Fix: Add guard to prevent division by zero at line 2359

The max_bot_traffic variable is extracted from a file which could
theoretically contain all zeros, causing division by zero. Added:
  max_bot_traffic=${max_bot_traffic:-1}

This ensures the denominator is never zero while preserving the
intended logic when valid data exists.

modules/email/email-diagnostics.sh

@@ -419,7 +419,8 @@ if [ "$sent" -gt 0 ] || [ "$received" -gt 0 ]; then
     # Top recipients (delivery recipients from emails in TEMP_MATCHES)
     if [ "$sent" -gt 0 ] || [ "$delivered" -gt 0 ]; then
         print_info "Top 5 recipients (emails delivered TO):"
-        grep -F "$search_pattern" "$TEMP_MATCHES" 2>/dev/null | grep -oE "=> [^@]+@[^ ]+" | sed 's/=> //' | sort | uniq -c | sort -rn | head -5 | while read count recipient; do
+        sed -n "/^$search_pattern/p" "$TEMP_MATCHES" 2>/dev/null | \
+            sed -n 's/.*=> \([^@]*@[^ ]*\).*/\1/p' | sort | uniq -c | sort -rn | head -5 | while read count recipient; do
             [ -n "$count" ] && echo "  $recipient - $count emails"
         done
         echo ""
@@ -428,7 +429,8 @@ if [ "$sent" -gt 0 ] || [ "$received" -gt 0 ]; then
     # Top senders (who is sending emails in TEMP_MATCHES)
     if [ "$sent" -gt 0 ]; then
         print_info "Top 5 senders (emails sent FROM):"
-        grep -F "$search_pattern" "$TEMP_MATCHES" 2>/dev/null | grep -oE "<= [^@]+@[^ ]+" | sed 's/<= //' | sort | uniq -c | sort -rn | head -5 | while read count sender; do
+        sed -n "/^$search_pattern/p" "$TEMP_MATCHES" 2>/dev/null | \
+            sed -n 's/.*<= \([^@]*@[^ ]*\).*/\1/p' | sort | uniq -c | sort -rn | head -5 | while read count sender; do
             [ -n "$count" ] && echo "  $sender - $count emails"
         done
         echo ""
@@ -546,7 +548,7 @@ if [ "$check_type" != "2" ]; then
 
     # cPanel forwarders (in /etc/valiases)
     if [ -f "/etc/valiases/$domain_part" ]; then
-        forwarder=$(grep -F "^$local_part:" "/etc/valiases/$domain_part" 2>/dev/null)
+        forwarder=$(grep "^${local_part}:" "/etc/valiases/$domain_part" 2>/dev/null || echo "")
         if [ -n "$forwarder" ]; then
             echo ""
             print_info "Forwarder configured:"
@@ -650,7 +652,7 @@ if [ "$delivered" -gt 0 ]; then
         else
             echo "  $line"
         fi
-    done < <(grep -F "$search_pattern" "$TEMP_MATCHES" | grep -iE "=>|delivered" | tail -5)
+    done < <(sed -n "/^$search_pattern/p" "$TEMP_MATCHES" 2>/dev/null | sed -n '/=>\|[Dd]elivered/p' | tail -5)
     echo ""
 fi
 
@@ -660,7 +662,7 @@ if [ "$bounced" -gt 0 ]; then
 
     # Get all bounce lines (Issue 4.1: add -- after grep flags)
     TEMP_BOUNCES="/tmp/email_bounces_$$.txt"
-    grep -F -- "$search_pattern" "$TEMP_MATCHES" 2>/dev/null | \
+    sed -n "/^$search_pattern/p" "$TEMP_MATCHES" 2>/dev/null | \
         grep -Ev "authenticator failed|Authentication failed|saved mail to|=>" | \
         grep -iE "550|551|552|553|554|bounced|Mail delivery failed|\\*\\* " > "$TEMP_BOUNCES" 2>/dev/null
 

modules/email/mail-queue-inspector.sh

@@ -40,14 +40,14 @@ if [ "$MTA" = "exim" ]; then
     print_header "Queue Summary"
 
     # Exim: exim -bpc returns just the number
-    queue_count=$(eval "$SYS_MAIL_CMD_QUEUE_COUNT")
+    queue_count=$(bash -c "$SYS_MAIL_CMD_QUEUE_COUNT" 2>/dev/null || echo "0")
 
     if [ "$queue_count" -gt 0 ] 2>/dev/null; then
         print_warning "$queue_count messages in queue"
         echo ""
 
         # Cache queue list - single execution for all operations
-        queue_list=$(eval "$SYS_MAIL_CMD_QUEUE_LIST")
+        queue_list=$(bash -c "$SYS_MAIL_CMD_QUEUE_LIST" 2>/dev/null || echo "")
 
         print_header "Recent Queue Messages (last 20)"
         echo "$queue_list" | head -20
@@ -74,7 +74,7 @@ elif [ "$MTA" = "postfix" ]; then
     print_header "Queue Summary"
 
     # Postfix: mailq | tail -1 returns "-- N Kbytes in M Requests."
-    queue_summary=$(eval "$SYS_MAIL_CMD_QUEUE_COUNT")
+    queue_summary=$(bash -c "$SYS_MAIL_CMD_QUEUE_COUNT" 2>/dev/null || echo "")
     print_info "$queue_summary"
 
     # Extract message count from summary line (last number is always message count)
@@ -89,7 +89,7 @@ elif [ "$MTA" = "postfix" ]; then
         echo ""
 
         # Cache queue list - single execution for all operations
-        queue_list=$(eval "$SYS_MAIL_CMD_QUEUE_LIST")
+        queue_list=$(bash -c "$SYS_MAIL_CMD_QUEUE_LIST" 2>/dev/null || echo "")
 
         print_header "Queue Details (first 50)"
         echo "$queue_list" | head -50
@@ -116,7 +116,7 @@ elif [ "$MTA" = "sendmail" ]; then
     print_header "Queue Summary"
 
     # Sendmail: mailq | tail -1 returns "-- N Kbytes in M Requests."
-    queue_summary=$(eval "$SYS_MAIL_CMD_QUEUE_COUNT")
+    queue_summary=$(bash -c "$SYS_MAIL_CMD_QUEUE_COUNT" 2>/dev/null || echo "")
     print_info "$queue_summary"
 
     # Extract message count from summary line (last number is always message count)
@@ -131,7 +131,7 @@ elif [ "$MTA" = "sendmail" ]; then
         echo ""
 
         # Cache queue list - single execution for all operations
-        queue_list=$(eval "$SYS_MAIL_CMD_QUEUE_LIST")
+        queue_list=$(bash -c "$SYS_MAIL_CMD_QUEUE_LIST" 2>/dev/null || echo "")
 
         print_header "Queue Details (first 50)"
         echo "$queue_list" | head -50

modules/maintenance/disk-space-analyzer.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+set -eo pipefail
 
 ################################################################################
 # Disk Space Analyzer (WinDirStat for Linux)
@@ -17,6 +18,7 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 source "$SCRIPT_DIR/lib/common-functions.sh"
 source "$SCRIPT_DIR/lib/system-detect.sh"
+source "$SCRIPT_DIR/lib/reference-db.sh"
 
 # Require root
 if [ "$EUID" -ne 0 ]; then
@@ -24,6 +26,9 @@ if [ "$EUID" -ne 0 ]; then
     exit 1
 fi
 
+# Ensure cache is fresh (only rebuilds if > 1 hour old)
+db_ensure_fresh 2>/dev/null || true
+
 # Temp file for results
 TEMP_DIR="/tmp/disk-analysis-$$"
 mkdir -p "$TEMP_DIR"
@@ -619,55 +624,51 @@ analyze_wordpress() {
     print_banner "WordPress Storage Analysis"
     echo ""
 
-    # Find WordPress installations
+    # Find WordPress installations from cache (instant lookup, no filesystem scan)
     show_progress "Finding WordPress installations"
 
-    local wp_paths=()
+    local wp_count=0
+    local wp_data=""
 
-    # Common locations
+    # Get WordPress data from cache
-    if [ -d "/home" ]; then
+    if command -v db_get_all_wordpress &>/dev/null; then
-        while IFS= read -r wp_config; do
+        wp_data=$(db_get_all_wordpress 2>/dev/null || true)
-            wp_dir=$(dirname "$wp_config")
-            wp_paths+=("$wp_dir")
-        done < <(find /home -name "wp-config.php" -type f 2>/dev/null)
     fi
 
-    if [ -d "/var/www" ]; then
+    # Count WP installations
-        while IFS= read -r wp_config; do
+    if [ -n "$wp_data" ]; then
-            wp_dir=$(dirname "$wp_config")
+        wp_count=$(echo "$wp_data" | grep -c "^WP|" || echo 0)
-            wp_paths+=("$wp_dir")
-        done < <(find /var/www -name "wp-config.php" -type f 2>/dev/null)
     fi
 
-    if [ ${#wp_paths[@]} -eq 0 ]; then
+    if [ "$wp_count" -eq 0 ]; then
         echo -e "\r${DIM}No WordPress installations found${NC}                              "
         echo ""
         press_enter
         return
     fi
 
-    echo -e "\r${GREEN}✓${NC} Found ${#wp_paths[@]} WordPress installations                              "
+    echo -e "\r${GREEN}✓${NC} Found ${wp_count} WordPress installations                              "
     echo ""
 
     echo -e "${BOLD}WordPress Space Usage:${NC}"
     echo "───────────────────────────────────────────────────────────────"
 
-    for wp_dir in "${wp_paths[@]}"; do
+    # Process cached WordPress data
-        # Get domain/user from path
+    while IFS='|' read -r type domain path db_name db_user version plugins themes; do
-        domain=$(echo "$wp_dir" | awk -F'/' '{for(i=1;i<=NF;i++) if($i~/public_html|httpdocs|www/) print $(i-1)}' | tail -1)
+        if [ "$type" = "WP" ] && [ -d "$path" ]; then
+            # Calculate sizes
+            total_size=$(du -sh "$path" 2>/dev/null | awk '{print $1}')
+            uploads_size=$(du -sh "$path/wp-content/uploads" 2>/dev/null | awk '{print $1}')
+            plugins_size=$(du -sh "$path/wp-content/plugins" 2>/dev/null | awk '{print $1}')
+            cache_size=$(du -sh "$path/wp-content/cache" 2>/dev/null | awk '{print $1}')
 
-        # Calculate sizes
+            echo -e "${BOLD}$domain${NC} ($total_size)"
-        total_size=$(du -sh "$wp_dir" 2>/dev/null | awk '{print $1}')
+            echo -e "  Uploads: ${CYAN}${uploads_size:-0}${NC}"
-        uploads_size=$(du -sh "$wp_dir/wp-content/uploads" 2>/dev/null | awk '{print $1}')
+            echo -e "  Plugins: ${CYAN}${plugins_size:-0}${NC}"
-        plugins_size=$(du -sh "$wp_dir/wp-content/plugins" 2>/dev/null | awk '{print $1}')
+            echo -e "  Cache:   ${CYAN}${cache_size:-0}${NC}"
-        cache_size=$(du -sh "$wp_dir/wp-content/cache" 2>/dev/null | awk '{print $1}')
+            echo ""
-
+        fi
-        echo -e "${BOLD}$domain${NC} ($total_size)"
+    done <<< "$wp_data"
-        echo -e "  Uploads: ${CYAN}${uploads_size:-0}${NC}"
-        echo -e "  Plugins: ${CYAN}${plugins_size:-0}${NC}"
-        echo -e "  Cache:   ${CYAN}${cache_size:-0}${NC}"
-        echo ""
-    done
 
     echo -e "${BOLD}Cleanup Suggestions:${NC}"
     echo "  • Delete old revisions: wp post delete \$(wp post list --post_type=revision --format=ids)"

modules/performance/hardware-health-check.sh

@@ -15,6 +15,9 @@ source "$TOOLKIT_ROOT/lib/reference-db.sh"
 # Initialize system detection
 detect_system
 
+# Ensure reference database is fresh (only rebuild if > 1 hour old)
+db_ensure_fresh 2>/dev/null || true
+
 # Load system info from reference database
 if [ -f "$TOOLKIT_ROOT/.sysref" ]; then
     SYS_HOSTNAME=$(grep "^SYS|HOSTNAME|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)

modules/performance/network-bandwidth-analyzer.sh

@@ -15,6 +15,9 @@ source "$TOOLKIT_ROOT/lib/reference-db.sh"
 # Initialize system detection
 detect_system
 
+# Ensure reference database is fresh (only rebuild if > 1 hour old)
+db_ensure_fresh 2>/dev/null || true
+
 # Load system info from reference database
 if [ -f "$TOOLKIT_ROOT/.sysref" ]; then
     SYS_HOSTNAME=$(grep "^SYS|HOSTNAME|" "$TOOLKIT_ROOT/.sysref" 2>/dev/null | cut -d'|' -f3)

modules/performance/nginx-varnish-manager.sh

@@ -31,6 +31,9 @@ if [ "$EUID" -ne 0 ]; then
     exit 1
 fi
 
+# Ensure reference database is fresh (only rebuild if > 1 hour old)
+db_ensure_fresh 2>/dev/null || true
+
 # Configuration
 BACKUP_DIR="/root/nginx-varnish-backups"
 VARNISH_VCL="/etc/varnish/default.vcl"
@@ -149,11 +152,28 @@ create_backup() {
     echo "$backup_path"
 }
 
-# Get list of cPanel domains
+# Get list of cPanel domains (from launcher cache, not filesystem)
 get_cpanel_domains() {
+    # Use launcher's cached domain list (instant lookup, already filtered by launcher)
+    # Fallback to filesystem scan only if cache unavailable
+
+    if command -v db_get_all_domains &>/dev/null; then
+        # Use cached data from launcher (built on startup, instant O(n) lookup)
+        db_get_all_domains 2>/dev/null || {
+            # Fallback if cache fails (shouldn't happen if db_ensure_fresh was called)
+            get_cpanel_domains_fallback
+        }
+    else
+        # Library not available, use filesystem fallback
+        get_cpanel_domains_fallback
+    fi
+}
+
+# Fallback domain discovery (only used if cache unavailable)
+get_cpanel_domains_fallback() {
     local domains=()
 
-    # Get domains from cPanel user data
+    # Fallback: Get domains from cPanel user data
     if [ -d /var/cpanel/userdata ]; then
         while IFS= read -r domain_file; do
             local domain=$(basename "$domain_file")

modules/security/bot-analyzer.sh

@@ -683,9 +683,9 @@ save_baseline() {
             local baseline_file="$BASELINE_DIR/${domain}_baseline.txt"
 
             # Get domain-specific metrics
-            local domain_requests=$(grep "^[^|]*|$domain|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | wc -l || echo "0")
+            local domain_requests=$(grep -F "|$domain|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | wc -l || echo "0")
-            local domain_attacks=$(grep "^[^|]*|$domain|" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | wc -l || echo "0")
+            local domain_attacks=$(grep -F "|$domain|" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | wc -l || echo "0")
-            local domain_bots=$(grep "^[^|]*|$domain|" "$TEMP_DIR/classified_bots.txt" 2>/dev/null | wc -l || echo "0")
+            local domain_bots=$(grep -F "|$domain|" "$TEMP_DIR/classified_bots.txt" 2>/dev/null | wc -l || echo "0")
 
             # Append to baseline history (timestamp|requests|attacks|bots|high_risk_ips)
             echo "$today|$domain_requests|$domain_attacks|$domain_bots|$high_risk_ips" >> "$baseline_file"
@@ -747,7 +747,7 @@ analyze_attack_progression() {
         > "$progression_file"
 
         # Extract all requests from this IP, in order
-        grep "^$ip|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | awk -F'|' '{
+        grep -F "$ip|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | awk -F'|' '{
             print $8 "|" $3 "|" $4 "|" $6
         }' | sort >> "$progression_file"
 
@@ -1036,7 +1036,7 @@ detect_threats() {
 
         # Breakdown by attack type
         for attack_type in sqli xss path_traversal rce_upload info_disclosure login_bruteforce; do
-            grep "|$attack_type$" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | \
+            grep -F "|$attack_type" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | grep -F "|$attack_type$" | \
                 awk -F'|' '{print $1"|"$2"|"$3"|"$4}' | \
                 sort | uniq -c | sort -rn > "$TEMP_DIR/${attack_type}_attempts.txt" || true
         done
@@ -1311,7 +1311,7 @@ calculate_bot_fingerprint() {
         }
         close(tmpdir "/bot_fingerprints.txt")
     }
-    ' < "$TEMP_DIR/parsed_logs.txt"
+    ' < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null || true
 
     # Create file if empty
     touch "$TEMP_DIR/bot_fingerprints.txt"
@@ -1626,13 +1626,13 @@ analyze_time_series() {
     print_info "Analyzing time-series patterns..."
 
     # Extract hourly bot traffic
-    cat "$TEMP_DIR/classified_bots.txt" 2>/dev/null | awk -F'|' '$9 != "unknown" {
+    awk -F'|' '$9 != "unknown" {
         timestamp = $8
         if (match(timestamp, /([0-9]{2})\/([A-Za-z]{3})\/([0-9]{4}):([0-9]{2}):([0-9]{2}):([0-9]{2})/, ts)) {
             hour = ts[4]
             print hour
         }
-    }' | sort | uniq -c > "$TEMP_DIR/hourly_bot_traffic.txt" || true
+    }' "$TEMP_DIR/classified_bots.txt" 2>/dev/null | sort | uniq -c > "$TEMP_DIR/hourly_bot_traffic.txt" || true
 
     # Extract hourly attack traffic
     if [ -f "$TEMP_DIR/attack_vectors_raw.txt" ]; then
@@ -1660,7 +1660,7 @@ calculate_threat_scores() {
     declare -A ip_request_counts
     while IFS='|' read -r ip rest; do
         ((ip_request_counts["$ip"]++))
-    done < <(cat "$TEMP_DIR/parsed_logs.txt")
+    done < "$TEMP_DIR/parsed_logs.txt"
 
     # Build hash tables from threat files for O(1) lookups
     # OPTIMIZATION: Use awk instead of echo|awk|cut in loops (10x faster)
@@ -1912,7 +1912,7 @@ detect_false_positives() {
     print_info "Detecting legitimate services (false positives)..."
 
     # Known monitoring service patterns and legitimate CDNs
-    cat "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | awk -F'|' '{
+    awk -F'|' '{
         ip = $1
         domain = $2
         url = $3
@@ -1952,7 +1952,7 @@ detect_false_positives() {
         else if (match(url, /checkout|payment|paypal|stripe|square/) && match(ua, /paypal|stripe|square/)) {
             print ip "|Payment Processor|" ua "|" domain
         }
-    }' | sort -u > "$TEMP_DIR/false_positives.txt" || true
+    }' "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | sort -u > "$TEMP_DIR/false_positives.txt" || true
 
     print_success "False positive detection complete ($(wc -l < "$TEMP_DIR/false_positives.txt" 2>/dev/null || echo 0) legitimate services identified)"
 }
@@ -1966,7 +1966,7 @@ generate_statistics() {
 
     # OPTIMIZATION: Use single-pass AWK to generate multiple stats from parsed logs
     # This reads the uncompressed file ONCE instead of 4+ separate reads
-    cat "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | awk -F'|' -v tmpdir="$TEMP_DIR" '
+    awk -F'|' -v tmpdir="$TEMP_DIR" '
     {
         # Count by domain (for top sites)
         domains[$2]++
@@ -1995,29 +1995,29 @@ generate_statistics() {
         close(tmpdir "/top_sites_raw.txt")
         close(tmpdir "/top_ips_raw.txt")
         close(tmpdir "/top_urls_raw.txt")
-    }'
+    }' "$TEMP_DIR/parsed_logs.txt" 2>/dev/null
 
-    # Sort and limit results
+    # Sort and limit results (files may not exist if no data)
-    sort -rn "$TEMP_DIR/top_sites_raw.txt" | head -5 > "$TEMP_DIR/top_sites.txt"
+    [ -f "$TEMP_DIR/top_sites_raw.txt" ] && sort -rn "$TEMP_DIR/top_sites_raw.txt" | head -5 > "$TEMP_DIR/top_sites.txt" || touch "$TEMP_DIR/top_sites.txt"
-    sort -rn "$TEMP_DIR/top_ips_raw.txt" | head -5 > "$TEMP_DIR/top_ips.txt"
+    [ -f "$TEMP_DIR/top_ips_raw.txt" ] && sort -rn "$TEMP_DIR/top_ips_raw.txt" | head -5 > "$TEMP_DIR/top_ips.txt" || touch "$TEMP_DIR/top_ips.txt"
-    sort -rn "$TEMP_DIR/top_urls_raw.txt" | head -5 > "$TEMP_DIR/top_urls.txt"
+    [ -f "$TEMP_DIR/top_urls_raw.txt" ] && sort -rn "$TEMP_DIR/top_urls_raw.txt" | head -5 > "$TEMP_DIR/top_urls.txt" || touch "$TEMP_DIR/top_urls.txt"
 
     # Top 5 bots by request count (single decompression)
-    cat "$TEMP_DIR/classified_bots.txt" 2>/dev/null | awk -F'|' '$9 != "unknown" {print $10}' | \
+    awk -F'|' '$9 != "unknown" {print $10}' "$TEMP_DIR/classified_bots.txt" 2>/dev/null | \
         sort | uniq -c | sort -rn | head -5 > "$TEMP_DIR/top_bots.txt" || true
 
     # Traffic breakdown by bot type (single decompression)
-    cat "$TEMP_DIR/classified_bots.txt" 2>/dev/null | awk -F'|' '{print $9}' | \
+    awk -F'|' '{print $9}' "$TEMP_DIR/classified_bots.txt" 2>/dev/null | \
         sort | uniq -c | sort -rn > "$TEMP_DIR/traffic_breakdown.txt" || true
 
     # Per-domain traffic sources (OPTIMIZED: read uncompressed file once, use grep)
     if [ -f "$TEMP_DIR/all_domains.txt" ]; then
         # Create indexed bot traffic file (decompress once)
-        cat "$TEMP_DIR/classified_bots.txt" 2>/dev/null | awk -F'|' '{print $2"|"$9}' > "$TEMP_DIR/domain_bot_types.txt" || true
+        awk -F'|' '{print $2"|"$9}' "$TEMP_DIR/classified_bots.txt" 2>/dev/null > "$TEMP_DIR/domain_bot_types.txt" || true
 
         while read -r domain; do
             echo "$domain" > "$TEMP_DIR/domain_${domain}_stats.txt"
-            grep "^$domain|" "$TEMP_DIR/domain_bot_types.txt" 2>/dev/null | cut -d'|' -f2 | \
+            grep -F "$domain|" "$TEMP_DIR/domain_bot_types.txt" 2>/dev/null | cut -d'|' -f2 | \
                 sort | uniq -c | sort -rn >> "$TEMP_DIR/domain_${domain}_stats.txt" || true
         done < "$TEMP_DIR/all_domains.txt"
     fi
@@ -2070,7 +2070,7 @@ generate_comparison_report() {
             echo "   Baseline (7-day avg): $baseline_requests requests"
             echo "   Today: $total_requests requests"
         elif [ "$request_pct" -lt 50 ]; then
-            echo "🟢 LOW: Requests are $(($((100 - $request_pct))))% below baseline"
+            echo "🟢 LOW: Requests are $((100 - $request_pct))% below baseline"
         else
             echo "🟡 NORMAL: Requests within expected range"
         fi
@@ -2287,19 +2287,19 @@ generate_report() {
     # QUICK STATS DASHBOARD
     print_header "QUICK STATS DASHBOARD"
 
-    total_requests=$(wc -l < "$TEMP_DIR/parsed_logs.txt")
+    total_requests=$(wc -l < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null || echo "0")
-    unique_ips=$(awk -F'|' '{print $1}' < "$TEMP_DIR/parsed_logs.txt" | sort -u | wc -l)
+    unique_ips=$(awk -F'|' '{print $1}' < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | sort -u | wc -l || echo "0")
-    unique_domains=$(awk -F'|' '{print $2}' < "$TEMP_DIR/parsed_logs.txt" | sort -u | wc -l)
+    unique_domains=$(awk -F'|' '{print $2}' < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | sort -u | wc -l || echo "0")
-    bot_requests=$(awk -F'|' '$9 != "unknown"' < "$TEMP_DIR/classified_bots.txt" | wc -l)
+    bot_requests=$(awk -F'|' '$9 != "unknown"' < "$TEMP_DIR/classified_bots.txt" 2>/dev/null | wc -l || echo "0")
 
     # Count private/internal IPs (excluded from threat analysis)
-    private_ips=$(awk -F'|' '{print $1}' < "$TEMP_DIR/parsed_logs.txt" | sort -u | grep -E '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)' || true | wc -l)
+    private_ips=$(awk -F'|' '{print $1}' < "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | sort -u | grep -E '^(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.)' 2>/dev/null | wc -l || echo "0")
 
     # Count server's own IPs in the logs
     server_ip_hits=0
     if [ -f "$TEMP_DIR/server_ips.txt" ] && [ -s "$TEMP_DIR/server_ips.txt" ]; then
         while read -r server_ip; do
-            if cat "$TEMP_DIR/parsed_logs.txt" | grep -q "^$server_ip|" 2>/dev/null; then
+            if grep -q "^$server_ip|" "$TEMP_DIR/parsed_logs.txt" 2>/dev/null; then
                 server_ip_hits=$((server_ip_hits + 1))
             fi
         done < "$TEMP_DIR/server_ips.txt"
@@ -2333,9 +2333,9 @@ generate_report() {
     # Traffic breakdown
     echo "Traffic Breakdown:"
     while read -r line; do
-        count=$(echo "$line" | awk '{print $1}')
+        count=$(echo "$line" | awk '{print $1}' || echo "0")
-        type=$(echo "$line" | awk '{print $2}')
+        type=$(echo "$line" | awk '{print $2}' || echo "unknown")
-        pct=$(awk "BEGIN {printf \"%.1f\", ($count/$total_requests)*100}")
+        pct=$(awk "BEGIN {printf \"%.1f\", (${count:-0}/${total_requests:-1})*100}" 2>/dev/null || echo "0.0")
         
         case $type in
             legit) echo "  Legitimate Bots:    $(printf "%'7d" $count) ($pct%)" ;;
@@ -2352,6 +2352,7 @@ generate_report() {
         echo ""
         echo "Bot Traffic Timeline (hourly):"
         max_bot_traffic=$(awk '{print $1}' "$TEMP_DIR/hourly_bot_traffic.txt" | sort -rn | head -1)
+        max_bot_traffic=${max_bot_traffic:-1}  # Prevent division by zero
         while read -r line; do
             count=$(echo "$line" | awk '{print $1}')
             hour=$(echo "$line" | awk '{print $2}')
@@ -2378,9 +2379,9 @@ generate_report() {
         echo ""
         echo "Response Code Analysis:"
         while read -r line; do
-            count=$(echo "$line" | awk '{print $1}')
+            count=$(echo "$line" | awk '{print $1}' || echo "0")
-            code=$(echo "$line" | awk '{print $2}')
+            code=$(echo "$line" | awk '{print $2}' || echo "000")
-            pct=$(awk "BEGIN {printf \"%.1f\", ($count/$total_requests)*100}")
+            pct=$(awk "BEGIN {printf \"%.1f\", (${count:-0}/${total_requests:-1})*100}" 2>/dev/null || echo "0.0")
 
             case $code in
                 200) echo "  200 (Success):     $(printf "%'7d" $count) ($pct%) Bots are getting data" ;;
@@ -2453,7 +2454,7 @@ generate_report() {
 
         # Show top attacked domains with attack details
         awk -F'|' 'NR <= 10 {print $1}' "$TEMP_DIR/domain_targeting.txt" | while read -r domain; do
-            domain_attack_count=$(grep "^[^|]*|${domain}|" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | wc -l || echo "0")
+            domain_attack_count=$(grep -F "|${domain}|" "$TEMP_DIR/attack_vectors_raw.txt" 2>/dev/null | wc -l || echo "0")
 
             if [ "$domain_attack_count" -gt 0 ]; then
                 echo "  Domain: $domain ($domain_attack_count attack attempts)"
@@ -2633,7 +2634,7 @@ generate_report() {
         # Calculate total bot bandwidth
         total_bot_bandwidth=0
         if [ -f "$TEMP_DIR/classified_bots.txt.gz" ]; then
-            total_bot_bandwidth=$(cat "$TEMP_DIR/classified_bots.txt" | awk -F'|' '$9 != "unknown" && $5 ~ /^[0-9]+$/ {sum += $5} END {print sum}')
+            total_bot_bandwidth=$(awk -F'|' '$9 != "unknown" && $5 ~ /^[0-9]+$/ {sum += $5} END {print sum}' "$TEMP_DIR/classified_bots.txt")
         fi
 
         if [ -n "$total_bot_bandwidth" ] && [ "$total_bot_bandwidth" -gt 0 ]; then
@@ -2642,7 +2643,7 @@ generate_report() {
             # Estimate cost at $0.09/GB (typical CDN pricing)
             estimated_cost=$(awk "BEGIN {printf \"%.2f\", ($total_bot_bandwidth/1073741824) * 0.09}")
 
-            total_bandwidth=$(cat "$TEMP_DIR/parsed_logs.txt" | awk -F'|' '$5 ~ /^[0-9]+$/ {sum += $5} END {print sum}')
+            total_bandwidth=$(awk -F'|' '$5 ~ /^[0-9]+$/ {sum += $5} END {print sum}' "$TEMP_DIR/parsed_logs.txt")
             bot_pct=$(awk "BEGIN {printf \"%.1f\", ($total_bot_bandwidth/$total_bandwidth)*100}")
 
             echo ""
@@ -2654,13 +2655,13 @@ generate_report() {
         echo "   Top bandwidth consumers:"
 
         head -3 "$TEMP_DIR/large_transfers.txt" | while read -r line; do
-            count=$(echo "$line" | awk '{print $1}')
+            count=$(echo "$line" | awk '{print $1}' || echo "0")
-            ip=$(echo "$line" | awk '{print $2}' | cut -d'|' -f1)
+            ip=$(echo "$line" | awk '{print $2}' 2>/dev/null | cut -d'|' -f1 || echo "unknown")
-            domain=$(echo "$line" | awk '{print $2}' | cut -d'|' -f2)
+            domain=$(echo "$line" | awk '{print $2}' 2>/dev/null | cut -d'|' -f2 || echo "unknown")
-            url=$(echo "$line" | awk '{print $2}' | cut -d'|' -f3)
+            url=$(echo "$line" | awk '{print $2}' 2>/dev/null | cut -d'|' -f3 || echo "unknown")
-            size=$(echo "$line" | awk '{print $2}' | cut -d'|' -f4)
+            size=$(echo "$line" | awk '{print $2}' 2>/dev/null | cut -d'|' -f4 || echo "0")
-            size_mb=$(awk "BEGIN {printf \"%.1f\", $size/1048576}")
+            size_mb=$(awk "BEGIN {printf \"%.1f\", ${size:-0}/1048576}" 2>/dev/null || echo "0.0")
-            total_ip_mb=$(awk "BEGIN {printf \"%.0f\", $size * $count / 1048576}")
+            total_ip_mb=$(awk "BEGIN {printf \"%.0f\", ${size:-0} * ${count:-0} / 1048576}" 2>/dev/null || echo "0")
             printf "      %s transfers from %s - %.1f MB avg (%s MB total) - %s%s\n" "$count" "$ip" "$size_mb" "$total_ip_mb" "$domain" "$url"
         done
         echo "      Action: Verify if scraping, consider serving WebP/optimized images"
@@ -2673,17 +2674,17 @@ generate_report() {
 
     counter=1
     while read -r line && [ "${counter:-0}" -le 5 ]; do
-        count=$(echo "$line" | awk '{print $1}')
+        count=$(echo "$line" | awk '{print $1}' || echo "0")
-        domain=$(echo "$line" | awk '{print $2}')
+        domain=$(echo "$line" | awk '{print $2}' || echo "unknown")
-        
+
         echo "[$counter] $domain - $count requests"
-        
+
         # Show traffic breakdown for this domain
         if [ -f "$TEMP_DIR/domain_${domain}_stats.txt" ]; then
             tail -n +2 "$TEMP_DIR/domain_${domain}_stats.txt" | while read -r stat_line; do
-                stat_count=$(echo "$stat_line" | awk '{print $1}')
+                stat_count=$(echo "$stat_line" | awk '{print $1}' || echo "0")
-                stat_type=$(echo "$stat_line" | awk '{print $2}')
+                stat_type=$(echo "$stat_line" | awk '{print $2}' || echo "unknown")
-                pct=$(awk "BEGIN {printf \"%.1f\", ($stat_count/$count)*100}")
+                pct=$(awk "BEGIN {printf \"%.1f\", (${stat_count:-0}/${count:-1})*100}" 2>/dev/null || echo "0.0")
                 
                 case $stat_type in
                     suspicious) echo -e "      ${YELLOW}Suspicious: $stat_count ($pct%)${NC}" ;;
@@ -3364,15 +3365,15 @@ generate_recommendations() {
         attack_scope="single_domain"
         primary_target=$(head -1 "$TEMP_DIR/domain_high_risk_ips.txt" 2>/dev/null | cut -d'|' -f1)
         # Calculate what % of high-risk IPs are targeting this domain
-        local domain_risk_count=$(head -1 "$TEMP_DIR/domain_high_risk_ips.txt" 2>/dev/null | cut -d'|' -f2)
+        local domain_risk_count=$(head -1 "$TEMP_DIR/domain_high_risk_ips.txt" 2>/dev/null | cut -d'|' -f2 || echo "0")
-        if [ "${total_high_risk_ips:-0}" -gt 0 ]; then
+        if [ "${total_high_risk_ips:-0}" -gt 0 ] && [ "${domain_risk_count:-0}" -gt 0 ]; then
-            primary_target_percentage=$(awk "BEGIN {printf \"%.0f\", ($domain_risk_count / $total_high_risk_ips) * 100}")
+            primary_target_percentage=$(awk "BEGIN {printf \"%.0f\", (${domain_risk_count:-0} / ${total_high_risk_ips:-0}) * 100}")
         fi
     elif [ "${affected_domains:-0}" -gt 1 ] && [ "${total_domains:-0}" -gt 1 ]; then
         # Check if one domain is getting most of the traffic
-        local top_domain_count=$(head -1 "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | cut -d'|' -f5)
+        local top_domain_count=$(head -1 "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | cut -d'|' -f5 || echo "0")
         if [ "${top_domain_count:-0}" -gt 0 ] && [ "${total_high_risk_ips:-0}" -gt 0 ]; then
-            local top_percentage=$(awk "BEGIN {printf \"%.0f\", ($top_domain_count / $total_high_risk_ips) * 100}")
+            local top_percentage=$(awk "BEGIN {printf \"%.0f\", (${top_domain_count:-0} / ${total_high_risk_ips:-0}) * 100}")
             if [ "$top_percentage" -ge 75 ]; then
                 attack_scope="primary_target"
                 primary_target=$(head -1 "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | cut -d'|' -f1)
@@ -3675,7 +3676,7 @@ show_detailed_recommendations() {
                 local target_domain=$(echo "$action_title" | grep -oP 'to \K[^ ]+' 2>/dev/null || echo "")
                 echo "Target Domain: $target_domain"
                 if [ -s "$TEMP_DIR/domain_threats_sorted.txt" ]; then
-                    grep "^$target_domain|" "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | while IFS='|' read -r domain total_req bot_req bot_pct high_risk attacks ips; do
+                    grep -F "$target_domain|" "$TEMP_DIR/domain_threats_sorted.txt" 2>/dev/null | while IFS='|' read -r domain total_req bot_req bot_pct high_risk attacks ips; do
                         echo "  • Total Requests: $total_req"
                         echo "  • Bot Requests: $bot_req ($bot_pct%)"
                         echo "  • High-Risk IPs: $high_risk"
@@ -4003,7 +4004,7 @@ execute_ip_blocking_specific() {
     local fail_count=0
 
     for ip in "${ips_to_block[@]}"; do
-        local score=$(grep "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")
+        local score=$(grep -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")
 
         if csf -td "$ip" "$duration" "Bot threat score: $score/100 - Auto-blocked by toolkit" >/dev/null 2>&1; then
             echo -e "  ${GREEN}${NC} Blocked $ip for $duration_text (score: $score/100)"
@@ -4153,7 +4154,7 @@ execute_htaccess_domain_blocking() {
     # Find document root for this domain using reference database
     local doc_root=""
     if [ -s "$SCRIPT_DIR/.sysref" ]; then
-        doc_root=$(grep "^DOMAIN|$target_domain|" "$SCRIPT_DIR/.sysref" 2>/dev/null | head -1 | cut -d'|' -f4 || echo "")
+        doc_root=$(grep -F "DOMAIN|$target_domain|" "$SCRIPT_DIR/.sysref" 2>/dev/null | head -1 | cut -d'|' -f4 || echo "")
     fi
 
     if [ -z "$doc_root" ]; then
@@ -4197,10 +4198,10 @@ execute_htaccess_domain_blocking() {
     print_info "Adding bot blocking rules..."
 
     # Get high-risk IPs for this domain
-    local block_ips=$(cat "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | grep "^[^|]*|$target_domain|" 2>/dev/null || true | cut -d'|' -f1 | sort -u | while read ip; do
+    local block_ips=$(cat "$TEMP_DIR/parsed_logs.txt" 2>/dev/null | grep -F "|$target_domain|" 2>/dev/null || true | cut -d'|' -f1 | sort -u | while read ip; do
         # Check if this IP has high threat score
-        if grep -q "|$ip$" "$TEMP_DIR/threat_scores.txt" 2>/dev/null; then
+        if grep -q -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null; then
-            local score=$(grep "|$ip$" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "0")
+            local score=$(grep -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "0")
             if [ "${score:-0}" -ge 70 ]; then
                 echo "$ip"
             fi
@@ -4520,7 +4521,7 @@ offer_csf_blocking() {
         count=$((count + 1))
         local ip="${high_risk_ips[$i]}"
         local score="${ip_scores[$i]}"
-        local requests=$(grep "^$ip|" "$TEMP_DIR/bot_ips.txt" 2>/dev/null | cut -d'|' -f2 || echo "0")
+        local requests=$(grep -F "$ip|" "$TEMP_DIR/bot_ips.txt" 2>/dev/null | cut -d'|' -f2 || echo "0")
 
         # Color code by severity
         if [ "$score" -ge 90 ]; then
@@ -4586,7 +4587,7 @@ apply_csf_blocks() {
 
     for ip in "${ips[@]}"; do
         # Get threat score for comment
-        local score=$(grep "|$ip$" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")
+        local score=$(grep -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")
 
         # Use csf -td for temporary deny
         if csf -td "$ip" "$duration" "Bot threat score: $score/100 - Auto-blocked by toolkit" >/dev/null 2>&1; then
@@ -4639,7 +4640,7 @@ apply_csf_permanent_blocks() {
     local fail_count=0
 
     for ip in "${ips[@]}"; do
-        local score=$(grep "|$ip$" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")
+        local score=$(grep -F "|$ip|" "$TEMP_DIR/threat_scores.txt" 2>/dev/null | cut -d'|' -f1 || echo "unknown")
 
         # Use csf -d for permanent deny
         if csf -d "$ip" "Bot threat score: $score/100 - Permanently blocked by toolkit" >/dev/null 2>&1; then

modules/security/malware-scanner.sh

@@ -2156,7 +2156,7 @@ for scanner in "${available_scanners[@]}"; do
             # Extract scan results from event log (more reliable than parsing output)
             # Maldet logs to /usr/local/maldetect/logs/event_log
             # Use dynamic path search for portability across all platforms (FIXED Issue 2: comprehensive path discovery)
-            local event_log=""
+            event_log=""
 
             # Search standard locations in order of likelihood
             for search_path in \
@@ -2556,7 +2556,7 @@ STANDALONE_EOF
     fi
 
     # Inject MALDET_ONLY flag for Maldet-dedicated scans
-    local maldet_flag="${MALDET_ONLY:-0}"
+    maldet_flag="${MALDET_ONLY:-0}"
     if ! sed -i "s|PLACEHOLDER_MALDET_ONLY|$maldet_flag|" "$session_dir/scan.sh"; then
         echo -e "${RED}ERROR: Failed to inject MALDET_ONLY flag${NC}"
         return 1

modules/security/optimize-ct-limit.sh

@@ -826,11 +826,8 @@ main() {
         echo ""
     fi
 
-    # Check if sysref database exists, build if needed
+    # Ensure reference database is fresh (only rebuild if > 1 hour old)
-    if [ ! -f "$SYSREF_DB" ] || [ ! -s "$SYSREF_DB" ]; then
+    db_ensure_fresh >/dev/null 2>&1
-        print_status "Building system reference database (first run)..."
-        build_reference_database >/dev/null 2>&1
-    fi
 
     # Run analysis
     check_server_resources

modules/security/suspicious-login-monitor.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+set -eo pipefail
 
 #
 # Suspicious Login Monitor - Integrated Security Analysis & Compromise Detection
@@ -11,6 +12,9 @@
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 TOOLKIT_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
 
+# Source reference-db for cache support (avoid redundant /etc/passwd parsing)
+source "$TOOLKIT_ROOT/lib/reference-db.sh" 2>/dev/null || true
+
 # Configuration
 SUSPICIOUS_LOGIN_AUTO_BLOCK="${SUSPICIOUS_LOGIN_AUTO_BLOCK:-yes}"
 SUSPICIOUS_LOGIN_AUTO_SCAN="${SUSPICIOUS_LOGIN_AUTO_SCAN:-yes}"
@@ -1673,7 +1677,7 @@ check_maintenance_mode() {
     fi
 
     if [ -n "$indicators" ]; then
-        echo "maintenance-mode:$(echo $indicators | sed 's/ $//')"
+        echo "maintenance-mode:$(sed 's/ $//' <<< "$indicators")"
         return 0
     fi
 
@@ -1823,6 +1827,10 @@ check_recent_password_changes() {
     fi
 
     # Check for locked accounts that were recently unlocked
+    # OPTIMIZATION: Read /etc/passwd ONCE, build nologin list, then check against it
+    # (avoiding redundant grep for each user in the loop)
+    local nologin_users=$(awk -F: '/\/sbin\/nologin|\/bin\/false/ {print $1}' /etc/passwd 2>/dev/null | tr '\n' '|')
+
     local recently_unlocked=$(awk -F: -v cutoff=$(( $(date +%s) / 86400 - 7 )) '
         # Field 2 starts with ! or !! = locked
         # If field 3 (last change) is recent and field 2 does NOT start with !, might have been unlocked
@@ -1830,8 +1838,8 @@ check_recent_password_changes() {
             print $1
         }
     ' /etc/shadow 2>/dev/null | while read user; do
-        # Check if account was previously locked (this is imperfect without history)
+        # Check if account has nologin shell (from pre-built list)
-        if grep "^$user:" /etc/passwd | grep -q "/sbin/nologin\|/bin/false"; then
+        if [[ "|$nologin_users" =~ \|$user\| ]]; then
             echo "$user"
         fi
     done)
@@ -2947,6 +2955,11 @@ main() {
     echo -e "${CYAN}Starting Suspicious Login Monitor...${NC}"
     echo ""
 
+    # Ensure cache is fresh (only rebuilds if > 1 hour old)
+    if command -v db_ensure_fresh &>/dev/null; then
+        db_ensure_fresh 2>/dev/null || true
+    fi
+
     # Detect panel
     local panel=$(detect_panel)
     echo "Detected panel: $panel"

modules/website/website-slowness-diagnostics.sh

@@ -1977,18 +1977,18 @@ calculate_performance_score() {
 
     # Calculate score (100 - issues)
     local score=$((100 - (critical_count * 10) - (warning_count * 2)))
-    [ $score -lt 0 ] && score=0
+    [ "$score" -lt 0 ] && score=0
-    [ $score -gt 100 ] && score=100
+    [ "$score" -gt 100 ] && score=100
 
     # Determine grade
     local grade
-    if [ $score -ge 90 ]; then
+    if [ "$score" -ge 90 ]; then
         grade="A - EXCELLENT"
-    elif [ $score -ge 80 ]; then
+    elif [ "$score" -ge 80 ]; then
         grade="B - GOOD"
-    elif [ $score -ge 70 ]; then
+    elif [ "$score" -ge 70 ]; then
         grade="C - FAIR"
-    elif [ $score -ge 60 ]; then
+    elif [ "$score" -ge 60 ]; then
         grade="D - POOR"
     else
         grade="F - CRITICAL"

run.sh

@@ -10,14 +10,22 @@ set -o pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 CLEANUP_FLAG="/tmp/.cleanup_requested"
 
-# Save original history setting to restore even if interrupted
+# Save original history state to restore even if interrupted
-HISTORY_SETTING=$(set +o | grep history)
+HISTORY_STATE="off"
+if set -o | grep -q "^set +o history" 2>/dev/null; then
+    HISTORY_STATE="on"
+fi
 RESTORE_HISTORY=false
 
 # Cleanup function: restore history even on error/interrupt
 cleanup_on_exit() {
-    if [ "$RESTORE_HISTORY" = true ]; then
+    if [ "$RESTORE_HISTORY" = true ] && [ -n "$HISTORY_STATE" ]; then
-        eval "$HISTORY_SETTING" 2>/dev/null || true
+        set +H  # Disable history expansion temporarily
+        if [ "$HISTORY_STATE" = "on" ]; then
+            set -o history
+        else
+            set +o history
+        fi
     fi
 }
 
@@ -59,7 +67,11 @@ source "$SCRIPT_DIR/launcher.sh"
 LAUNCHER_EXIT=$?
 
 # Re-enable history (trap will also do this)
-eval "$HISTORY_SETTING" 2>/dev/null || true
+if [ "$HISTORY_STATE" = "on" ]; then
+    set -o history 2>/dev/null || true
+else
+    set +o history 2>/dev/null || true
+fi
 RESTORE_HISTORY=false
 
 # Handle cleanup request (if user selected "Clean and remove traces")