[IXI-2773]

What was actually copied

Verbatim source snapshots from CarterPerez-dev/Cybersecurity-Projects, whose Python source credits ©AngelaMos (2026):

• third_party/community/http-headers-scanner/ — upstream http_headers_scanner.py, README.md, LICENSE and pyproject.toml.
• third_party/community/hash-identifier/ — upstream hash_identifier.py, README.md, LICENSE and pyproject.toml.

Both retain upstream AGPL-3.0-or-later licensing, original source comments, and a pinned commit. Upstream bytes: 8/8 verified against Git blob IDs after import.

Collection metadata

• Adds third_party/community/imports.json, a separate manifest of pinned Git blob IDs, leaving the existing evidence-bound third_party/imports.json unchanged.
• Adds scripts/check_community_imports.py for exact byte and Python syntax checks without executing network tools.
• Adds source-only/third-party labels to root README and licensing indexes; no new portfolio-authored implementation, scan outcomes or measured detection claims.

Scope and safety

• Pure upstream source import; upstream large learning modules, tests and lockfiles intentionally omitted.
• Neither scanner nor identifier was run against external assets; no full repository suite executed.
• Header scanner should be run only against authorized targets.
• The earlier ssh-audit/detect-secrets import receipts and manifest are unchanged.

Follow-up, if desired: import additional tools from the named upstream repositories one bounded selection at a time.