docs: Shadow AI Chat Data Leakage Simulation + pending doc catch-up

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,54 @@
+name: Bug report
+description: Something on itsectools.com isn't working correctly.
+labels: ["bug", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. This repo hosts documentation only — the
+        application source lives in a private codebase — but issues filed
+        here are triaged the same way and tracked through to a fix.
+
+  - type: input
+    id: page
+    attributes:
+      label: Page or feature
+      description: Which page/tool was this on?
+      placeholder: e.g. /network-pulse, /dlp, /ngfw, /mitre
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen?
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What actually happened?
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      placeholder: |
+        1. Go to '...'
+        2. Click '...'
+        3. See error
+    validations:
+      required: false
+
+  - type: textarea
+    id: context
+    attributes:
+      label: Additional context
+      description: Browser/OS, screenshots, test payload, or anything else relevant.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: General question
+    url: https://itsectools.com/contact
+    about: For general questions not related to a bug or feature request.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,17 @@
+name: Feature request
+description: Suggest an improvement or a new test/capability.
+labels: ["enhancement", "needs-triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: What problem would this solve?
+    validations:
+      required: true
+
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/security_finding.yml

@@ -0,0 +1,48 @@
+name: Incorrect test result
+description: An NGFW/AET/DLP/MITRE test result looks wrong (false positive/negative).
+labels: ["security-finding", "needs-triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Use this when a test's verdict itself seems incorrect — e.g. a
+        firewall clearly blocked something but the tool reports it as
+        vulnerable, or the reverse.
+
+  - type: dropdown
+    id: test-type
+    attributes:
+      label: Which test
+      options:
+        - NGFW / AET
+        - DLP Validator
+        - MITRE ATT&CK
+        - Network Pulse
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: combo
+    attributes:
+      label: Specific test/combo (if applicable)
+      placeholder: e.g. chunked-delayed, max-aet, nested-json-mcp
+    validations:
+      required: false
+
+  - type: textarea
+    id: expected-vs-actual
+    attributes:
+      label: What the tool reported vs. what actually happened
+      description: e.g. "Tool said Vulnerable, but my firewall log shows the request was blocked."
+    validations:
+      required: true
+
+  - type: textarea
+    id: payload
+    attributes:
+      label: Test payload / response JSON (if you have it)
+      description: Paste the raw result JSON or firewall log line if available. Redact anything sensitive first.
+      render: json
+    validations:
+      required: false

CHANGELOG.md

@@ -1,41 +1,131 @@
 # Changelog
 
-All notable changes to ITSecTools are documented here.
+All notable changes to itsectools.com are recorded here, most recent first.
+Format loosely follows [Keep a Changelog](https://keepachangelog.com/).
 
-## [1.2.0] — 2026-02
+---
+
+## 2026-09-08 — DLP Validator: Shadow AI Chat Data Leakage Simulation
+
+### Added
+- New Shadow AI Chat Data Leakage Simulation panel in the DLP Validator's
+  Data Leakage Simulator step: a simulated AI chat interface for testing
+  whether DLP/CASB solutions catch sensitive data pasted into ChatGPT/
+  Copilot-style prompts — the fastest-growing exfiltration path outside
+  file uploads.
+- Backend endpoint (`/api/dlp/chat/v1/chat/completions`) mirrors OpenAI's
+  actual chat-completions REST path and JSON request/response schema (also
+  copied by Azure OpenAI, Ollama, vLLM, and most self-hosted LLM servers),
+  so the traffic is a genuine payload for content-based DLP inspection to
+  react to. Deliberately does not attempt to reach real AI vendor domains —
+  that would mean sending test data to infrastructure this tool's users
+  don't own or have authorization to test.
+- Assistant replies reference exactly what was detected in the message
+  (SSN/card/email/credential), rather than a canned reply — a stronger,
+  more legible illustration of the risk than a generic response.
+
+### Fixed
+- Per-message result no longer auto-counts every successful send as a
+  "leak" regardless of content — a benign message (e.g. "hi") was being
+  logged and reported identically to an actual sensitive payload. Now a
+  test only counts toward the report when the message contains a genuine
+  sensitive pattern **and** an explicit "Include in report" toggle is on
+  (off by default). The same false-positive logging bug was also present
+  in the pre-existing HTTP/S POST Simulation and the Advanced DLP (MCP)
+  custom-content test; fixed identically in both.
+- Chat auto-scroll was using `scrollIntoView()`, which scrolls every
+  scrollable ancestor (including the whole page) to satisfy alignment —
+  each new message was yanking the entire page down, not just the chat
+  box. Now scrolls only the chat panel's own scroll position.
+
+---
+
+## 2026-09-05 — SDLC: issue tracking + error alerting
 
 ### Added
-- **Regex Engine Tools** — Build and translate DLP regex patterns across 10 vendor engines (Forcepoint, Symantec, Palo Alto, Zscaler, Netskope, Trellix, Fortinet, Microsoft Purview, Proofpoint)
-- **Regex Creator** with 27 match types and auto-analysis
-- **Regex Translator & Tester** with vendor-specific syntax translation and failure diagnostics
-- **Label & Classification Check** — Deep-scans DOCX/XLSX for MIP classification labels, PDF metadata scanning, content-level PII/PCI/PHI detection
-- **Evasive Payload Download** — Renamed file extensions, Base64 encoder/decoder, password-protected ZIP (AES), nested archives (1–10 layers)
-- File hashing (MD5, SHA-256) for integrity verification
-- Color-coded classification results (Confidential/Internal/Public)
-- Help Center with detailed guides for every tool
-- FAQ schema (JSON-LD) for DLP, NGFW, MITRE, and Network Pulse pages
-
-### Improved
-- Enhanced SEO metadata across all pages
-- AI discoverability via `llms.txt` and structured data
-
-## [1.1.0] — 2026-01
+- GitHub issue templates (`bug_report`, `security_finding`, `feature_request`) and
+  triage labels (`bug`, `regression`, `enhancement`, `security-finding`,
+  `needs-triage`, `docs`) on the public docs repo. No application source added —
+  the repo stays documentation-only.
+- Production error alerting: a standalone Tail Worker
+  (`itsectools-error-alerts`) consumes trace events from the main Worker and
+  emails `info@itsectools.com` (via Resend) on unhandled exceptions or 5xx
+  responses. A 5-minute KV-backed cooldown per error signature prevents a
+  single bad deploy from flooding the inbox.
+- `itsectools.com` verified as a sending domain in Resend (DKIM + SPF/MX on
+  the `send.` subdomain only — does not touch the existing Zoho MX records
+  serving `info@itsectools.com` and other mailboxes).
+
+---
+
+## 2026-08-20 — Network Pulse: Application Path Analysis (real trace + BGP facts)
 
 ### Added
-- **MITRE ATT&CK Kill Chain Simulator** — 4-phase sequential attack (T1190, T1059.001, T1003.001, T1048.003)
-- **Network Pulse** — Public IP detection, edge server geolocation, latency, jitter, packet loss, PMTU discovery, AI Security Insights
-- **NGFW C2C Beacon Testing** — OOB data exfiltration, web shell beacon, Python stager download
-- **Advanced Evasion Techniques** — Log4j JNDI, hex-encoded SQLi, Shellshock RCE
-
-### Improved
-- Console output with color-coded real-time logging
-- MITRE test payloads updated to trigger IPS signatures via backend service
-
-## [1.0.0] — 2025-12
-
-### Initial Release
-- **DLP Validator** — File upload testing (HTTP, HTTPS, FTP), data download (PII, PCI, PHI in PDF, DOCX, XLSX, CSV), raw text POST simulation
-- **NGFW Tests** — IPS signature testing (SQLi, XSS, Path Traversal)
-- **Threat Gen** — EICAR test files, heuristic malware simulators, ransomware behaviour scripts
-- Sidebar navigation with all tools
-- Privacy-first architecture — no data stored
+- New `/api/pulse/trace` endpoint: measures DNS + connect/TLS/first-byte
+  timing from the edge to a target, resolves target IP/ASN/geo via keyless
+  DoH + Team Cymru + ipwho.is, and returns a verdict (ok / slow / blocked).
+- Business-SaaS dropdown (Microsoft 365, Google Workspace, Teams, Slack,
+  Zoom, Salesforce, Workday, ServiceNow, etc.) plus a custom-URL input,
+  replacing the earlier "Phase 2 · in development" placeholder.
+- "Target network (BGP registry)" panel — real BGP data from RIPE Stat's
+  keyless looking-glass API: origin AS, registered country, announced
+  prefix, path diversity/multi-homing count, and an explicit anycast
+  callout for global CDN/cloud networks (Microsoft, Google, Cloudflare,
+  AWS, etc.) explaining that "registered country" is not where the user's
+  traffic actually terminates.
+- SSRF guard on the trace endpoint (rejects RFC1918/loopback/link-local
+  targets).
+
+### Fixed
+- Removed a misleading "Entry" hop in the AS-level path that was always the
+  same Singapore route-collector peer (an artifact of which RIPE collector
+  reported, not real transit) for every target.
+- Removed the country flag from the "Target" node in the AS-level path —
+  registry country for global anycast networks (e.g. Microsoft AS8075
+  showing "US") does not reflect where the user's traffic is actually
+  served, and was reading as a factual claim it wasn't.
+- Country-matching logic normalised via `Intl.DisplayNames` so ISO codes
+  (`AE`) and full names (`United Arab Emirates`) compare correctly instead
+  of always mismatching.
+
+### Removed
+- The `cloudflare:sockets`-based per-phase TCP/TLS timing attempt — proven
+  in a live production test to always return `tls_ms: 0` (the handshake is
+  lazy and folds into first-byte time) and to fail entirely on some hosts
+  (Anthropic, Zoom) that `fetch()` reaches fine. Reverted to `fetch()`-based
+  combined connect+TLS+first-byte timing, honestly labelled as such.
+
+---
+
+## August 2026 — Network Pulse: Overall Health redesign
+
+### Added
+- Two-section "Network Security Posture" redesign of `/network-pulse`:
+  Overall Health (connection quality + 8 plain-English safety findings,
+  each with an expandable technical drill-down) and Application Path
+  Analysis.
+- Hero with two large start cards so both sections are reachable without
+  scrolling.
+- IPv4/IPv6 chip, DoH-bypass probe, path-MTU probe, MITM/TLS-integrity
+  check (via `cf-ray` presence), all measured client-side.
+- "Under development · beta" banner.
+
+### Changed
+- Findings reduced from 8 to 7: the outbound-port-sweep finding was
+  removed — it cannot be tested honestly from a browser (no raw sockets)
+  or a plain Cloudflare Worker (only ports 80/443 exposed).
+- IPv6-vs-IPv4 finding downgraded from a warning to informational — most
+  business networks are IPv4-only and that is not a security issue.
+- Country/edge-PoP labelling reworded to remove Cloudflare branding
+  per product direction.
+
+### Removed
+- Download-throughput measurement and its `/api/pulse/download` endpoint —
+  browser-based single-connection throughput under-reported real bandwidth
+  by roughly 5× against speedtest.net.
+
+---
+
+## Earlier
+
+See git history and `docs/` for changes prior to this changelog's start.

README.md

@@ -23,14 +23,20 @@ A free, browser-based security testing platform for validating NGFW, DLP, IPS, a
 - Sequential execution with 6s inter-stage delay to avoid IP shunning.
 - **PDF Kill Chain Report** — Stage-by-stage visualization, risk assessment, and recommendations showing where the attack was stopped.
 
-### 3. DLP Validator — 7-Step Workflow
-- **Step 1: Download Test Files** — Generate DOCX/PDF/XLSX/CSV with 100+ rows of realistic PII (SSN, Driver License, Passport), PCI (Luhn-valid Visa/MC/Amex), or PHI (ICD-10 codes, prescriptions) data. Includes sensitivity-labeled files (Confidential, Internal, Public). Each download is dynamically generated to prevent static hash fingerprinting. Also validates proxy/inline DLP by testing whether your DLP engine intercepts and inspects file content during HTTPS transit.
-- **Step 2: Evasive Payload Download** — Base64 encoding, renamed extensions (.docx→.jpg), AES-256 encrypted archives, nested ZIPs (1–10 layers for depth testing).
-- **Step 3: Label & Classification Check** *(optional)* — Deep-scan documents for Microsoft Information Protection (MIP) labels from DOCX/XLSX ZIP archives, PDF metadata dictionaries, content-level DLP pattern matching, and MD5/SHA-256 hashing.
-- **Step 4: Data Leakage Simulator** — Upload files over HTTP/HTTPS/FTP and send raw text POST payloads to test whether DLP blocks data in transit across all protocols. Detects and displays block status when a DLP agent intercepts browser uploads — the only free tool that distinguishes endpoint-level blocks from network/proxy blocks.
-- **Step 5: Advanced DLP Tests** — Tests DLP detection of sensitive data inside deeply nested JSON structures used by AI agents (MCP), REST APIs, and GraphQL mutations. Server generates fresh PII/PCI/PHI data and wraps it at configurable nesting depth (2/4/6 levels).
-- **Step 6: Generate & Share Report** — Auto-generated PDF scorecard with score gauge, protocol coverage matrix, data category breakdown, gap analysis, and actionable recommendations. Client-side generation — no data leaves the browser.
-- **Step 7: DLP Regex Builder** — Build and translate DLP regex patterns across 10 vendor formats (Forcepoint, Symantec, Palo Alto, Zscaler, Netskope, Trellix, Fortinet, Microsoft Purview, Proofpoint).
+### 3. DLP (Data Loss Prevention) Tools
+
+**7-Step Guided Workflow:** ① Download Test Files → ② Evasive Payload Download → ③ Label & Classification Check → ④ Data Leakage Simulator → ⑤ Advanced DLP Tests → ⑥ Generate & Share Report → ⑦ DLP Regex Builder
+
+- **File Upload Testing (Step 4)** — Upload sensitive test files over HTTP/HTTPS/FTP to verify DLP blocking.
+- **Shadow AI Chat Data Leakage Simulation (Step 4)** — Simulated AI chat interface for testing whether DLP/CASB catches sensitive data pasted into ChatGPT/Copilot-style prompts. Requests are shaped like real chat-completions traffic (OpenAI-compatible `/v1/chat/completions` path and JSON schema) so content-based inspection has something genuine to react to. Reports a plain Success/Failed-to-send status per message, with an explicit opt-in toggle before a result counts toward the PDF report.
+- **Endpoint DLP Agent Detection** *(Unique)* — The only free DLP testing tool that detects and reports when an Endpoint DLP agent (Forcepoint, Symantec) blocks file uploads at the browser level — even in inline/proxy mode. Clearly distinguishes endpoint-level blocks from network/proxy DLP blocks with actionable output messages.
+- **Download Test Files (Step 1)** — Generate DOCX/PDF/XLSX/CSV with 100 rows of realistic PII (SSN, Driver License, Passport), PCI (Luhn-valid Visa/MC/Amex), or PHI (ICD-10 codes, prescriptions) data. Each download is dynamically generated to prevent static hash fingerprinting.
+- **Proxy Mode DLP Validation (Step 1)** — Downloads dynamically generated documents over HTTPS. Tests whether proxy/inline DLP can parse DOCX (OOXML ZIP), PDF (content streams), XLSX, and CSV to detect embedded sensitive data. CSV/XLSX are detected by most DLP engines; DOCX/PDF require deeper file parsing that not all proxy DLP solutions support.
+- **Label & Classification Check (Step 3)** — Inspect Microsoft Information Protection (MIP) labels from DOCX/XLSX ZIP archives and PDF metadata dictionaries. Content-level DLP pattern matching with MD5/SHA-256 hashing.
+- **DLP Regex Builder (Step 7)** — Build and translate DLP regex patterns across 10 vendor formats (Forcepoint, Symantec, Palo Alto, Zscaler, Netskope, Trellix, Fortinet, Microsoft Purview, Proofpoint).
+- **Evasive Payload Download (Step 2)** — Base64 encoding, renamed extensions (.docx→.jpg), AES-256 encrypted archives, nested ZIPs (depth testing).
+- **Advanced DLP Tests — Nested JSON Exfiltration (Step 5)** — Tests DLP detection of sensitive data inside deeply nested JSON structures used by AI agents (MCP), REST APIs, and GraphQL mutations. Server generates fresh PII/PCI/PHI data and wraps it at configurable nesting depth (2/4/6 levels). Tests whether network DLP can parse structured payloads to find hidden sensitive data.
+- **Generate & Share Report (Step 6)** — Auto-generated scorecard with score gauge, protocol coverage matrix, data category breakdown, gap analysis, and actionable recommendations. Client-side generation — no data leaves the browser.
 
 ### 4. Threat Protection Lab
 - **EICAR Test Files** — Standard EICAR antivirus test file in multiple formats (.txt, .zip, .ps1).