diff --git a/.github/workflows/safety.yml b/.github/workflows/safety.yml
new file mode 100644
index 0000000..f7e3a29
--- /dev/null
+++ b/.github/workflows/safety.yml
@@ -0,0 +1,12 @@
+name: Isolated script safety
+on: [push, pull_request]
+permissions:
+  contents: read
+jobs:
+  fixtures:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+      - name: Bash syntax and local fixture regressions
+        run: python3 -m unittest discover -s tests -v
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..41c33c8
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,3 @@
+
+__pycache__/
+*.pyc
diff --git a/README.md b/README.md
index 751a810..6177c4a 100644
--- a/README.md
+++ b/README.md
@@ -1,189 +1,58 @@
-# 🐧 Linux Admin Scripts
+# Linux Admin Scripts
 
-A production-ready collection of Bash scripts for Linux system administration — monitoring, alerting, backup, maintenance, and security auditing.
+9 September continuation: shared backup publication now refuses existing checksum files, symlinks and directories. Both daily and weekly paths publish checksums with no-clobber hard links; a checksum-generation failure cannot report a verified backup. Interrupted publication may still leave an archive without its final checksum, so require a valid checksum pair and investigate retained partial artifacts. This adds two isolated regression tests (12 total); application-consistent restoration remains a lab gate.
 
-> All scripts include centralized Slack/Teams/Email alerting, lock files, log rotation, and proper error handling.
+Bash administration utilities. Validate each script in a disposable lab before production deployment. Syntax checks and fixture tests do not certify an environment or an application backup.
 
----
+## Entry points
 
-## 📁 Repository Structure
+Use `bash <script-path>`; several maintained entry points intentionally have no `.sh` extension.
 
-```
-linux-admin-scripts/
-└── scripts/
-    ├── core/               ← Shared alert engine (load this first)
-    ├── audit/              ← Security & system auditing
-    ├── monitoring/         ← Resource & service monitoring
-    ├── backup/             ← Backup & rotation scripts
-    └── maintenance/        ← Cleanup & housekeeping
-```
+| Path | Behavior and scope |
+| --- | --- |
+| `scripts/monitoring/server-stats.sh` | Local statistics snapshot; unchanged in the September remediation. |
+| `scripts/monitoring/cpu_memory_monitor` | CPU/memory observations; local log and stderr alerts. |
+| `scripts/monitoring/disk_alert` | One GNU df collection; warning/critical or unavailable collection returns nonzero. |
+| `scripts/monitoring/service_uptime <unit> ...` | Explicit service scope, alert-only; never restarts a service. |
+| `scripts/backup/backup_script <source> <existing-destination>` | Verified, versioned file archive; retention inventory only. |
+| `scripts/backup/backup_rotation.sh` | Versioned daily/weekly archives; requires SRC_DIR, BACKUP_DIR and EXPECTED_BACKUP_SOURCE. |
+| `scripts/Nginx_create.sh <dns-name> <template> <owner>` | Configuration preview. `--apply` installs and validates; `--reload` additionally reloads Nginx. |
+| `scripts/appache2_confg.sh --plan` | Apache installation plan. `--install` is explicit and may start Apache; never changes UFW. |
+| `scripts/audit/LinuxAudit.sh` | Interactive audit. Expensive filesystem scans are opt-in and bounded. |
+| `scripts/audit/FastCheck.sh <host> --scan` | Explicitly authorized TLS/connectivity checks; intrusive NSE/DoS menu removed. |
+| `scripts/audit/ScanPort.sh <IPv4> --scan` | Explicitly authorized checks of the 24 listed TCP ports. |
 
----
+The previously documented `system_resource_check` and `maintenance/log_cleanup` scripts are not supplied. Remove references to those nonexistent paths from deployment plans.
 
-## 🔔 Core
+## Alerts, state, and privileges
 
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/core/alert_engine.sh` | Central alerting module — Slack, MS Teams, Email. Sourced by all other scripts. Also provides lock files and log rotation. | Read-only |
+`scripts/core/alert_engine.sh` supplies locking, log archival, and timestamped **local stderr alerts only**. It does not send Slack, Teams or email. Integrate stdout/stderr and exit status with your approved monitoring system; external delivery is not configured by this repository. The CPU monitor also writes `/var/log/admin-scripts`; provision that protected log directory before deployment. Log archives are retained; configure a separate reviewed retention policy.
 
-**Configure this first** before running any other script. Set your Slack webhook, Teams webhook, or email inside this file.
+Locks use `${XDG_STATE_HOME:-$HOME/.local/state}/admin-scripts`, or `ADMIN_SCRIPTS_STATE_DIR`. The state directory must be owned by the executing account, mode 700, with trusted ancestors. Backup directories and configuration parents must be protected against concurrent untrusted writers. Do not run from or deploy into user-writable directories as root.
 
----
+Monitoring needs read access to the selected objects. Backup needs read access to the source and write access to the destination. Nginx `--apply` and Apache `--install` require root and an approved change window. Scan commands contact their target; target-owner approval is required.
 
-## 🔍 Audit
+## Backup configuration and migration
 
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/audit/LinuxAudit.sh` | Collects Linux system audit information — users, services, packages, network details, and configuration data. | Read-only / information gathering |
+1. Provision an existing, protected destination and verify the intended mounted device. Read-only check: `findmnt -n -o SOURCE -T <BackupDirectory>`.
+2. Pin the reviewed value in `EXPECTED_BACKUP_SOURCE`; do not dynamically accept whichever device is mounted at runtime.
+3. Set the source/destination explicitly. Archives include a source-path job identifier and unique timestamp/PID; old daily files are never accepted merely because they exist.
+4. Creation writes to `.partial.*`, checks gzip/tar integrity, then publishes without overwriting an existing archive and writes a SHA256 sidecar. Failures retain clearly marked partial artifacts and return nonzero.
+5. Retention prints job-specific, nonrecursive candidates; it never deletes previous backups. Review retention and capacity separately. Existing legacy archives are retained.
+6. Test restoration into an isolated directory and compare representative files, metadata, ACLs and application consistency. These are file archives, not consistent live-database backups; this implementation does not promise ACL/xattr preservation. Use an application-aware backup when required.
 
----
+Weekly filenames include the ISO week-year. Publication requires same-filesystem hard-link support. Interrupted runs after publication but before the sidecar completes must be investigated; do not infer completion from filename alone. No automatic cleanup of failed artifacts is performed.
 
-## 📊 Monitoring
+## Configuration changes
 
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/monitoring/server-stats.sh` | Displays server statistics — CPU, memory, disk usage, uptime, and running processes. | Read-only |
-| `scripts/monitoring/cpu_memory_monitor.sh` | Monitors CPU and memory usage. Sends WARNING/CRITICAL alerts when thresholds are exceeded. Uses `vmstat` and `/proc/meminfo` for accuracy. | Read-only |
-| `scripts/monitoring/disk_alert.sh` | Monitors all disk mountpoints. Two alert levels: WARNING at 75%, CRITICAL at 90%. Skips tmpfs/devtmpfs. | Read-only |
-| `scripts/monitoring/service_uptime_checker.sh` | Checks critical services (nginx, docker, mysql). Auto-restarts if down, retries N times, escalates to CRITICAL alert with journal logs if restart fails. | Read/Write (restarts services) |
-| `scripts/monitoring/system_resource_check.sh` | Full hourly system snapshot — CPU, RAM, swap, disk, top processes, network connections, last logins. Saves report to log file. | Read-only |
+Nginx defaults to stdout preview. Templates are operator-supplied and must be reviewed, including certificate paths and any includes. Existing web roots/sites are refused. Applying checks the baseline first, creates only the new targets, tests the complete configuration, and rolls back only those new targets on failure. Ownership changes are limited to the newly created directory. If `--reload` fails, the previous file configuration is restored and a rollback reload is attempted; a failure is reported for operator intervention. A successful `--apply` without `--reload` stages the site for the next reload.
 
----
+Apache installation and firewall activation are separate changes. Before any manual firewall activation, record existing policy, the actual management port/source, console access, rollback commands, and an independent management-session validation. This script does not activate the firewall.
 
-## 💾 Backup
+For filesystem audit scans, set `ENABLE_FILESYSTEM_SCAN=1` and an explicit absolute `AUDIT_SCAN_ROOT` only after approving metadata I/O. Results can be incomplete on permission errors or timeout and must be reviewed accordingly.
 
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/backup/backup_rotation.sh` | Daily + weekly backup with rotation. Pre-flight checks for source directory and free disk space. Alerts on failure. | Read/Write |
-| `scripts/backup/backup_script.sh` | Compressed backup with archive integrity verification (`tar -tzf`). Cleans backups older than N days. | Read/Write |
+## Validation
 
----
+`python3 -m unittest discover -s tests -v` performs Bash syntax validation, local backup creation/restore fixtures, and mocked systemctl/df/configuration-preview checks. It makes no production calls. GitHub Actions runs the same tests. Nginx reload/rollback, full disks, application restore, production mounts and notification delivery still require environment-specific lab validation.
 
-## 🧹 Maintenance
-
-| Script | Description | Risk Level |
-|---|---|---|
-| `scripts/maintenance/log_cleanup.sh` | Deletes log files older than N days. Optional `--archive` flag compresses logs before deletion. Protects `audit.log` and `secure.log`. | Read/Write (deletes files) |
-
----
-
-## ⚙️ Setup
-
-### 1. Clone the repository
-
-```bash
-git clone https://github.com/blow-tech/linux-admin-scripts.git
-cd linux-admin-scripts
-```
-
-### 2. Deploy to server
-
-```bash
-sudo mkdir -p /opt/admin-scripts
-sudo cp -r scripts/* /opt/admin-scripts/
-sudo chmod +x /opt/admin-scripts/**/*.sh
-sudo mkdir -p /var/log/admin-scripts
-```
-
-### 3. Configure alerts
-
-Edit `/opt/admin-scripts/core/alert_engine.sh`:
-
-```bash
-SLACK_ENABLED=true
-SLACK_WEBHOOK_URL="https://hooks.slack.com/services/YOUR/WEBHOOK/URL"
-
-TEAMS_ENABLED=true
-TEAMS_WEBHOOK_URL="https://outlook.office.com/webhook/YOUR-WEBHOOK-URL"
-
-SMTP_CONFIGURED=true
-ALERT_EMAIL="admin@yourcompany.com"
-```
-
-### 4. Make scripts executable
-
-```bash
-chmod +x scripts/monitoring/cpu_memory_monitor.sh
-chmod +x scripts/monitoring/disk_alert.sh
-chmod +x scripts/monitoring/service_uptime_checker.sh
-chmod +x scripts/monitoring/system_resource_check.sh
-chmod +x scripts/backup/backup_rotation.sh
-chmod +x scripts/backup/backup_script.sh
-chmod +x scripts/maintenance/log_cleanup.sh
-chmod +x scripts/core/alert_engine.sh
-```
-
-### 5. Run a script
-
-```bash
-./scripts/monitoring/cpu_memory_monitor.sh
-./scripts/monitoring/disk_alert.sh
-./scripts/audit/LinuxAudit.sh
-./scripts/backup/backup_rotation.sh
-./scripts/maintenance/log_cleanup.sh /var/log 14 --archive
-```
-
----
-
-## ⏰ Recommended Crontab
-
-```bash
-sudo crontab -e
-```
-
-```cron
-# CPU & Memory — every 5 minutes
-*/5 * * * * /opt/admin-scripts/monitoring/cpu_memory_monitor.sh
-
-# Disk Alert — every 30 minutes
-*/30 * * * * /opt/admin-scripts/monitoring/disk_alert.sh
-
-# Service Health — every 5 minutes
-*/5 * * * * /opt/admin-scripts/monitoring/service_uptime_checker.sh
-
-# System Resource Snapshot — every hour
-0 * * * * /opt/admin-scripts/monitoring/system_resource_check.sh
-
-# Daily Backup — 2AM every day
-0 2 * * * /opt/admin-scripts/backup/backup_rotation.sh
-
-# Log Cleanup — 3AM every Sunday
-0 3 * * 0 /opt/admin-scripts/maintenance/log_cleanup.sh /var/log 14 --archive
-```
-
----
-
-## 📋 Log Files
-
-All logs are written to `/var/log/admin-scripts/`:
-
-| File | Contents |
-|---|---|
-| `alerts.log` | All alerts from all scripts |
-| `cpu_memory_monitor.log` | CPU/memory check history |
-| `disk_alert.log` | Disk usage check history |
-| `service_uptime_checker.log` | Service status & restart history |
-| `system_resource_check.log` | Hourly resource snapshots |
-| `backup_rotation.log` | Daily/weekly backup history |
-| `backup_script.log` | Backup job history |
-| `log_cleanup.log` | Cleanup activity |
-
----
-
-## 🛡️ Script Safety Features
-
-Every script in this repo includes:
-
-- `set -euo pipefail` — exits immediately on any error
-- Lock files — prevents duplicate cron executions
-- Log rotation — log files are capped automatically
-- Pre-flight validation — checks directories and disk space before acting
-- Alert integration — every failure sends a real-time notification
-
----
-
-## 👤 Author
-
-**Prashanth Teja Vankala**  
-Linux System Administrator  
-GitHub: [@blow-tech](https://github.com/blow-tech)
+The September 2026 remediation corresponds to review findings H2-H5, H9, M1-M2 and the identified Linux performance items. See the pull request for exact validation evidence. Keep existing deployments pinned until their schedule and parameters have been migrated and approved.
diff --git a/scripts/Nginx_create.sh b/scripts/Nginx_create.sh
index 1db5e55..e165a6c 100644
--- a/scripts/Nginx_create.sh
+++ b/scripts/Nginx_create.sh
@@ -1,52 +1,67 @@
-#!/bin/bash
-
-if [[ $EUID -ne 0 ]]; then
-   echo "Only root allowed." 
-   exit 1
+#!/usr/bin/env bash
+# Usage: Nginx_create.sh <dns-name> <reviewed-template> <owner> [--apply] [--reload]
+# Default: print proposed configuration only. --apply installs after baseline validation.
+set -euo pipefail
+[[ $# -ge 3 ]] || { echo 'Supply DNS name, template and existing service owner' >&2; exit 2; }
+vhost=$1 template=$2 owner=$3; shift 3
+apply=false reload=false
+for arg in "$@"; do
+    case $arg in --apply) apply=true ;; --reload) reload=true ;; *) echo "Unknown option: $arg" >&2; exit 2 ;; esac
+done
+[[ ${#vhost} -le 253 && $vhost == *.* && $vhost =~ ^[a-zA-Z0-9.-]+$ ]] || exit 2
+IFS=. read -r -a labels <<< "$vhost"
+[[ $vhost != *. ]] || exit 2
+for label in "${labels[@]}"; do
+    [[ ${#label} -le 63 && $label =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?$ ]] || exit 2
+done
+[[ $owner =~ ^[a-zA-Z_][a-zA-Z0-9_-]*$ && -f $template && ! -L $template ]] || exit 2
+id "$owner" >/dev/null
+config=$(sed "s/{{DOMAIN}}/$vhost/g" "$template")
+[[ $config != *'{{'* ]] || { echo 'Unresolved template placeholder' >&2; exit 2; }
+if ! $apply; then
+    printf '%s\n' "$config"
+    echo 'PREVIEW only. Review template, certificate paths and change window before --apply.' >&2
+    exit 0
 fi
-
-TEMPLATE_HTTP="/root/template/nginx-http.conf"
-TEMPLATE_HTTPS="/root/template/nginx-secure-http.conf"
-
-if [ ! -f "$TEMPLATE_HTTP" ] || [ ! -f "$TEMPLATE_HTTPS"]; then
-    echo "Template files not found."
-    exit 1
-fi
-
-read -p "Enter vhost (contoh: example.test): " vhost
-
-# Ask user to choice between HTTP or HTTPS template
-echo "Want to use HTTP or HTTPS?"
-echo "1) HTTP Only"
-echo "2) HTTP + HTTPS"
-read -p "Choice between (1) or (2): " template_choice
-
-if [ "$template_choice" == "1" ]; then
-    TEMPLATE_FILE="$TEMPLATE_HTTP"
-elif [ "$template_choice" == "2" ]; then
-    TEMPLATE_FILE="$TEMPLATE_HTTPS"
-else
-    echo "Wrong choice!"
-    exit 1
-fi
-
-# Create new vhost directory on /var/www/
-mkdir -p /var/www/$vhost
-chown -R baiquni:baiquni /var/www/$vhost
-
-# Create nginx configuration base on template on sites-available
-echo "Membuat file konfigurasi nginx untuk $vhost dari template..."
-sed "s/{{DOMAIN}}/$vhost/g" "$TEMPLATE_FILE" > /etc/nginx/sites-available/$vhost
-
-# Create symlinks into sites-enabled
-ln -s /etc/nginx/sites-available/$vhost /etc/nginx/sites-enabled/
-
-# Check nginx configuration
+(( EUID == 0 )) || { echo '--apply requires root' >&2; exit 1; }
+for parent in /var /var/www /etc /etc/nginx /etc/nginx/sites-available /etc/nginx/sites-enabled; do
+    [[ -d $parent && ! -L $parent ]] || { echo "Missing or symlink parent: $parent" >&2; exit 1; }
+done
+available=/etc/nginx/sites-available/$vhost
+enabled=/etc/nginx/sites-enabled/$vhost
+webroot=/var/www/$vhost
+for path in "$available" "$enabled" "$webroot"; do
+    [[ ! -e $path && ! -L $path ]] || { echo "Refusing existing target: $path" >&2; exit 1; }
+done
+nginx -t
+stage=$(mktemp /etc/nginx/sites-available/.stage.XXXXXX)
+made_available=false made_enabled=false made_root=false committed=false reload_attempted=false
+rollback() {
+    local status=$?
+    if ! $committed; then
+        $made_enabled && rm -- "$enabled"
+        $made_available && rm -- "$available"
+        $made_root && rmdir -- "$webroot"
+        if $reload_attempted; then
+            nginx -t && systemctl reload nginx || echo 'CRITICAL: rollback reload failed; operator action required' >&2
+        fi
+    fi
+    rm -f -- "$stage"
+    return "$status"
+}
+trap rollback EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+printf '%s\n' "$config" > "$stage"
+chmod 644 "$stage"
+mkdir -- "$webroot"; made_root=true
+chown -- "$owner:$(id -gn "$owner")" "$webroot"
+ln -- "$stage" "$available"; made_available=true
+ln -s -- "$available" "$enabled"; made_enabled=true
 nginx -t
-
-if [ $? -eq 0 ]; then
+if $reload; then
+    reload_attempted=true
     systemctl reload nginx
-    echo "Setup vhost $vhost done!"
-else
-    echo "Error found. Only God know where."
 fi
+committed=true
+printf 'Configuration validated and installed: %s; reload requested=%s\n' "$vhost" "$reload"
diff --git a/scripts/appache2_confg.sh b/scripts/appache2_confg.sh
index 68f8000..f624c5d 100644
--- a/scripts/appache2_confg.sh
+++ b/scripts/appache2_confg.sh
@@ -1,11 +1,18 @@
-#!/bin/bash
-
-#Simply Install Apache2 7 configure in firewall
-sudo apt-get install apache2 ufw net-tools -y
-sudo ufw enable
-sudo ufw allow 80
-sudo ufw allow 443
-sudo ufw allow "Apache Full"
-
-echo "Apache 2 Has been Installed & Configured in Firewiall"
-systemctl status apache2 --no-pager
+#!/usr/bin/env bash
+# Default is a plan. Installation can start Apache via package maintainer scripts.
+# Firewall activation is deliberately a separate, reviewed infrastructure change.
+set -euo pipefail
+[[ -r /etc/os-release ]] || exit 1
+source /etc/os-release
+case ${ID:-} in ubuntu|debian) ;; *) echo 'Only Ubuntu/Debian supported' >&2; exit 2 ;; esac
+[[ $# -le 1 && ${1:---plan} =~ ^--(plan|install)$ ]] || exit 2
+printf '%s\n' 'Plan: install apache2. Package installation may start the service.' \
+ 'Firewall prerequisite: review existing UFW policy, actual SSH port/source and out-of-band access.' \
+ 'This script does not install, activate or modify the firewall.'
+if [[ ${1:---plan} == --install ]]; then
+    (( EUID == 0 )) || { echo '--install requires root' >&2; exit 1; }
+    apt-get install --yes apache2
+    apache2ctl configtest
+    systemctl is-active --quiet apache2
+    echo 'Apache installed; configuration valid and service active.'
+fi
diff --git a/scripts/audit/FastCheck.sh b/scripts/audit/FastCheck.sh
index 3885480..4441169 100644
--- a/scripts/audit/FastCheck.sh
+++ b/scripts/audit/FastCheck.sh
@@ -1,151 +1,24 @@
-#!/bin/bash
-tput clear
-trap ctrl_c INT
-
-function ctrl_c() {
-        echo "**You pressed Ctrl+C...Exiting"
-	exit 0;
-}
-#
-echo "#################### ############################## ###############################"
-echo "####################### ############################# ##############################"
-echo "######################## ############################# #############################"
-echo "--------------------------------FastChecker v1.0.1:---------------------------------"
-echo
-echo "Written by sokdr"
-echo
-echo "Nmap [https://nmap.org]  should be isntalled in your linux machine, if not open terminal and type 'sudo apt-get install nmap'"
-echo "waf00f also should be installed on your linux machine, if not then type 'pip install wafw00f' to install it "
-echo "With waf00f pls use FQDN for better resutls:"
-echo "Also the script makes use of hping3 and sslscan tools:"
-echo "####################################################################################"
-echo
-echo "Dear ##$HOSTNAME## Welcome to the Fast VUlnerability Checker v1.0.1:"
-echo "======================================================="
-echo "I provide you with your public IP address:"
-curl -s http://checkip.dyndns.org/ | grep -o "[[:digit:].]\+"
-echo "======================================================="
-echo
-echo -n " Please enter the IP/FQDN you want to check: "
-read hostname
-echo "OK...now checking the availability of $hostname:"
-fping -c1 -t300 $hostname 2>/dev/null 1>/dev/null  #fping to define the timeout in milliseconds
-if [ "$?" = 1 ]   								   #1 unreachable 0 reachable
-then
-	echo "$hostname does not exist run the script again pls:"
-	exit 0;
-else
-	echo "OK moving on to the check-list:"
+#!/usr/bin/env bash
+# Scoped connectivity/TLS inspection. No DoS, exploit or vulnerability NSE categories.
+set -euo pipefail
+[[ $# == 2 && $2 == --scan ]] || { echo 'Usage: FastCheck.sh <DNS-name-or-IPv4> --scan (requires target-owner approval)' >&2; exit 2; }
+host=$1
+[[ ${#host} -le 253 && $host =~ ^[a-zA-Z0-9]([a-zA-Z0-9.-]*[a-zA-Z0-9])?$ && $host != *..* ]] || exit 2
+if [[ $host =~ ^[0-9.]+$ ]]; then
+    [[ $host =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || exit 2
+    IFS=. read -r -a octets <<< "$host"
+    for octet in "${octets[@]}"; do (( 10#$octet <= 255 )) || exit 2; done
 fi
-echo
-echo "Here is the list of vulnerabilities and checks you want to search:"
-echo
-PS3='Please enter your choice: '
-options=("Poodle check" "Heartbleed check" "SSL/TLS check" "ftp-anon" "Shellshock check" "Slowloris check" "HTTP-Methods" "TCP timestamp" "WebServer Information" "Strict-Transport-Security" "Banner grabbing" "WAF detection" "Check DoS attack" "Quit")
-select opt in "${options[@]}"
-do
-    case $opt in
-        "Poodle check")
-		echo "Searching for Poodle vulnerability:"
-		echo
-		echo "Poodle scanner start to check hosts:"
-		nmap -sS -sV --version-light --script ssl-poodle -p 443 $hostname
-		echo
-            ;;
-        "Heartbleed check")
-		echo "Searching for Heartbleed vulnerability:"
-		echo
-		echo "Now starting Heartbleed check:"
-		nmap -p 443 --script ssl-heartbleed $hostname
-		echo
-            ;;
-        "SSL/TLS check")
-        read -p "Please choose between Nmap or SSLscan $program [nmap sslscan]:" answer #choose nmap or sslscan
-		if [[ $answer = nmap ]]; then
-				nmap -sS --script ssl-enum-ciphers -p 443 $hostname
-				echo
-       elif [[ $answer = sslscan ]]; then
-				sslscan --no-failed $hostname
-				echo
-		else echo "wrong try again-:-"
-		fi
-		echo
-            ;;
-	"ftp-anon")
-		echo "check for anonymous FTP connections:"
-		echo
-		nmap -sV -sC -p21 $hostname
-		echo
-	    ;;
-	"Shellshock check")
-		echo "check for Shellshock Vulnerability:"
-		echo
-		nmap -sV -p- --script http-shellshock $hostname
-		echo
-	    ;;
-	"Slowloris check")
-		echo "check for Slowloris Vulnerability:"
-		echo
-		nmap --script http-slowloris-check $hostname
-		echo
-	    ;;
-	"HTTP-Methods")
-		echo "Check HTTP methods:"
-		echo
-		nmap -sS -Pn -p 80,443 -script http-methods $hostname
-		echo
-		;;
-    "TCP timestamp")
-		echo "Checking timestamps:"
-		echo
-		hping3 -S -c 1 -p 443 $hostname --tcp-timestamp
-		echo
-		;;
-	"WebServer Information")
-		echo "Checking webserver information:"
-		echo
-		curl -I -L $hostname
-		echo
-		;;
-	"Strict-Transport-Security")
-		echo "Checking Strict-Transport-Security:"
-		echo
-		curl -si $hostname | grep "Strict"
-		echo
-		;;
-	"Banner grabbing")
-		echo "Checking banners"
-		echo -n "Enter the port you want to check:"
-		read port
-		echo
-		nc $hostname $port
-		echo
-		;;
-	"WAF detection")
-		echo "Check if the targeted hosts are protected by a WAF:"
-		echo
-		echo "Please note that wafw00f script is used to identify the following WAFs: also pls provide FQDN to test"
-		wafw00f -l
-		read -p "Do you want to continue $foo? [yn]" answer
-		if [[ $answer = y ]];
-		then
-			wafw00f $hostname -v
-		fi
-		echo
-	    ;;
-	"Check DoS attack")
-		echo "Check the $hostname if it is vulnerable to DoS attacks:" 	
-		echo
-		echo -n "Enter the port you want to check:"
-		read port
-		#nmap -v --script dos
-		echo
-		nmap --script dos -Pn $hostname $port 
-     "Quit")
-            break
-            ;;
-        *) echo invalid option;;
+PS3='Select check: '
+select choice in 'HTTPS headers' 'TLS certificate' 'TCP port' 'Quit'; do
+    case $choice in
+        'HTTPS headers') curl --connect-timeout 5 --max-time 20 --head -- "https://$host" || exit $? ;;
+        'TLS certificate') timeout 20 openssl s_client -connect "$host:443" -servername "$host" -verify_return_error -verify_hostname "$host" </dev/null || exit $? ;;
+        'TCP port')
+            read -r -p 'Port (1-65535): ' port
+            [[ $port =~ ^[0-9]{1,5}$ ]] && (( 10#$port >= 1 && 10#$port <= 65535 )) || { echo 'Invalid port' >&2; continue; }
+            timeout 5 nc -vz -w 3 "$host" "$((10#$port))" || echo 'Connection failed; host availability unknown' >&2 ;;
+        Quit) break ;;
+        *) echo 'Invalid option' >&2 ;;
     esac
 done
-
-
diff --git a/scripts/audit/LinuxAudit.sh b/scripts/audit/LinuxAudit.sh
index 3d0f614..bd35567 100644
--- a/scripts/audit/LinuxAudit.sh
+++ b/scripts/audit/LinuxAudit.sh
@@ -2,7 +2,7 @@
 # LinuxAudit - Targeted Security Audit Tool
 # Interactive menu: run only what you need
 
-tput clear
+tput clear 2>/dev/null || true
 
 ctrl_c() {
   echo ""
@@ -11,6 +11,10 @@ ctrl_c() {
 }
 trap ctrl_c INT
 
+umask 077
+if [[ ${ENABLE_FILESYSTEM_SCAN:-0} == 1 ]]; then
+  [[ ${AUDIT_SCAN_ROOT:-} == /* && -d ${AUDIT_SCAN_ROOT:-} ]] || { echo "Invalid AUDIT_SCAN_ROOT" >&2; exit 2; }
+fi
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 OUTPUT_FILE="$SCRIPT_DIR/LinuxAudit_$(hostname)_$(date +%Y%m%d_%H%M%S).txt"
 
@@ -186,7 +190,11 @@ audit_disk_memory() {
   sep
 
   hdr "Largest Directories Under / (top 20, skipping pseudo-fs)"
-  du -x --max-depth=3 / 2>/dev/null | sort -rh | head -20; echo
+  if [[ ${ENABLE_FILESYSTEM_SCAN:-0} == 1 ]]; then
+    timeout 60 du -x --max-depth=3 "${AUDIT_SCAN_ROOT:?Set an approved absolute scan directory}" | sort -rn | head -20
+  else
+    echo "Skipped: set ENABLE_FILESYSTEM_SCAN=1 and AUDIT_SCAN_ROOT after approving metadata I/O."
+  fi
   sep
 }
 
@@ -303,12 +311,16 @@ audit_security() {
   sep
 
   hdr "World-Writable Files"
-  find / -xdev -type f -perm -0002 2>/dev/null | head -50
+  if [[ ${ENABLE_FILESYSTEM_SCAN:-0} == 1 ]]; then
+    timeout 60 find "${AUDIT_SCAN_ROOT:?Set approved scan root}" -xdev -type f -perm -0002 | head -50
+  else echo "Filesystem scan skipped."; fi
   echo
   sep
 
   hdr "SUID / SGID Binaries"
-  find / -xdev \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null
+  if [[ ${ENABLE_FILESYSTEM_SCAN:-0} == 1 ]]; then
+    timeout 60 find "${AUDIT_SCAN_ROOT:?Set approved scan root}" -xdev \( -perm -4000 -o -perm -2000 \) -type f
+  else echo "Filesystem scan skipped."; fi
   echo
   sep
 
diff --git a/scripts/audit/ScanPort.sh b/scripts/audit/ScanPort.sh
index 9cef4b3..11ee95c 100644
--- a/scripts/audit/ScanPort.sh
+++ b/scripts/audit/ScanPort.sh
@@ -1,49 +1,23 @@
-!/usr/bin/env bash
-#sokdr
-
-tput clear
-trap ctrl_c INT
-
-function ctrl_c() {
-    echo "** You pressed Ctrl+C... Exiting Script;"
-    exit 0
-}
-
-ip="$1"
-
-# List of top 200 common TCP ports
-top_ports=("20" "21" "22" "23" "25" "53" "80" "110" "123" "135" "139" "143" "443" "445" "993" "995" "1433" "1521" "3306" "3389" "5432" "5900" "8080" "8443")
-
-# Check if a valid IPv4 address is provided
-if [[ $ip =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] ; then
-    echo "#######################################"
-    echo "######## Welcome to ScanPort Script ########"
-    echo "Now checking availability of $ip"
-    
-    START=$(date +%s)
-
-    # Ping the IP address to check if the host is up
-    if ping -c1 $ip >/dev/null 2>&1; then
-        echo "Host is up.... OK ;)"
-
-        
-        echo "Scanning top 200 TCP ports on $ip "
-        echo "========================================================"
-        
-        
-        for port in "${top_ports[@]}"; do
-            nc -vz -w 2 -n $ip $port
-        done
-
-        END=$(date +%s)
-        DIFF=$(( END - START ))
-        echo
-        echo "Script completed in $DIFF seconds."
+#!/usr/bin/env bash
+# Authorized, single-host TCP connectivity checks only; never infer host-down from ICMP.
+set -euo pipefail
+[[ $# == 2 && $2 == --scan ]] || { echo 'Usage: ScanPort.sh <IPv4> --scan (requires target-owner approval)' >&2; exit 2; }
+ip=$1
+[[ $ip =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]] || exit 2
+IFS=. read -r -a octets <<< "$ip"
+for octet in "${octets[@]}"; do (( 10#$octet <= 255 )) || exit 2; done
+command -v nc >/dev/null
+command -v timeout >/dev/null
+ports=(20 21 22 23 25 53 80 110 123 135 139 143 443 445 993 995 1433 1521 3306 3389 5432 5900 8080 8443)
+printf 'Checking %s TCP ports on %s\n' "${#ports[@]}" "$ip"
+for port in "${ports[@]}"; do
+    if timeout 4 nc -z -w 2 -n "$ip" "$port"; then
+        printf '%s OPEN\n' "$port"
     else
-        echo "Host seems to be down.... exiting"
-        exit 1
+        status=$?
+        case $status in
+            1|124) printf '%s CLOSED/FILTERED/TIMED OUT\n' "$port" ;;
+            *) echo "Probe tool failed (exit $status)" >&2; exit "$status" ;;
+        esac
     fi
-else
-    echo "Invalid IPv4 address. Please enter a valid address."
-    exit 1
-fi
+done
diff --git a/scripts/backup/backup_rotation.sh b/scripts/backup/backup_rotation.sh
index d6f4b3e..3079055 100644
--- a/scripts/backup/backup_rotation.sh
+++ b/scripts/backup/backup_rotation.sh
@@ -1,117 +1,30 @@
-#!/bin/bash
-# ===========================================================
-# Script Name : backup_rotation.sh
-# Purpose     : Daily + weekly backup with rotation and alerts
-# Usage       : ./backup_rotation.sh
-#               Recommended cron: 0 2 * * *  (2AM daily)
-# Author      : blow_tech
-# Version     : 2.0
-# ===========================================================
+#!/usr/bin/env bash
+# Required: SRC_DIR, BACKUP_DIR (existing), EXPECTED_BACKUP_SOURCE.
+# Versioned daily/weekly archives; retention is inventory-only.
 set -euo pipefail
-
-SCRIPT_NAME="backup_rotation"
-LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
-
-# =================== CONFIGURATION =========================
-SRC_DIR="/var/www/html"     # Directory to back up
-BACKUP_DIR="/backups"        # Backup destination root
-DAILY_KEEP=7                 # Keep last N daily backups
-WEEKLY_KEEP=4                # Keep last N weekly backups
-MIN_FREE_MB=500              # Abort if less than this MB free on backup disk
-# ===========================================================
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+umask 077
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$SCRIPT_DIR/../core/alert_engine.sh"
-
-lock_script "$SCRIPT_NAME"
-
-mkdir -p "$(dirname "$LOG_FILE")"
-mkdir -p "$BACKUP_DIR/daily"
-mkdir -p "$BACKUP_DIR/weekly"
-
-rotate_log "$LOG_FILE" 10240
-
-HOST=$(hostname)
-DATE=$(date +"%Y-%m-%d")
-WEEK_NUM=$(date +%V)
-DAY_OF_WEEK=$(date +%u)   # 1=Monday … 7=Sunday
-TIMESTAMP=$(date +"%Y-%m-%d %H:%M:%S")
-
-log() { echo "[$TIMESTAMP] $*" | tee -a "$LOG_FILE"; }
-
-log "=== Backup rotation started on $HOST ==="
-
-# ----------------------------------------------------------
-# Pre-flight: check source exists
-# ----------------------------------------------------------
-if [ ! -d "$SRC_DIR" ]; then
-    MSG="Source directory $SRC_DIR does not exist on $HOST!"
-    log "❌ ABORT: $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Aborted — Missing Source" "$MSG"
-    exit 1
+source "$SCRIPT_DIR/../core/backup_engine.sh"
+lock_script backup_rotation
+backup_preflight "${SRC_DIR:?Set SRC_DIR}" "${BACKUP_DIR:?Set BACKUP_DIR}"
+for dir in "$BACKUP_DIR/daily" "$BACKUP_DIR/weekly"; do
+    [[ ! -L $dir ]] || { echo 'Refusing symlink backup subdirectory' >&2; exit 1; }
+    mkdir -p -- "$dir"
+done
+JOB_ID=$(printf %s "$SOURCE_DIR" | sha256sum | cut -c1-16)
+STAMP=$(date -u +%Y%m%dT%H%M%S)-$$
+BACKUP_FILE="$BACKUP_DIR/daily/admin-daily-${JOB_ID}-${STAMP}.tar.gz"
+create_verified_archive "$BACKUP_FILE"
+if [[ $(date -u +%u) == 7 ]]; then
+    WEEKLY_FILE="$BACKUP_DIR/weekly/admin-weekly-${JOB_ID}-$(date -u +%G-W%V)-${STAMP}.tar.gz"
+    PARTIAL=$(mktemp "${WEEKLY_FILE}.partial.XXXXXX")
+    cp -- "$BACKUP_FILE" "$PARTIAL"
+    cmp -- "$BACKUP_FILE" "$PARTIAL"
+    publish_verified_archive "$PARTIAL" "$WEEKLY_FILE"
 fi
-
-# ----------------------------------------------------------
-# Pre-flight: check free disk space on backup destination
-# ----------------------------------------------------------
-FREE_MB=$(df -BM "$BACKUP_DIR" | awk 'NR==2 {gsub(/M/,"",$4); print $4}')
-if [ "$FREE_MB" -lt "$MIN_FREE_MB" ]; then
-    MSG="Only ${FREE_MB}MB free on $BACKUP_DIR (minimum: ${MIN_FREE_MB}MB). Backup aborted on $HOST."
-    log "❌ ABORT: $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Aborted — Disk Space Low" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Daily backup
-# ----------------------------------------------------------
-BACKUP_FILE="$BACKUP_DIR/daily/backup-$DATE.tar.gz"
-
-if [ -f "$BACKUP_FILE" ]; then
-    log "⏭️  Daily backup for $DATE already exists — skipping creation."
-else
-    log "📦 Creating daily backup: $BACKUP_FILE ..."
-    if tar -czf "$BACKUP_FILE" "$SRC_DIR" 2>>"$LOG_FILE"; then
-        SIZE=$(du -sh "$BACKUP_FILE" | cut -f1)
-        log "✅ Daily backup created: $BACKUP_FILE ($SIZE)"
-        alert_info "$SCRIPT_NAME" "Backup Success — $HOST" \
-            "Daily backup created: $BACKUP_FILE ($SIZE)"
-    else
-        MSG="tar failed for $SRC_DIR → $BACKUP_FILE on $HOST"
-        log "❌ FAILED: $MSG"
-        alert_critical "$SCRIPT_NAME" "Backup FAILED — $HOST" "$MSG"
-        exit 1
-    fi
-fi
-
-# ----------------------------------------------------------
-# Rotate old daily backups
-# ----------------------------------------------------------
-DELETED=$(find "$BACKUP_DIR/daily" -type f -mtime +"$DAILY_KEEP" -name "*.tar.gz" \
-          -print -delete 2>>"$LOG_FILE" | wc -l)
-log "🧹 Daily rotation: removed $DELETED old backup(s) older than $DAILY_KEEP days."
-
-# ----------------------------------------------------------
-# Weekly backup (every Sunday)
-# ----------------------------------------------------------
-if [ "$DAY_OF_WEEK" -eq 7 ]; then
-    WEEKLY_FILE="$BACKUP_DIR/weekly/backup-week-$WEEK_NUM.tar.gz"
-
-    if [ -f "$WEEKLY_FILE" ]; then
-        log "⏭️  Weekly backup for week $WEEK_NUM already exists — skipping."
-    else
-        log "📦 Creating weekly backup: $WEEKLY_FILE ..."
-        cp "$BACKUP_FILE" "$WEEKLY_FILE"
-        SIZE=$(du -sh "$WEEKLY_FILE" | cut -f1)
-        log "✅ Weekly backup created: $WEEKLY_FILE ($SIZE)"
-        alert_info "$SCRIPT_NAME" "Weekly Backup Success — $HOST" \
-            "Weekly backup (week $WEEK_NUM) created: $WEEKLY_FILE ($SIZE)"
-    fi
-
-    # Rotate old weekly backups (older than WEEKLY_KEEP * 7 days)
-    WDELETED=$(find "$BACKUP_DIR/weekly" -type f -mtime +"$((7 * WEEKLY_KEEP))" -name "*.tar.gz" \
-               -print -delete 2>>"$LOG_FILE" | wc -l)
-    log "🧹 Weekly rotation: removed $WDELETED old weekly backup(s)."
-fi
-
-log "=== Backup rotation completed successfully ==="
+alert_info backup_rotation 'Backup verified' "$BACKUP_FILE"
+preview_retention "$BACKUP_DIR/daily" "admin-daily-${JOB_ID}-*.tar.gz" "${DAILY_KEEP:-7}"
+WEEKLY_KEEP=${WEEKLY_KEEP:-4}
+[[ $WEEKLY_KEEP =~ ^[1-9][0-9]*$ ]] || exit 2
+preview_retention "$BACKUP_DIR/weekly" "admin-weekly-${JOB_ID}-*.tar.gz" "$((7 * WEEKLY_KEEP))"
diff --git a/scripts/backup/backup_script b/scripts/backup/backup_script
index a204118..57861be 100644
--- a/scripts/backup/backup_script
+++ b/scripts/backup/backup_script
@@ -1,99 +1,15 @@
-#!/bin/bash
-# ===========================================================
-# Script Name : backup_script.sh
-# Purpose     : Compressed backup with verification + alerts
-# Usage       : ./backup_script.sh [source_dir] [backup_dir]
-#               Defaults to Documents → Backups if no args given
-# Author      : blow_tech
-# Version     : 2.0
-# ===========================================================
+#!/usr/bin/env bash
+# EXPECTED_BACKUP_SOURCE='<findmnt SOURCE>' bash backup_script <source> <existing-backup-directory>
 set -euo pipefail
-
-SCRIPT_NAME="backup_script"
-LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+umask 077
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$SCRIPT_DIR/../core/alert_engine.sh"
-
-lock_script "$SCRIPT_NAME"
-
-mkdir -p "$(dirname "$LOG_FILE")"
-rotate_log "$LOG_FILE" 5120
-
-# =================== CONFIGURATION =========================
-SOURCE_DIR="${1:-/home/$USER/Documents}"
-BACKUP_DIR="${2:-/home/$USER/Backups}"
-KEEP_DAYS=7           # Auto-delete backups older than N days
-MIN_FREE_MB=200        # Abort if disk has less than this free
-# ===========================================================
-
-TIMESTAMP=$(date +"%Y-%m-%d_%H-%M-%S")
-BACKUP_FILE="$BACKUP_DIR/backup_${TIMESTAMP}.tar.gz"
-DATE=$(date +"%Y-%m-%d %H:%M:%S")
-HOST=$(hostname)
-
-log() { echo "[$DATE] $*" | tee -a "$LOG_FILE"; }
-
-log "=== Backup started: $SOURCE_DIR → $BACKUP_DIR ==="
-
-# ----------------------------------------------------------
-# Validate source
-# ----------------------------------------------------------
-if [ ! -e "$SOURCE_DIR" ]; then
-    MSG="Source path does not exist: $SOURCE_DIR on $HOST"
-    log "❌ ABORT: $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Aborted" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Ensure backup directory exists and has space
-# ----------------------------------------------------------
-mkdir -p "$BACKUP_DIR"
-
-FREE_MB=$(df -BM "$BACKUP_DIR" | awk 'NR==2 {gsub(/M/,"",$4); print $4}')
-if [ "$FREE_MB" -lt "$MIN_FREE_MB" ]; then
-    MSG="Insufficient disk space: only ${FREE_MB}MB free in $BACKUP_DIR (need ${MIN_FREE_MB}MB) on $HOST"
-    log "❌ ABORT: $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Aborted — Low Disk Space" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Create the backup
-# ----------------------------------------------------------
-log "📦 Creating backup: $BACKUP_FILE ..."
-if tar -czf "$BACKUP_FILE" "$SOURCE_DIR" 2>>"$LOG_FILE"; then
-    SIZE=$(du -sh "$BACKUP_FILE" | cut -f1)
-    log "✅ Backup successful — $BACKUP_FILE ($SIZE)"
-    alert_info "$SCRIPT_NAME" "Backup Success — $HOST" \
-        "Backup of $SOURCE_DIR completed.\nFile: $BACKUP_FILE\nSize: $SIZE"
-else
-    MSG="tar failed: $SOURCE_DIR → $BACKUP_FILE on $HOST"
-    log "❌ FAILED: $MSG"
-    # Clean up partial file
-    rm -f "$BACKUP_FILE"
-    alert_critical "$SCRIPT_NAME" "Backup FAILED — $HOST" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Verify the archive is not corrupt
-# ----------------------------------------------------------
-log "🔍 Verifying archive integrity ..."
-if tar -tzf "$BACKUP_FILE" > /dev/null 2>&1; then
-    log "✅ Archive integrity OK."
-else
-    MSG="Archive verification FAILED for $BACKUP_FILE on $HOST — file may be corrupt!"
-    log "❌ $MSG"
-    alert_critical "$SCRIPT_NAME" "Backup Corrupt — $HOST" "$MSG"
-    exit 1
-fi
-
-# ----------------------------------------------------------
-# Rotate old backups
-# ----------------------------------------------------------
-DELETED=$(find "$BACKUP_DIR" -type f -mtime +"$KEEP_DAYS" -name "*.tar.gz" \
-          -print -delete 2>>"$LOG_FILE" | wc -l)
-log "🧹 Cleaned $DELETED backup(s) older than $KEEP_DAYS days."
-log "=== Backup process completed ==="
+source "$SCRIPT_DIR/../core/backup_engine.sh"
+[[ $# == 2 ]] || { echo 'Supply source and existing backup directory' >&2; exit 2; }
+lock_script backup_script
+backup_preflight "$1" "$2"
+JOB_ID=$(printf %s "$SOURCE_DIR" | sha256sum | cut -c1-16)
+BACKUP_FILE="$BACKUP_DIR/admin-backup-${JOB_ID}-$(date -u +%Y%m%dT%H%M%S)-$$.tar.gz"
+create_verified_archive "$BACKUP_FILE"
+alert_info backup_script 'Backup verified' "$BACKUP_FILE"
+preview_retention "$BACKUP_DIR" "admin-backup-${JOB_ID}-*.tar.gz" "${KEEP_DAYS:-7}"
diff --git a/scripts/core/alert_engine.sh b/scripts/core/alert_engine.sh
new file mode 100644
index 0000000..9d38659
--- /dev/null
+++ b/scripts/core/alert_engine.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Local alerts only: no mail/webhook destination is assumed or contacted.
+# Sourcing this file performs no work.
+alert_emit() { printf '%s [%s] %s: %s -- %s\n' "$(date -Is)" "$1" "$2" "$3" "$4" >&2; }
+alert_info() { alert_emit INFO "$@"; }
+alert_warning() { alert_emit WARNING "$@"; }
+alert_critical() { alert_emit CRITICAL "$@"; }
+lock_script() {
+    local name=$1 dir=${ADMIN_SCRIPTS_STATE_DIR:-${XDG_STATE_HOME:-$HOME/.local/state}/admin-scripts}
+    [[ $name =~ ^[a-zA-Z0-9_-]+$ ]] || return 1
+    command -v flock >/dev/null || { echo 'flock is required' >&2; return 1; }
+    (umask 077; mkdir -p -- "$dir") || return 1
+    [[ ! -L $dir && -O $dir && $(stat -c %a -- "$dir") == 700 ]] || {
+        echo 'State directory must be owned by this user, mode 700, and not a symlink' >&2; return 1;
+    }
+    [[ ! -L $dir/$name.lock ]] || return 1
+    exec {ADMIN_SCRIPTS_LOCK_FD}>"$dir/$name.lock" || return 1
+    flock -n "$ADMIN_SCRIPTS_LOCK_FD" || { echo "Another $name run holds the lock" >&2; return 1; }
+}
+rotate_log() {
+    local path=$1 limit_kib=$2 archive
+    [[ ! -L $path && $limit_kib =~ ^[0-9]+$ ]] || return 1
+    if [[ -f $path ]] && (( $(stat -c %s -- "$path") > limit_kib * 1024 )); then
+        archive=$(mktemp "${path}.$(date +%Y%m%dT%H%M%S).XXXXXX") || return 1
+        mv -- "$path" "$archive" || return 1
+        # Retain evidence for a separately configured retention policy.
+    fi
+}
diff --git a/scripts/core/backup_engine.sh b/scripts/core/backup_engine.sh
new file mode 100644
index 0000000..ebb404e
--- /dev/null
+++ b/scripts/core/backup_engine.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# Fail-closed file backups. Live databases require application-specific backups.
+backup_preflight() {
+    local source=$1 destination=$2 actual needed available tool
+    for tool in realpath findmnt tar gzip df du sha256sum mktemp flock; do
+        command -v "$tool" >/dev/null || { echo "Missing dependency: $tool" >&2; return 1; }
+    done
+    SOURCE_DIR=$(realpath -e -- "$source") || return 1
+    BACKUP_DIR=$(realpath -e -- "$destination") || return 1
+    [[ -d $SOURCE_DIR && -d $BACKUP_DIR && $SOURCE_DIR != / && $BACKUP_DIR != / ]] || return 1
+    [[ $BACKUP_DIR != "$SOURCE_DIR" && $BACKUP_DIR != "$SOURCE_DIR/"* ]] || {
+        echo 'Backup destination must be outside the source tree' >&2; return 1;
+    }
+    : "${EXPECTED_BACKUP_SOURCE:?Set EXPECTED_BACKUP_SOURCE to the reviewed findmnt SOURCE for this destination}"
+    actual=$(findmnt -n -o SOURCE -T "$BACKUP_DIR") || return 1
+    [[ $actual == "$EXPECTED_BACKUP_SOURCE" ]] || { echo 'Backup mount identity mismatch' >&2; return 1; }
+    [[ ! -L $destination ]] || { echo 'Symlink backup destinations are not supported' >&2; return 1; }
+    needed=$(du -sb -- "$SOURCE_DIR" | cut -f1) || return 1
+    available=$(df -B1 --output=avail -- "$BACKUP_DIR" | awk 'NR==2 {print $1}') || return 1
+    [[ $needed =~ ^[0-9]+$ && $available =~ ^[0-9]+$ ]] || return 1
+    (( available > needed + needed / 10 + 524288000 )) || { echo 'Insufficient backup headroom' >&2; return 1; }
+}
+publish_verified_archive() {
+    local partial=$1 target=$2 checksum
+    [[ ! -e $target && ! -L $target && ! -e ${target}.sha256 && ! -L ${target}.sha256 ]] || {
+        echo 'Refusing existing archive or checksum' >&2; return 1;
+    }
+    gzip -t -- "$partial" && tar -tzf "$partial" >/dev/null || return 1
+    checksum=$(mktemp "${target}.sha256.partial.XXXXXX") || return 1
+    # Hash through the final pathname only after no-clobber archive publication.
+    ln -T -- "$partial" "$target" || return 1
+    sha256sum -- "$target" > "$checksum" || return 1
+    ln -T -- "$checksum" "${target}.sha256" || return 1
+    rm -- "$partial" "$checksum" || return 1
+}
+create_verified_archive() {
+    local target=$1 partial
+    [[ ! -e $target && ! -L $target && ! -e ${target}.sha256 && ! -L ${target}.sha256 ]] || {
+        echo 'Refusing existing archive or checksum' >&2; return 1;
+    }
+    partial=$(mktemp "${target}.partial.XXXXXX") || return 1
+    if ! tar -czf "$partial" -C "$(dirname -- "$SOURCE_DIR")" -- "$(basename -- "$SOURCE_DIR")"; then
+        echo "Backup failed; incomplete artifact retained: $partial" >&2; return 1
+    fi
+    publish_verified_archive "$partial" "$target" || return 1
+    printf 'Verified archive: %s (restore test still required)\n' "$target"
+}
+preview_retention() {
+    local dir=$1 pattern=$2 days=$3
+    [[ $days =~ ^[1-9][0-9]*$ ]] || return 1
+    printf 'Retention candidates only; review before any separate deletion:\n'
+    find "$dir" -maxdepth 1 -type f -name "$pattern" -mtime "+$days" -print
+}
diff --git a/scripts/monitoring/cpu_memory_monitor b/scripts/monitoring/cpu_memory_monitor
index bf6115b..ca2c5ac 100644
--- a/scripts/monitoring/cpu_memory_monitor
+++ b/scripts/monitoring/cpu_memory_monitor
@@ -8,6 +8,7 @@
 # Version     : 2.0
 # ===========================================================
 set -euo pipefail
+umask 077
 
 SCRIPT_NAME="cpu_memory_monitor"
 LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
@@ -62,7 +63,7 @@ if [ "$CPU_USAGE" -ge "$CPU_THRESHOLD" ]; then
     log "🔴 CRITICAL: $MSG"
 
     # Top 3 CPU-hungry processes for context
-    TOP_PROCS=$(ps -eo comm,%cpu --sort=-%cpu | head -4 | tail -3 | awk '{printf "%s (%s%%)\n", $1, $2}' | tr '\n' ' ')
+    TOP_PROCS=$(ps -eo comm,%cpu --sort=-%cpu | awk 'NR>=2 && NR<=4' | awk '{printf "%s (%s%%)\n", $1, $2}' | tr '\n' ' ')
     alert_critical "$SCRIPT_NAME" "High CPU Usage — $HOST" "$MSG\nTop processes: $TOP_PROCS"
 else
     log "✅ CPU usage normal: ${CPU_USAGE}% (threshold: ${CPU_THRESHOLD}%)"
@@ -76,7 +77,7 @@ if [ "$MEM_INT" -ge "$MEM_THRESHOLD" ]; then
     MSG="Memory usage is at ${MEM_USAGE}% (${MEM_USED_MB}MB / ${MEM_TOTAL_MB}MB) on $HOST"
     log "🔴 CRITICAL: $MSG"
 
-    TOP_MEM=$(ps -eo comm,%mem --sort=-%mem | head -4 | tail -3 | awk '{printf "%s (%s%%)\n", $1, $2}' | tr '\n' ' ')
+    TOP_MEM=$(ps -eo comm,%mem --sort=-%mem | awk 'NR>=2 && NR<=4' | awk '{printf "%s (%s%%)\n", $1, $2}' | tr '\n' ' ')
     alert_critical "$SCRIPT_NAME" "High Memory Usage — $HOST" "$MSG\nTop processes: $TOP_MEM"
 else
     log "✅ Memory usage normal: ${MEM_USAGE}% — ${MEM_USED_MB}MB / ${MEM_TOTAL_MB}MB"
diff --git a/scripts/monitoring/disk_alert b/scripts/monitoring/disk_alert
index 7e26e5b..8f275fb 100644
--- a/scripts/monitoring/disk_alert
+++ b/scripts/monitoring/disk_alert
@@ -1,85 +1,29 @@
-#!/bin/bash
-# ===========================================================
-# Script Name : disk_alert.sh
-# Purpose     : Monitor disk usage on all mountpoints
-#               Alert via Slack/Email when threshold exceeded
-# Usage       : ./disk_alert.sh
-#               Recommended cron: */30 * * * *
-# Author      : blow_tech
-# Version     : 2.0
-# ===========================================================
+#!/usr/bin/env bash
+# GNU df: one collection pass, preserving the trailing mountpoint field.
 set -euo pipefail
-
-SCRIPT_NAME="disk_alert"
-LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
-
-# =================== CONFIGURATION =========================
-WARNING_THRESHOLD=75    # % — send WARNING alert
-CRITICAL_THRESHOLD=90   # % — send CRITICAL alert
-
-# Mountpoints to skip (space-separated)
-EXCLUDE_FS="tmpfs devtmpfs udev squashfs overlay"
-# ===========================================================
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$SCRIPT_DIR/../core/alert_engine.sh"
-
-lock_script "$SCRIPT_NAME"
-
-mkdir -p "$(dirname "$LOG_FILE")"
-rotate_log "$LOG_FILE" 5120
-
-HOST=$(hostname)
-DATE=$(date +"%Y-%m-%d %H:%M:%S")
-ALERT_TRIGGERED=false
-
-log() { echo "[$DATE] $*" | tee -a "$LOG_FILE"; }
-
-log "--- Disk usage check started on $HOST ---"
-
-# Build exclusion pattern
-EXCLUDE_PATTERN=$(echo "$EXCLUDE_FS" | tr ' ' '|')
-
-while IFS= read -r line; do
-    # Parse df output columns
-    FS=$(echo "$line"      | awk '{print $1}')
-    SIZE=$(echo "$line"    | awk '{print $2}')
-    USED=$(echo "$line"    | awk '{print $3}')
-    AVAIL=$(echo "$line"   | awk '{print $4}')
-    USEP=$(echo "$line"    | awk '{print $5}' | tr -d '%')
-    MOUNT=$(echo "$line"   | awk '{print $6}')
-
-    # Skip excluded filesystem types
-    FS_TYPE=$(findmnt -n -o FSTYPE "$MOUNT" 2>/dev/null || echo "unknown")
-    if echo "$FS_TYPE" | grep -qE "^($EXCLUDE_PATTERN)$"; then
-        continue
-    fi
-
-    # Skip if usage is not a number
-    if ! [[ "$USEP" =~ ^[0-9]+$ ]]; then
-        continue
-    fi
-
-    if [ "$USEP" -ge "$CRITICAL_THRESHOLD" ]; then
-        MSG="CRITICAL: $MOUNT on $HOST is ${USEP}% full (Used: $USED / $SIZE, Available: $AVAIL)"
-        log "🔴 $MSG"
-        alert_critical "$SCRIPT_NAME" "Disk Critical — $MOUNT on $HOST" "$MSG"
-        ALERT_TRIGGERED=true
-
-    elif [ "$USEP" -ge "$WARNING_THRESHOLD" ]; then
-        MSG="WARNING: $MOUNT on $HOST is ${USEP}% full (Used: $USED / $SIZE, Available: $AVAIL)"
-        log "🟡 $MSG"
-        alert_warning "$SCRIPT_NAME" "Disk Warning — $MOUNT on $HOST" "$MSG"
-        ALERT_TRIGGERED=true
-
+lock_script disk_alert
+WARNING_THRESHOLD=${WARNING_THRESHOLD:-75}
+CRITICAL_THRESHOLD=${CRITICAL_THRESHOLD:-90}
+[[ $WARNING_THRESHOLD =~ ^[0-9]+$ && $CRITICAL_THRESHOLD =~ ^[0-9]+$ ]] || exit 2
+(( WARNING_THRESHOLD < CRITICAL_THRESHOLD && CRITICAL_THRESHOLD <= 100 )) || exit 2
+data=$(LC_ALL=C df -BM --output=fstype,size,used,avail,pcent,target) || {
+    alert_critical disk_alert UNKNOWN 'Filesystem collection failed'; exit 1;
+}
+checked=0 failed=0
+while read -r type size used avail percent mount; do
+    case $type in Type|tmpfs|devtmpfs|udev|squashfs|overlay) continue ;; esac
+    percent=${percent%%%}
+    [[ $percent =~ ^[0-9]+$ && -n $mount ]] || { echo 'UNKNOWN: malformed df row' >&2; failed=1; continue; }
+    checked=$((checked + 1))
+    if (( percent >= CRITICAL_THRESHOLD )); then
+        alert_critical disk_alert "$mount" "${percent}% used; $avail available"; failed=1
+    elif (( percent >= WARNING_THRESHOLD )); then
+        alert_warning disk_alert "$mount" "${percent}% used; $avail available"; failed=1
     else
-        log "✅ $MOUNT — ${USEP}% used (${AVAIL} free)"
+        printf 'OK: %s %s%% used\n' "$mount" "$percent"
     fi
-
-done < <(df -BM | awk 'NR>1')
-
-if [ "$ALERT_TRIGGERED" = false ]; then
-    log "✅ All disk partitions within normal range."
-fi
-
-log "--- Disk usage check completed ---"
+done <<< "$data"
+(( checked > 0 )) || { echo 'UNKNOWN: no eligible filesystems checked' >&2; exit 1; }
+(( failed == 0 ))
diff --git a/scripts/monitoring/service_uptime b/scripts/monitoring/service_uptime
index 517f426..1fea851 100644
--- a/scripts/monitoring/service_uptime
+++ b/scripts/monitoring/service_uptime
@@ -1,83 +1,28 @@
-#!/bin/bash
-# ===========================================================
-# Script Name : service_uptime_checker.sh
-# Purpose     : Check critical services — restart if down,
-#               escalate alert if restart fails
-# Usage       : ./service_uptime_checker.sh
-#               Recommended cron: */5 * * * *
-# Author      : blow_tech
-# Version     : 2.0
-# ===========================================================
+#!/usr/bin/env bash
+# Alert-only monitor. Supply intended service names explicitly.
 set -euo pipefail
-
-SCRIPT_NAME="service_uptime_checker"
-LOG_FILE="/var/log/admin-scripts/${SCRIPT_NAME}.log"
-
-# =================== CONFIGURATION =========================
-SERVICES=("nginx" "docker" "mysql")   # Services to monitor
-MAX_RESTART_ATTEMPTS=2                  # How many times to retry before escalating
-RESTART_WAIT=5                          # Seconds to wait between restart attempts
-# ===========================================================
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
 source "$SCRIPT_DIR/../core/alert_engine.sh"
-
-lock_script "$SCRIPT_NAME"
-
-mkdir -p "$(dirname "$LOG_FILE")"
-rotate_log "$LOG_FILE" 5120
-
-HOST=$(hostname)
-DATE=$(date +"%Y-%m-%d %H:%M:%S")
-FAIL_COUNT=0
-
-log() { echo "[$DATE] $*" | tee -a "$LOG_FILE"; }
-
-log "--- Service check started on $HOST ---"
-
-for service in "${SERVICES[@]}"; do
-
-    # Check if service exists on this system
-    if ! systemctl list-units --full --all 2>/dev/null | grep -q "^${service}.service"; then
-        log "⏭️  $service — not installed on this system, skipping."
-        continue
+[[ $# -gt 0 ]] || { echo 'Usage: service_uptime <service> [service ...]' >&2; exit 2; }
+lock_script service_uptime
+checked=0 failed=0
+for service in "$@"; do
+    [[ $service =~ ^[a-zA-Z0-9_@.:-]+$ ]] || { echo 'Invalid unit name' >&2; exit 2; }
+    checked=$((checked + 1))
+    if ! state=$(systemctl show "$service" --property=LoadState,ActiveState --no-pager); then
+        alert_critical service_uptime 'UNKNOWN: query failed' "$service"
+        failed=$((failed + 1)); continue
     fi
-
-    if systemctl is-active --quiet "$service"; then
-        log "✅ $service is running."
+    load= active=
+    while IFS='=' read -r key value; do
+        case $key in LoadState) load=$value ;; ActiveState) active=$value ;; esac
+    done <<< "$state"
+    if [[ $load == loaded && $active == active ]]; then
+        printf 'OK: %s\n' "$service"
     else
-        log "⚠️  $service is DOWN — attempting restart..."
-        alert_warning "$SCRIPT_NAME" "Service Down — $service on $HOST" \
-            "$service is not running on $HOST. Attempting automatic restart."
-
-        SUCCESS=false
-        for attempt in $(seq 1 "$MAX_RESTART_ATTEMPTS"); do
-            log "   Restart attempt $attempt / $MAX_RESTART_ATTEMPTS ..."
-            systemctl restart "$service" 2>>"$LOG_FILE" || true
-            sleep "$RESTART_WAIT"
-
-            if systemctl is-active --quiet "$service"; then
-                log "✅ $service restarted successfully on attempt $attempt."
-                alert_info "$SCRIPT_NAME" "Service Recovered — $service on $HOST" \
-                    "$service was down but has been restarted successfully on attempt $attempt."
-                SUCCESS=true
-                break
-            fi
-        done
-
-        if [ "$SUCCESS" = false ]; then
-            log "🔴 CRITICAL: $service failed to restart after $MAX_RESTART_ATTEMPTS attempts! Manual intervention required."
-            alert_critical "$SCRIPT_NAME" "Service FAILED — $service on $HOST" \
-                "$service could not be restarted after $MAX_RESTART_ATTEMPTS attempts on $HOST. MANUAL INTERVENTION REQUIRED.\n\nLast journal entries:\n$(journalctl -u "$service" -n 10 --no-pager 2>/dev/null || echo 'Unable to fetch journal')"
-            (( FAIL_COUNT++ )) || true
-        fi
+        alert_critical service_uptime 'Service not healthy' "$service load=$load active=$active; no restart attempted"
+        failed=$((failed + 1))
     fi
 done
-
-if [ "$FAIL_COUNT" -gt 0 ]; then
-    log "--- Service check completed with $FAIL_COUNT failure(s) ---"
-    exit 1
-else
-    log "--- Service check completed — all services healthy ---"
-    exit 0
-fi
+printf 'Checked=%s Failed=%s\n' "$checked" "$failed"
+(( failed == 0 ))
diff --git a/tests/test_safety.py b/tests/test_safety.py
new file mode 100644
index 0000000..532a6c3
--- /dev/null
+++ b/tests/test_safety.py
@@ -0,0 +1,117 @@
+"""Local fixtures and mocked systemctl/df only. Never contacts a target or service."""
+import os
+from pathlib import Path
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+class SafetyTests(unittest.TestCase):
+    def setUp(self):
+        self.tmp = tempfile.TemporaryDirectory()
+        self.addCleanup(self.tmp.cleanup)
+        self.base = Path(self.tmp.name)
+        self.bin = self.base / 'bin'; self.bin.mkdir()
+        self.env = dict(os.environ, ADMIN_SCRIPTS_STATE_DIR=str(self.base/'state'), PATH=str(self.bin)+os.pathsep+os.environ['PATH'])
+    def mock(self, name, body):
+        p=self.bin/name; p.write_text('#!/usr/bin/env bash\n'+body+'\n'); p.chmod(0o755)
+    def run_script(self, script, *args):
+        return subprocess.run(['bash', str(ROOT/'scripts'/script), *map(str,args)], env=self.env, text=True, capture_output=True, timeout=15)
+    def backup_fixture(self):
+        source=self.base/'source with spaces'; source.mkdir(); (source/'data.txt').write_text('preserve me\n')
+        dest=self.base/'backups'; dest.mkdir()
+        self.env['EXPECTED_BACKUP_SOURCE']=subprocess.check_output(['findmnt','-n','-o','SOURCE','-T',str(dest)],text=True).strip()
+        return source,dest
+    def test_all_bash_syntax(self):
+        for p in (ROOT/'scripts').rglob('*'):
+            if p.is_file() and p.read_bytes().startswith(b'#!'):
+                result=subprocess.run(['bash','-n',str(p)],capture_output=True,text=True)
+                self.assertEqual(result.returncode,0,f'{p}: {result.stderr}')
+    def test_backup_roundtrip_and_preserves_unrelated_files(self):
+        src,dest=self.backup_fixture(); old=dest/'unrelated.tar.gz'; old.write_text('keep')
+        result=self.run_script('backup/backup_script',src,dest)
+        self.assertEqual(result.returncode,0,result.stderr)
+        archives=list(dest.glob('admin-backup-*.tar.gz')); self.assertEqual(len(archives),1)
+        restore=self.base/'restore'; restore.mkdir()
+        subprocess.run(['tar','-xzf',str(archives[0]),'-C',str(restore)],check=True)
+        self.assertEqual((restore/src.name/'data.txt').read_bytes(),(src/'data.txt').read_bytes())
+        self.assertEqual(old.read_text(),'keep')
+        subprocess.run(['sha256sum','-c',str(archives[0])+'.sha256'],check=True,capture_output=True)
+    def test_failed_tar_never_publishes_or_rotates(self):
+        src,dest=self.backup_fixture(); old=dest/'old.tar.gz'; old.write_text('keep')
+        self.mock('tar','echo partial > "$2"; exit 2')
+        result=self.run_script('backup/backup_script',src,dest)
+        self.assertNotEqual(result.returncode,0)
+        self.assertFalse(list(dest.glob('admin-backup-*.tar.gz')))
+        self.assertTrue(list(dest.glob('*.partial.*')))
+        self.assertEqual(old.read_text(),'keep')
+        self.assertNotIn('Backup verified',result.stderr)
+    def test_wrong_mount_and_recursive_destination_rejected(self):
+        src,dest=self.backup_fixture(); self.env['EXPECTED_BACKUP_SOURCE']='wrong-device'
+        self.assertNotEqual(self.run_script('backup/backup_script',src,dest).returncode,0)
+        self.assertEqual(list(dest.iterdir()),[])
+        inside=src/'backup'; inside.mkdir()
+        self.assertNotEqual(self.run_script('backup/backup_script',src,inside).returncode,0)
+    def test_existing_final_archive_is_never_overwritten(self):
+        src,dest=self.backup_fixture(); target=dest/'existing.tar.gz'; target.write_text('not an archive')
+        env=dict(self.env,SOURCE_DIR=str(src),TARGET=str(target),ENGINE=str(ROOT/'scripts/core/backup_engine.sh'))
+        result=subprocess.run(['bash','-c','source "$ENGINE"; create_verified_archive "$TARGET"'],env=env,capture_output=True)
+        self.assertNotEqual(result.returncode,0); self.assertEqual(target.read_text(),'not an archive')
+    def test_service_states_fail_closed_without_restart(self):
+        for load,active,code,expected in [('loaded','active',0,0),('loaded','failed',0,1),('loaded','inactive',0,1),('masked','inactive',0,1),('not-found','inactive',0,1),('','',1,1)]:
+            self.mock('systemctl',f'[[ $1 == show ]] || exit 99\nprintf "LoadState={load}\\nActiveState={active}\\n"\nexit {code}')
+            result=self.run_script('monitoring/service_uptime','nginx')
+            self.assertEqual(result.returncode,expected,result.stderr)
+        self.assertNotEqual(self.run_script('monitoring/service_uptime').returncode,0)
+    def test_checksum_collision_never_overwrites_evidence(self):
+        src,dest=self.backup_fixture()
+        for kind in ['file','symlink','directory']:
+            target=dest/(kind+'.tar.gz'); sidecar=Path(str(target)+'.sha256')
+            evidence=dest/(kind+'-evidence'); evidence.write_text('retain')
+            if kind=='file': sidecar.write_text('retain')
+            elif kind=='symlink': sidecar.symlink_to(evidence)
+            else: sidecar.mkdir()
+            env=dict(self.env,SOURCE_DIR=str(src),TARGET=str(target),ENGINE=str(ROOT/'scripts/core/backup_engine.sh'))
+            result=subprocess.run(['bash','-c','source "$ENGINE"; create_verified_archive "$TARGET"'],env=env,capture_output=True)
+            self.assertNotEqual(result.returncode,0)
+            self.assertFalse(target.exists())
+            self.assertEqual(evidence.read_text(),'retain')
+            if kind!='directory': self.assertEqual(sidecar.read_text(),'retain')
+    def test_checksum_failure_is_not_a_verified_backup(self):
+        src,dest=self.backup_fixture(); target=dest/'failed.tar.gz'
+        self.mock('sha256sum','exit 1')
+        env=dict(self.env,SOURCE_DIR=str(src),TARGET=str(target),ENGINE=str(ROOT/'scripts/core/backup_engine.sh'))
+        result=subprocess.run(['bash','-c','source "$ENGINE"; create_verified_archive "$TARGET"'],env=env,capture_output=True,text=True)
+        self.assertNotEqual(result.returncode,0)
+        self.assertFalse(Path(str(target)+'.sha256').exists())
+        self.assertNotIn('Verified archive:',result.stdout)
+        self.assertTrue(list(dest.glob('*.partial.*')))
+    def test_disk_preserves_mount_spaces_and_query_failure(self):
+        self.mock('df',"printf 'Type 1M-blocks Used Avail Use%% Mounted on\\next4 100M 80M 20M 80%% /data with spaces\\n'")
+        result=self.run_script('monitoring/disk_alert'); self.assertEqual(result.returncode,1)
+        self.assertIn('/data with spaces',result.stderr)
+        self.mock('df','exit 1')
+        result=self.run_script('monitoring/disk_alert'); self.assertNotEqual(result.returncode,0)
+        self.assertIn('UNKNOWN',result.stderr)
+    def test_nginx_invalid_inputs_never_reach_system_commands(self):
+        template=self.base/'template'; template.write_text('server_name {{DOMAIN}};')
+        for domain in ['', '../etc', '-bad.com', 'a..com', 'x.com/../../', 'bad name.com', 'a.com;id', 'a.com.']:
+            result=self.run_script('Nginx_create.sh',domain,template,'root')
+            self.assertNotEqual(result.returncode,0,domain)
+    def test_nginx_preview_does_not_mutate(self):
+        template=self.base/'template'; template.write_text('server_name {{DOMAIN}};')
+        self.mock('id','exit 0')
+        for command in ['nginx','mkdir','chown','chmod','ln','systemctl','rm']:
+            self.mock(command,'echo "UNEXPECTED MUTATION" >&2; exit 99')
+        result=self.run_script('Nginx_create.sh','example.test',template,'root')
+        self.assertEqual(result.returncode,0,result.stderr)
+        self.assertIn('server_name example.test;',result.stdout)
+        self.assertNotIn('UNEXPECTED',result.stderr)
+    def test_scan_rejects_invalid_address_before_network(self):
+        self.mock('nc','echo NETWORK_CALLED; exit 99')
+        for ip in ['256.1.1.1','1.2.3','-1.2.3.4','1.2.3.4;id']:
+            result=self.run_script('audit/ScanPort.sh',ip,'--scan')
+            self.assertNotEqual(result.returncode,0); self.assertNotIn('NETWORK_CALLED',result.stdout)
+
+if __name__=='__main__': unittest.main()