perf(lib): reuse parsed templates across isolated executions

feat(templates): add execution-local parser lifecycle
docs: plan nuclei runtime reuse milestone
2026-11-10 04:01:31 -10:00 · 2026-09-08 09:37:29 +05:30 · 2026-09-08 09:33:08 +05:30 · 2026-09-08 09:30:08 +05:30 · 2026-09-07 06:19:19 +00:00 · 2026-09-07 03:55:36 +07:00
157 changed files with 13561 additions and 1912 deletions
@@ -16,5 +16,4 @@ jobs:
      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/setup/go/compat-checks@v1
        with:
-          go-version: "stable"
          release-test: true
@@ -0,0 +1,124 @@
+name: Maintain security context
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 4 * * 1"
+  push:
+    paths: [.github/workflows/security-context.yml]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: security-context
+  cancel-in-progress: true
+
+jobs:
+  refresh:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      # A workflow can initially run from the branch that adds this file. The
+      # API analyzes the repository default branch, so check out that same
+      # branch before calculating the HEAD we wait for.
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+
+      # Analyze this commit on securitycontext.dev, wait for the result, and
+      # download it. The run's own token authorizes private repositories —
+      # no secrets to configure.
+      - name: Generate SECURITY_CONTEXT.md
+        id: context
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: |
+          sc() { curl --fail-with-body -sS -H "X-GitHub-Token: $GITHUB_TOKEN" "$@"; }
+          base="https://securitycontext.dev"
+          head="$(git rev-parse HEAD)"
+
+          sc -X POST "$base/api/v1/context?wait=60" -H "Content-Type: application/json" \
+             -H "X-Secc-Client: github-action" --data "{\"repo\":\"$GITHUB_REPOSITORY\",\"head\":\"$head\"}" >/dev/null
+
+          for _ in {1..120}; do
+            state="$(sc "$base/api/v1/context/$GITHUB_REPOSITORY")"
+            status="$(jq -r .status <<<"$state")"
+            if [ "$status" = "error" ]; then
+              jq -r '.error // "analysis failed"' <<<"$state" >&2
+              exit 1
+            fi
+            if [ "$status" = "ready" ] && [ "$(jq -r '.summary.head_sha // empty' <<<"$state")" = "$head" ]; then
+              sc -L "$base/r/$GITHUB_REPOSITORY.md" -o SECURITY_CONTEXT.md
+              # A private report is access-gated on the web, so the pull request
+              # links the rendered file on this branch instead.
+              jq -r '"visibility=" + (.visibility // "public")' <<<"$state" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+            sleep 15
+          done
+          echo "Timed out waiting for analysis of $head" >&2
+          exit 1
+
+      # A pull request should mean the analysis changed. When only the volatile
+      # header moved (timestamps, analyzed commit, commit counts), restore the
+      # committed file so no PR is opened and any header-only PR closes.
+      - name: Skip the update unless the analysis changed
+        id: report
+        run: |
+          changed=true
+          if [ -n "$(git ls-files SECURITY_CONTEXT.md)" ] && git diff --quiet -I '^<!-- Generated' -I '^_Generated' -I '^_Analyzed commit' -I '^- Commits analyzed' -I '^- Commits flagged' -- SECURITY_CONTEXT.md; then
+            git checkout -- SECURITY_CONTEXT.md
+            changed=false
+          fi
+          echo "changed=$changed" >> "$GITHUB_OUTPUT"
+
+      # Point the repository's agent instructions at the file, when it has any.
+      # Never create one: adding an agent instructions file uninvited is a
+      # bigger footprint than this warrants.
+      - name: Reference the context from agent instructions
+        id: agents
+        env:
+          REPORT_CHANGED: ${{ steps.report.outputs.changed }}
+        run: |
+          line="See SECURITY_CONTEXT.md for this repo's known vulnerabilities and recurring weak spots. Check it before writing or reviewing security-sensitive code."
+          touched=""
+          paths="SECURITY_CONTEXT.md"
+          for f in CLAUDE.md AGENTS.md; do
+            if [ ! -f "$f" ]; then continue; fi
+            paths="$(printf '%s\n%s' "$paths" "$f")"
+            if grep -q "SECURITY_CONTEXT.md" "$f"; then continue; fi
+            printf '\n%s\n' "$line" >> "$f"
+            if [ -n "$touched" ]; then touched="$touched and $f"; else touched="$f"; fi
+          done
+          echo "touched=$touched" >> "$GITHUB_OUTPUT"
+          # Title the pull request for what it actually carries: when the
+          # analysis is unchanged, the only edit is the agent-instructions line.
+          if [ "$REPORT_CHANGED" = "false" ]; then
+            echo "subject=chore: reference security context from agent instructions" >> "$GITHUB_OUTPUT"
+          else
+            echo "subject=chore: refresh security context" >> "$GITHUB_OUTPUT"
+          fi
+          {
+            echo "paths<<SC_EOF"
+            echo "$paths"
+            echo "SC_EOF"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Open an update pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          branch: security-context/refresh
+          commit-message: ${{ steps.agents.outputs.subject }}
+          title: ${{ steps.agents.outputs.subject }}
+          body: |
+            Refreshes `SECURITY_CONTEXT.md`, this repository's security-fix history as working context, so agents and reviewers don't reintroduce fixes that already shipped.
+
+            ${{ steps.context.outputs.visibility == 'private' && format('[Read the updated file]({0}/{1}/blob/security-context/refresh/SECURITY_CONTEXT.md)', github.server_url, github.repository) || format('[Full report for this repository](https://securitycontext.dev/r/{0})', github.repository) }}
+
+            ${{ steps.agents.outputs.touched != '' && format('Also adds a one-line reference to {0} so your coding agent picks this up automatically.', steps.agents.outputs.touched) || 'Tip: reference `SECURITY_CONTEXT.md` from your agent instructions file (`CLAUDE.md` or `AGENTS.md`) so your coding agent reads it automatically.' }}
+
+            ---
+            _Your agent doesn't know this repo's security history. [Security Context](https://securitycontext.dev) keeps it where your agent can see it, so old vulnerabilities and their variants don't come back in new code._
+          add-paths: ${{ steps.agents.outputs.paths }}
@@ -206,8 +206,6 @@ jobs:
    steps:
      - uses: actions/checkout@v7
      - uses: projectdiscovery/actions/setup/go@v1
-        with:
-          go-version: "stable"
      - uses: projectdiscovery/actions/goreleaser@v1

  flamegraph:
@@ -17,4 +17,4 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
-      - uses: crate-ci/[email protected]8.0
+      - uses: crate-ci/[email protected]9.0
@@ -33,6 +33,8 @@

 # Templates
 /*.yaml
+!/.sops.yaml
+!/.golangci.yaml

 # Generated docs
 /dsl.md
@@ -12,6 +12,7 @@ builds:
    env:
      - CGO_ENABLED=0
      - GOEXPERIMENT=greenteagc
+      - GODEBUG=tlssha1=1
    goos: [windows, linux, darwin]
    goarch: [amd64, '386', arm, arm64]
    ignore:
@@ -0,0 +1,4 @@
+# SOPS Creation Rules for Secret File (ref: https://docs.projectdiscovery.io/tools/nuclei/authenticated-scans)
+
+creation_rules:
+  - encrypted_regex: ^(password|username|token|value|key|raw)$
@@ -81,4 +81,5 @@ Each protocol (HTTP, DNS, Network, etc.) implements:
 - **internal/tests/functional/** - CI-only native functional comparison suite and testcase assets
 - **pkg/fuzz/** - Fuzzing engine and DAST capabilities
 - **pkg/input/** - Input processing for various formats (Burp, OpenAPI, etc.)
- **pkg/reporting/** - Result export and issue tracking integrations
+- **pkg/reporting/** - Result export and issue tracking integrations
+See SECURITY_CONTEXT.md for this repo's known vulnerabilities and recurring weak spots. Check it before writing or reviewing security-sensitive code.
@@ -1,5 +1,5 @@
 # Build
-FROM golang:1.24-alpine AS builder
+FROM golang:1.27-alpine AS builder

 RUN apk add build-base
 WORKDIR /app
@@ -33,8 +33,9 @@ clean:

 go-build: clean
 go-build:
-	CGO_ENABLED=0 $(GOBUILD) -trimpath $(GOFLAGS) -ldflags '${LDFLAGS}' $(GOBUILD_ADDITIONAL_ARGS) \
-		 -o '${GOBUILD_OUTPUT}${GOBUILD_OUTPUT_EXT}' $(GOBUILD_PACKAGES)
+	CGO_ENABLED=0 GOEXPERIMENT=greenteagc GODEBUG=tlssha1=1 $(GOBUILD) \
+		-trimpath $(GOFLAGS) -ldflags '${LDFLAGS}' $(GOBUILD_ADDITIONAL_ARGS) \
+		-o '${GOBUILD_OUTPUT}${GOBUILD_OUTPUT_EXT}' $(GOBUILD_PACKAGES)

 build: GOFLAGS = -pgo=auto
 build: GOBUILD_OUTPUT = ./bin/nuclei
@@ -297,4 +298,4 @@ template-validate:
 	./bin/nuclei -validate \
 		-w workflows \
 		-et http/technologies \
-		-ept code
+		-ept code
@@ -64,11 +64,11 @@

 ### **1. Nuclei CLI**

-_Install Nuclei on your machine. Get started by following the installation guide [**`here`**](https://docs.projectdiscovery.io/tools/nuclei/install?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme). Additionally, We provide [**`a free cloud tier`**](https://cloud.projectdiscovery.io/sign-up) and comes with a generous monthly free limits:_
+_Install Nuclei on your machine. Get started by following the installation guide [**`here`**](https://docs.projectdiscovery.io/tools/nuclei/install?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme). Additionally, we provide [**`a free cloud tier`**](https://cloud.projectdiscovery.io/sign-up) that comes with generous monthly free limits:_

 - Store and visualize your vulnerability findings
- Write and manage your nuclei templates
- Access latest nuclei templates
+- Write and manage your Nuclei templates
+- Access the latest Nuclei templates
 - Discover and store your targets

 > [!Important]
@@ -91,7 +91,7 @@ _For security teams and enterprises, we provide a cloud-hosted service built on
 - We're constantly [**`adding new features`**](https://feedback.projectdiscovery.io/changelog)!
 - **Ideal for:** Pentesters, security teams, and enterprises

-[**`Sign up to Pro`**](https://projectdiscovery.io/pricing?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme) or [**`Talk to our team`**](https://projectdiscovery.io/request-demo?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme) if you have large organization and complex requirements.
+[**`Sign up to Pro`**](https://projectdiscovery.io/pricing?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme) or [**`Talk to our team`**](https://projectdiscovery.io/request-demo?utm_source=github&utm_medium=web&utm_campaign=nuclei_readme) if you have a large organization and complex requirements.

 <br>
 <br>
@@ -147,7 +147,7 @@ TARGET:
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

 TARGET-FORMAT:
-   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
+   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger, http) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file
   -vtt, -vars-text-templating    enable text templating for vars in input file (only for yaml input mode)
@@ -147,7 +147,7 @@ TARGET:
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

 TARGET-FORMAT:
-   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
+   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger, http) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file
   -vtt, -vars-text-templating    enable text templating for vars in input file (only for yaml input mode)
@@ -147,7 +147,7 @@ TARGET:
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

 TARGET-FORMAT:
-   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
+   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger, http) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file
   -vtt, -vars-text-templating    enable text templating for vars in input file (only for yaml input mode)
@@ -147,7 +147,7 @@ TARGET:
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

 TARGET-FORMAT:
-   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
+   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger, http) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file
   -vtt, -vars-text-templating    enable text templating for vars in input file (only for yaml input mode)
@@ -147,7 +147,7 @@ TARGET:
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

 TARGET-FORMAT:
-   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
+   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger, http) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file
   -vtt, -vars-text-templating    enable text templating for vars in input file (only for yaml input mode)
@@ -147,7 +147,7 @@ TARGET:
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

 TARGET-FORMAT:
-   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
+   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger, http) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file
   -vtt, -vars-text-templating    enable text templating for vars in input file (only for yaml input mode)
@@ -147,7 +147,7 @@ TARGET:
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

 TARGET-FORMAT:
-   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
+   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger, http) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file
   -vtt, -vars-text-templating    enable text templating for vars in input file (only for yaml input mode)
@@ -147,7 +147,7 @@ TARGET:
   -iv, -ip-version string[]     IP version to scan of hostname (4,6) - (default 4)

 TARGET-FORMAT:
-   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger) (default "list")
+   -im, -input-mode string        mode of input file (list, burp, jsonl, yaml, openapi, swagger, http) (default "list")
   -ro, -required-only            use only required fields in input format when generating requests
   -sfv, -skip-format-validation  skip format validation (like missing vars) when parsing input file
   -vtt, -vars-text-templating    enable text templating for vars in input file (only for yaml input mode)
@@ -0,0 +1,255 @@
+<!-- Generated by securitycontext.dev. Source HEAD: 3e1e0e81f091c7817bbf7af64bb8eec6e8c2bac1. -->
+# Security Context: projectdiscovery/nuclei @ dev
+
+> Reference context for editing projectdiscovery/nuclei. Before changing any component below, **preserve the listed guards and do not reintroduce these fixed issues**. Each fingerprint is a regression check, and each shared attack surface is a guard that must keep holding on every path.
+
+_Generated 2026-09-01 16:22 UTC by secc_
+
+_Analyzed commit: 3e1e0e81f091c7817bbf7af64bb8eec6e8c2bac1_
+
+**Remediation coverage: 56.7%**
+_17 of 30 historical fixes have no remaining unguarded variant; 368 open remediation leads to verify. Measures fix consistency, not a vulnerability verdict._
+
+- Commits analyzed: **4814**
+- Commits flagged for review: **235**
+- Confirmed historical security fixes: **32**
+- Known published CVEs: **0**
+
+## Summary
+
+Nuclei's historical security posture is dominated by sandbox escapes and code execution via unsigned or unverified templates, with recurring SSRF, path traversal, and auth bypass issues across JS libraries, loaders, and workflow paths. The most critical theme is inconsistent enforcement of signature verification and local-file-access (-lfa) guards across direct, workflow, DAST, and JS-sandbox entry points, enabling variant attacks. A second theme is network policy (host allowlist) gaps in LDAP dialing and proxy handling. The security context also includes dependency upgrades (Alpine, go-git) and output file permission hardening, but the highest-value focus is on template trust boundaries and sandbox enforcement parity.
+
+## Recurring Security Patterns
+
+**15.6% of classified fixes repeat a previously fixed pattern** (5 recurring, 27 first-seen). A recurring pattern means this repository fixed a similar issue before — not that the code is currently vulnerable.
+
+- **Code Execution:** [1c440e755a](https://github.com/projectdiscovery/nuclei/commit/1c440e755a97471c56fb0276ee8a8c4132974645) → [9de96e4dda](https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76) — matched on `class:code execution`, `component:pkg/catalog/loader/loader.go`
+- **Code Execution via Unsigned Template:** [fa56800fcc](https://github.com/projectdiscovery/nuclei/commit/fa56800fcca3c8c8fe8e8dec28584210ca1527de) → [fac0b7196d](https://github.com/projectdiscovery/nuclei/commit/fac0b7196d2fbca56c8af8ff8e1899c111041a37) — matched on `class:code execution via unsigned template`, `CWE-347`, `sink:loadtemplates`
+- **SSRF:** [a167e6c57b](https://github.com/projectdiscovery/nuclei/commit/a167e6c57b80f5dc7be231231b62d7c594ee2770) → [9def9af7e3](https://github.com/projectdiscovery/nuclei/commit/9def9af7e3f7ebcf5cd561c37b623b9999ee7572) — matched on `class:ssrf`, `CWE-918`, `component:pkg/js/libs/ldap/ldap.go`
+- **Dependency Vulnerability:** [d93b4a01df](https://github.com/projectdiscovery/nuclei/commit/d93b4a01df9c218a36dd2fccfb1c2c1f96b181fe) → [fcd5c6b111](https://github.com/projectdiscovery/nuclei/commit/fcd5c6b111ddcb746525f88b7d0bf4b4abbc2529) — matched on `class:dependency vulnerability`, `CWE-1104`, `component:dockerfile`
+- **Sandbox Escape:** [96049a32fa](https://github.com/projectdiscovery/nuclei/commit/96049a32fa70aef0483d4180d386a57b3c2d973a) → [cf2a98b03d](https://github.com/projectdiscovery/nuclei/commit/cf2a98b03d76327c20fb0183b7f1c849eb692c91) — matched on `class:sandbox escape`, `CWE-284`, `component:v2/internal/runner/processor.go`, `sink:stdlib allmodulenames`, `sink:stdlib getmodulemap`
+
+## Top Risks
+
+### 1. Sandbox Escape: `pkg/js/compiler/pool.go, v2/pkg/protocols/javascript/js.go, v2/pkg/protocols/headless/engine/engine.go, v2/internal/runner/processor.go` (high)
+
+Multiple sandbox escapes across JS require(), eval/ReadFile, headless browser flags, and tengo imports, indicating weak default sandbox boundaries that require consistent -lfa and safe-module enforcement.
+
+Evidence: 6f2ade6a9b427c284c15a43445f9c7f055e60e5d, c35162c8ef061a96dd74b54c8f022c1a41cf5833, df55f7a2eb591a7949b5c66a9c54db54aa28f450, cf2a98b03d76327c20fb0183b7f1c849eb692c91, 96049a32fa70aef0483d4180d386a57b3c2d973a
+
+### 2. Code Execution via Unsigned Template: `pkg/catalog/loader/loader.go, pkg/templates/workflows.go, pkg/templates/templates.go` (critical)
+
+Unsigned templates can execute code through direct loading, workflows, and DAST branches; signature verification was bypassed via cache poisoning and missing guards on specific paths.
+
+Evidence: 9de96e4dda5a03da963b9ae6582f03ea55791a76, 1c440e755a97471c56fb0276ee8a8c4132974645, fac0b7196d2fbca56c8af8ff8e1899c111041a37, e86f38299765b82ad724fdb701557e0eaff3884d, fa56800fcca3c8c8fe8e8dec28584210ca1527de
+
+### 3. Auth Bypass: `pkg/templates/compile.go, pkg/templates/signer/tmpl_signer.go, pkg/catalog/loader/loader.go, pkg/protocols/http/request.go` (high)
+
+Signature verification can be bypassed via cached metadata, improper signature extraction, or missing checks on specific load paths, and cookie jar bypass via disabled cookie handling.
+
+Evidence: 4534e9cb3034ebe5cc7b0cecabe399b6fb9ce0e4, 0da993afe6d41b4b1b814e8fad23a2acba13c60a, 9bd4db3f74aedd067af568df4f9198a8a090f68b, a976ca8d3f6a18c9ca746c8ce73f28fdcd518642
+
+### 4. SSRF: `pkg/js/libs/ldap/ldap.go, v2/internal/runner/proxy.go` (high)
+
+SSRF via LDAP dialing to internal hosts and via proxy configuration; host allowlist checks were missing or applied to the wrong target (domain vs controller).
+
+Evidence: 9def9af7e3f7ebcf5cd561c37b623b9999ee7572, a167e6c57b80f5dc7be231231b62d7c594ee2770, 0e46d3e0410f89e4af41099f5cd38fa7f54ae54f
+
+### 5. Path Traversal: `pkg/catalog/config/nucleiconfig.go, v2/internal/runner/update.go, v2/pkg/protocols/common/protocolstate/headless.go` (high)
+
+Path traversal via lexical prefix checks, zip-slip in template extraction, and file:// scheme in headless mode; canonicalization and containment checks are required.
+
+Evidence: 20cbf0bd73893c1270582c9778b6b26a5cb11206, f9c214a66f37a00fc29fe64232b690e6285ec59c, d3928e080d819f25306bfbaecc399f03516db5aa
+
+### 6. Code Execution: `pkg/catalog/loader/loader.go, pkg/templates/workflows.go` (high)
+
+Code execution via cache poisoning and unverified code templates in workflows; requires -code flag and verified templates.
+
+Evidence: 9de96e4dda5a03da963b9ae6582f03ea55791a76, e86f38299765b82ad724fdb701557e0eaff3884d
+
+## Shared Attack Surfaces
+
+Capabilities guarded by more than one past fix on different code paths. A guard enforced on one entry point is often missing on a sibling; verify each alternate path before assuming it's covered.
+
+### 1. Template signature verification and unsigned-template opt-in enforcement across all load paths
+
+- Guard that should hold everywhere: signature verification (template.Verified, Verify), DisableUnsignedTemplates flag, -code flag for code templates, cache invalidation on verification status/fingerprint/digest
+- Entry points: `pkg/catalog/loader/loader.go (LoadTemplatesWithTags, DAST branch)`, `pkg/templates/workflows.go (loadTemplates, workflowExecutor)`, `pkg/templates/templates.go (loadTemplates)`, `pkg/templates/compile.go (template.Verified)`, `pkg/templates/signer/tmpl_signer.go (Verify)`
+- Check: Inspect the DAST and workflow sub-loaders: they must enforce the same DisableUnsignedTemplates and -code checks as the direct loader, and must not rely on cached verification results without re-checking signatures.
+- Evidence: 9de96e4dda5a03da963b9ae6582f03ea55791a76, 1c440e755a97471c56fb0276ee8a8c4132974645, fac0b7196d2fbca56c8af8ff8e1899c111041a37, e86f38299765b82ad724fdb701557e0eaff3884d, fa56800fcca3c8c8fe8e8dec28584210ca1527de, 4534e9cb3034ebe5cc7b0cecabe399b6fb9ce0e4, 0da993afe6d41b4b1b814e8fad23a2acba13c60a, 9bd4db3f74aedd067af568df4f9198a8a090f68b
+
+### 2. Local file access (read/write) outside the sandbox, gated by -lfa flag
+
+- Guard that should hold everywhere: -lfa flag enforcement, path canonicalization and containment (sandbox directory), file:// scheme blocking, allowAllFiles stripping, require() registry rebuild
+- Entry points: `pkg/js/libs/krbforge/krbforge.go (CreateTicket)`, `pkg/js/libs/mysql/mysql_private.go (sql.Open)`, `pkg/js/compiler/pool.go (require)`, `v2/pkg/protocols/javascript/js.go (ReadFile, eval)`, `v2/pkg/protocols/common/protocolstate/headless.go (file:)`, `v2/pkg/protocols/common/generators/load.go (loadPayloadsFromFile)`
+- Check: Verify that every JS library and protocol helper (krbforge, mysql, require, headless file://, payload loaders) enforces the -lfa flag and path containment; a sibling path that skips the -lfa check is a sandbox escape.
+- Evidence: 3a8b65cb45f121fcdf418f60e5177ed9f250c122, 9611926a9a1ca99e8ed554d1b26fbeff60e06368, 6f2ade6a9b427c284c15a43445f9c7f055e60e5d, c35162c8ef061a96dd74b54c8f022c1a41cf5833, d3928e080d819f25306bfbaecc399f03516db5aa, e7fb40a41308f6c41267e858d1781eb67f7e0572
+
+### 3. Network policy (host allowlist) enforcement before outbound connections
+
+- Guard that should hold everywhere: IsHostAllowed check on the actual target host (controller, not domain), proxy validation and connectivity check, ProxyInternal gate for HTTP_PROXY env
+- Entry points: `pkg/js/libs/ldap/ldap.go (Dial, newLdapSession)`, `v2/internal/runner/proxy.go (loadProxyServers, os.Setenv HTTP_PROXY)`
+- Check: Inspect other dialing paths (e.g., HTTP, headless) to ensure they apply the same host allowlist check on the resolved IP/host, not just a user-supplied domain, and that proxy settings cannot redirect traffic to internal hosts.
+- Evidence: 9def9af7e3f7ebcf5cd561c37b623b9999ee7572, a167e6c57b80f5dc7be231231b62d7c594ee2770, 0e46d3e0410f89e4af41099f5cd38fa7f54ae54f, 3f5c055aca1499642caf4f40e8cf55ad32bd4da9
+
+### 4. Path traversal in file extraction and template path trust boundaries
+
+- Guard that should hold everywhere: canonical path containment check (filepath.Rel, prefix), zip-slip validation against template directory, sandbox path prefix validation
+- Entry points: `pkg/catalog/config/nucleiconfig.go (IsCustomTemplate)`, `v2/internal/runner/update.go (os.OpenFile)`, `v2/pkg/protocols/common/generators/load.go (loadPayloadsFromFile)`
+- Check: Audit all file-write and file-read paths that accept template-controlled paths (e.g., template extraction, payload loading) to ensure they use canonical containment, not lexical prefix checks, and apply the same sandbox directory restriction.
+- Evidence: 20cbf0bd73893c1270582c9778b6b26a5cb11206, f9c214a66f37a00fc29fe64232b690e6285ec59c, e7fb40a41308f6c41267e858d1781eb67f7e0572
+
+## Historical Vulnerability Classes
+
+| Class | Count |
+|---|---|
+| Sandbox Escape | 7 |
+| Auth Bypass | 4 |
+| Code Execution | 3 |
+| Dependency Vulnerability | 3 |
+| Path Traversal | 3 |
+| SSRF | 3 |
+| Code Execution via Unsigned Template | 2 |
+| Arbitrary File Read | 1 |
+| Cryptographic Weakness | 1 |
+| Deserialization of Untrusted Data | 1 |
+| Information Disclosure | 1 |
+| Insecure File Permissions | 1 |
+| Race Condition | 1 |
+| Security Misconfiguration | 1 |
+
+## Fixed-Issue Fingerprints
+
+These are real security fixes mined from git history. Use them as regression checks.
+
+- **Auth Bypass** (high) [CWE-287]: Honors disable-cookie by preventing the shared cookie jar from being applied when cookie handling is disabled, closing a path where cookies could be reused across requests.
+  - sink: `SetCookieJar(input.CookieJar)`
+  - fix: Adds !request.DisableCookie check before applying shared cookie jar
+  - commit: https://github.com/projectdiscovery/nuclei/commit/a976ca8d3f6a18c9ca746c8ce73f28fdcd518642 (2026-08-25)
+- **Code Execution** (high) [CWE-347]: This commit fixes a cache poisoning vulnerability where unsigned templates could bypass signature verification and execute malicious code during compilation or request execution.
+  - sink: `template compilation and execution of JavaScript`
+  - fix: cache invalidation based on verification status, verifier fingerprint, and content digest
+  - commit: https://github.com/projectdiscovery/nuclei/commit/9de96e4dda5a03da963b9ae6582f03ea55791a76 (2026-08-04)
+- **Code Execution via Unsigned Template** (high) [CWE-347]: Enforces signature verification on JavaScript templates, preventing execution of unsigned templates that could lead to arbitrary code execution.
+  - sink: `loading unsigned javascript templates into execution paths`
+  - fix: Require signature verification for javascript templates in direct loading and workflows when signing is enforced
+  - commit: https://github.com/projectdiscovery/nuclei/commit/fac0b7196d2fbca56c8af8ff8e1899c111041a37 (2026-07-03)
+- **Sandbox Escape** (high) [CWE-22]: Enforces nuclei's local file access policy on krbforge output paths, preventing arbitrary file writes outside the sandbox.
+  - sink: `gpkrb.CreateTicket(cfg) with cfg.OutputFile`
+  - fix: Path normalization into sandbox and denial of outside paths unless -lfa
+  - commit: https://github.com/projectdiscovery/nuclei/commit/3a8b65cb45f121fcdf418f60e5177ed9f250c122 (2026-06-24)
+- **SSRF** (high) [CWE-918]: Adds network policy host allowlist checks before LDAP dialing, preventing SSRF to restricted internal hosts.
+  - sink: `dialers.Fastdialer.Dial`
+  - fix: host allowlist check via IsHostAllowed before dialing
+  - commit: https://github.com/projectdiscovery/nuclei/commit/9def9af7e3f7ebcf5cd561c37b623b9999ee7572 (2026-06-24)
+- **Arbitrary File Read** (high) [CWE-22]: Gates MySQL's allowAllFiles option behind the -lfa flag, preventing arbitrary local file reads via LOAD DATA LOCAL INFILE.
+  - sink: `sql.Open("mysql", dsn) with AllowAllFiles=true`
+  - fix: DSN sandbox that strips allowAllFiles unless -lfa is set
+  - commit: https://github.com/projectdiscovery/nuclei/commit/9611926a9a1ca99e8ed554d1b26fbeff60e06368 (2026-06-19)
+- **Code Execution** (critical) [CWE-94]: Moves the unsigned code-template guard ahead of the DAST branch, preventing unsigned code templates from being loaded and executed under DAST, which previously bypassed the signature check.
+  - sink: `Template loading and execution`
+  - fix: Hoisting unsigned code-template guard before DAST branch to ensure it applies on all load paths
+  - commit: https://github.com/projectdiscovery/nuclei/commit/1c440e755a97471c56fb0276ee8a8c4132974645 (2026-06-19)
+- **Path Traversal** (high) [CWE-22]: This commit replaces lexical prefix checks with canonical path containment checks across multiple filesystem trust boundaries, preventing path traversal where sibling paths were incorrectly treated as trusted.
+  - sink: `IsCustomTemplate`
+  - fix: path canonicalization and containment check
+  - commit: https://github.com/projectdiscovery/nuclei/commit/20cbf0bd73893c1270582c9778b6b26a5cb11206 (2026-06-04)
+- **Information Disclosure** (medium) [CWE-200]: This commit fixes a data leakage issue in workflows where sibling state could leak across concurrent executions, and race requests ignored dynamic values, by syncing context and cloning inputs.
+  - sink: `syncWorkflowInputToTemplateCtx`
+  - fix: context synchronization and input cloning
+  - commit: https://github.com/projectdiscovery/nuclei/commit/805bcfe76f3629dbe71021795d4ce865406c1555 (2026-05-08)
+- **Sandbox Escape** (high) [CWE-284]: Fixes sandbox escape where require() bypassed local file access restrictions and reused privileged module cache across executions.
+  - sink: `require() using default host filesystem loader`
+  - fix: Rebuild require registry per execution and enforce allow-local-file-access sandbox rules
+  - commit: https://github.com/projectdiscovery/nuclei/commit/6f2ade6a9b427c284c15a43445f9c7f055e60e5d (2026-04-10)
+- **Cryptographic Weakness** (medium) [CWE-338]: Replaces predictable math/rand PRNG with cryptographically secure crypto/rand in JS helper functions.
+  - sink: `rand.Intn(255) / rand.Int63()`
+  - fix: Replace predictable math/rand with crypto/rand
+  - commit: https://github.com/projectdiscovery/nuclei/commit/44ef9ce34ffcfdfca3a96626abc73d99dd0e83ab (2026-03-15)
+- **Auth Bypass** (high) [CWE-347]: Caching signature verification results without cryptographic re-check allows a metadata index compromise to bypass template signature verification.
+  - sink: `template.Verified, template.TemplateVerifier`
+  - fix: cached verification data reuse
+  - commit: https://github.com/projectdiscovery/nuclei/commit/4534e9cb3034ebe5cc7b0cecabe399b6fb9ce0e4 (2026-01-21)
+- **Race Condition** (medium) [CWE-362]: Fixes a race condition in workflow execution caused by shared context callbacks, which could lead to data corruption or crashes; the primary impact is reliability, not a direct security breach.
+  - sink: `shared context callbacks in workflow execution`
+  - fix: fix race condition by making workflow execution sequential
+  - commit: https://github.com/projectdiscovery/nuclei/commit/24d1f58682027e23cb21a299a170abd2bdf20dc2 (2025-12-05)
+- **Auth Bypass** (high) [CWE-347]: Fixes template signature verification by centralizing signature extraction and requiring the signature to be at the end of the template, preventing bypass.
+  - sink: `Verify`
+  - fix: signature extraction and verification
+  - commit: https://github.com/projectdiscovery/nuclei/commit/0da993afe6d41b4b1b814e8fad23a2acba13c60a (2024-08-19)
+- **Dependency Vulnerability** (medium) [CWE-1104]: Upgrades Alpine base image from 3.18.5 to 3.18.6 to fix known security vulnerabilities in bundled packages.
+  - sink: `FROM alpine:3.18.5`
+  - fix: Upgrade base image to patched version
+  - commit: https://github.com/projectdiscovery/nuclei/commit/fcd5c6b111ddcb746525f88b7d0bf4b4abbc2529 (2024-03-15)
+- **Dependency Vulnerability** (medium) [CWE-1104]: Upgrades Alpine base image from 3.18.2 to 3.18.5 to fix known security vulnerabilities in bundled packages.
+  - sink: `FROM alpine:3.18.2`
+  - fix: Upgrade base image to patched version
+  - commit: https://github.com/projectdiscovery/nuclei/commit/d93b4a01df9c218a36dd2fccfb1c2c1f96b181fe (2024-03-15)
+- **Dependency Vulnerability** (high) [CWE-1035]: Updates go-git to fix known vulnerabilities (CVE-2023-49569, CVE-2023-49568), which could be exploited when processing untrusted git data.
+  - sink: `go-git library usage`
+  - fix: dependency upgrade to patched version
+  - commit: https://github.com/projectdiscovery/nuclei/commit/1700cdf4e23128a358066364062246b58c1c013f (2024-03-14)
+- **Code Execution via Unsigned Template** (high) [CWE-347]: Introduces a flag to disable unsigned templates, preventing execution of unverified templates that could lead to arbitrary code execution.
+  - sink: `loading unsigned templates when -dut flag is set`
+  - fix: Adds -disable-unsigned-templates flag to skip unsigned templates and report them separately
+  - commit: https://github.com/projectdiscovery/nuclei/commit/fa56800fcca3c8c8fe8e8dec28584210ca1527de (2024-03-14)
+- **Auth Bypass** (medium) [CWE-347]: This commit introduces a flag to skip unsigned templates, closing a path where an attacker could execute untrusted templates by bypassing signature verification.
+  - sink: `parsed.Verified`
+  - fix: skip unverified templates when DisableUnsignedTemplates is set
+  - commit: https://github.com/projectdiscovery/nuclei/commit/9bd4db3f74aedd067af568df4f9198a8a090f68b (2024-03-10)
+- **Code Execution** (high) [CWE-94]: Prevents execution of unverified code templates in workflows, mitigating code execution risk.
+  - sink: `template.RequestsCode`
+  - fix: require -code flag and verified templates for code templates in workflows
+  - commit: https://github.com/projectdiscovery/nuclei/commit/e86f38299765b82ad724fdb701557e0eaff3884d (2024-03-01)
+- **SSRF** (high) [CWE-918]: Fixes SSRF by validating the actual LDAP controller host against the network policy instead of the domain name.
+  - sink: `newLdapSession`
+  - fix: host allowlist check on controller instead of domain
+  - commit: https://github.com/projectdiscovery/nuclei/commit/a167e6c57b80f5dc7be231231b62d7c594ee2770 (2024-01-20)
+- **Sandbox Escape** (high) [CWE-94]: Disables eval and tightens file read validation in the JavaScript sandbox, preventing template-driven code execution and file access outside the sandbox.
+  - sink: `eval function and file read in sandbox mode`
+  - fix: Disable eval function and rewrite file validation in sandbox mode
+  - commit: https://github.com/projectdiscovery/nuclei/commit/c35162c8ef061a96dd74b54c8f022c1a41cf5833 (2023-10-13)
+- **Path Traversal** (high) [CWE-22]: Adds network policy and blocks file:// protocol in headless mode unless -lfa is set, preventing local file disclosure.
+  - sink: `file:// protocol access in headless browser`
+  - fix: Network policy validation and file:// scheme blocking when local file access is disabled
+  - commit: https://github.com/projectdiscovery/nuclei/commit/d3928e080d819f25306bfbaecc399f03516db5aa (2023-08-25)
+- **Deserialization of Untrusted Data** (medium) [CWE-502]: Fixes JSON deserialization by adding explicit UnmarshalJSON methods and correcting tags, preventing type confusion and potential logic bypasses.
+  - sink: `UnmarshalJSON on user-controlled fields like Type and Name`
+  - fix: Adds proper UnmarshalJSON implementations and corrects json tags to prevent type confusion
+  - commit: https://github.com/projectdiscovery/nuclei/commit/85090b75317977bb9301444c9dfd8e4c2dba667a (2023-02-07)
+- **Sandbox Escape** (medium) [CWE-22]: The commit adds sandbox mode that restricts payload file paths to the template directory, preventing arbitrary file reads when sandbox is enabled.
+  - sink: `loadPayloadsFromFile`
+  - fix: path prefix validation against template directory and template path directory
+  - commit: https://github.com/projectdiscovery/nuclei/commit/e7fb40a41308f6c41267e858d1781eb67f7e0572 (2022-11-16)
+- **Insecure File Permissions** (low) [CWE-732]: Fixes overly permissive file permissions on debug output files by changing from os.ModePerm (0777) to 0644.
+  - sink: `os.OpenFile`
+  - fix: restrict file mode to 0644
+  - commit: https://github.com/projectdiscovery/nuclei/commit/af4854f90de728bb08689d5cae3dec4acfdb6b9a (2022-06-20)
+- **Security Misconfiguration** (medium) [CWE-16]: Prevents setting HTTP_PROXY environment variable unless explicitly enabled, avoiding potential proxy hijacking.
+  - sink: `os.Setenv(types.HTTP_PROXY_ENV, proxyURL.String())`
+  - fix: Added check for options.ProxyInternal before setting HTTP_PROXY environment variable
+  - commit: https://github.com/projectdiscovery/nuclei/commit/3f5c055aca1499642caf4f40e8cf55ad32bd4da9 (2022-03-09)
+- **Sandbox Escape** (high) [CWE-250]: The commit restricts the use of the --no-sandbox flag to Linux root users, preventing sandbox escape vulnerabilities in other environments.
+  - sink: `NoSandbox(true)`
+  - fix: Conditionally disable sandbox only on Linux as root
+  - commit: https://github.com/projectdiscovery/nuclei/commit/df55f7a2eb591a7949b5c66a9c54db54aa28f450 (2021-12-05)
+- **Path Traversal** (high) [CWE-22]: This commit fixes a zip-slip path traversal vulnerability by validating the extracted file path against the configured template directory.
+  - sink: `os.OpenFile`
+  - fix: path canonicalization and prefix check
+  - commit: https://github.com/projectdiscovery/nuclei/commit/f9c214a66f37a00fc29fe64232b690e6285ec59c (2021-11-25)
+- **SSRF** (high) [CWE-918]: Adds validation and connectivity checks for SOCKS5 proxies before launching a scan, preventing SSRF through proxy configuration.
+  - sink: `Proxy connection validation and loading`
+  - fix: Proxy server validation and connectivity check before scan launch
+  - commit: https://github.com/projectdiscovery/nuclei/commit/0e46d3e0410f89e4af41099f5cd38fa7f54ae54f (2021-11-10)
+- **Sandbox Escape** (high) [CWE-284]: This commit adds a sandbox flag that, when enabled, restricts the tengo scripting engine to safe modules, preventing sandbox escape and arbitrary command execution.
+  - sink: `stdlib.GetModuleMap(stdlib.AllModuleNames()...)`
+  - fix: Added sandbox flag to restrict imports to safe modules when sandbox is enabled
+  - commit: https://github.com/projectdiscovery/nuclei/commit/cf2a98b03d76327c20fb0183b7f1c849eb692c91 (2020-12-13)
+- **Sandbox Escape** (high) [CWE-284]: This commit restricts the tengo scripting engine to a safe module list, preventing sandbox escape and arbitrary command execution via workflow templates.
+  - sink: `stdlib.GetModuleMap(stdlib.AllModuleNames()...)`
+  - fix: Restricted tengo script imports to a safe module list
+  - commit: https://github.com/projectdiscovery/nuclei/commit/96049a32fa70aef0483d4180d386a57b3c2d973a (2020-12-13)
+
+---
+_Fixed-issue fingerprints and CVE matches are derived from real data; LLM-written prose is advisory and should be verified against the cited commits._
@@ -1477,6 +1477,19 @@ DisableCookie is an optional setting that disables cookie reuse

 <div class="dd">

+<code>disable-http-cache</code>  <i>bool</i>
+
+</div>
+<div class="dt">
+
+DisableHTTPCache turns off HTTP caching for this request. It cannot turn caching on when -http-cache is unset.
+
+</div>
+
+<hr />
+
+<div class="dd">
+
 <code>read-all</code>  <i>bool</i>

 </div>
@@ -0,0 +1,72 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/adrg/xdg"
+	"github.com/projectdiscovery/goflags"
+	"github.com/projectdiscovery/gologger"
+	"github.com/projectdiscovery/nuclei/v3/internal/configuration"
+	catalogconfig "github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+)
+
+func TestAuthValueIsCLIOnly(t *testing.T) {
+	oldConfigHome := xdg.ConfigHome
+	oldConfigDirs := xdg.ConfigDirs
+	t.Cleanup(func() {
+		xdg.ConfigHome = oldConfigHome
+		xdg.ConfigDirs = oldConfigDirs
+	})
+
+	const apiKey = "12345678-1234-1234-1234-123456789012"
+	tests := []struct {
+		name string
+		args func(string) []string
+		file string
+		want string
+	}{
+		{name: "explicit config", args: func(path string) []string { return []string{"-config=" + path} }, file: "auth: true\n"},
+		{name: "profile", args: func(path string) []string { return []string{"-profile=" + path} }, file: "auth: " + apiKey + "\n"},
+		{name: "CLI", args: func(string) []string { return []string{"-auth=" + apiKey} }, want: apiKey},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			dir := t.TempDir()
+			xdg.ConfigHome = filepath.Join(dir, "config-home")
+			xdg.ConfigDirs = nil
+
+			selectedPath := filepath.Join(dir, "selected.yaml")
+			if test.file != "" {
+				if err := os.WriteFile(selectedPath, []byte(test.file), 0o600); err != nil {
+					t.Fatalf("write selected configuration: %v", err)
+				}
+			}
+
+			var auth string
+			var selected configuration.Selection
+			flagSet := goflags.NewFlagSet()
+			flagSet.DynamicVar(&auth, "auth", "true", "")
+			flagSet.StringVar(&selected.Config, "config", "", "")
+			flagSet.StringVar(&selected.Profile, "profile", "", "")
+
+			cfg := &catalogconfig.Config{Logger: gologger.DefaultLogger}
+			cfg.SetConfigDir(filepath.Join(xdg.ConfigHome, catalogconfig.BinaryName))
+			warnings, err := configuration.Load(cfg, flagSet, &selected, func(path string) (string, error) {
+				return path, nil
+			}, test.args(selectedPath)...)
+			if err != nil {
+				t.Fatalf("load configuration: %v", err)
+			}
+			if len(warnings) != 0 {
+				t.Fatalf("configuration warnings: %v", warnings)
+			}
+
+			if got := cliOnlyDynamicValue(flagSet, "auth", auth); got != test.want {
+				t.Fatalf("auth value = %q, want %q", got, test.want)
+			}
+		})
+	}
+}
@@ -2,6 +2,7 @@ package main

 import (
 	"bufio"
+	"flag"
 	"fmt"
 	"io/fs"
 	"os"
@@ -11,11 +12,11 @@ import (
 	"runtime/pprof"
 	"runtime/trace"
 	"strings"
+	"sync"
 	"time"

 	"github.com/projectdiscovery/gologger"
 	_pdcp "github.com/projectdiscovery/nuclei/v3/internal/pdcp"
-	"github.com/projectdiscovery/nuclei/v3/pkg/utils/yaml"
 	"github.com/projectdiscovery/utils/auth/pdcp"
 	"github.com/projectdiscovery/utils/env"
 	_ "github.com/projectdiscovery/utils/pprof"
@@ -25,6 +26,7 @@ import (
 	"github.com/projectdiscovery/goflags"
 	"github.com/projectdiscovery/gologger/levels"
 	"github.com/projectdiscovery/interactsh/pkg/client"
+	"github.com/projectdiscovery/nuclei/v3/internal/configuration"
 	"github.com/projectdiscovery/nuclei/v3/internal/runner"
 	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/provider"
@@ -47,27 +49,22 @@ import (
 )

 var (
-	cfgFile                string
-	templateProfile        string
-	memProfile             string // optional profile file path
-	options                = &types.Options{}
-	inlineSecretsTempFiles []string
+	memProfile           string // optional profile file path
+	options              = &types.Options{}
+	inlineSecretsTempDir string
+	inlineSecretsTempMu  sync.Mutex
 )

 func main() {
 	options.Logger = gologger.DefaultLogger

-	defer func() {
-		for _, f := range inlineSecretsTempFiles {
-			_ = os.Remove(f)
-		}
-	}()
+	defer cleanupInlineSecretsDirs()

 	// enables CLI specific configs mostly interactive behavior
 	config.CurrentAppMode = config.AppModeCLI

 	if err := runner.ConfigureOptions(); err != nil {
-		options.Logger.Fatal().Msgf("Could not initialize options: %s\n", err)
+		fatalf("Could not initialize options: %s\n", err)
 	}
 	_ = readConfig()

@@ -83,7 +80,7 @@ func main() {
 		templates.UseOptionsForSigner(options)
 		tsigner, err := signer.NewTemplateSigner(nil, nil) // will read from env , config or generate new keys
 		if err != nil {
-			options.Logger.Fatal().Msgf("couldn't initialize signer crypto engine: %s\n", err)
+			fatalf("Could not initialize signer crypto engine: %s\n", err)
 		}

 		successCounter := 0
@@ -122,7 +119,7 @@ func main() {
 		createProfileFile := func(ext, profileType string) *os.File {
 			f, err := os.Create(memProfile + ext)
 			if err != nil {
-				options.Logger.Fatal().Msgf("profile: could not create %s profile %q file: %v", profileType, f.Name(), err)
+				fatalf("profile: could not create %s profile %q file: %v", profileType, memProfile+ext, err)
 			}
 			return f
 		}
@@ -136,18 +133,18 @@ func main() {

 		// Start tracing
 		if err := trace.Start(traceFile); err != nil {
-			options.Logger.Fatal().Msgf("profile: could not start trace: %v", err)
+			fatalf("profile: could not start trace: %v", err)
 		}

 		// Start CPU profiling
 		if err := pprof.StartCPUProfile(cpuProfileFile); err != nil {
-			options.Logger.Fatal().Msgf("profile: could not start CPU profile: %v", err)
+			fatalf("profile: could not start CPU profile: %v", err)
 		}

 		defer func() {
 			// Start heap memory snapshot
 			if err := pprof.WriteHeapProfile(memProfileFile); err != nil {
-				options.Logger.Fatal().Msgf("profile: could not write memory profile: %v", err)
+				fatalf("profile: could not write memory profile: %v", err)
 			}

 			pprof.StopCPUProfile()
@@ -169,14 +166,14 @@ func main() {

 	if options.ScanUploadFile != "" {
 		if err := runner.UploadResultsToCloud(options); err != nil {
-			options.Logger.Fatal().Msgf("could not upload scan results to cloud dashboard: %s\n", err)
+			fatalf("Could not upload scan results to cloud dashboard: %s\n", err)
 		}
 		return
 	}

 	nucleiRunner, err := runner.New(options)
 	if err != nil {
-		options.Logger.Fatal().Msgf("Could not create runner: %s\n", err)
+		fatalf("Could not create runner: %s\n", err)
 	}
 	if nucleiRunner == nil {
 		return
@@ -187,7 +184,7 @@ func main() {
 		cancel := stackMonitor.Start(10 * time.Second)
 		defer cancel()
 		stackMonitor.RegisterCallback(func(dumpID string) error {
-			resumeFileName := fmt.Sprintf("crash-resume-file-%s.dump", dumpID)
+			resumeFileName := types.DefaultCrashResumeFilePath(dumpID)
 			if options.EnableCloudUpload {
 				options.Logger.Info().Msgf("Uploading scan results to cloud...")
 			}
@@ -213,6 +210,7 @@ func main() {
 		options.Logger.Info().Msgf("CTRL+C pressed: Exiting\n")
 		if options.DASTServer {
 			nucleiRunner.Close()
+			cleanupInlineSecretsDirs()
 			os.Exit(1)
 		}

@@ -228,17 +226,15 @@ func main() {
 				options.Logger.Error().Msgf("Couldn't create resume file: %s\n", err)
 			}
 		}
-		for _, f := range inlineSecretsTempFiles {
-			_ = os.Remove(f)
-		}
+		cleanupInlineSecretsDirs()
 		os.Exit(1)
 	}()

 	if err := nucleiRunner.RunEnumeration(); err != nil {
 		if options.Validate {
-			options.Logger.Fatal().Msgf("Could not validate templates: %s\n", err)
+			fatalf("Could not validate templates: %s\n", err)
 		} else {
-			options.Logger.Fatal().Msgf("Could not run nuclei: %s\n", err)
+			fatalf("Could not run nuclei: %s\n", err)
 		}
 	}
 	nucleiRunner.Close()
@@ -249,10 +245,12 @@ func main() {
 }

 func readConfig() *goflags.FlagSet {
-
+	var selectedFiles configuration.Selection
 	// when true updates nuclei binary to latest version
 	var updateNucleiBinary bool
-	var pdcpauth string
+	var disableUpdateCheck bool
+	var resetRequested bool
+	var pdcpAuth string
 	var fuzzFlag bool

 	flagSet := goflags.NewFlagSet()
@@ -348,8 +346,8 @@ on extensive configurability, massive extensibility and ease of use.`)
 	)

 	flagSet.CreateGroup("configs", "Configurations",
-		flagSet.StringVar(&cfgFile, "config", "", "path to the nuclei configuration file"),
-		flagSet.StringVarP(&templateProfile, "profile", "tp", "", "template profile config file to run"),
+		flagSet.StringVar(&selectedFiles.Config, "config", "", "path to the nuclei configuration file"),
+		flagSet.StringVarP(&selectedFiles.Profile, "profile", "tp", "", "template profile config file to run"),
 		flagSet.BoolVarP(&options.ListTemplateProfiles, "profile-list", "tpl", false, "list community template profiles"),
 		flagSet.BoolVarP(&options.FollowRedirects, "follow-redirects", "fr", false, "enable following redirects for http templates"),
 		flagSet.BoolVarP(&options.FollowHostRedirects, "follow-host-redirects", "fhr", false, "follow redirects on the same host"),
@@ -378,7 +376,7 @@ on extensive configurability, massive extensibility and ease of use.`)
 		flagSet.StringVarP(&options.SourceIP, "source-ip", "sip", "", "source ip address to use for network scan"),
 		flagSet.IntVarP(&options.ResponseReadSize, "response-size-read", "rsr", 0, "max response size to read in bytes"),
 		flagSet.IntVarP(&options.ResponseSaveSize, "response-size-save", "rss", unitutils.Mega, "max response size to read in bytes"),
-		flagSet.CallbackVar(resetCallback, "reset", "reset removes all nuclei configuration and data files (including nuclei-templates)"),
+		flagSet.CallbackVar(func() { resetRequested = true }, "reset", "reset removes all nuclei configuration and data files (including nuclei-templates)"),
 		flagSet.BoolVarP(&options.TlsImpersonate, "tls-impersonate", "tlsi", false, "enable experimental client hello (ja3) tls randomization"),
 		flagSet.StringVarP(&options.HttpApiEndpoint, "http-api-endpoint", "hae", "", "experimental http api endpoint"),
 	)
@@ -452,6 +450,7 @@ on extensive configurability, massive extensibility and ease of use.`)
 		flagSet.BoolVarP(&options.DisableHTTPProbe, "no-httpx", "nh", false, "disable httpx probing for non-url input"),
 		flagSet.BoolVar(&options.PreflightPortScan, "preflight-portscan", false, "run preflight resolve + TCP portscan and filter targets before scanning (disabled by default)"),
 		flagSet.BoolVar(&options.DisableStdin, "no-stdin", false, "disable stdin processing"),
+		flagSet.BoolVar(&options.EnableHTTPCache, "http-cache", false, "enable HTTP cache (RFC 9111) for HTTP requests"),
 	)

 	flagSet.CreateGroup("headless", "Headless",
@@ -489,7 +488,7 @@ on extensive configurability, massive extensibility and ease of use.`)
 		flagSet.BoolVarP(&updateNucleiBinary, "update", "up", false, "update nuclei engine to the latest released version"),
 		flagSet.BoolVarP(&options.UpdateTemplates, "update-templates", "ut", false, "update nuclei-templates to latest released version"),
 		flagSet.StringVarP(&options.NewTemplatesDirectory, "update-template-dir", "ud", "", "custom directory to install / update nuclei-templates"),
-		flagSet.CallbackVarP(disableUpdatesCallback, "disable-update-check", "duc", "disable automatic nuclei/templates update check"),
+		flagSet.BoolVarP(&disableUpdateCheck, "disable-update-check", "duc", false, "disable automatic nuclei/templates update check"),
 	)

 	flagSet.CreateGroup("Honeypot", "Honeypot",
@@ -507,7 +506,7 @@ on extensive configurability, massive extensibility and ease of use.`)
 	)

 	flagSet.CreateGroup("cloud", "Cloud",
-		flagSet.DynamicVar(&pdcpauth, "auth", "true", "configure projectdiscovery cloud (pdcp) api key"),
+		flagSet.DynamicVar(&pdcpAuth, "auth", "true", "configure projectdiscovery cloud (pdcp) api key"),
 		flagSet.StringVarP(&options.TeamID, "team-id", "tid", _pdcp.TeamIDEnv, "upload scan results to given team id (optional)"),
 		flagSet.BoolVarP(&options.EnableCloudUpload, "cloud-upload", "cup", false, "upload scan results to pdcp dashboard [DEPRECATED use -dashboard]"),
 		flagSet.StringVarP(&options.ScanID, "scan-id", "sid", "", "upload scan results to existing scan id (optional)"),
@@ -540,12 +539,32 @@ Run nuclei with sorted Markdown outputs (with environment variables):
 Additional documentation is available at: https://docs.nuclei.sh/getting-started/running
 	`)

-	// nuclei has multiple migrations
-	// ex: resume.cfg moved to platform standard cache dir from config dir
-	// ex: config.yaml moved to platform standard config dir from linux specific config dir
-	// and hence it will be attempted in config package during init
+	// Nuclei handles config-path compatibility before parsing its layered files.
 	goflags.DisableAutoConfigMigration = true
-	_ = flagSet.Parse()
+	warnings, err := configuration.Load(config.DefaultConfig, flagSet, &selectedFiles, func(path string) (string, error) {
+		return configuration.ResolveProfilePath(path, configuration.TemplatesDirectory(options, config.DefaultConfig))
+	})
+
+	for _, warning := range warnings {
+		options.Logger.Warning().Msgf("Could not load configuration: %s\n", warning)
+	}
+
+	if err != nil {
+		fatalf("Could not load configuration: %s\n", err)
+	}
+	pdcpAuth = cliOnlyDynamicValue(flagSet, "auth", pdcpAuth)
+
+	if disableUpdateCheck {
+		config.DefaultConfig.DisableUpdateCheck()
+	}
+
+	if templatesDir, overridden := configuration.TemplatesDirectoryOverride(options); overridden {
+		config.DefaultConfig.SetTemplatesDir(templatesDir)
+	}
+
+	if resetRequested {
+		resetCallback()
+	}

 	// when fuzz flag is enabled, set the dast flag to true
 	if fuzzFlag {
@@ -559,13 +578,13 @@ Additional documentation is available at: https://docs.nuclei.sh/getting-started
 	}

 	// api key hierarchy: cli flag > env var > .pdcp/credential file
-	if pdcpauth == "true" {
+	if pdcpAuth == "true" {
 		runner.AuthWithPDCP()
-	} else if len(pdcpauth) == 36 {
+	} else if len(pdcpAuth) == 36 {
 		ph := pdcp.PDCPCredHandler{}
 		if _, err := ph.GetCreds(); err == pdcp.ErrNoCreds {
 			apiServer := env.GetEnvOrDefault("PDCP_API_SERVER", pdcp.DefaultApiServer)
-			if validatedCreds, err := ph.ValidateAPIKey(pdcpauth, apiServer, config.BinaryName); err == nil {
+			if validatedCreds, err := ph.ValidateAPIKey(pdcpAuth, apiServer, config.BinaryName); err == nil {
 				_ = ph.SaveCreds(validatedCreds)
 			}
 		}
@@ -576,7 +595,7 @@ Additional documentation is available at: https://docs.nuclei.sh/getting-started
 		h := &pdcp.PDCPCredHandler{}
 		_, err := h.GetCreds()
 		if err != nil {
-			options.Logger.Fatal().Msg("To utilize the `-ai` flag, please configure your API key with the `-auth` flag or set the `PDCP_API_KEY` environment variable")
+			fatalf("To utilize the `-ai` flag, please configure your API key with the `-auth` flag or set the `PDCP_API_KEY` environment variable")
 		}
 	}

@@ -595,143 +614,34 @@ Additional documentation is available at: https://docs.nuclei.sh/getting-started
 		runner.NucleiToolUpdateCallback()
 	}

+	tempSecretsDir, err := configuration.ApplyProfile(selectedFiles.Profile, options)
+	if err != nil {
+		fatalf("Could not process template profile: %s\n", err)
+	}
+	if tempSecretsDir != "" {
+		setInlineSecretsTempDir(tempSecretsDir)
+	}
+
 	if options.LeaveDefaultPorts {
 		http.LeaveDefaultPorts = true
 	}
-	if customConfigDir := os.Getenv(config.NucleiConfigDirEnv); customConfigDir != "" {
-		config.DefaultConfig.SetConfigDir(customConfigDir)
-		readFlagsConfig(flagSet)
-	}
-
-	if cfgFile != "" {
-		if !fileutil.FileExists(cfgFile) {
-			options.Logger.Fatal().Msgf("given config file '%s' does not exist", cfgFile)
-		}
-		// merge config file with flags
-		if err := flagSet.MergeConfigFile(cfgFile); err != nil {
-			options.Logger.Fatal().Msgf("Could not read config: %s\n", err)
-		}
-
-		if !options.Vars.IsEmpty() {
-			// Maybe we should add vars to the config file as well even if they are set via flags?
-			file, err := os.Open(cfgFile)
-			if err != nil {
-				gologger.Fatal().Msgf("Could not open config file: %s\n", err)
-			}
-			defer func() {
-				_ = file.Close()
-			}()
-			data := make(map[string]interface{})
-			err = yaml.NewDecoder(file).Decode(&data)
-			if err != nil {
-				gologger.Fatal().Msgf("Could not decode config file: %s\n", err)
-			}
-
-			variables := data["var"]
-			if variables != nil {
-				if varSlice, ok := variables.([]interface{}); ok {
-					for _, value := range varSlice {
-						if strVal, ok := value.(string); ok {
-							err = options.Vars.Set(strVal)
-							if err != nil {
-								gologger.Warning().Msgf("Could not set variable from config file: %s\n", err)
-							}
-						} else {
-							gologger.Warning().Msgf("Skipping non-string variable in config: %#v", value)
-						}
-					}
-				} else {
-					gologger.Warning().Msgf("No 'var' section found in config file: %s", cfgFile)
-				}
-			}
-
-		}
-	}
-
-	templatesDir := options.NewTemplatesDirectory
-	if templatesDir == "" {
-		templatesDir = os.Getenv(config.NucleiTemplatesDirEnv)
-	}
-	if templatesDir != "" {
-		config.DefaultConfig.SetTemplatesDir(templatesDir)
-	}
-
-	defaultProfilesPath := filepath.Join(config.DefaultConfig.GetTemplateDir(), "profiles")
-	if templateProfile != "" {
-		if filepath.Ext(templateProfile) == "" {
-			if tp := findProfilePathById(templateProfile, defaultProfilesPath); tp != "" {
-				templateProfile = tp
-			} else {
-				options.Logger.Fatal().Msgf("'%s' is not a profile-id or profile path", templateProfile)
-			}
-		}
-		if !filepath.IsAbs(templateProfile) {
-			if filepath.Dir(templateProfile) == "profiles" {
-				defaultProfilesPath = filepath.Join(config.DefaultConfig.GetTemplateDir())
-			}
-			currentDir, err := os.Getwd()
-			if err == nil && fileutil.FileExists(filepath.Join(currentDir, templateProfile)) {
-				templateProfile = filepath.Join(currentDir, templateProfile)
-			} else {
-				templateProfile = filepath.Join(defaultProfilesPath, templateProfile)
-			}
-		}
-		if !fileutil.FileExists(templateProfile) {
-			options.Logger.Fatal().Msgf("given template profile file '%s' does not exist", templateProfile)
-		}
-		if err := flagSet.MergeConfigFile(templateProfile); err != nil {
-			options.Logger.Fatal().Msgf("Could not read template profile: %s\n", err)
-		}
-
-		// Process inline target list from profile.
-		// Supports both the dedicated targets-inline key and multiline
-		// content in the list key (which normally holds a file path).
-		if options.InlineTargetsList != "" {
-			inlineTargets := strings.Split(strings.TrimSpace(options.InlineTargetsList), "\n")
-			for _, target := range inlineTargets {
-				target = strings.TrimSpace(target)
-				if target != "" && !strings.HasPrefix(target, "#") {
-					options.Targets = append(options.Targets, target)
-				}
-			}
-		}
-		if strings.Contains(options.TargetsFilePath, "\n") {
-			// list key has multiline content, treat as inline targets
-			inlineTargets := strings.Split(strings.TrimSpace(options.TargetsFilePath), "\n")
-			for _, target := range inlineTargets {
-				target = strings.TrimSpace(target)
-				if target != "" && !strings.HasPrefix(target, "#") {
-					options.Targets = append(options.Targets, target)
-				}
-			}
-			options.TargetsFilePath = ""
-		}
-
-		// Process inline secrets from profile YAML
-		tempSecretsFile, err := processInlineSecretsFromProfile(templateProfile, options)
-		if err != nil {
-			options.Logger.Fatal().Msgf("Could not process inline secrets: %s\n", err)
-		}
-		if tempSecretsFile != "" {
-			inlineSecretsTempFiles = append(inlineSecretsTempFiles, tempSecretsFile)
-		}
-	}

 	if len(options.SecretsFile) > 0 {
 		for _, secretFile := range options.SecretsFile {
 			if !fileutil.FileExists(secretFile) {
-				options.Logger.Fatal().Msgf("given secrets file '%s' does not exist", secretFile)
+				fatalf("Secrets file '%s' does not exist", secretFile)
 			}
 		}
 	}

 	cleanupOldResumeFiles()
+
 	return flagSet
 }

 // cleanupOldResumeFiles cleans up resume files older than 10 days.
 func cleanupOldResumeFiles() {
-	root := config.DefaultConfig.GetCacheDir()
+	root := config.DefaultConfig.GetStateDir()
 	filter := fileutil.FileFilters{
 		OlderThan: 24 * time.Hour * 10, // cleanup on the 10th day
 		Prefix:    "resume-",
@@ -739,40 +649,6 @@ func cleanupOldResumeFiles() {
 	_ = fileutil.DeleteFilesOlderThan(root, filter)
 }

-// readFlagsConfig reads the config file from the default config dir and copies it to the current config dir.
-func readFlagsConfig(flagset *goflags.FlagSet) {
-	// check if config.yaml file exists
-	defaultCfgFile, err := flagset.GetConfigFilePath()
-	if err != nil {
-		// something went wrong either dir is not readable or something else went wrong upstream in `goflags`
-		// warn and exit in this case
-		options.Logger.Warning().Msgf("Could not read config file: %s\n", err)
-		return
-	}
-	cfgFile := config.DefaultConfig.GetFlagsConfigFilePath()
-	if !fileutil.FileExists(cfgFile) {
-		if !fileutil.FileExists(defaultCfgFile) {
-			// if default config does not exist, warn and exit
-			options.Logger.Warning().Msgf("missing default config file : %s", defaultCfgFile)
-			return
-		}
-		// if does not exist copy it from the default config
-		if err = fileutil.CopyFile(defaultCfgFile, cfgFile); err != nil {
-			options.Logger.Warning().Msgf("Could not copy config file: %s\n", err)
-		}
-		return
-	}
-	// if config file exists, merge it with the default config
-	if err = flagset.MergeConfigFile(cfgFile); err != nil {
-		options.Logger.Warning().Msgf("failed to merge configfile with flags got: %s\n", err)
-	}
-}
-
-// disableUpdatesCallback disables the update check.
-func disableUpdatesCallback() {
-	config.DefaultConfig.DisableUpdateCheck()
-}
-
 // printVersion prints the nuclei version and exits.
 func printVersion() {
 	options.Logger.Info().Msgf("Nuclei Engine Version: %s", config.Version)
@@ -800,119 +676,155 @@ func printTemplateVersion() {
 	os.Exit(0)
 }

+type resetPath struct {
+	name string
+	path string
+}
+
 func resetCallback() {
+	cfg := config.DefaultConfig
+	templateRoot := cfg.TemplatesDirectory
+	templateAction := fmt.Sprintf("4. Active nuclei-templates at %v", templateRoot)
 	warning := fmt.Sprintf(`
-Using '-reset' will delete all nuclei configurations files and all nuclei-templates
+Using '-reset' will delete Nuclei configuration, state, cache, and template files

 Following files will be deleted:
 1. All config files at %v
-2. All cache files (including resume state) at %v
-3. All nuclei-templates at %v
+2. All state files (including generated resume state) at %v
+3. All cache files at %v
+%s

 Note: Make sure you have backup of your custom nuclei-templates before proceeding

-`, config.DefaultConfig.GetConfigDir(), config.DefaultConfig.GetCacheDir(), config.DefaultConfig.TemplatesDirectory)
+`, cfg.GetConfigDir(), cfg.GetStateDir(), cfg.GetCacheDir(), templateAction)
 	options.Logger.Print().Msg(warning)
 	reader := bufio.NewReader(os.Stdin)
 	for {
 		fmt.Print("Are you sure you want to continue? [y/n]: ")
+
 		resp, err := reader.ReadString('\n')
 		if err != nil {
-			options.Logger.Fatal().Msgf("could not read response: %s", err)
+			fatalf("Could not read response: %s", err)
 		}
+
 		resp = strings.TrimSpace(resp)
 		if stringsutil.EqualFoldAny(resp, "y", "yes") {
 			break
 		}
+
 		if stringsutil.EqualFoldAny(resp, "n", "no", "") {
 			fmt.Println("Exiting...")
 			os.Exit(0)
 		}
 	}
-	err := os.RemoveAll(config.DefaultConfig.GetConfigDir())
-	if err != nil {
-		options.Logger.Fatal().Msgf("could not delete config dir: %s", err)
+
+	resetPaths := []resetPath{
+		{name: "config", path: cfg.GetConfigDir()},
+		{name: "state", path: cfg.GetStateDir()},
+		{name: "cache", path: cfg.GetCacheDir()},
+		{name: "templates", path: templateRoot},
 	}
-	err = os.RemoveAll(config.DefaultConfig.GetCacheDir())
-	if err != nil {
-		options.Logger.Fatal().Msgf("could not delete cache dir: %s", err)
+
+	if err := removeResetPaths(resetPaths); err != nil {
+		fatalf("Could not reset paths: %s", err)
 	}
-	err = os.RemoveAll(config.DefaultConfig.TemplatesDirectory)
-	if err != nil {
-		options.Logger.Fatal().Msgf("could not delete templates dir: %s", err)
-	}
-	options.Logger.Info().Msgf("Successfully deleted all nuclei configurations files and nuclei-templates")
+
+	options.Logger.Info().Msgf("Successfully reset Nuclei files")
 	os.Exit(0)
 }

-func findProfilePathById(profileId, templatesDir string) string {
-	var profilePath string
-	err := filepath.WalkDir(templatesDir, func(iterItem string, d fs.DirEntry, err error) error {
-		ext := filepath.Ext(iterItem)
-		isYaml := ext == extensions.YAML || ext == extensions.YML
-		if err != nil || d.IsDir() || !isYaml {
-			// skip non yaml files
-			return nil
+func removeResetPaths(paths []resetPath) error {
+	for _, path := range paths {
+		if err := validateResetPath(path.path); err != nil {
+			return fmt.Errorf("error validating %s path: %w", path.name, err)
 		}
-		if strings.TrimSuffix(filepath.Base(iterItem), ext) == profileId {
-			profilePath = iterItem
-			return fmt.Errorf("FOUND")
+	}
+
+	for _, path := range paths {
+		if err := os.RemoveAll(path.path); err != nil {
+			return fmt.Errorf("error deleting %s path: %w", path.name, err)
+		}
+	}
+
+	return nil
+}
+
+func validateResetPath(path string) error {
+	if path == "" {
+		return fmt.Errorf("path is empty")
+	}
+
+	absPath, err := filepath.Abs(path)
+	if err != nil {
+		return fmt.Errorf("resolve %q: %w", path, err)
+	}
+
+	absPath = filepath.Clean(absPath)
+	volume := filepath.VolumeName(absPath)
+	if absPath == filepath.Clean(volume+string(filepath.Separator)) {
+		return fmt.Errorf("path %q is a filesystem root", absPath)
+	}
+
+	relativePath := strings.Trim(filepath.ToSlash(strings.TrimPrefix(absPath, volume)), "/")
+	if relativePath == "" || len(strings.Split(relativePath, "/")) < 2 {
+		return fmt.Errorf("path %q is too broad", absPath)
+	}
+
+	if homeDir, err := os.UserHomeDir(); err == nil && absPath == filepath.Clean(homeDir) {
+		return fmt.Errorf("path %q is the user home directory", absPath)
+	}
+
+	if absPath == filepath.Clean(os.TempDir()) {
+		return fmt.Errorf("path %q is the system temporary directory", absPath)
+	}
+
+	if cwd, err := os.Getwd(); err == nil && absPath == filepath.Clean(cwd) {
+		return fmt.Errorf("path %q is the current working directory", absPath)
+	}
+
+	if resolvedPath, err := filepath.EvalSymlinks(absPath); err == nil && resolvedPath != absPath {
+		if err := validateResetPath(resolvedPath); err != nil {
+			return fmt.Errorf("resolved path %q is unsafe: %w", resolvedPath, err)
+		}
+	}
+
+	return nil
+}
+
+func cleanupInlineSecretsDirs() {
+	inlineSecretsTempMu.Lock()
+	dir := inlineSecretsTempDir
+	inlineSecretsTempDir = ""
+	inlineSecretsTempMu.Unlock()
+
+	if dir != "" {
+		_ = os.RemoveAll(dir)
+	}
+}
+
+func setInlineSecretsTempDir(dir string) {
+	inlineSecretsTempMu.Lock()
+	inlineSecretsTempDir = dir
+	inlineSecretsTempMu.Unlock()
+}
+
+func cliOnlyDynamicValue(flagSet *goflags.FlagSet, name, value string) string {
+	found := false
+
+	flagSet.CommandLine.Visit(func(current *flag.Flag) {
+		if current.Name == name {
+			found = true
 		}
-		return nil
 	})
-	if err != nil && err.Error() != "FOUND" {
-		options.Logger.Error().Msgf("%s\n", err)
+
+	if !found {
+		return ""
 	}
-	return profilePath
+
+	return value
 }

-// profileSecrets is a helper struct to extract secrets section from a template profile YAML
-type profileSecrets struct {
-	Secrets interface{} `yaml:"secrets"`
-}
-
-// processInlineSecretsFromProfile parses the profile YAML file for inline secrets
-// and creates a temporary secrets file compatible with nuclei's auth provider.
-// Returns the path to the temp file or empty string if no secrets found.
-func processInlineSecretsFromProfile(profilePath string, options *types.Options) (string, error) {
-	data, err := os.ReadFile(profilePath)
-	if err != nil {
-		return "", fmt.Errorf("could not read profile file: %w", err)
-	}
-
-	var profile profileSecrets
-	if err := yaml.Unmarshal(data, &profile); err != nil {
-		return "", fmt.Errorf("could not parse profile YAML: %w", err)
-	}
-
-	if profile.Secrets == nil {
-		return "", nil
-	}
-
-	secretsData, err := yaml.Marshal(profile.Secrets)
-	if err != nil {
-		return "", fmt.Errorf("could not marshal inline secrets: %w", err)
-	}
-
-	tempDir := filepath.Join(os.TempDir(), "nuclei-secrets")
-	if err := os.MkdirAll(tempDir, 0700); err != nil {
-		return "", fmt.Errorf("could not create temp directory: %w", err)
-	}
-
-	tempFile, err := os.CreateTemp(tempDir, "inline-secrets-*.yaml")
-	if err != nil {
-		return "", fmt.Errorf("could not create temp secrets file: %w", err)
-	}
-	defer func() {
-		_ = tempFile.Close()
-	}()
-
-	if _, err := tempFile.Write(secretsData); err != nil {
-		_ = tempFile.Close()
-		_ = os.Remove(tempFile.Name())
-		return "", fmt.Errorf("could not write to temp secrets file: %w", err)
-	}
-
-	options.SecretsFile = append(options.SecretsFile, tempFile.Name())
-	return tempFile.Name(), nil
+func fatalf(format string, args ...any) {
+	cleanupInlineSecretsDirs()
+	options.Logger.Fatal().Msgf(format, args...)
 }
@@ -0,0 +1,184 @@
+package main
+
+import (
+	"bytes"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/projectdiscovery/gologger"
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+)
+
+const inlineSecretsFatalChildEnv = "NUCLEI_INLINE_SECRETS_FATAL_CHILD"
+
+func TestValidateResetPathRejectsBroadTargets(t *testing.T) {
+	if err := validateResetPath(""); err == nil {
+		t.Fatal("empty reset path was accepted")
+	}
+	if err := validateResetPath(string(filepath.Separator)); err == nil {
+		t.Fatal("filesystem root reset path was accepted")
+	}
+	if err := validateResetPath(filepath.Join(string(filepath.Separator), "var")); err == nil {
+		t.Fatal("broad top-level reset path was accepted")
+	}
+	if err := validateResetPath(os.TempDir()); err == nil {
+		t.Fatal("system temporary directory reset path was accepted")
+	}
+	if cwd, err := os.Getwd(); err == nil {
+		if err := validateResetPath(cwd); err == nil {
+			t.Fatal("current working directory reset path was accepted")
+		}
+	}
+	if homeDir, err := os.UserHomeDir(); err == nil {
+		if err := validateResetPath(homeDir); err == nil {
+			t.Fatal("user home reset path was accepted")
+		}
+	}
+	if err := validateResetPath(t.TempDir()); err != nil {
+		t.Fatalf("scoped reset path was rejected: %v", err)
+	}
+}
+
+func TestRemoveResetPathsValidatesAllTargetsBeforeDeletion(t *testing.T) {
+	root := t.TempDir()
+	configDir := filepath.Join(root, "config")
+	if err := os.Mkdir(configDir, 0o700); err != nil {
+		t.Fatalf("create config directory: %v", err)
+	}
+
+	paths := []resetPath{
+		{name: "config", path: configDir},
+		{name: "unsafe", path: string(filepath.Separator)},
+	}
+	if err := removeResetPaths(paths); err == nil {
+		t.Fatal("unsafe reset target was accepted")
+	}
+	if _, err := os.Stat(configDir); err != nil {
+		t.Fatalf("config directory was removed before validation completed: %v", err)
+	}
+}
+
+func TestCleanupInlineSecretsDirsRemovesPrivateDirectory(t *testing.T) {
+	secretsDir := filepath.Join(t.TempDir(), "nuclei-secrets-run")
+	if err := os.Mkdir(secretsDir, 0o700); err != nil {
+		t.Fatalf("create inline secrets directory: %v", err)
+	}
+	secretsPath := filepath.Join(secretsDir, "inline-secrets.yaml")
+	if err := os.WriteFile(secretsPath, []byte("static: []\n"), 0o600); err != nil {
+		t.Fatalf("write inline secrets file: %v", err)
+	}
+
+	inlineSecretsTempMu.Lock()
+	previous := inlineSecretsTempDir
+	inlineSecretsTempDir = secretsDir
+	inlineSecretsTempMu.Unlock()
+	t.Cleanup(func() {
+		inlineSecretsTempMu.Lock()
+		inlineSecretsTempDir = previous
+		inlineSecretsTempMu.Unlock()
+	})
+
+	cleanupInlineSecretsDirs()
+	if _, err := os.Stat(secretsDir); !os.IsNotExist(err) {
+		t.Fatalf("inline secrets directory still exists: %v", err)
+	}
+}
+
+func TestCleanupInlineSecretsDirsIsConcurrentSafe(t *testing.T) {
+	root := t.TempDir()
+	dir := filepath.Join(root, "nuclei-secrets")
+	if err := os.Mkdir(dir, 0o700); err != nil {
+		t.Fatalf("create inline secrets directory: %v", err)
+	}
+
+	inlineSecretsTempMu.Lock()
+	previous := inlineSecretsTempDir
+	inlineSecretsTempDir = dir
+	inlineSecretsTempMu.Unlock()
+	t.Cleanup(func() {
+		inlineSecretsTempMu.Lock()
+		inlineSecretsTempDir = previous
+		inlineSecretsTempMu.Unlock()
+	})
+
+	start := make(chan struct{})
+	var wg sync.WaitGroup
+	for range 8 {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			<-start
+			cleanupInlineSecretsDirs()
+		}()
+	}
+	close(start)
+	wg.Wait()
+
+	if _, err := os.Stat(dir); !os.IsNotExist(err) {
+		t.Fatalf("inline secrets directory still exists: %s: %v", dir, err)
+	}
+}
+
+func TestReadConfigFatalCleansInlineSecretsDirectory(t *testing.T) {
+	if os.Getenv(inlineSecretsFatalChildEnv) == "1" {
+		options = &types.Options{Logger: gologger.DefaultLogger}
+		os.Args = []string{
+			os.Args[0],
+			"-profile", os.Getenv("NUCLEI_TEST_PROFILE"),
+			"-secret-file", os.Getenv("NUCLEI_TEST_MISSING_SECRET"),
+			"-disable-update-check",
+		}
+		readConfig()
+		os.Exit(0)
+	}
+
+	root := t.TempDir()
+	profilePath := filepath.Join(root, "profile.yaml")
+	if err := os.WriteFile(profilePath, []byte("secrets:\n  static: []\n"), 0o600); err != nil {
+		t.Fatalf("write profile: %v", err)
+	}
+	missingSecret := filepath.Join(root, "missing-secrets.yaml")
+	tempRoot := filepath.Join(root, "tmp")
+	if err := os.Mkdir(tempRoot, 0o700); err != nil {
+		t.Fatalf("create temporary root: %v", err)
+	}
+
+	cmd := exec.Command(os.Args[0], "-test.run=^TestReadConfigFatalCleansInlineSecretsDirectory$", "-test.count=1")
+	cmd.Env = isolatedNucleiStorageEnv(root, tempRoot,
+		inlineSecretsFatalChildEnv+"=1",
+		"NUCLEI_TEST_PROFILE="+profilePath,
+		"NUCLEI_TEST_MISSING_SECRET="+missingSecret,
+	)
+	output, err := cmd.CombinedOutput()
+	if err == nil {
+		t.Fatal("child process did not exit on the missing secrets file")
+	}
+	if !bytes.Contains(output, []byte("Secrets file")) || !bytes.Contains(output, []byte("does not exist")) {
+		t.Fatalf("child did not reach the missing secrets file failure:\n%s", output)
+	}
+
+	matches, err := filepath.Glob(filepath.Join(tempRoot, "nuclei-secrets-*"))
+	if err != nil {
+		t.Fatalf("list inline secrets directories: %v", err)
+	}
+	if len(matches) != 0 {
+		t.Fatalf("inline secrets directories remain after fatal exit: %v", matches)
+	}
+}
+
+func isolatedNucleiStorageEnv(root, tempRoot string, extra ...string) []string {
+	env := append(os.Environ(),
+		"TMPDIR="+tempRoot,
+		"TMP="+tempRoot,
+		"TEMP="+tempRoot,
+		"XDG_CONFIG_HOME="+filepath.Join(root, "config"),
+		"XDG_STATE_HOME="+filepath.Join(root, "state"),
+		"XDG_CACHE_HOME="+filepath.Join(root, "cache"),
+		"XDG_DATA_HOME="+filepath.Join(root, "data"),
+		"NUCLEI_CONFIG_DIR="+filepath.Join(root, "config", "nuclei"),
+	)
+	return append(env, extra...)
+}
@@ -0,0 +1,280 @@
+# Nuclei Runtime Reuse Milestone 1 Implementation Plan
+
+> Execute this plan test-first. Do not begin scheduler rechunking until the baseline and worker-runtime gates at the end of this plan pass.
+
+**Goal:** Remove confirmed repeated parsing/compilation and unbounded per-chunk compiled-cache retention from Aurora's Nuclei execution path, while producing trustworthy before/after timing, allocation, memory, and coverage evidence.
+
+**Architecture:** A long-lived worker owns the parsed template cache and safe protocol infrastructure. Each concurrent scan execution receives a private parser with a private compiled cache, while sharing only immutable parsed template source. The execution cache is explicitly released at execution completion. Aurora's rate-limited batch loop uses the same ownership model and stops before starting another batch after cancellation.
+
+**Tech stack:** Go, Nuclei SDK/core, Aurora worker, Prometheus, Go benchmarks, race detector, deterministic local HTTP/TLS fixtures.
+
+**Design reference:** `docs/superpowers/specs/2026-09-08-aurora-nuclei-performance-design.md` in the Aurora `codex/aurora-nuclei-performance` worktree.
+
+## Task 1: Add an explicit Nuclei execution-parser lifecycle
+
+**Files:**
+
+- Modify: `pkg/templates/parser.go`
+- Modify: `pkg/templates/parser_purge_test.go`
+- Modify: `pkg/templates/compile_bench_test.go`
+
+### Step 1: Write failing lifecycle tests
+
+Add tests proving that an execution parser:
+
+- shares the parent's parsed cache;
+- starts with an empty, private compiled cache;
+- preserves parser validation/strictness settings;
+- can purge its compiled cache without purging the parent's parsed cache;
+- does not expose its compiled entries to a sibling execution parser.
+
+Run:
+
+```bash
+go test ./pkg/templates -run 'TestParser.*Execution|TestParserPurgeCompiled' -count=1
+```
+
+Expected: FAIL because the explicit execution-parser and compiled-only purge APIs do not exist.
+
+### Step 2: Implement the minimum lifecycle API
+
+Add:
+
+```go
+func NewExecutionParser(parent *Parser) *Parser
+func (p *Parser) PurgeCompiled()
+```
+
+`NewExecutionParser` must share only `parsedTemplatesCache`, copy parser behaviour flags, and allocate a new compiled cache. Reject or safely handle a nil parent. `PurgeCompiled` must never clear the shared parsed cache.
+
+### Step 3: Run focused tests and race tests
+
+```bash
+go test ./pkg/templates -run 'TestParser.*Execution|TestParserPurge' -count=1
+go test -race ./pkg/templates -run 'TestParser.*Execution|TestParserPurge' -count=1
+```
+
+Expected: PASS.
+
+### Step 4: Extend the existing cache benchmark
+
+Update `BenchmarkParseAcrossEngineLocalCaches` to use the public execution-parser lifecycle. Report allocation and timing results before and after the change without claiming scan-level improvement from this microbenchmark.
+
+```bash
+go test ./pkg/templates -run '^$' -bench BenchmarkParseAcrossEngineLocalCaches -benchmem -count=5
+```
+
+### Step 5: Commit
+
+```bash
+git add pkg/templates/parser.go pkg/templates/parser_purge_test.go pkg/templates/compile_bench_test.go
+git commit -m "feat(templates): add execution-local parser lifecycle"
+```
+
+## Task 2: Make the thread-safe Nuclei SDK reuse parsed templates safely
+
+**Files:**
+
+- Modify: `lib/multi.go`
+- Modify: `lib/multi_internal_test.go`
+- Modify: `lib/multi_bench_test.go`
+- Verify: `lib/result_callback_test.go`
+
+### Step 1: Write failing SDK ownership tests
+
+Test `createEphemeralObjects` directly and prove:
+
+- each call receives a distinct execution parser;
+- both parsers share the base parsed cache but not a compiled cache;
+- caching is enabled within that isolated execution;
+- closing ephemeral objects clears that execution's compiled cache;
+- base and sibling caches remain intact;
+- concurrent per-call output callbacks remain isolated.
+
+Run:
+
+```bash
+go test ./lib -run 'TestEphemeral.*Parser|TestThreadSafe.*Callback' -count=1
+```
+
+Expected: FAIL because the current code reuses the base parser and sets `DoNotCache=true`.
+
+### Step 2: Implement execution-local parser ownership
+
+Create an execution parser from the long-lived engine parser in `createEphemeralObjects`, store its ownership in `unsafeOptions`, set it on `ExecutorOptions`, and allow caching inside the private execution cache. In `closeEphemeralObjects`, purge only that private compiled cache before removing inherited references.
+
+Do not share compiled request objects across concurrent executions. Do not move output writers, credentials, variables, global matchers, workflow state, or rate limiters into the shared parser.
+
+### Step 3: Run correctness and race tests
+
+```bash
+go test ./lib -run 'TestEphemeral.*Parser|TestThreadSafe|TestResult' -count=1
+go test -race ./lib -run 'TestEphemeral.*Parser|TestThreadSafe|TestResult' -count=1
+```
+
+Expected: PASS with no race reports.
+
+### Step 4: Capture SDK benchmark evidence
+
+Run the existing repeated-execution benchmark on the parent revision and candidate revision with identical fixture and machine settings:
+
+```bash
+go test ./lib -run '^$' -bench BenchmarkExecuteNucleiWithOptsCtx -benchmem -count=10
+```
+
+Compare with `benchstat`. Record sec/op, B/op, and allocs/op. This is an SDK setup/execute benchmark, not yet an Aurora end-to-end result.
+
+### Step 5: Commit
+
+```bash
+git add lib/multi.go lib/multi_internal_test.go lib/multi_bench_test.go
+git commit -m "perf(lib): reuse parsed templates across isolated executions"
+```
+
+## Task 3: Add Aurora phase and terminal-reason observability
+
+**Files:**
+
+- Modify: `internal/agent/metrics/metrics.go`
+- Modify: `internal/agent/nuclei/nuclei.go`
+- Modify: `internal/agent/tasks.go`
+- Modify: `internal/agent/tasks_test.go` or the nearest existing scan-settlement test
+- Add: `internal/agent/nuclei/execution_metrics_test.go`
+
+### Step 1: Write failing metric/terminal-reason tests
+
+Tests must distinguish:
+
+- Aurora chunk execution deadline;
+- outer worker lifecycle timeout/cancellation;
+- Nuclei core/batch deadline;
+- target network timeout counted as an executed scan attempt rather than an orchestration timeout;
+- normal completion and non-deadline execution failure.
+
+Avoid new high-cardinality labels such as scan ID, target, or template ID.
+
+### Step 2: Add bounded-cardinality metrics
+
+Add counters/histograms for terminal reason and phase duration using fixed labels such as stream, phase, and reason. Time at least template discovery/load, compile/load-store, execute, output flush, and cleanup. Emit the same reason in structured logs.
+
+### Step 3: Verify
+
+```bash
+GOWORK=off go test ./internal/agent/nuclei ./internal/agent -run 'Test.*ExecutionMetric|Test.*Settlement|Test.*Deadline' -count=1
+```
+
+Expected: PASS.
+
+### Step 4: Commit
+
+```bash
+git add internal/agent/metrics/metrics.go internal/agent/nuclei internal/agent/tasks.go internal/agent/*test.go
+git commit -m "feat(agent): expose nuclei execution phases and terminal reasons"
+```
+
+## Task 4: Bound Aurora rate-limited batch memory and honor cancellation
+
+**Files:**
+
+- Modify: `internal/agent/nuclei/nuclei.go`
+- Add: `internal/agent/nuclei/rate_limited_batches_test.go`
+
+### Step 1: Extract a testable sequential batch executor
+
+Extract only the rate-limited batch loop behind a small internal function. Pass the loader/engine execution seam as a function so unit tests do not need live network services or a full Nuclei corpus.
+
+### Step 2: Write failing behavioural tests
+
+Cover only the confirmed boundaries:
+
+- cancellation before a batch prevents that batch and every later batch from loading or executing;
+- cancellation during a batch prevents the next batch from starting;
+- each batch gets a private compiled cache backed by the process parsed cache;
+- the previous batch compiled cache is empty/released before the next batch starts;
+- every template path appears exactly once when no cancellation occurs;
+- private templates/workflows retain the existing execute-once semantics.
+
+### Step 3: Implement the bounded lifecycle
+
+Before each batch, check `context.Cause(ctx)`. Create an execution parser with a private compiled cache for the batch, execute it, and explicitly purge the compiled cache on every exit path. Remove forced `runtime.GC()` from the hot loop only after the lifecycle tests prove cached objects are no longer retained.
+
+Keep the current batch size initially. Changing batch size and cache ownership simultaneously would make the performance result ambiguous.
+
+### Step 4: Verify
+
+```bash
+GOWORK=off go test ./internal/agent/nuclei -run 'TestRateLimitedBatch' -count=1
+GOWORK=off go test -race ./internal/agent/nuclei -run 'TestRateLimitedBatch' -count=1
+```
+
+Expected: PASS.
+
+### Step 5: Commit
+
+```bash
+git add internal/agent/nuclei/nuclei.go internal/agent/nuclei/rate_limited_batches_test.go
+git commit -m "fix(agent): bound nuclei batch cache lifetime"
+```
+
+## Task 5: Build the deterministic milestone benchmark
+
+**Files:**
+
+- Add: `internal/agent/nuclei/tests/perfserver/server.go`
+- Add: `internal/agent/nuclei/runtime_benchmark_test.go`
+- Add: `scripts/scan-performance/run-milestone-1.sh`
+- Add: `docs/benchmarks/aurora-nuclei-milestone-1.md`
+
+### Step 1: Implement deterministic fixtures
+
+Provide fixed fast, 100-ms, 500-ms, timeout, connection-reset, TLS, redirect, and multi-request endpoints. Track accepted connections and request identities. Use fixed seeds and local-only addresses.
+
+### Step 2: Define the milestone coverage oracle
+
+For this milestone, generate a seeded template/target manifest and compare expected server-observed attempts with worker terminal accounting. A target network timeout counts as a terminal attempt; missing or duplicated attempts fail. Full workflow/payload canonical-ledger support remains Workstream 1's next milestone and is not claimed here.
+
+### Step 3: Capture baseline and candidate
+
+Run at least five cold and ten warm repetitions using the same rate limit, template set, and concurrency. Capture:
+
+- complete/missing/duplicate attempts;
+- full-run wall time and attempts/second;
+- process CPU time;
+- peak RSS and RSS byte-seconds;
+- heap allocations and GC count/pause;
+- connections created and reused;
+- compiled/parsed cache counts after each batch and run;
+- Aurora versus target timeout reasons.
+
+### Step 4: Apply the milestone gate
+
+Proceed to deadline-fit scheduler work only if:
+
+- the candidate has zero missing or duplicate attempts;
+- no Aurora/core deadline expires in the deterministic matrix;
+- repeated-run compiled-cache size is bounded by the active batch/execution;
+- wall time and attempts/second do not regress;
+- CPU-seconds and RSS byte-seconds improve.
+
+### Step 5: Commit evidence
+
+```bash
+git add internal/agent/nuclei/tests/perfserver internal/agent/nuclei/runtime_benchmark_test.go scripts/scan-performance docs/benchmarks/aurora-nuclei-milestone-1.md
+git commit -m "test(agent): add nuclei runtime performance benchmark"
+```
+
+## Task 6: Milestone verification and handoff
+
+Run:
+
+```bash
+go test ./pkg/templates ./lib -count=1
+go test -race ./pkg/templates ./lib -count=1
+GOWORK=off go test ./internal/agent/nuclei ./internal/agent -count=1
+GOWORK=off go test -race ./internal/agent/nuclei -count=1
+```
+
+Then run the deterministic benchmark and record the exact commands, revisions, machine limits, and raw summary in the benchmark document.
+
+Do not claim the overall zero-deadline goal at this milestone. The milestone claim is limited to safe runtime reuse, bounded batch memory, cancellation correctness, and demonstrated local performance. The next implementation plan covers canonical attempt accounting, deadline-fit chunking, capacity-aware admission, and work-based fleet sizing.
+
@@ -1,6 +1,6 @@
 module github.com/projectdiscovery/nuclei/v3

-go 1.26
+go 1.26.0

 require (
 	github.com/andygrunwald/go-jira v1.16.1
@@ -16,14 +16,14 @@ require (
 	github.com/miekg/dns v1.1.72
 	github.com/olekukonko/tablewriter v1.0.8
 	github.com/pkg/errors v0.9.1
-	github.com/projectdiscovery/clistats v0.1.4
-	github.com/projectdiscovery/fastdialer v0.5.14
-	github.com/projectdiscovery/hmap v0.0.101
+	github.com/projectdiscovery/clistats v0.1.6
+	github.com/projectdiscovery/fastdialer v0.5.19
+	github.com/projectdiscovery/hmap v0.0.102
 	github.com/projectdiscovery/interactsh v1.3.1
-	github.com/projectdiscovery/rawhttp v0.1.91
-	github.com/projectdiscovery/retryabledns v1.0.115
-	github.com/projectdiscovery/retryablehttp-go v1.3.21
-	github.com/projectdiscovery/yamldoc-go v1.0.6
+	github.com/projectdiscovery/rawhttp v0.1.92
+	github.com/projectdiscovery/retryabledns v1.0.116
+	github.com/projectdiscovery/retryablehttp-go v1.3.25
+	github.com/projectdiscovery/yamldoc-go v1.0.7
 	github.com/remeh/sizedwaitgroup v1.0.0
 	github.com/rs/xid v1.6.0
 	github.com/segmentio/ksuid v1.0.4
@@ -32,14 +32,15 @@ require (
 	github.com/syndtr/goleveldb v1.0.0
 	github.com/weppos/publicsuffix-go v0.50.3 // indirect
 	go.uber.org/multierr v1.11.0
-	golang.org/x/net v0.56.0
+	golang.org/x/net v0.58.0
 	golang.org/x/oauth2 v0.36.0
-	golang.org/x/text v0.39.0
+	golang.org/x/text v0.41.0
 )

 require (
 	carvel.dev/ytt v0.52.0
 	code.gitea.io/sdk/gitea v0.17.0
+	filippo.io/age v1.2.0
 	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.10.1
 	github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.1.0
 	github.com/Azure/go-ntlmssp v0.1.1
@@ -49,14 +50,15 @@ require (
 	github.com/Mzack9999/go-rsync v0.0.0-20250821180103-81ffa574ef4d
 	github.com/Mzack9999/goimpacket v0.0.0-20260422121140-7085336a0415
 	github.com/RedTeamPentesting/adauth v0.5.4-0.20260511073005-3d18e8a5a687
+	github.com/adrg/xdg v0.5.3
 	github.com/alexsnet/go-vnc v0.1.0
 	github.com/alitto/pond v1.9.2
 	github.com/antchfx/xmlquery v1.4.4
 	github.com/antchfx/xpath v1.3.6
 	github.com/aws/aws-sdk-go-v2 v1.41.5
-	github.com/aws/aws-sdk-go-v2/config v1.29.17
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.70
-	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.82
+	github.com/aws/aws-sdk-go-v2/config v1.31.16
+	github.com/aws/aws-sdk-go-v2/credentials v1.18.20
+	github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.2
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0
 	github.com/bytedance/sonic v1.15.0
 	github.com/cespare/xxhash v1.1.0
@@ -67,7 +69,8 @@ require (
 	github.com/fatih/structs v1.1.0
 	github.com/fullstorydev/grpcurl v1.9.3
 	github.com/getkin/kin-openapi v0.144.0
-	github.com/go-git/go-git/v5 v5.19.1
+	github.com/getsops/sops/v3 v3.9.2
+	github.com/go-git/go-git/v5 v5.19.2
 	github.com/go-ldap/ldap/v3 v3.4.12
 	github.com/go-pdf/fpdf v0.9.0
 	github.com/go-pg/pg/v10 v10.15.0
@@ -91,55 +94,70 @@ require (
 	github.com/oiweiwei/go-msrpc v1.2.12
 	github.com/ory/dockertest/v3 v3.12.0
 	github.com/praetorian-inc/fingerprintx v1.1.15
-	github.com/projectdiscovery/dsl v0.8.20
+	github.com/projectdiscovery/dsl v0.8.22
 	github.com/projectdiscovery/fasttemplate v0.0.2
 	github.com/projectdiscovery/gcache v0.0.0-20241015120333-12546c6e3f4c
-	github.com/projectdiscovery/goflags v0.1.75
+	github.com/projectdiscovery/goflags v0.2.0
 	github.com/projectdiscovery/goja v0.0.0-20260618133720-acb73e419534
 	github.com/projectdiscovery/goja_nodejs v0.0.0-20260618132410-8519f75f703d
-	github.com/projectdiscovery/gologger v1.1.71
+	github.com/projectdiscovery/gologger v1.1.72
 	github.com/projectdiscovery/gostruct v0.0.2
 	github.com/projectdiscovery/govaluate v0.0.0-20260615100919-5ee2581bbf7e
 	github.com/projectdiscovery/gozero v0.1.1-0.20260530071156-fa1dad563d76
-	github.com/projectdiscovery/httpx v1.10.0
+	github.com/projectdiscovery/httpx v1.11.0
 	github.com/projectdiscovery/mapcidr v1.1.97
 	github.com/projectdiscovery/n3iwf v0.0.0-20230523120440-b8cd232ff1f5
-	github.com/projectdiscovery/networkpolicy v0.1.44
+	github.com/projectdiscovery/networkpolicy v0.1.49
 	github.com/projectdiscovery/ratelimit v0.0.88
 	github.com/projectdiscovery/rdap v0.9.0
 	github.com/projectdiscovery/sarif v0.1.0
-	github.com/projectdiscovery/tlsx v1.2.2
+	github.com/projectdiscovery/tlsx v1.3.2
 	github.com/projectdiscovery/uncover v1.2.1
-	github.com/projectdiscovery/useragent v0.0.108
-	github.com/projectdiscovery/utils v0.11.1
-	github.com/projectdiscovery/wappalyzergo v0.2.91
+	github.com/projectdiscovery/useragent v0.0.109
+	github.com/projectdiscovery/utils v0.11.3
+	github.com/projectdiscovery/wappalyzergo v0.2.96
 	github.com/redis/go-redis/v9 v9.11.0
 	github.com/rs/zerolog v1.34.0
+	github.com/sandrolain/httpcache v1.4.0
 	github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466
 	github.com/sijms/go-ora/v2 v2.9.0
-	github.com/stretchr/testify v1.11.1
+	github.com/stretchr/testify v1.12.1
 	github.com/tarunKoyalwar/goleak v0.0.0-20240429141123-0efa90dbdcf9
 	github.com/yassinebenaid/godump v0.11.1
 	github.com/zmap/zgrab2 v0.1.8
 	gitlab.com/gitlab-org/api/client-go v1.9.1
 	go.mongodb.org/mongo-driver v1.17.9
-	golang.org/x/sync v0.21.0
-	golang.org/x/term v0.44.0
-	google.golang.org/grpc v1.82.1
+	golang.org/x/sync v0.22.0
+	golang.org/x/term v0.45.0
+	google.golang.org/grpc v1.83.1
 	gopkg.in/yaml.v3 v3.0.1
 	moul.io/http2curl v1.0.0
 )

 require (
 	aead.dev/minisign v0.3.0 // indirect
+	cel.dev/expr v0.25.2 // indirect
+	cloud.google.com/go v0.123.0 // indirect
+	cloud.google.com/go/auth v0.18.2 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
+	cloud.google.com/go/compute/metadata v0.9.0 // indirect
+	cloud.google.com/go/iam v1.5.3 // indirect
+	cloud.google.com/go/kms v1.25.0 // indirect
+	cloud.google.com/go/longrunning v0.8.0 // indirect
+	cloud.google.com/go/monitoring v1.24.3 // indirect
+	cloud.google.com/go/storage v1.56.0 // indirect
 	dario.cat/mergo v1.0.2 // indirect
 	filippo.io/edwards25519 v1.2.0 // indirect
 	git.mills.io/prologic/smtpd v0.0.0-20210710122116-a525b76c287a // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.0 // indirect
 	github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.3.1 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.1.1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
 	github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 // indirect
-	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 // indirect
+	github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Mzack9999/gcache v0.0.0-20230410081825-519e28eab057 // indirect
 	github.com/Mzack9999/go-http-digest-auth-client v0.6.1-0.20220414142836-eb8883508809 // indirect
@@ -157,24 +175,26 @@ require (
 	github.com/andybalholm/cascadia v1.3.3 // indirect
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
 	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.12 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.34.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/kms v1.37.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.30.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.39.0 // indirect
 	github.com/aws/smithy-go v1.24.2 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bits-and-blooms/bitset v1.22.0 // indirect
 	github.com/bits-and-blooms/bloom/v3 v3.5.0 // indirect
+	github.com/blang/semver v3.5.1+incompatible // indirect
 	github.com/bodgit/plumbing v1.3.0 // indirect
 	github.com/bodgit/sevenzip v1.6.1 // indirect
 	github.com/bodgit/windows v1.0.1 // indirect
@@ -203,8 +223,8 @@ require (
 	github.com/containerd/continuity v0.4.5 // indirect
 	github.com/containerd/errdefs v1.0.0 // indirect
 	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
 	github.com/cyphar/filepath-securejoin v0.6.1 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/davidmz/go-pageant v1.0.2 // indirect
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/distribution/reference v0.6.0 // indirect
@@ -213,6 +233,7 @@ require (
 	github.com/dlclark/regexp2/v2 v2.2.1 // indirect
 	github.com/docker/cli v29.2.0+incompatible // indirect
 	github.com/docker/go-connections v0.7.0 // indirect
+	github.com/dop251/goja v0.0.0-20260311135729-065cd970411c // indirect
 	github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/ebitengine/purego v0.10.0 // indirect
@@ -227,6 +248,7 @@ require (
 	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
 	github.com/gaissmai/bart v0.29.0 // indirect
 	github.com/geoffgarside/ber v1.2.0 // indirect
+	github.com/getsops/gopgagent v0.0.0-20240527072608-0c14999532fe // indirect
 	github.com/gin-contrib/sse v0.1.0 // indirect
 	github.com/gin-gonic/gin v1.9.1 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
@@ -251,14 +273,27 @@ require (
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/certificate-transparency-go v1.3.2 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 // indirect
+	github.com/google/s2a-go v0.1.9 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.11 // indirect
+	github.com/googleapis/gax-go/v2 v2.17.0 // indirect
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gosimple/slug v1.15.0 // indirect
 	github.com/gosimple/unidecode v1.0.1 // indirect
+	github.com/goware/prefixer v0.0.0-20160118172347-395022866408 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
+	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
+	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 // indirect
+	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/hashicorp/go-version v1.8.0 // indirect
+	github.com/hashicorp/go-version v1.9.0 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/hashicorp/vault/api v1.15.0 // indirect
 	github.com/hbakhtiyor/strsim v0.0.0-20190107154042-4d2bbb273edf // indirect
 	github.com/hdm/jarm-go v0.0.8 // indirect
 	github.com/iangcarroll/cookiemonster v1.6.0 // indirect
@@ -284,7 +319,7 @@ require (
 	github.com/libdns/libdns v1.1.1 // indirect
 	github.com/lor00x/goldap v0.0.0-20240304151906-8d785c64d1c8 // indirect
 	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
-	github.com/lufia/plan9stats v0.0.0-20250827001030-24949be3fa54 // indirect
+	github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 // indirect
 	github.com/mackerelio/go-osstat v0.2.6 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
@@ -296,6 +331,8 @@ require (
 	github.com/minio/minlz v1.0.1 // indirect
 	github.com/minio/selfupdate v0.6.1-0.20230907112617-f11e74f84ca7 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/moby/api v1.54.2 // indirect
 	github.com/moby/moby/client v0.4.1 // indirect
@@ -322,15 +359,16 @@ require (
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
 	github.com/projectdiscovery/asnmap v1.1.1 // indirect
-	github.com/projectdiscovery/blackrock v0.0.1 // indirect
-	github.com/projectdiscovery/cdncheck v1.2.46 // indirect
+	github.com/projectdiscovery/blackrock v0.0.2 // indirect
+	github.com/projectdiscovery/cdncheck v1.2.51 // indirect
 	github.com/projectdiscovery/freeport v0.0.7 // indirect
 	github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb // indirect
 	github.com/projectdiscovery/machineid v0.0.0-20250715113114-c77eb3567582 // indirect
 	github.com/refraction-networking/utls v1.8.2 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
 	github.com/sashabaranov/go-openai v1.37.0 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
@@ -341,8 +379,7 @@ require (
 	github.com/sorairolake/lzip-go v0.3.8 // indirect
 	github.com/spf13/afero v1.15.0 // indirect
 	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
-	github.com/stretchr/objx v0.5.3 // indirect
+	github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect
 	github.com/tidwall/btree v1.8.1 // indirect
 	github.com/tidwall/buntdb v1.3.2 // indirect
 	github.com/tidwall/gjson v1.18.0 // indirect
@@ -358,6 +395,7 @@ require (
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
 	github.com/ugorji/go/codec v1.2.11 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
+	github.com/urfave/cli v1.22.16 // indirect
 	github.com/valyala/bytebufferpool v1.0.0 // indirect
 	github.com/vmihailenco/bufpool v0.1.11 // indirect
 	github.com/vmihailenco/msgpack/v5 v5.3.4 // indirect
@@ -381,15 +419,23 @@ require (
 	github.com/zcalusic/sysinfo v1.1.3 // indirect
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
 	go.opentelemetry.io/otel v1.44.0 // indirect
 	go.opentelemetry.io/otel/metric v1.44.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.44.0 // indirect
+	go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect
 	go.opentelemetry.io/otel/trace v1.44.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
 	go4.org v0.0.0-20230225012048-214862532bf5 // indirect
 	golang.org/x/arch v0.3.0 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/api v0.264.0 // indirect
+	google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
 	mellium.im/sasl v0.3.2 // indirect
 	software.sslmate.com/src/go-pkcs12 v0.7.2 // indirect
 )
@@ -400,7 +446,7 @@ require (
 	github.com/gobwas/httphead v0.1.0 // indirect
 	github.com/gobwas/pool v0.2.1 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
-	github.com/google/go-querystring v1.1.0 // indirect
+	github.com/google/go-querystring v1.2.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d // indirect
 	github.com/trivago/tgo v1.0.7
@@ -413,12 +459,12 @@ require (
 	go.etcd.io/bbolt v1.4.3 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	goftp.io/server/v2 v2.0.1 // indirect
-	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/crypto v0.55.0 // indirect
 	golang.org/x/exp v0.0.0-20260527015227-08cc5374adb3
-	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/time v0.14.0 // indirect
-	golang.org/x/tools v0.47.0
+	golang.org/x/mod v0.39.0 // indirect
+	golang.org/x/sys v0.47.0
+	golang.org/x/time v0.15.0 // indirect
+	golang.org/x/tools v0.49.0
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6 // indirect
 	gopkg.in/corvus-ch/zbase32.v1 v1.0.0 // indirect
@@ -1,8 +1,12 @@
 aead.dev/minisign v0.2.0/go.mod h1:zdq6LdSd9TbuSxchxwhpA9zEb9YXcVGoE8JakuiGaIQ=
 aead.dev/minisign v0.3.0 h1:8Xafzy5PEVZqYDNP60yJHARlW1eOQtsKNp/Ph2c0vRA=
 aead.dev/minisign v0.3.0/go.mod h1:NLvG3Uoq3skkRMDuc3YHpWUTMTrSExqm+Ij73W13F6Y=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805 h1:u2qwJeEvnypw+OCPUHmoZE3IqwfuN5kgDfo5MLzpNM0=
+c2sp.org/CCTV/age v0.0.0-20240306222714-3ec4d716e805/go.mod h1:FomMrUJ2Lxt5jCLmZkG3FHa72zUprnhd3v/Z18Snm4w=
 carvel.dev/ytt v0.52.0 h1:tkJPL8Gun5snVfypNXbmMKwnbwMyspcTi3Ypyso3nRY=
 carvel.dev/ytt v0.52.0/go.mod h1:QgmuU7E15EXW1r2wxTt7zExVz14IHwEG4WNMmaFBkJo=
+cel.dev/expr v0.25.2 h1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=
+cel.dev/expr v0.25.2/go.mod h1:hrXvqGP6G6gyx8UAHSHJ5RGk//1Oj5nXQ2NI02Nrsg4=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -18,6 +22,12 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
+cloud.google.com/go v0.123.0 h1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=
+cloud.google.com/go v0.123.0/go.mod h1:xBoMV08QcqUGuPW65Qfm1o9Y4zKZBpGS+7bImXLTAZU=
+cloud.google.com/go/auth v0.18.2 h1:+Nbt5Ev0xEqxlNjd6c+yYUeosQ5TtEUaNcN/3FozlaM=
+cloud.google.com/go/auth v0.18.2/go.mod h1:xD+oY7gcahcu7G2SG2DsBerfFxgPAJz17zz2joOFF3M=
+cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
+cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
@@ -25,8 +35,20 @@ cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUM
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
+cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
+cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
+cloud.google.com/go/iam v1.5.3 h1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=
+cloud.google.com/go/iam v1.5.3/go.mod h1:MR3v9oLkZCTlaqljW6Eb2d3HGDGK5/bDv93jhfISFvU=
+cloud.google.com/go/kms v1.25.0 h1:gVqvGGUmz0nYCmtoxWmdc1wli2L1apgP8U4fghPGSbQ=
+cloud.google.com/go/kms v1.25.0/go.mod h1:XIdHkzfj0bUO3E+LvwPg+oc7s58/Ns8Nd8Sdtljihbk=
+cloud.google.com/go/logging v1.13.1 h1:O7LvmO0kGLaHY/gq8cV7T0dyp6zJhYAOtZPX4TF3QtY=
+cloud.google.com/go/logging v1.13.1/go.mod h1:XAQkfkMBxQRjQek96WLPNze7vsOmay9H5PqfsNYDqvw=
+cloud.google.com/go/longrunning v0.8.0 h1:LiKK77J3bx5gDLi4SMViHixjD2ohlkwBi+mKA7EhfW8=
+cloud.google.com/go/longrunning v0.8.0/go.mod h1:UmErU2Onzi+fKDg2gR7dusz11Pe26aknR4kHmJJqIfk=
+cloud.google.com/go/monitoring v1.24.3 h1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=
+cloud.google.com/go/monitoring v1.24.3/go.mod h1:nYP6W0tm3N9H/bOw8am7t62YTzZY+zUeQ+Bi6+2eonI=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@@ -36,11 +58,17 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+cloud.google.com/go/storage v1.56.0 h1:iixmq2Fse2tqxMbWhLWC9HfBj1qdxqAmiK8/eqtsLxI=
+cloud.google.com/go/storage v1.56.0/go.mod h1:Tpuj6t4NweCLzlNbw9Z9iwxEkrSem20AetIeH/shgVU=
+cloud.google.com/go/trace v1.11.7 h1:kDNDX8JkaAG3R2nq1lIdkb7FCSi1rCmsEtKVsty7p+U=
+cloud.google.com/go/trace v1.11.7/go.mod h1:TNn9d5V3fQVf6s4SCveVMIBS2LJUqo73GACmq/Tky0s=
 code.gitea.io/sdk/gitea v0.17.0 h1:8JPBss4+Jf7AE1YcfyiGrngTXE8dFSG3si/bypsTH34=
 code.gitea.io/sdk/gitea v0.17.0/go.mod h1:ndkDk99BnfiUCCYEUhpNzi0lpmApXlwRFqClBlOlEBg=
 dario.cat/mergo v1.0.2 h1:85+piFYR1tMbRrLcDwR18y4UKJ3aH1Tbzi24VRW1TK8=
 dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
+filippo.io/age v1.2.0 h1:vRDp7pUMaAJzXNIWJVAZnEf/Dyi4Vu4wI8S1LBzufhE=
+filippo.io/age v1.2.0/go.mod h1:JL9ew2lTN+Pyft4RiNGguFfOpewKwSHm5ayKD/A4004=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
 git.mills.io/prologic/smtpd v0.0.0-20210710122116-a525b76c287a h1:3i+FJ7IpSZHL+VAjtpQeZCRhrpP0odl5XfoLBY4fxJ8=
@@ -77,6 +105,14 @@ github.com/DataDog/gostackparse v0.7.0 h1:i7dLkXHvYzHV308hnkvVGDL3BR4FWl7IsXNPz/
 github.com/DataDog/gostackparse v0.7.0/go.mod h1:lTfqcJKqS9KnXQGnyQMCugq3u1FP6UZMfWR0aitKFMM=
 github.com/FalconOpsLLC/goexec v0.3.0 h1:ryLMkrGT6asnkqdc5rFMNOSTYdMH/iCfyEuwu0D6ZhA=
 github.com/FalconOpsLLC/goexec v0.3.0/go.mod h1:kiyxVbmFCGbbwXRyZmOSKlOy7PiK+JH2gq07Ztag/k8=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 h1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0/go.mod h1:pJTkW8hEUIIi3Pf65lPZOnn4Y81yCllX6IWk2jNXdkM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0 h1:owcC2UnmsZycprQ5RfRgjydWhuoxg71LUfyiQdijZuM=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.53.0/go.mod h1:ZPpqegjbE99EPKsu3iUWV22A04wzGPcAY/ziSIQEEgs=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0 h1:4LP6hvB4I5ouTbGgWtixJhgED6xdf67twf9PoY96Tbg=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0/go.mod h1:jUZ5LYlw40WMd07qxcQJD5M40aUxrfwqQX1g7zxYnrQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 h1:Ron4zCA/yk6U7WOBXhTJcDpsUBG9npumK6xw2auFltQ=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0/go.mod h1:cSgYe11MCNYunTnRXrKiR/tHc0eoKjICUuWpNZoVCOo=
 github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
 github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
@@ -106,6 +142,8 @@ github.com/STARRY-S/zip v0.2.3 h1:luE4dMvRPDOWQdeDdUxUoZkzUIpTccdKdhHHsQJ1fm4=
 github.com/STARRY-S/zip v0.2.3/go.mod h1:lqJ9JdeRipyOQJrYSOtpNAiaesFO6zVDsE8GIGFaoSk=
 github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=
 github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
+github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
+github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
 github.com/akrylysov/pogreb v0.10.2 h1:e6PxmeyEhWyi2AKOBIJzAEi4HkiC+lKyCocRGlnDi78=
 github.com/akrylysov/pogreb v0.10.2/go.mod h1:pNs6QmpQ1UlTJKDezuRWmaqkgUE2TuU0YTWyqJZ7+lI=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
@@ -157,20 +195,20 @@ github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV
 github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
-github.com/aws/aws-sdk-go-v2/config v1.29.17 h1:jSuiQ5jEe4SAMH6lLRMY9OVC+TqJLP5655pBGjmnjr0=
-github.com/aws/aws-sdk-go-v2/config v1.29.17/go.mod h1:9P4wwACpbeXs9Pm9w1QTh6BwWwJjwYvJ1iCt5QbCXh8=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.70 h1:ONnH5CM16RTXRkS8Z1qg7/s2eDOhHhaXVd72mmyv4/0=
-github.com/aws/aws-sdk-go-v2/credentials v1.17.70/go.mod h1:M+lWhhmomVGgtuPOhO85u4pEa3SmssPTdcYpP/5J/xc=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32 h1:KAXP9JSHO1vKGCr5f4O6WmlVKLFFXgWYAGoJosorxzU=
-github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.32/go.mod h1:h4Sg6FQdexC1yYG9RDnOvLbW1a/P986++/Y/a+GyEM8=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.82 h1:EO13QJTCD1Ig2IrQnoHTRrn981H9mB7afXsZ89WptI4=
-github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.17.82/go.mod h1:AGh1NCg0SH+uyJamiJA5tTQcql4MMRDXGRdMmCxCXzY=
+github.com/aws/aws-sdk-go-v2/config v1.31.16 h1:E4Tz+tJiPc7kGnXwIfCyUj6xHJNpENlY11oKpRTgsjc=
+github.com/aws/aws-sdk-go-v2/config v1.31.16/go.mod h1:2S9hBElpCyGMifv14WxQ7EfPumgoeCPZUpuPX8VtW34=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.20 h1:KFndAnHd9NUuzikHjQ8D5CfFVO+bgELkmcGY8yAw98Q=
+github.com/aws/aws-sdk-go-v2/credentials v1.18.20/go.mod h1:9mCi28a+fmBHSQ0UM79omkz6JtN+PEsvLrnG36uoUv0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.12 h1:VO3FIM2TDbm0kqp6sFNR0PbioXJb/HzCDW6NtIZpIWE=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.12/go.mod h1:6C39gB8kg82tx3r72muZSrNhHia9rjGkX7ORaS2GKNE=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.2 h1:9/HxDeIgA7DcKK6e6ZaP5PQiXugYbNERx3Z5u30mN+k=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.20.2/go.mod h1:3N1RoxKNcVHmbOKVMMw8pvMs5TUhGYPQP/aq1zmAWqo=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
-github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
@@ -181,14 +219,16 @@ github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3x
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
+github.com/aws/aws-sdk-go-v2/service/kms v1.37.7 h1:dZmNIRtPUvtvUIIDVNpvtnJQ8N8Iqm7SQAxf18htZYw=
+github.com/aws/aws-sdk-go-v2/service/kms v1.37.7/go.mod h1:vj8PlfJH9mnGeIzd6uMLPi5VgiqzGG7AZoe1kf1uTXM=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 h1:hlSuz394kV0vhv9drL5lhuEFbEOEP1VyQpy15qWh1Pk=
 github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.5 h1:AIRJ3lfb2w/1/8wOOSqYb9fUKGwQbtysJ2H1MofRUPg=
-github.com/aws/aws-sdk-go-v2/service/sso v1.25.5/go.mod h1:b7SiVprpU+iGazDUqvRSLf5XmCdn+JtT1on7uNL6Ipc=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3 h1:BpOxT3yhLwSJ77qIY3DoHAQjZsc4HEGfMCE4NGy3uFg=
-github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.3/go.mod h1:vq/GQR1gOFLquZMSrxUK/cpvKCNVYibNyJ1m7JrU88E=
-github.com/aws/aws-sdk-go-v2/service/sts v1.34.0 h1:NFOJ/NXEGV4Rq//71Hs1jC/NvPs1ezajK+yQmkwnPV0=
-github.com/aws/aws-sdk-go-v2/service/sts v1.34.0/go.mod h1:7ph2tGpfQvwzgistp2+zga9f+bCjlQJPkPUmMgDSD7w=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.0 h1:xHXvxst78wBpJFgDW07xllOx0IAzbryrSdM4nMVQ4Dw=
+github.com/aws/aws-sdk-go-v2/service/sso v1.30.0/go.mod h1:/e8m+AO6HNPPqMyfKRtzZ9+mBF5/x1Wk8QiDva4m07I=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.4 h1:tBw2Qhf0kj4ZwtsVpDiVRU3zKLvjvjgIjHMKirxXg8M=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.4/go.mod h1:Deq4B7sRM6Awq/xyOBlxBdgW8/Z926KYNNaGMW2lrkA=
+github.com/aws/aws-sdk-go-v2/service/sts v1.39.0 h1:C+BRMnasSYFcgDw8o9H5hzehKzXyAb9GY5v/8bP9DUY=
+github.com/aws/aws-sdk-go-v2/service/sts v1.39.0/go.mod h1:4EjU+4mIx6+JqKQkruye+CaigV7alL3thVPfDd9VlMs=
 github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
 github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
@@ -207,6 +247,8 @@ github.com/bits-and-blooms/bitset v1.22.0 h1:Tquv9S8+SGaS3EhyA+up3FXzmkhxPGjQQCk
 github.com/bits-and-blooms/bitset v1.22.0/go.mod h1:7hO7Gc7Pp1vODcmWvKMRA9BNmbv6a/7QIWpPxHddWR8=
 github.com/bits-and-blooms/bloom/v3 v3.5.0 h1:AKDvi1V3xJCmSR6QhcBfHbCN4Vf8FfxeWkMNQfmAGhY=
 github.com/bits-and-blooms/bloom/v3 v3.5.0/go.mod h1:Y8vrn7nk1tPIlmLtW2ZPV+W7StdVMor6bC1xgpjMZFs=
+github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
+github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
 github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU=
 github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs=
 github.com/bodgit/sevenzip v1.6.1 h1:kikg2pUMYC9ljU7W9SaqHXhym5HyKm8/M/jd31fYan4=
@@ -295,6 +337,8 @@ github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
 github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/cpuguy83/go-md2man/v2 v2.0.5 h1:ZtcqGrnekaHpVLArFSe4HK5DoKx1T0rq2DwVB0alcyc=
+github.com/cpuguy83/go-md2man/v2 v2.0.5/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
 github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
 github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE=
@@ -326,6 +370,8 @@ github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf
 github.com/docker/go-connections v0.7.0/go.mod h1:no1qkHdjq7kLMGUXYAduOhYPSJxxvgWBh7ogVvptn3Q=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/dop251/goja v0.0.0-20260311135729-065cd970411c h1:OcLmPfx1T1RmZVHHFwWMPaZDdRf0DBMZOFMVWJa7Pdk=
+github.com/dop251/goja v0.0.0-20260311135729-065cd970411c/go.mod h1:MxLav0peU43GgvwVgNbLAj1s/bSGboKkhuULvq/7hx4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 h1:2tV76y6Q9BB+NEBasnqvs7e49aEBFI8ejC89PSnWH+4=
 github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707/go.mod h1:qssHWj60/X5sZFNxpG4HBPDHVqxNm4DfnCKgrbZOT+s=
 github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780/go.mod h1:Lj+Z9rebOhdfkVLjJ8T6VcRQv3SXugXy999NBtR9aFY=
@@ -341,8 +387,12 @@ github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FM
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.14.0 h1:hbG2kr4RuFj222B6+7T83thSPqLjwBIfQawTkC++2HA=
+github.com/envoyproxy/go-control-plane v0.14.0/go.mod h1:NcS5X47pLl/hfqxU70yPwL9ZMkUlwlKxtAohpi2wBEU=
 github.com/envoyproxy/go-control-plane/envoy v1.37.0 h1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=
 github.com/envoyproxy/go-control-plane/envoy v1.37.0/go.mod h1:DReE9MMrmecPy+YvQOAOHNYMALuowAnbjjEMkkWOi6A=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJPzVVHnPgRKdUdwW/KdbRt94AzgRee4=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v1.3.3 h1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=
 github.com/envoyproxy/protoc-gen-validate v1.3.3/go.mod h1:TsndJ/ngyIdQRhMcVVGDDHINPLWB7C82oDArY51KfB0=
@@ -375,6 +425,10 @@ github.com/geoffgarside/ber v1.2.0 h1:/loowoRcs/MWLYmGX9QtIAbA+V/FrnVLsMMPhwiRm6
 github.com/geoffgarside/ber v1.2.0/go.mod h1:jVPKeCbj6MvQZhwLYsGwaGI52oUorHoHKNecGT85ZCc=
 github.com/getkin/kin-openapi v0.144.0 h1:hIRcTH+KjLfkLpYU6bSSfdFpi0fZi1fp+hSPi4aQu9Y=
 github.com/getkin/kin-openapi v0.144.0/go.mod h1:3BH9M9XDe/y9M5DSvEocVYAYq1w0qrhJHjC/vZi0AaY=
+github.com/getsops/gopgagent v0.0.0-20240527072608-0c14999532fe h1:QKe/kmAYbndxwu91TcjHERsnMh5SgOB1x/qicvOdUJ8=
+github.com/getsops/gopgagent v0.0.0-20240527072608-0c14999532fe/go.mod h1:awFzISqLJoZLm+i9QQ4SgMNHDqljH6jWV0B36V5MrUM=
+github.com/getsops/sops/v3 v3.9.2 h1:Cuuahc/UGu7W3+NXd+mrl+2oXGxxj/jIPsw6Ah2CbxA=
+github.com/getsops/sops/v3 v3.9.2/go.mod h1:J8CMEdmPWT8gxFaNmPBSrc5NFd4uNndf8aFQwhD/ZR8=
 github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
 github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
 github.com/gin-gonic/gin v1.9.1 h1:4idEAncQnU5cB7BeOkPtxjfCSye0AAm1R0RVIqJ+Jmg=
@@ -393,8 +447,8 @@ github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmm
 github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4=
 github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII=
-github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00=
-github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ=
+github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY=
+github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
@@ -446,6 +500,8 @@ github.com/go-sourcemap/sourcemap v2.1.4+incompatible/go.mod h1:F8jJfvm2KbVjc5Nq
 github.com/go-sql-driver/mysql v1.10.0 h1:Q+1LV8DkHJvSYAdR83XzuhDaTykuDx0l6fkXxoWCWfw=
 github.com/go-sql-driver/mysql v1.10.0/go.mod h1:M+cqaI7+xxXGG9swrdeUIoPG3Y3KCkF0pZej+SK+nWk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
+github.com/go-test/deep v1.0.2/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
 github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
 github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/goburrow/cache v0.1.4 h1:As4KzO3hgmzPlnaMniZU9+VmoNYseUhuELbxy9mRBfw=
@@ -533,13 +589,17 @@ github.com/google/go-github/v30 v30.1.0 h1:VLDx+UolQICEOKu2m4uAoMti1SxuEBAl7RSEG
 github.com/google/go-github/v30 v30.1.0/go.mod h1:n8jBpHl45a/rlBUtRJMOG4GhNADUQFEufcolZ95JfU8=
 github.com/google/go-github/v50 v50.2.0/go.mod h1:VBY8FB6yPIjrtKhozXv4FQupxKLS6H4m6xFZlT43q8Q=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
-github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
 github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/go-querystring v1.2.0 h1:yhqkPbu2/OH+V9BfpCVPZkNmUXhb2gBxJArfhIxNtP0=
+github.com/google/go-querystring v1.2.0/go.mod h1:8IFJqpSRITyJ8QhQ13bmbeMBDfmeEJZD5A0egEOmkqU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
 github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
+github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -551,12 +611,18 @@ github.com/google/pprof v0.0.0-20240227163752-401108e1b7e7/go.mod h1:czg5+yv1E0Z
 github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8 h1:FKHo8hFI3A+7w0aUQuYXQ+6EN5stWmeY/AZqtM8xk9k=
 github.com/google/pprof v0.0.0-20240727154555-813a5fbdbec8/go.mod h1:K1liHPHnj73Fdn/EKuT8nrFqBihUSKXoLYU0BuatOYo=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/s2a-go v0.1.9 h1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=
+github.com/google/s2a-go v0.1.9/go.mod h1:YA0Ei2ZQL3acow2O62kdp9UlnvMmU7kA6Eutn0dXayM=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11 h1:vAe81Msw+8tKUxi2Dqh/NZMz7475yUvmRIkXr4oN2ao=
+github.com/googleapis/enterprise-certificate-proxy v0.3.11/go.mod h1:RFV7MUdlb7AgEq2v7FmMCfeSMCllAzWxFgRdusoGks8=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/googleapis/gax-go/v2 v2.17.0 h1:RksgfBpxqff0EZkDWYuz9q/uWsTVz+kf43LsZ1J6SMc=
+github.com/googleapis/gax-go/v2 v2.17.0/go.mod h1:mzaqghpQp4JDh3HvADwrat+6M3MOIDp5YKHhb9PAgDY=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
 github.com/gorilla/css v1.0.1 h1:ntNaBIghp6JmvWnxbZKANoLyuXTPZ4cAMlo6RyhlbO8=
@@ -571,24 +637,43 @@ github.com/gosimple/slug v1.15.0 h1:wRZHsRrRcs6b0XnxMUBM6WK1U1Vg5B0R7VkIf1Xzobo=
 github.com/gosimple/slug v1.15.0/go.mod h1:UiRaFH+GEilHstLUmcBgWcI42viBN7mAb818JrYOeFQ=
 github.com/gosimple/unidecode v1.0.1 h1:hZzFTMMqSswvf0LBJZCZgThIZrpDHFXux9KeGmn6T/o=
 github.com/gosimple/unidecode v1.0.1/go.mod h1:CP0Cr1Y1kogOtx0bJblKzsVWrqYaqfNOnHzpgWw4Awc=
+github.com/goware/prefixer v0.0.0-20160118172347-395022866408 h1:Y9iQJfEqnN3/Nce9cOegemcy/9Ai5k3huT6E80F3zaw=
+github.com/goware/prefixer v0.0.0-20160118172347-395022866408/go.mod h1:PE1ycukgRPJ7bJ9a1fdfQ9j8i/cEcRAoLZzbxYpNB/s=
 github.com/h2non/filetype v1.1.3 h1:FKkx9QbD7HR/zjK1Ia5XiBsq9zdLi5Kf3zGyFTAFkGg=
 github.com/h2non/filetype v1.1.3/go.mod h1:319b3zT68BvV+WRj7cwy856M2ehB3HqNOt6sy1HndBY=
+github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
 github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
+github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
+github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 h1:iBt4Ew4XEGLfh6/bPk4rSYmuZJGizr6/x/AEizP0CQc=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8/go.mod h1:aiJI+PIApBRQG7FZTEBx5GiiX+HbOHilUdNxUZi4eV0=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
+github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-version v1.5.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/go-version v1.8.0 h1:KAkNb1HAiZd1ukkxDFGmokVZe1Xy9HG6NUp+bPle2i4=
-github.com/hashicorp/go-version v1.8.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
+github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
 github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/vault/api v1.15.0 h1:O24FYQCWwhwKnF7CuSqP30S51rTV7vz1iACXE/pj5DA=
+github.com/hashicorp/vault/api v1.15.0/go.mod h1:+5YTO09JGn0u+b6ySD/LLVf8WkJCPLAL2Vkmrn2+CM8=
 github.com/hbakhtiyor/strsim v0.0.0-20190107154042-4d2bbb273edf h1:umfGUaWdFP2s6457fz1+xXYIWDxdGc7HdkLS9aJ1skk=
 github.com/hbakhtiyor/strsim v0.0.0-20190107154042-4d2bbb273edf/go.mod h1:V99KdStnMHZsvVOwIvhfcUzYgYkRZeQWUtumtL+SKxA=
 github.com/hdm/jarm-go v0.0.7/go.mod h1:kinGoS0+Sdn1Rr54OtanET5E5n7AlD6T6CrJAKDjJSQ=
@@ -701,8 +786,8 @@ github.com/lor00x/goldap v0.0.0-20240304151906-8d785c64d1c8 h1:z9RDOBcFcf3f2hSfK
 github.com/lor00x/goldap v0.0.0-20240304151906-8d785c64d1c8/go.mod h1:37YR9jabpiIxsb8X9VCIx8qFOjTDIIrIHHODa8C4gz0=
 github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
 github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
-github.com/lufia/plan9stats v0.0.0-20250827001030-24949be3fa54 h1:mFWunSatvkQQDhpdyuFAYwyAan3hzCuma+Pz8sqvOfg=
-github.com/lufia/plan9stats v0.0.0-20250827001030-24949be3fa54/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
+github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3 h1:PwQumkgq4/acIiZhtifTV5OUqqiP82UAl0h87xj/l9k=
+github.com/lufia/plan9stats v0.0.0-20251013123823-9fd1530e3ec3/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/mackerelio/go-osstat v0.2.6 h1:gs4U8BZeS1tjrL08tt5VUliVvSWP26Ai2Ob8Lr7f2i0=
 github.com/mackerelio/go-osstat v0.2.6/go.mod h1:lRy8V9ZuHpuRVZh+vyTkODeDPl3/d5MgXHtLSaqG8bA=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
@@ -744,6 +829,10 @@ github.com/minio/selfupdate v0.6.1-0.20230907112617-f11e74f84ca7/go.mod h1:bO02G
 github.com/minio/sha256-simd v0.1.1/go.mod h1:B5e1o+1/KgNmWrSQK08Y6Z1Vb5pwIktudl0J58iy0KM=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
+github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
+github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
@@ -825,48 +914,46 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
 github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1:t/avpk3KcrXxUnYOhZhMXJlSEyie6gQbtLq5NM3loB8=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 h1:o4JXh1EVt9k/+g42oCprj/FisM4qX9L3sZB3upGN2ZU=
 github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55/go.mod h1:OmDBASR4679mdNQnz2pUhc2G8CO2JrUAVFDRBDP/hJE=
 github.com/praetorian-inc/fingerprintx v1.1.15 h1:CVIxrIQARbmdk5h8E9tIJZbvFoY2sGLLG9rpFVfQqpA=
 github.com/praetorian-inc/fingerprintx v1.1.15/go.mod h1:hqRroITBwKpP8BOGF+n/A+qv9wSF7OSVinmu5NCyOUI=
 github.com/projectdiscovery/asnmap v1.1.1 h1:ImJiKIaACOT7HPx4Pabb5dksolzaFYsD1kID2iwsDqI=
 github.com/projectdiscovery/asnmap v1.1.1/go.mod h1:QT7jt9nQanj+Ucjr9BqGr1Q2veCCKSAVyUzLXfEcQ60=
-github.com/projectdiscovery/blackrock v0.0.1 h1:lHQqhaaEFjgf5WkuItbpeCZv2DUIE45k0VbGJyft6LQ=
-github.com/projectdiscovery/blackrock v0.0.1/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss=
-github.com/projectdiscovery/cdncheck v1.2.46 h1:ELtTCaT5dLigd0FGmw6z+JuIpbFAr422hbgAFXMmKvY=
-github.com/projectdiscovery/cdncheck v1.2.46/go.mod h1:9oE9KKxCSHNvUf0UaMeqqUwWpC38FkNaTll0ScIBT3w=
-github.com/projectdiscovery/clistats v0.1.4 h1:kDnXoNxIdOvQElOF7k2Mt6XosGa5GbMKPtRXdPHMVzU=
-github.com/projectdiscovery/clistats v0.1.4/go.mod h1:hjJYNcUubk9T3cuFvA+JkLhZGjzYW50fkC48dqUAtbU=
-github.com/projectdiscovery/dsl v0.8.20 h1:CxWcKuoHFpOSS1kzqnbJuK5No/6qoRG8IzNDMnZ6c/M=
-github.com/projectdiscovery/dsl v0.8.20/go.mod h1:e1oHi7mxAxF+UhBhD5gOk90Ga6LQqvFea2voMO1E5D0=
-github.com/projectdiscovery/fastdialer v0.5.14 h1:83hkWNnbWq8IxDM65h1CCmHf/GoVj1fpwbR+wACiBhA=
-github.com/projectdiscovery/fastdialer v0.5.14/go.mod h1:+QaDuVAsvPk4VPSk9aVQCdZzHVbtI9+2BeeFhQUyebo=
+github.com/projectdiscovery/blackrock v0.0.2 h1:mxXdu0uM8P2L2Qi210COlU8QiICPFW/Rxk5QUhlPO2k=
+github.com/projectdiscovery/blackrock v0.0.2/go.mod h1:ANUtjDfaVrqB453bzToU+YB4cUbvBRpLvEwoWIwlTss=
+github.com/projectdiscovery/cdncheck v1.2.51 h1:uB+/JdG39HaP3GQ3ncBsWmPh/8cbYmJ3p/UxstHZl0o=
+github.com/projectdiscovery/cdncheck v1.2.51/go.mod h1:GIAA0SqjDfxzDQjHR/X+bK05BGmUGfsVplP5Zdv/kHA=
+github.com/projectdiscovery/clistats v0.1.6 h1:e2Hc7cVWKJ4sCbyQ7th5zuBvgqsZcLwRq1qY0vmQXY4=
+github.com/projectdiscovery/clistats v0.1.6/go.mod h1:RxRGxhMzkT344VTTvZWIrojurUXdQQRN1yfwgg/88I8=
+github.com/projectdiscovery/dsl v0.8.22 h1:ZfPunLaaYUJTBffE1ShuAAV9hkSH2thvlszK48FlZS0=
+github.com/projectdiscovery/dsl v0.8.22/go.mod h1:fr8WMU381As89e4Z+SQ8tYQ1NudniWAS6NLPHrhe+Vs=
+github.com/projectdiscovery/fastdialer v0.5.19 h1:FQOoGGaCyreq53yz3QI+KztvOKn2M9OXJqNg7/4e03w=
+github.com/projectdiscovery/fastdialer v0.5.19/go.mod h1:6I4/kPu9s/LTUgmPqIc0ZOEh8TfZGY0Nlr5M84cFAj8=
 github.com/projectdiscovery/fasttemplate v0.0.2 h1:h2cISk5xDhlJEinlBQS6RRx0vOlOirB2y3Yu4PJzpiA=
 github.com/projectdiscovery/fasttemplate v0.0.2/go.mod h1:XYWWVMxnItd+r0GbjA1GCsUopMw1/XusuQxdyAIHMCw=
 github.com/projectdiscovery/freeport v0.0.7 h1:Q6uXo/j8SaV/GlAHkEYQi8WQoPXyJWxyspx+aFmz9Qk=
 github.com/projectdiscovery/freeport v0.0.7/go.mod h1:cOhWKvNBe9xM6dFJ3RrrLvJ5vXx2NQ36SecuwjenV2k=
 github.com/projectdiscovery/gcache v0.0.0-20241015120333-12546c6e3f4c h1:s+lLAlrOrgwlPZQ9DFqNw+kia2nteKnJZ2Ek313yoUc=
 github.com/projectdiscovery/gcache v0.0.0-20241015120333-12546c6e3f4c/go.mod h1:rN35/D3lVx2YDeENFFz06uj8j3XIqK1Ym9XcISF5fzg=
-github.com/projectdiscovery/goflags v0.1.75 h1:njEBnyueQaFa2ptWxbyl9zX0OClNdlN2AzZveNHiBOs=
-github.com/projectdiscovery/goflags v0.1.75/go.mod h1:7nAP1r2Dqgn/rwmOE3EWbZWUCEJKNIhVSBGpuzJAIns=
+github.com/projectdiscovery/goflags v0.2.0 h1:zj16hnTmLmlnVYm02hfOrCY6oYTu/AQDBE99yZkS+s8=
+github.com/projectdiscovery/goflags v0.2.0/go.mod h1:7nAP1r2Dqgn/rwmOE3EWbZWUCEJKNIhVSBGpuzJAIns=
 github.com/projectdiscovery/goja v0.0.0-20260618133720-acb73e419534 h1:hYd1zQA/dxO2ASyQ6Re73TcJkW1LjLQvt4+86Hxefz8=
 github.com/projectdiscovery/goja v0.0.0-20260618133720-acb73e419534/go.mod h1:SO0AP+uKfYeeoR6jyVH/PKRYJE/f5gJrPMAM00iGEMc=
 github.com/projectdiscovery/goja_nodejs v0.0.0-20260618132410-8519f75f703d h1:fqqH9LHpN2WDz9QuxFrhKNxXSRtzk+Sa6jAhbB7tXcQ=
 github.com/projectdiscovery/goja_nodejs v0.0.0-20260618132410-8519f75f703d/go.mod h1:Ezmbgdaw4EunGGBU4MQViLoGMJc37LA3ip55YV3KeRI=
-github.com/projectdiscovery/gologger v1.1.71 h1:IYU4mw9viKdSzMTIGVpYuw1Gtg7QIHIStqAQgeNXcBQ=
-github.com/projectdiscovery/gologger v1.1.71/go.mod h1:mJwODZcFDg70ihINpOvZevmBtgvpP8H9/l8Y+OPhZPY=
+github.com/projectdiscovery/gologger v1.1.72 h1:PKk+aSx3jYOCBPi+FD+nTnhe+Vxx9u3K7Ega0GVlMCI=
+github.com/projectdiscovery/gologger v1.1.72/go.mod h1:mJwODZcFDg70ihINpOvZevmBtgvpP8H9/l8Y+OPhZPY=
 github.com/projectdiscovery/gostruct v0.0.2 h1:s8gP8ApugGM4go1pA+sVlPDXaWqNP5BBDDSv7VEdG1M=
 github.com/projectdiscovery/gostruct v0.0.2/go.mod h1:H86peL4HKwMXcQQtEa6lmC8FuD9XFt6gkNR0B/Mu5PE=
 github.com/projectdiscovery/govaluate v0.0.0-20260615100919-5ee2581bbf7e h1:vxzgQlz2Cy/YvizYDQx9OhucBcmBotfDhbQ4yCY2vfA=
 github.com/projectdiscovery/govaluate v0.0.0-20260615100919-5ee2581bbf7e/go.mod h1:xH7bPwHxUlz1yx9UlVeTF+UVCUaKhTnZgaxHb5z362E=
 github.com/projectdiscovery/gozero v0.1.1-0.20260530071156-fa1dad563d76 h1:AN70bbi6BBs7KpIM9w0LxygUN7uzT/oH+owDIQ+Fz/k=
 github.com/projectdiscovery/gozero v0.1.1-0.20260530071156-fa1dad563d76/go.mod h1:cWHYnRXoYWHtTpOYyAp5laGYX8GH8ITUhgQaP8G/8FA=
-github.com/projectdiscovery/hmap v0.0.101 h1:zXM6YtLmsn8Q0CUUw8QavhqWmiQYwaw+/U679Rr00pc=
-github.com/projectdiscovery/hmap v0.0.101/go.mod h1:w6N9/a5H8kvyx53AhtPDUWe5Qq3D6NBDPA23glHpa/Q=
-github.com/projectdiscovery/httpx v1.10.0 h1:sZvfeJDeX4eJfB5Oh29My4gOHmLfvpCt2wCqhargJrE=
-github.com/projectdiscovery/httpx v1.10.0/go.mod h1:gfdNnFznLLlAgAgSQlYjUeEVvYzKrNV0jO5Qyo5w+FI=
+github.com/projectdiscovery/hmap v0.0.102 h1:ybPuf7UQvuOLiHLOUbVMvd+PSlItQU5iQpP1Erl8kaU=
+github.com/projectdiscovery/hmap v0.0.102/go.mod h1:IZ92wXFmxYpdn0euZ7VFmypzOBNDwq8c3yRyIIol6XE=
+github.com/projectdiscovery/httpx v1.11.0 h1:0jPnhqiCMlkcEGv5qFVkBYUX7BRbe3gStvDkBZdkbYs=
+github.com/projectdiscovery/httpx v1.11.0/go.mod h1:parFzVgFWVb7qDgyPgztD2I2OaVGJl8CCKGLPkWaObA=
 github.com/projectdiscovery/interactsh v1.3.1 h1:5HzeVGVCAX/cjTguJ+7ClOmML5r97Ty7op9s+/F7BiM=
 github.com/projectdiscovery/interactsh v1.3.1/go.mod h1:MXQ11EoBPROb4bEw+WP9e4DX4fMhrpS6EwfMfZomBsw=
 github.com/projectdiscovery/ldapserver v1.0.2-0.20240219154113-dcc758ebc0cb h1:MGtI4oE12ruWv11ZlPXXd7hl/uAaQZrFvrIDYDeVMd8=
@@ -877,34 +964,34 @@ github.com/projectdiscovery/mapcidr v1.1.97 h1:7FkxNNVXp+m1rIu5Nv/2SrF9k4+LwP8Qu
 github.com/projectdiscovery/mapcidr v1.1.97/go.mod h1:9dgTJh1SP02gYZdpzMjm6vtYFkEHQHoTyaVNvaeJ7lA=
 github.com/projectdiscovery/n3iwf v0.0.0-20230523120440-b8cd232ff1f5 h1:L/e8z8yw1pfT6bg35NiN7yd1XKtJap5Nk6lMwQ0RNi8=
 github.com/projectdiscovery/n3iwf v0.0.0-20230523120440-b8cd232ff1f5/go.mod h1:pGW2ncnTxTxHtP9wzcIJAB+3/NMp6IiuQWd2NK7K+oc=
-github.com/projectdiscovery/networkpolicy v0.1.44 h1:+fnpYNQVH9mYZY7VrsTqdL4YJGVZSA8XLAlRHBMl5QE=
-github.com/projectdiscovery/networkpolicy v0.1.44/go.mod h1:q1KeQiHchXdElScEMWc5mShWNRNoJXI5koRnVaX6Qh8=
+github.com/projectdiscovery/networkpolicy v0.1.49 h1:4F2lIy/iZUfLltpAwudXF/93CCICipr+pBshz5Ozts4=
+github.com/projectdiscovery/networkpolicy v0.1.49/go.mod h1:wm/KWiKQ9I0LLowandFnLiSype7HEvilXVjEwNLk2PE=
 github.com/projectdiscovery/ratelimit v0.0.88 h1:AcurW9aLRzlEyPe9kSjnOpr3XzLMWTpiWAlW/w73ALU=
 github.com/projectdiscovery/ratelimit v0.0.88/go.mod h1:CU1s+68UUG2mctSl2wi32/DHLJA6TMg+4rxgP59LfVk=
-github.com/projectdiscovery/rawhttp v0.1.91 h1:6EIhZxCkBn27kJAl47FieCFCe4H2ZdbhoBVj0J6ZCVY=
-github.com/projectdiscovery/rawhttp v0.1.91/go.mod h1:VZYAM25UI/wVB3URZ95ZaftgOnsbphxyAw/XnQRRz4Y=
+github.com/projectdiscovery/rawhttp v0.1.92 h1:38GRsVLNllES/dZcEcA6s6P+rYBp34H9mDphMJMDvvg=
+github.com/projectdiscovery/rawhttp v0.1.92/go.mod h1:spfXTPjxCj+bfWLynMVB7uOb+LS3PDNAI9HexMEV1Zg=
 github.com/projectdiscovery/rdap v0.9.0 h1:wPhHx5pQ2QI+WGhyNb2PjhTl0NtB39Nk7YFZ9cp8ZGA=
 github.com/projectdiscovery/rdap v0.9.0/go.mod h1:zk4yrJFQ2Hy36Aqk+DvotYQxYAeALaCJ5ORySkff36Q=
-github.com/projectdiscovery/retryabledns v1.0.115 h1:RKV63FNIznFHUoawg/1hs53pVH3wqPtFhwstCuxVSoA=
-github.com/projectdiscovery/retryabledns v1.0.115/go.mod h1:+fEMWoPigw+M0lGNKY7AZ+g8FIgj+4sONjsinMmeL3k=
-github.com/projectdiscovery/retryablehttp-go v1.3.21 h1:HytR9e8AfhIF/4xUo6szqg213a7pOq5tE3kpNZCyYwI=
-github.com/projectdiscovery/retryablehttp-go v1.3.21/go.mod h1:0SCELxSKpkqHTy9pcZDZ2ry+5djp4geKpEURJ1uSB24=
+github.com/projectdiscovery/retryabledns v1.0.116 h1:tK28PJ4tLO7bgM89RpIFjkfTPMSbRegwvg9mN/q6z78=
+github.com/projectdiscovery/retryabledns v1.0.116/go.mod h1:r3vH0AKYtJ9fculcqRFrdVYe2ABcHwZeR4C6j3rqCbY=
+github.com/projectdiscovery/retryablehttp-go v1.3.25 h1:caWjhagt49zkSbaOZnsD+qi8UwfgbofezHOtYPHvhb0=
+github.com/projectdiscovery/retryablehttp-go v1.3.25/go.mod h1:+lyetyXnmFCGzjfebzVCsszts9JHkKncal+nNwYeqCs=
 github.com/projectdiscovery/sarif v0.1.0 h1:O541T+a448nSJsmIMnXXSOeDQEzpnCAYvRfe0eG5h74=
 github.com/projectdiscovery/sarif v0.1.0/go.mod h1:LBC+reM3bkI3qIIhE0rZaINaYX6VG+En6u2hHa5mA7E=
 github.com/projectdiscovery/stringsutil v0.0.2 h1:uzmw3IVLJSMW1kEg8eCStG/cGbYYZAja8BH3LqqJXMA=
 github.com/projectdiscovery/stringsutil v0.0.2/go.mod h1:EJ3w6bC5fBYjVou6ryzodQq37D5c6qbAYQpGmAy+DC0=
-github.com/projectdiscovery/tlsx v1.2.2 h1:Y96QBqeD2anpzEtBl4kqNbwzXh2TrzJuXfgiBLvK+SE=
-github.com/projectdiscovery/tlsx v1.2.2/go.mod h1:ZJl9F1sSl0sdwE+lR0yuNHVX4Zx6tCSTqnNxnHCFZB4=
+github.com/projectdiscovery/tlsx v1.3.2 h1:1Lh2ith79o8R+rOOSBZiMq8EiZ8j4D3T/8ENO+gAqXA=
+github.com/projectdiscovery/tlsx v1.3.2/go.mod h1:2wgTGC/sourHvoR+RX8cAok0Sa8YK6QbEP3xo5SDzPI=
 github.com/projectdiscovery/uncover v1.2.1 h1:8U46T/96CLT7BPoXBgkTvWqB06lOyeTSLvh5+UjzATE=
 github.com/projectdiscovery/uncover v1.2.1/go.mod h1:0p8onrWxfpXQEYs90ZDzTSpu1107gWmodX1NWqu/+z4=
-github.com/projectdiscovery/useragent v0.0.108 h1:fb+uLuFJvC+MHZjCtxQJxtvp1X6A8n98CUGPyFcg3NE=
-github.com/projectdiscovery/useragent v0.0.108/go.mod h1:XdNRrlvtDmYfVL1Oybat4uMe+W6cLwsK9S18ond17CI=
-github.com/projectdiscovery/utils v0.11.1 h1:PWj1KjIASxt8icxommH72C0TQqNOvGkcSODRkiq0SQw=
-github.com/projectdiscovery/utils v0.11.1/go.mod h1:yktGrHGk2CTjNiccXovnvGrLHX9sV2bqz9nSnbA3V8M=
-github.com/projectdiscovery/wappalyzergo v0.2.91 h1:pjbEOCJKmxfEG5xK3WnUNY4SuYjPoYUuAUxa3F1QN1Y=
-github.com/projectdiscovery/wappalyzergo v0.2.91/go.mod h1:gMH0o5lBp65sKMwHx/tuUdOtW2RjodC6Ti+9QDsYMkY=
-github.com/projectdiscovery/yamldoc-go v1.0.6 h1:GCEdIRlQjDux28xTXKszM7n3jlMf152d5nqVpVoetas=
-github.com/projectdiscovery/yamldoc-go v1.0.6/go.mod h1:R5lWrNzP+7Oyn77NDVPnBsxx2/FyQZBBkIAaSaCQFxw=
+github.com/projectdiscovery/useragent v0.0.109 h1:b86BPdZvmgbJousa04jAugDRY4Y+rAvEamE0TFCPmeE=
+github.com/projectdiscovery/useragent v0.0.109/go.mod h1:sRyBqDAcD31RKYrO8fyXGowLd36fNwY1g0MNW9mp7zk=
+github.com/projectdiscovery/utils v0.11.3 h1:TNBhSNJ8uFw7DWASUHBf1vfCx7mwMi+jtGizrizMM5s=
+github.com/projectdiscovery/utils v0.11.3/go.mod h1:HMxhxLigsAr+M9Oa8n9Z0ROZcs8wAJHGsgR7UGb+oUE=
+github.com/projectdiscovery/wappalyzergo v0.2.96 h1:/YHMiUA2kL2bap2vHDuZs1cJK3RgHZjxdVam5GxJ12k=
+github.com/projectdiscovery/wappalyzergo v0.2.96/go.mod h1:5ZuunxbKPGvnJeEOMIqlfj5xg/XSEAoakZr/s9l2pNI=
+github.com/projectdiscovery/yamldoc-go v1.0.7 h1:Odmjd1o4EkMff2F6QHi1dIYPIQPZUFy24YqmQCprmTk=
+github.com/projectdiscovery/yamldoc-go v1.0.7/go.mod h1:nqD1iPMcofpRA1DbXavPByJhWURrshT+l8WN9XjyQag=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
 github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
@@ -946,9 +1033,15 @@ github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
 github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
 github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
+github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
+github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
+github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d h1:hrujxIzL1woJ7AwssoOcM/tq5JjjG2yYOc8odClEiXA=
 github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU=
+github.com/sandrolain/httpcache v1.4.0 h1:Jf4Vx62X2ybvNPSpPvI1kT3xvMdDG1AsApQjOQKO9E0=
+github.com/sandrolain/httpcache v1.4.0/go.mod h1:kHBuXveitSn39SNPBhdf/ybG272X706HJ2RJqOQ+Em0=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
 github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
 github.com/sashabaranov/go-openai v1.37.0 h1:hQQowgYm4OXJ1Z/wTrE+XZaO20BYsL0R3uRPSpfNZkY=
@@ -992,8 +1085,8 @@ github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
 github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/spiffe/go-spiffe/v2 v2.6.0 h1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=
-github.com/spiffe/go-spiffe/v2 v2.6.0/go.mod h1:gm2SeUoMZEtpnzPNs2Csc0D/gX33k1xIx7lEzqblHEs=
+github.com/spiffe/go-spiffe/v2 v2.7.0 h1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=
+github.com/spiffe/go-spiffe/v2 v2.7.0/go.mod h1:47Q0Q9/AqGha8QLHp+kxpH4Wca7X7EnOtlIJy3mxZ3U=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
@@ -1012,9 +1105,10 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.3/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
-github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/syndtr/goleveldb v1.0.0 h1:fBdIW9lB4Iz0n9khmH8w27SJ3QEJ7+IgjPEwGSZiFdE=
 github.com/syndtr/goleveldb v1.0.0/go.mod h1:ZVVdQEZoIme9iO1Ch2Jdy24qqXrMMOU6lpPAyBWyWuQ=
 github.com/tarunKoyalwar/goleak v0.0.0-20240429141123-0efa90dbdcf9 h1:GXIyLuIJ5Qk46lI8WJ83qHBZKUI3zhmMmuoY9HICUIQ=
@@ -1061,6 +1155,8 @@ github.com/ugorji/go/codec v1.2.11/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZ
 github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
+github.com/urfave/cli v1.22.16 h1:MH0k6uJxdwdeWQTwhSO42Pwr4YLrNLwBtg1MRgTqPdQ=
+github.com/urfave/cli v1.22.16/go.mod h1:EeJR6BKodywf4zciqrdw6hpCPk68JO9z5LazXZMn5Po=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/vmihailenco/bufpool v0.1.11 h1:gOq2WmBrq0i2yW5QJ16ykccQ4wH9UyEsgLm6czKAd94=
@@ -1170,16 +1266,24 @@ go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
 go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/detectors/gcp v1.44.0 h1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=
+go.opentelemetry.io/contrib/detectors/gcp v1.44.0/go.mod h1:tNAsgd8avTGke1+MndXlU5Cru4PQ9Ai/cCNWQv/ZJ/s=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 h1:CqXxU8VOmDefoh0+ztfGaymYbhdB/tT3zs79QaZTNGY=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0/go.mod h1:BuhAPThV8PBHBvg8ZzZ/Ok3idOdhWIodywz2xEcRbJo=
 go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=
 go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw=
 go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=
 go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo=
-go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg=
-go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg=
-go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw=
-go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A=
+go.opentelemetry.io/otel/metric/x v0.66.0 h1:YkCrx1zLOChi9ZcZ6euupOcsgzbVlec7D/xoEU1+cTA=
+go.opentelemetry.io/otel/metric/x v0.66.0/go.mod h1:d1+BDj9t96do0/1LoU1ayfCv79ZgNE41qbhBvnMOBZk=
+go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=
+go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0=
+go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=
+go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA=
 go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=
 go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@@ -1190,8 +1294,8 @@ go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
 go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
 go.uber.org/zap/exp v0.3.0 h1:6JYzdifzYkGmTdRR59oYH+Ng7k49H9qVpWwNSsGJj3U=
 go.uber.org/zap/exp v0.3.0/go.mod h1:5I384qq7XGxYyByIhHm6jg5CHkGY0nsTfbDLgDDlgJQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc=
 go4.org v0.0.0-20230225012048-214862532bf5/go.mod h1:F57wTi5Lrj6WLyswp5EYV1ncrEbFGHD4hhz6S1ZYeaU=
 goftp.io/server/v2 v2.0.1 h1:H+9UbCX2N206ePDSVNCjBftOKOgil6kQ5RAQNx5hJwE=
@@ -1222,8 +1326,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
-golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
-golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
+golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -1261,8 +1365,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
+golang.org/x/mod v0.39.0 h1:UF5zwQdCRRUpHfyPwr7d4UrGiVeldIsogtzWVnczL74=
+golang.org/x/mod v0.39.0/go.mod h1:bvIbwjQ0HUFFf5AKukeeYQG4ZBUG9yxQbR9aEweIwYY=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -1312,8 +1416,8 @@ golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
 golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=
+golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -1341,8 +1445,8 @@ golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
 golang.org/x/sync v0.10.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
-golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
+golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1409,8 +1513,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
-golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -1424,8 +1528,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
-golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
-golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -1443,13 +1547,13 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
-golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
+golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
-golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -1496,8 +1600,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -1520,6 +1624,8 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
+google.golang.org/api v0.264.0 h1:+Fo3DQXBK8gLdf8rFZ3uLu39JpOnhvzJrLMQSoSYZJM=
+google.golang.org/api v0.264.0/go.mod h1:fAU1xtNNisHgOF5JooAs8rRaTkl2rT3uaoNGo9NS3R8=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -1556,8 +1662,12 @@ google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7Fc
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409 h1:VQZ/yAbAtjkHgH80teYd2em3xtIkkHd7ZhqfH2N9CsM=
+google.golang.org/genproto v0.0.0-20260128011058-8636f8732409/go.mod h1:rxKD3IEILWEu3P44seeNOAwZN4SaoKaQ/2eTg4mM6EM=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa h1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:q4lMZS6kskjT5HvCPrnnypcDPVJqT/f4nfxmkE7gryY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -1570,8 +1680,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
-google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y=
+google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -1602,6 +1712,8 @@ gopkg.in/corvus-ch/zbase32.v1 v1.0.0/go.mod h1:T3oKkPOm4AV/bNXCNFUxRmlE9RUyBz/DS
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/ini.v1 v1.42.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
+gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22/go.mod h1:yeKp02qBN3iKW1OzL3MGk2IdtZzaj7SFntXj72NppTA=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
@@ -0,0 +1,198 @@
+package configuration
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime"
+	"slices"
+
+	"github.com/adrg/xdg"
+	"github.com/projectdiscovery/goflags"
+	catalogconfig "github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+)
+
+// Selection contains the config and profile selected for one invocation.
+type Selection struct {
+	Config  string
+	Profile string
+}
+
+// Load applies automatic config files, one selected config file, and one
+// selected profile in priority order. Explicit CLI flags retain precedence.
+func Load(
+	cfg *catalogconfig.Config,
+	flagSet *goflags.FlagSet,
+	selected *Selection,
+	resolveProfile func(string) (string, error),
+	args ...string,
+) ([]error, error) {
+	userConfigFile := cfg.GetFlagsConfigFilePath()
+	defaultUserConfigFile := filepath.Join(xdg.ConfigHome, catalogconfig.BinaryName, catalogconfig.CLIConfigFileName)
+	automaticFiles := automaticConfigFiles(xdg.ConfigDirs, runtime.GOOS, userConfigFile)
+
+	return loadConfigFiles(userConfigFile, defaultUserConfigFile, automaticFiles, flagSet, selected, resolveProfile, args...)
+}
+
+func loadConfigFiles(
+	userConfigFile string,
+	defaultUserConfigFile string,
+	automaticFiles []string,
+	flagSet *goflags.FlagSet,
+	selected *Selection,
+	resolveProfile func(string) (string, error),
+	args ...string,
+) ([]error, error) {
+
+	var warnings []error
+	if err := prepareUserConfigFile(userConfigFile, defaultUserConfigFile); err != nil {
+		warnings = append(warnings, err)
+	}
+
+	flagSet.SetConfigFilePaths(automaticFiles...)
+	if err := flagSet.Parse(args...); err != nil {
+		warnings = append(warnings, fmt.Errorf("automatic configuration was ignored: %w", err))
+	}
+
+	if err := mergeSelectedFiles(flagSet, selected, resolveProfile); err != nil {
+		return warnings, err
+	}
+
+	return warnings, nil
+}
+
+func mergeSelectedFiles(
+	flagSet *goflags.FlagSet,
+	selected *Selection,
+	resolveProfile func(string) (string, error),
+) error {
+	configFile := selected.Config
+	if configFile != "" {
+		if err := flagSet.MergeConfigFile(configFile); err != nil {
+			return fmt.Errorf("read config file %q: %w", configFile, err)
+		}
+
+		// A selected config may choose a profile, but it cannot redirect its
+		// completed config stage.
+		selected.Config = configFile
+	}
+
+	if selected.Profile == "" {
+		return nil
+	}
+
+	profileFile, err := resolveProfile(selected.Profile)
+	if err != nil {
+		return err
+	}
+	if err := flagSet.MergeConfigFile(profileFile); err != nil {
+		return fmt.Errorf("read template profile %q: %w", profileFile, err)
+	}
+
+	// A profile cannot redirect either completed file-selection stage.
+	selected.Config = configFile
+	selected.Profile = profileFile
+
+	return nil
+}
+
+func automaticConfigFiles(configDirs []string, goos, userConfigFile string) []string {
+	highestFirst := make([]string, 0, len(configDirs)+2)
+	highestFirst = append(highestFirst, userConfigFile)
+
+	if unixSystemFile := unixSystemConfigFilePath(goos); unixSystemFile != "" {
+		highestFirst = append(highestFirst, unixSystemFile)
+	}
+
+	for _, configDir := range configDirs {
+		if filepath.IsAbs(configDir) {
+			highestFirst = append(highestFirst, filepath.Join(configDir, catalogconfig.BinaryName, catalogconfig.CLIConfigFileName))
+		}
+	}
+
+	files := make([]string, 0, len(highestFirst))
+	seen := make(map[string]struct{}, len(highestFirst))
+
+	for _, file := range highestFirst {
+		if file == "" {
+			continue
+		}
+
+		cleanFile := filepath.Clean(file)
+		if _, exists := seen[cleanFile]; exists {
+			continue
+		}
+
+		seen[cleanFile] = struct{}{}
+		files = append(files, file)
+	}
+
+	slices.Reverse(files)
+
+	return files
+}
+
+func unixSystemConfigFilePath(goos string) string {
+	switch goos {
+	case "aix", "darwin", "dragonfly", "freebsd", "linux", "netbsd", "openbsd", "solaris":
+		return path.Join("/etc", catalogconfig.BinaryName, catalogconfig.CLIConfigFileName)
+	default:
+		return ""
+	}
+}
+
+func prepareUserConfigFile(configFile, defaultConfigFile string) error {
+	if filepath.Clean(configFile) == filepath.Clean(defaultConfigFile) {
+		return nil
+	}
+
+	if _, err := os.Stat(configFile); err == nil {
+		return nil
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return fmt.Errorf("inspect custom config file %q: %w", configFile, err)
+	}
+
+	data, err := os.ReadFile(defaultConfigFile)
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	if err != nil {
+		return fmt.Errorf("read default config file %q: %w", defaultConfigFile, err)
+	}
+
+	if err := os.MkdirAll(filepath.Dir(configFile), 0o700); err != nil {
+		return fmt.Errorf("create custom config directory %q: %w", filepath.Dir(configFile), err)
+	}
+
+	file, err := os.OpenFile(configFile, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if errors.Is(err, os.ErrExist) {
+		return nil
+	}
+
+	if err != nil {
+		return fmt.Errorf("create custom config file %q: %w", configFile, err)
+	}
+
+	written := false
+
+	defer func() {
+		_ = file.Close()
+		if !written {
+			_ = os.Remove(configFile)
+		}
+	}()
+
+	if _, err := file.Write(data); err != nil {
+		return fmt.Errorf("copy default config from %q to %q: %w", defaultConfigFile, configFile, err)
+	}
+
+	if err := file.Close(); err != nil {
+		return fmt.Errorf("close custom config file %q: %w", configFile, err)
+	}
+
+	written = true
+
+	return nil
+}
@@ -0,0 +1,443 @@
+package configuration
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/projectdiscovery/goflags"
+	catalogconfig "github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+)
+
+func TestConfigurationPrecedence(t *testing.T) {
+	dir := t.TempDir()
+	preferredSystemDir := filepath.Join(dir, "preferred-system")
+	fallbackSystemDir := filepath.Join(dir, "fallback-system")
+	preferredSystemPath := filepath.Join(preferredSystemDir, catalogconfig.BinaryName, catalogconfig.CLIConfigFileName)
+	fallbackSystemPath := filepath.Join(fallbackSystemDir, catalogconfig.BinaryName, catalogconfig.CLIConfigFileName)
+	unixSystemPath := filepath.Join(dir, "etc", catalogconfig.BinaryName, catalogconfig.CLIConfigFileName)
+	userPath := filepath.Join(dir, "user.yaml")
+	explicitPath := filepath.Join(dir, "explicit.yaml")
+	profilePath := filepath.Join(dir, "profile.yaml")
+
+	writeConfigFile(t, fallbackSystemPath, `
+fallback-only: fallback
+preferred-wins: fallback
+local-wins: fallback
+user-wins: fallback
+explicit-wins: fallback
+profile-wins: fallback
+cli-wins: fallback
+default-wins: fallback
+config: ignored.yaml
+profile: ignored.yaml
+`)
+	writeConfigFile(t, preferredSystemPath, `
+preferred-wins: preferred
+local-wins: preferred
+user-wins: preferred
+explicit-wins: preferred
+profile-wins: preferred
+cli-wins: preferred
+default-wins: preferred
+`)
+	writeConfigFile(t, unixSystemPath, `
+local-wins: local
+user-wins: local
+explicit-wins: local
+profile-wins: local
+cli-wins: local
+default-wins: local
+`)
+	writeConfigFile(t, userPath, fmt.Sprintf(`
+user-wins: user
+explicit-wins: user
+profile-wins: user
+cli-wins: user
+default-wins: user
+config: %q
+profile: ignored-user.yaml
+`, explicitPath))
+	writeConfigFile(t, explicitPath, fmt.Sprintf(`
+explicit-wins: explicit
+profile-wins: explicit
+cli-wins: explicit
+default-wins: explicit
+profile: %q
+`, profilePath))
+	writeConfigFile(t, profilePath, `
+profile-wins: profile
+cli-wins: profile
+default-wins: profile
+`)
+
+	var fallbackOnly, preferredWins, localWins, userWins, explicitWins, profileWins, cliWins, defaultWins string
+	var selected Selection
+	flagSet := goflags.NewFlagSet()
+	flagSet.StringVar(&fallbackOnly, "fallback-only", "built-in", "")
+	flagSet.StringVar(&preferredWins, "preferred-wins", "built-in", "")
+	flagSet.StringVar(&localWins, "local-wins", "built-in", "")
+	flagSet.StringVar(&userWins, "user-wins", "built-in", "")
+	flagSet.StringVar(&explicitWins, "explicit-wins", "built-in", "")
+	flagSet.StringVar(&profileWins, "profile-wins", "built-in", "")
+	flagSet.StringVar(&cliWins, "cli-wins", "built-in", "")
+	flagSet.StringVar(&defaultWins, "default-wins", "built-in", "")
+	flagSet.StringVar(&selected.Config, "config", "", "")
+	flagSet.StringVar(&selected.Profile, "profile", "", "")
+
+	automaticFiles := []string{fallbackSystemPath, preferredSystemPath, unixSystemPath, userPath}
+	automaticErr, err := loadTestFlags(flagSet, automaticFiles, &selected, existingProfilePath, "-cli-wins=cli", "-default-wins=built-in")
+	if err != nil {
+		t.Fatalf("load configuration failed: %v", err)
+	}
+	if automaticErr != nil {
+		t.Fatalf("automatic configuration failed: %v", automaticErr)
+	}
+
+	assertEqual(t, "fallback-only", fallbackOnly, "fallback")
+	assertEqual(t, "preferred-wins", preferredWins, "preferred")
+	assertEqual(t, "local-wins", localWins, "local")
+	assertEqual(t, "user-wins", userWins, "user")
+	assertEqual(t, "explicit-wins", explicitWins, "explicit")
+	assertEqual(t, "profile-wins", profileWins, "profile")
+	assertEqual(t, "cli-wins", cliWins, "cli")
+	assertEqual(t, "default-wins", defaultWins, "built-in")
+	assertEqual(t, "selected config", selected.Config, explicitPath)
+	assertEqual(t, "selected profile", selected.Profile, profilePath)
+}
+
+func TestAutomaticConfigFiles(t *testing.T) {
+	dir := t.TempDir()
+	preferredSystemDir := filepath.Join(dir, "preferred")
+	fallbackSystemDir := filepath.Join(dir, "fallback")
+	userConfigDir := filepath.Join(dir, "user")
+	preferredSystemFile := filepath.Join(preferredSystemDir, catalogconfig.BinaryName, catalogconfig.CLIConfigFileName)
+	fallbackSystemFile := filepath.Join(fallbackSystemDir, catalogconfig.BinaryName, catalogconfig.CLIConfigFileName)
+	userConfigFile := filepath.Join(userConfigDir, catalogconfig.BinaryName, catalogconfig.CLIConfigFileName)
+	unixSystemFile := unixSystemConfigFilePath("linux")
+
+	got := automaticConfigFiles([]string{preferredSystemDir, "relative-system", fallbackSystemDir}, "linux", userConfigFile)
+	want := []string{
+		fallbackSystemFile,
+		preferredSystemFile,
+		unixSystemFile,
+		userConfigFile,
+	}
+	if !slices.Equal(got, want) {
+		t.Fatalf("automatic config files = %v, want %v", got, want)
+	}
+
+	got = automaticConfigFiles([]string{preferredSystemDir, "/etc", userConfigDir}, "linux", userConfigFile)
+	want = []string{
+		preferredSystemFile,
+		unixSystemFile,
+		userConfigFile,
+	}
+	if !slices.Equal(got, want) {
+		t.Fatalf("automatic config files with duplicate system paths = %v, want %v", got, want)
+	}
+
+	got = automaticConfigFiles([]string{preferredSystemDir, "/etc"}, "linux", unixSystemFile)
+	want = []string{
+		preferredSystemFile,
+		unixSystemFile,
+	}
+	if !slices.Equal(got, want) {
+		t.Fatalf("automatic config files with Unix path used as user path = %v, want %v", got, want)
+	}
+}
+
+func TestHigherPriorityFilesReplaceCollections(t *testing.T) {
+	dir := t.TempDir()
+	systemPath := filepath.Join(dir, "system.yaml")
+	userPath := filepath.Join(dir, "user.yaml")
+	explicitPath := filepath.Join(dir, "explicit.yaml")
+	profilePath := filepath.Join(dir, "profile.yaml")
+
+	writeConfigFile(t, systemPath, "replace: [system-a, system-b]\nclear: [system]\nvar: [system=one]\n")
+	writeConfigFile(t, userPath, fmt.Sprintf("replace: [user]\nclear: [user]\nvar: [user=two]\nconfig: %q\n", explicitPath))
+	writeConfigFile(t, explicitPath, fmt.Sprintf("replace: [explicit-a, explicit-b]\nclear: [explicit]\nvar: [explicit=three]\nprofile: %q\n", profilePath))
+	writeConfigFile(t, profilePath, "replace: [profile]\nclear: []\nvar: [profile=four]\n")
+
+	var replace, clear goflags.StringSlice
+	var variables goflags.RuntimeMap
+	var selected Selection
+	flagSet := goflags.NewFlagSet()
+	flagSet.StringSliceVar(&replace, "replace", nil, "", goflags.StringSliceOptions)
+	flagSet.StringSliceVar(&clear, "clear", nil, "", goflags.StringSliceOptions)
+	flagSet.RuntimeMapVar(&variables, "var", nil, "")
+	flagSet.StringVar(&selected.Config, "config", "", "")
+	flagSet.StringVar(&selected.Profile, "profile", "", "")
+
+	automaticErr, err := loadTestFlags(flagSet, []string{systemPath, userPath}, &selected, existingProfilePath, "-config="+explicitPath)
+	if err != nil {
+		t.Fatalf("load configuration failed: %v", err)
+	}
+	if automaticErr != nil {
+		t.Fatalf("automatic configuration failed: %v", automaticErr)
+	}
+	if !slices.Equal(replace, []string{"profile"}) {
+		t.Fatalf("replace = %v, want [profile]", replace)
+	}
+	if len(clear) != 0 {
+		t.Fatalf("clear = %v, want an empty list", clear)
+	}
+	if got := variables.AsMap(); len(got) != 1 || got["profile"] != "four" {
+		t.Fatalf("var = %v, want only profile=four", got)
+	}
+}
+
+func TestParsingCreatesPrimaryUserConfig(t *testing.T) {
+	tests := []struct {
+		name         string
+		createSystem bool
+		wantValue    string
+		forbidInUser string
+	}{
+		{name: "missing system", wantValue: "built-in"},
+		{name: "system values are not materialized", createSystem: true, wantValue: "system", forbidInUser: "system"},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			dir := t.TempDir()
+			systemPath := filepath.Join(dir, "system.yaml")
+			userPath := filepath.Join(dir, "user", "yaml")
+			if test.createSystem {
+				writeConfigFile(t, systemPath, "value: system\n")
+			}
+
+			value := "built-in"
+			var selected Selection
+			var noop bool
+			flagSet := goflags.NewFlagSet()
+			flagSet.StringVar(&value, "value", "built-in", "value description")
+			flagSet.StringVar(&selected.Config, "config", "", "")
+			flagSet.StringVar(&selected.Profile, "profile", "", "")
+			flagSet.BoolVar(&noop, "noop", false, "")
+
+			automaticErr, err := loadTestFlags(flagSet, []string{systemPath, userPath}, &selected, existingProfilePath, "-noop=false")
+			if err != nil {
+				t.Fatalf("load configuration failed: %v", err)
+			}
+			if automaticErr != nil {
+				t.Fatalf("automatic configuration failed: %v", automaticErr)
+			}
+			assertEqual(t, "value", value, test.wantValue)
+
+			data, err := os.ReadFile(userPath)
+			if err != nil {
+				t.Fatalf("read generated user config: %v", err)
+			}
+			content := string(data)
+			if !strings.Contains(content, "#value: built-in") {
+				t.Fatalf("generated user config is not a commented built-in config:\n%s", content)
+			}
+			if test.forbidInUser != "" && strings.Contains(content, test.forbidInUser) {
+				t.Fatalf("generated user config materialized %q:\n%s", test.forbidInUser, content)
+			}
+		})
+	}
+}
+
+func TestSelectedConfigLoadsAfterMalformedAutomaticConfig(t *testing.T) {
+	dir := t.TempDir()
+	systemPath := filepath.Join(dir, "system.yaml")
+	userPath := filepath.Join(dir, "user.yaml")
+	explicitPath := filepath.Join(dir, "explicit.yaml")
+	writeConfigFile(t, systemPath, "value: system\nautomatic-only: system\n")
+	writeConfigFile(t, userPath, "value: [\n")
+	writeConfigFile(t, explicitPath, "value: explicit\n")
+
+	value := "built-in"
+	automaticOnly := "built-in"
+	var selected Selection
+	flagSet := goflags.NewFlagSet()
+	flagSet.StringVar(&value, "value", "built-in", "")
+	flagSet.StringVar(&automaticOnly, "automatic-only", "built-in", "")
+	flagSet.StringVar(&selected.Config, "config", "", "")
+	flagSet.StringVar(&selected.Profile, "profile", "", "")
+
+	automaticErr, err := loadTestFlags(flagSet, []string{systemPath, userPath}, &selected, existingProfilePath, "-config="+explicitPath)
+	if err != nil {
+		t.Fatalf("valid explicit config failed after malformed automatic config: %v", err)
+	}
+	if automaticErr == nil {
+		t.Fatal("expected malformed automatic configuration error")
+	}
+	assertEqual(t, "value", value, "explicit")
+	assertEqual(t, "automatic-only", automaticOnly, "built-in")
+}
+
+func TestDeferredUpdateConfiguration(t *testing.T) {
+	dir := t.TempDir()
+	userPath := filepath.Join(dir, "user.yaml")
+	updateDir := filepath.Join(dir, "templates")
+	writeConfigFile(t, userPath, fmt.Sprintf(`
+disable-update-check: true
+update: true
+update-templates: true
+update-template-dir: %q
+`, updateDir))
+
+	var disableUpdateCheck, updateBinary, updateTemplates, noop bool
+	var selected Selection
+	var selectedUpdateDir string
+	flagSet := goflags.NewFlagSet()
+	flagSet.BoolVar(&disableUpdateCheck, "disable-update-check", false, "")
+	flagSet.BoolVar(&updateBinary, "update", false, "")
+	flagSet.BoolVar(&updateTemplates, "update-templates", false, "")
+	flagSet.StringVar(&selectedUpdateDir, "update-template-dir", "", "")
+	flagSet.StringVar(&selected.Config, "config", "", "")
+	flagSet.StringVar(&selected.Profile, "profile", "", "")
+	flagSet.BoolVar(&noop, "noop", false, "")
+
+	automaticErr, err := loadTestFlags(flagSet, []string{filepath.Join(dir, "missing-system.yaml"), userPath}, &selected, existingProfilePath, "-noop=false")
+	if err != nil {
+		t.Fatalf("load configuration failed: %v", err)
+	}
+	if automaticErr != nil {
+		t.Fatalf("automatic configuration failed: %v", automaticErr)
+	}
+	if !disableUpdateCheck || !updateBinary || !updateTemplates {
+		t.Fatalf("update values were not loaded: disable=%t update=%t templates=%t", disableUpdateCheck, updateBinary, updateTemplates)
+	}
+	assertEqual(t, "update template directory", selectedUpdateDir, updateDir)
+
+	testConfig := &catalogconfig.Config{}
+	if !testConfig.CanCheckForUpdates() {
+		t.Fatal("configuration loading applied disable-update-check too early")
+	}
+	if disableUpdateCheck {
+		testConfig.DisableUpdateCheck()
+	}
+	if testConfig.CanCheckForUpdates() {
+		t.Fatal("deferred disable-update-check was not applied")
+	}
+}
+
+func TestConfigFilesDoNotExecuteCallbacks(t *testing.T) {
+	dir := t.TempDir()
+	systemPath := filepath.Join(dir, "system.yaml")
+	userPath := filepath.Join(dir, "user.yaml")
+	explicitPath := filepath.Join(dir, "explicit.yaml")
+	profilePath := filepath.Join(dir, "profile.yaml")
+	callbackYAML := "reset: true\nversion: true\ntemplates-version: true\n"
+	writeConfigFile(t, systemPath, callbackYAML)
+	writeConfigFile(t, userPath, fmt.Sprintf("%sconfig: %q\n", callbackYAML, explicitPath))
+	writeConfigFile(t, explicitPath, fmt.Sprintf("%sprofile: %q\n", callbackYAML, profilePath))
+	writeConfigFile(t, profilePath, callbackYAML)
+
+	callbackCount := 0
+	var selected Selection
+	var noop bool
+	flagSet := goflags.NewFlagSet()
+	flagSet.CallbackVar(func() { callbackCount++ }, "reset", "")
+	flagSet.CallbackVar(func() { callbackCount++ }, "version", "")
+	flagSet.CallbackVar(func() { callbackCount++ }, "templates-version", "")
+	flagSet.StringVar(&selected.Config, "config", "", "")
+	flagSet.StringVar(&selected.Profile, "profile", "", "")
+	flagSet.BoolVar(&noop, "noop", false, "")
+
+	automaticErr, err := loadTestFlags(flagSet, []string{systemPath, userPath}, &selected, existingProfilePath, "-noop=false")
+	if err != nil {
+		t.Fatalf("load configuration failed: %v", err)
+	}
+	if automaticErr != nil {
+		t.Fatalf("automatic configuration failed: %v", automaticErr)
+	}
+	if callbackCount != 0 {
+		t.Fatalf("configuration executed %d callbacks", callbackCount)
+	}
+
+	flagSet = goflags.NewFlagSet()
+	flagSet.CallbackVar(func() { callbackCount++ }, "reset", "")
+	flagSet.StringVar(&selected.Config, "config", "", "")
+	flagSet.StringVar(&selected.Profile, "profile", "", "")
+	automaticErr, err = loadTestFlags(flagSet, []string{systemPath, userPath}, &selected, existingProfilePath, "-reset")
+	if err != nil {
+		t.Fatalf("load configuration with CLI callback failed: %v", err)
+	}
+	if automaticErr != nil {
+		t.Fatalf("automatic configuration with CLI callback failed: %v", automaticErr)
+	}
+	if callbackCount != 1 {
+		t.Fatalf("CLI callback count = %d, want 1", callbackCount)
+	}
+}
+
+func TestSelectedFilesCannotRedirectTheirOwnStage(t *testing.T) {
+	dir := t.TempDir()
+	userPath := filepath.Join(dir, "user.yaml")
+	configPath := filepath.Join(dir, "config.yaml")
+	otherConfigPath := filepath.Join(dir, "other-config.yaml")
+	profilePath := filepath.Join(dir, "profile.yaml")
+	otherProfilePath := filepath.Join(dir, "other-profile.yaml")
+
+	writeConfigFile(t, userPath, fmt.Sprintf("config: %q\n", configPath))
+	writeConfigFile(t, configPath, fmt.Sprintf("config: %q\nprofile: %q\n", otherConfigPath, profilePath))
+	writeConfigFile(t, otherConfigPath, "other-config-loaded: true\n")
+	writeConfigFile(t, profilePath, fmt.Sprintf("config: %q\nprofile: %q\n", otherConfigPath, otherProfilePath))
+	writeConfigFile(t, otherProfilePath, "other-profile-loaded: true\n")
+
+	var selected Selection
+	var otherConfigLoaded, otherProfileLoaded bool
+	flagSet := goflags.NewFlagSet()
+	flagSet.StringVar(&selected.Config, "config", "", "")
+	flagSet.StringVar(&selected.Profile, "profile", "", "")
+	flagSet.BoolVar(&otherConfigLoaded, "other-config-loaded", false, "")
+	flagSet.BoolVar(&otherProfileLoaded, "other-profile-loaded", false, "")
+
+	automaticErr, err := loadTestFlags(flagSet, []string{userPath}, &selected, existingProfilePath, "--")
+	if err != nil {
+		t.Fatalf("load configuration failed: %v", err)
+	}
+	if automaticErr != nil {
+		t.Fatalf("automatic configuration failed: %v", automaticErr)
+	}
+	assertEqual(t, "selected config", selected.Config, configPath)
+	assertEqual(t, "selected profile", selected.Profile, profilePath)
+	if otherConfigLoaded || otherProfileLoaded {
+		t.Fatalf("loading followed a redirected stage: config=%t profile=%t", otherConfigLoaded, otherProfileLoaded)
+	}
+}
+
+func loadTestFlags(
+	flagSet *goflags.FlagSet,
+	automaticFiles []string,
+	selected *Selection,
+	resolveProfile func(string) (string, error),
+	args ...string,
+) (error, error) {
+	userConfigFile := automaticFiles[len(automaticFiles)-1]
+	warnings, err := loadConfigFiles(userConfigFile, userConfigFile, automaticFiles, flagSet, selected, resolveProfile, args...)
+	return errors.Join(warnings...), err
+}
+
+func existingProfilePath(path string) (string, error) {
+	if _, err := os.Stat(path); err != nil {
+		return "", err
+	}
+	return path, nil
+}
+
+func writeConfigFile(t *testing.T, path, content string) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		t.Fatalf("create config directory: %v", err)
+	}
+	if err := os.WriteFile(path, []byte(strings.TrimPrefix(content, "\n")), 0o600); err != nil {
+		t.Fatalf("write config file %q: %v", path, err)
+	}
+}
+
+func assertEqual[T comparable](t *testing.T, name string, got, want T) {
+	t.Helper()
+	if got != want {
+		t.Fatalf("%s = %v, want %v", name, got, want)
+	}
+}
@@ -0,0 +1,67 @@
+package configuration
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	catalogconfig "github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+)
+
+func TestUnixSystemConfigFilePath(t *testing.T) {
+	for _, goos := range []string{"aix", "darwin", "dragonfly", "freebsd", "linux", "netbsd", "openbsd", "solaris"} {
+		if got, want := unixSystemConfigFilePath(goos), "/etc/nuclei/config.yaml"; got != want {
+			t.Fatalf("unix system config for %s = %q, want %q", goos, got, want)
+		}
+	}
+	for _, goos := range []string{"windows", "plan9", "js"} {
+		if got := unixSystemConfigFilePath(goos); got != "" {
+			t.Fatalf("system config for %s = %q, want empty", goos, got)
+		}
+	}
+}
+
+func TestPrepareUserConfigFile(t *testing.T) {
+	dir := t.TempDir()
+	defaultConfigFile := filepath.Join(dir, "default", catalogconfig.CLIConfigFileName)
+	customConfigFile := filepath.Join(dir, "custom", catalogconfig.CLIConfigFileName)
+	if err := os.MkdirAll(filepath.Dir(defaultConfigFile), 0o700); err != nil {
+		t.Fatalf("create default config directory: %v", err)
+	}
+	if err := os.WriteFile(defaultConfigFile, []byte("value: inherited\n"), 0o600); err != nil {
+		t.Fatalf("write default config: %v", err)
+	}
+
+	if err := prepareUserConfigFile(customConfigFile, defaultConfigFile); err != nil {
+		t.Fatalf("prepare user config file: %v", err)
+	}
+	data, err := os.ReadFile(customConfigFile)
+	if err != nil {
+		t.Fatalf("read inherited config: %v", err)
+	}
+	if got, want := string(data), "value: inherited\n"; got != want {
+		t.Fatalf("inherited config = %q, want %q", got, want)
+	}
+
+	if err := os.WriteFile(defaultConfigFile, []byte("value: changed\n"), 0o600); err != nil {
+		t.Fatalf("update default config: %v", err)
+	}
+	if err := prepareUserConfigFile(customConfigFile, defaultConfigFile); err != nil {
+		t.Fatalf("prepare existing user config: %v", err)
+	}
+	data, err = os.ReadFile(customConfigFile)
+	if err != nil {
+		t.Fatalf("read existing user config: %v", err)
+	}
+	if got, want := string(data), "value: inherited\n"; got != want {
+		t.Fatalf("existing user config = %q, want %q", got, want)
+	}
+
+	missingConfigFile := filepath.Join(dir, "missing-custom", catalogconfig.CLIConfigFileName)
+	if err := prepareUserConfigFile(missingConfigFile, filepath.Join(dir, "missing-default.yaml")); err != nil {
+		t.Fatalf("prepare config without default source: %v", err)
+	}
+	if _, err := os.Stat(missingConfigFile); !os.IsNotExist(err) {
+		t.Fatalf("missing default source created user config: %v", err)
+	}
+}
@@ -0,0 +1,187 @@
+package configuration
+
+import (
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+
+	catalogconfig "github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates/extensions"
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+	"github.com/projectdiscovery/nuclei/v3/pkg/utils/yaml"
+	fileutil "github.com/projectdiscovery/utils/file"
+)
+
+// TemplatesDirectory returns the final template directory used while loading
+// configuration and resolving profiles.
+func TemplatesDirectory(options *types.Options, config *catalogconfig.Config) string {
+	if templatesDir, overridden := TemplatesDirectoryOverride(options); overridden {
+		return templatesDir
+	}
+
+	return config.GetTemplateDir()
+}
+
+// TemplatesDirectoryOverride returns an explicit flag/config or environment
+// template directory.
+func TemplatesDirectoryOverride(options *types.Options) (string, bool) {
+	templatesDir := options.NewTemplatesDirectory
+	if templatesDir == "" {
+		templatesDir = os.Getenv(catalogconfig.NucleiTemplatesDirEnv)
+	}
+
+	if templatesDir == "" {
+		return "", false
+	}
+
+	if absPath, err := filepath.Abs(templatesDir); err == nil {
+		return absPath, true
+	}
+
+	return templatesDir, true
+}
+
+// ResolveProfilePath resolves a profile path or profile ID against the active
+// template root.
+func ResolveProfilePath(profilePath, templatesDir string) (string, error) {
+	defaultProfilesPath := filepath.Join(templatesDir, "profiles")
+	if filepath.Ext(profilePath) == "" {
+		path, err := findProfilePathByID(profilePath, defaultProfilesPath)
+		if err != nil {
+			return "", err
+		}
+
+		if path == "" {
+			return "", fmt.Errorf("%q is not a profile ID or profile path", profilePath)
+		}
+
+		profilePath = path
+	}
+
+	if !filepath.IsAbs(profilePath) {
+		if filepath.Dir(profilePath) == "profiles" {
+			defaultProfilesPath = templatesDir
+		}
+
+		currentDir, err := os.Getwd()
+		if err == nil && fileutil.FileExists(filepath.Join(currentDir, profilePath)) {
+			profilePath = filepath.Join(currentDir, profilePath)
+		} else {
+			profilePath = filepath.Join(defaultProfilesPath, profilePath)
+		}
+	}
+
+	if !fileutil.FileExists(profilePath) {
+		return "", fmt.Errorf("given template profile file %q does not exist", profilePath)
+	}
+
+	return profilePath, nil
+}
+
+func findProfilePathByID(profileID, profilesDir string) (string, error) {
+	var profilePath string
+	err := filepath.WalkDir(profilesDir, func(path string, entry fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if entry.IsDir() {
+			return nil
+		}
+
+		ext := filepath.Ext(path)
+		if ext != extensions.YAML && ext != extensions.YML {
+			return nil
+		}
+
+		if strings.TrimSuffix(filepath.Base(path), ext) == profileID {
+			profilePath = path
+			return fs.SkipAll
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return "", fmt.Errorf("search profile ID %q in %q: %w", profileID, profilesDir, err)
+	}
+
+	return profilePath, nil
+}
+
+// ApplyProfile processes profile-only inline targets and secrets after its
+// flag values have been merged. It returns the private directory that owns a
+// generated inline-secrets file.
+func ApplyProfile(profilePath string, options *types.Options) (string, error) {
+	if profilePath == "" {
+		return "", nil
+	}
+
+	options.Targets = appendInlineTargets(options.Targets, options.InlineTargetsList)
+	if strings.Contains(options.TargetsFilePath, "\n") {
+		options.Targets = appendInlineTargets(options.Targets, options.TargetsFilePath)
+		options.TargetsFilePath = ""
+	}
+
+	return processInlineSecretsFromProfile(profilePath, options)
+}
+
+func appendInlineTargets(targets []string, input string) []string {
+	for target := range strings.SplitSeq(strings.TrimSpace(input), "\n") {
+		target = strings.TrimSpace(target)
+		if target != "" && !strings.HasPrefix(target, "#") {
+			targets = append(targets, target)
+		}
+	}
+
+	return targets
+}
+
+type profileSecrets struct {
+	Secrets any `yaml:"secrets"`
+}
+
+func processInlineSecretsFromProfile(profilePath string, options *types.Options) (string, error) {
+	data, err := os.ReadFile(profilePath)
+	if err != nil {
+		return "", fmt.Errorf("read profile file %q: %w", profilePath, err)
+	}
+
+	var profile profileSecrets
+	if err := yaml.Unmarshal(data, &profile); err != nil {
+		return "", fmt.Errorf("parse profile YAML %q: %w", profilePath, err)
+	}
+
+	if profile.Secrets == nil {
+		return "", nil
+	}
+
+	secretsData, err := yaml.Marshal(profile.Secrets)
+	if err != nil {
+		return "", fmt.Errorf("marshal inline profile secrets: %w", err)
+	}
+
+	tempDir, err := os.MkdirTemp("", "nuclei-secrets-*")
+	if err != nil {
+		return "", fmt.Errorf("create inline secrets directory: %w", err)
+	}
+
+	removeDir := true
+	defer func() {
+		if removeDir {
+			_ = os.RemoveAll(tempDir)
+		}
+	}()
+
+	tempPath := filepath.Join(tempDir, "inline-secrets.yaml")
+	if err := os.WriteFile(tempPath, secretsData, 0o600); err != nil {
+		return "", fmt.Errorf("write inline secrets file %q: %w", tempPath, err)
+	}
+
+	removeDir = false
+	options.SecretsFile = append(options.SecretsFile, tempPath)
+
+	return tempDir, nil
+}
@@ -1,254 +1,356 @@
-package main
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	"github.com/projectdiscovery/nuclei/v3/pkg/types"
-)
-
-func TestProcessInlineSecretsFromProfile(t *testing.T) {
-	t.Run("profile with inline secrets", func(t *testing.T) {
-		profileContent := `
-secrets:
-  static:
-    - type: header
-      domains:
-        - api.example.com
-      headers:
-        - key: x-api-key
-          value: test-key-123
-`
-		tmpFile, err := os.CreateTemp(t.TempDir(), "test-profile-*.yaml")
-		if err != nil {
-			t.Fatalf("could not create temp file: %v", err)
-		}
-		if _, err := tmpFile.WriteString(profileContent); err != nil {
-			t.Fatalf("could not write profile: %v", err)
-		}
-		_ = tmpFile.Close()
-
-		opts := &types.Options{}
-		tempPath, err := processInlineSecretsFromProfile(tmpFile.Name(), opts)
-		if err != nil {
-			t.Fatalf("processInlineSecretsFromProfile failed: %v", err)
-		}
-		defer func() {
-			_ = os.Remove(tempPath)
-		}()
-
-		if len(opts.SecretsFile) != 1 {
-			t.Fatalf("expected 1 secrets file, got %d", len(opts.SecretsFile))
-		}
-
-		secretsPath := opts.SecretsFile[0]
-		if !strings.Contains(secretsPath, "inline-secrets-") {
-			t.Errorf("secrets file path should contain 'inline-secrets-', got %s", secretsPath)
-		}
-
-		data, err := os.ReadFile(secretsPath)
-		if err != nil {
-			t.Fatalf("could not read generated secrets file: %v", err)
-		}
-
-		content := string(data)
-		if !strings.Contains(content, "x-api-key") {
-			t.Errorf("secrets file should contain header key, got:\n%s", content)
-		}
-		if !strings.Contains(content, "test-key-123") {
-			t.Errorf("secrets file should contain header value, got:\n%s", content)
-		}
-		if !strings.Contains(content, "api.example.com") {
-			t.Errorf("secrets file should contain domain, got:\n%s", content)
-		}
-	})
-
-	t.Run("profile without secrets", func(t *testing.T) {
-		profileContent := `
-severity:
-  - critical
-  - high
-`
-		tmpFile, err := os.CreateTemp(t.TempDir(), "test-profile-*.yaml")
-		if err != nil {
-			t.Fatalf("could not create temp file: %v", err)
-		}
-		if _, err := tmpFile.WriteString(profileContent); err != nil {
-			t.Fatalf("could not write profile: %v", err)
-		}
-		if err := tmpFile.Close(); err != nil {
-			t.Fatalf("could not close temp file: %v", err)
-		}
-
-		opts := &types.Options{}
-		tempPath, err := processInlineSecretsFromProfile(tmpFile.Name(), opts)
-		if err != nil {
-			t.Fatalf("processInlineSecretsFromProfile should not fail: %v", err)
-		}
-
-		if tempPath != "" {
-			t.Errorf("expected empty temp path for profile without secrets, got %s", tempPath)
-		}
-
-		if len(opts.SecretsFile) != 0 {
-			t.Errorf("expected 0 secrets files for profile without secrets, got %d", len(opts.SecretsFile))
-		}
-	})
-
-	t.Run("nonexistent profile", func(t *testing.T) {
-		opts := &types.Options{}
-		_, err := processInlineSecretsFromProfile(filepath.Join(t.TempDir(), "nonexistent.yaml"), opts)
-		if err == nil {
-			t.Error("expected error for nonexistent file")
-		}
-	})
-}
-
-func TestInlineTargetsParsing(t *testing.T) {
-	t.Run("multiline list key treated as inline targets", func(t *testing.T) {
-		opts := &types.Options{
-			TargetsFilePath: "example.com\ntest.com\nscanme.sh\n",
-		}
-
-		if strings.Contains(opts.TargetsFilePath, "\n") {
-			inlineTargets := strings.Split(strings.TrimSpace(opts.TargetsFilePath), "\n")
-			for _, target := range inlineTargets {
-				target = strings.TrimSpace(target)
-				if target != "" && !strings.HasPrefix(target, "#") {
-					opts.Targets = append(opts.Targets, target)
-				}
-			}
-			opts.TargetsFilePath = ""
-		}
-
-		if len(opts.Targets) != 3 {
-			t.Fatalf("expected 3 targets, got %d: %v", len(opts.Targets), opts.Targets)
-		}
-		if opts.Targets[0] != "example.com" {
-			t.Errorf("expected first target 'example.com', got '%s'", opts.Targets[0])
-		}
-		if opts.Targets[1] != "test.com" {
-			t.Errorf("expected second target 'test.com', got '%s'", opts.Targets[1])
-		}
-		if opts.Targets[2] != "scanme.sh" {
-			t.Errorf("expected third target 'scanme.sh', got '%s'", opts.Targets[2])
-		}
-		if opts.TargetsFilePath != "" {
-			t.Errorf("TargetsFilePath should be cleared, got '%s'", opts.TargetsFilePath)
-		}
-	})
-
-	t.Run("single line list key remains as file path", func(t *testing.T) {
-		opts := &types.Options{
-			TargetsFilePath: "/path/to/targets.txt",
-		}
-
-		if strings.Contains(opts.TargetsFilePath, "\n") {
-			t.Error("single-line path should not be treated as inline targets")
-		}
-
-		if opts.TargetsFilePath != "/path/to/targets.txt" {
-			t.Errorf("file path should remain unchanged, got '%s'", opts.TargetsFilePath)
-		}
-	})
-
-	t.Run("inline targets with comments and blank lines", func(t *testing.T) {
-		opts := &types.Options{
-			TargetsFilePath: "example.com\n# this is a comment\n\ntest.com\n",
-		}
-
-		if strings.Contains(opts.TargetsFilePath, "\n") {
-			inlineTargets := strings.Split(strings.TrimSpace(opts.TargetsFilePath), "\n")
-			for _, target := range inlineTargets {
-				target = strings.TrimSpace(target)
-				if target != "" && !strings.HasPrefix(target, "#") {
-					opts.Targets = append(opts.Targets, target)
-				}
-			}
-			opts.TargetsFilePath = ""
-		}
-
-		if len(opts.Targets) != 2 {
-			t.Fatalf("expected 2 targets (comments/blanks filtered), got %d: %v", len(opts.Targets), opts.Targets)
-		}
-	})
-
-	t.Run("targets-inline key", func(t *testing.T) {
-		opts := &types.Options{
-			InlineTargetsList: "host1.com\nhost2.com\nhost3.com",
-		}
-
-		if opts.InlineTargetsList != "" {
-			inlineTargets := strings.Split(strings.TrimSpace(opts.InlineTargetsList), "\n")
-			for _, target := range inlineTargets {
-				target = strings.TrimSpace(target)
-				if target != "" && !strings.HasPrefix(target, "#") {
-					opts.Targets = append(opts.Targets, target)
-				}
-			}
-		}
-
-		if len(opts.Targets) != 3 {
-			t.Fatalf("expected 3 targets from targets-inline, got %d", len(opts.Targets))
-		}
-	})
-}
-
-func TestInlineSecretsFileFormat(t *testing.T) {
-	// Verify the generated secrets file has the correct YAML structure
-	// that matches what authx.GetAuthDataFromYAML expects
-	profileContent := `
-secrets:
-  static:
-    - type: header
-      domains:
-        - api.example.com
-      headers:
-        - key: Authorization
-          value: Bearer test-token
-  dynamic:
-    - template: oauth-flow.yaml
-      variables:
-        - key: username
-          value: testuser
-      type: cookie
-      domains:
-        - auth.example.com
-`
-	tmpFile, err := os.CreateTemp(t.TempDir(), "test-secrets-*.yaml")
-	if err != nil {
-		t.Fatalf("could not create temp file: %v", err)
-	}
-	if _, err := tmpFile.WriteString(profileContent); err != nil {
-		t.Fatalf("could not write profile: %v", err)
-	}
-	if err := tmpFile.Close(); err != nil {
-		t.Fatalf("could not close temp file: %v", err)
-	}
-
-	opts := &types.Options{}
-	tempPath, err := processInlineSecretsFromProfile(tmpFile.Name(), opts)
-	if err != nil {
-		t.Fatalf("processInlineSecretsFromProfile failed: %v", err)
-	}
-	defer func() {
-		_ = os.Remove(tempPath)
-	}()
-
-	data, err := os.ReadFile(opts.SecretsFile[0])
-	if err != nil {
-		t.Fatalf("could not read secrets file: %v", err)
-	}
-
-	content := string(data)
-	// The secrets section should contain static and dynamic at root level,
-	// matching the Authx struct yaml tags
-	if !strings.Contains(content, "static:") {
-		t.Errorf("secrets file should have 'static:' key for Authx compatibility, got:\n%s", content)
-	}
-	if !strings.Contains(content, "dynamic:") {
-		t.Errorf("secrets file should have 'dynamic:' key for Authx compatibility, got:\n%s", content)
-	}
-}
+package configuration
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	catalogconfig "github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+)
+
+func TestProcessInlineSecretsFromProfile(t *testing.T) {
+	t.Run("profile with inline secrets", func(t *testing.T) {
+		profileContent := `
+secrets:
+  static:
+    - type: header
+      domains:
+        - api.example.com
+      headers:
+        - key: x-api-key
+          value: test-key-123
+`
+		tmpFile, err := os.CreateTemp(t.TempDir(), "test-profile-*.yaml")
+		if err != nil {
+			t.Fatalf("could not create temp file: %v", err)
+		}
+		if _, err := tmpFile.WriteString(profileContent); err != nil {
+			t.Fatalf("could not write profile: %v", err)
+		}
+		_ = tmpFile.Close()
+
+		opts := &types.Options{}
+		tempDir, err := processInlineSecretsFromProfile(tmpFile.Name(), opts)
+		if err != nil {
+			t.Fatalf("processInlineSecretsFromProfile failed: %v", err)
+		}
+		defer func() {
+			_ = os.RemoveAll(tempDir)
+		}()
+
+		if len(opts.SecretsFile) != 1 {
+			t.Fatalf("expected 1 secrets file, got %d", len(opts.SecretsFile))
+		}
+
+		secretsPath := opts.SecretsFile[0]
+		if filepath.Base(secretsPath) != "inline-secrets.yaml" {
+			t.Errorf("secrets file name = %q, want inline-secrets.yaml", filepath.Base(secretsPath))
+		}
+
+		data, err := os.ReadFile(secretsPath)
+		if err != nil {
+			t.Fatalf("could not read generated secrets file: %v", err)
+		}
+
+		content := string(data)
+		if !strings.Contains(content, "x-api-key") {
+			t.Errorf("secrets file should contain header key, got:\n%s", content)
+		}
+		if !strings.Contains(content, "test-key-123") {
+			t.Errorf("secrets file should contain header value, got:\n%s", content)
+		}
+		if !strings.Contains(content, "api.example.com") {
+			t.Errorf("secrets file should contain domain, got:\n%s", content)
+		}
+	})
+
+	t.Run("profile without secrets", func(t *testing.T) {
+		profileContent := `
+severity:
+  - critical
+  - high
+`
+		tmpFile, err := os.CreateTemp(t.TempDir(), "test-profile-*.yaml")
+		if err != nil {
+			t.Fatalf("could not create temp file: %v", err)
+		}
+		if _, err := tmpFile.WriteString(profileContent); err != nil {
+			t.Fatalf("could not write profile: %v", err)
+		}
+		if err := tmpFile.Close(); err != nil {
+			t.Fatalf("could not close temp file: %v", err)
+		}
+
+		opts := &types.Options{}
+		tempDir, err := processInlineSecretsFromProfile(tmpFile.Name(), opts)
+		if err != nil {
+			t.Fatalf("processInlineSecretsFromProfile should not fail: %v", err)
+		}
+
+		if tempDir != "" {
+			t.Errorf("expected no temporary directory for profile without secrets, got %s", tempDir)
+		}
+
+		if len(opts.SecretsFile) != 0 {
+			t.Errorf("expected 0 secrets files for profile without secrets, got %d", len(opts.SecretsFile))
+		}
+	})
+
+	t.Run("nonexistent profile", func(t *testing.T) {
+		opts := &types.Options{}
+		_, err := processInlineSecretsFromProfile(filepath.Join(t.TempDir(), "nonexistent.yaml"), opts)
+		if err == nil {
+			t.Error("expected error for nonexistent file")
+		}
+	})
+
+	t.Run("does not follow a shared temporary directory symlink", func(t *testing.T) {
+		tempRoot := t.TempDir()
+		t.Setenv("TMPDIR", tempRoot)
+		t.Setenv("TMP", tempRoot)
+		t.Setenv("TEMP", tempRoot)
+
+		victimDir := filepath.Join(tempRoot, "victim")
+		if err := os.Mkdir(victimDir, 0o755); err != nil {
+			t.Fatalf("create victim directory: %v", err)
+		}
+		before, err := os.Stat(victimDir)
+		if err != nil {
+			t.Fatalf("stat victim directory before processing: %v", err)
+		}
+
+		sharedPath := filepath.Join(tempRoot, "nuclei-secrets")
+		if err := os.Symlink(victimDir, sharedPath); err != nil {
+			t.Skipf("create directory symlink: %v", err)
+		}
+
+		profilePath := filepath.Join(t.TempDir(), "profile.yaml")
+		writeConfigFile(t, profilePath, "secrets:\n  static: []\n")
+		opts := &types.Options{}
+		tempDir, err := processInlineSecretsFromProfile(profilePath, opts)
+		if err != nil {
+			t.Fatalf("process inline secrets: %v", err)
+		}
+		t.Cleanup(func() { _ = os.RemoveAll(tempDir) })
+
+		if tempDir == sharedPath {
+			t.Fatalf("inline secrets used shared path %q", sharedPath)
+		}
+		if got := filepath.Dir(opts.SecretsFile[0]); got != tempDir {
+			t.Fatalf("inline secrets file directory = %q, want %q", got, tempDir)
+		}
+		after, err := os.Stat(victimDir)
+		if err != nil {
+			t.Fatalf("stat victim directory after processing: %v", err)
+		}
+		if before.Mode().Perm() != after.Mode().Perm() {
+			t.Fatalf("victim directory mode changed from %o to %o", before.Mode().Perm(), after.Mode().Perm())
+		}
+	})
+}
+
+func TestInlineTargetsParsing(t *testing.T) {
+	t.Run("multiline list key treated as inline targets", func(t *testing.T) {
+		opts := &types.Options{
+			TargetsFilePath: "example.com\ntest.com\nscanme.sh\n",
+		}
+
+		if strings.Contains(opts.TargetsFilePath, "\n") {
+			inlineTargets := strings.Split(strings.TrimSpace(opts.TargetsFilePath), "\n")
+			for _, target := range inlineTargets {
+				target = strings.TrimSpace(target)
+				if target != "" && !strings.HasPrefix(target, "#") {
+					opts.Targets = append(opts.Targets, target)
+				}
+			}
+			opts.TargetsFilePath = ""
+		}
+
+		if len(opts.Targets) != 3 {
+			t.Fatalf("expected 3 targets, got %d: %v", len(opts.Targets), opts.Targets)
+		}
+		if opts.Targets[0] != "example.com" {
+			t.Errorf("expected first target 'example.com', got '%s'", opts.Targets[0])
+		}
+		if opts.Targets[1] != "test.com" {
+			t.Errorf("expected second target 'test.com', got '%s'", opts.Targets[1])
+		}
+		if opts.Targets[2] != "scanme.sh" {
+			t.Errorf("expected third target 'scanme.sh', got '%s'", opts.Targets[2])
+		}
+		if opts.TargetsFilePath != "" {
+			t.Errorf("TargetsFilePath should be cleared, got '%s'", opts.TargetsFilePath)
+		}
+	})
+
+	t.Run("single line list key remains as file path", func(t *testing.T) {
+		opts := &types.Options{
+			TargetsFilePath: "/path/to/targets.txt",
+		}
+
+		if strings.Contains(opts.TargetsFilePath, "\n") {
+			t.Error("single-line path should not be treated as inline targets")
+		}
+
+		if opts.TargetsFilePath != "/path/to/targets.txt" {
+			t.Errorf("file path should remain unchanged, got '%s'", opts.TargetsFilePath)
+		}
+	})
+
+	t.Run("inline targets with comments and blank lines", func(t *testing.T) {
+		opts := &types.Options{
+			TargetsFilePath: "example.com\n# this is a comment\n\ntest.com\n",
+		}
+
+		if strings.Contains(opts.TargetsFilePath, "\n") {
+			inlineTargets := strings.Split(strings.TrimSpace(opts.TargetsFilePath), "\n")
+			for _, target := range inlineTargets {
+				target = strings.TrimSpace(target)
+				if target != "" && !strings.HasPrefix(target, "#") {
+					opts.Targets = append(opts.Targets, target)
+				}
+			}
+			opts.TargetsFilePath = ""
+		}
+
+		if len(opts.Targets) != 2 {
+			t.Fatalf("expected 2 targets (comments/blanks filtered), got %d: %v", len(opts.Targets), opts.Targets)
+		}
+	})
+
+	t.Run("targets-inline key", func(t *testing.T) {
+		opts := &types.Options{
+			InlineTargetsList: "host1.com\nhost2.com\nhost3.com",
+		}
+
+		if opts.InlineTargetsList != "" {
+			inlineTargets := strings.Split(strings.TrimSpace(opts.InlineTargetsList), "\n")
+			for _, target := range inlineTargets {
+				target = strings.TrimSpace(target)
+				if target != "" && !strings.HasPrefix(target, "#") {
+					opts.Targets = append(opts.Targets, target)
+				}
+			}
+		}
+
+		if len(opts.Targets) != 3 {
+			t.Fatalf("expected 3 targets from targets-inline, got %d", len(opts.Targets))
+		}
+	})
+}
+
+func TestInlineSecretsFileFormat(t *testing.T) {
+	// Verify the generated secrets file has the correct YAML structure
+	// that matches what authx.GetAuthDataFromYAML expects
+	profileContent := `
+secrets:
+  static:
+    - type: header
+      domains:
+        - api.example.com
+      headers:
+        - key: Authorization
+          value: Bearer test-token
+  dynamic:
+    - template: oauth-flow.yaml
+      variables:
+        - key: username
+          value: testuser
+      type: cookie
+      domains:
+        - auth.example.com
+`
+	tmpFile, err := os.CreateTemp(t.TempDir(), "test-secrets-*.yaml")
+	if err != nil {
+		t.Fatalf("could not create temp file: %v", err)
+	}
+	if _, err := tmpFile.WriteString(profileContent); err != nil {
+		t.Fatalf("could not write profile: %v", err)
+	}
+	if err := tmpFile.Close(); err != nil {
+		t.Fatalf("could not close temp file: %v", err)
+	}
+
+	opts := &types.Options{}
+	tempDir, err := processInlineSecretsFromProfile(tmpFile.Name(), opts)
+	if err != nil {
+		t.Fatalf("processInlineSecretsFromProfile failed: %v", err)
+	}
+	defer func() {
+		_ = os.RemoveAll(tempDir)
+	}()
+
+	data, err := os.ReadFile(opts.SecretsFile[0])
+	if err != nil {
+		t.Fatalf("could not read secrets file: %v", err)
+	}
+
+	content := string(data)
+	// The secrets section should contain static and dynamic at root level,
+	// matching the Authx struct yaml tags
+	if !strings.Contains(content, "static:") {
+		t.Errorf("secrets file should have 'static:' key for Authx compatibility, got:\n%s", content)
+	}
+	if !strings.Contains(content, "dynamic:") {
+		t.Errorf("secrets file should have 'dynamic:' key for Authx compatibility, got:\n%s", content)
+	}
+}
+
+func TestApplyProfileParsesInlineTargets(t *testing.T) {
+	profilePath := filepath.Join(t.TempDir(), "profile.yaml")
+	writeConfigFile(t, profilePath, "severity: [high]\n")
+	options := &types.Options{
+		InlineTargetsList: "inline.example\n# comment\n",
+		TargetsFilePath:   "list.example\n\nsecond.example\n",
+	}
+
+	tempSecretsDir, err := ApplyProfile(profilePath, options)
+	if err != nil {
+		t.Fatalf("apply profile: %v", err)
+	}
+	if tempSecretsDir != "" {
+		t.Fatalf("temporary secrets directory = %q, want empty", tempSecretsDir)
+	}
+	want := []string{"inline.example", "list.example", "second.example"}
+	if strings.Join(options.Targets, ",") != strings.Join(want, ",") {
+		t.Fatalf("targets = %v, want %v", options.Targets, want)
+	}
+	if options.TargetsFilePath != "" {
+		t.Fatalf("targets file path = %q, want empty", options.TargetsFilePath)
+	}
+}
+
+func TestResolveProfilePathByID(t *testing.T) {
+	templatesDir := t.TempDir()
+	profilePath := filepath.Join(templatesDir, "profiles", "nested", "recommended.yaml")
+	writeConfigFile(t, profilePath, "severity: [high]\n")
+
+	got, err := ResolveProfilePath("recommended", templatesDir)
+	if err != nil {
+		t.Fatalf("resolve profile ID: %v", err)
+	}
+	if got != profilePath {
+		t.Fatalf("profile path = %q, want %q", got, profilePath)
+	}
+}
+
+func TestTemplatesDirectoryOverridePrecedence(t *testing.T) {
+	dir := t.TempDir()
+	envDir := filepath.Join(dir, "environment")
+	flagDir := filepath.Join(dir, "flag")
+	t.Setenv(catalogconfig.NucleiTemplatesDirEnv, envDir)
+
+	got, overridden := TemplatesDirectoryOverride(&types.Options{NewTemplatesDirectory: flagDir})
+	if !overridden {
+		t.Fatal("flag template directory was not reported as an override")
+	}
+	want, err := filepath.Abs(flagDir)
+	if err != nil {
+		t.Fatalf("resolve expected path: %v", err)
+	}
+	if got != want {
+		t.Fatalf("template directory = %q, want flag path %q", got, want)
+	}
+}
@@ -10,26 +10,43 @@ import (
 	pdcpauth "github.com/projectdiscovery/utils/auth/pdcp"
 )

-// AppendDirectoryInfo writes nuclei config/cache/PDCP directory paths.
-func AppendDirectoryInfo(w io.Writer) {
-	_, _ = fmt.Fprintf(w, "Nuclei Config Directory: %s\n", config.DefaultConfig.GetConfigDir())
-	_, _ = fmt.Fprintf(w, "Nuclei Cache Directory: %s\n", config.DefaultConfig.GetCacheDir())
-	_, _ = fmt.Fprintf(w, "PDCP Directory: %s\n", pdcpauth.PDCPDir)
+type directoryRecord struct {
+	label string
+	path  string
 }

-// DirectoryInfo returns nuclei config/cache/PDCP directory paths as a string.
+func directoryRecords() []directoryRecord {
+	return []directoryRecord{
+		{label: "Nuclei Config Directory", path: config.DefaultConfig.GetConfigDir()},
+		{label: "Nuclei State Directory", path: config.DefaultConfig.GetStateDir()},
+		{label: "Nuclei Cache Directory", path: config.DefaultConfig.GetCacheDir()},
+		{label: "PDCP Directory", path: pdcpauth.PDCPDir},
+	}
+}
+
+// AppendDirectoryInfo writes nuclei config/state/cache/PDCP directory paths.
+func AppendDirectoryInfo(w io.Writer) {
+	for _, record := range directoryRecords() {
+		_, _ = fmt.Fprintf(w, "%s: %s\n", record.label, record.path)
+	}
+}
+
+// DirectoryInfo returns nuclei config/state/cache/PDCP directory paths as a string.
 func DirectoryInfo() string {
 	var b strings.Builder
+
 	AppendDirectoryInfo(&b)
+
 	return b.String()
 }

-// LogDirectoryInfo logs nuclei config/cache/PDCP directory paths at info level.
+// LogDirectoryInfo logs nuclei config/state/cache/PDCP directory paths at info level.
 func LogDirectoryInfo(logger *gologger.Logger) {
 	if logger == nil {
 		return
 	}
-	logger.Info().Msgf("Nuclei Config Directory: %s", config.DefaultConfig.GetConfigDir())
-	logger.Info().Msgf("Nuclei Cache Directory: %s", config.DefaultConfig.GetCacheDir())
-	logger.Info().Msgf("PDCP Directory: %s", pdcpauth.PDCPDir)
+
+	for _, record := range directoryRecords() {
+		logger.Info().Msgf("%s: %s", record.label, record.path)
+	}
 }
@@ -5,21 +5,50 @@ import (
 	"strings"
 	"testing"

+	"github.com/projectdiscovery/gologger"
+	"github.com/projectdiscovery/gologger/formatter"
+	"github.com/projectdiscovery/gologger/levels"
 	"github.com/stretchr/testify/require"

 	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
 	pdcpauth "github.com/projectdiscovery/utils/auth/pdcp"
 )

+type directoryLogWriter struct {
+	records []string
+}
+
+func (w *directoryLogWriter) Write(data []byte, _ levels.Level) {
+	w.records = append(w.records, string(data))
+}
+
 func TestDirectoryInfoContainsKnownLabels(t *testing.T) {
 	info := DirectoryInfo()
 	cfg := config.DefaultConfig

 	require.Equal(t, strings.Join([]string{
 		fmt.Sprintf("Nuclei Config Directory: %s", cfg.GetConfigDir()),
+		fmt.Sprintf("Nuclei State Directory: %s", cfg.GetStateDir()),
 		fmt.Sprintf("Nuclei Cache Directory: %s", cfg.GetCacheDir()),
 		fmt.Sprintf("PDCP Directory: %s", pdcpauth.PDCPDir),
 		"",
 	}, "\n"), info)
-	require.Equal(t, 3, strings.Count(info, "\n"))
+	require.Equal(t, 4, strings.Count(info, "\n"))
+}
+
+func TestLogDirectoryInfoContainsKnownLabels(t *testing.T) {
+	writer := &directoryLogWriter{}
+	logger := &gologger.Logger{}
+	logger.SetFormatter(formatter.NewCLI(true))
+	logger.SetWriter(writer)
+	logger.SetMaxLevel(levels.LevelInfo)
+
+	LogDirectoryInfo(logger)
+
+	require.Equal(t, []string{
+		fmt.Sprintf("[INF] Nuclei Config Directory: %s", config.DefaultConfig.GetConfigDir()),
+		fmt.Sprintf("[INF] Nuclei State Directory: %s", config.DefaultConfig.GetStateDir()),
+		fmt.Sprintf("[INF] Nuclei Cache Directory: %s", config.DefaultConfig.GetCacheDir()),
+		fmt.Sprintf("[INF] PDCP Directory: %s", pdcpauth.PDCPDir),
+	}, writer.records)
 }
@@ -23,17 +23,31 @@ func DoHealthCheck(options *types.Options) string {
 	AppendDirectoryInfo(&test)

 	var testResult string
+
 	cfg := config.DefaultConfig
-	for _, filename := range []string{cfg.GetFlagsConfigFilePath(), cfg.GetIgnoreFilePath(), cfg.GetChecksumFilePath()} {
+	if err := cfg.InitializationError(); err != nil {
+		fmt.Fprintf(&test, "Configuration initialization => Ko (%s)\n", err)
+	} else {
+		fmt.Fprintln(&test, "Configuration initialization => Ok")
+	}
+
+	for _, filename := range []string{
+		cfg.GetFlagsConfigFilePath(),
+		cfg.GetTemplatesStateFilePath(),
+		cfg.GetActiveIgnoreFilePath(),
+		cfg.GetChecksumFilePath(),
+	} {
 		ok, err := fileutil.IsReadable(filename)
 		if ok {
 			testResult = "Ok"
 		} else {
 			testResult = "Ko"
 		}
+
 		if err != nil {
 			testResult += fmt.Sprintf(" (%s)", err)
 		}
+
 		fmt.Fprintf(&test, "File \"%s\" Read => %s\n", filename, testResult)
 		ok, err = fileutil.IsWriteable(filename)
 		if ok {
@@ -41,37 +55,48 @@ func DoHealthCheck(options *types.Options) string {
 		} else {
 			testResult = "Ko"
 		}
+
 		if err != nil {
 			testResult += fmt.Sprintf(" (%s)", err)
 		}
+
 		fmt.Fprintf(&test, "File \"%s\" Write => %s\n", filename, testResult)
 	}
+
 	c4, err := net.Dial("tcp4", "scanme.sh:80")
 	if err == nil && c4 != nil {
 		_ = c4.Close()
 	}
+
 	testResult = "Ok"
 	if err != nil {
 		testResult = fmt.Sprintf("Ko (%s)", err)
 	}
+
 	fmt.Fprintf(&test, "IPv4 connectivity to scanme.sh:80 => %s\n", testResult)
+
 	c6, err := net.Dial("tcp6", "scanme.sh:80")
 	if err == nil && c6 != nil {
 		_ = c6.Close()
 	}
+
 	testResult = "Ok"
 	if err != nil {
 		testResult = fmt.Sprintf("Ko (%s)", err)
 	}
+
 	fmt.Fprintf(&test, "IPv6 connectivity to scanme.sh:80 => %s\n", testResult)
+
 	u4, err := net.Dial("udp4", "scanme.sh:53")
 	if err == nil && u4 != nil {
 		_ = u4.Close()
 	}
+
 	testResult = "Ok"
 	if err != nil {
 		testResult = fmt.Sprintf("Ko (%s)", err)
 	}
+
 	fmt.Fprintf(&test, "IPv4 UDP connectivity to scanme.sh:53 => %s\n", testResult)

 	return test.String()
@@ -0,0 +1,73 @@
+package runner
+
+import (
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/projectdiscovery/gologger"
+	"github.com/projectdiscovery/gologger/formatter"
+	"github.com/projectdiscovery/gologger/levels"
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+	"github.com/stretchr/testify/require"
+)
+
+type ignoreFileLogRecord struct {
+	message string
+	level   levels.Level
+}
+
+type ignoreFileLogWriter struct {
+	records []ignoreFileLogRecord
+}
+
+func (w *ignoreFileLogWriter) Write(data []byte, level levels.Level) {
+	w.records = append(w.records, ignoreFileLogRecord{message: string(data), level: level})
+}
+
+func newIgnoreFileTestRunner(t *testing.T, root string, writer *ignoreFileLogWriter) *Runner {
+	t.Helper()
+
+	cfg := config.DefaultConfig
+	oldRoot := cfg.TemplatesDirectory
+	t.Cleanup(func() { cfg.SetTemplatesDir(oldRoot) })
+	cfg.SetTemplatesDir(root)
+
+	logger := &gologger.Logger{}
+	logger.SetFormatter(formatter.NewCLI(false))
+	logger.SetWriter(writer)
+	logger.SetMaxLevel(levels.LevelWarning)
+
+	options := types.DefaultOptions()
+	options.Logger = logger
+	return &Runner{options: options, Logger: logger}
+}
+
+func TestLoadIgnoreFileWarnsAndContinuesWhenActiveFileIsMissing(t *testing.T) {
+	root := t.TempDir()
+	writer := &ignoreFileLogWriter{}
+	runner := newIgnoreFileTestRunner(t, root, writer)
+
+	require.NoError(t, runner.loadIgnoreFile())
+	require.Empty(t, runner.options.ExcludeTags)
+	require.Empty(t, runner.options.ExcludedTemplates)
+	require.Len(t, writer.records, 1)
+	require.Equal(t, levels.LevelWarning, writer.records[0].level)
+	require.Contains(t, writer.records[0].message, strconv.Quote(filepath.Join(root, config.NucleiIgnoreFileName)))
+	require.Contains(t, writer.records[0].message, "continuing without ignore exclusions")
+}
+
+func TestLoadIgnoreFileRejectsCorruptActiveFile(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, config.NucleiIgnoreFileName)
+	require.NoError(t, os.WriteFile(path, []byte("tags: ["), 0o600))
+	writer := &ignoreFileLogWriter{}
+	runner := newIgnoreFileTestRunner(t, root, writer)
+
+	err := runner.loadIgnoreFile()
+	require.ErrorContains(t, err, "error parsing")
+	require.ErrorContains(t, err, strconv.Quote(path))
+	require.Empty(t, writer.records)
+}
@@ -15,7 +15,9 @@ import (
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/generators"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/helpers/writer"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/replacer"
+	httpprotocol "github.com/projectdiscovery/nuclei/v3/pkg/protocols/http"
 	"github.com/projectdiscovery/nuclei/v3/pkg/scan"
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates"
 	"github.com/projectdiscovery/nuclei/v3/pkg/types"
 	"github.com/projectdiscovery/utils/env"
 	"github.com/projectdiscovery/utils/errkit"
@@ -79,6 +81,8 @@ func GetLazyAuthFetchCallback(opts *AuthLazyFetchOptions) authx.LazyFetchSecret
 		}
 		data := map[string]interface{}{}
 		tmpl := tmpls[0]
+		restore := skipSecretFileOnAuthTemplate(tmpl)
+		defer restore()
 		// add args to tmpl here
 		vars := map[string]interface{}{}
 		mainCtx := context.Background()
@@ -149,3 +153,46 @@ func GetLazyAuthFetchCallback(opts *AuthLazyFetchOptions) authx.LazyFetchSecret
 		return finalErr
 	}
 }
+
+// skipSecretFileOnAuthTemplate disables secret-file auth on the login template for
+// the duration of the fetch. Login requests that hit the same domain as the
+// secret would otherwise ApplyAuth → Fetch and deadlock on sync.Once (#7639).
+// Previous SkipSecretFile values are restored so a cached template is unchanged.
+func skipSecretFileOnAuthTemplate(tmpl *templates.Template) func() {
+	if tmpl == nil {
+		return func() {}
+	}
+	var reqs []*httpprotocol.Request
+	seen := make(map[*httpprotocol.Request]struct{})
+	add := func(r *httpprotocol.Request) {
+		if r == nil {
+			return
+		}
+		if _, ok := seen[r]; ok {
+			return
+		}
+		seen[r] = struct{}{}
+		reqs = append(reqs, r)
+	}
+	for _, r := range tmpl.RequestsHTTP {
+		add(r)
+	}
+	for _, r := range tmpl.RequestsWithHTTP {
+		add(r)
+	}
+	for _, req := range tmpl.RequestsQueue {
+		if r, ok := req.(*httpprotocol.Request); ok {
+			add(r)
+		}
+	}
+	prev := make([]bool, len(reqs))
+	for i, r := range reqs {
+		prev[i] = r.SkipSecretFile
+		r.SkipSecretFile = true
+	}
+	return func() {
+		for i, r := range reqs {
+			r.SkipSecretFile = prev[i]
+		}
+	}
+}
@@ -6,6 +6,9 @@ import (

 	"github.com/projectdiscovery/nuclei/v3/pkg/operators"
 	"github.com/projectdiscovery/nuclei/v3/pkg/output"
+	"github.com/projectdiscovery/nuclei/v3/pkg/protocols"
+	httpprotocol "github.com/projectdiscovery/nuclei/v3/pkg/protocols/http"
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates"
 	"github.com/stretchr/testify/require"
 )

@@ -137,3 +140,27 @@ func TestCallbackDynamicValues(t *testing.T) {
 	require.NoError(t, err)
 	require.Equal(t, "sess-xyz-123", data["session"], "should pick the longest value")
 }
+
+func TestSkipSecretFileOnAuthTemplate(t *testing.T) {
+	t.Run("nil template is a no-op", func(t *testing.T) {
+		restore := skipSecretFileOnAuthTemplate(nil)
+		require.NotPanics(t, restore)
+	})
+
+	t.Run("sets skip during fetch and restores previous values", func(t *testing.T) {
+		alreadySkipped := &httpprotocol.Request{SkipSecretFile: true}
+		needsSkip := &httpprotocol.Request{}
+		tmpl := &templates.Template{
+			RequestsHTTP: []*httpprotocol.Request{alreadySkipped, needsSkip},
+		}
+		tmpl.RequestsQueue = []protocols.Request{alreadySkipped, needsSkip}
+
+		restore := skipSecretFileOnAuthTemplate(tmpl)
+		require.True(t, alreadySkipped.SkipSecretFile)
+		require.True(t, needsSkip.SkipSecretFile)
+
+		restore()
+		require.True(t, alreadySkipped.SkipSecretFile, "templates that already skipped secret-file must stay skipped")
+		require.False(t, needsSkip.SkipSecretFile, "scan-time ApplyAuth must remain enabled after login fetch")
+	})
+}
@@ -117,6 +117,10 @@ func New(options *types.Options) (*Runner, error) {
 		Logger:  options.Logger,
 	}

+	if err := config.DefaultConfig.InitializationError(); err != nil && !options.HealthCheck {
+		return nil, fmt.Errorf("initialize nuclei configuration: %w", err)
+	}
+
 	if options.HealthCheck {
 		runner.Logger.Print().Msgf("%s\n", DoHealthCheck(options))
 		os.Exit(0)
@@ -128,9 +132,10 @@ func New(options *types.Options) (*Runner, error) {

 	//  Version check by default
 	if config.DefaultConfig.CanCheckForUpdates() {
-		if err := installer.NucleiVersionCheck(); err != nil {
+		latestIgnoreHash, versionCheckErr := installer.NucleiVersionCheck()
+		if versionCheckErr != nil {
 			if options.Verbose || options.Debug {
-				runner.Logger.Error().Msgf("nuclei version check failed got: %s\n", err)
+				runner.Logger.Error().Msgf("nuclei version check failed got: %s\n", versionCheckErr)
 			}
 		}

@@ -147,15 +152,15 @@ func New(options *types.Options) (*Runner, error) {
 			DisablePublicTemplates: options.PublicTemplateDisableDownload,
 		}
 		if err := tm.FreshInstallIfNotExists(); err != nil {
-			runner.Logger.Warning().Msgf("failed to install nuclei templates: %s\n", err)
+			runner.Logger.Warning().Msgf("Failed to install nuclei templates: %s\n", err)
 		}
 		if err := tm.UpdateIfOutdated(); err != nil {
-			runner.Logger.Warning().Msgf("failed to update nuclei templates: %s\n", err)
+			runner.Logger.Warning().Msgf("Failed to update nuclei templates: %s\n", err)
 		}

-		if config.DefaultConfig.NeedsIgnoreFileUpdate() {
+		if config.DefaultConfig.IgnoreFileNeedsUpdate(latestIgnoreHash) {
 			if err := installer.UpdateIgnoreFile(); err != nil {
-				runner.Logger.Warning().Msgf("failed to update nuclei ignore file: %s\n", err)
+				runner.Logger.Warning().Msgf("Failed to update .nuclei-ignore file: %s\n", err)
 			}
 		}

@@ -165,6 +170,7 @@ func New(options *types.Options) (*Runner, error) {
 			if !config.DefaultConfig.NeedsTemplateUpdate() {
 				runner.Logger.Info().Msgf("No new updates found for nuclei templates")
 			}
+
 			// manually trigger update of custom templates
 			if ctm != nil {
 				ctm.Update(context.TODO())
@@ -181,6 +187,7 @@ func New(options *types.Options) (*Runner, error) {
 		if options.Validate {
 			parser.ShouldValidate = true
 		}
+
 		// TODO: refactor to pass options reference globally without cycles
 		parser.NoStrictSyntax = options.NoStrictSyntax
 		runner.parser = parser
@@ -193,10 +200,12 @@ func New(options *types.Options) (*Runner, error) {
 		if engine.MustDisableSandbox() {
 			runner.Logger.Warning().Msgf("The current platform and privileged user will run the browser without sandbox\n")
 		}
+
 		browser, err := engine.New(options)
 		if err != nil {
 			return nil, err
 		}
+
 		runner.browser = browser
 	}

@@ -205,6 +214,7 @@ func New(options *types.Options) (*Runner, error) {
 	var httpclient *retryablehttp.Client
 	if options.ProxyInternal && options.AliveHttpProxy != "" || options.AliveSocksProxy != "" {
 		var err error
+
 		httpclient, err = httpclientpool.Get(options, &httpclientpool.Configuration{}, "")
 		if err != nil {
 			return nil, err
@@ -214,10 +224,12 @@ func New(options *types.Options) (*Runner, error) {
 	if err := reporting.CreateConfigIfNotExists(); err != nil {
 		return nil, err
 	}
+
 	reportingOptions, err := createReportingOptions(options)
 	if err != nil {
 		return nil, err
 	}
+
 	if reportingOptions != nil && httpclient != nil {
 		reportingOptions.HttpClient = httpclient
 	}
@@ -227,6 +239,7 @@ func New(options *types.Options) (*Runner, error) {
 		if err != nil {
 			return nil, errors.Wrap(err, "could not create issue reporting client")
 		}
+
 		runner.issuesClient = client
 	}

@@ -289,10 +302,12 @@ func New(options *types.Options) (*Runner, error) {
 	if err != nil {
 		return nil, errors.Wrap(err, "could not create output file")
 	}
+
 	if hpDetector != nil {
 		outputWriter.SetHoneypotDetector(hpDetector)
 		runner.honeypotDetector = hpDetector
 	}
+
 	// setup a proxy writer to automatically upload results to PDCP
 	runner.output = runner.setupPDCPUpload(outputWriter)
 	if options.HTTPStats {
@@ -303,9 +318,11 @@ func New(options *types.Options) (*Runner, error) {
 	if options.JSONL && options.EnableProgressBar {
 		options.StatsJSON = true
 	}
+
 	if options.StatsJSON {
 		options.EnableProgressBar = true
 	}
+
 	// Creates the progress tracking object
 	var progressErr error
 	statsInterval := options.StatsInterval
@@ -331,12 +348,15 @@ func New(options *types.Options) (*Runner, error) {
 		if err != nil {
 			return nil, err
 		}
+
 		err = json.Unmarshal(file, &resumeCfg)
 		if err != nil {
 			return nil, err
 		}
+
 		resumeCfg.Compile()
 	}
+
 	runner.resumeCfg = resumeCfg

 	if options.DASTReport || options.DASTServer {
@@ -345,11 +365,13 @@ func New(options *types.Options) (*Runner, error) {
 		if err != nil {
 			return nil, errors.Wrap(err, "could not create fuzz stats db")
 		}
+
 		if !options.DASTServer {
 			dastServer, err := server.NewStatsServer(runner.fuzzStats)
 			if err != nil {
 				return nil, errors.Wrap(err, "could not create dast server")
 			}
+
 			runner.dastServer = dastServer
 		}
 	}
@@ -359,6 +381,7 @@ func New(options *types.Options) (*Runner, error) {
 			if request.Error == "none" || request.Error == "" {
 				return
 			}
+
 			runner.fuzzStats.RecordErrorEvent(fuzzStats.ErrorEvent{
 				TemplateID: request.Template,
 				URL:        request.Input,
@@ -396,6 +419,7 @@ func New(options *types.Options) (*Runner, error) {
 		// in testing it was found most of times when interactsh failed, it was due to failure in registering /polling requests
 		opts.HTTPClient = retryablehttp.NewClient(retryablehttp.DefaultOptionsSingle)
 	}
+
 	interactshClient, err := interactsh.New(opts)
 	if err != nil {
 		runner.Logger.Error().Msgf("Could not create interactsh client: %s", err)
@@ -408,9 +432,11 @@ func New(options *types.Options) (*Runner, error) {
 		options.RateLimit = options.RateLimitMinute
 		options.RateLimitDuration = time.Minute
 	}
+
 	if options.RateLimit > 0 && options.RateLimitDuration == 0 {
 		options.RateLimitDuration = time.Second
 	}
+
 	// If per-host rate limiting is enabled, make global rate limiter unlimited
 	if options.PerHostRateLimit {
 		runner.rateLimiter = utils.GetRateLimiter(context.Background(), 0, 0)
@@ -420,6 +446,7 @@ func New(options *types.Options) (*Runner, error) {

 	// Initialization successful, disable cleanup on error
 	cleanupOnError = false
+
 	return runner, nil
 }

@@ -428,6 +455,7 @@ func (r *Runner) runStandardEnumeration(executerOpts *protocols.ExecutorOptions,
 	if r.options.AutomaticScan {
 		return r.executeSmartWorkflowInput(executerOpts, store, engine)
 	}
+
 	return r.executeTemplatesInput(store, engine)
 }

@@ -576,10 +604,13 @@ func (r *Runner) RunEnumeration() error {
 			OutScope:              r.options.OutOfScope,
 			NucleiExecutorOptions: execurOpts,
 		})
+
 		if err != nil {
 			return err
 		}
+
 		r.dastServer = dastServer
+
 		return dastServer.Start()
 	}

@@ -589,16 +620,18 @@ func (r *Runner) RunEnumeration() error {
 			r.options.Templates = append(r.options.Templates, arr...)
 		}
 	}
+
 	if len(r.options.NewTemplatesWithVersion) > 0 {
 		if arr := installer.GetNewTemplatesInVersions(r.options.NewTemplatesWithVersion...); len(arr) > 0 {
 			r.options.Templates = append(r.options.Templates, arr...)
 		}
 	}
-	// Exclude ignored file for validation
+
+	// Apply the active ignore policy only when templates can execute.
 	if !r.options.Validate {
-		ignoreFile := config.ReadIgnoreFile()
-		r.options.ExcludeTags = append(r.options.ExcludeTags, ignoreFile.Tags...)
-		r.options.ExcludedTemplates = append(r.options.ExcludedTemplates, ignoreFile.Files...)
+		if err := r.loadIgnoreFile(); err != nil {
+			return err
+		}
 	}

 	fuzzFreqCache := frequency.New(frequency.DefaultMaxTrackCount, r.options.FuzzParamFrequency)
@@ -680,8 +713,8 @@ func (r *Runner) RunEnumeration() error {

 	// If using input-file flags, only load http fuzzing based templates.
 	loaderConfig := loader.NewConfig(r.options, r.catalog, executorOpts)
-	if !strings.EqualFold(r.options.InputFileMode, "list") || r.options.DAST {
-		// if input type is not list (implicitly enable fuzzing)
+	if (!strings.EqualFold(r.options.InputFileMode, "list") || r.options.DAST) && !r.options.OfflineHTTP {
+		// if input type is not list (implicitly enable fuzzing), unless passive/offlinehttp
 		r.options.DAST = true
 	}
 	store, err := loader.New(loaderConfig)
@@ -858,6 +891,24 @@ func (r *Runner) RunEnumeration() error {
 	return err
 }

+func (r *Runner) loadIgnoreFile() error {
+	ignoreFile, err := config.ReadIgnoreFile()
+	if errors.Is(err, os.ErrNotExist) {
+		r.Logger.Warning().Msgf("Could not read active .nuclei-ignore file: %s; continuing without ignore exclusions", err)
+
+		return nil
+	}
+
+	if err != nil {
+		return err
+	}
+
+	r.options.ExcludeTags = append(r.options.ExcludeTags, ignoreFile.Tags...)
+	r.options.ExcludedTemplates = append(r.options.ExcludedTemplates, ignoreFile.Files...)
+
+	return nil
+}
+
 func shortDur(d time.Duration) string {
 	if d < time.Minute {
 		return d.String()
@@ -971,15 +1022,8 @@ func (r *Runner) displayExecutionInfo(store *loader.Store) {
 	cfg := config.DefaultConfig

 	updateutils.Aurora = r.colorizer
-	versionInfo := func(version, latestVersion, versionType string) string {
-		if !cfg.CanCheckForUpdates() {
-			return fmt.Sprintf("Current %s version: %v (%s) - remove '-duc' flag to enable update checks", versionType, version, r.colorizer.BrightYellow("unknown"))
-		}
-		return fmt.Sprintf("Current %s version: %v %v", versionType, version, updateutils.GetVersionDescription(version, latestVersion))
-	}
-
-	gologger.Info().Msg(versionInfo(config.Version, cfg.LatestNucleiVersion, "nuclei"))
-	gologger.Info().Msg(versionInfo(cfg.TemplateVersion, cfg.LatestNucleiTemplatesVersion, "nuclei-templates"))
+	gologger.Info().Msg(versionInfo(cfg, r.colorizer, config.Version, cfg.LatestNucleiVersion, "nuclei"))
+	gologger.Info().Msg(templateVersionInfo(cfg, r.colorizer))
 	if !HideAutoSaveMsg {
 		if r.pdcpUploadErrMsg != "" {
 			r.Logger.Warning().Msgf("%s", r.pdcpUploadErrMsg)
@@ -1013,19 +1057,40 @@ func (r *Runner) displayExecutionInfo(store *loader.Store) {
 	}
 }

+func versionInfo(cfg *config.Config, colorizer *aurora.Aurora, version, latestVersion, versionType string) string {
+	if !cfg.CanCheckForUpdates() {
+		return fmt.Sprintf("Current %s version: %v (%s) - remove '-duc' flag to enable update checks", versionType, version, colorizer.BrightYellow("unknown"))
+	}
+
+	return fmt.Sprintf("Current %s version: %v %v", versionType, version, updateutils.GetVersionDescription(version, latestVersion))
+}
+
+func templateVersionInfo(cfg *config.Config, colorizer *aurora.Aurora) string {
+	return versionInfo(cfg, colorizer, cfg.TemplateVersion, cfg.LatestNucleiTemplatesVersion, "nuclei-templates")
+}
+
 // SaveResumeConfig to file
 func (r *Runner) SaveResumeConfig(path string) error {
 	dir := filepath.Dir(path)
 	if !fileutil.FolderExists(dir) {
-		if err := os.MkdirAll(dir, os.ModePerm); err != nil {
-			return err
+		if err := os.MkdirAll(dir, 0o700); err != nil {
+			return fmt.Errorf("create resume directory %q: %w", dir, err)
 		}
 	}
+
 	resumeCfgClone := r.resumeCfg.Clone()
 	resumeCfgClone.ResumeFrom = resumeCfgClone.Current
-	data, _ := json.MarshalIndent(resumeCfgClone, "", "\t")

-	return os.WriteFile(path, data, permissionutil.ConfigFilePermission)
+	data, err := json.MarshalIndent(resumeCfgClone, "", "\t")
+	if err != nil {
+		return fmt.Errorf("encode resume configuration: %w", err)
+	}
+
+	if err := os.WriteFile(path, data, permissionutil.ConfigFilePermission); err != nil {
+		return fmt.Errorf("write resume configuration %q: %w", path, err)
+	}
+
+	return nil
 }

 // upload existing scan results to cloud with progress
@@ -0,0 +1,45 @@
+package runner
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+)
+
+func TestTemplateVersionInfoIgnoresLegacyDiscoverySource(t *testing.T) {
+	dir := t.TempDir()
+	root := filepath.Join(dir, "system", config.BinaryName, config.NucleiTemplatesDirName)
+	cfg := &config.Config{}
+	cfg.SetStateDir(filepath.Join(dir, "state"))
+
+	state, err := json.Marshal(map[string]string{
+		"nuclei-templates-directory":        root,
+		"nuclei-templates-directory-source": "xdg-system",
+		"nuclei-templates-version":          "v1.2.3",
+		"nuclei-templates-latest-version":   "v99.0.0",
+	})
+	if err != nil {
+		t.Fatalf("marshal templates state: %v", err)
+	}
+	if err := os.MkdirAll(filepath.Dir(cfg.GetTemplatesStateFilePath()), 0o700); err != nil {
+		t.Fatalf("create state directory: %v", err)
+	}
+	if err := os.WriteFile(cfg.GetTemplatesStateFilePath(), state, 0o600); err != nil {
+		t.Fatalf("write templates state: %v", err)
+	}
+	if err := cfg.ReadTemplatesConfig(); err != nil {
+		t.Fatalf("read templates state: %v", err)
+	}
+
+	info := templateVersionInfo(cfg, nil)
+	if !strings.Contains(info, "v1.2.3") || !strings.Contains(info, "outdated") {
+		t.Fatalf("template version info = %q, want normal version comparison", info)
+	}
+	if strings.Contains(info, "package-managed") {
+		t.Fatalf("template version info retained discovery ownership: %q", info)
+	}
+}
@@ -117,8 +117,8 @@ func newNucleiExecutor(opts *NucleiExecutorOptions) (*nucleiExecutor, error) {

 	// If using input-file flags, only load http fuzzing based templates.
 	loaderConfig := loader.NewConfig(opts.Options, opts.Catalog, executorOpts)
-	if !strings.EqualFold(opts.Options.InputFileMode, "list") || opts.Options.DAST || opts.Options.DASTServer {
-		// if input type is not list (implicitly enable fuzzing)
+	if (!strings.EqualFold(opts.Options.InputFileMode, "list") || opts.Options.DAST || opts.Options.DASTServer) && !opts.Options.OfflineHTTP {
+		// if input type is not list (implicitly enable fuzzing), unless passive/offlinehttp
 		opts.Options.DAST = true
 	}
 	store, err := loader.New(loaderConfig)
@@ -59,7 +59,12 @@ func runTestMain(m *testing.M) int {
 		ci:            isCI(),
 		runner: testutils.NewRunner(
 			testutils.WithWorkingDir(repoRoot),
-			testutils.WithBaseEnv("NUCLEI_CONFIG_DIR="+configDir),
+			testutils.WithBaseEnv(
+				"NUCLEI_CONFIG_DIR="+configDir,
+				"NUCLEI_TEMPLATES_DIR="+filepath.Join(configDir, "templates"),
+				"XDG_STATE_HOME="+filepath.Join(configDir, "state"),
+				"XDG_CACHE_HOME="+filepath.Join(configDir, "cache"),
+			),
 		),
 	}
 	defer func() {
@@ -447,23 +452,31 @@ func candidateExecutableNames(name string) []string {
 }

 func prepareFunctionalEnvironment(binaryPath, repoRoot, configDir string) error {
-	configRoot := filepath.Join(configDir, "nuclei")
-	if err := os.MkdirAll(configRoot, 0755); err != nil {
-		return fmt.Errorf("failed to create functional nuclei config root: %w", err)
-	}
-	ignoreFile := filepath.Join(configRoot, ".nuclei-ignore")
-	if err := os.WriteFile(ignoreFile, nil, 0644); err != nil {
-		return fmt.Errorf("failed to create functional ignore file: %w", err)
-	}
+	templatesDir := filepath.Join(configDir, "templates")
 	for _, args := range [][]string{{"-update-templates"}, {"-validate"}} {
 		cmd := exec.Command(binaryPath, args...)
 		cmd.Dir = repoRoot
-		cmd.Env = append(os.Environ(), "NUCLEI_CONFIG_DIR="+configDir)
+		cmd.Env = append(os.Environ(),
+			"NUCLEI_CONFIG_DIR="+configDir,
+			"NUCLEI_TEMPLATES_DIR="+templatesDir,
+			"XDG_STATE_HOME="+filepath.Join(configDir, "state"),
+			"XDG_CACHE_HOME="+filepath.Join(configDir, "cache"),
+		)
 		output, err := cmd.CombinedOutput()
 		if err != nil {
 			return fmt.Errorf("functional setup command %v failed: %w\n%s", args, err, strings.TrimSpace(string(output)))
 		}
 	}
+
+	ignoreFile, err := os.ReadFile(filepath.Join(templatesDir, ".nuclei-ignore"))
+	if err != nil {
+		return fmt.Errorf("failed to read functional ignore file: %w", err)
+	}
+
+	if err := os.WriteFile(filepath.Join(configDir, ".nuclei-ignore"), ignoreFile, 0o600); err != nil {
+		return fmt.Errorf("failed to write legacy functional ignore file: %w", err)
+	}
+
 	return nil
 }

@@ -119,7 +119,9 @@ func TestTemplatesDirEnv(t *testing.T) {
 func TestCustomConfigDir(t *testing.T) {
 	t.Run("ConfigDirIsolated", func(t *testing.T) {
 		customTempDir := t.TempDir()
-		results, err := testutils.RunNucleiBareArgsAndGetResults(suite.debug, []string{"NUCLEI_CONFIG_DIR=" + customTempDir}, "-t", "protocols/http/get.yaml", "-u", newTemplateDirTarget(t))
+		stateHome := t.TempDir()
+		templatesDir := t.TempDir()
+		results, err := testutils.RunNucleiBareArgsAndGetResults(suite.debug, []string{"NUCLEI_CONFIG_DIR=" + customTempDir, "XDG_STATE_HOME=" + stateHome, "NUCLEI_TEMPLATES_DIR=" + templatesDir}, "-t", "protocols/http/get.yaml", "-u", newTemplateDirTarget(t))
 		if err != nil {
 			t.Fatalf("custom config dir request failed: %v", err)
 		}
@@ -132,11 +134,14 @@ func TestCustomConfigDir(t *testing.T) {
 			for _, file := range files {
 				fileNames = append(fileNames, file.Name())
 			}
-			for _, requiredFile := range []string{".templates-config.json", "config.yaml", "reporting-config.yaml"} {
+			for _, requiredFile := range []string{"config.yaml", "reporting-config.yaml"} {
 				if !slices.Contains(fileNames, requiredFile) {
 					t.Fatalf("missing required config file %q in custom config dir: %v", requiredFile, fileNames)
 				}
 			}
+			if _, err := os.Stat(filepath.Join(stateHome, "nuclei", "templates.json")); err != nil {
+				t.Fatalf("missing templates state file: %v", err)
+			}
 		}
 	})
 }
@@ -5,9 +5,13 @@ package integration_test

 import (
 	"fmt"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"os"
+	"path/filepath"
+	"strings"

 	"github.com/julienschmidt/httprouter"
 	"github.com/projectdiscovery/nuclei/v3/internal/tests/testutils"
@@ -36,6 +40,55 @@ var fuzzingTestCases = []integrationCase{
 	{Path: "fuzz/fuzz-body-params-sqli.yaml", TestCase: &genericFuzzTestCase{expectedResults: 1}},
 	{Path: "fuzz/fuzz-body-xml-sqli.yaml", TestCase: &genericFuzzTestCase{expectedResults: 1}},
 	{Path: "fuzz/fuzz-body-generic-sqli.yaml", TestCase: &genericFuzzTestCase{expectedResults: 4}},
+	{Path: "fuzz/fuzz-raw-http-input.yaml", TestCase: &rawHttpInputFuzz{}},
+}
+
+// rawHttpInputFuzz seeds the base request from a raw HTTP request file, the
+// shape users have on hand when there is no spec or captured traffic to feed in.
+type rawHttpInputFuzz struct{}
+
+func (h *rawHttpInputFuzz) Execute(filePath string) error {
+	router := httprouter.New()
+	router.POST("/api/login", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		w.Header().Set("Content-Type", "text/html")
+		var payload map[string]string
+		if err := json.Unmarshal(body, &payload); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		// stand in for a backend that interpolates the value into a query
+		if strings.Contains(payload["user"], "'") {
+			_, _ = fmt.Fprint(w, "unrecognized token:")
+			return
+		}
+		_, _ = fmt.Fprintf(w, "welcome %s", payload["user"])
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	target, err := url.Parse(ts.URL)
+	if err != nil {
+		return err
+	}
+	rawRequest := fmt.Sprintf("POST /api/login HTTP/1.1\r\nHost: %s\r\nContent-Type: application/json\r\n\r\n{\"user\":\"admin\"}", target.Host)
+	targetPath := filepath.Join(os.TempDir(), "nuclei-raw-http-input.http")
+	if err := os.WriteFile(targetPath, []byte(rawRequest), 0644); err != nil {
+		return err
+	}
+	defer func() {
+		_ = os.Remove(targetPath)
+	}()
+
+	results, err := testutils.RunNucleiWithArgsAndGetResults(debug, "-t", filePath, "-l", targetPath, "-im", "http", "-dast")
+	if err != nil {
+		return err
+	}
+	return expectResultsCount(results, 1)
 }

 type genericFuzzTestCase struct {
@@ -16,6 +16,7 @@ import (
 	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"

 	"github.com/julienschmidt/httprouter"
@@ -43,6 +44,7 @@ var httpTestcases = []integrationCase{
 	{Path: "protocols/http/post-json-body.yaml", TestCase: &httpPostJSONBody{}},
 	{Path: "protocols/http/post-multipart-body.yaml", TestCase: &httpPostMultipartBody{}},
 	{Path: "protocols/http/raw-cookie-reuse.yaml", TestCase: &httpRawCookieReuse{}},
+	{Path: "protocols/http/disable-cookie-reuse.yaml", TestCase: &httpDisableCookieReuse{}},
 	{Path: "protocols/http/raw-dynamic-extractor.yaml", TestCase: &httpRawDynamicExtractor{}},
 	{Path: "protocols/http/raw-get-query.yaml", TestCase: &httpRawGetQuery{}},
 	{Path: "protocols/http/raw-get.yaml", TestCase: &httpRawGet{}},
@@ -95,6 +97,8 @@ var httpTestcases = []integrationCase{
 	{Path: "protocols/http/response-data-literal-reuse.yaml", TestCase: &httpResponseDataLiteralReuse{}},
 	{Path: "protocols/http/raw-path-single-slash.yaml", TestCase: &httpRawPathSingleSlash{}},
 	{Path: "protocols/http/raw-unsafe-path-single-slash.yaml", TestCase: &httpRawUnsafePathSingleSlash{}},
+	{Path: "protocols/http/disable-http-cache.yaml", TestCase: &httpDisableCache{}},
+	{Path: "protocols/http/http-cache.yaml", TestCase: &httpCache{}},
 }

 type httpMultiVarSharing struct{}
@@ -902,6 +906,29 @@ func (h *httpPaths) Execute(filepath string) error {

 type httpRawCookieReuse struct{}

+type httpDisableCookieReuse struct{}
+
+func (h *httpDisableCookieReuse) Execute(filePath string) error {
+	router := httprouter.New()
+	router.GET("/login", func(w http.ResponseWriter, _ *http.Request, _ httprouter.Params) {
+		http.SetCookie(w, &http.Cookie{Name: "nuclei", Value: "test"})
+		_, _ = fmt.Fprint(w, "logged in")
+	})
+	router.GET("/anonymous", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		if _, err := r.Cookie("nuclei"); errors.Is(err, http.ErrNoCookie) {
+			_, _ = fmt.Fprint(w, "anonymous")
+		}
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug)
+	if err != nil {
+		return err
+	}
+	return expectResultsCount(results, 1)
+}
+
 // Execute executes a test case and returns an error if occurred
 func (h *httpRawCookieReuse) Execute(filePath string) error {
 	router := httprouter.New()
@@ -1825,3 +1852,67 @@ func (h *httpRawUnsafePathSingleSlash) Execute(filepath string) error {
 	}
 	return nil
 }
+
+type httpCache struct{}
+
+func (h *httpCache) Execute(filePath string) error {
+	router := httprouter.New()
+	var requestCount int32
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		atomic.AddInt32(&requestCount, 1)
+		w.Header().Set("Cache-Control", "max-age=2")
+		w.WriteHeader(http.StatusOK)
+		_, _ = fmt.Fprint(w, requestCount)
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug, "-http-cache")
+	if err != nil {
+		return err
+	}
+
+	// We expect 2 results because we made 2 requests and both should match
+	if err := expectResultsCount(results, 2); err != nil {
+		return err
+	}
+
+	// We expect only 1 actual request to the server because of caching
+	if count := atomic.LoadInt32(&requestCount); count != 1 {
+		return fmt.Errorf("expected 1 request to server, got %d", count)
+	}
+
+	return nil
+}
+
+type httpDisableCache struct{}
+
+func (h *httpDisableCache) Execute(filePath string) error {
+	var requestCount int32
+	router := httprouter.New()
+	router.GET("/", func(w http.ResponseWriter, r *http.Request, _ httprouter.Params) {
+		atomic.AddInt32(&requestCount, 1)
+		w.Header().Set("Cache-Control", "max-age=2")
+		w.WriteHeader(http.StatusOK)
+		_, _ = fmt.Fprint(w, requestCount)
+	})
+	ts := httptest.NewServer(router)
+	defer ts.Close()
+
+	results, err := testutils.RunNucleiTemplateAndGetResults(filePath, ts.URL, debug, "-http-cache")
+	if err != nil {
+		return err
+	}
+
+	// We expect 2 results because we made 2 requests and both should match
+	if err := expectResultsCount(results, 2); err != nil {
+		return err
+	}
+
+	// We expect 2 actual requests to the server because cache is disabled
+	if count := atomic.LoadInt32(&requestCount); count != 2 {
+		return fmt.Errorf("expected 2 requests to server, got %d", count)
+	}
+
+	return nil
+}
@@ -18,6 +18,7 @@ import (

 	"github.com/projectdiscovery/nuclei/v3/internal/fuzzplayground"
 	"github.com/projectdiscovery/nuclei/v3/internal/tests/testutils"
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
 )

 type integrationHarness struct {
@@ -63,12 +64,26 @@ func TestMain(m *testing.M) {
 		_ = os.RemoveAll(tempDir)
 		os.Exit(1)
 	}
+	homeDir, err := os.UserHomeDir()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "failed to determine user home directory: %v\n", err)
+		_ = os.RemoveAll(tempDir)
+		os.Exit(1)
+	}
+	templatesDir := filepath.Join(homeDir, config.NucleiTemplatesDirName)
+	config.DefaultConfig.SetTemplatesDir(templatesDir)

 	previousRunner := testutils.DefaultRunner()
 	runner := testutils.NewRunner(
 		testutils.WithBinaryPath(binaryPath),
 		testutils.WithWorkingDir(workingFixturesDir),
 		testutils.WithExtraArgs(integrationExtraArgs...),
+		testutils.WithBaseEnv(
+			"NUCLEI_TEMPLATES_DIR="+templatesDir,
+			"XDG_CONFIG_HOME="+filepath.Join(tempDir, "config"),
+			"XDG_STATE_HOME="+filepath.Join(tempDir, "state"),
+			"XDG_CACHE_HOME="+filepath.Join(tempDir, "cache"),
+		),
 	)
 	testutils.SetDefaultRunner(runner)

@@ -9,6 +9,7 @@ import (
 	"log"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"path/filepath"
 	"strings"
 	"time"
@@ -92,7 +93,14 @@ func executeNucleiAsLibrary(templatePath, templateURL string) ([]string, error)
 		actualTemplatePath = fixturePath(actualTemplatePath)
 	}
 	defaultOpts.Templates = goflags.StringSlice{actualTemplatePath}
-	defaultOpts.ExcludeTags = config.ReadIgnoreFile().Tags
+	ignoreFile, err := config.ReadIgnoreFile()
+	if errors.Is(err, os.ErrNotExist) {
+		defaultOpts.Logger.Warning().Msgf("%s; continuing without ignore exclusions\n", err)
+	} else if err != nil {
+		return nil, err
+	} else {
+		defaultOpts.ExcludeTags = ignoreFile.Tags
+	}

 	outputWriter := testutils.NewMockOutputWriter(defaultOpts.OmitTemplate)
 	var results []string
@@ -106,7 +106,7 @@ func integrationFamilies() []integrationFamily {
 		{Name: "headless", Cases: headlessTestcases},
 		{Name: "whois", Cases: whoisTestCases},
 		{Name: "library", Cases: libraryTestcases},
-		{Name: "template-path", Cases: templatesPathTestCases},
+		{Name: "template-path", Cases: templatesPathTestCases()},
 		{Name: "offline-http", Cases: offlineHttpTestcases},
 		{Name: "fuzz", Cases: fuzzingTestCases},
 		{Name: "generic", Cases: genericTestcases},
@@ -5,25 +5,24 @@ package integration_test

 import (
 	"fmt"
+	"path/filepath"
 	"strings"

 	"github.com/projectdiscovery/nuclei/v3/internal/tests/testutils"
 	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
 )

-func getTemplatePath() string {
-	return config.DefaultConfig.TemplatesDirectory
-}
-
-var templatesPathTestCases = []integrationCase{
-	//template folder path issue
-	{Path: "protocols/http/get.yaml", TestCase: &folderPathTemplateTest{}},
-	//cwd
-	{Path: "./dns/detect-dangling-cname.yaml", TestCase: &cwdTemplateTest{}},
-	//relative path
-	{Path: "dns/dns-saas-service-detection.yaml", TestCase: &relativePathTemplateTest{}},
-	//absolute path
-	{Path: fmt.Sprintf("%v/dns/dns-saas-service-detection.yaml", getTemplatePath()), TestCase: &absolutePathTemplateTest{}},
+func templatesPathTestCases() []integrationCase {
+	return []integrationCase{
+		//template folder path issue
+		{Path: "protocols/http/get.yaml", TestCase: &folderPathTemplateTest{}},
+		//cwd
+		{Path: "./dns/detect-dangling-cname.yaml", TestCase: &cwdTemplateTest{}},
+		//relative path
+		{Path: "dns/dns-saas-service-detection.yaml", TestCase: &relativePathTemplateTest{}},
+		//absolute path
+		{Path: filepath.Join(config.DefaultConfig.TemplatesDirectory, "dns", "dns-saas-service-detection.yaml"), TestCase: &absolutePathTemplateTest{}},
+	}
 }

 type cwdTemplateTest struct{}
@@ -0,0 +1,34 @@
+id: raw-http-input-body-fuzz
+
+info:
+  name: fuzzing json body seeded from a raw http request file
+  author: pdteam
+  severity: info
+  description: |
+    This template fuzzes the json body of a base request seeded from a raw HTTP
+    request file (-im http), covering the shortest path from a single request to
+    a DAST scan.
+
+http:
+  - pre-condition:
+      - type: dsl
+        dsl:
+          - method == "POST"
+          - contains(content_type, "application/json")
+        condition: and
+
+    payloads:
+      injection:
+        - "'"
+
+    fuzzing:
+      - part: body
+        type: postfix
+        mode: single
+        fuzz:
+          - '{{injection}}'
+
+    matchers:
+      - type: word
+        words:
+          - "unrecognized token:"
@@ -0,0 +1,27 @@
+id: disable-cookie-reuse
+
+info:
+  name: Disable Cookie Reuse
+  author: pdteam
+  severity: info
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/login"
+
+    matchers:
+      - type: word
+        words:
+          - "logged in"
+        internal: true
+
+  - method: GET
+    path:
+      - "{{BaseURL}}/anonymous"
+    disable-cookie: true
+
+    matchers:
+      - type: word
+        words:
+          - "anonymous"
@@ -0,0 +1,23 @@
+id: disable-http-cache
+
+info:
+  name: Disable HTTP Cache Test
+  author: dwisiswant0
+  severity: info
+  description: Tests if disable-http-cache works as expected
+  tags: test
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+    disable-http-cache: true
+    matchers:
+      - type: dsl
+        dsl:
+          - body_1 == "1"
+          - body_2 == "2"
@@ -0,0 +1,23 @@
+id: http-cache
+
+info:
+  name: HTTP Cache Test
+  author: dwisiswant0
+  severity: info
+  description: Tests if HTTP cache (RFC 9111) works as expected
+  tags: test
+
+requests:
+  - raw:
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+      - |
+        GET / HTTP/1.1
+        Host: {{Hostname}}
+    disable-http-cache: false
+    matchers:
+      - type: dsl
+        dsl:
+          - body_1 == "1"
+          - body_2 == "1"
@@ -40,7 +40,6 @@ func Cleanup(options *types.Options) {

 // DefaultOptions is the default options structure for nuclei during mocking.
 var DefaultOptions = &types.Options{
-	Metrics:                    false,
 	Debug:                      false,
 	DebugRequests:              false,
 	DebugResponse:              false,
@@ -0,0 +1,28 @@
+package nuclei
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strconv"
+	"testing"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewNucleiEngineRejectsCorruptActiveIgnoreFile(t *testing.T) {
+	root := t.TempDir()
+	path := filepath.Join(root, config.NucleiIgnoreFileName)
+	require.NoError(t, os.WriteFile(path, []byte("tags: ["), 0o600))
+
+	cfg := config.DefaultConfig
+	oldRoot := cfg.TemplatesDirectory
+	t.Cleanup(func() { cfg.SetTemplatesDir(oldRoot) })
+	cfg.SetTemplatesDir(root)
+
+	engine, err := NewNucleiEngineCtx(context.Background())
+	require.Nil(t, engine)
+	require.ErrorContains(t, err, "error parsing")
+	require.ErrorContains(t, err, strconv.Quote(path))
+}
@@ -12,6 +12,7 @@ import (
 	"github.com/projectdiscovery/nuclei/v3/pkg/loader/workflow"
 	"github.com/projectdiscovery/nuclei/v3/pkg/output"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols"
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates"
 	"github.com/projectdiscovery/nuclei/v3/pkg/types"
 	"github.com/projectdiscovery/nuclei/v3/pkg/utils"
 	"github.com/projectdiscovery/utils/errkit"
@@ -22,7 +23,8 @@ import (
 // hence they are ephemeral and are created on every ExecuteNucleiWithOpts invocation
 // in ThreadSafeNucleiEngine
 type unsafeOptions struct {
-	executerOpts *protocols.ExecutorOptions
+	executerOpts    *protocols.ExecutorOptions
+	executionParser *templates.Parser
 }

 // createEphemeralObjects creates ephemeral nuclei objects/instances/types.
@@ -31,7 +33,9 @@ func createEphemeralObjects(ctx context.Context, base *NucleiEngine, opts *types
 	if outputWriter == nil {
 		outputWriter = base.customWriter
 	}
-	u := &unsafeOptions{}
+	u := &unsafeOptions{
+		executionParser: templates.NewExecutionParser(base.parser),
+	}
 	u.executerOpts = &protocols.ExecutorOptions{
 		Output:       outputWriter,
 		Options:      opts,
@@ -42,13 +46,12 @@ func createEphemeralObjects(ctx context.Context, base *NucleiEngine, opts *types
 		Interactsh:   base.interactshClient,
 		Colorizer:    aurora.New(aurora.WithColors(true)),
 		ResumeCfg:    types.NewResumeCfg(),
-		Parser:       base.parser,
+		Parser:       u.executionParser,
 		Browser:      base.browserInstance,
-		// Thread-safe executes can run concurrently with different Output writers.
-		// The compiled-template cache shallow-copies requests and mutates shared
-		// ExecutorOptions.Output via UpdateOptions/ApplyNewEngineOptions, which
-		// would otherwise route all findings to whichever call last won the race.
-		DoNotCache: true,
+		// Each execution has a private compiled-template cache because compiled
+		// requests retain mutable ExecutorOptions. Only clean parsed templates are
+		// shared with the long-lived engine parser.
+		DoNotCache: false,
 	}
 	if opts.ShouldUseHostError() && base.hostErrCache != nil {
 		u.executerOpts.HostErrorsCache = base.hostErrCache
@@ -64,6 +67,32 @@ func createEphemeralObjects(ctx context.Context, base *NucleiEngine, opts *types
 	return u, nil
 }

+// restoreBaseExcludeTags re-adds any of the engine's baseline excluded tags that
+// a per-execution option dropped, appending only what is missing so the result
+// is order-stable and repeated application is a no-op.
+//
+// The current ExcludeTags slice is cloned before merging so a caller-owned
+// backing array (e.g. a reused WithTemplateFilters ExcludeTags value with spare
+// capacity) is never mutated or shared across concurrent executions.
+func restoreBaseExcludeTags(base []string, opts *types.Options) {
+	if len(base) == 0 {
+		return
+	}
+	merged := append([]string(nil), opts.ExcludeTags...)
+	present := make(map[string]struct{}, len(merged)+len(base))
+	for _, tag := range merged {
+		present[tag] = struct{}{}
+	}
+	for _, tag := range base {
+		if _, ok := present[tag]; ok {
+			continue
+		}
+		merged = append(merged, tag)
+		present[tag] = struct{}{}
+	}
+	opts.ExcludeTags = merged
+}
+
 // resolveEphemeralOutput combines the base/global writer with any per-call result callbacks.
 // Global callbacks keep working; per-call callbacks are isolated to this execution.
 func resolveEphemeralOutput(base, call *NucleiEngine) output.Writer {
@@ -90,6 +119,10 @@ func resolveEphemeralOutput(base, call *NucleiEngine) output.Writer {

 // closeEphemeralObjects closes all resources used by ephemeral nuclei objects/instances/types
 func closeEphemeralObjects(u *unsafeOptions) {
+	if u.executionParser != nil {
+		u.executionParser.PurgeCompiled()
+		u.executionParser = nil
+	}
 	if u.executerOpts.RateLimiter != nil {
 		u.executerOpts.RateLimiter.Stop()
 	}
@@ -161,6 +194,18 @@ func (e *ThreadSafeNucleiEngine) ExecuteNucleiWithOptsCtx(ctx context.Context, t
 			return err
 		}
 	}
+	// Per-execution options land on a COPY of the engine's options, so an option
+	// that assigns a whole filter set clears every field it does not name —
+	// WithTemplateFilters does exactly that. ExcludeTags is one of those fields,
+	// and it carries the .nuclei-ignore deny-list that applyRequiredDefaults
+	// installed at construction; nothing re-reads the ignore file afterwards, so
+	// the exclusions would be lost for this execution and templates tagged dos,
+	// bruteforce, fuzz, local or txt-service would run.
+	//
+	// Restore the engine's baseline exclusions so a per-execution filter can add
+	// to them but never silently discard them. IncludeTags remains the explicit
+	// per-tag override for callers who do want an ignored template to run.
+	restoreBaseExcludeTags(e.eng.opts.ExcludeTags, tmpEngine.opts)

 	// create ephemeral nuclei objects/instances/types using base nuclei engine
 	unsafeOpts, err := createEphemeralObjects(ctx, e.eng, tmpEngine.opts, resolveEphemeralOutput(e.eng, tmpEngine))
@@ -0,0 +1,161 @@
+package nuclei_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+
+	nuclei "github.com/projectdiscovery/nuclei/v3/lib"
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+	"github.com/projectdiscovery/nuclei/v3/pkg/output"
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// TestExecuteNucleiWithOptsCtxKeepsBaseExcludeTags covers the case where a
+// per-execution filter that names only Tags used to clear the engine's
+// ExcludeTags — which carry the .nuclei-ignore deny-list installed at
+// construction — letting templates tagged dos (and local, fuzz, bruteforce,
+// txt-service) execute against the target.
+//
+// The engine's construction-time ExcludeTags stand in for that deny-list, and
+// the per-execution filter deliberately asks for the excluded tag: exclusion
+// must still win, because IncludeTags is the documented way to override it.
+func TestExecuteNucleiWithOptsCtxKeepsBaseExcludeTags(t *testing.T) {
+	templatePath := writeSDKDosTaggedTemplate(t)
+
+	var reached atomic.Bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached.Store(true)
+		_, _ = w.Write([]byte("token-dos"))
+	}))
+	t.Cleanup(srv.Close)
+
+	ne, err := nuclei.NewThreadSafeNucleiEngineCtx(context.Background(),
+		nuclei.WithTemplateFilters(nuclei.TemplateFilters{ExcludeTags: []string{"dos"}}),
+	)
+	require.NoError(t, err, "could not create thread-safe nuclei engine")
+	t.Cleanup(ne.Close)
+
+	var matches atomic.Int64
+	ne.GlobalResultCallback(func(*output.ResultEvent) { matches.Add(1) })
+
+	err = ne.ExecuteNucleiWithOptsCtx(context.Background(), []string{srv.URL},
+		nuclei.WithTemplatesOrWorkflows(nuclei.TemplateSources{Templates: []string{templatePath}}),
+		nuclei.WithTemplateFilters(nuclei.TemplateFilters{Tags: []string{"dos"}}),
+	)
+
+	require.ErrorIs(t, err, nuclei.ErrNoTemplatesAvailable,
+		"the dos-tagged template must stay excluded, leaving nothing to run")
+	assert.Zero(t, matches.Load(), "an excluded template must not report results")
+	assert.False(t, reached.Load(), "an excluded template must not reach the target")
+}
+
+// TestExecuteNucleiWithOptsCtxHonoursIncludeTags is the other half of the
+// contract: restoring the baseline exclusions must not break the documented
+// per-tag override, or callers lose the only way to run an ignored template.
+func TestExecuteNucleiWithOptsCtxHonoursIncludeTags(t *testing.T) {
+	templatePath := writeSDKDosTaggedTemplate(t)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte("token-dos"))
+	}))
+	t.Cleanup(srv.Close)
+
+	ne, err := nuclei.NewThreadSafeNucleiEngineCtx(context.Background(),
+		nuclei.WithTemplateFilters(nuclei.TemplateFilters{ExcludeTags: []string{"dos"}}),
+	)
+	require.NoError(t, err, "could not create thread-safe nuclei engine")
+	t.Cleanup(ne.Close)
+
+	var matches atomic.Int64
+	ne.GlobalResultCallback(func(*output.ResultEvent) { matches.Add(1) })
+
+	err = ne.ExecuteNucleiWithOptsCtx(context.Background(), []string{srv.URL},
+		nuclei.WithTemplatesOrWorkflows(nuclei.TemplateSources{Templates: []string{templatePath}}),
+		nuclei.WithTemplateFilters(nuclei.TemplateFilters{IncludeTags: []string{"dos"}}),
+	)
+
+	require.NoError(t, err)
+	assert.NotZero(t, matches.Load(), "IncludeTags should still override the exclusion")
+}
+
+func writeSDKDosTaggedTemplate(t *testing.T) string {
+	t.Helper()
+	dir := t.TempDir()
+	path := filepath.Join(dir, "sdk-dos-tagged.yaml")
+	content := `id: sdk-dos-tagged
+info:
+  name: SDK dos tagged
+  author: nuclei-sdk-test
+  severity: info
+  tags: dos
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/"
+    matchers:
+      - type: word
+        words:
+          - "token-"
+`
+	require.NoError(t, os.WriteFile(path, []byte(content), 0o600))
+	return path
+}
+
+// TestExecuteNucleiWithOptsCtxKeepsIgnoreFileExcludeTags is the end-to-end path
+// for #7695 once #7697 is on the tree: tags from a real .nuclei-ignore must
+// survive a per-execution WithTemplateFilters that only sets Tags.
+func TestExecuteNucleiWithOptsCtxKeepsIgnoreFileExcludeTags(t *testing.T) {
+	previousConfigDir := config.DefaultConfig.GetConfigDir()
+	previousTemplatesDir := config.DefaultConfig.TemplatesDirectory
+	previousStateDir := config.DefaultConfig.GetStateDir()
+	t.Cleanup(func() {
+		config.DefaultConfig.SetConfigDir(previousConfigDir)
+		config.DefaultConfig.SetStateDir(previousStateDir)
+		config.DefaultConfig.SetTemplatesDir(previousTemplatesDir)
+	})
+
+	dir := t.TempDir()
+	config.DefaultConfig.SetConfigDir(dir)
+	config.DefaultConfig.SetTemplatesDir(dir)
+
+	require.NoError(t, os.WriteFile(
+		config.DefaultConfig.GetActiveIgnoreFilePath(),
+		[]byte("tags:\n  - dos\n"),
+		0o600,
+	))
+
+	templatePath := writeSDKDosTaggedTemplate(t)
+
+	var reached atomic.Bool
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		reached.Store(true)
+		_, _ = w.Write([]byte("token-dos"))
+	}))
+	t.Cleanup(srv.Close)
+
+	ne, err := nuclei.NewThreadSafeNucleiEngineCtx(context.Background(),
+		nuclei.WithOptions(types.DefaultOptions()),
+		nuclei.DisableUpdateCheck(),
+	)
+	require.NoError(t, err, "could not create thread-safe nuclei engine")
+	t.Cleanup(ne.Close)
+	var matches atomic.Int64
+	ne.GlobalResultCallback(func(*output.ResultEvent) { matches.Add(1) })
+
+	err = ne.ExecuteNucleiWithOptsCtx(context.Background(), []string{srv.URL},
+		nuclei.WithTemplatesOrWorkflows(nuclei.TemplateSources{Templates: []string{templatePath}}),
+		nuclei.WithTemplateFilters(nuclei.TemplateFilters{Tags: []string{"dos"}}),
+	)
+
+	require.ErrorIs(t, err, nuclei.ErrNoTemplatesAvailable,
+		"ignore-file dos exclusion must survive a Tags-only per-execution filter")
+	assert.Zero(t, matches.Load())
+	assert.False(t, reached.Load())
+}
@@ -0,0 +1,123 @@
+package nuclei
+
+import (
+	"context"
+	"sync"
+	"testing"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates"
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestEphemeralObjectsUseExecutionLocalParser(t *testing.T) {
+	baseParser := templates.NewParser()
+	baseParser.Cache().Store("parsed", &templates.Template{}, []byte("raw"), nil)
+	base := &NucleiEngine{parser: baseParser}
+
+	first, err := createEphemeralObjects(context.Background(), base, types.DefaultOptions(), nil)
+	require.NoError(t, err)
+	second, err := createEphemeralObjects(context.Background(), base, types.DefaultOptions(), nil)
+	require.NoError(t, err)
+	t.Cleanup(func() { closeEphemeralObjects(second) })
+
+	firstParser, ok := first.executerOpts.Parser.(*templates.Parser)
+	require.True(t, ok)
+	secondParser, ok := second.executerOpts.Parser.(*templates.Parser)
+	require.True(t, ok)
+
+	require.NotSame(t, baseParser, firstParser)
+	require.NotSame(t, firstParser, secondParser)
+	require.Same(t, baseParser.Cache(), firstParser.Cache())
+	require.Same(t, baseParser.Cache(), secondParser.Cache())
+	require.NotSame(t, firstParser.CompiledCache(), secondParser.CompiledCache())
+	require.False(t, first.executerOpts.DoNotCache)
+
+	firstParser.CompiledCache().StoreWithoutRaw("compiled", &templates.Template{}, nil)
+	require.Equal(t, 1, firstParser.CompiledCount())
+	require.Zero(t, secondParser.CompiledCount())
+
+	closeEphemeralObjects(first)
+	require.Zero(t, firstParser.CompiledCount())
+	require.Equal(t, 1, baseParser.ParsedCount())
+}
+
+func TestRestoreBaseExcludeTags(t *testing.T) {
+	tests := []struct {
+		name     string
+		base     []string
+		current  []string
+		expected []string
+	}{
+		{
+			name:     "per-execution filter cleared the deny-list",
+			base:     []string{"dos", "fuzz"},
+			current:  nil,
+			expected: []string{"dos", "fuzz"},
+		},
+		{
+			name:     "per-execution exclusions are kept alongside the baseline",
+			base:     []string{"dos"},
+			current:  []string{"custom"},
+			expected: []string{"custom", "dos"},
+		},
+		{
+			name:     "entries already present are not duplicated",
+			base:     []string{"dos", "fuzz"},
+			current:  []string{"fuzz"},
+			expected: []string{"fuzz", "dos"},
+		},
+		{
+			name:     "no baseline is a no-op",
+			base:     nil,
+			current:  []string{"custom"},
+			expected: []string{"custom"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			opts := &types.Options{ExcludeTags: tt.current}
+			restoreBaseExcludeTags(tt.base, opts)
+			assert.Equal(t, tt.expected, []string(opts.ExcludeTags))
+		})
+	}
+}
+
+// TestRestoreBaseExcludeTagsIsIdempotent matters because the helper runs on
+// every execution against a long-lived engine.
+func TestRestoreBaseExcludeTagsIsIdempotent(t *testing.T) {
+	opts := &types.Options{}
+	restoreBaseExcludeTags([]string{"dos", "fuzz"}, opts)
+	restoreBaseExcludeTags([]string{"dos", "fuzz"}, opts)
+
+	assert.Equal(t, []string{"dos", "fuzz"}, []string(opts.ExcludeTags))
+}
+
+// TestRestoreBaseExcludeTagsDoesNotMutateCallerSlice guards the concurrent
+// ThreadSafeNucleiEngine case where WithTemplateFilters assigns a caller-owned
+// ExcludeTags slice with spare capacity: a naive append would race and mutate
+// the caller's backing array.
+func TestRestoreBaseExcludeTagsDoesNotMutateCallerSlice(t *testing.T) {
+	shared := make([]string, 1, 8)
+	shared[0] = "custom"
+	base := []string{"dos", "fuzz"}
+
+	var wg sync.WaitGroup
+	for i := 0; i < 32; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			opts := &types.Options{ExcludeTags: shared}
+			restoreBaseExcludeTags(base, opts)
+			if got := []string(opts.ExcludeTags); len(got) != 3 || got[0] != "custom" || got[1] != "dos" || got[2] != "fuzz" {
+				panic(got)
+			}
+		}()
+	}
+	wg.Wait()
+
+	assert.Equal(t, []string{"custom"}, shared[:1])
+	assert.Equal(t, make([]string, 7), shared[1:cap(shared)])
+}
@@ -0,0 +1,70 @@
+package nuclei
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/templates"
+	"github.com/projectdiscovery/nuclei/v3/pkg/types"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCallerParserUsesEngineLocalCompiledCache(t *testing.T) {
+	templatePath := filepath.Join(t.TempDir(), "template.yaml")
+	require.NoError(t, os.WriteFile(templatePath, []byte(`id: parser-lifecycle
+
+info:
+  name: Parser lifecycle
+  author: pdteam
+  severity: info
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}"
+`), 0o600))
+
+	callerParser := templates.NewParser()
+	callerParser.Cache().StoreWithoutRaw("sentinel", &templates.Template{}, nil)
+
+	for range 3 {
+		compiledParser := func() *templates.Parser {
+			opts := types.DefaultOptions()
+			opts.Parser = callerParser
+			opts.Templates = []string{templatePath}
+
+			engine, err := NewNucleiEngineCtx(context.Background(), DisableUpdateCheck(), WithOptions(opts))
+			require.NoError(t, err)
+
+			engineParser := engine.GetParser()
+			require.Same(t, callerParser, engineParser)
+			require.False(t, engine.GetExecuterOptions().DoNotCache)
+
+			compiledParser, ok := engine.GetExecuterOptions().Parser.(*templates.Parser)
+			require.True(t, ok)
+			require.NotSame(t, callerParser, compiledParser)
+			require.Same(t, callerParser.Cache(), compiledParser.Cache())
+
+			require.NoError(t, engine.LoadAllTemplates())
+			require.Len(t, engine.GetTemplates(), 1)
+			require.Equal(t, 0, callerParser.CompiledCount())
+			require.Equal(t, 1, compiledParser.CompiledCount())
+			require.Equal(t, 2, callerParser.ParsedCount())
+			require.NoError(t, engine.LoadAllTemplates())
+			require.Len(t, engine.GetTemplates(), 1)
+			require.Equal(t, 1, compiledParser.CompiledCount())
+
+			engine.Close()
+			return compiledParser
+		}()
+
+		require.Equal(t, 0, callerParser.CompiledCount())
+		require.Equal(t, 0, compiledParser.CompiledCount())
+		require.Equal(t, 2, callerParser.ParsedCount())
+		cached, err := callerParser.Cache().Get("sentinel")
+		require.NoError(t, err)
+		require.NotNil(t, cached)
+	}
+}
@@ -81,6 +81,7 @@ type NucleiEngine struct {
 	browserInstance  *engine.Browser
 	httpClient       *retryablehttp.Client
 	parser           *templates.Parser
+	compiledParser   *templates.Parser
 	ownsParser       bool // true when the engine created the parser and may purge it on Close
 	authprovider     authprovider.AuthProvider

@@ -276,10 +277,11 @@ func (e *NucleiEngine) closeInternal() {
 	if e.opts != nil {
 		generators.ClearOptionsPayloadMap(e.opts)
 	}
-	// Purge the template caches (compiled templates are heap-heavy) so a
-	// long-running embedder does not retain them for the process lifetime.
-	// Only do this when the engine created the parser; a caller-supplied
-	// parser is an opt-in shared cache the caller owns.
+	// Purge engine-owned template caches. A caller-supplied parser remains
+	// untouched, while its engine-local compiled cache is always released.
+	if e.compiledParser != nil && e.compiledParser != e.parser {
+		e.compiledParser.CompiledCache().Purge()
+	}
 	if e.ownsParser && e.parser != nil {
 		e.parser.Purge()
 	}
@@ -135,15 +135,37 @@ func (e *NucleiEngine) applyRequiredDefaults(ctx context.Context) {
 		e.opts.ExcludeTags = []string{}
 	}

-	// these templates are known to have weak matchers
-	// and idea is to disable them to avoid false positives
-	e.opts.ExcludeTags = append(e.opts.ExcludeTags, config.ReadIgnoreFile().Tags...)
-
 	e.inputProvider = provider.NewSimpleInputProvider()
 }

+func (e *NucleiEngine) loadIgnoreFile() error {
+	ignoreFile, err := config.ReadIgnoreFile()
+	if errors.Is(err, os.ErrNotExist) {
+		e.Logger.Warning().Msgf("Could not read active .nuclei-ignore file: %s; continuing without ignore exclusions", err)
+
+		return nil
+	}
+
+	if err != nil {
+		return err
+	}
+
+	// .nuclei-ignore blocks templates that should not run by default, by tag
+	// (dos, fuzz, ...) and by path (templates known to have weak matchers, which
+	// would otherwise generate false positives). Both sections are applied, as
+	// the CLI runner does — applying only the tags leaves the `files` section
+	// inert for every SDK consumer.
+	e.opts.ExcludeTags = append(e.opts.ExcludeTags, ignoreFile.Tags...)
+	e.opts.ExcludedTemplates = append(e.opts.ExcludedTemplates, ignoreFile.Files...)
+
+	return nil
+}
+
 // init
 func (e *NucleiEngine) init(ctx context.Context) error {
+	if err := config.DefaultConfig.InitializationError(); err != nil {
+		return errors.Wrap(err, "initialize nuclei configuration")
+	}
 	// Update logger ref (if it was changed by [WithLogger])
 	// (Logger is already initialized)
 	if e.opts.Logger != e.Logger {
@@ -162,6 +184,10 @@ func (e *NucleiEngine) init(ctx context.Context) error {
 		return err
 	}

+	if err := e.loadIgnoreFile(); err != nil {
+		return err
+	}
+
 	if e.opts.Parser != nil {
 		if op, ok := e.opts.Parser.(*templates.Parser); ok {
 			e.parser = op
@@ -172,6 +198,14 @@ func (e *NucleiEngine) init(ctx context.Context) error {
 		e.parser = templates.NewParser()
 		e.ownsParser = true
 	}
+	e.compiledParser = e.parser
+	if !e.ownsParser {
+		// Compiled templates retain engine-local ExecutorOptions. Keep their
+		// cache private while the caller-owned parser provides the parsed cache.
+		e.compiledParser = templates.NewParserWithParsedCache(e.parser.Cache())
+		e.compiledParser.ShouldValidate = e.parser.ShouldValidate
+		e.compiledParser.NoStrictSyntax = e.parser.NoStrictSyntax
+	}

 	if protocolstate.ShouldInit(e.opts.ExecutionId) {
 		_ = protocolinit.Init(e.opts)
@@ -250,7 +284,8 @@ func (e *NucleiEngine) init(ctx context.Context) error {
 		Colorizer:          aurora.New(aurora.WithColors(true)),
 		ResumeCfg:          types.NewResumeCfg(),
 		Browser:            e.browserInstance,
-		Parser:             e.parser,
+		Parser:             e.compiledParser,
+		DoNotCache:         e.opts.DoNotCacheTemplates,
 		InputHelper:        input.NewHelper(),
 		TemporaryDirectory: e.tmpDir,
 		Logger:             e.opts.Logger,
@@ -306,8 +341,6 @@ func (e *NucleiEngine) init(ctx context.Context) error {
 		if cachedParser, ok := e.opts.Parser.(*templates.Parser); ok {
 			e.parser = cachedParser
 			e.opts.Parser = cachedParser
-			e.executerOpts.Parser = cachedParser
-			e.executerOpts.Options.Parser = cachedParser
 		}
 	}

@@ -332,14 +365,23 @@ func (e *NucleiEngine) init(ctx context.Context) error {
 		e.httpxClient = nucleiUtils.GetInputLivenessChecker(client)
 	}

-	// Only Happens once regardless how many times this function is called
-	// This will update ignore file to filter out templates with weak matchers to avoid false positives
-	// and also upgrade templates to latest version if available
-	installer.NucleiSDKVersionCheck()
-
 	if DefaultConfig.CanCheckForUpdates() {
-		return e.processUpdateCheckResults()
+		// Only Happens once regardless how many times this function is called
+		// This will update ignore file to filter out templates with weak matchers to avoid false positives
+		// and also upgrade templates to latest version if available
+		latestIgnoreHash, _ := installer.NucleiSDKVersionCheck()
+
+		if err := e.processUpdateCheckResults(); err != nil {
+			return err
+		}
+
+		if DefaultConfig.IgnoreFileNeedsUpdate(latestIgnoreHash) {
+			if err := installer.UpdateIgnoreFile(); err != nil {
+				e.opts.Logger.Warning().Msgf("failed to update nuclei ignore file: %s\n", err)
+			}
+		}
 	}
+
 	return nil
 }

@@ -8,6 +8,7 @@ import (
 	"time"

 	nuclei "github.com/projectdiscovery/nuclei/v3/lib"
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
 	"github.com/projectdiscovery/nuclei/v3/pkg/types"
 	"github.com/stretchr/testify/require"
 )
@@ -120,3 +121,37 @@ func TestWithOptionsRateLimitSetsRuntimeLimiter(t *testing.T) {
 	require.NotNil(t, execOpts.RateLimiter, "rate limiter should be initialized")
 	require.Equal(t, opts.RateLimit, int(execOpts.RateLimiter.GetLimit()), "runtime limiter should match rate limit from WithOptions")
 }
+
+// TestIgnoreFileFilesSectionIsApplied verifies the SDK applies BOTH sections of
+// .nuclei-ignore, matching the CLI runner. The files section suppresses
+// templates known to have weak matchers, so skipping it hands SDK consumers
+// false positives the CLI would never report.
+func TestIgnoreFileFilesSectionIsApplied(t *testing.T) {
+	previousConfigDir := config.DefaultConfig.GetConfigDir()
+	previousTemplatesDir := config.DefaultConfig.TemplatesDirectory
+	previousStateDir := config.DefaultConfig.GetStateDir()
+	t.Cleanup(func() {
+		config.DefaultConfig.SetConfigDir(previousConfigDir)
+		config.DefaultConfig.SetStateDir(previousStateDir)
+		config.DefaultConfig.SetTemplatesDir(previousTemplatesDir)
+	})
+
+	dir := t.TempDir()
+	config.DefaultConfig.SetConfigDir(dir)
+	config.DefaultConfig.SetTemplatesDir(dir)
+
+	ignoreFile := "tags:\n  - dos\nfiles:\n  - http/fuzzing/wordpress-themes-detect.yaml\n"
+	require.NoError(t, os.WriteFile(config.DefaultConfig.GetActiveIgnoreFilePath(), []byte(ignoreFile), 0o600))
+
+	ne, err := nuclei.NewNucleiEngineCtx(context.Background(),
+		nuclei.WithOptions(types.DefaultOptions()),
+		nuclei.DisableUpdateCheck(),
+	)
+	require.NoError(t, err, "could not create nuclei engine")
+	defer ne.Close()
+
+	require.Contains(t, ne.Options().ExcludeTags, "dos",
+		"tags section should reach ExcludeTags")
+	require.Contains(t, ne.Options().ExcludedTemplates, "http/fuzzing/wordpress-themes-detect.yaml",
+		"files section should reach ExcludedTemplates")
+}
@@ -28,6 +28,9 @@ var knownLeaks = []goleak.Option{
 	goleak.IgnoreAnyContainingPkg("github.com/syndtr/goleveldb"),
 	goleak.IgnoreAnyContainingPkg("github.com/projectdiscovery/ratelimit"),
 	goleak.IgnoreAnyFunction("github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/protocolstate.StartActiveMemGuardian.func1"),
+	// NOTE(dwisiswant0): This is an indirect call and not used anywhere, not
+	// even within SOPS (#5841). See `go mod why go.opencensus.io/stats/view`.
+	goleak.IgnoreAnyContainingPkg("go.opencensus.io/stats/view"),
 }

 func TestSimpleNuclei(t *testing.T) {
@@ -880,6 +880,11 @@
          "title": "optional disable cookie reuse",
          "description": "Optional setting that disables cookie reuse"
        },
+        "disable-http-cache": {
+          "type": "boolean",
+          "title": "disable HTTP cache",
+          "description": "Turns off HTTP caching for this request; cannot enable cache when -http-cache is unset"
+        },
        "read-all": {
          "type": "boolean",
          "title": "force read all body",
@@ -1,9 +1,13 @@
 package authx

 import (
+	"bytes"
 	"fmt"
+	"runtime"
+	"strconv"
 	"strings"
 	"sync"
+	"sync/atomic"

 	"github.com/projectdiscovery/gologger"
 	"github.com/projectdiscovery/nuclei/v3/pkg/protocols/common/replacer"
@@ -19,6 +23,9 @@ type LazyFetchSecret func(d *Dynamic) error
 type fetchState struct {
 	once sync.Once
 	err  error
+	// owner is the goroutine running the fetch callback. Nested Fetch/GetStrategies
+	// on that goroutine must not wait on once (sync.Once deadlocks on re-entry).
+	owner atomic.Int64
 }

 var (
@@ -191,6 +198,11 @@ func (d *Dynamic) applyValuesToSecret(secret *Secret) error {

 // GetStrategies returns the auth strategies for the dynamic secret
 func (d *Dynamic) GetStrategies() []AuthStrategy {
+	// Nested lookup from inside the fetch callback (login template ApplyAuth)
+	// must not wait on Fetch and must not apply still-unresolved secrets.
+	if d.fetchingOnThisGoroutine() {
+		return nil
+	}
 	// Ensure fetch has completed before returning strategies.
 	// Fetch errors are treated as non-fatal here so a failed dynamic auth fetch
 	// does not terminate the entire scan process.
@@ -219,7 +231,13 @@ func (d *Dynamic) Fetch(isFatal bool) error {
 		return errkit.New("dynamic secret not validated: call Validate() before Fetch()")
 	}

+	if d.fetchingOnThisGoroutine() {
+		return d.fetchState.err
+	}
+
 	d.fetchState.once.Do(func() {
+		d.fetchState.owner.Store(goroutineID())
+		defer d.fetchState.owner.Store(0)
 		if d.fetchCallback == nil {
 			d.fetchState.err = errkit.New("dynamic secret fetch callback not set: call SetLazyFetchCallback() before Fetch()")
 			return
@@ -240,3 +258,31 @@ func (d *Dynamic) Error() error {
 	}
 	return d.fetchState.err
 }
+
+func (d *Dynamic) fetchingOnThisGoroutine() bool {
+	if d == nil || d.fetchState == nil {
+		return false
+	}
+	owner := d.fetchState.owner.Load()
+	return owner != 0 && owner == goroutineID()
+}
+
+func goroutineID() int64 {
+	var buf [64]byte
+	n := runtime.Stack(buf[:], false)
+	s := buf[:n]
+	const prefix = "goroutine "
+	if !bytes.HasPrefix(s, []byte(prefix)) {
+		return 0
+	}
+	s = s[len(prefix):]
+	i := bytes.IndexByte(s, ' ')
+	if i <= 0 {
+		return 0
+	}
+	id, err := strconv.ParseInt(string(s[:i]), 10, 64)
+	if err != nil {
+		return 0
+	}
+	return id
+}
@@ -226,6 +226,78 @@ func TestDynamicFetchConcurrent(t *testing.T) {
 	})
 }

+func TestDynamicFetchReentry(t *testing.T) {
+	t.Run("nested Fetch from callback does not deadlock", func(t *testing.T) {
+		d := &Dynamic{
+			TemplatePath: "auth.yaml",
+			Variables:    []KV{{Key: "user", Value: "admin"}},
+		}
+		require.NoError(t, d.Validate())
+
+		var nestedErr error
+		d.SetLazyFetchCallback(func(dynamic *Dynamic) error {
+			nestedErr = dynamic.Fetch(false)
+			dynamic.Extracted = map[string]interface{}{"token": "abc"}
+			return nil
+		})
+
+		done := make(chan error, 1)
+		go func() {
+			done <- d.Fetch(false)
+		}()
+
+		select {
+		case err := <-done:
+			require.NoError(t, err)
+			require.NoError(t, nestedErr)
+		case <-time.After(2 * time.Second):
+			t.Fatal("Fetch deadlocked on re-entry")
+		}
+	})
+
+	t.Run("nested GetStrategies does not apply unresolved secrets", func(t *testing.T) {
+		d := &Dynamic{
+			Secret: &Secret{
+				Type:    "Header",
+				Domains: []string{"example.com"},
+				Headers: []KV{{Key: "X-Token", Value: "{{token}}"}},
+			},
+			TemplatePath: "auth.yaml",
+			Variables:    []KV{{Key: "user", Value: "admin"}},
+		}
+		require.NoError(t, d.Validate())
+
+		d.SetLazyFetchCallback(func(dynamic *Dynamic) error {
+			req, err := http.NewRequest(http.MethodGet, "https://example.com", nil)
+			require.NoError(t, err)
+			strategy := &DynamicAuthStrategy{Dynamic: *dynamic}
+			strategy.Apply(req)
+			require.Empty(t, req.Header.Get("X-Token"), "login request must not receive secret-file auth during fetch")
+			require.Nil(t, dynamic.GetStrategies())
+			dynamic.Extracted = map[string]interface{}{"token": "abc"}
+			return nil
+		})
+
+		done := make(chan error, 1)
+		go func() {
+			done <- d.Fetch(false)
+		}()
+
+		select {
+		case err := <-done:
+			require.NoError(t, err)
+		case <-time.After(2 * time.Second):
+			t.Fatal("GetStrategies deadlocked on re-entry")
+		}
+
+		req, err := http.NewRequest(http.MethodGet, "https://example.com", nil)
+		require.NoError(t, err)
+		strategy := &DynamicAuthStrategy{Dynamic: *d}
+		strategy.Apply(req)
+		require.Equal(t, "abc", req.Header.Get("X-Token"), "scan requests must still receive secrets after fetch")
+	})
+}
+
 func TestDynamicValidate(t *testing.T) {
 	t.Run("missing template path", func(t *testing.T) {
 		d := &Dynamic{
@@ -1,12 +1,15 @@
 package authx

 import (
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
 	"regexp"
 	"strings"

+	"github.com/getsops/sops/v3"
+	"github.com/getsops/sops/v3/decrypt"
 	"github.com/projectdiscovery/nuclei/v3/pkg/utils/json"
 	"github.com/projectdiscovery/utils/errkit"
 	"github.com/projectdiscovery/utils/generic"
@@ -205,18 +208,30 @@ func (c *Cookie) Parse() error {

 // GetAuthDataFromFile reads the auth data from file
 func GetAuthDataFromFile(file string) (*Authx, error) {
-	ext := filepath.Ext(file)
-	if !generic.EqualsAny(ext, ".yml", ".yaml", ".json") {
-		return nil, fmt.Errorf("invalid file extension: supported extensions are .yml,.yaml and .json got %s", ext)
+	var data []byte
+
+	ext := strings.TrimPrefix(filepath.Ext(file), ".")
+	if !generic.EqualsAny(ext, "yml", "yaml", "json") {
+		return nil, fmt.Errorf(`unsupported extensions: valid extensions are "yml", "yaml", and "json"; got %q`, ext)
 	}
-	bin, err := os.ReadFile(file)
+
+	data, err := decrypt.File(file, ext)
 	if err != nil {
-		return nil, err
+		if errors.Is(err, sops.MetadataNotFound) {
+			data, err = os.ReadFile(file)
+			if err != nil {
+				return nil, fmt.Errorf("could not read secret file: %w", err)
+			}
+		} else {
+			return nil, fmt.Errorf("could not decrypt file: %w", err)
+		}
 	}
-	if ext == ".yml" || ext == ".yaml" {
-		return GetAuthDataFromYAML(bin)
+
+	if ext == "yml" || ext == "yaml" {
+		return GetAuthDataFromYAML(data)
 	}
-	return GetAuthDataFromJSON(bin)
+
+	return GetAuthDataFromJSON(data)
 }

 // GetTemplatePathsFromSecretFile reads the template IDs from the secret file
@@ -1,20 +1,100 @@
 package authx

 import (
+	"crypto/rand"
+	"os"
+	"path/filepath"
 	"testing"
+	"time"

+	"filippo.io/age"
+	"github.com/getsops/sops/v3"
+	"github.com/getsops/sops/v3/aes"
+	sopsage "github.com/getsops/sops/v3/age"
+	"github.com/getsops/sops/v3/config"
+	"github.com/getsops/sops/v3/stores/yaml"
+	"github.com/getsops/sops/v3/version"
 	"github.com/stretchr/testify/require"
 )

 func TestSecretsUnmarshal(t *testing.T) {
-	loc := "testData/example-auth.yaml"
-	data, err := GetAuthDataFromFile(loc)
-	require.Nil(t, err, "could not read secrets file")
+	data, err := GetAuthDataFromFile("testData/example-auth.yaml")
+	require.NoError(t, err, "could not read secrets file")
 	require.NotNil(t, data, "could not read secrets file")
+
+	t.Run("encrypted", func(t *testing.T) {
+		loc := encryptAuthFile(t, "testData/example-auth.yaml")
+		decryptedData, err := GetAuthDataFromFile(loc)
+		require.NoError(t, err, "could not read encrypted secrets file")
+		require.NotNil(t, decryptedData, "could not read secrets file")
+		require.Equal(t, data, decryptedData, "decrypted data should match original data")
+
+		for _, s := range decryptedData.Secrets {
+			require.NoError(t, s.Validate(), "could not validate secret")
+		}
+
+		for _, d := range decryptedData.Dynamic {
+			require.NoError(t, d.Validate(), "could not validate dynamic")
+		}
+	})
+
 	for _, s := range data.Secrets {
-		require.Nil(t, s.Validate(), "could not validate secret")
+		require.NoError(t, s.Validate(), "could not validate secret")
 	}
+
 	for _, d := range data.Dynamic {
-		require.Nil(t, d.Validate(), "could not validate dynamic")
+		require.NoError(t, d.Validate(), "could not validate dynamic")
 	}
 }
+
+func encryptAuthFile(t *testing.T, source string) string {
+	t.Helper()
+
+	plaintext, err := os.ReadFile(source)
+	require.NoError(t, err)
+
+	identity, err := age.GenerateX25519Identity()
+	require.NoError(t, err)
+	t.Setenv(sopsage.SopsAgeKeyEnv, identity.String())
+
+	masterKey, err := sopsage.MasterKeyFromRecipient(identity.Recipient().String())
+	require.NoError(t, err)
+
+	dataKey := make([]byte, 32)
+	_, err = rand.Read(dataKey)
+	require.NoError(t, err)
+	require.NoError(t, masterKey.Encrypt(dataKey))
+
+	store := yaml.NewStore(&config.YAMLStoreConfig{})
+	branches, err := store.LoadPlainFile(plaintext)
+	require.NoError(t, err)
+
+	tree := sops.Tree{
+		Branches: branches,
+		Metadata: sops.Metadata{
+			EncryptedRegex: `^(password|username|token|value|key|raw)$`,
+			KeyGroups:      []sops.KeyGroup{{masterKey}},
+			Version:        version.Version,
+		},
+	}
+
+	cipher := aes.NewCipher()
+	mac, err := tree.Encrypt(dataKey, cipher)
+	require.NoError(t, err)
+	tree.Metadata.LastModified = time.Now().UTC()
+	tree.Metadata.MessageAuthenticationCode, err = cipher.Encrypt(
+		mac,
+		dataKey,
+		tree.Metadata.LastModified.Format(time.RFC3339),
+	)
+	require.NoError(t, err)
+
+	encrypted, err := store.EmitEncryptedFile(tree)
+	require.NoError(t, err)
+	require.Contains(t, string(encrypted), "sops:")
+	require.NotContains(t, string(encrypted), "1a2b3c4d5e6f7g8h9i0j")
+
+	path := filepath.Join(t.TempDir(), "example-auth.yaml")
+	require.NoError(t, os.WriteFile(path, encrypted, 0600))
+	return path
+}
@@ -21,9 +21,15 @@ var (
 )

 const (
-	TemplateConfigFileName          = ".templates-config.json"
+	// TODO(dwisiswant0): do not use this in the future.
+	legacyTemplatesConfigFileName = ".templates-config.json"
+	// TemplateConfigFileName is the legacy templates-state filename.
+	//
+	// Deprecated: use TemplatesStateFileName for current templates state.
+	TemplateConfigFileName          = legacyTemplatesConfigFileName
+	TemplatesStateFileName          = "templates.json"
 	NucleiTemplatesDirName          = "nuclei-templates"
-	OfficialNucleiTemplatesRepoName = "nuclei-templates"
+	OfficialNucleiTemplatesRepoName = NucleiTemplatesDirName
 	NucleiIgnoreFileName            = ".nuclei-ignore"
 	NucleiTemplatesIndexFileName    = ".templates-index" // contains index of official nuclei templates
 	NucleiTemplatesCheckSumFileName = ".checksum"
@@ -1,33 +1,184 @@
 package config

 import (
+	"bytes"
+	"crypto/md5"
+	"errors"
+	"fmt"
+	"io"
 	"os"
+	"reflect"
+	"slices"
+	"strings"

-	"github.com/projectdiscovery/gologger"
 	"github.com/projectdiscovery/nuclei/v3/pkg/utils/yaml"
 )

+// maxIgnoreFileBytes caps untrusted ignore-file payloads (PDTM downloads,
+// template archives) before YAML decode.
+const maxIgnoreFileBytes = 1 << 20
+
+var errMultipleIgnoreFileDocuments = errors.New("multiple YAML documents are not supported")
+
 // IgnoreFile is an internal nuclei template blocking configuration file
 type IgnoreFile struct {
 	Tags  []string `yaml:"tags"`
 	Files []string `yaml:"files"`
 }

-// ReadIgnoreFile reads the nuclei ignore file returning blocked tags and paths
-func ReadIgnoreFile() IgnoreFile {
-	file, err := os.Open(DefaultConfig.GetIgnoreFilePath())
+// ReadIgnoreFile reads the active .nuclei-ignore file and returns blocked tags
+// and paths. Callers must decide whether a read error is recoverable. Malformed
+// content is returned as an error to prevent a fail-open scan.
+func ReadIgnoreFile() (IgnoreFile, error) {
+	path := DefaultConfig.GetActiveIgnoreFilePath()
+
+	file, err := os.Open(path)
 	if err != nil {
-		gologger.Error().Msgf("Could not read nuclei-ignore file: %s\n", err)
-		return IgnoreFile{}
+		return IgnoreFile{}, fmt.Errorf("error opening %q: %w", path, err)
 	}
 	defer func() {
 		_ = file.Close()
 	}()

-	ignore := IgnoreFile{}
-	if err := yaml.NewDecoder(file).Decode(&ignore); err != nil {
-		gologger.Error().Msgf("Could not parse nuclei-ignore file: %s\n", err)
-		return IgnoreFile{}
+	ignore, err := decodeIgnoreFile(file, false)
+	if err != nil {
+		return IgnoreFile{}, fmt.Errorf("error parsing %q: %w", path, err)
 	}
-	return ignore
+
+	return ignore, nil
+}
+
+// WriteActiveIgnoreFile atomically replaces the active root ignore file.
+func (c *Config) WriteActiveIgnoreFile(data []byte) error {
+	path := c.GetActiveIgnoreFilePath()
+	if err := validateIgnoreFileContents(data); err != nil {
+		return fmt.Errorf("invalid active .nuclei-ignore file %q: %w", path, err)
+	}
+
+	if err := atomicWriteFile(path, data, 0o600); err != nil {
+		return fmt.Errorf("write active .nuclei-ignore file: %w", err)
+	}
+
+	return nil
+}
+
+func validateIgnoreFileContents(data []byte) error {
+	if len(data) > maxIgnoreFileBytes {
+		return fmt.Errorf("payload exceeds %d bytes", maxIgnoreFileBytes)
+	}
+	if len(bytes.TrimSpace(data)) == 0 {
+		return errors.New("empty document")
+	}
+
+	if _, err := decodeIgnoreFile(bytes.NewReader(data), true); err != nil {
+		if errors.Is(err, io.EOF) {
+			return errors.New("empty document")
+		}
+		return err
+	}
+
+	decoder := yaml.NewDecoder(bytes.NewReader(data))
+	var raw map[string]any
+	if err := decoder.Decode(&raw); err != nil {
+		return err
+	}
+	if raw == nil {
+		return errors.New("document must be a YAML mapping")
+	}
+
+	allowed := ignoreFileFieldNames()
+	found := false
+	for key := range raw {
+		if !slices.Contains(allowed, key) {
+			return fmt.Errorf("unknown field %q", key)
+		}
+		found = true
+	}
+	if !found {
+		return fmt.Errorf("document must define at least one of %s", strings.Join(allowed, ", "))
+	}
+
+	return nil
+}
+
+func decodeIgnoreFile(r io.Reader, knownFields bool) (IgnoreFile, error) {
+	decoder := yaml.NewDecoder(r)
+	decoder.KnownFields(knownFields)
+
+	ignore := IgnoreFile{}
+	if err := decoder.Decode(&ignore); err != nil {
+		return IgnoreFile{}, err
+	}
+
+	var additionalDocument any
+	if err := decoder.Decode(&additionalDocument); !errors.Is(err, io.EOF) {
+		if err != nil {
+			return IgnoreFile{}, err
+		}
+
+		return IgnoreFile{}, errMultipleIgnoreFileDocuments
+	}
+
+	return ignore, nil
+}
+
+func ignoreFileFieldNames() []string {
+	typ := reflect.TypeOf(IgnoreFile{})
+	names := make([]string, 0, typ.NumField())
+	for i := 0; i < typ.NumField(); i++ {
+		name, _, _ := strings.Cut(typ.Field(i).Tag.Get("yaml"), ",")
+		if name == "" || name == "-" {
+			continue
+		}
+		names = append(names, name)
+	}
+	slices.Sort(names)
+	return names
+}
+
+// IgnoreFileNeedsUpdate reports whether the active ignore file is
+// missing or differs from the latest known hash.
+func (c *Config) IgnoreFileNeedsUpdate(latestHash string) bool {
+	ignoreFilePath := c.GetActiveIgnoreFilePath()
+
+	contents, err := os.ReadFile(ignoreFilePath)
+	if err != nil {
+		return true
+	}
+	if latestHash == "" {
+		return false
+	}
+
+	return ignoreFileHash(contents) != latestHash
+}
+
+// NeedsIgnoreFileUpdate reports whether the active ignore file differs
+// from the deprecated in-memory remote hash.
+//
+// Deprecated: pass the transient remote hash to IgnoreFileNeedsUpdate.
+func (c *Config) NeedsIgnoreFileUpdate() bool {
+	c.m.Lock()
+	latestHash := c.LatestNucleiIgnoreHash
+	c.m.Unlock()
+
+	return c.IgnoreFileNeedsUpdate(latestHash)
+}
+
+// UpdateNucleiIgnoreHash refreshes the deprecated in-memory compatibility
+// field from the active ignore file.
+//
+// Deprecated: local ignore-file hashes are derived from the active file.
+func (c *Config) UpdateNucleiIgnoreHash() error {
+	ignoreFilePath := c.GetActiveIgnoreFilePath()
+	contents, err := os.ReadFile(ignoreFilePath)
+	if err != nil {
+		return fmt.Errorf("read active .nuclei-ignore file %q: %w", ignoreFilePath, err)
+	}
+
+	c.NucleiIgnoreHash = ignoreFileHash(contents)
+	return nil
+}
+
+func ignoreFileHash(contents []byte) string {
+	return fmt.Sprintf("%x", md5.Sum(contents))
 }
@@ -0,0 +1,198 @@
+package config
+
+import (
+	"bytes"
+	"errors"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+func setActiveIgnoreFileRoot(t *testing.T) string {
+	t.Helper()
+
+	root := t.TempDir()
+	cfg := DefaultConfig
+	oldRoot := cfg.TemplatesDirectory
+	t.Cleanup(func() { cfg.SetTemplatesDir(oldRoot) })
+	cfg.SetTemplatesDir(root)
+	return root
+}
+
+func TestReadIgnoreFileReportsMissingActiveFile(t *testing.T) {
+	root := setActiveIgnoreFileRoot(t)
+	path := filepath.Join(root, NucleiIgnoreFileName)
+
+	ignore, err := ReadIgnoreFile()
+	if !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("read missing ignore file error = %v, want os.ErrNotExist", err)
+	}
+	if len(ignore.Tags) != 0 || len(ignore.Files) != 0 {
+		t.Fatalf("missing ignore file = %+v, want empty", ignore)
+	}
+	if message := err.Error(); !strings.Contains(message, strconv.Quote(path)) || !strings.Contains(message, "error opening") {
+		t.Fatalf("missing ignore file error = %q, want open failure and active path", message)
+	}
+}
+
+func TestReadIgnoreFileRejectsCorruptActiveFile(t *testing.T) {
+	root := setActiveIgnoreFileRoot(t)
+	path := filepath.Join(root, NucleiIgnoreFileName)
+
+	if err := os.WriteFile(path, []byte("tags: ["), 0o600); err != nil {
+		t.Fatalf("write invalid ignore file: %v", err)
+	}
+	ignore, err := ReadIgnoreFile()
+	if err == nil {
+		t.Fatalf("read corrupt ignore file = %+v, want error", ignore)
+	}
+	if message := err.Error(); !strings.Contains(message, strconv.Quote(path)) || !strings.Contains(message, "error parsing") {
+		t.Fatalf("corrupt ignore file error = %q, want parse failure and active path", message)
+	}
+}
+
+func TestReadIgnoreFileRejectsMalformedTrailingDocument(t *testing.T) {
+	root := setActiveIgnoreFileRoot(t)
+	path := filepath.Join(root, NucleiIgnoreFileName)
+
+	if err := os.WriteFile(path, []byte("tags: [weak]\n---\ntags: ["), 0o600); err != nil {
+		t.Fatalf("write ignore file: %v", err)
+	}
+	ignore, err := ReadIgnoreFile()
+	if err == nil {
+		t.Fatalf("read ignore file = %+v, want trailing parse error", ignore)
+	}
+	if len(ignore.Tags) != 0 || len(ignore.Files) != 0 {
+		t.Fatalf("ignore file after trailing parse error = %+v, want empty", ignore)
+	}
+	if message := err.Error(); !strings.Contains(message, strconv.Quote(path)) || !strings.Contains(message, "error parsing") {
+		t.Fatalf("trailing parse error = %q, want parse failure and active path", message)
+	}
+}
+
+func TestReadIgnoreFileRejectsAdditionalDocument(t *testing.T) {
+	root := setActiveIgnoreFileRoot(t)
+	path := filepath.Join(root, NucleiIgnoreFileName)
+
+	if err := os.WriteFile(path, []byte("tags: [weak]\n---\nfiles: [blocked.yaml]\n"), 0o600); err != nil {
+		t.Fatalf("write ignore file: %v", err)
+	}
+	ignore, err := ReadIgnoreFile()
+	if err == nil {
+		t.Fatalf("read ignore file = %+v, want multiple-document error", ignore)
+	}
+	if len(ignore.Tags) != 0 || len(ignore.Files) != 0 {
+		t.Fatalf("ignore file with additional document = %+v, want empty", ignore)
+	}
+	if message := err.Error(); !strings.Contains(message, strconv.Quote(path)) || !strings.Contains(message, "multiple YAML documents") {
+		t.Fatalf("multiple-document error = %q, want active path and document count failure", message)
+	}
+}
+
+func TestReadIgnoreFileParsesActiveFile(t *testing.T) {
+	root := setActiveIgnoreFileRoot(t)
+
+	if err := os.WriteFile(filepath.Join(root, NucleiIgnoreFileName), []byte("tags: [weak]\nfiles: [blocked.yaml]\n"), 0o600); err != nil {
+		t.Fatalf("write ignore file: %v", err)
+	}
+	ignore, err := ReadIgnoreFile()
+	if err != nil {
+		t.Fatalf("read ignore file: %v", err)
+	}
+	if len(ignore.Tags) != 1 || ignore.Tags[0] != "weak" {
+		t.Fatalf("ignore tags = %v, want [weak]", ignore.Tags)
+	}
+	if len(ignore.Files) != 1 || ignore.Files[0] != "blocked.yaml" {
+		t.Fatalf("ignore files = %v, want [blocked.yaml]", ignore.Files)
+	}
+}
+
+func TestWriteActiveIgnoreFileRejectsInvalidPayloads(t *testing.T) {
+	root := setActiveIgnoreFileRoot(t)
+	cfg := DefaultConfig
+	path := filepath.Join(root, NucleiIgnoreFileName)
+	valid := []byte("tags: [weak]\nfiles: [blocked.yaml]\n")
+	if err := os.WriteFile(path, valid, 0o600); err != nil {
+		t.Fatalf("seed ignore file: %v", err)
+	}
+
+	cases := map[string][]byte{
+		"proxy html":          []byte("<!DOCTYPE HTML>\n<html>\n<head>\n<meta name=\"description\" content=\"Zscaler: blocked\">\n</head>\n</html>\n"),
+		"unrelated yaml":      []byte("error: access denied\nmessage: blocked by proxy\n"),
+		"empty":               []byte("   \n"),
+		"empty mapping":       []byte("{}\n"),
+		"null document":       []byte("null\n"),
+		"template yaml":       []byte("id: example\ninfo:\n  name: example\n"),
+		"additional document": []byte("tags: [weak]\n---\nfiles: [blocked.yaml]\n"),
+		"malformed yaml":      []byte("tags: ["),
+		"oversized":           bytes.Repeat([]byte("a"), maxIgnoreFileBytes+1),
+	}
+
+	for name, payload := range cases {
+		t.Run(name, func(t *testing.T) {
+			err := cfg.WriteActiveIgnoreFile(payload)
+			if err == nil {
+				t.Fatal("write invalid ignore file succeeded")
+			}
+			if message := err.Error(); !strings.Contains(message, strconv.Quote(path)) {
+				t.Fatalf("invalid write error = %q, want active path", message)
+			}
+			got, readErr := os.ReadFile(path)
+			if readErr != nil {
+				t.Fatalf("read ignore file: %v", readErr)
+			}
+			if !bytes.Equal(got, valid) {
+				t.Fatalf("invalid payload overwrote ignore file: got %q", got)
+			}
+		})
+	}
+}
+
+func TestWriteActiveIgnoreFileAcceptsKnownShapes(t *testing.T) {
+	root := setActiveIgnoreFileRoot(t)
+	cfg := DefaultConfig
+	path := filepath.Join(root, NucleiIgnoreFileName)
+
+	cases := map[string][]byte{
+		"tags and files": []byte("tags: [weak]\nfiles: [blocked.yaml]\n"),
+		"tags only":      []byte("tags: []\n"),
+		"files only":     []byte("files: [blocked.yaml]\n"),
+	}
+
+	for name, payload := range cases {
+		t.Run(name, func(t *testing.T) {
+			if err := cfg.WriteActiveIgnoreFile(payload); err != nil {
+				t.Fatalf("write ignore file: %v", err)
+			}
+			got, err := os.ReadFile(path)
+			if err != nil {
+				t.Fatalf("read ignore file: %v", err)
+			}
+			if !bytes.Equal(got, payload) {
+				t.Fatalf("ignore file = %q, want %q", got, payload)
+			}
+			if _, err := ReadIgnoreFile(); err != nil {
+				t.Fatalf("read back written ignore file: %v", err)
+			}
+		})
+	}
+}
+
+func TestSetTemplatesDirDoesNotCopyLegacyIgnoreFile(t *testing.T) {
+	dir := t.TempDir()
+	configDir := filepath.Join(dir, "config")
+	legacyPath := filepath.Join(configDir, NucleiIgnoreFileName)
+	writeTestFile(t, legacyPath, []byte("tags: [legacy]\n"), 0o600)
+
+	root := filepath.Join(dir, "active")
+	if err := os.MkdirAll(root, 0o700); err != nil {
+		t.Fatalf("create active root: %v", err)
+	}
+	cfg := &Config{configDir: configDir}
+	cfg.SetTemplatesDir(root)
+	if _, err := os.Stat(cfg.GetActiveIgnoreFilePath()); !os.IsNotExist(err) {
+		t.Fatalf("legacy ignore file was copied into active root: %v", err)
+	}
+}
@@ -2,22 +2,20 @@ package config

 import (
 	"bytes"
-	"crypto/md5"
-	"fmt"
+	"errors"
 	"os"
 	"path/filepath"
 	"slices"
 	"strings"
 	"sync"

+	"github.com/adrg/xdg"
 	"github.com/projectdiscovery/gologger"
 	filepathutil "github.com/projectdiscovery/nuclei/v3/pkg/utils/filepath"
-	"github.com/projectdiscovery/nuclei/v3/pkg/utils/json"
 	"github.com/projectdiscovery/nuclei/v3/pkg/utils/yaml"
 	"github.com/projectdiscovery/utils/env"
 	"github.com/projectdiscovery/utils/errkit"
 	fileutil "github.com/projectdiscovery/utils/file"
-	folderutil "github.com/projectdiscovery/utils/folder"
 )

 // DefaultConfig is the default nuclei configuration
@@ -27,32 +25,44 @@ var DefaultConfig *Config
 type Config struct {
 	TemplatesDirectory string `json:"nuclei-templates-directory,omitempty"`

-	// customtemplates exists in templates directory with the name of custom-templates provider
-	// below custom paths are absolute paths to respective custom-templates directories
+	// Custom template paths are absolute provider-specific directories under the
+	// active template root.
 	CustomS3TemplatesDirectory     string `json:"custom-s3-templates-directory"`
 	CustomGitHubTemplatesDirectory string `json:"custom-github-templates-directory"`
 	CustomGitLabTemplatesDirectory string `json:"custom-gitlab-templates-directory"`
 	CustomAzureTemplatesDirectory  string `json:"custom-azure-templates-directory"`

-	TemplateVersion        string `json:"nuclei-templates-version,omitempty"`
-	NucleiIgnoreHash       string `json:"nuclei-ignore-hash,omitempty"`
+	TemplateVersion string `json:"nuclei-templates-version,omitempty"`
+
+	// NucleiIgnoreHash is retained for SDK compatibility. Nuclei derives the
+	// current hash from the active ignore file and does not persist this field.
+	//
+	// Deprecated: local ignore-file hashes are derived from the active file.
+	NucleiIgnoreHash       string `json:"-"`
 	LogAllEvents           bool   `json:"-"` // when enabled logs all events (more than verbose)
 	HideTemplateSigWarning bool   `json:"-"` // when enabled disables template signature warning

-	// LatestXXX are not meant to be used directly and is used as
-	// local cache of nuclei version check endpoint
-	// these fields are only update during nuclei version check
-	// TODO: move these fields to a separate unexported struct as they are not meant to be used directly
-	LatestNucleiVersion          string           `json:"nuclei-latest-version"`
-	LatestNucleiTemplatesVersion string           `json:"nuclei-templates-latest-version"`
-	LatestNucleiIgnoreHash       string           `json:"nuclei-latest-ignore-hash,omitempty"`
-	Logger                       *gologger.Logger `json:"-"` // logger
+	// These fields cache version-check results.
+	LatestNucleiVersion          string `json:"nuclei-latest-version"`
+	LatestNucleiTemplatesVersion string `json:"nuclei-templates-latest-version"`
+
+	// LatestNucleiIgnoreHash is retained for SDK compatibility. Nuclei passes
+	// remote ignore hashes directly from version checks to the active-file
+	// comparison and does not persist this field.
+	//
+	// Deprecated: remote ignore hashes are transient version-check results.
+	LatestNucleiIgnoreHash string           `json:"-"`
+	Logger                 *gologger.Logger `json:"-"` // logger

 	// internal / unexported fields
-	disableUpdates bool     `json:"-"` // disable updates both version check and template updates
-	homeDir        string   `json:"-"` //  User Home Directory
-	configDir      string   `json:"-"` //  Nuclei Global Config Directory
-	debugArgs      []string `json:"-"` // debug args
+	disableUpdates    bool     `json:"-"` // disable updates both version check and template updates
+	configDir         string   `json:"-"` //  Nuclei Global Config Directory
+	stateDir          string   `json:"-"` // Restart-persistent operational state
+	cacheDir          string   `json:"-"` // Regenerable cached data
+	dataHome          string   `json:"-"` // User template data
+	dataDirs          []string `json:"-"` // Template data, in preference order
+	debugArgs         []string `json:"-"` // debug args
+	initializationErr error    `json:"-"`

 	m sync.Mutex
 }
@@ -76,37 +86,46 @@ func (c *Config) IsCustomTemplate(templatePath string) bool {
 			return true
 		}
 	}
+
 	if c.TemplatesDirectory == "" {
 		return false
 	}
+
 	return !filepathutil.IsPathWithinDirectory(templatePath, c.TemplatesDirectory)
 }

 // WriteVersionCheckData writes version check data to config file
-func (c *Config) WriteVersionCheckData(ignorehash, nucleiVersion, templatesVersion string) error {
+func (c *Config) WriteVersionCheckData(ignoreHash, nucleiVersion, templatesVersion string) error {
 	updated := false
-	if ignorehash != "" && c.LatestNucleiIgnoreHash != ignorehash {
-		c.LatestNucleiIgnoreHash = ignorehash
-		updated = true
+
+	if ignoreHash != "" && c.LatestNucleiIgnoreHash != ignoreHash {
+		// Retain the historical in-memory SDK behavior without persisting remote
+		// ignore metadata.
+		c.LatestNucleiIgnoreHash = ignoreHash
 	}
+
 	if nucleiVersion != "" && c.LatestNucleiVersion != nucleiVersion {
 		c.LatestNucleiVersion = nucleiVersion
 		updated = true
 	}
+
 	if templatesVersion != "" && c.LatestNucleiTemplatesVersion != templatesVersion {
 		c.LatestNucleiTemplatesVersion = templatesVersion
 		updated = true
 	}
+
 	// write config to disk if any of the fields are updated
 	if updated {
 		return c.WriteTemplatesConfig()
 	}
+
 	return nil
 }

 // GetTemplateDir returns the nuclei templates directory absolute path
 func (c *Config) GetTemplateDir() string {
 	val, _ := filepath.Abs(c.TemplatesDirectory)
+
 	return val
 }

@@ -114,6 +133,7 @@ func (c *Config) GetTemplateDir() string {
 func (c *Config) DisableUpdateCheck() {
 	c.m.Lock()
 	defer c.m.Unlock()
+
 	c.disableUpdates = true
 }

@@ -121,6 +141,7 @@ func (c *Config) DisableUpdateCheck() {
 func (c *Config) CanCheckForUpdates() bool {
 	c.m.Lock()
 	defer c.m.Unlock()
+
 	return !c.disableUpdates
 }

@@ -128,30 +149,9 @@ func (c *Config) CanCheckForUpdates() bool {
 func (c *Config) NeedsTemplateUpdate() bool {
 	c.m.Lock()
 	defer c.m.Unlock()
-	return !c.disableUpdates && (c.TemplateVersion == "" || IsOutdatedVersion(c.TemplateVersion, c.LatestNucleiTemplatesVersion) || !fileutil.FolderExists(c.TemplatesDirectory))
-}

-// NeedsIgnoreFileUpdate returns true if Ignore file hash is different (aka ignore file is outdated)
-func (c *Config) NeedsIgnoreFileUpdate() bool {
-	c.m.Lock()
-	defer c.m.Unlock()
-	return c.NucleiIgnoreHash == "" || c.NucleiIgnoreHash != c.LatestNucleiIgnoreHash
-}
-
-// UpdateNucleiIgnoreHash updates the nuclei ignore hash in config
-func (c *Config) UpdateNucleiIgnoreHash() error {
-	// calculate hash of ignore file and update config
-	ignoreFilePath := c.GetIgnoreFilePath()
-	if fileutil.FileExists(ignoreFilePath) {
-		bin, err := os.ReadFile(ignoreFilePath)
-		if err != nil {
-			return errkit.Newf("could not read nuclei ignore file: %v", err)
-		}
-		c.NucleiIgnoreHash = fmt.Sprintf("%x", md5.Sum(bin))
-		// write config to disk
-		return c.WriteTemplatesConfig()
-	}
-	return errkit.New("ignore file not found: could not update nuclei ignore hash")
+	return !c.disableUpdates &&
+		(c.TemplateVersion == "" || IsOutdatedVersion(c.TemplateVersion, c.LatestNucleiTemplatesVersion) || !fileutil.FolderExists(c.TemplatesDirectory))
 }

 // GetConfigDir returns the nuclei configuration directory
@@ -159,6 +159,21 @@ func (c *Config) GetConfigDir() string {
 	return c.configDir
 }

+// GetStateDir returns the directory for restart-persistent operational state.
+func (c *Config) GetStateDir() string {
+	if c.stateDir != "" {
+		return c.stateDir
+	}
+
+	return defaultStateDir()
+}
+
+// SetStateDir changes the templates state directory. It is primarily useful to
+// SDK callers that isolate all Nuclei storage.
+func (c *Config) SetStateDir(dir string) {
+	c.stateDir = dir
+}
+
 // GetKeysDir returns the nuclei signer keys directory
 func (c *Config) GetKeysDir() string {
 	return filepath.Join(c.configDir, "keys")
@@ -175,10 +190,19 @@ func (c *Config) GetReportingConfigFilePath() string {
 }

 // GetIgnoreFilePath returns the nuclei ignore file path
+//
+// Deprecated: use GetActiveIgnoreFilePath. The config-directory ignore file is
+// no longer active.
 func (c *Config) GetIgnoreFilePath() string {
 	return filepath.Join(c.configDir, NucleiIgnoreFileName)
 }

+// GetActiveIgnoreFilePath returns the ignore file in the active public template
+// root.
+func (c *Config) GetActiveIgnoreFilePath() string {
+	return filepath.Join(c.TemplatesDirectory, NucleiIgnoreFileName)
+}
+
 func (c *Config) GetTemplateIndexFilePath() string {
 	return filepath.Join(c.TemplatesDirectory, NucleiTemplatesIndexFileName)
 }
@@ -197,58 +221,75 @@ func (c *Config) GetFlagsConfigFilePath() string {
 // if .new-additions file is not present empty slice is returned
 func (c *Config) GetNewAdditions() []string {
 	arr := []string{}
+
 	newAdditionsPath := filepath.Join(c.TemplatesDirectory, NewTemplateAdditionsFileName)
 	if !fileutil.FileExists(newAdditionsPath) {
 		return arr
 	}
+
 	bin, err := os.ReadFile(newAdditionsPath)
 	if err != nil {
 		return arr
 	}
+
 	for v := range strings.FieldsSeq(string(bin)) {
 		if IsTemplateWithRoot(v, c.TemplatesDirectory) {
 			arr = append(arr, v)
 		}
 	}
+
 	return arr
 }

-// GetCacheDir returns the nuclei cache directory
-// with new version of nuclei cache directory is changed
-// instead of saving resume files in nuclei config directory
-// they are saved in nuclei cache directory
+// GetCacheDir returns the directory for regenerable cached data.
 func (c *Config) GetCacheDir() string {
-	return folderutil.AppCacheDirOrDefault(".nuclei-cache", BinaryName)
+	if c.cacheDir != "" {
+		return c.cacheDir
+	}
+
+	return defaultCacheDir()
 }

 // SetConfigDir sets the nuclei configuration directory
 // and appropriate changes are made to the config
 func (c *Config) SetConfigDir(dir string) {
 	c.configDir = dir
+	// Preserve the historical SDK behavior that SetConfigDir also isolates
+	// templates state. NUCLEI_CONFIG_DIR is resolved separately and does not move
+	// state.
+	c.stateDir = dir
 	if err := c.createConfigDirIfNotExists(); err != nil {
 		c.Logger.Fatal().Msgf("Could not create nuclei config directory at %s: %s", c.configDir, err)
 	}

 	// if folder already exists read config or create new
 	if err := c.ReadTemplatesConfig(); err != nil {
+		if !errors.Is(err, os.ErrNotExist) {
+			c.Logger.Fatal().Msgf("Could not read templates state: %s", err)
+		}
+
 		// create new config
-		applyDefaultConfig()
+		if defaultsErr := c.applyDefaultConfig(); defaultsErr != nil {
+			c.Logger.Fatal().Msgf("Could not select default templates directory: %s", defaultsErr)
+		}
+
 		if err2 := c.WriteTemplatesConfig(); err2 != nil {
 			c.Logger.Fatal().Msgf("Could not create nuclei config file at %s: %s", c.getTemplatesConfigFilePath(), err2)
 		}
 	}
-
-	// while other config files are optional, ignore file is mandatory
-	// since it is used to ignore templates with weak matchers
-	c.copyIgnoreFile()
 }

 // SetTemplatesDir sets the new nuclei templates directory
 func (c *Config) SetTemplatesDir(dirPath string) {
+	c.setTemplatesDir(dirPath)
+}
+
+func (c *Config) setTemplatesDir(dirPath string) {
 	if dirPath != "" && !filepath.IsAbs(dirPath) {
 		cwd, _ := os.Getwd()
 		dirPath = filepath.Join(cwd, dirPath)
 	}
+
 	c.TemplatesDirectory = dirPath
 	// Update the custom templates directory
 	c.CustomGitHubTemplatesDirectory = filepath.Join(dirPath, CustomGitHubTemplatesDirName)
@@ -260,64 +301,26 @@ func (c *Config) SetTemplatesDir(dirPath string) {
 // SetTemplatesVersion sets the new nuclei templates version
 func (c *Config) SetTemplatesVersion(version string) error {
 	c.TemplateVersion = version
+
 	// write config to disk
 	if err := c.WriteTemplatesConfig(); err != nil {
 		return errkit.Newf("could not write nuclei config file at %s: %v", c.getTemplatesConfigFilePath(), err)
 	}
-	return nil
-}

-// ReadTemplatesConfig reads the nuclei templates config file
-func (c *Config) ReadTemplatesConfig() error {
-	if !fileutil.FileExists(c.getTemplatesConfigFilePath()) {
-		return errkit.Newf("nuclei config file at %s does not exist", c.getTemplatesConfigFilePath())
-	}
-	var cfg *Config
-	bin, err := os.ReadFile(c.getTemplatesConfigFilePath())
-	if err != nil {
-		return errkit.Newf("could not read nuclei config file at %s: %v", c.getTemplatesConfigFilePath(), err)
-	}
-	if err := json.Unmarshal(bin, &cfg); err != nil {
-		return errkit.Newf("could not unmarshal nuclei config file at %s: %v", c.getTemplatesConfigFilePath(), err)
-	}
-	// apply config
-	c.TemplatesDirectory = cfg.TemplatesDirectory
-	c.TemplateVersion = cfg.TemplateVersion
-	c.NucleiIgnoreHash = cfg.NucleiIgnoreHash
-	c.LatestNucleiIgnoreHash = cfg.LatestNucleiIgnoreHash
-	c.LatestNucleiTemplatesVersion = cfg.LatestNucleiTemplatesVersion
-	return nil
-}
-
-// WriteTemplatesConfig writes the nuclei templates config file
-func (c *Config) WriteTemplatesConfig() error {
-	// check if config folder exists if not create one
-	if err := c.createConfigDirIfNotExists(); err != nil {
-		return err
-	}
-	bin, err := json.Marshal(c)
-	if err != nil {
-		return errkit.Newf("failed to marshal nuclei config: %v", err)
-	}
-	if err = os.WriteFile(c.getTemplatesConfigFilePath(), bin, 0600); err != nil {
-		return errkit.Newf("failed to write nuclei config file at %s: %v", c.getTemplatesConfigFilePath(), err)
-	}
 	return nil
 }

 // WriteTemplatesIndex writes the nuclei templates index file
 func (c *Config) WriteTemplatesIndex(index map[string]string) error {
 	indexFile := c.GetTemplateIndexFilePath()
+
 	var buff bytes.Buffer
+
 	for k, v := range index {
 		_, _ = buff.WriteString(k + "," + v + "\n")
 	}
-	return os.WriteFile(indexFile, buff.Bytes(), 0600)
-}

-// getTemplatesConfigFilePath returns configDir/.templates-config.json file path
-func (c *Config) getTemplatesConfigFilePath() string {
-	return filepath.Join(c.configDir, TemplateConfigFileName)
+	return os.WriteFile(indexFile, buff.Bytes(), 0600)
 }

 // createConfigDirIfNotExists creates the nuclei config directory if not exists
@@ -330,22 +333,6 @@ func (c *Config) createConfigDirIfNotExists() error {
 	return nil
 }

-// copyIgnoreFile copies the nuclei ignore file default config directory
-// to the current config directory
-func (c *Config) copyIgnoreFile() {
-	if err := c.createConfigDirIfNotExists(); err != nil {
-		c.Logger.Error().Msgf("Could not create nuclei config directory at %s: %s", c.configDir, err)
-		return
-	}
-	ignoreFilePath := c.GetIgnoreFilePath()
-	if !fileutil.FileExists(ignoreFilePath) {
-		// copy ignore file from default config directory
-		if err := fileutil.CopyFile(filepath.Join(folderutil.AppConfigDirOrDefault(FallbackConfigFolderName, BinaryName), NucleiIgnoreFileName), ignoreFilePath); err != nil {
-			c.Logger.Error().Msgf("Could not copy nuclei ignore file at %s: %s", ignoreFilePath, err)
-		}
-	}
-}
-
 // IsDebugArgEnabled checks if debug arg is enabled
 // this could be a feature specific to debugging like PPROF or printing stats
 // of max host error etc
@@ -359,14 +346,17 @@ func (c *Config) parseDebugArgs(data string) {
 	for v := range strings.FieldsSeq(data) {
 		key := v
 		value := ""
+
 		// if it is key value pair then split it
 		if k, val, ok := strings.Cut(v, "="); ok {
 			key, value = strings.TrimSpace(k), strings.TrimSpace(val)
 		}
+
 		if value == "false" || value == "0" {
 			// if false or disabled then skip
 			continue
 		}
+
 		switch key {
 		case DebugArgHostErrorStats:
 			c.debugArgs = append(c.debugArgs, DebugArgHostErrorStats)
@@ -377,7 +367,7 @@ func (c *Config) parseDebugArgs(data string) {
 }

 func init() {
-	ConfigDir := folderutil.AppConfigDirOrDefault(FallbackConfigFolderName, BinaryName)
+	ConfigDir := defaultConfigDir()

 	if cfgDir := os.Getenv(NucleiConfigDirEnv); cfgDir != "" {
 		ConfigDir = cfgDir
@@ -389,9 +379,13 @@ func init() {
 			gologger.Error().Msgf("failed to create config directory at %v got: %s", ConfigDir, err)
 		}
 	}
+
 	DefaultConfig = &Config{
-		homeDir:   folderutil.HomeDirOrDefault(""),
 		configDir: ConfigDir,
+		stateDir:  defaultStateDir(),
+		cacheDir:  defaultCacheDir(),
+		dataHome:  xdg.DataHome,
+		dataDirs:  append([]string(nil), xdg.DataDirs...),
 		Logger:    gologger.DefaultLogger,
 	}

@@ -407,19 +401,24 @@ func init() {

 	// try to read config from file
 	if err := DefaultConfig.ReadTemplatesConfig(); err != nil {
-		gologger.Verbose().Msgf("config file not found, creating new config file at %s", DefaultConfig.getTemplatesConfigFilePath())
-		applyDefaultConfig()
-		// write config to file
-		if err := DefaultConfig.WriteTemplatesConfig(); err != nil {
-			gologger.Error().Msgf("failed to write config file at %s got: %s", DefaultConfig.getTemplatesConfigFilePath(), err)
+		if !errors.Is(err, os.ErrNotExist) {
+			DefaultConfig.initializationErr = err
+			gologger.Error().Msgf("Failed to read templates state: %s", err)
+		} else {
+			gologger.Verbose().Msgf("Templates state not found, creating %s", DefaultConfig.getTemplatesConfigFilePath())
+		}
+
+		if defaultsErr := DefaultConfig.applyDefaultConfig(); defaultsErr != nil {
+			DefaultConfig.initializationErr = errors.Join(DefaultConfig.initializationErr, defaultsErr)
+			gologger.Error().Msgf("Failed to select default templates directory: %s", defaultsErr)
+		} else if DefaultConfig.initializationErr == nil {
+			if writeErr := DefaultConfig.WriteTemplatesConfig(); writeErr != nil {
+				DefaultConfig.initializationErr = writeErr
+				gologger.Error().Msgf("Failed to write templates state at %s: %s", DefaultConfig.getTemplatesConfigFilePath(), writeErr)
+			}
 		}
 	}

-	// Loads/updates paths of custom templates
-	// Note: custom templates paths should not be updated in config file
-	// and even if it is changed we don't follow it since it is not expected behavior
-	// If custom templates are in default locations only then they are loaded while running nuclei
-	DefaultConfig.SetTemplatesDir(DefaultConfig.TemplatesDirectory)
 	DefaultConfig.parseDebugArgs(env.GetEnvOrDefault("NUCLEI_ARGS", ""))

 	// expose the templates directory to the yaml preprocessor so include
@@ -430,9 +429,33 @@ func init() {
 	}
 }

-// Add Default Config adds default when .templates-config.json file is not present
-func applyDefaultConfig() {
-	DefaultConfig.TemplatesDirectory = filepath.Join(DefaultConfig.homeDir, NucleiTemplatesDirName)
-	// updates all necessary paths
-	DefaultConfig.SetTemplatesDir(DefaultConfig.TemplatesDirectory)
+// InitializationError returns a templates state or path error detected during
+// package initialization.
+func (c *Config) InitializationError() error {
+	return c.initializationErr
+}
+
+func (c *Config) applyDefaultConfig() error {
+	dataHome := c.dataHome
+	if dataHome == "" {
+		dataHome = xdg.DataHome
+	}
+
+	dataDirs := c.dataDirs
+	if dataDirs == nil {
+		dataDirs = xdg.DataDirs
+	}
+
+	root, err := selectXDGTemplateRoot(dataHome, dataDirs)
+	if err != nil {
+		return err
+	}
+
+	rootChanged := filepath.Clean(c.TemplatesDirectory) != filepath.Clean(root)
+	c.setTemplatesDir(root)
+	if rootChanged {
+		c.TemplateVersion = ""
+	}
+
+	return nil
 }
@@ -0,0 +1,9 @@
+//go:build !windows
+
+package config
+
+import "os"
+
+func replaceTemplatesConfigFile(temporaryPath, configFilePath string) error {
+	return os.Rename(temporaryPath, configFilePath)
+}
@@ -0,0 +1,48 @@
+package config
+
+import (
+	"errors"
+	"os"
+	"unsafe"
+
+	"golang.org/x/sys/windows"
+)
+
+var replaceFile = windows.NewLazySystemDLL("kernel32.dll").NewProc("ReplaceFileW")
+
+func replaceTemplatesConfigFile(temporaryPath, configFilePath string) error {
+	temporary, err := windows.UTF16PtrFromString(temporaryPath)
+	if err != nil {
+		return err
+	}
+
+	target, err := windows.UTF16PtrFromString(configFilePath)
+	if err != nil {
+		return err
+	}
+
+	if _, err := os.Lstat(configFilePath); err != nil {
+		if !os.IsNotExist(err) {
+			return err
+		}
+
+		return windows.MoveFileEx(temporary, target, windows.MOVEFILE_WRITE_THROUGH)
+	}
+
+	replaced, _, callErr := replaceFile.Call(
+		uintptr(unsafe.Pointer(target)),
+		uintptr(unsafe.Pointer(temporary)),
+		0,
+		0,
+		0,
+		0,
+	)
+	if replaced != 0 {
+		return nil
+	}
+	if errors.Is(callErr, windows.ERROR_FILE_NOT_FOUND) {
+		return windows.MoveFileEx(temporary, target, windows.MOVEFILE_WRITE_THROUGH)
+	}
+
+	return callErr
+}
@@ -0,0 +1,40 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestReplaceTemplatesConfigFile(t *testing.T) {
+	for _, targetExists := range []bool{false, true} {
+		name := "creates"
+		if targetExists {
+			name = "replaces"
+		}
+		t.Run(name, func(t *testing.T) {
+			directory := t.TempDir()
+			target := filepath.Join(directory, "config.json")
+			if targetExists {
+				if err := os.WriteFile(target, []byte("previous"), 0o600); err != nil {
+					t.Fatal(err)
+				}
+			}
+			temporary := filepath.Join(directory, "config.tmp")
+			if err := os.WriteFile(temporary, []byte("current"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+
+			if err := replaceTemplatesConfigFile(temporary, target); err != nil {
+				t.Fatal(err)
+			}
+			contents, err := os.ReadFile(target)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if string(contents) != "current" {
+				t.Fatalf("expected replacement contents, got %q", contents)
+			}
+		})
+	}
+}
@@ -1,6 +1,10 @@
 package config

 import (
+	"crypto/md5"
+	"encoding/json"
+	"fmt"
+	"os"
 	"path/filepath"
 	"testing"
 )
@@ -46,3 +50,82 @@ func TestIsCustomTemplateUsesPathBoundaries(t *testing.T) {
 		})
 	}
 }
+
+func TestTemplateRootLifecycleIgnoresLegacyDiscoverySource(t *testing.T) {
+	dir := t.TempDir()
+	root := filepath.Join(dir, "system", BinaryName, NucleiTemplatesDirName)
+	stateDir := filepath.Join(dir, "state")
+	state, err := json.Marshal(map[string]string{
+		"nuclei-templates-directory":        root,
+		"nuclei-templates-directory-source": "xdg-system",
+		"nuclei-templates-version":          "v1.0.0",
+	})
+	if err != nil {
+		t.Fatalf("marshal templates state: %v", err)
+	}
+	writeTestFile(t, filepath.Join(stateDir, TemplatesStateFileName), state, 0o600)
+
+	cfg := &Config{stateDir: stateDir, configDir: filepath.Join(dir, "config")}
+	if err := cfg.ReadTemplatesConfig(); err != nil {
+		t.Fatalf("read templates state: %v", err)
+	}
+	cfg.LatestNucleiTemplatesVersion = "v99.0.0"
+
+	if !cfg.NeedsTemplateUpdate() {
+		t.Fatal("discovered root did not request an available template update")
+	}
+	if !cfg.IgnoreFileNeedsUpdate("changed") {
+		t.Fatal("discovered root did not request a missing ignore file")
+	}
+	if err := cfg.WriteActiveIgnoreFile([]byte("tags: []\n")); err != nil {
+		t.Fatalf("write discovered-root ignore file: %v", err)
+	}
+	if err := cfg.WriteTemplatesIndex(map[string]string{"id": "path"}); err != nil {
+		t.Fatalf("write discovered-root template index: %v", err)
+	}
+	if err := cfg.SetTemplatesVersion("v2.0.0"); err != nil {
+		t.Fatalf("set discovered-root template version: %v", err)
+	}
+
+	for _, customDir := range cfg.GetAllCustomTemplateDirs() {
+		if filepath.Dir(customDir) != root {
+			t.Fatalf("custom directory %q is not under active root %q", customDir, root)
+		}
+	}
+}
+
+func TestNeedsIgnoreFileUpdateUsesActiveFile(t *testing.T) {
+	root := t.TempDir()
+	cfg := &Config{}
+	cfg.SetTemplatesDir(root)
+
+	contents := []byte("tags: [weak]\n")
+	latestHash := fmt.Sprintf("%x", md5.Sum(contents))
+
+	// The compatibility field must not hide a missing active file.
+	cfg.NucleiIgnoreHash = latestHash
+	if !cfg.IgnoreFileNeedsUpdate(latestHash) {
+		t.Fatal("missing active ignore file did not require an update")
+	}
+
+	if err := os.WriteFile(cfg.GetActiveIgnoreFilePath(), contents, 0o600); err != nil {
+		t.Fatalf("write active ignore file: %v", err)
+	}
+	// The compatibility field must not override the active file contents.
+	cfg.NucleiIgnoreHash = "stale"
+	if cfg.IgnoreFileNeedsUpdate(latestHash) {
+		t.Fatal("matching active ignore file required an update")
+	}
+
+	if err := os.WriteFile(cfg.GetActiveIgnoreFilePath(), []byte("tags: []\n"), 0o600); err != nil {
+		t.Fatalf("replace active ignore file: %v", err)
+	}
+	cfg.NucleiIgnoreHash = latestHash
+	if !cfg.IgnoreFileNeedsUpdate(latestHash) {
+		t.Fatal("modified active ignore file did not require an update")
+	}
+
+	if cfg.IgnoreFileNeedsUpdate("") {
+		t.Fatal("valid active ignore file required an update without a remote hash")
+	}
+}
@@ -0,0 +1,73 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/adrg/xdg"
+)
+
+func defaultConfigDir() string {
+	return filepath.Join(xdg.ConfigHome, BinaryName)
+}
+
+func defaultStateDir() string {
+	return filepath.Join(xdg.StateHome, BinaryName)
+}
+
+func defaultCacheDir() string {
+	return filepath.Join(xdg.CacheHome, BinaryName)
+}
+
+func selectXDGTemplateRoot(dataHome string, dataDirs []string) (string, error) {
+	if !filepath.IsAbs(dataHome) {
+		return "", fmt.Errorf("XDG data home %q is not absolute", dataHome)
+	}
+
+	userRoot := filepath.Join(dataHome, BinaryName, NucleiTemplatesDirName)
+	exists, err := directoryExists(userRoot)
+	if err != nil {
+		return "", err
+	}
+
+	if exists {
+		return userRoot, nil
+	}
+
+	for _, dataDir := range dataDirs {
+		if !filepath.IsAbs(dataDir) {
+			continue
+		}
+
+		root := filepath.Join(dataDir, BinaryName, NucleiTemplatesDirName)
+		exists, err := directoryExists(root)
+		if err != nil {
+			return "", err
+		}
+
+		if exists {
+			return root, nil
+		}
+	}
+
+	return userRoot, nil
+}
+
+func directoryExists(path string) (bool, error) {
+	info, err := os.Stat(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return false, nil
+	}
+
+	if err != nil {
+		return false, fmt.Errorf("inspect directory %q: %w", path, err)
+	}
+
+	if !info.IsDir() {
+		return false, fmt.Errorf("path %q is not a directory", path)
+	}
+
+	return true, nil
+}
@@ -0,0 +1,84 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/adrg/xdg"
+)
+
+func TestXDGConfigPaths(t *testing.T) {
+	if got, want := defaultConfigDir(), filepath.Join(xdg.ConfigHome, BinaryName); got != want {
+		t.Fatalf("default config directory = %q, want %q", got, want)
+	}
+
+	if got, want := (&Config{}).GetCacheDir(), filepath.Join(xdg.CacheHome, BinaryName); got != want {
+		t.Fatalf("cache directory = %q, want %q", got, want)
+	}
+
+	if got, want := (&Config{}).GetStateDir(), filepath.Join(xdg.StateHome, BinaryName); got != want {
+		t.Fatalf("state directory = %q, want %q", got, want)
+	}
+}
+
+func TestSelectXDGTemplateRoot(t *testing.T) {
+	t.Run("user data wins", func(t *testing.T) {
+		dir := t.TempDir()
+		dataHome := filepath.Join(dir, "user")
+		userRoot := filepath.Join(dataHome, BinaryName, NucleiTemplatesDirName)
+		if err := os.MkdirAll(userRoot, 0o700); err != nil {
+			t.Fatalf("create user root: %v", err)
+		}
+		systemRoot := filepath.Join(dir, "system", BinaryName, NucleiTemplatesDirName)
+		if err := os.MkdirAll(systemRoot, 0o755); err != nil {
+			t.Fatalf("create system root: %v", err)
+		}
+
+		root, err := selectXDGTemplateRoot(dataHome, []string{filepath.Join(dir, "system")})
+		if err != nil {
+			t.Fatalf("select root: %v", err)
+		}
+		if root != userRoot {
+			t.Fatalf("root = %q, want %q", root, userRoot)
+		}
+	})
+
+	t.Run("first system directory wins", func(t *testing.T) {
+		dir := t.TempDir()
+		firstDir := filepath.Join(dir, "first")
+		secondDir := filepath.Join(dir, "second")
+		for _, base := range []string{firstDir, secondDir} {
+			if err := os.MkdirAll(filepath.Join(base, BinaryName, NucleiTemplatesDirName), 0o755); err != nil {
+				t.Fatalf("create system root: %v", err)
+			}
+		}
+
+		root, err := selectXDGTemplateRoot(filepath.Join(dir, "user"), []string{firstDir, secondDir})
+		if err != nil {
+			t.Fatalf("select root: %v", err)
+		}
+		want := filepath.Join(firstDir, BinaryName, NucleiTemplatesDirName)
+		if root != want {
+			t.Fatalf("root = %q, want %q", root, want)
+		}
+	})
+
+	t.Run("missing roots select user installation target", func(t *testing.T) {
+		dataHome := filepath.Join(t.TempDir(), "user")
+		root, err := selectXDGTemplateRoot(dataHome, nil)
+		if err != nil {
+			t.Fatalf("select root: %v", err)
+		}
+		want := filepath.Join(dataHome, BinaryName, NucleiTemplatesDirName)
+		if root != want {
+			t.Fatalf("root = %q, want %q", root, want)
+		}
+	})
+
+	t.Run("relative user data home is rejected", func(t *testing.T) {
+		if _, err := selectXDGTemplateRoot("relative", nil); err == nil {
+			t.Fatal("relative XDG data home was accepted")
+		}
+	})
+}
@@ -0,0 +1,142 @@
+package config
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/utils/json"
+)
+
+type templatesState struct {
+	TemplatesDirectory           string `json:"nuclei-templates-directory,omitempty"`
+	TemplateVersion              string `json:"nuclei-templates-version,omitempty"`
+	LatestNucleiVersion          string `json:"nuclei-latest-version"`
+	LatestNucleiTemplatesVersion string `json:"nuclei-templates-latest-version"`
+}
+
+// ReadTemplatesConfig reads templates state, migrating the legacy config file
+// only when the new state file does not exist.
+func (c *Config) ReadTemplatesConfig() error {
+	statePath := c.getTemplatesConfigFilePath()
+	data, err := os.ReadFile(statePath)
+	migrate := false
+	if errors.Is(err, os.ErrNotExist) {
+		legacyPath := c.getLegacyTemplatesConfigFilePath()
+
+		data, err = os.ReadFile(legacyPath)
+		if err != nil {
+			return fmt.Errorf("read templates state %q or legacy state %q: %w", statePath, legacyPath, err)
+		}
+
+		migrate = true
+	} else if err != nil {
+		return fmt.Errorf("read templates state %q: %w", statePath, err)
+	}
+
+	var state templatesState
+	if err := json.Unmarshal(data, &state); err != nil {
+		return fmt.Errorf("decode templates state %q: %w", statePath, err)
+	}
+
+	if state.TemplatesDirectory == "" {
+		return fmt.Errorf("decode templates state %q: templates directory is empty", statePath)
+	}
+
+	c.setTemplatesDir(state.TemplatesDirectory)
+	c.TemplateVersion = state.TemplateVersion
+
+	c.LatestNucleiVersion = state.LatestNucleiVersion
+	c.LatestNucleiTemplatesVersion = state.LatestNucleiTemplatesVersion
+
+	if migrate {
+		if err := c.WriteTemplatesConfig(); err != nil {
+			return fmt.Errorf("migrate templates state: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// WriteTemplatesConfig atomically writes restart-persistent templates state.
+func (c *Config) WriteTemplatesConfig() error {
+	state := templatesState{
+		TemplatesDirectory:           c.TemplatesDirectory,
+		TemplateVersion:              c.TemplateVersion,
+		LatestNucleiVersion:          c.LatestNucleiVersion,
+		LatestNucleiTemplatesVersion: c.LatestNucleiTemplatesVersion,
+	}
+
+	data, err := json.Marshal(&state)
+	if err != nil {
+		return fmt.Errorf("encode templates state: %w", err)
+	}
+
+	if err := atomicWriteFile(c.getTemplatesConfigFilePath(), data, 0o600); err != nil {
+		return fmt.Errorf("write templates state: %w", err)
+	}
+
+	return nil
+}
+
+func (c *Config) getTemplatesConfigFilePath() string {
+	return filepath.Join(c.GetStateDir(), TemplatesStateFileName)
+}
+
+// GetTemplatesStateFilePath returns the restart-persistent templates state
+// file path.
+func (c *Config) GetTemplatesStateFilePath() string {
+	return c.getTemplatesConfigFilePath()
+}
+
+// TODO(dwisiswant0): remove this in the future, only used for legacy migration.
+func (c *Config) getLegacyTemplatesConfigFilePath() string {
+	return filepath.Join(c.configDir, legacyTemplatesConfigFileName)
+}
+
+func atomicWriteFile(path string, data []byte, mode os.FileMode) error {
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return fmt.Errorf("create directory %q: %w", dir, err)
+	}
+
+	temp, err := os.CreateTemp(dir, "."+filepath.Base(path)+"-*")
+	if err != nil {
+		return fmt.Errorf("create temporary file for %q: %w", path, err)
+	}
+
+	tempPath := temp.Name()
+
+	defer func() {
+		if temp != nil {
+			_ = temp.Close()
+		}
+
+		_ = os.Remove(tempPath)
+	}()
+
+	if err := temp.Chmod(mode); err != nil {
+		return fmt.Errorf("set temporary file mode for %q: %w", path, err)
+	}
+
+	if _, err := temp.Write(data); err != nil {
+		return fmt.Errorf("write temporary file for %q: %w", path, err)
+	}
+
+	if err := temp.Sync(); err != nil {
+		return fmt.Errorf("sync temporary file for %q: %w", path, err)
+	}
+
+	if err := temp.Close(); err != nil {
+		return fmt.Errorf("close temporary file for %q: %w", path, err)
+	}
+
+	temp = nil
+
+	if err := replaceTemplatesConfigFile(tempPath, path); err != nil {
+		return fmt.Errorf("replace %q: %w", path, err)
+	}
+
+	return nil
+}
@@ -0,0 +1,141 @@
+package config
+
+import (
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+)
+
+func TestReadTemplatesConfigMigratesLegacyState(t *testing.T) {
+	dir := t.TempDir()
+	configDir := filepath.Join(dir, "config")
+	stateDir := filepath.Join(dir, "state")
+	// Keep a backslash in the path so JSON escaping is exercised on all platforms.
+	legacyRoot := filepath.Join(dir, `legacy\templates`)
+	legacyState, err := json.Marshal(map[string]string{
+		"nuclei-templates-directory": legacyRoot,
+		"nuclei-templates-version":   "v1.2.3",
+		"nuclei-ignore-hash":         "legacy-local-hash",
+		"nuclei-latest-ignore-hash":  "legacy-remote-hash",
+	})
+	if err != nil {
+		t.Fatalf("marshal legacy state: %v", err)
+	}
+	writeTestFile(t, filepath.Join(configDir, legacyTemplatesConfigFileName), legacyState, 0o600)
+
+	cfg := &Config{configDir: configDir, stateDir: stateDir}
+	if err := cfg.ReadTemplatesConfig(); err != nil {
+		t.Fatalf("read templates state: %v", err)
+	}
+	if cfg.TemplatesDirectory != legacyRoot {
+		t.Fatalf("root = %q, want %q", cfg.TemplatesDirectory, legacyRoot)
+	}
+	if cfg.TemplateVersion != "v1.2.3" {
+		t.Fatalf("template version = %q, want v1.2.3", cfg.TemplateVersion)
+	}
+	if cfg.NucleiIgnoreHash != "" {
+		t.Fatalf("local ignore hash = %q, want empty", cfg.NucleiIgnoreHash)
+	}
+	if cfg.LatestNucleiIgnoreHash != "" {
+		t.Fatalf("remote ignore hash = %q, want empty", cfg.LatestNucleiIgnoreHash)
+	}
+	cfg.NucleiIgnoreHash = "current-local-hash"
+	cfg.LatestNucleiIgnoreHash = "current-remote-hash"
+	if err := cfg.WriteTemplatesConfig(); err != nil {
+		t.Fatalf("rewrite templates state: %v", err)
+	}
+
+	statePath := filepath.Join(stateDir, TemplatesStateFileName)
+	info, err := os.Stat(statePath)
+	if err != nil {
+		t.Fatalf("stat migrated state: %v", err)
+	}
+	if got := info.Mode().Perm(); runtime.GOOS != "windows" && got != 0o600 {
+		t.Fatalf("state mode = %o, want 600", got)
+	}
+	state, err := os.ReadFile(statePath)
+	if err != nil {
+		t.Fatalf("read migrated state: %v", err)
+	}
+	if strings.Contains(string(state), "nuclei-ignore-hash") {
+		t.Fatalf("migrated state persisted local ignore hash: %s", state)
+	}
+	if strings.Contains(string(state), "nuclei-latest-ignore-hash") {
+		t.Fatalf("migrated state persisted remote ignore hash: %s", state)
+	}
+	if _, err := os.Stat(filepath.Join(configDir, legacyTemplatesConfigFileName)); err != nil {
+		t.Fatalf("legacy state was removed: %v", err)
+	}
+}
+
+func TestReadTemplatesConfigDoesNotHideCorruptState(t *testing.T) {
+	dir := t.TempDir()
+	configDir := filepath.Join(dir, "config")
+	stateDir := filepath.Join(dir, "state")
+	writeTestFile(t, filepath.Join(configDir, legacyTemplatesConfigFileName), []byte(`{"nuclei-templates-directory":"legacy"}`), 0o600)
+	writeTestFile(t, filepath.Join(stateDir, TemplatesStateFileName), []byte(`{"nuclei-templates-directory":`), 0o600)
+
+	cfg := &Config{configDir: configDir, stateDir: stateDir}
+	err := cfg.ReadTemplatesConfig()
+	if err == nil {
+		t.Fatal("expected corrupt new state to fail")
+	}
+	if errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("corrupt state reported as missing: %v", err)
+	}
+	if cfg.TemplatesDirectory == "legacy" {
+		t.Fatal("corrupt new state fell back to legacy state")
+	}
+}
+
+func TestReadTemplatesConfigIgnoresLegacyRootSource(t *testing.T) {
+	dir := t.TempDir()
+	stateDir := filepath.Join(dir, "state")
+	root := filepath.Join(dir, "system", BinaryName, NucleiTemplatesDirName)
+	state, err := json.Marshal(map[string]string{
+		"nuclei-templates-directory":        root,
+		"nuclei-templates-directory-source": "xdg-system",
+		"nuclei-templates-version":          "v1.2.3",
+	})
+	if err != nil {
+		t.Fatalf("marshal templates state: %v", err)
+	}
+	statePath := filepath.Join(stateDir, TemplatesStateFileName)
+	writeTestFile(t, statePath, state, 0o600)
+
+	cfg := &Config{stateDir: stateDir, configDir: filepath.Join(dir, "config")}
+	if err := cfg.ReadTemplatesConfig(); err != nil {
+		t.Fatalf("read templates state: %v", err)
+	}
+	if cfg.TemplatesDirectory != root {
+		t.Fatalf("root = %q, want %q", cfg.TemplatesDirectory, root)
+	}
+	if cfg.TemplateVersion != "v1.2.3" {
+		t.Fatalf("template version = %q, want v1.2.3", cfg.TemplateVersion)
+	}
+
+	if err := cfg.WriteTemplatesConfig(); err != nil {
+		t.Fatalf("rewrite templates state: %v", err)
+	}
+	rewritten, err := os.ReadFile(statePath)
+	if err != nil {
+		t.Fatalf("read rewritten templates state: %v", err)
+	}
+	if strings.Contains(string(rewritten), "nuclei-templates-directory-source") {
+		t.Fatalf("rewritten state retained legacy root source: %s", rewritten)
+	}
+}
+
+func writeTestFile(t *testing.T, path string, data []byte, mode os.FileMode) {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
+		t.Fatalf("create test directory: %v", err)
+	}
+	if err := os.WriteFile(path, data, mode); err != nil {
+		t.Fatalf("write test file: %v", err)
+	}
+}
@@ -11,7 +11,6 @@ import (
 	"github.com/maypok86/otter/v2"
 	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
 	"github.com/projectdiscovery/nuclei/v3/pkg/templates"
-	folderutil "github.com/projectdiscovery/utils/folder"
 )

 const (
@@ -47,10 +46,10 @@ type cacheSnapshot struct {
 // NewIndex creates a new template metadata cache with the given options.
 func NewIndex(cacheDir string) (*Index, error) {
 	if cacheDir == "" {
-		cacheDir = folderutil.AppCacheDirOrDefault(".nuclei-cache", config.BinaryName)
+		cacheDir = config.DefaultConfig.GetCacheDir()
 	}

-	if err := os.MkdirAll(cacheDir, 0755); err != nil {
+	if err := os.MkdirAll(cacheDir, 0o700); err != nil {
 		return nil, err
 	}

@@ -226,10 +225,16 @@ func (i *Index) Save() error {

 	// NOTE(dwisiswant0): write to temp for atomic op.
 	tmpFile := i.cacheFile + ".tmp"
-	file, err := os.Create(tmpFile)
+	file, err := os.OpenFile(tmpFile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
 	if err != nil {
 		return err
 	}
+	if err := file.Chmod(0o600); err != nil {
+		_ = file.Close()
+		_ = os.Remove(tmpFile)
+
+		return err
+	}

 	encoder := gob.NewEncoder(file)
 	if err := encoder.Encode(snapshot); err != nil {
@@ -4,9 +4,12 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"testing"
 	"time"

+	"github.com/adrg/xdg"
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
 	"github.com/projectdiscovery/nuclei/v3/pkg/model"
 	"github.com/projectdiscovery/nuclei/v3/pkg/model/types/severity"
 	"github.com/projectdiscovery/nuclei/v3/pkg/model/types/stringslice"
@@ -29,9 +32,31 @@ func TestNewIndex(t *testing.T) {
 	})

 	t.Run("with default directory", func(t *testing.T) {
+		oldConfig := config.DefaultConfig
+		oldCacheHome := xdg.CacheHome
+		cacheHome := t.TempDir()
+		xdg.CacheHome = cacheHome
+		config.DefaultConfig = &config.Config{}
+		t.Cleanup(func() {
+			config.DefaultConfig = oldConfig
+			xdg.CacheHome = oldCacheHome
+		})
+
 		cache, err := NewDefaultIndex()
 		require.NoError(t, err, "Failed to create cache with default directory")
 		require.NotNil(t, cache, "Cache should not be nil")
+		require.Equal(t, filepath.Join(cacheHome, config.BinaryName, IndexFileName), cache.cacheFile)
+	})
+
+	t.Run("creates private directory", func(t *testing.T) {
+		cacheDir := filepath.Join(t.TempDir(), "cache")
+		_, err := NewIndex(cacheDir)
+		require.NoError(t, err)
+		info, err := os.Stat(cacheDir)
+		require.NoError(t, err)
+		if runtime.GOOS != "windows" {
+			require.Equal(t, os.FileMode(0o700), info.Mode().Perm())
+		}
 	})
 }

@@ -125,6 +150,9 @@ func TestCachePersistence(t *testing.T) {
 		stat, err := os.Stat(cacheFile)
 		require.NoError(t, err, "Cache file should exist")
 		require.Greater(t, stat.Size(), int64(0), "Cache file should not be empty")
+		if runtime.GOOS != "windows" {
+			require.Equal(t, os.FileMode(0o600), stat.Mode().Perm())
+		}

 		// Create new cache and load
 		cache2, err := NewIndex(tmpDir)
@@ -823,7 +823,14 @@ func (store *Store) LoadTemplatesWithTags(templatesList, tags []string) ([]*temp
 	// tags, so it must be matched against the ignore-file tags specifically:
 	// otherwise user-requested -exclude-tags drops would be mislabeled as
 	// .nuclei-ignore exclusions.
-	ignoreFileTags := config.ReadIgnoreFile().Tags
+	ignoreFile, err := config.ReadIgnoreFile()
+	if errors.Is(err, os.ErrNotExist) {
+		store.logger.Warning().Msgf("Could not read active .nuclei-ignore file: %s; continuing without ignore exclusions", err)
+	} else if err != nil {
+		return nil, err
+	}
+	ignoreFileTags := ignoreFile.Tags
+
 	noteExcludedByTag := func(templatePath string, metadata *index.Metadata) {
 		if len(ignoreFileTags) == 0 || !slices.ContainsFunc(ignoreFileTags, metadata.HasTag) {
 			return
@@ -5,6 +5,7 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"strconv"
 	"testing"
 	"time"

@@ -60,6 +61,37 @@ func TestLoadTemplates(t *testing.T) {
 	})
 }

+func TestLoadTemplatesWithTagsRejectsCorruptIgnoreFileInValidationMode(t *testing.T) {
+	root := t.TempDir()
+	ignoreFilePath := filepath.Join(root, config.NucleiIgnoreFileName)
+	require.NoError(t, os.WriteFile(ignoreFilePath, []byte("tags: ["), 0o600))
+
+	cfg := config.DefaultConfig
+	oldRoot := cfg.TemplatesDirectory
+	t.Cleanup(func() { cfg.SetTemplatesDir(oldRoot) })
+	cfg.SetTemplatesDir(root)
+
+	options := testutils.DefaultOptions.Copy()
+	options.Validate = true
+	metadataIndex, err := metadataindex.NewIndex(t.TempDir())
+	require.NoError(t, err)
+
+	store, err := New(&Config{
+		Catalog: disk.NewCatalog(""),
+		ExecutorOptions: &protocols.ExecutorOptions{
+			Options: options,
+			Parser:  templates.NewParser(),
+		},
+		Logger:        options.Logger,
+		MetadataIndex: metadataIndex,
+	})
+	require.NoError(t, err)
+
+	_, err = store.LoadTemplatesWithTags(nil, nil)
+	require.ErrorContains(t, err, "error parsing")
+	require.ErrorContains(t, err, strconv.Quote(ignoreFilePath))
+}
+
 func TestNewUsesConfiguredMetadataIndex(t *testing.T) {
 	indexDir := t.TempDir()
 	metadataIndex, err := metadataindex.NewIndex(indexDir)
@@ -27,3 +27,40 @@ func NewInputProvider(opts InputOptions) (InputProvider, error)

 This function returns a InputProvider based by appropriately selecting input provider based on the input format (i.e. either list or http) and returns the provider that can handle that input format.

+
+## Formats
+
+Fuzzing and DAST take the request shape (method, body, params) from the input, not from CLI flags, so a bare URL is always fuzzed as a `GET`. To fuzz anything else, feed a request-shaped input with `-im`:
+
+| `-im` | Input |
+| --- | --- |
+| `list` | urls, domains, ips, cidrs (default) |
+| `http` | raw HTTP requests |
+| `burp` | Burp Suite xml export |
+| `jsonl` | proxify jsonl output |
+| `yaml` | proxify yaml multidoc output |
+| `openapi` | OpenAPI 3 spec |
+| `swagger` | Swagger 2 spec |
+
+### Raw HTTP requests (`-im http`)
+
+The shortest path from a single endpoint to a DAST scan, for targets with no spec or captured traffic. Save the request as it appears on the wire, which is what "copy as raw request" in Burp and browser devtools produce:
+
+```
+POST /api/login HTTP/1.1
+Host: example.com
+Content-Type: application/json
+
+{"user":"admin","pass":"secret"}
+```
+
+```console
+nuclei -l login.http -im http -dast -t fuzzing-templates/
+```
+
+Notes:
+
+- Separate multiple requests with a line starting with `###`, the `.http` file convention.
+- The scheme is not part of the request, so it is inferred from the authority. Use an absolute request target (`POST https://example.com/api/login HTTP/1.1`) to state it explicitly.
+- The target comes from the `Host` header or from an absolute request target; a request carrying neither is skipped.
+
@@ -1,14 +1,12 @@
 package burp

 import (
-	"encoding/base64"
 	"io"
 	"strings"

 	"github.com/pkg/errors"
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/formats"
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/types"
-	"github.com/projectdiscovery/utils/conversion"
 	burpxml "github.com/projectdiscovery/utils/parsers/burp/xml"
 )

@@ -42,17 +40,28 @@ func (j *BurpFormat) Parse(input io.Reader, resultsCb formats.ParseReqRespCallba
 	}

 	for _, item := range items.Items {
-		binx, err := base64.StdEncoding.DecodeString(item.Request.Raw)
-		if err != nil {
-			return errors.Wrap(err, "could not decode base64")
+		// Prefer decoded Body from burpxml; fall back to Raw. Do not TrimSpace the
+		// payload — trailing blank lines mark end-of-headers for HTTP parsers.
+		reqRaw := item.Request.Body
+		if strings.TrimSpace(reqRaw) == "" {
+			reqRaw = item.Request.Raw
 		}
-		if strings.TrimSpace(conversion.String(binx)) == "" {
+		if strings.TrimSpace(reqRaw) == "" {
 			continue
 		}
-		rawRequest, err := types.ParseRawRequestWithURL(conversion.String(binx), item.URL)
+		rawRequest, err := types.ParseRawRequestWithURL(reqRaw, item.URL)
 		if err != nil {
 			return errors.Wrap(err, "could not parse raw request")
 		}
+
+		respRaw := item.Response.Body
+		if strings.TrimSpace(respRaw) == "" {
+			respRaw = item.Response.Raw
+		}
+		if strings.TrimSpace(respRaw) != "" {
+			rawRequest.Response = &types.HttpResponse{Raw: respRaw}
+		}
+
 		resultsCb(rawRequest)
 	}
 	return nil
@@ -14,6 +14,7 @@ func TestBurpParse(t *testing.T) {
 	proxifyInputFile := "../testdata/burp.xml"

 	var gotMethodsToURLs []string
+	var gotResponses int

 	file, err := os.Open(proxifyInputFile)
 	require.Nilf(t, err, "error opening proxify input file: %v", err)
@@ -23,6 +24,10 @@ func TestBurpParse(t *testing.T) {

 	err = format.Parse(file, func(request *types.RequestResponse) bool {
 		gotMethodsToURLs = append(gotMethodsToURLs, request.URL.String())
+		if request.Response != nil && request.Response.Raw != "" {
+			gotResponses++
+			require.Contains(t, request.Response.Raw, "HTTP/")
+		}
 		return false
 	}, proxifyInputFile)
 	if err != nil {
@@ -37,4 +42,25 @@ func TestBurpParse(t *testing.T) {
 		"http://google.com/",
 	}
 	require.ElementsMatch(t, expectedURLs, gotMethodsToURLs, "could not get burp urls")
+	require.Equal(t, 2, gotResponses, "burp items should include response bodies for passive mode")
+}
+
+func TestBurpParseResponseBodyContent(t *testing.T) {
+	format := New()
+	file, err := os.Open("../testdata/burp.xml")
+	require.NoError(t, err)
+	defer func() { _ = file.Close() }()
+
+	var first *types.RequestResponse
+	err = format.Parse(file, func(request *types.RequestResponse) bool {
+		if first == nil {
+			first = request
+		}
+		return false
+	}, "../testdata/burp.xml")
+	require.NoError(t, err)
+	require.NotNil(t, first)
+	require.NotNil(t, first.Response)
+	require.Contains(t, first.Response.Raw, `"id":"1"`)
+	require.Contains(t, first.Request.Raw, "POST /scans")
 }
@@ -2,6 +2,7 @@ package json

 import (
 	"io"
+	"strings"

 	"github.com/pkg/errors"
 	"github.com/projectdiscovery/gologger"
@@ -32,6 +33,13 @@ type proxifyRequest struct {
 		Raw      string            `json:"raw"`
 		Endpoint string            `json:"endpoint"`
 	} `json:"request"`
+	Response *proxifyResponse `json:"response,omitempty"`
+}
+
+type proxifyResponse struct {
+	Header map[string]string `json:"header"`
+	Body   string            `json:"body"`
+	Raw    string            `json:"raw"`
 }

 // Name returns the name of the format
@@ -65,7 +73,28 @@ func (j *JSONFormat) Parse(input io.Reader, resultsCb formats.ParseReqRespCallba
 			gologger.Warning().Msgf("jsonl: Could not parse raw request %s: %s\n", request.URL, err)
 			continue
 		}
+		if resp := buildProxifyResponse(request.Response); resp != nil {
+			rawRequest.Response = resp
+		}
 		resultsCb(rawRequest)
 	}
 	return nil
 }
+
+func buildProxifyResponse(resp *proxifyResponse) *types.HttpResponse {
+	if resp == nil {
+		return nil
+	}
+	raw := resp.Raw
+	if raw == "" {
+		return nil
+	}
+	// Proxify often stores headers in raw and the body separately (e.g. gzip).
+	if resp.Body != "" && (strings.HasSuffix(raw, "\r\n\r\n") || strings.HasSuffix(raw, "\n\n")) {
+		raw += resp.Body
+	}
+	return &types.HttpResponse{
+		Raw:  raw,
+		Body: resp.Body,
+	}
+}
@@ -49,8 +49,13 @@ func TestJSONFormatterParse(t *testing.T) {
 	}()

 	var urls []string
+	var withResponse int
 	err = format.Parse(file, func(request *types.RequestResponse) bool {
 		urls = append(urls, request.URL.String())
+		if request.Response != nil && request.Response.Raw != "" {
+			withResponse++
+			require.Contains(t, request.Response.Raw, "HTTP/")
+		}
 		return false
 	}, proxifyInputFile)
 	if err != nil {
@@ -61,4 +66,15 @@ func TestJSONFormatterParse(t *testing.T) {
 		t.Fatalf("invalid number of urls: %d", len(urls))
 	}
 	require.ElementsMatch(t, urls, expectedURLs)
+	require.Equal(t, len(expectedURLs), withResponse, "jsonl items should include response bodies for passive mode")
+}
+
+func TestBuildProxifyResponseAppendsBody(t *testing.T) {
+	resp := buildProxifyResponse(&proxifyResponse{
+		Raw:  "HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\n",
+		Body: "hello",
+	})
+	require.NotNil(t, resp)
+	require.Equal(t, "HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello", resp.Raw)
+	require.Equal(t, "hello", resp.Body)
 }
@@ -0,0 +1,99 @@
+// Package raw parses input files holding raw HTTP requests, the shape produced
+// by "copy as raw request" in Burp and browser devtools and stored in .http
+// files. It is the shortest path from a single request to a DAST scan, for
+// targets that have no OpenAPI spec or captured traffic to feed in.
+package raw
+
+import (
+	"io"
+	"strings"
+
+	"github.com/pkg/errors"
+	"github.com/projectdiscovery/gologger"
+	"github.com/projectdiscovery/nuclei/v3/pkg/input/formats"
+	"github.com/projectdiscovery/nuclei/v3/pkg/input/types"
+	"github.com/projectdiscovery/nuclei/v3/pkg/utils"
+)
+
+// requestSeparator delimits requests when a file carries more than one,
+// following the .http file convention
+const requestSeparator = "###"
+
+// RawFormat is a parser for files containing one or more raw HTTP requests
+type RawFormat struct {
+	opts formats.InputFormatOptions
+}
+
+// New creates a new raw HTTP request parser
+func New() *RawFormat {
+	return &RawFormat{}
+}
+
+var _ formats.Format = &RawFormat{}
+
+// Name returns the name of the format
+func (r *RawFormat) Name() string {
+	return "http"
+}
+
+func (r *RawFormat) SetOptions(options formats.InputFormatOptions) {
+	r.opts = options
+}
+
+// Parse parses the input and calls the provided callback
+// function for each RawRequest it discovers.
+func (r *RawFormat) Parse(input io.Reader, resultsCb formats.ParseReqRespCallback, filePath string) error {
+	data, err := io.ReadAll(input)
+	if err != nil {
+		return errors.Wrap(err, "could not read raw request file")
+	}
+	for _, request := range splitRequests(string(data)) {
+		reqResp, err := types.ParseRawRequest(terminateHeaders(request))
+		if err != nil {
+			gologger.Warning().Msgf("http: could not parse raw request in %s: %s\n", filePath, err)
+			continue
+		}
+		if reqResp.URL.Host == "" {
+			gologger.Warning().Msgf("http: skipped raw request in %s: no target, add a Host header or an absolute request target\n", filePath)
+			continue
+		}
+		if reqResp.URL.Scheme == "" {
+			// nothing in the request states the scheme, so settle it the same
+			// way nuclei settles it for scheme-less list inputs
+			reqResp.URL.Scheme = utils.DetermineSchemeOrder(reqResp.URL.Host)[0]
+		}
+		resultsCb(reqResp)
+	}
+	return nil
+}
+
+// splitRequests splits the file contents into individual raw requests
+func splitRequests(data string) []string {
+	var requests []string
+	var current []string
+	flush := func() {
+		if request := strings.Join(current, "\n"); strings.TrimSpace(request) != "" {
+			requests = append(requests, strings.TrimLeft(request, "\r\n"))
+		}
+		current = nil
+	}
+	for _, line := range strings.Split(data, "\n") {
+		if strings.HasPrefix(strings.TrimSpace(line), requestSeparator) {
+			flush()
+			continue
+		}
+		current = append(current, line)
+	}
+	flush()
+	return requests
+}
+
+// terminateHeaders appends the blank line that separates headers from the body.
+// Requests copied out of a browser or Burp routinely end at the last header,
+// and the parser needs that terminator to know where the headers stop.
+func terminateHeaders(request string) string {
+	if strings.Contains(request, "\n\r\n") || strings.Contains(request, "\n\n") {
+		return request
+	}
+	return request + "\r\n\r\n"
+}
@@ -0,0 +1,119 @@
+package raw
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/input/formats"
+	"github.com/projectdiscovery/nuclei/v3/pkg/input/types"
+	"github.com/stretchr/testify/require"
+)
+
+func parseAll(t *testing.T, data string) []*types.RequestResponse {
+	t.Helper()
+	var got []*types.RequestResponse
+	err := New().Parse(strings.NewReader(data), func(rr *types.RequestResponse) bool {
+		got = append(got, rr)
+		return false
+	}, "test.http")
+	require.NoError(t, err)
+	return got
+}
+
+func TestParseSingleRequest(t *testing.T) {
+	got := parseAll(t, "POST /api/login HTTP/1.1\r\nHost: example.com\r\nContent-Type: application/json\r\n\r\n{\"user\":\"admin\"}")
+
+	require.Len(t, got, 1)
+	require.Equal(t, "POST", got[0].Request.Method)
+	require.Equal(t, "https://example.com/api/login", got[0].URL.String())
+	require.Equal(t, `{"user":"admin"}`, got[0].Request.Body)
+	contentType, _ := got[0].Request.Headers.Get("Content-Type")
+	require.Equal(t, "application/json", contentType)
+}
+
+func TestParseMultipleRequests(t *testing.T) {
+	got := parseAll(t, strings.Join([]string{
+		"GET /one HTTP/1.1",
+		"Host: example.com",
+		"",
+		"### second request",
+		"POST /two HTTP/1.1",
+		"Host: example.com",
+		"",
+		"body=1",
+	}, "\n"))
+
+	require.Len(t, got, 2)
+	require.Equal(t, "https://example.com/one", got[0].URL.String())
+	require.Equal(t, "https://example.com/two", got[1].URL.String())
+	require.Equal(t, "body=1", got[1].Request.Body)
+}
+
+// A request pasted out of a browser or Burp commonly ends at the last header.
+func TestParseWithoutTrailingBlankLine(t *testing.T) {
+	got := parseAll(t, "GET /api/users?id=1 HTTP/1.1\r\nHost: example.com")
+
+	require.Len(t, got, 1)
+	require.Equal(t, "https://example.com/api/users?id=1", got[0].URL.String())
+	require.Empty(t, got[0].Request.Body)
+}
+
+// The scheme is not part of an origin-form request, so it is inferred from the
+// authority unless the request target states it.
+func TestParseResolvesScheme(t *testing.T) {
+	tests := []struct {
+		name string
+		raw  string
+		url  string
+	}{
+		{"no port", "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n", "https://example.com/"},
+		{"port 80", "GET / HTTP/1.1\r\nHost: example.com:80\r\n\r\n", "http://example.com:80/"},
+		{"high port", "GET / HTTP/1.1\r\nHost: 127.0.0.1:18080\r\n\r\n", "http://127.0.0.1:18080/"},
+		{"absolute target", "GET https://example.com/p HTTP/1.1\r\nHost: example.com\r\n\r\n", "https://example.com/p"},
+		{"absolute plain target", "GET http://example.com/p HTTP/1.1\r\nHost: example.com\r\n\r\n", "http://example.com/p"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := parseAll(t, tt.raw)
+			require.Len(t, got, 1)
+			require.Equal(t, tt.url, got[0].URL.String())
+		})
+	}
+}
+
+// A request with no way to resolve a target is dropped rather than scanned
+// against nothing, and it must not take the rest of the file down with it.
+func TestParseSkipsRequestsWithoutTarget(t *testing.T) {
+	got := parseAll(t, strings.Join([]string{
+		"GET /no-host HTTP/1.1",
+		"X-Test: 1",
+		"",
+		"###",
+		"GET /valid HTTP/1.1",
+		"Host: example.com",
+		"",
+	}, "\n"))
+
+	require.Len(t, got, 1)
+	require.Equal(t, "https://example.com/valid", got[0].URL.String())
+}
+
+// The callback's return value is unused across every input format, and its two
+// call sites in the provider give it opposite meanings, so a request must be
+// reported regardless of what the previous one returned.
+func TestParseIgnoresCallbackReturn(t *testing.T) {
+	var count int
+	err := New().Parse(strings.NewReader("GET /one HTTP/1.1\nHost: example.com\n\n###\nGET /two HTTP/1.1\nHost: example.com\n\n"), func(rr *types.RequestResponse) bool {
+		count++
+		return true
+	}, "test.http")
+
+	require.NoError(t, err)
+	require.Equal(t, 2, count)
+}
+
+func TestFormatInterface(t *testing.T) {
+	var format formats.Format = New()
+	require.Equal(t, "http", format.Name())
+}
@@ -3,6 +3,7 @@ package yaml
 import (
 	"bytes"
 	"io"
+	"strings"

 	"github.com/pkg/errors"
 	"github.com/projectdiscovery/gologger"
@@ -26,12 +27,19 @@ var _ formats.Format = &YamlMultiDocFormat{}

 // proxifyRequest is a request for proxify
 type proxifyRequest struct {
-	URL     string `json:"url"`
+	URL     string `json:"url" yaml:"url"`
 	Request struct {
-		Header map[string]string `json:"header"`
-		Body   string            `json:"body"`
-		Raw    string            `json:"raw"`
-	} `json:"request"`
+		Header map[string]string `json:"header" yaml:"header"`
+		Body   string            `json:"body" yaml:"body"`
+		Raw    string            `json:"raw" yaml:"raw"`
+	} `json:"request" yaml:"request"`
+	Response *proxifyResponse `json:"response,omitempty" yaml:"response,omitempty"`
+}
+
+type proxifyResponse struct {
+	Header map[string]string `json:"header" yaml:"header"`
+	Body   string            `json:"body" yaml:"body"`
+	Raw    string            `json:"raw" yaml:"raw"`
 }

 // Name returns the name of the format
@@ -83,7 +91,27 @@ func (j *YamlMultiDocFormat) Parse(input io.Reader, resultsCb formats.ParseReqRe
 			gologger.Warning().Msgf("multidoc-yaml: Could not parse raw request %s: %s", request.URL, err)
 			continue
 		}
+		if resp := buildProxifyResponse(request.Response); resp != nil {
+			rawRequest.Response = resp
+		}
 		resultsCb(rawRequest)
 	}
 	return nil
 }
+
+func buildProxifyResponse(resp *proxifyResponse) *types.HttpResponse {
+	if resp == nil {
+		return nil
+	}
+	raw := resp.Raw
+	if raw == "" {
+		return nil
+	}
+	if resp.Body != "" && (strings.HasSuffix(raw, "\r\n\r\n") || strings.HasSuffix(raw, "\n\n")) {
+		raw += resp.Body
+	}
+	return &types.HttpResponse{
+		Raw:  raw,
+		Body: resp.Body,
+	}
+}
@@ -27,13 +27,29 @@ func TestYamlFormatterParse(t *testing.T) {
 	}()

 	var urls []string
+	var withResponse int
 	err = format.Parse(file, func(request *types.RequestResponse) bool {
 		urls = append(urls, request.URL.String())
+		if request.Response != nil && request.Response.Raw != "" {
+			withResponse++
+			require.Contains(t, request.Response.Raw, "HTTP/")
+		}
 		return false
 	}, proxifyInputFile)
 	require.Nilf(t, err, "error parsing yaml file: %v", err)
 	require.Len(t, urls, len(expectedUrls), "invalid number of urls")
 	require.ElementsMatch(t, urls, expectedUrls, "invalid urls")
+	require.Equal(t, len(expectedUrls), withResponse, "yaml items should include response bodies for passive mode")
+}
+
+func TestBuildProxifyResponseAppendsBody(t *testing.T) {
+	resp := buildProxifyResponse(&proxifyResponse{
+		Raw:  "HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\n",
+		Body: "hello",
+	})
+	require.NotNil(t, resp)
+	require.Equal(t, "HTTP/1.1 200 OK\r\nContent-Length: 5\r\n\r\nhello", resp.Raw)
+	require.Equal(t, "hello", resp.Body)
 }

 func TestYamlFormatterParseWithVariables(t *testing.T) {
@@ -12,6 +12,7 @@ import (
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/formats/burp"
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/formats/json"
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/formats/openapi"
+	"github.com/projectdiscovery/nuclei/v3/pkg/input/formats/raw"
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/formats/swagger"
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/formats/yaml"
 	"github.com/projectdiscovery/nuclei/v3/pkg/input/types"
@@ -145,6 +146,7 @@ var providersList = []formats.Format{
 	yaml.New(),
 	openapi.New(),
 	swagger.New(),
+	raw.New(),
 }

 // SupportedFormats returns the list of supported formats in comma-separated
@@ -15,6 +15,7 @@ import (
 	"github.com/projectdiscovery/useragent"
 	"github.com/projectdiscovery/utils/conversion"
 	mapsutil "github.com/projectdiscovery/utils/maps"
+	stringsutil "github.com/projectdiscovery/utils/strings"
 	urlutil "github.com/projectdiscovery/utils/url"
 )

@@ -239,25 +240,25 @@ func ParseRawRequest(raw string) (rr *RequestResponse, err error) {
 	method := parts[0]
 	rr.Request.Method = method

-	// parse relative url
-	urlx, err := urlutil.ParseRawRelativePath(parts[1], true)
+	// the request target is normally an origin-form path, but proxy captures and
+	// .http files use the absolute form, which already carries the authority
+	var urlx *urlutil.URL
+	target := parts[1]
+	if stringsutil.HasPrefixAnyI(target, urlutil.HTTP+urlutil.SchemeSeparator, urlutil.HTTPS+urlutil.SchemeSeparator) {
+		// urlutil.ParseAbsoluteURL only accepts lowercase schemes; preserve the
+		// remainder of the request target unchanged.
+		if scheme, rest, ok := strings.Cut(target, urlutil.SchemeSeparator); ok {
+			target = strings.ToLower(scheme) + urlutil.SchemeSeparator + rest
+		}
+		urlx, err = urlutil.ParseAbsoluteURL(target, true)
+	} else {
+		urlx, err = urlutil.ParseRawRelativePath(target, true)
+	}
 	if err != nil {
 		return nil, fmt.Errorf("failed to parse url: %s", err)
 	}
 	rr.URL = *urlx

-	// parse host line
-	hostLine, err := protoReader.ReadLine()
-	if err != nil {
-		return nil, fmt.Errorf("failed to read host line: %s", err)
-	}
-	sep := strings.Index(hostLine, ":")
-	if sep <= 0 || sep >= len(hostLine)-1 {
-		return nil, fmt.Errorf("invalid host line: %s", hostLine)
-	}
-	hostLine = hostLine[sep+2:]
-	rr.URL.Host = hostLine
-
 	// parse headers
 	rr.Request.Headers = mapsutil.NewOrderedMap[string, string]()
 	for {
@@ -269,11 +270,23 @@ func ParseRawRequest(raw string) (rr *RequestResponse, err error) {
 			// end of headers next is body
 			break
 		}
-		parts := strings.SplitN(line, ":", 2)
-		if len(parts) != 2 {
+		key, value, found := strings.Cut(line, ":")
+		if !found || key == "" {
 			return nil, fmt.Errorf("invalid header line: %s", line)
 		}
-		rr.Request.Headers.Set(parts[0], parts[1][1:])
+		value = strings.TrimSpace(value)
+		// Host carries the authority rather than request metadata, and callers
+		// read it off the URL: retryablehttp derives the wire Host from there,
+		// and keeping it in the header map would expose it to header fuzzing as
+		// if it were an ordinary header.
+		if strings.EqualFold(key, "Host") {
+			// an absolute request target takes precedence over the Host header
+			if rr.URL.Host == "" {
+				rr.URL.Host = value
+			}
+			continue
+		}
+		rr.Request.Headers.Set(key, value)
 	}

 	// parse body
@@ -121,6 +121,139 @@ func TestParseRawRequestBodyTrailingNewlines(t *testing.T) {
 	}
 }

+// Headers used to be parsed positionally: the second line was always taken as
+// the Host line and dropped from the header map, and values were read by
+// skipping a single byte after the colon. Any request-shaped input (burp, jsonl,
+// yaml, openapi) hitting one of these shapes either lost a header silently,
+// truncated a value, or crashed the whole scan.
+func TestParseRawRequestHeaderParsing(t *testing.T) {
+	tests := []struct {
+		name    string
+		raw     string
+		host    string
+		headers map[string]string
+	}{
+		{
+			name:    "host first",
+			raw:     "POST /login HTTP/1.1\r\nHost: example.com\r\nContent-Type: application/json\r\n\r\n{}",
+			host:    "example.com",
+			headers: map[string]string{"Content-Type": "application/json"},
+		},
+		{
+			name:    "host after other headers",
+			raw:     "POST /login HTTP/1.1\r\nContent-Type: application/json\r\nHost: example.com\r\n\r\n{}",
+			host:    "example.com",
+			headers: map[string]string{"Content-Type": "application/json"},
+		},
+		{
+			name:    "host absent",
+			raw:     "POST /login HTTP/1.1\r\nContent-Type: application/json\r\n\r\n{}",
+			host:    "",
+			headers: map[string]string{"Content-Type": "application/json"},
+		},
+		{
+			name:    "no space after colon",
+			raw:     "GET / HTTP/1.1\r\nHost:example.com\r\nX-Token:abc\r\n\r\n",
+			host:    "example.com",
+			headers: map[string]string{"X-Token": "abc"},
+		},
+		{
+			name:    "valueless header",
+			raw:     "GET / HTTP/1.1\r\nHost: example.com\r\nX-Empty:\r\n\r\n",
+			host:    "example.com",
+			headers: map[string]string{"X-Empty": ""},
+		},
+		{
+			name:    "lowercase host key",
+			raw:     "GET / HTTP/1.1\r\ncontent-type: text/plain\r\nhost: example.com\r\n\r\n",
+			host:    "example.com",
+			headers: map[string]string{"content-type": "text/plain"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var rr *RequestResponse
+			var err error
+			require.NotPanics(t, func() {
+				rr, err = ParseRawRequest(tt.raw)
+			})
+			require.NoError(t, err)
+			require.Equal(t, tt.host, rr.URL.Host)
+
+			got := map[string]string{}
+			rr.Request.Headers.Iterate(func(k, v string) bool {
+				got[k] = v
+				return true
+			})
+			require.Equal(t, tt.headers, got)
+		})
+	}
+}
+
+// Requests captured through a proxy carry an absolute request target, which the
+// parser used to append to the authority as if it were a path.
+func TestParseRawRequestAbsoluteTarget(t *testing.T) {
+	tests := []struct {
+		name string
+		raw  string
+		url  string
+		host string
+		path string
+	}{
+		{
+			name: "absolute target",
+			raw:  "GET http://example.com/p?q=1 HTTP/1.1\r\nHost: example.com\r\n\r\n",
+			url:  "http://example.com/p?q=1",
+		},
+		{
+			name: "absolute target wins over host header",
+			raw:  "GET https://example.com/p HTTP/1.1\r\nHost: proxy.internal\r\n\r\n",
+			url:  "https://example.com/p",
+		},
+		{
+			name: "uppercase scheme absolute target",
+			raw:  "GET HTTP://example.com/p?q=1 HTTP/1.1\r\nHost: example.com\r\n\r\n",
+			url:  "http://example.com/p?q=1",
+			host: "example.com",
+			path: "/p",
+		},
+		{
+			name: "mixed-case https absolute target wins over host",
+			raw:  "GET Https://Example.COM/p HTTP/1.1\r\nHost: proxy.internal\r\n\r\n",
+			url:  "https://Example.COM/p",
+			host: "Example.COM",
+			path: "/p",
+		},
+		{
+			name: "origin form keeps host header",
+			raw:  "GET /p HTTP/1.1\r\nHost: example.com\r\n\r\n",
+			url:  "example.com/p",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rr, err := ParseRawRequest(tt.raw)
+			require.NoError(t, err)
+			require.Equal(t, tt.url, rr.URL.String())
+			if tt.host != "" {
+				require.Equal(t, tt.host, rr.URL.Host)
+			}
+			if tt.path != "" {
+				require.Equal(t, tt.path, rr.URL.Path)
+			}
+		})
+	}
+}
+
+// A header line without a colon is not a header, and must not be mistaken for
+// the start of the body.
+func TestParseRawRequestRejectsMalformedHeader(t *testing.T) {
+	_, err := ParseRawRequest("GET / HTTP/1.1\r\nHost: example.com\r\nnot-a-header\r\n\r\n")
+	require.Error(t, err)
+}
+
 func TestUnmarshalJSON(t *testing.T) {
 	tests := []struct {
 		name           string
@@ -0,0 +1,56 @@
+package installer
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
+)
+
+func TestTemplateRootLifecycleIgnoresLegacyDiscoverySource(t *testing.T) {
+	dir := t.TempDir()
+	// Keep a backslash in the path so JSON escaping is exercised on all platforms.
+	root := filepath.Join(dir, `system\nuclei\nuclei-templates`)
+	if err := os.MkdirAll(root, 0o755); err != nil {
+		t.Fatalf("create template root: %v", err)
+	}
+	stateDir := filepath.Join(dir, "state")
+	if err := os.MkdirAll(stateDir, 0o700); err != nil {
+		t.Fatalf("create state directory: %v", err)
+	}
+	state, err := json.Marshal(map[string]string{
+		"nuclei-templates-directory":        root,
+		"nuclei-templates-directory-source": "xdg-system",
+	})
+	if err != nil {
+		t.Fatalf("marshal templates state: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(stateDir, config.TemplatesStateFileName), state, 0o600); err != nil {
+		t.Fatalf("write templates state: %v", err)
+	}
+
+	oldConfig := config.DefaultConfig
+	cfg := &config.Config{}
+	cfg.SetStateDir(stateDir)
+	if err := cfg.ReadTemplatesConfig(); err != nil {
+		t.Fatalf("read templates state: %v", err)
+	}
+	config.DefaultConfig = cfg
+	t.Cleanup(func() { config.DefaultConfig = oldConfig })
+
+	manager := &TemplateManager{DisablePublicTemplates: true}
+	if err := manager.installTemplatesAt(root); err != nil {
+		t.Fatalf("install into discovered root: %v", err)
+	}
+	if err := manager.updateTemplatesAt(root); err != nil {
+		t.Fatalf("update discovered root: %v", err)
+	}
+	if err := manager.writeChecksumFileInDir(root); err != nil {
+		t.Fatalf("write discovered-root checksum: %v", err)
+	}
+	if _, err := os.Stat(config.DefaultConfig.GetChecksumFilePath()); err != nil {
+		t.Fatalf("stat discovered-root checksum: %v", err)
+	}
+}
@@ -4,15 +4,19 @@ import (
 	"bytes"
 	"context"
 	"crypto/md5"
+	"crypto/rand"
+	"errors"
 	"fmt"
 	"io"
 	"io/fs"
+	"net/http"
 	"os"
 	"path/filepath"
 	"strconv"
 	"strings"

 	"github.com/charmbracelet/glamour"
+	"github.com/google/go-github/v30/github"
 	"github.com/olekukonko/tablewriter"
 	"github.com/projectdiscovery/gologger"
 	"github.com/projectdiscovery/nuclei/v3/pkg/catalog/config"
@@ -20,13 +24,13 @@ import (
 	filepathutil "github.com/projectdiscovery/nuclei/v3/pkg/utils/filepath"
 	"github.com/projectdiscovery/utils/errkit"
 	fileutil "github.com/projectdiscovery/utils/file"
-	mapsutil "github.com/projectdiscovery/utils/maps"
 	stringsutil "github.com/projectdiscovery/utils/strings"
 	updateutils "github.com/projectdiscovery/utils/update"
 )

 const (
-	checkSumFilePerm = 0644
+	checkSumFilePerm              = 0644
+	templateOutputTemporaryPrefix = ".nuclei-write-"
 )

 var (
@@ -80,13 +84,16 @@ func (t *TemplateManager) FreshInstallIfNotExists() error {
 	if fileutil.FolderExists(config.DefaultConfig.TemplatesDirectory) {
 		return nil
 	}
+
 	gologger.Info().Msgf("nuclei-templates are not installed, installing...")
 	if err := t.installTemplatesAt(config.DefaultConfig.TemplatesDirectory); err != nil {
 		return errkit.Wrapf(err, "failed to install templates at %s", config.DefaultConfig.TemplatesDirectory)
 	}
+
 	if t.CustomTemplates != nil {
 		t.CustomTemplates.Download(context.TODO())
 	}
+
 	return nil
 }

@@ -101,6 +108,10 @@ func (t *TemplateManager) updateIfOutdatedLocked() error {
 		return t.FreshInstallIfNotExists()
 	}

+	if err := recoverTemplateOwnership(config.DefaultConfig.TemplatesDirectory); err != nil {
+		return errkit.Wrapf(err, "failed to recover template ownership at %s", config.DefaultConfig.TemplatesDirectory)
+	}
+
 	needsUpdate := config.DefaultConfig.NeedsTemplateUpdate()

 	// NOTE(dwisiswant0): if PDTM API data is not available
@@ -130,30 +141,230 @@ func (t *TemplateManager) installTemplatesAt(dir string) error {
 			return errkit.Wrapf(err, "failed to create directory at %s", dir)
 		}
 	}
+
 	if t.DisablePublicTemplates {
 		gologger.Info().Msgf("Skipping installation of public nuclei-templates")
 		return nil
 	}
+
+	if err := recoverTemplateOwnership(dir); err != nil {
+		return errkit.Wrapf(err, "failed to recover template ownership at %s", dir)
+	}
+
 	ghrd, err := updateutils.NewghReleaseDownloader(config.OfficialNucleiTemplatesRepoName)
 	if err != nil {
 		return errkit.Wrapf(err, "failed to install templates at %s", dir)
 	}

 	// write templates to disk
-	_, err = t.writeTemplatesToDisk(ghrd, dir)
-	if err != nil {
-		return errkit.Wrapf(err, "failed to write templates to disk at %s", dir)
+	writtenOutputs, writeErr := t.writeTemplatesToDisk(ghrd, dir)
+	if _, finalizeErr := t.finalizeTemplateWrite(config.DefaultConfig, writtenOutputs, ghrd.Latest.GetTagName(), writeErr); finalizeErr != nil {
+		return errkit.Wrapf(finalizeErr, "failed to finalize template installation at %s", dir)
 	}
+
 	gologger.Info().Msgf("Successfully installed nuclei-templates at %s", dir)
+
 	return nil
 }

+type templateArchiveFetcher func(version string) (*bytes.Reader, error)
+
+func commitTemplateVersion(cfg *config.Config, version string) error {
+	previousVersion := cfg.TemplateVersion
+	if err := cfg.SetTemplatesVersion(version); err != nil {
+		cfg.TemplateVersion = previousVersion
+
+		return err
+	}
+
+	return nil
+}
+
+func (t *TemplateManager) finalizeTemplateRelease(cfg *config.Config, writtenOutputs map[string]string, version string) (map[string]string, error) {
+	dir := cfg.TemplatesDirectory
+
+	var finalizationErr error
+
+	if err := reconcileTemplateOwnership(dir, writtenOutputs); err != nil {
+		finalizationErr = errors.Join(finalizationErr, fmt.Errorf("reconcile template ownership: %w", err))
+	}
+
+	checksums, err := t.regenerateTemplateMetadata(cfg)
+	if err != nil {
+		finalizationErr = errors.Join(finalizationErr, fmt.Errorf("regenerate template metadata: %w", err))
+	}
+
+	if finalizationErr != nil {
+		return nil, finalizationErr
+	}
+
+	if err := commitTemplateVersion(cfg, version); err != nil {
+		return nil, errkit.Wrap(err, "failed to update templates version")
+	}
+
+	return checksums, nil
+}
+
+func (t *TemplateManager) finalizeTemplateWrite(cfg *config.Config, writtenOutputs map[string]string, version string, writeErr error) (map[string]string, error) {
+	if writeErr != nil {
+		if ownershipErr := recordPartialTemplateOwnership(cfg.TemplatesDirectory, writtenOutputs); ownershipErr != nil {
+			writeErr = errors.Join(writeErr, fmt.Errorf("record ownership for partially written templates: %w", ownershipErr))
+		}
+
+		return nil, writeErr
+	}
+
+	return t.finalizeTemplateRelease(cfg, writtenOutputs, version)
+}
+
+func (t *TemplateManager) bootstrapTemplateOwnership(dir, version string, fetchArchive templateArchiveFetcher) error {
+	if _, err := loadTemplateOwnership(dir); err == nil {
+		return nil
+	} else if errors.Is(err, errTemplateOwnershipInvalid) {
+		quarantines, recoveryErr := listTemplateOwnershipQuarantines(dir)
+		if recoveryErr != nil {
+			return errors.Join(err, recoveryErr)
+		}
+
+		restoreStates, recoveryErr := listTemplateOwnershipRestoreStates(dir)
+		if recoveryErr != nil {
+			return errors.Join(err, recoveryErr)
+		}
+
+		if len(quarantines) > 0 || len(restoreStates) > 0 {
+			return err
+		}
+
+		gologger.Verbose().Msgf("Replacing invalid template ownership metadata without retiring prior templates: %s", err)
+
+		return nil
+	} else if !errors.Is(err, errTemplateOwnershipMissing) {
+		return err
+	}
+
+	version = strings.TrimSpace(version)
+	if version == "" {
+		return nil
+	}
+
+	archive, err := fetchArchive(version)
+	if err != nil {
+		gologger.Verbose().Msgf("Continuing template update without prior ownership for %q: %s", version, err)
+		return nil
+	}
+
+	if err := t.bootstrapTemplateOwnershipFromArchive(dir, archive); err != nil {
+		if errors.Is(err, errTemplateOwnershipArchiveInvalid) {
+			gologger.Verbose().Msgf("Continuing template update without prior ownership for %q: %s", version, err)
+			return nil
+		}
+
+		return fmt.Errorf("build ownership from prior template release %q: %w", version, err)
+	}
+
+	return nil
+}
+
+func fetchTemplateReleaseArchive(version string) (*bytes.Reader, error) {
+	ctx := context.Background()
+	httpClient := &http.Client{Timeout: updateutils.DownloadUpdateTimeout}
+	client := github.NewClient(httpClient)
+	archiveURL, _, err := client.Repositories.GetArchiveLink(
+		ctx,
+		updateutils.Organization,
+		config.OfficialNucleiTemplatesRepoName,
+		github.Zipball,
+		&github.RepositoryContentGetOptions{Ref: version},
+		true,
+	)
+	if err != nil {
+		return nil, fmt.Errorf("resolve prior template release %q archive: %w", version, err)
+	}
+
+	request, err := http.NewRequestWithContext(ctx, http.MethodGet, archiveURL.String(), nil)
+	if err != nil {
+		return nil, fmt.Errorf("create prior template release %q archive request: %w", version, err)
+	}
+
+	var contents bytes.Buffer
+	response, err := client.Do(ctx, request, &contents)
+	if err != nil {
+		return nil, fmt.Errorf("download prior template release %q: %w", version, err)
+	}
+	if response.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("download prior template release %q: unexpected HTTP status %s", version, response.Status)
+	}
+
+	return bytes.NewReader(contents.Bytes()), nil
+}
+
+func (t *TemplateManager) bootstrapTemplateOwnershipFromArchive(dir string, archive *bytes.Reader) error {
+	absDir, err := filepath.Abs(dir)
+	if err != nil {
+		return fmt.Errorf("get absolute templates directory: %w", err)
+	}
+
+	manifest := &templateOwnershipManifest{
+		Version: templateOwnershipVersion,
+		Files:   make(map[string]string),
+	}
+
+	callback := func(uri string, fileInfo fs.FileInfo, reader io.Reader) error {
+		if fileInfo.IsDir() {
+			return nil
+		}
+
+		_, writePath := t.getTemplateOutputLocation(absDir, uri, fileInfo)
+		if writePath == "" {
+			return nil
+		}
+
+		if !config.IsTemplate(writePath) {
+			return nil
+		}
+
+		relativePath, err := filepath.Rel(absDir, writePath)
+		if err != nil {
+			return fmt.Errorf("make prior template path %q relative to %q: %w", writePath, absDir, err)
+		}
+
+		relativePath = filepath.ToSlash(relativePath)
+		if !config.IsTemplate(relativePath) {
+			return nil
+		}
+
+		if err := validateTemplateOwnershipPath(relativePath); err != nil {
+			return err
+		}
+
+		contents, err := io.ReadAll(reader)
+		if err != nil {
+			return fmt.Errorf("read prior template %q: %w", uri, err)
+		}
+
+		manifest.Files[relativePath] = templateDigest(contents)
+		return nil
+	}
+
+	if err := updateutils.UnpackAssetWithCallback(updateutils.Zip, archive, callback); err != nil {
+		return fmt.Errorf("%w: unpack prior template release: %v", errTemplateOwnershipArchiveInvalid, err)
+	}
+
+	return writeTemplateOwnership(absDir, manifest)
+}
+
 // updateTemplatesAt updates templates at given directory
 func (t *TemplateManager) updateTemplatesAt(dir string) error {
 	if t.DisablePublicTemplates {
 		gologger.Info().Msgf("Skipping update of public nuclei-templates")
+
 		return nil
 	}
+
+	if err := t.bootstrapTemplateOwnership(dir, config.DefaultConfig.TemplateVersion, fetchTemplateReleaseArchive); err != nil {
+		return errkit.Wrapf(err, "failed to migrate template ownership at %s", dir)
+	}
+
 	// firstly, read checksums from .checksum file these are used to generate stats
 	oldchecksums, err := t.getChecksumFromDir(dir)
 	if err != nil {
@@ -176,49 +387,15 @@ func (t *TemplateManager) updateTemplatesAt(dir string) error {
 	}

 	// write templates to disk
-	writtenPaths, err := t.writeTemplatesToDisk(ghrd, dir)
-	if err != nil {
-		return err
-	}
-
-	// cleanup orphaned templates that exist locally but weren't in the new release
-	if err := t.cleanupOrphanedTemplates(dir, writtenPaths); err != nil {
-		// log warning but don't fail the update
-		gologger.Warning().Msgf("failed to cleanup orphaned templates: %s", err)
-	} else {
-		// Regenerate metadata (index and checksum) after successful cleanup to ensure
-		// metadata accurately reflects the cleaned template tree. This prevents stale
-		// index entries and checksum entries for deleted templates.
-		if err := t.regenerateTemplateMetadata(dir); err != nil {
-			// Log warning but don't fail the update - metadata will be out of sync
-			// but templates are cleaned up correctly
-			gologger.Warning().Msgf("failed to regenerate template metadata after cleanup: %s", err)
-		}
-	}
-
-	// get checksums from new templates
-	newchecksums, err := t.getChecksumFromDir(dir)
-	if err != nil {
-		// unlikely this case will happen
-		return errkit.Wrapf(err, "failed to get checksums from %s after update", dir)
+	writtenOutputs, writeErr := t.writeTemplatesToDisk(ghrd, dir)
+	newchecksums, finalizeErr := t.finalizeTemplateWrite(config.DefaultConfig, writtenOutputs, latestVersion, writeErr)
+	if finalizeErr != nil {
+		return errkit.Wrapf(finalizeErr, "failed to finalize template update at %s", dir)
 	}

 	// summarize all changes
 	results := t.summarizeChanges(oldchecksums, newchecksums)

-	// remove deleted templates
-	for _, deletion := range results.deletions {
-		// the deletion list comes from the on-disk .checksum file; only remove
-		// paths inside the templates directory.
-		if !filepathutil.IsPathWithinDirectory(deletion, dir) {
-			gologger.Warning().Msgf("skipping deletion of %s: path is outside templates directory %s", deletion, dir)
-			continue
-		}
-		if err := os.Remove(deletion); err != nil && !os.IsNotExist(err) {
-			gologger.Warning().Msgf("failed to remove deleted template %s: %s", deletion, err)
-		}
-	}
-
 	// print summary
 	if results.totalCount > 0 {
 		gologger.Info().Msgf("Successfully updated nuclei-templates (%v) to %s. GoodLuck!", ghrd.Latest.GetTagName(), dir)
@@ -230,6 +407,7 @@ func (t *TemplateManager) updateTemplatesAt(dir string) error {
 	} else {
 		gologger.Info().Msgf("Successfully updated nuclei-templates (%v) to %s. GoodLuck!", ghrd.Latest.GetTagName(), dir)
 	}
+
 	return nil
 }

@@ -245,26 +423,30 @@ func (t *TemplateManager) summarizeChanges(old, new map[string]string) *template
 			results.additions = append(results.additions, k)
 		}
 	}
+
 	for k := range old {
 		if _, ok := new[k]; !ok {
 			results.deletions = append(results.deletions, k)
 		}
 	}
+
 	results.totalCount = len(results.additions) + len(results.deletions) + len(results.modifications)
+
 	return results
 }

-// getAbsoluteFilePath returns an absolute path where a file should be written based on given uri(i.e., files in zip)
-// if a returned path is empty, it means that file should not be written and skipped
-func (t *TemplateManager) getAbsoluteFilePath(templateDir, uri string, f fs.FileInfo) string {
+// getTemplateOutputLocation returns the safe root and absolute output path for an archive entry.
+// An empty output path means the entry should be skipped.
+func (t *TemplateManager) getTemplateOutputLocation(templateDir, uri string, f fs.FileInfo) (string, string) {
 	// overwrite .nuclei-ignore every time nuclei-templates are downloaded
 	if f.Name() == config.NucleiIgnoreFileName {
-		return config.DefaultConfig.GetIgnoreFilePath()
+		return config.DefaultConfig.TemplatesDirectory, config.DefaultConfig.GetActiveIgnoreFilePath()
 	}
+
 	// skip all meta files
 	if !strings.EqualFold(f.Name(), config.NewTemplateAdditionsFileName) {
 		if strings.TrimSpace(f.Name()) == "" || strings.HasPrefix(f.Name(), ".") || strings.EqualFold(f.Name(), "README.md") {
-			return ""
+			return "", ""
 		}
 	}

@@ -282,9 +464,9 @@ func (t *TemplateManager) getAbsoluteFilePath(templateDir, uri string, f fs.File
 		// to outside the configured templates directory.
 		fallbackPath := filepath.Clean(filepath.Join(templateDir, uri))
 		if !filepathutil.IsPathWithinDirectory(fallbackPath, templateDir) {
-			return ""
+			return "", ""
 		}
-		return fallbackPath
+		return templateDir, fallbackPath
 	}
 	// separator is also included in rootDir
 	rootDirectory := uri[:index+1]
@@ -292,47 +474,41 @@ func (t *TemplateManager) getAbsoluteFilePath(templateDir, uri string, f fs.File

 	// if it is a github meta directory skip it
 	if stringsutil.HasPrefixAny(relPath, ".github", ".git") {
-		return ""
+		return "", ""
 	}

 	newPath := filepath.Clean(filepath.Join(templateDir, relPath))

 	if !filepathutil.IsPathWithinDirectory(newPath, templateDir) || !filepathutil.IsPathWithinDirectory(filepath.Dir(newPath), templateDir) {
 		// we don't allow LFI
-		return ""
+		return "", ""
 	}

 	if filepath.Clean(newPath) == filepath.Clean(templateDir) {
 		// skip writing the folder itself since it already exists
-		return ""
+		return "", ""
 	}

-	if relPath != "" && f.IsDir() {
-		// if uri is a directory, create it
-		if err := fileutil.CreateFolder(newPath); err != nil {
-			gologger.Warning().Msgf("uri %v: got %s while installing templates", uri, err)
-		}
-		return ""
-	}
-	return newPath
+	return templateDir, newPath
 }

-// writeTemplatesToDisk writes all templates to disk and returns a map of written file paths
-// The returned map contains absolute paths of all template files that were successfully written
-func (t *TemplateManager) writeTemplatesToDisk(ghrd *updateutils.GHReleaseDownloader, dir string) (*mapsutil.SyncLockMap[string, struct{}], error) {
-	localTemplatesIndex, err := config.GetNucleiTemplatesIndex()
-	if err != nil {
-		gologger.Warning().Msgf("failed to get local nuclei-templates index: %s", err)
-		if localTemplatesIndex == nil {
-			localTemplatesIndex = map[string]string{} // no-op
-		}
-	}
+func isActiveIgnoreFilePath(writePath string) bool {
+	return filepath.Clean(writePath) == filepath.Clean(config.DefaultConfig.GetActiveIgnoreFilePath())
+}

-	// Track all paths that are successfully written during this update
-	writtenPaths := mapsutil.NewSyncLockMap[string, struct{}]()
+// writeTemplatesToDisk writes release outputs to disk and returns their digests.
+// The returned map includes every successfully written output; ownership
+// reconciliation filters it to official template paths.
+func (t *TemplateManager) writeTemplatesToDisk(ghrd *updateutils.GHReleaseDownloader, dir string) (map[string]string, error) {
+	writtenOutputs := make(map[string]string)
+	touchedDirectories := make(map[string]struct{})

 	callbackFunc := func(uri string, f fs.FileInfo, r io.Reader) error {
-		writePath := t.getAbsoluteFilePath(dir, uri, f)
+		if f.IsDir() {
+			return nil
+		}
+
+		rootDir, writePath := t.getTemplateOutputLocation(dir, uri, f)
 		if writePath == "" {
 			// skip writing file
 			return nil
@@ -343,69 +519,33 @@ func (t *TemplateManager) writeTemplatesToDisk(ghrd *updateutils.GHReleaseDownlo
 			// if error occurs, iteration also stops
 			return errkit.Wrapf(err, "failed to read file %s", uri)
 		}
-		// TODO: It might be better to just download index file from nuclei templates repo
-		// instead of creating it from scratch
-		id, _ := config.GetTemplateIDFromReader(bytes.NewReader(bin), uri)
-		if id != "" {
-			// based on template id, check if we are updating a path of official nuclei template
-			if oldPath, ok := localTemplatesIndex[id]; ok {
-				if oldPath != writePath {
-					// write new template at a new path and delete old template
-					if err := os.WriteFile(writePath, bin, f.Mode()); err != nil {
-						return errkit.Wrapf(err, "failed to write file %s", uri)
-					}
-					// Track the new path as written
-					_ = writtenPaths.Set(writePath, struct{}{})
-					// after successful write, remove old template. oldPath comes
-					// from the on-disk .templates-index; only remove paths inside
-					// the templates directory.
-					if !filepathutil.IsPathWithinDirectory(oldPath, dir) {
-						gologger.Warning().Msgf("skipping removal of old template %s: path is outside templates directory %s", oldPath, dir)
-					} else if err := os.Remove(oldPath); err != nil {
-						gologger.Warning().Msgf("failed to remove old template %s: %s", oldPath, err)
-					}
-					return nil
-				}
-			}
+
+		outputResult, outputErr := writeTemplateOutput(rootDir, writePath, bin, f.Mode())
+		for _, directory := range outputResult.touchedDirectories {
+			touchedDirectories[directory] = struct{}{}
 		}
-		// no change in template Path of official templates
-		if err := os.WriteFile(writePath, bin, f.Mode()); err != nil {
-			return errkit.Wrapf(err, "failed to write file %s", uri)
+
+		if outputErr != nil {
+			return errkit.Wrapf(outputErr, "failed to write file %s", uri)
 		}
-		// Track successfully written paths
-		_ = writtenPaths.Set(writePath, struct{}{})
+
+		writtenOutputs[writePath] = templateDigest(bin)
+
 		return nil
 	}
-	err = ghrd.DownloadSourceWithCallback(!HideProgressBar, callbackFunc)
-	if err != nil {
-		return nil, errkit.Wrap(err, "failed to download templates")
+
+	var writeErr error
+
+	if err := ghrd.DownloadSourceWithCallback(!HideProgressBar, callbackFunc); err != nil {
+		writeErr = errkit.Wrap(err, "failed to download templates")
 	}

-	if err := config.DefaultConfig.WriteTemplatesConfig(); err != nil {
-		return nil, errkit.Wrap(err, "failed to write templates config")
-	}
-	// update ignore hash after writing new templates
-	if err := config.DefaultConfig.UpdateNucleiIgnoreHash(); err != nil {
-		return nil, errkit.Wrap(err, "failed to update nuclei ignore hash")
+	if err := syncTemplateOutputDirectories(touchedDirectories, syncTemplateOwnershipDirectory); err != nil {
+		writeErr = errors.Join(writeErr, errkit.Wrap(err, "failed to sync template output directories"))
 	}

-	// update templates version in config file
-	if err := config.DefaultConfig.SetTemplatesVersion(ghrd.Latest.GetTagName()); err != nil {
-		return nil, errkit.Wrap(err, "failed to update templates version")
-	}
-
-	PurgeEmptyDirectories(dir)
-
-	// generate index of all templates
-	_ = os.Remove(config.DefaultConfig.GetTemplateIndexFilePath())
-
-	index, err := config.GetNucleiTemplatesIndex()
-	if err != nil {
-		return nil, errkit.Wrap(err, "failed to get nuclei templates index")
-	}
-
-	if err = config.DefaultConfig.WriteTemplatesIndex(index); err != nil {
-		return nil, errkit.Wrap(err, "failed to write nuclei templates index")
+	if writeErr != nil {
+		return writtenOutputs, writeErr
 	}

 	if !HideReleaseNotes {
@@ -415,148 +555,162 @@ func (t *TemplateManager) writeTemplatesToDisk(ghrd *updateutils.GHReleaseDownlo
 		if err != nil {
 			gologger.Error().Msgf("markdown rendering not supported: %v", err)
 		}
+
 		if rendered, err := r.Render(output); err == nil {
 			output = rendered
 		} else {
 			gologger.Error().Msg(err.Error())
 		}
+
 		gologger.Print().Msgf("\n%v\n\n", output)
 	}

-	// after installation, create and write checksums to .checksum file
-	if err := t.writeChecksumFileInDir(dir); err != nil {
-		return nil, err
-	}
-
-	return writtenPaths, nil
+	return writtenOutputs, nil
 }

-// cleanupOrphanedTemplates removes template files that exist locally but were not part of the new release
-// It scans the templates directory for template files and deletes those that are not in the writtenPaths set
-// This function handles empty directories gracefully - if the directory is empty, no orphaned files will be found
-func (t *TemplateManager) cleanupOrphanedTemplates(dir string, writtenPaths *mapsutil.SyncLockMap[string, struct{}]) error {
-	absDir, err := filepath.Abs(dir)
-	if err != nil {
-		return errkit.Wrapf(err, "failed to get absolute path of templates directory")
-	}
-	// Use Clean to normalize the path consistently (handles Windows paths better)
-	absDir = filepath.Clean(absDir)
+func syncTemplateOutputDirectories(directories map[string]struct{}, syncDirectory func(*os.Root, string) error) error {
+	var syncErrors error

-	// If directory doesn't exist, there's nothing to clean up
-	if !fileutil.FolderExists(absDir) {
-		return nil
-	}
-
-	// Normalize all written paths to absolute paths for comparison
-	normalizedWrittenPaths := mapsutil.NewSyncLockMap[string, struct{}]()
-	for path := range writtenPaths.GetAll() {
-		absPath, err := filepath.Abs(path)
-		if err == nil {
-			// Use Clean to normalize the path consistently (handles Windows paths better)
-			absPath = filepath.Clean(absPath)
-			_ = normalizedWrittenPaths.Set(absPath, struct{}{})
-		}
-	}
-
-	// Get custom template directories to exclude
-	customDirs := config.DefaultConfig.GetAllCustomTemplateDirs()
-	customDirAbs := make([]string, 0, len(customDirs))
-	for _, customDir := range customDirs {
-		if absCustomDir, err := filepath.Abs(customDir); err == nil {
-			// Use Clean to normalize the path consistently (handles Windows paths better)
-			absCustomDir = filepath.Clean(absCustomDir)
-			customDirAbs = append(customDirAbs, absCustomDir)
-		}
-	}
-
-	var orphanedFiles []string
-
-	// Walk the templates directory to find all template files
-	err = filepath.WalkDir(absDir, func(path string, d fs.DirEntry, err error) error {
+	for directory := range directories {
+		root, err := os.OpenRoot(directory)
 		if err != nil {
-			// Log but continue walking
-			gologger.Debug().Msgf("error accessing path %s during orphan cleanup: %s", path, err)
-			return nil
+			syncErrors = errors.Join(syncErrors, fmt.Errorf("open output directory %q: %w", directory, err))
+			continue
 		}

-		// Skip directories
-		if d.IsDir() {
-			return nil
+		syncErr := syncDirectory(root, ".")
+		closeErr := root.Close()
+		if syncErr != nil {
+			syncErrors = errors.Join(syncErrors, fmt.Errorf("sync output directory %q: %w", directory, syncErr))
 		}
-
-		absPath, err := filepath.Abs(path)
-		if err != nil {
-			return nil
-		}
-		// Use Clean to normalize the path consistently (handles Windows paths better)
-		absPath = filepath.Clean(absPath)
-
-		// Skip custom template directories
-		if filepathutil.IsPathWithinAnyDirectory(absPath, customDirAbs...) {
-			return nil
-		}
-
-		// Only process template files
-		if !config.IsTemplate(absPath) {
-			return nil
-		}
-
-		// Skip if this file was written in the new release
-		if normalizedWrittenPaths.Has(absPath) {
-			return nil
-		}
-
-		// This is an orphaned template file
-		orphanedFiles = append(orphanedFiles, absPath)
-		return nil
-	})
-
-	if err != nil {
-		return errkit.Wrapf(err, "failed to walk templates directory for orphan cleanup")
-	}
-
-	// Delete orphaned files
-	for _, orphanPath := range orphanedFiles {
-		if err := os.Remove(orphanPath); err != nil {
-			if !os.IsNotExist(err) {
-				gologger.Warning().Msgf("failed to remove orphaned template %s: %s", orphanPath, err)
-			}
-		} else {
-			gologger.Debug().Msgf("removed orphaned template: %s", orphanPath)
+		if closeErr != nil {
+			syncErrors = errors.Join(syncErrors, fmt.Errorf("close output directory %q: %w", directory, closeErr))
 		}
 	}

-	if len(orphanedFiles) > 0 {
-		gologger.Info().Msgf("cleaned up %d orphaned template file(s)", len(orphanedFiles))
-	}
-
-	return nil
+	return syncErrors
 }

-// regenerateTemplateMetadata regenerates template index and checksum files after cleanup operations.
-// This ensures the metadata accurately reflects the current state of template files on disk.
-func (t *TemplateManager) regenerateTemplateMetadata(dir string) error {
-	// Purge empty directories that may have been left after cleanup
+// templateOutputWriteResult records filesystem state that must be finalized
+// even when the associated write returns an error.
+type templateOutputWriteResult struct {
+	touchedDirectories []string
+}
+
+func writeTemplateOutput(rootDir, writePath string, contents []byte, mode fs.FileMode) (templateOutputWriteResult, error) {
+	var result templateOutputWriteResult
+	if isActiveIgnoreFilePath(writePath) {
+		if err := config.DefaultConfig.WriteActiveIgnoreFile(contents); err != nil {
+			return result, err
+		}
+		result.touchedDirectories = append(result.touchedDirectories, filepath.Dir(writePath))
+		return result, nil
+	}
+
+	relativePath, err := filepath.Rel(rootDir, writePath)
+	if err != nil {
+		return result, err
+	}
+
+	if relativePath == ".." || strings.HasPrefix(relativePath, ".."+string(os.PathSeparator)) || filepath.IsAbs(relativePath) {
+		return result, fmt.Errorf("output path %q escapes root %q", writePath, rootDir)
+	}
+
+	root, err := os.OpenRoot(rootDir)
+	if err != nil {
+		return result, fmt.Errorf("open output root %q: %w", rootDir, err)
+	}
+	defer func() { _ = root.Close() }()
+
+	parent := filepath.Dir(relativePath)
+	if parent != "." {
+		parentsToSync, err := createTemplateDirectories(root, parent)
+		for _, parentToSync := range parentsToSync {
+			result.touchedDirectories = append(result.touchedDirectories, filepath.Clean(filepath.Join(rootDir, parentToSync)))
+		}
+		if err != nil {
+			return result, fmt.Errorf("create output parent %q: %w", parent, err)
+		}
+	}
+	result.touchedDirectories = append(result.touchedDirectories, filepath.Dir(writePath))
+
+	randomSuffix := make([]byte, 16)
+	if _, err := rand.Read(randomSuffix); err != nil {
+		return result, fmt.Errorf("generate temporary output name: %w", err)
+	}
+
+	temporaryPath := filepath.Join(parent, fmt.Sprintf("%s%x", templateOutputTemporaryPrefix, randomSuffix))
+	temporaryMode := mode.Perm()
+	preserveMode := false
+
+	if info, err := root.Lstat(relativePath); err == nil && info.Mode().IsRegular() {
+		temporaryMode = 0o600
+		mode = info.Mode()
+		preserveMode = true
+	} else if err != nil && !os.IsNotExist(err) {
+		return result, fmt.Errorf("inspect existing output %q: %w", relativePath, err)
+	}
+
+	temporary, err := root.OpenFile(temporaryPath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, temporaryMode)
+	if err != nil {
+		return result, fmt.Errorf("create temporary output %q: %w", temporaryPath, err)
+	}
+
+	defer func() {
+		_ = temporary.Close()
+		_ = root.Remove(temporaryPath)
+	}()
+
+	if _, err := temporary.Write(contents); err != nil {
+		return result, fmt.Errorf("write temporary output %q: %w", temporaryPath, err)
+	}
+
+	if preserveMode {
+		if err := temporary.Chmod(mode.Perm()); err != nil {
+			return result, fmt.Errorf("preserve output mode %q: %w", temporaryPath, err)
+		}
+	}
+
+	// A release contains thousands of files, so syncing every temporary file
+	// makes installation latency scale with storage flush latency. Closing and
+	// renaming keeps replacement atomic; touched directories are synced once
+	// after extraction and before ownership or version finalization.
+	if err := temporary.Close(); err != nil {
+		return result, fmt.Errorf("close temporary output %q: %w", temporaryPath, err)
+	}
+
+	if err := root.Rename(temporaryPath, relativePath); err != nil {
+		return result, fmt.Errorf("replace output %q: %w", relativePath, err)
+	}
+
+	return result, nil
+}
+
+// regenerateTemplateMetadata rebuilds the index and checksums from the finalized on-disk tree.
+func (t *TemplateManager) regenerateTemplateMetadata(cfg *config.Config) (map[string]string, error) {
+	dir := cfg.TemplatesDirectory
+
+	// Purge empty directories before rebuilding metadata.
 	PurgeEmptyDirectories(dir)

-	// Ensure templates directory exists (it may have been purged if empty)
+	// Ensure the templates directory exists if the finalized tree is empty.
 	if !fileutil.FolderExists(dir) {
 		if err := os.MkdirAll(dir, 0755); err != nil {
-			return errkit.Wrapf(err, "failed to recreate templates directory %s after purge", dir)
+			return nil, errkit.Wrapf(err, "failed to recreate templates directory %s after purge", dir)
 		}
 	}

 	// Remove old index file and regenerate it from current templates on disk
-	indexFilePath := config.DefaultConfig.GetTemplateIndexFilePath()
+	indexFilePath := cfg.GetTemplateIndexFilePath()
 	if err := os.Remove(indexFilePath); err != nil && !os.IsNotExist(err) {
-		return errkit.Wrapf(err, "failed to remove old index file %s", indexFilePath)
+		return nil, errkit.Wrapf(err, "failed to remove old index file %s", indexFilePath)
 	}

 	// Force regeneration by ensuring the file doesn't exist (handles Windows file handle issues)
 	// GetNucleiTemplatesIndex will scan the directory if the file doesn't exist
 	index, err := config.GetNucleiTemplatesIndex()
 	if err != nil {
-		return errkit.Wrap(err, "failed to regenerate nuclei templates index after cleanup")
+		return nil, errkit.Wrap(err, "failed to regenerate nuclei templates index")
 	}

 	// Filter out any entries that don't actually exist on disk (Windows file deletion timing issues)
@@ -567,16 +721,20 @@ func (t *TemplateManager) regenerateTemplateMetadata(dir string) error {
 		}
 	}

-	if err = config.DefaultConfig.WriteTemplatesIndex(filteredIndex); err != nil {
-		return errkit.Wrap(err, "failed to write nuclei templates index after cleanup")
+	if err = cfg.WriteTemplatesIndex(filteredIndex); err != nil {
+		return nil, errkit.Wrap(err, "failed to write regenerated nuclei templates index")
 	}

-	// Regenerate checksum file to reflect current templates on disk
-	if err := t.writeChecksumFileInDir(dir); err != nil {
-		return errkit.Wrap(err, "failed to regenerate checksum file after cleanup")
+	checksumMap, err := t.calculateChecksumMap(dir)
+	if err != nil {
+		return nil, errkit.Wrap(err, "failed to regenerate checksum map")
 	}

-	return nil
+	if err := writeChecksumMap(cfg, checksumMap); err != nil {
+		return nil, errkit.Wrap(err, "failed to write regenerated checksum file")
+	}
+
+	return checksumMap, nil
 }

 // getChecksumFromDir returns a map containing checksums (md5 hash) of all yaml files (with .yaml extension)
@@ -595,29 +753,51 @@ func (t *TemplateManager) getChecksumFromDir(dir string) (map[string]string, err
 				if len(tmparr) != 2 {
 					continue
 				}
+
 				allChecksums[tmparr[0]] = tmparr[1]
 			}
+
 			return allChecksums, nil
 		}
 	}
+
 	return t.calculateChecksumMap(dir)
 }

-// writeChecksumFileInDir creates checksums of all yaml files in given directory
-// and writes them to a file named .checksum
+// writeChecksumFileInDir creates checksums of all YAML files in dir and writes
+// them to the configured checksum file.
 func (t *TemplateManager) writeChecksumFileInDir(dir string) error {
 	checksumMap, err := t.calculateChecksumMap(dir)
 	if err != nil {
 		return err
 	}
+
+	return writeChecksumMap(config.DefaultConfig, checksumMap)
+}
+
+func writeChecksumMap(cfg *config.Config, checksumMap map[string]string) error {
 	var buff bytes.Buffer
+
 	for k, v := range checksumMap {
 		buff.WriteString(k)
 		buff.WriteString(",")
 		buff.WriteString(v)
 		buff.WriteString(";")
 	}
-	return os.WriteFile(config.DefaultConfig.GetChecksumFilePath(), buff.Bytes(), checkSumFilePerm)
+
+	return os.WriteFile(cfg.GetChecksumFilePath(), buff.Bytes(), checkSumFilePerm)
+}
+
+func isTemplateOutputTemporary(name string) bool {
+	suffix, found := strings.CutPrefix(name, templateOutputTemporaryPrefix)
+	if !found {
+		return false
+	}
+	if isLowerHex(suffix, 32) {
+		return true
+	}
+	pathDigest, token, found := strings.Cut(suffix, "-")
+	return found && isLowerHex(pathDigest, 32) && isLowerHex(token, 32)
 }

 // getChecksumMap returns a map containing checksums (md5 hash) of all yaml files (with .yaml extension)
@@ -633,6 +813,7 @@ func (t *TemplateManager) calculateChecksumMap(dir string) (map[string]string, e
 		if err != nil {
 			return "", err
 		}
+
 		return fmt.Sprintf("%x", md5.Sum(bin)), nil
 	}

@@ -640,6 +821,18 @@ func (t *TemplateManager) calculateChecksumMap(dir string) (map[string]string, e
 		if err != nil {
 			return err
 		}
+
+		if !d.IsDir() && isTemplateOutputTemporary(filepath.Base(path)) {
+			return nil
+		}
+
+		if filepath.Dir(path) == filepath.Clean(dir) {
+			name := filepath.Base(path)
+			if name == templateOwnershipFileName || strings.HasPrefix(name, templateOwnershipTemporaryPrefix) || strings.HasPrefix(name, templateOwnershipRetiredPrefix) || strings.HasPrefix(name, templateOwnershipRestorePrefix) {
+				return nil
+			}
+		}
+
 		// skip checksums of custom templates i.e github and s3
 		if filepathutil.IsPathWithinAnyDirectory(path, config.DefaultConfig.GetAllCustomTemplateDirs()...) {
 			return nil
@@ -651,9 +844,12 @@ func (t *TemplateManager) calculateChecksumMap(dir string) (map[string]string, e
 			if err != nil {
 				return err
 			}
+
 			checksumMap[path] = checksum
 		}
+
 		return nil
 	})
+
 	return checksumMap, errkit.Wrap(err, "failed to calculate checksums of templates")
 }
@@ -0,0 +1,42 @@
+//go:build !windows
+
+package installer
+
+import (
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestWriteTemplateOutputHonorsUmask(t *testing.T) {
+	previousUmask := syscall.Umask(0o077)
+	t.Cleanup(func() { syscall.Umask(previousUmask) })
+
+	outputPath := filepath.Join(t.TempDir(), "official.yaml")
+	_, err := writeTemplateOutput(filepath.Dir(outputPath), outputPath, []byte("release"), 0o666)
+	require.NoError(t, err)
+	info, err := os.Stat(outputPath)
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+}
+
+func TestCopyQuarantinedTemplatePreservesMode(t *testing.T) {
+	templatesDir := t.TempDir()
+	quarantinePath := templateOwnershipRetiredPrefix + "mode"
+	require.NoError(t, os.WriteFile(filepath.Join(templatesDir, quarantinePath), []byte("modified"), 0o644))
+
+	previousUmask := syscall.Umask(0o077)
+	t.Cleanup(func() { syscall.Umask(previousUmask) })
+
+	root, err := os.OpenRoot(templatesDir)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, root.Close()) })
+
+	require.NoError(t, copyQuarantinedTemplate(root, "retired.yaml", quarantinePath))
+	info, err := root.Stat("retired.yaml")
+	require.NoError(t, err)
+	require.Equal(t, os.FileMode(0o644), info.Mode().Perm())
+}
@@ -0,0 +1,42 @@
+//go:build darwin
+
+package installer
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"golang.org/x/sys/unix"
+)
+
+func renameTemplateRestoreNoReplace(root *os.Root, temporaryPath, retiredPath string) error {
+	sourceDirectory, err := root.Open(filepath.Dir(temporaryPath))
+	if err != nil {
+		return err
+	}
+	defer func() { _ = sourceDirectory.Close() }()
+
+	destinationDirectory, err := root.Open(filepath.Dir(retiredPath))
+	if err != nil {
+		return err
+	}
+	defer func() { _ = destinationDirectory.Close() }()
+
+	err = unix.RenameatxNp(int(sourceDirectory.Fd()), filepath.Base(temporaryPath), int(destinationDirectory.Fd()), filepath.Base(retiredPath), unix.RENAME_EXCL)
+	return mapRenameNoReplaceError(err)
+}
+
+func mapRenameNoReplaceError(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	switch {
+	case errors.Is(err, unix.ENOTSUP), errors.Is(err, unix.ENOSYS), errors.Is(err, unix.EINVAL):
+		return fmt.Errorf("%w: %w", errors.ErrUnsupported, err)
+	default:
+		return err
+	}
+}