[ItsWanheda]

Summary

This branch addresses the scanner reliability/security audit without changing main directly.

Changes

• Replace parse_known_args() with strict CLI parsing; wire target aliases, ports, TCP/UDP selection, timing, timeout/concurrency, and JSON/HTML/CSV output.
• Add conservative UDP probing; silence is not misreported as a confirmed closed port.
• Require trusted SSH host keys, redact passwords from successful results/logs, classify failures, and fix the queue worker startup/shutdown race.
• Improve NVD pagination, rate-limit/error handling, CVSS metric parsing, CPE evidence, affected-version range checks, and finding classifications.
• Bound async concurrency and task creation, validate ports/timeouts, and enable TLS certificate verification by default.
• Stream network host iteration, enforce a maximum host count, and support excluded CIDR ranges.
• Use environment-configured report storage, atomic report writes, and CSV formula neutralization.
• Add CLI, credential-queue, CVE, and report regression tests; expand CI matrix and security checks.

Validation

CI is configured to run compilation, import smoke tests, unit/integration tests, dependency auditing, and Bandit. Results must be reviewed before merging.

Notes

• UDP scanning reports only services that respond to a probe; silence is inherently inconclusive.
• SSH credential checks now require the server host key to be trusted in system known-hosts.
• CVE findings remain potential when CPE/version evidence is insufficient; version schemes that cannot be parsed are not marked confirmed.