Import 3 real upstream tools: Linux CIS, DLP and DNS

.gitattributes

@@ -0,0 +1,2 @@
+# Keep pinned upstream community source bytes identical on all platforms.
+third_party/community/** -text

README.md

@@ -89,6 +89,9 @@ These are runnable third-party CLI imports, **not projects written for this port
 | --- | --- | --- |
 | [HTTP security-header scanner](third_party/community/http-headers-scanner/) | ©AngelaMos / CarterPerez-dev; evaluates HTTP response security headers | [Code, usage and limitations](third_party/community/README.md) |
 | [Hash identifier](third_party/community/hash-identifier/) | ©AngelaMos / CarterPerez-dev; suggests likely hash formats | [Code, usage and limitations](third_party/community/README.md) |
+| [Linux CIS hardening auditor](third_party/community/linux-cis-hardening-auditor/) | ©AngelaMos / CarterPerez-dev; Linux hardening checks and compliance scores | [Source and run limits](third_party/community/README.md) |
+| [DLP scanner](third_party/community/dlp-scanner/) | ©AngelaMos / CarterPerez-dev; checks for sensitive data in files, databases and PCAPs | [Source and run limits](third_party/community/README.md) |
+| [DNS lookup CLI](third_party/community/dns-lookup/) | ©AngelaMos / CarterPerez-dev; DNS, reverse lookup and WHOIS investigation | [Source and run limits](third_party/community/README.md) |
 
 The pinned files have a [separate import manifest](third_party/community/imports.json), preserving the earlier recorded integrations unchanged.
 

THIRD_PARTY.md

@@ -2,16 +2,19 @@
 
 ![Open-source integration](assets/badges/open-source-integration.svg)
 
-**Work type:** upstream-authored tool source, paired with collection-developed integration examples. [Portfolio projects](README.md#portfolio-projects) have a separate index.
+**Work type:** upstream-authored tool source. The first two integrations have collection-developed examples; community imports are source-only. [Portfolio projects](README.md#portfolio-projects) have a separate index.
 
-These tools are copied release snapshots credited to their original authors. Their source is unmodified; each retains its own license. The collection's contribution is the pinned import, local examples, recorded outputs and integration checks.
+These tools are copied release snapshots credited to their original authors. Their source is unmodified; each retains its own license. The collection's contribution varies: the earlier ssh-audit/detect-secrets snapshots have retained examples and results; community copies have pinned provenance and source-integrity checks, but no collection execution claims.
 
 | Tool | Original project and authors | Imported release | License | Collection example |
 | --- | --- | --- | --- | --- |
 | ssh-audit | [Joe Testa and contributors](https://github.com/jtesta/ssh-audit), including original author Andris Raugulis | [v3.9.0 / dbf8b69](https://github.com/jtesta/ssh-audit/tree/dbf8b696331925ce7d4dbf72cb93faf3968397aa) | [MIT](third_party/ssh-audit/LICENSE) | [Offline SSH algorithm review](projects/11-ssh-algorithm-review/) |
 | detect-secrets | [Yelp and contributors](https://github.com/Yelp/detect-secrets) | [v1.5.0 / 01886c8](https://github.com/Yelp/detect-secrets/tree/01886c8a910c64595c47f186ca1ffc0b77fa5458) | [Apache-2.0](third_party/detect-secrets/LICENSE), with embedded notices preserved | [Secret-detection controls](projects/12-secret-detection/) |
 | HTTP security-header scanner | [AngelaMos / CarterPerez-dev](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/foundations/http-headers-scanner) | [Pinned source / 6c8ac85](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865) | [AGPL-3.0-or-later](third_party/community/http-headers-scanner/LICENSE) | [Copied runnable source only](third_party/community/http-headers-scanner/); no collection execution claimed |
 | Hash identifier | [AngelaMos / CarterPerez-dev](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/foundations/hash-identifier) | [Pinned source / 6c8ac85](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865) | [AGPL-3.0-or-later](third_party/community/hash-identifier/LICENSE) | [Copied runnable source only](third_party/community/hash-identifier/); no collection execution claimed |
+| Linux CIS hardening auditor | [AngelaMos / CarterPerez-dev](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/beginner/linux-cis-hardening-auditor) | [Pinned source / 6c8ac85](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865) | [AGPL-3.0-or-later](third_party/community/linux-cis-hardening-auditor/LICENSE) | [Copied runnable source only](third_party/community/linux-cis-hardening-auditor/); no collection execution claimed |
+| DLP scanner | [AngelaMos / CarterPerez-dev](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/intermediate/dlp-scanner) | [Pinned source / 6c8ac85](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865) | [AGPL-3.0-or-later](third_party/community/dlp-scanner/LICENSE) | [Copied runnable source only](third_party/community/dlp-scanner/); no collection execution claimed |
+| DNS lookup CLI | [AngelaMos / CarterPerez-dev](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/beginner/dns-lookup) | [Pinned source / 6c8ac85](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865) | [AGPL-3.0-or-later](third_party/community/dns-lookup/LICENSE) | [Copied runnable source only](third_party/community/dns-lookup/); no collection execution claimed |
 
 [imports.json](third_party/imports.json) records the earlier two evidence-bound integration snapshots by path and SHA-256; [community/imports.json](third_party/community/imports.json) separately records the new source-only imports by Git blob hash. Runtime source, package metadata and notices are included; upstream test suites, build automation and test keys are excluded. Upstream READMEs are retained unchanged as source documents; use the collection examples above for commands that match this layout.
 

scripts/check_community_imports.py

@@ -1,4 +1,4 @@
-"""Verify pinned, untouched community CLI copies; never execute upstream tools."""
+"""Verify pinned, untouched community tool copies; never execute upstream scanners."""
 import ast
 import hashlib
 import json
@@ -14,7 +14,7 @@ def git_blob_sha1(data: bytes) -> str:
 
 def main() -> None:
     records = json.loads(MANIFEST.read_text(encoding="utf-8"))["imports"]
-    expected_names = {"http-headers-scanner", "hash-identifier"}
+    expected_names = {"http-headers-scanner", "hash-identifier", "linux-cis-hardening-auditor", "dlp-scanner", "dns-lookup"}
     if {item["name"] for item in records} != expected_names or len(records) != len(expected_names):
         raise ValueError("Unexpected community import set")
     total = 0

third_party/README.md

@@ -7,6 +7,6 @@ This directory contains unmodified release snapshots of software written by upst
 The collection-developed fixtures, runners and recorded results are described under [Open-source tool integrations](../README.md#open-source-tool-integrations). Portfolio investigations and software are listed separately under [Portfolio projects](../README.md#portfolio-projects).
 
 
-Additional [community CLI source copies](community/) include the upstream HTTP security-header scanner and hash identifier from CarterPerez-dev/AngelaMos (AGPL-3.0-or-later). Their [separate pinned manifest](community/imports.json) leaves the previously recorded import evidence untouched. They are runnable source only; no collection-authored security findings or results are claimed.
+Additional [community CLI source copies](community/) include HTTP security-header scanning, hash identification, Linux CIS hardening audits, DLP scanning and DNS lookup from CarterPerez-dev/AngelaMos (AGPL-3.0-or-later). Their [separate pinned manifest](community/imports.json) leaves the previously recorded import evidence untouched. They are runnable source only; no collection-authored security findings or results are claimed.
 
 [Original authors and licenses](../THIRD_PARTY.md) · [Import manifest](imports.json)

third_party/community/README.md

@@ -1,26 +1,44 @@
 # Community tools — original third-party code
 
-These are **verbatim copies of upstream-authored CLI tools**, not software written by Don Lopez. The imports are pinned to [CarterPerez-dev/Cybersecurity-Projects at `6c8ac8547cf52edaa06935e637a1fe11ac45b865`](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865). The Python source attributes ©AngelaMos (2026). Each tool remains under its original **AGPL-3.0-or-later** license. See [the import manifest](imports.json) and [original author credits](../../THIRD_PARTY.md).
+These are **verbatim copies of upstream-authored CLI tools**, not software written by Don Lopez. The imports are pinned to [CarterPerez-dev/Cybersecurity-Projects at `6c8ac8547cf52edaa06935e637a1fe11ac45b865`](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865). The upstream source attributes ©AngelaMos (2026). Each tool remains under its original **AGPL-3.0-or-later** license. See [the import manifest](imports.json) and [original author credits](../../THIRD_PARTY.md).
 
 | Copied tool | Upstream source | What it does | Status |
 | --- | --- | --- | --- |
 | [HTTP security-header scanner](http-headers-scanner/) | [Foundations project](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/foundations/http-headers-scanner) | Fetches one URL and grades six response security headers. | Verbatim source; no collection scan or recorded result |
 | [Hash identifier](hash-identifier/) | [Foundations project](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/foundations/hash-identifier) | Suggests hash algorithm formats by prefix, length and character set. | Verbatim source; no accuracy study or recorded result |
+| [Linux CIS hardening auditor](linux-cis-hardening-auditor/) | [Beginner project](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/beginner/linux-cis-hardening-auditor) | Evaluates Linux hardening controls and formats compliance reports. | Verbatim source; no host audit or recorded score |
+| [DLP scanner](dlp-scanner/) | [Intermediate project](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/intermediate/dlp-scanner) | Checks files, database samples and packet captures for sensitive-data patterns. | Verbatim source; no real-data scan or results |
+| [DNS lookup CLI](dns-lookup/) | [Beginner project](https://github.com/CarterPerez-dev/Cybersecurity-Projects/tree/6c8ac8547cf52edaa06935e637a1fe11ac45b865/PROJECTS/beginner/dns-lookup) | Queries DNS record types, reverse lookup and WHOIS. | Verbatim source; no network queries or results |
 
 ## Use locally
 
-These copies include the upstream scripts, readmes, dependency metadata and licenses. They omit the large upstream learning modules, tests and lockfiles. The original READMEs may link to omitted companion material; use the pinned upstream links above for that material.
+All copies retain the upstream code, README and license, plus relevant package metadata or config. They omit upstream tests, large learning modules and lockfiles; the original READMEs may link to those omitted companion assets. For details, follow the pinned upstream source links above.
 
-For Python 3.13+ in a dedicated environment, install the upstream runtime dependencies `rich>=15` (both tools) and `httpx>=0.28.1` (header scanner), then invoke:
+For the original two Python CLI tools, use Python 3.13+ in a dedicated environment with `rich>=15` and (for headers) `httpx>=0.28.1`:
 
 ```bash
 python third_party/community/hash-identifier/hash_identifier.py --help
 python third_party/community/http-headers-scanner/http_headers_scanner.py --help
 ```
 
-Use the header scanner **only with websites you own or are authorized to assess**. Hash guesses are heuristic, not proof of a generating algorithm. Neither copy is represented as a vulnerability confirmation or original portfolio project.
+For a read-only Linux CIS control listing (Bash on Debian/Ubuntu):
 
-Run the bounded source-integrity check, which **does not execute either tool**:
+```bash
+bash third_party/community/linux-cis-hardening-auditor/src/cisaudit.sh --list-controls
+```
+
+For the DLP and DNS CLIs, use isolated virtual environments with the Python versions required by their upstream `pyproject.toml` (DLP ≥3.12; DNS ≥3.13). Installation can download large dependencies; review each upstream `pyproject.toml` and install only if you need to run that tool. From the repository root:
+
+```bash
+python -m pip install -e third_party/community/dlp-scanner
+python -m pip install -e third_party/community/dns-lookup
+dlp-scan --help
+dnslookup --help
+```
+
+Only scan systems, hosts and data you own or are authorized to examine. DLP output can include sensitive matches: do not commit real logs, personal data, credentials, or scan reports to this public repo. The CIS auditor describes a benchmark subset, not a certification of compliance. DNS/WHOIS may make external queries. Hash identification is heuristic; HTTP-header grades are not vulnerability confirmation. **No execution outcome for any of these five imports is claimed.**
+
+Run the bounded source-integrity check, which **does not execute the imported scanners**:
 
 ```bash
 python scripts/check_community_imports.py

third_party/community/dlp-scanner/.dlp-scanner.yml

@@ -0,0 +1,86 @@
+# ©AngelaMos | 2026
+# .dlp-scanner.yml
+
+scan:
+  file:
+    max_file_size_mb: 100
+    recursive: true
+    exclude_patterns:
+      - "*.pyc"
+      - "__pycache__"
+      - ".git"
+      - "node_modules"
+      - ".venv"
+    include_extensions:
+      - ".pdf"
+      - ".docx"
+      - ".xlsx"
+      - ".xls"
+      - ".csv"
+      - ".json"
+      - ".xml"
+      - ".yaml"
+      - ".yml"
+      - ".txt"
+      - ".log"
+      - ".eml"
+      - ".msg"
+      - ".parquet"
+      - ".avro"
+      - ".tar.gz"
+      - ".tar.bz2"
+      - ".zip"
+
+  database:
+    sample_percentage: 5
+    max_rows_per_table: 10000
+    timeout_seconds: 30
+    exclude_tables: []
+    include_tables: []
+
+  network:
+    bpf_filter: ""
+    entropy_threshold: 7.2
+    dns_label_entropy_threshold: 4.0
+    max_packets: 0
+
+detection:
+  min_confidence: 0.20
+  severity_threshold: "low"
+  context_window_tokens: 10
+  enable_rules:
+    - "*"
+  disable_rules: []
+  allowlists:
+    values:
+      - "123-45-6789"
+      - "000-00-0000"
+      - "4111111111111111"
+    domains:
+      - "example.com"
+      - "test.com"
+    file_patterns:
+      - "test_*"
+      - "*_fixture*"
+      - "mock_*"
+
+compliance:
+  frameworks:
+    - "HIPAA"
+    - "PCI_DSS"
+    - "GDPR"
+    - "CCPA"
+    - "SOX"
+    - "GLBA"
+
+output:
+  format: "console"
+  output_file: ""
+  redaction_style: "partial"
+  verbose: false
+  color: true
+
+logging:
+  level: "INFO"
+  json_output: false
+  log_file: ""