed
+# key/.env/weight files; private (RFC1918) IPs are only a WARNING here, because a
+# network tool legitimately contains RFC1918 range constants, demo topology and
+# host-config defaults. Home/server-specific IPs are scrubbed separately.
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  secret-scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: gitleaks full scan (entropy + curated rules)
+        run: |
+          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.24.3/gitleaks_8.24.3_linux_x64.tar.gz -o /tmp/gl.tgz
+          tar -xzf /tmp/gl.tgz -C /tmp gitleaks
+          /tmp/gitleaks detect --source . --no-banner --redact --exit-code 1
+      - name: key / .env / weight files
+        if: always()
+        run: |
+          HITS=$(find . -path ./.git -prune -o -type f \( -name '*.key' -o -name '*.pem' -o -name '.env' -o -name '*.safetensors' -o -name '*.gguf' \) -print | grep -v '.env.example' || true)
+          if [ -n "$HITS" ]; then echo "::error::key/.env/weight file committed:"; echo "$HITS"; exit 1; fi
+          echo "OK: no key/.env/weight files."
+      - name: private IPs (warning only — network tool)
+        if: always()
+        run: |
+          IP='(^|[^0-9.])(10\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}|192\.168\.[0-9]{1,3}\.[0-9]{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]{1,3}\.[0-9]{1,3})'
+          if grep -rIEn "$IP" --include='*.py' --include='*.ts' --include='*.js' --include='*.sh' --exclude-dir=.git --exclude-dir=.github --exclude-dir=docs --exclude-dir=tests . ; then
+            echo "::warning::private IPs present — expected for a network tool; ensure no home/server-specific IP."
+          fi
+          echo "done."

.gitignore

@@ -44,6 +44,8 @@ ecosystem.config.js
 visitors.json
 feedback.json
 hijack-subs.json
+webhook-subs.json
+aspa-adoption-history.json
 audit/reports/
 audit/__pycache__/
 audit/asn_registry.json

CHANGELOG_PENDING.md

@@ -26,3 +26,10 @@
 {"d":"2026-04-09","t":"FIX","m":"renderResilienceScore + renderRouteLeak: functions were called but never defined — caused JS crash 'is not defined' breaking entire doLookup render"}
 {"d":"2026-04-09","t":"INFRA","m":"Production git synced to GitHub main (11 commits ahead fixed via git pull); deploy.sh script added for future deployments"}
 {"d":"2026-04-09","t":"INFRA","m":"PeeringDB SQLite daily cron: peeringdb sync at 03:00 UTC, refresh-peeringdb.sh installed on Erik; DB refreshed 34302→34387 networks"}
+{"d":"2026-04-30","t":"FEAT","m":"BGP Hijack Alerting + Webhooks: real-time hijack detection with HMAC-SHA256 signed webhooks, exponential backoff retries, 6h dedup, /api/webhooks + /api/hijacks endpoints"}
+{"d":"2026-04-30","t":"FEAT","m":"PDF Export: server-side Puppeteer PDF generation with 3 formats — Executive (3p), Technical (8p, full prefix/upstream tables + check scores), Full Report (10p, ASPA analysis + data provenance); 5min cache, /api/export/pdf"}
+{"d":"2026-04-30","t":"FEAT","m":"Comparison PDF: side-by-side ASN comparison as downloadable PDF with shared IXPs, common facilities, peering opportunities, /api/export/pdf/compare"}
+{"d":"2026-04-30","t":"FEAT","m":"ASPA Adoption Tracker: daily snapshots of global ASPA deployment rate (Atlas-denominated coverage %), trend history, linear regression forecast, /api/aspa-adoption-stats"}
+{"d":"2026-04-30","t":"FEAT","m":"IPv6 Adoption per RIR: fetches all 5 RIR delegation files daily, computes IPv6 record percentage per ARIN/RIPE/APNIC/AFRINIC/LACNIC + global, /api/ipv6-adoption-stats"}
+{"d":"2026-04-30","t":"UI","m":"Adoption Tracker overlay panel: two-tab overlay (ASPA Adoption + IPv6 per RIR) matching editorial design, Canvas trend charts, stat cards, data tables — replaces /aspa-adoption nav link"}
+{"d":"2026-04-30","t":"UI","m":"PDF download buttons in UI: action-bar PDF dropdown (Full Report / Executive / Technical Deep-Dive) after ASN lookup; Comparison PDF button at bottom of Network Comparison panel"}

package.json

@@ -70,6 +70,7 @@
     "cheerio": "^1.0.0",
     "node-whois": "^2.1.3",
     "ollama": "^0.5.12",
+    "puppeteer": "^24.42.0",
     "zod": "^3.24.0"
   },
   "devDependencies": {