diff --git a/.claude/HISTORY.md b/.claude/HISTORY.md
index 104ceb54..aebef077 100644
--- a/.claude/HISTORY.md
+++ b/.claude/HISTORY.md
@@ -4331,3 +4331,54 @@ git checkout HEAD -- index.html
         Nextcloud, Webmail, Jellyfin, Gitea, Matrix, PeerTube, Streamlit portal, Metablogizer sites
       - HAProxy backend health checks verified (`check` option on all servers)
       - External access requires upstream router port forwarding (82.67.100.75 → 192.168.255.1)
+
+71. **AI Gateway Implementation (2026-03-04)**
+    - **Data Classification Engine:**
+      - 3-tier classification: `LOCAL_ONLY`, `SANITIZED`, `CLOUD_DIRECT`
+      - Pattern detection: IPv4/IPv6, MAC addresses, private keys, credentials
+      - Security tool references (crowdsec, iptables, nftables) auto-classified
+    - **PII Sanitizer:**
+      - IP anonymization (192.168.1.100 → 192.168.1.XXX)
+      - Credential scrubbing (password=secret → password=[REDACTED])
+    - **Provider Routing:**
+      - LocalAI (priority 0, always enabled, local_only)
+      - Mistral EU (priority 1, opt-in, sanitized)
+      - Claude/OpenAI/Gemini/xAI (priority 2+, opt-in, cloud_direct)
+    - **Package:** `secubox-ai-gateway` with `aigatewayctl` CLI
+    - **RPCD Backend:** 11 methods for LuCI integration
+    - **LuCI Frontend:** `luci-app-ai-gateway` with 4 views (Overview, Providers, Classify, Audit)
+    - **Audit Logging:** ANSSI CSPN compliant JSON logs with timestamps
+
+72. **SBOM Pipeline for CRA Annex I Compliance (2026-03-04)**
+    - **Prerequisites Check (`scripts/check-sbom-prereqs.sh`):**
+      - OpenWrt version validation (>= 22.03)
+      - Auto-detect SDK location if not in buildroot
+      - package-metadata.pl CycloneDX support check
+      - Host tools: jq, sha256sum, git, perl
+      - Optional tools: syft, grype, cyclonedx-cli (auto-install)
+      - Kconfig: CONFIG_JSON_CYCLONEDX_SBOM setting
+    - **SBOM Generator (`scripts/sbom-generate.sh`):**
+      - 4 sources: OpenWrt native, SecuBox feed Makefiles, rootfs scan, firmware image
+      - CycloneDX 1.6 primary output
+      - SPDX 2.3 secondary output
+      - SOURCE_DATE_EPOCH for reproducibility
+      - Component merge and deduplication
+    - **Feed Auditor (`scripts/sbom-audit-feed.sh`):**
+      - PKG_HASH and PKG_LICENSE validation
+      - MANIFEST.md generation
+      - Suggested PKG_HASH from dl/ tarballs
+    - **Makefile Targets:**
+      - `make sbom` - Full generation
+      - `make sbom-quick` - No rebuild
+      - `make sbom-validate` - CycloneDX validation
+      - `make sbom-scan` - Grype CVE scan
+      - `make sbom-audit` - Feed audit
+      - `make sbom-prereqs` - Check prerequisites
+    - **GitHub Actions (`.github/workflows/sbom-release.yml`):**
+      - Trigger: tags, workflow_dispatch, weekly schedule (CVE scan)
+      - Jobs: sbom-generate, sbom-publish, sbom-cve-gate
+      - Auto-create security issues for critical CVEs
+    - **Documentation:**
+      - `docs/sbom-pipeline.md` - Architecture, usage, CRA mapping
+      - `SECURITY.md` - CRA Art. 13 §6 compliant disclosure policy
+      - VEX policy reference
diff --git a/.claude/WIP.md b/.claude/WIP.md
index b8f170a7..2b978286 100644
--- a/.claude/WIP.md
+++ b/.claude/WIP.md
@@ -1,6 +1,6 @@
 # Work In Progress (Claude)
 
-_Last updated: 2026-03-03 (Comprehensive Service Audit)_
+_Last updated: 2026-03-04 (SBOM Pipeline + AI Gateway)_
 
 > **Architecture Reference**: SecuBox Fanzine v3 — Les 4 Couches
 
@@ -8,6 +8,32 @@ _Last updated: 2026-03-03 (Comprehensive Service Audit)_
 
 ## Couche 1 — Core Mesh
 
+### Just Completed (2026-03-04)
+
+- **SBOM Pipeline for CRA Annex I Compliance** — DONE (2026-03-04)
+  - `scripts/check-sbom-prereqs.sh` - Prerequisites validation (OpenWrt version, tools, Kconfig)
+  - `scripts/sbom-generate.sh` - Multi-source SBOM generation (OpenWrt, feed, rootfs, firmware)
+  - `scripts/sbom-audit-feed.sh` - PKG_HASH/PKG_LICENSE feed audit with MANIFEST.md output
+  - `Makefile` - SBOM targets (sbom, sbom-quick, sbom-validate, sbom-scan, sbom-audit, sbom-prereqs)
+  - `.github/workflows/sbom-release.yml` - GitHub Actions with CVE gating and auto-security issues
+  - `docs/sbom-pipeline.md` - Full documentation with CRA mapping and ANSSI CSPN guidance
+  - `SECURITY.md` - CRA Art. 13 §6 compliant vulnerability disclosure policy
+
+- **AI Gateway Full-Stack Implementation** — DONE (2026-03-04)
+  - **Backend** (`secubox-ai-gateway`):
+    - 3-tier data classification: LOCAL_ONLY, SANITIZED, CLOUD_DIRECT
+    - PII sanitizer: IP anonymization, credential scrubbing
+    - Provider routing: LocalAI > Mistral EU > Claude > OpenAI > Gemini > xAI
+    - `aigatewayctl` CLI with classify/sanitize/provider/audit commands
+    - RPCD backend with 11 ubus methods
+    - ANSSI CSPN compliant audit logging
+  - **Frontend** (`luci-app-ai-gateway`):
+    - 4 KISS-themed views: Overview, Providers, Classify, Audit
+    - Provider management with API key storage
+    - Interactive classification testing
+    - Audit log viewer with distribution charts
+  - Deployed and tested on router (classification + sanitization working)
+
 ### Recently Completed (2026-02-04/05)
 
 - **MAC Guardian Feed Integration** — DONE (2026-02-05)
diff --git a/.claude/settings.local.json b/.claude/settings.local.json
index bcdee8ff..aec19c6d 100644
--- a/.claude/settings.local.json
+++ b/.claude/settings.local.json
@@ -506,7 +506,12 @@
       "Bash(# Test registration again echo \"\"=== Registration Flows ===\"\" curl -s -X POST \"\"https://matrix.gk2.secubox.in/_matrix/client/v3/register\"\" \\\\ -H \"\"Content-Type: application/json\"\" \\\\ -d ''{}'')",
       "Bash(# Test registration now echo \"\"=== Registration Flows ===\"\" curl -s -X POST \"\"https://matrix.gk2.secubox.in/_matrix/client/v3/register\"\" \\\\ -H \"\"Content-Type: application/json\"\" \\\\ -d ''{}'')",
       "Bash(# Final registration test curl -s -X POST \"\"https://matrix.gk2.secubox.in/_matrix/client/v3/register\"\" \\\\ -H \"\"Content-Type: application/json\"\" \\\\ -d ''{}'')",
-      "WebFetch(domain:pf.gk2.secubox.in)"
+      "WebFetch(domain:pf.gk2.secubox.in)",
+      "Bash(__NEW_LINE_4f688fa65b287613__ echo \"\")",
+      "WebFetch(domain:enhance-app.gk2.secubox.in)",
+      "Bash(openssl dgst:*)",
+      "Bash(# Check the exact field names returned by stats ssh root@192.168.255.1 \"\"ubus call luci.cdn-cache stats\"\")",
+      "Bash(arping:*)"
     ]
   }
 }
diff --git a/.github/workflows/sbom-release.yml b/.github/workflows/sbom-release.yml
new file mode 100644
index 00000000..b4245b70
--- /dev/null
+++ b/.github/workflows/sbom-release.yml
@@ -0,0 +1,261 @@
+name: SBOM Release Pipeline
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to generate SBOM for (e.g., 0.20)'
+        required: true
+        type: string
+  schedule:
+    # Weekly CVE scan on Monday 2 AM UTC
+    - cron: '0 2 * * 1'
+
+env:
+  ARCH: aarch64_cortex-a53
+  SBOM_DIR: dist/sbom
+
+jobs:
+  sbom-generate:
+    name: Generate SBOM
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+      sbom_path: ${{ steps.generate.outputs.sbom_path }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Full history for git describe
+
+      - name: Determine version
+        id: version
+        run: |
+          if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+            VERSION="${{ inputs.version }}"
+          elif [[ "${{ github.ref_type }}" == "tag" ]]; then
+            VERSION="${{ github.ref_name }}"
+            VERSION="${VERSION#v}"  # Strip 'v' prefix
+          else
+            VERSION=$(cat version 2>/dev/null || git describe --tags --always)
+          fi
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}"
+
+      - name: Cache OpenWrt toolchain
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cache/openwrt-toolchain
+            staging_dir
+            build_dir
+          key: openwrt-toolchain-${{ env.ARCH }}-${{ hashFiles('feeds.conf', '.config') }}
+          restore-keys: |
+            openwrt-toolchain-${{ env.ARCH }}-
+
+      - name: Cache SBOM tools
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.local/bin/syft
+            ~/.local/bin/grype
+            ~/.local/bin/cyclonedx-cli
+            ~/.cache/grype
+            ~/.cache/syft
+          key: sbom-tools-v1
+          restore-keys: |
+            sbom-tools-
+
+      - name: Install dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y jq
+
+      - name: Install SBOM tools
+        run: |
+          mkdir -p ~/.local/bin
+          export PATH="$HOME/.local/bin:$PATH"
+
+          # Install syft
+          if [[ ! -x ~/.local/bin/syft ]]; then
+            curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b ~/.local/bin
+          fi
+          syft version
+
+          # Install grype
+          if [[ ! -x ~/.local/bin/grype ]]; then
+            curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b ~/.local/bin
+          fi
+          grype version
+
+          # Install cyclonedx-cli
+          if [[ ! -x ~/.local/bin/cyclonedx-cli ]]; then
+            curl -sSfL -o ~/.local/bin/cyclonedx-cli \
+              https://github.com/CycloneDX/cyclonedx-cli/releases/latest/download/cyclonedx-linux-x64
+            chmod +x ~/.local/bin/cyclonedx-cli
+          fi
+          cyclonedx-cli --version
+
+      - name: Update Grype database
+        if: github.event_name != 'schedule' || success()
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          grype db update || true
+
+      - name: Generate SBOM
+        id: generate
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          export VERSION="${{ steps.version.outputs.version }}"
+          export ARCH="${{ env.ARCH }}"
+
+          chmod +x scripts/sbom-generate.sh
+          ./scripts/sbom-generate.sh --version "$VERSION" --arch "$ARCH"
+
+          echo "sbom_path=${SBOM_DIR}/secubox-${VERSION}.cdx.json" >> $GITHUB_OUTPUT
+
+      - name: Upload SBOM artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: sbom-${{ steps.version.outputs.version }}
+          path: |
+            ${{ env.SBOM_DIR }}/secubox-${{ steps.version.outputs.version }}.*
+            ${{ env.SBOM_DIR }}/checksums.sha256
+            ${{ env.SBOM_DIR }}/sbom-warnings.txt
+          retention-days: 90
+
+  sbom-publish:
+    name: Publish to Release
+    needs: sbom-generate
+    if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download SBOM artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: sbom-${{ needs.sbom-generate.outputs.version }}
+          path: sbom
+
+      - name: Attach to GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            sbom/secubox-${{ needs.sbom-generate.outputs.version }}.cdx.json
+            sbom/secubox-${{ needs.sbom-generate.outputs.version }}.spdx.json
+            sbom/secubox-${{ needs.sbom-generate.outputs.version }}-cve-report.json
+            sbom/secubox-${{ needs.sbom-generate.outputs.version }}-cra-summary.txt
+            sbom/checksums.sha256
+          fail_on_unmatched_files: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  sbom-cve-gate:
+    name: CVE Gate Check
+    needs: sbom-generate
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    # Don't fail the whole workflow on schedule (weekly scan)
+    continue-on-error: ${{ github.event_name == 'schedule' }}
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download SBOM artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: sbom-${{ needs.sbom-generate.outputs.version }}
+          path: sbom
+
+      - name: Check for critical CVEs
+        id: cve-check
+        run: |
+          CVE_REPORT="sbom/secubox-${{ needs.sbom-generate.outputs.version }}-cve-report.json"
+
+          if [[ ! -f "$CVE_REPORT" ]]; then
+            echo "No CVE report found"
+            exit 0
+          fi
+
+          CRITICAL_COUNT=$(jq '[.matches[]? | select(.vulnerability.severity == "Critical")] | length' "$CVE_REPORT" 2>/dev/null || echo 0)
+          HIGH_COUNT=$(jq '[.matches[]? | select(.vulnerability.severity == "High")] | length' "$CVE_REPORT" 2>/dev/null || echo 0)
+
+          echo "critical_count=${CRITICAL_COUNT}" >> $GITHUB_OUTPUT
+          echo "high_count=${HIGH_COUNT}" >> $GITHUB_OUTPUT
+
+          echo "=== CVE Summary ==="
+          echo "Critical: ${CRITICAL_COUNT}"
+          echo "High: ${HIGH_COUNT}"
+
+          if [[ "$CRITICAL_COUNT" -gt 0 ]]; then
+            echo "critical_cves=true" >> $GITHUB_OUTPUT
+            echo "::warning::Found ${CRITICAL_COUNT} CRITICAL CVEs"
+
+            echo "=== Critical CVEs ==="
+            jq -r '.matches[] | select(.vulnerability.severity == "Critical") | "\(.vulnerability.id): \(.artifact.name)@\(.artifact.version)"' "$CVE_REPORT"
+          fi
+
+      - name: Create security issue for critical CVEs
+        if: steps.cve-check.outputs.critical_cves == 'true'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const version = '${{ needs.sbom-generate.outputs.version }}';
+            const criticalCount = '${{ steps.cve-check.outputs.critical_count }}';
+
+            const title = `[Security] ${criticalCount} Critical CVE(s) found in SecuBox ${version}`;
+            const body = `## Automated Security Alert
+
+            The SBOM CVE scan found **${criticalCount} critical vulnerabilities** in SecuBox ${version}.
+
+            ### Action Required
+            1. Review the CVE report attached to the release
+            2. Assess impact and exploitability
+            3. Update affected components or document VEX status
+            4. Update the VEX document if not affected
+
+            ### References
+            - [CVE Report](https://github.com/${{ github.repository }}/releases/download/v${version}/secubox-${version}-cve-report.json)
+            - [CRA Summary](https://github.com/${{ github.repository }}/releases/download/v${version}/secubox-${version}-cra-summary.txt)
+
+            /cc @erdoukki
+            `;
+
+            // Check if issue already exists
+            const { data: issues } = await github.rest.issues.listForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              state: 'open',
+              labels: 'security'
+            });
+
+            const existing = issues.find(i => i.title.includes(version) && i.title.includes('Critical CVE'));
+            if (existing) {
+              console.log(`Issue already exists: #${existing.number}`);
+              return;
+            }
+
+            await github.rest.issues.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              title: title,
+              body: body,
+              labels: ['security', 'cve', 'priority-critical'],
+              assignees: ['erdoukki']
+            });
+
+      - name: Fail on critical CVEs (release only)
+        if: github.event_name == 'push' && steps.cve-check.outputs.critical_cves == 'true'
+        run: |
+          echo "::error::Critical CVEs found - manual review required before release"
+          echo "See the security issue created for details"
+          exit 1
diff --git a/Makefile b/Makefile
new file mode 100644
index 00000000..487d60c4
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,83 @@
+# SecuBox SBOM Pipeline Makefile
+# Convenience targets for CRA Annex I compliance
+#
+# Usage:
+#   make sbom          - Generate full SBOM (all sources)
+#   make sbom-quick    - Generate SBOM without rebuilding
+#   make sbom-validate - Validate existing SBOM
+#   make sbom-scan     - CVE scan only
+#   make sbom-audit    - Audit feed packages for metadata
+#   make sbom-prereqs  - Check prerequisites
+#   make sbom-clean    - Clean SBOM outputs
+#   make sbom-help     - Show this help
+
+.PHONY: sbom sbom-quick sbom-validate sbom-scan sbom-audit sbom-prereqs sbom-clean sbom-help
+
+# Default version (can be overridden: make sbom VERSION=0.20)
+VERSION ?= $(shell cat version 2>/dev/null || git describe --tags --always 2>/dev/null || echo "dev")
+ARCH ?= aarch64_cortex-a53
+SBOM_DIR ?= dist/sbom
+
+sbom: sbom-prereqs
+	@echo "=== Generating Full SBOM ==="
+	./scripts/sbom-generate.sh --version "$(VERSION)" --arch "$(ARCH)"
+
+sbom-quick:
+	@echo "=== Generating Quick SBOM (no rebuild) ==="
+	./scripts/sbom-generate.sh --version "$(VERSION)" --arch "$(ARCH)"
+
+sbom-validate:
+	@echo "=== Validating SBOM ==="
+	@if command -v cyclonedx-cli >/dev/null 2>&1; then \
+		cyclonedx-cli validate --input-file "$(SBOM_DIR)/secubox-$(VERSION).cdx.json" \
+			--input-format json --input-version v1_6 || true; \
+	else \
+		echo "cyclonedx-cli not found. Install with:"; \
+		echo "  curl -sSfL -o ~/.local/bin/cyclonedx-cli https://github.com/CycloneDX/cyclonedx-cli/releases/latest/download/cyclonedx-linux-x64"; \
+		echo "  chmod +x ~/.local/bin/cyclonedx-cli"; \
+	fi
+
+sbom-scan:
+	@echo "=== Running CVE Scan ==="
+	@if command -v grype >/dev/null 2>&1; then \
+		grype sbom:"$(SBOM_DIR)/secubox-$(VERSION).cdx.json" \
+			--output table \
+			--output json="$(SBOM_DIR)/secubox-$(VERSION)-cve-report.json"; \
+	else \
+		echo "grype not found. Install with:"; \
+		echo "  curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b ~/.local/bin"; \
+	fi
+
+sbom-audit:
+	@echo "=== Auditing Feed Packages ==="
+	./scripts/sbom-audit-feed.sh
+
+sbom-prereqs:
+	@echo "=== Checking Prerequisites ==="
+	./scripts/check-sbom-prereqs.sh
+
+sbom-clean:
+	@echo "=== Cleaning SBOM Outputs ==="
+	rm -rf "$(SBOM_DIR)"
+	@echo "Cleaned: $(SBOM_DIR)"
+
+sbom-help:
+	@echo "SecuBox SBOM Pipeline Targets"
+	@echo "=============================="
+	@echo ""
+	@echo "  make sbom          - Generate full SBOM (all sources)"
+	@echo "  make sbom-quick    - Generate SBOM without rebuilding"
+	@echo "  make sbom-validate - Validate existing SBOM"
+	@echo "  make sbom-scan     - CVE scan only"
+	@echo "  make sbom-audit    - Audit feed packages for metadata"
+	@echo "  make sbom-prereqs  - Check prerequisites"
+	@echo "  make sbom-clean    - Clean SBOM outputs"
+	@echo ""
+	@echo "Variables:"
+	@echo "  VERSION=$(VERSION)"
+	@echo "  ARCH=$(ARCH)"
+	@echo "  SBOM_DIR=$(SBOM_DIR)"
+	@echo ""
+	@echo "Examples:"
+	@echo "  make sbom VERSION=0.20"
+	@echo "  make sbom-scan VERSION=0.20"
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..0c693df2
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,229 @@
+# Security Policy
+
+## SecuBox Security Disclosure Policy
+
+This document describes the security policy for SecuBox firmware, in compliance with
+**EU Cyber Resilience Act (CRA) Article 13 §6** requirements for Class I products.
+
+**Manufacturer:** CyberMind Produits SASU
+**Contact:** Gérald Kerma, Notre-Dame-du-Cruet, Savoie, France
+**Website:** https://cybermind.fr | https://secubox.in
+
+---
+
+## Supported Versions
+
+| Version | Support Status | End of Support |
+|---------|---------------|----------------|
+| 0.20.x  | ✅ Current    | Active development |
+| 0.19.x  | ✅ LTS        | March 2027 |
+| 0.18.x  | ⚠️ Security only | September 2026 |
+| < 0.18  | ❌ EOL        | Unsupported |
+
+**Support policy:**
+- **Current:** All bug fixes and security patches
+- **LTS (Long Term Support):** Critical security patches only, 18 months
+- **Security only:** Critical vulnerabilities only, 6 months after next major release
+- **EOL (End of Life):** No updates, upgrade strongly recommended
+
+---
+
+## Reporting a Vulnerability
+
+We take security vulnerabilities seriously. If you discover a security issue,
+please report it responsibly.
+
+### Primary Contact
+
+**Email:** security@cybermind.fr
+
+**PGP Key:** [0xABCD1234](https://secubox.in/pgp/security-key.asc)
+**Fingerprint:** `1234 5678 9ABC DEF0 1234 5678 9ABC DEF0 1234 5678`
+
+### Alternative Contact
+
+For critical vulnerabilities requiring immediate attention:
+- **Phone:** +33 (0)4 79 XX XX XX (French business hours)
+- **Signal:** Available upon request via email
+
+### Encrypted Communication
+
+We **strongly recommend** using PGP encryption for vulnerability reports.
+Our public key is available at:
+- https://secubox.in/pgp/security-key.asc
+- https://keys.openpgp.org (search: security@cybermind.fr)
+
+### What to Include
+
+Please provide:
+1. **Description:** Clear description of the vulnerability
+2. **Impact:** Potential security impact (confidentiality, integrity, availability)
+3. **Affected versions:** Which SecuBox versions are affected
+4. **Reproduction steps:** Step-by-step instructions to reproduce
+5. **Proof of concept:** Code, logs, or screenshots if applicable
+6. **Suggested fix:** If you have one (optional)
+
+### Response Timeline
+
+| Phase | Timeline |
+|-------|----------|
+| Acknowledgment | Within 48 hours |
+| Initial triage | Within 5 business days |
+| Status update | Every 7 days during investigation |
+| Fix development | Depends on severity (see below) |
+| Public disclosure | 90 days after fix, or coordinated |
+
+**Severity-based fix timeline:**
+- **Critical (CVSS 9.0+):** 7 days
+- **High (CVSS 7.0-8.9):** 30 days
+- **Medium (CVSS 4.0-6.9):** 60 days
+- **Low (CVSS < 4.0):** Next regular release
+
+---
+
+## Software Bill of Materials (SBOM)
+
+As required by CRA Annex I, we publish machine-readable SBOMs for all releases.
+
+### SBOM Location
+
+SBOMs are attached to each GitHub Release:
+- **CycloneDX 1.6:** `secubox-VERSION.cdx.json`
+- **SPDX 2.3:** `secubox-VERSION.spdx.json`
+- **CVE Report:** `secubox-VERSION-cve-report.json`
+- **Checksums:** `checksums.sha256`
+
+**Direct link:** https://github.com/cybermind/secubox/releases/latest
+
+### SBOM Contents
+
+Our SBOM includes:
+- All OpenWrt base packages
+- SecuBox custom packages and dependencies
+- Kernel modules and firmware blobs
+- Cryptographic libraries and versions
+- License information (SPDX identifiers)
+- PURL (Package URL) identifiers for each component
+
+### Verifying SBOM Integrity
+
+```bash
+# Download SBOM and checksums
+wget https://github.com/cybermind/secubox/releases/latest/download/secubox-0.20.cdx.json
+wget https://github.com/cybermind/secubox/releases/latest/download/checksums.sha256
+
+# Verify checksum
+sha256sum -c checksums.sha256 --ignore-missing
+```
+
+---
+
+## Vulnerability Disclosure (VEX)
+
+We use **Vulnerability Exploitability eXchange (VEX)** documents to communicate
+the status of CVEs affecting SecuBox components.
+
+### VEX Policy
+
+See [docs/vex-policy.md](docs/vex-policy.md) for our full VEX handling policy.
+
+**Status definitions:**
+- `not_affected`: CVE does not affect SecuBox (component not used, conditions not met)
+- `affected`: CVE affects SecuBox, fix in progress
+- `fixed`: CVE fixed in specified version
+- `under_investigation`: Analysis ongoing
+
+VEX documents are published alongside releases:
+- `secubox-VERSION.vex.json` (CycloneDX VEX format)
+
+---
+
+## CRA Compliance Statement
+
+### EU Cyber Resilience Act — Class I Declaration
+
+SecuBox is a **Class I product** under the EU Cyber Resilience Act (Regulation 2024/XXX),
+as it is a router/VPN appliance with network connectivity functions.
+
+**Compliance status:**
+- ✅ SBOM published in machine-readable format (CycloneDX + SPDX)
+- ✅ Vulnerability disclosure contact established
+- ✅ Security update mechanism implemented (opkg + secubox-update)
+- ✅ Default secure configuration
+- ⏳ ANSSI CSPN certification: In progress (target Q3 2026)
+
+### Certification Path
+
+We are pursuing **ANSSI CSPN (Certification de Sécurité de Premier Niveau)**
+certification for SecuBox, targeting completion in Q3 2026.
+
+**Certification scope:**
+- Firewall functionality
+- VPN (WireGuard) implementation
+- Intrusion detection (CrowdSec integration)
+- Secure boot chain
+- Update integrity verification
+
+---
+
+## Security Architecture
+
+### Defense in Depth
+
+SecuBox implements multiple security layers:
+
+1. **Network Segmentation:** VLAN isolation, guest network separation
+2. **WAF Protection:** mitmproxy-based web application firewall
+3. **Intrusion Detection:** CrowdSec community threat intelligence
+4. **Encrypted VPN:** WireGuard with modern cryptography
+5. **Access Control:** SSO portal with MFA support
+6. **Audit Logging:** Comprehensive security event logging
+
+### Data Sovereignty
+
+SecuBox includes an **AI Gateway** that enforces data classification:
+- **LOCAL_ONLY:** Sensitive data (IPs, credentials) never leaves device
+- **SANITIZED:** PII scrubbed before EU cloud processing (Mistral)
+- **CLOUD_DIRECT:** Generic queries to opted-in providers
+
+See [AI Gateway documentation](docs/ai-gateway.md) for details.
+
+---
+
+## Third-Party Components
+
+SecuBox builds upon:
+- **OpenWrt:** GPL-2.0, https://openwrt.org
+- **CrowdSec:** MIT, https://crowdsec.net
+- **WireGuard:** GPL-2.0, https://wireguard.com
+- **mitmproxy:** MIT, https://mitmproxy.org
+
+We monitor upstream security advisories and integrate patches promptly.
+
+---
+
+## Secure Development Practices
+
+- **Code review:** All changes require peer review
+- **Dependency scanning:** Automated CVE scanning in CI/CD
+- **SBOM generation:** Automated with each release
+- **Reproducible builds:** SOURCE_DATE_EPOCH enforced
+- **Signed releases:** (Planned) cosign signatures for releases
+
+---
+
+## Contact
+
+- **General security:** security@cybermind.fr
+- **Support:** support@cybermind.fr
+- **Commercial:** contact@cybermind.fr
+
+**Address:**
+CyberMind Produits SASU
+Notre-Dame-du-Cruet
+73130 Savoie, France
+
+---
+
+_Last updated: 2026-03-04_
+_Document version: 1.0_
diff --git a/docs/sbom-pipeline.md b/docs/sbom-pipeline.md
new file mode 100644
index 00000000..61d1b010
--- /dev/null
+++ b/docs/sbom-pipeline.md
@@ -0,0 +1,303 @@
+# SecuBox SBOM Pipeline Documentation
+
+## Overview
+
+The SecuBox SBOM (Software Bill of Materials) pipeline generates CycloneDX 1.6 and
+SPDX 2.3 compliant SBOMs for EU Cyber Resilience Act (CRA) Annex I compliance.
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────────────────┐
+│                         SecuBox SBOM Pipeline                                │
+├─────────────────────────────────────────────────────────────────────────────┤
+│                                                                              │
+│   ┌─────────────┐    ┌─────────────┐    ┌─────────────┐    ┌─────────────┐  │
+│   │   Source A  │    │   Source B  │    │   Source C  │    │   Source D  │  │
+│   │  OpenWrt    │    │   SecuBox   │    │   Rootfs    │    │  Firmware   │  │
+│   │  Native     │    │   Feed      │    │   Scan      │    │   Image     │  │
+│   │             │    │             │    │             │    │             │  │
+│   │ Packages    │    │ Makefiles   │    │ Syft scan   │    │ Syft scan   │  │
+│   │ .manifest   │    │ PKG_* vars  │    │ dir:rootfs  │    │ file:*.bin  │  │
+│   └──────┬──────┘    └──────┬──────┘    └──────┬──────┘    └──────┬──────┘  │
+│          │                  │                  │                  │         │
+│          └──────────────────┴──────────────────┴──────────────────┘         │
+│                                    │                                         │
+│                                    ▼                                         │
+│                          ┌─────────────────┐                                 │
+│                          │   Merge & Dedup │                                 │
+│                          │   (jq fusion)   │                                 │
+│                          └────────┬────────┘                                 │
+│                                   │                                          │
+│                                   ▼                                          │
+│                          ┌─────────────────┐                                 │
+│                          │    Validate     │                                 │
+│                          │ cyclonedx-cli   │                                 │
+│                          └────────┬────────┘                                 │
+│                                   │                                          │
+│                    ┌──────────────┼──────────────┐                           │
+│                    ▼              ▼              ▼                           │
+│             ┌───────────┐  ┌───────────┐  ┌───────────┐                      │
+│             │ CVE Scan  │  │ CRA Report│  │ Checksums │                      │
+│             │  (grype)  │  │  Summary  │  │ sha256sum │                      │
+│             └───────────┘  └───────────┘  └───────────┘                      │
+│                                                                              │
+└─────────────────────────────────────────────────────────────────────────────┘
+
+Output Files:
+├── secubox-VERSION.cdx.json          # CycloneDX 1.6 (primary)
+├── secubox-VERSION.spdx.json         # SPDX 2.3 (alternative)
+├── secubox-VERSION-cve-report.json   # Grype CVE scan results
+├── secubox-VERSION-cve-table.txt     # Human-readable CVE table
+├── secubox-VERSION-cra-summary.txt   # CRA compliance summary
+├── sbom-warnings.txt                 # Missing metadata warnings
+└── checksums.sha256                  # File integrity checksums
+```
+
+## Prerequisites
+
+### Minimum Versions
+
+| Tool | Minimum Version | Purpose |
+|------|-----------------|---------|
+| OpenWrt | 22.03 | Native SBOM support |
+| Perl | 5.26+ | package-metadata.pl |
+| jq | 1.6+ | JSON processing |
+| Syft | 0.100+ | Filesystem scanning |
+| Grype | 0.70+ | CVE scanning |
+| cyclonedx-cli | 0.25+ | SBOM validation |
+
+### Environment Setup
+
+```bash
+# Check prerequisites
+./scripts/check-sbom-prereqs.sh
+
+# Install SBOM tools (if not present)
+# Syft
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b ~/.local/bin
+
+# Grype
+curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b ~/.local/bin
+
+# cyclonedx-cli
+curl -sSfL -o ~/.local/bin/cyclonedx-cli \
+  https://github.com/CycloneDX/cyclonedx-cli/releases/latest/download/cyclonedx-linux-x64
+chmod +x ~/.local/bin/cyclonedx-cli
+
+# Add to PATH
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+### OpenWrt Kconfig
+
+Enable native SBOM generation in `.config`:
+
+```
+CONFIG_JSON_CYCLONEDX_SBOM=y
+CONFIG_COLLECT_KERNEL_DEBUG=n
+```
+
+## Usage
+
+### Daily Development
+
+```bash
+# Full SBOM generation (all 4 sources)
+./scripts/sbom-generate.sh
+
+# Quick SBOM from existing artifacts (no rebuild)
+./scripts/sbom-generate.sh --version 0.20
+
+# Offline mode (no network, uses cached databases)
+./scripts/sbom-generate.sh --offline
+
+# Skip CVE scan (faster)
+./scripts/sbom-generate.sh --no-cve
+```
+
+### Using Makefile Targets
+
+```bash
+# Full build + SBOM
+make sbom
+
+# SBOM only (no rebuild)
+make sbom-quick
+
+# Validate existing SBOM
+make sbom-validate
+
+# CVE scan only
+make sbom-scan
+
+# Clean SBOM outputs
+make sbom-clean
+
+# Show help
+make sbom-help
+```
+
+### Audit Feed Packages
+
+```bash
+# Check all SecuBox feed packages for missing metadata
+./scripts/sbom-audit-feed.sh
+
+# Output: feeds/secubox/MANIFEST.md
+```
+
+## Adding a New Package
+
+When adding a new package to the SecuBox feed, ensure SBOM compatibility:
+
+### Checklist
+
+- [ ] **PKG_NAME** defined
+- [ ] **PKG_VERSION** defined
+- [ ] **PKG_LICENSE** defined (SPDX identifier)
+- [ ] **PKG_HASH** defined (sha256)
+- [ ] **PKG_SOURCE_URL** defined (optional but recommended)
+
+### Example Makefile
+
+```makefile
+include $(TOPDIR)/rules.mk
+
+PKG_NAME:=my-package
+PKG_VERSION:=1.0.0
+PKG_RELEASE:=1
+
+PKG_SOURCE_URL:=https://github.com/example/my-package/archive
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_HASH:=a1b2c3d4e5f6...  # sha256sum of the source tarball
+
+PKG_LICENSE:=MIT
+PKG_LICENSE_FILES:=LICENSE
+
+PKG_MAINTAINER:=Your Name <email@example.com>
+```
+
+### Compute PKG_HASH
+
+```bash
+# Download and hash the source
+wget https://example.com/package-1.0.0.tar.gz
+sha256sum package-1.0.0.tar.gz
+
+# Or use the OpenWrt download helper
+make package/my-package/download V=s
+sha256sum dl/my-package-1.0.0.tar.gz
+```
+
+## CRA Annex I Mapping
+
+| CRA Requirement | SBOM Implementation |
+|-----------------|---------------------|
+| Art. 13(5) - Component identification | `components[].purl` (Package URL) |
+| Art. 13(5) - Supplier identification | `metadata.component.supplier` |
+| Art. 13(5) - Version information | `components[].version` |
+| Art. 13(5) - Dependencies | `dependencies[]` array |
+| Art. 13(5) - License information | `components[].licenses[]` |
+| Art. 13(6) - Machine-readable format | CycloneDX 1.6 JSON + SPDX 2.3 |
+| Art. 13(6) - Vulnerability disclosure | SECURITY.md + VEX documents |
+| Art. 13(7) - Unique identification | PURL + `serialNumber` UUID |
+| Annex I(2) - Integrity verification | `hashes[]` with SHA-256 |
+
+## ANSSI CSPN Submission
+
+For CSPN certification, include the following in your dossier:
+
+### Required Documents
+
+1. **SBOM Files**
+   - `secubox-VERSION.cdx.json` (primary)
+   - `secubox-VERSION.spdx.json` (alternative)
+
+2. **Provenance**
+   - `checksums.sha256` (integrity verification)
+   - Git commit hash from metadata
+
+3. **Vulnerability Analysis**
+   - `secubox-VERSION-cve-report.json`
+   - `secubox-VERSION-cra-summary.txt`
+
+4. **Process Documentation**
+   - This document (`docs/sbom-pipeline.md`)
+   - `SECURITY.md` (vulnerability disclosure policy)
+
+### Submission Checklist
+
+- [ ] All components have PKG_HASH and PKG_LICENSE
+- [ ] SBOM validates with cyclonedx-cli
+- [ ] No unaddressed Critical CVEs
+- [ ] VEX document explains any accepted risks
+- [ ] SOURCE_DATE_EPOCH reproducibility verified
+
+## Troubleshooting
+
+### Common Errors
+
+#### "OpenWrt version < 22.03"
+
+The native CycloneDX SBOM support requires OpenWrt 22.03 or later.
+
+**Solution:** Upgrade your OpenWrt fork or use `sbom-generate.sh` without native support
+(it will fall back to Makefile parsing).
+
+#### "package-metadata.pl not found"
+
+The SBOM generation script is missing from your OpenWrt checkout.
+
+**Solution:**
+```bash
+git checkout origin/master -- scripts/package-metadata.pl
+```
+
+#### "syft: command not found"
+
+Syft is not installed or not in PATH.
+
+**Solution:**
+```bash
+curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b ~/.local/bin
+export PATH="$HOME/.local/bin:$PATH"
+```
+
+#### "SBOM validation failed"
+
+The generated SBOM has schema errors.
+
+**Solution:**
+1. Check `sbom-warnings.txt` for missing metadata
+2. Fix Makefiles with missing PKG_HASH or PKG_LICENSE
+3. Regenerate SBOM
+
+#### "Grype database update failed"
+
+Network connectivity issue or rate limiting.
+
+**Solution:**
+- Use `--offline` mode with cached database
+- Or manually update: `grype db update`
+
+### Debug Mode
+
+```bash
+# Verbose output
+DEBUG=1 ./scripts/sbom-generate.sh
+
+# Keep intermediate files
+KEEP_TEMP=1 ./scripts/sbom-generate.sh
+```
+
+## Version History
+
+| Version | Date | Changes |
+|---------|------|---------|
+| 1.0 | 2026-03-04 | Initial pipeline implementation |
+
+---
+
+_Maintained by CyberMind Produits SASU_
+_Contact: secubox@cybermind.fr_
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages b/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages
index 05c6a2b9..6420732f 100644
--- a/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages
+++ b/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages
@@ -1,3 +1,14 @@
+Package: luci-app-ai-gateway
+Version: 1.0.0-r1
+Depends: luci-base, secubox-ai-gateway
+Section: luci
+Maintainer: OpenWrt LuCI community
+Architecture: all
+Installed-Size: 61440
+Description:  Data Sovereignty Engine with multi-tier classification for ANSSI CSPN compliance
+Filename: luci-app-ai-gateway_1.0.0-r1_all.ipk
+Size: 10787
+
 Package: luci-app-ai-insights
 Version: 1.0.0-r1
 Depends: luci-base
@@ -11,7 +22,7 @@ Description:  Unified AI security insights dashboard for SecuBox.
  DNS Guard, Network Anomaly, CVE Triage, and LocalRecall.
  Provides security posture scoring and AI-powered analysis.
 Filename: luci-app-ai-insights_1.0.0-r1_all.ipk
-Size: 11639
+Size: 11635
 
 Package: luci-app-auth-guardian
 Version: 0.4.0-r3
@@ -23,7 +34,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Comprehensive authentication and session management with captive portal, OAuth2/OIDC integration, voucher system, and time-based access control
 Filename: luci-app-auth-guardian_0.4.0-r3_all.ipk
-Size: 12397
+Size: 12393
 
 Package: luci-app-backup
 Version: 1.0.0-r1
@@ -35,7 +46,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI Backup Manager
 Filename: luci-app-backup_1.0.0-r1_all.ipk
-Size: 4534
+Size: 4535
 
 Package: luci-app-bandwidth-manager
 Version: 0.5.0-r2
@@ -47,7 +58,7 @@ Architecture: all
 Installed-Size: 337920
 Description:  Advanced bandwidth management with QoS rules, client quotas, and SQM integration
 Filename: luci-app-bandwidth-manager_0.5.0-r2_all.ipk
-Size: 61686
+Size: 61684
 
 Package: luci-app-cdn-cache
 Version: 0.5.0-r3
@@ -59,7 +70,7 @@ Architecture: all
 Installed-Size: 122880
 Description:  Dashboard for managing local CDN caching proxy on OpenWrt
 Filename: luci-app-cdn-cache_0.5.0-r3_all.ipk
-Size: 24254
+Size: 24252
 
 Package: luci-app-client-guardian
 Version: 0.4.0-r7
@@ -71,7 +82,7 @@ Architecture: all
 Installed-Size: 276480
 Description:  Network Access Control with client monitoring, zone management, captive portal, parental controls, and SMS/email alerts
 Filename: luci-app-client-guardian_0.4.0-r7_all.ipk
-Size: 52686
+Size: 52682
 
 Package: luci-app-cloner
 Version: 1.0.0-r1
@@ -82,7 +93,7 @@ Architecture: all
 Installed-Size: 102400
 Description:  SecuBox cloning station for building and deploying clone images
 Filename: luci-app-cloner_1.0.0-r1_all.ipk
-Size: 19434
+Size: 19431
 
 Package: luci-app-config-advisor
 Version: 1.0.0-r1
@@ -94,7 +105,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  ANSSI CSPN compliance checking and security configuration advisor
 Filename: luci-app-config-advisor_1.0.0-r1_all.ipk
-Size: 8861
+Size: 8858
 
 Package: luci-app-cookie-tracker
 Version: 1.0.0-r1
@@ -105,7 +116,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI Cookie Tracker Dashboard
 Filename: luci-app-cookie-tracker_1.0.0-r1_all.ipk
-Size: 5660
+Size: 5657
 
 Package: luci-app-crowdsec-dashboard
 Version: 0.8.0-r1
@@ -117,7 +128,7 @@ Architecture: all
 Installed-Size: 225280
 Description:  Real-time security monitoring dashboard for CrowdSec on OpenWrt
 Filename: luci-app-crowdsec-dashboard_0.8.0-r1_all.ipk
-Size: 43023
+Size: 43021
 
 Package: luci-app-cve-triage
 Version: 1.0.0-r1
@@ -129,7 +140,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI CVE Triage Dashboard
 Filename: luci-app-cve-triage_1.0.0-r1_all.ipk
-Size: 5945
+Size: 5942
 
 Package: luci-app-cyberfeed
 Version: 0.1.1-r1
@@ -141,7 +152,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Cyberpunk-themed RSS feed aggregator dashboard with social media support
 Filename: luci-app-cyberfeed_0.1.1-r1_all.ipk
-Size: 12887
+Size: 12884
 
 Package: luci-app-device-intel
 Version: 1.0.0-r1
@@ -153,7 +164,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  LuCI SecuBox Device Intelligence
 Filename: luci-app-device-intel_1.0.0-r1_all.ipk
-Size: 12049
+Size: 12047
 
 Package: luci-app-dnsguard
 Version: 1.1.0-r1
@@ -172,7 +183,7 @@ Description:  SecuBox DNS Guard provides privacy-focused DNS management with AI-
  - Real-time alerts and blocklist management
  - Domain analysis with LocalAI integration
 Filename: luci-app-dnsguard_1.1.0-r1_all.ipk
-Size: 12448
+Size: 12446
 
 Package: luci-app-dns-provider
 Version: 1.0.0-r1
@@ -184,7 +195,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI DNS Provider Manager
 Filename: luci-app-dns-provider_1.0.0-r1_all.ipk
-Size: 7175
+Size: 7166
 
 Package: luci-app-domoticz
 Version: 1.0.0-r1
@@ -208,7 +219,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  LuCI SecuBox Service Exposure Manager
 Filename: luci-app-exposure_1.0.0-r3_all.ipk
-Size: 11700
+Size: 11699
 
 Package: luci-app-gitea
 Version: 1.0.0-r2
@@ -220,7 +231,7 @@ Architecture: all
 Installed-Size: 92160
 Description:  Modern dashboard for Gitea Platform management on OpenWrt
 Filename: luci-app-gitea_1.0.0-r2_all.ipk
-Size: 16622
+Size: 16620
 
 Package: luci-app-glances
 Version: 1.0.0-r2
@@ -232,7 +243,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  Modern dashboard for Glances system monitoring with SecuBox theme
 Filename: luci-app-glances_1.0.0-r2_all.ipk
-Size: 7016
+Size: 7017
 
 Package: luci-app-gotosocial
 Version: 0.1.0-r1
@@ -244,7 +255,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  LuCI app for GoToSocial Fediverse Server
 Filename: luci-app-gotosocial_0.1.0-r1_all.ipk
-Size: 8209
+Size: 8208
 
 Package: luci-app-haproxy
 Version: 1.0.0-r8
@@ -256,7 +267,7 @@ Architecture: all
 Installed-Size: 225280
 Description:  Web interface for managing HAProxy load balancer with vhosts, SSL certificates, and backend routing
 Filename: luci-app-haproxy_1.0.0-r8_all.ipk
-Size: 35340
+Size: 35342
 
 Package: luci-app-hexojs
 Version: 1.0.0-r3
@@ -268,7 +279,7 @@ Architecture: all
 Installed-Size: 194560
 Description:  Modern dashboard for Hexo static site generator on OpenWrt
 Filename: luci-app-hexojs_1.0.0-r3_all.ipk
-Size: 30453
+Size: 30451
 
 Package: luci-app-iot-guard
 Version: 1.0.0-r1
@@ -292,7 +303,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  SecuBox IP Blocklist - Static threat defense dashboard
 Filename: luci-app-ipblocklist_1.0.0-r1_all.ipk
-Size: 6529
+Size: 6528
 
 Package: luci-app-jabber
 Version: 0
@@ -316,7 +327,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  LuCI Jellyfin Media Server Configuration
 Filename: luci-app-jellyfin_1.0.0-r1_all.ipk
-Size: 10485
+Size: 10486
 
 Package: luci-app-jitsi
 Version: 1.0.0-r1
@@ -328,7 +339,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI Jitsi Meet Configuration
 Filename: luci-app-jitsi_1.0.0-r1_all.ipk
-Size: 5180
+Size: 5175
 
 Package: luci-app-ksm-manager
 Version: 0.4.0-r2
@@ -340,7 +351,7 @@ Architecture: all
 Installed-Size: 112640
 Description:  Centralized cryptographic key management with hardware security module (HSM) support for Nitrokey and YubiKey devices. Provides secure key storage, certificate management, SSH key handling, and secret storage with audit logging.
 Filename: luci-app-ksm-manager_0.4.0-r2_all.ipk
-Size: 18783
+Size: 18778
 
 Package: luci-app-localai
 Version: 0.1.0-r15
@@ -352,7 +363,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Modern dashboard for LocalAI LLM management on OpenWrt
 Filename: luci-app-localai_0.1.0-r15_all.ipk
-Size: 13321
+Size: 13317
 
 Package: luci-app-localrecall
 Version: 1.0.0-r1
@@ -364,7 +375,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI LocalRecall AI Memory Dashboard
 Filename: luci-app-localrecall_1.0.0-r1_all.ipk
-Size: 8423
+Size: 8415
 
 Package: luci-app-lyrion
 Version: 1.0.0-r1
@@ -388,7 +399,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI MAC Guardian - WiFi MAC Security Monitor
 Filename: luci-app-mac-guardian_0.5.0-r1_all.ipk
-Size: 6669
+Size: 6660
 
 Package: luci-app-magicmirror2
 Version: 0.4.0-r6
@@ -400,7 +411,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Modern dashboard for MagicMirror2 smart display platform with module manager and SecuBox theme
 Filename: luci-app-magicmirror2_0.4.0-r6_all.ipk
-Size: 12361
+Size: 12359
 
 Package: luci-app-mailinabox
 Version: 1.0.0-r1
@@ -412,7 +423,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI support for Mail-in-a-Box
 Filename: luci-app-mailinabox_1.0.0-r1_all.ipk
-Size: 5483
+Size: 5484
 
 Package: luci-app-mailserver
 Version: 1.0.0-r1
@@ -424,7 +435,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI Mail Server Manager
 Filename: luci-app-mailserver_1.0.0-r1_all.ipk
-Size: 6508
+Size: 6515
 
 Package: luci-app-master-link
 Version: 1.0.0-r1
@@ -436,7 +447,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI SecuBox Master-Link Mesh Management
 Filename: luci-app-master-link_1.0.0-r1_all.ipk
-Size: 6306
+Size: 6305
 
 Package: luci-app-matrix
 Version: 1.0.0-r1
@@ -448,7 +459,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI Matrix Homeserver Dashboard
 Filename: luci-app-matrix_1.0.0-r1_all.ipk
-Size: 7527
+Size: 7524
 
 Package: luci-app-media-flow
 Version: 0.6.4-r1
@@ -460,7 +471,7 @@ Architecture: all
 Installed-Size: 133120
 Description:  Real-time detection and monitoring of streaming services (Netflix, YouTube, Spotify, etc.) with quality estimation, history tracking, and alerts. Supports nDPId local DPI and netifyd.
 Filename: luci-app-media-flow_0.6.4-r1_all.ipk
-Size: 25382
+Size: 25380
 
 Package: luci-app-metablogizer
 Version: 1.1.0-r1
@@ -472,7 +483,7 @@ Architecture: all
 Installed-Size: 133120
 Description:  LuCI support for MetaBlogizer Static Site Publisher
 Filename: luci-app-metablogizer_1.1.0-r1_all.ipk
-Size: 26204
+Size: 26205
 
 Package: luci-app-metabolizer
 Version: 1.0.0-r2
@@ -484,7 +495,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI support for Metabolizer CMS
 Filename: luci-app-metabolizer_1.0.0-r2_all.ipk
-Size: 4820
+Size: 4825
 
 Package: luci-app-mitmproxy
 Version: 0.5.0-r2
@@ -508,7 +519,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  Web interface for MMPM - MagicMirror Package Manager
 Filename: luci-app-mmpm_0.2.0-r3_all.ipk
-Size: 7974
+Size: 7969
 
 Package: luci-app-mqtt-bridge
 Version: 0.4.0-r4
@@ -532,7 +543,7 @@ Architecture: all
 Installed-Size: 122880
 Description:  Modern dashboard for nDPId deep packet inspection on OpenWrt
 Filename: luci-app-ndpid_1.1.2-r2_all.ipk
-Size: 21700
+Size: 21701
 
 Package: luci-app-netdata-dashboard
 Version: 0.5.0-r2
@@ -556,7 +567,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI Network Anomaly Detection Dashboard
 Filename: luci-app-network-anomaly_1.0.0-r1_all.ipk
-Size: 7644
+Size: 7646
 
 Package: luci-app-network-modes
 Version: 0.5.0-r3
@@ -580,7 +591,7 @@ Architecture: all
 Installed-Size: 81920
 Description:  Unified network services dashboard with DNS/hosts sync, CDN cache control, and WPAD auto-proxy configuration
 Filename: luci-app-network-tweaks_1.0.0-r7_all.ipk
-Size: 15948
+Size: 15947
 
 Package: luci-app-nextcloud
 Version: 1.0.0-r1
@@ -592,7 +603,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  LuCI support for Nextcloud LXC
 Filename: luci-app-nextcloud_1.0.0-r1_all.ipk
-Size: 10350
+Size: 10351
 
 Package: luci-app-ollama
 Version: 0.1.0-r1
@@ -604,7 +615,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Modern dashboard for Ollama LLM management on OpenWrt
 Filename: luci-app-ollama_0.1.0-r1_all.ipk
-Size: 14334
+Size: 14333
 
 Package: luci-app-openclaw
 Version: 1.0.0-r1
@@ -616,7 +627,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  Web interface for OpenClaw personal AI with Claude/OpenAI/Ollama support
 Filename: luci-app-openclaw_1.0.0-r1_all.ipk
-Size: 8414
+Size: 8412
 
 Package: luci-app-peertube
 Version: 0
@@ -628,7 +639,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI PeerTube Video Platform
 Filename: luci-app-peertube_0_all.ipk
-Size: 5755
+Size: 5757
 
 Package: luci-app-picobrew
 Version: 1.0.0-r1
@@ -640,7 +651,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  Modern dashboard for PicoBrew Server management on OpenWrt
 Filename: luci-app-picobrew_1.0.0-r1_all.ipk
-Size: 9534
+Size: 9535
 
 Package: luci-app-secubox
 Version: 0.7.1-r4
@@ -652,7 +663,7 @@ Architecture: all
 Installed-Size: 440320
 Description:  Central control hub for all SecuBox modules. Provides unified dashboard, module status, system health monitoring, and quick actions.
 Filename: luci-app-secubox_0.7.1-r4_all.ipk
-Size: 82094
+Size: 82095
 
 Package: luci-app-secubox-admin
 Version: 1.0.0-r19
@@ -663,7 +674,7 @@ Architecture: all
 Installed-Size: 337920
 Description:  Unified admin control center for SecuBox appstore plugins with system monitoring
 Filename: luci-app-secubox-admin_1.0.0-r19_all.ipk
-Size: 58041
+Size: 58039
 
 Package: luci-app-secubox-crowdsec
 Version: 1.0.0-r3
@@ -675,7 +686,7 @@ Architecture: all
 Installed-Size: 81920
 Description:  LuCI SecuBox CrowdSec Dashboard
 Filename: luci-app-secubox-crowdsec_1.0.0-r3_all.ipk
-Size: 13920
+Size: 13916
 
 Package: luci-app-secubox-mirror
 Version: 0.1.0-r1
@@ -687,7 +698,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI MirrorNet Dashboard
 Filename: luci-app-secubox-mirror_0.1.0-r1_all.ipk
-Size: 5850
+Size: 5847
 
 Package: luci-app-secubox-netdiag
 Version: 1.0.0-r1
@@ -699,7 +710,7 @@ Architecture: all
 Installed-Size: 81920
 Description:  Real-time DSA switch port statistics, error monitoring, and network health diagnostics
 Filename: luci-app-secubox-netdiag_1.0.0-r1_all.ipk
-Size: 15346
+Size: 15344
 
 Package: luci-app-secubox-netifyd
 Version: 1.2.1-r1
@@ -711,7 +722,7 @@ Architecture: all
 Installed-Size: 194560
 Description:  Complete LuCI interface for netifyd DPI engine with real-time flow monitoring, application detection, network analytics, and flow action plugins
 Filename: luci-app-secubox-netifyd_1.2.1-r1_all.ipk
-Size: 36721
+Size: 36720
 
 Package: luci-app-secubox-p2p
 Version: 0.1.0-r1
@@ -723,7 +734,7 @@ Architecture: all
 Installed-Size: 245760
 Description:  LuCI SecuBox P2P Hub
 Filename: luci-app-secubox-p2p_0.1.0-r1_all.ipk
-Size: 46834
+Size: 46832
 
 Package: luci-app-secubox-portal
 Version: 0.7.0-r3
@@ -735,7 +746,7 @@ Architecture: all
 Installed-Size: 194560
 Description:  Unified entry point for all SecuBox applications with tabbed navigation
 Filename: luci-app-secubox-portal_0.7.0-r3_all.ipk
-Size: 41685
+Size: 41682
 
 Package: luci-app-secubox-security-threats
 Version: 1.0.0-r4
@@ -747,7 +758,7 @@ Architecture: all
 Installed-Size: 61440
 Description:  Unified dashboard integrating netifyd DPI threats with CrowdSec intelligence for real-time threat monitoring and automated blocking
 Filename: luci-app-secubox-security-threats_1.0.0-r4_all.ipk
-Size: 10659
+Size: 10656
 
 Package: luci-app-secubox-users
 Version: 1.0.0-r1
@@ -758,7 +769,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI SecuBox User Management
 Filename: luci-app-secubox-users_1.0.0-r1_all.ipk
-Size: 5147
+Size: 5144
 
 Package: luci-app-service-registry
 Version: 1.0.0-r1
@@ -770,7 +781,7 @@ Architecture: all
 Installed-Size: 194560
 Description:  Unified service aggregation with HAProxy vhosts, Tor hidden services, and QR-coded landing page
 Filename: luci-app-service-registry_1.0.0-r1_all.ipk
-Size: 39954
+Size: 39952
 
 Package: luci-app-simplex
 Version: 1.0.0-r1
@@ -782,7 +793,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI SimpleX Chat Server Configuration
 Filename: luci-app-simplex_1.0.0-r1_all.ipk
-Size: 7041
+Size: 7035
 
 Package: luci-app-streamlit
 Version: 1.0.0-r11
@@ -794,7 +805,7 @@ Architecture: all
 Installed-Size: 112640
 Description:  Multi-instance Streamlit management with Gitea integration
 Filename: luci-app-streamlit_1.0.0-r11_all.ipk
-Size: 20569
+Size: 20565
 
 Package: luci-app-system-hub
 Version: 0.5.2-r2
@@ -806,7 +817,7 @@ Architecture: all
 Installed-Size: 327680
 Description:  Central system control with monitoring, services, logs, and backup
 Filename: luci-app-system-hub_0.5.2-r2_all.ipk
-Size: 64290
+Size: 64292
 
 Package: luci-app-threat-analyst
 Version: 1.0.0-r1
@@ -818,7 +829,7 @@ Architecture: all
 Installed-Size: 51200
 Description:  LuCI Threat Analyst Dashboard
 Filename: luci-app-threat-analyst_1.0.0-r1_all.ipk
-Size: 10144
+Size: 10142
 
 Package: luci-app-tor
 Version: 1.0.0-r1
@@ -830,7 +841,7 @@ Architecture: all
 Installed-Size: 92160
 Description:  Modern dashboard for Tor anonymization on OpenWrt
 Filename: luci-app-tor_1.0.0-r1_all.ipk
-Size: 17818
+Size: 17816
 
 Package: luci-app-tor-shield
 Version: 1.0.0-r10
@@ -842,7 +853,7 @@ Architecture: all
 Installed-Size: 122880
 Description:  Modern dashboard for Tor anonymization on OpenWrt
 Filename: luci-app-tor-shield_1.0.0-r10_all.ipk
-Size: 22766
+Size: 22763
 
 Package: luci-app-traffic-shaper
 Version: 0.4.0-r2
@@ -854,7 +865,7 @@ Architecture: all
 Installed-Size: 81920
 Description:  Advanced traffic shaping with TC/CAKE for precise bandwidth control
 Filename: luci-app-traffic-shaper_0.4.0-r2_all.ipk
-Size: 14591
+Size: 14587
 
 Package: luci-app-vhost-manager
 Version: 0.5.0-r5
@@ -866,7 +877,7 @@ Architecture: all
 Installed-Size: 153600
 Description:  Nginx reverse proxy manager with Let's Encrypt SSL certificates, authentication, and WebSocket support
 Filename: luci-app-vhost-manager_0.5.0-r5_all.ipk
-Size: 26283
+Size: 26278
 
 Package: luci-app-voip
 Version: 1.0.0-r1
@@ -878,7 +889,7 @@ Architecture: all
 Installed-Size: 81920
 Description:  LuCI VoIP PBX Management
 Filename: luci-app-voip_1.0.0-r1_all.ipk
-Size: 11045
+Size: 11040
 
 Package: luci-app-vortex-dns
 Version: 1.0.0-r1
@@ -890,7 +901,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  LuCI Vortex DNS Dashboard
 Filename: luci-app-vortex-dns_1.0.0-r1_all.ipk
-Size: 6077
+Size: 6074
 
 Package: luci-app-vortex-firewall
 Version: 1.0.0-r1
@@ -902,7 +913,7 @@ Architecture: all
 Installed-Size: 30720
 Description:  LuCI Vortex DNS Firewall Dashboard
 Filename: luci-app-vortex-firewall_1.0.0-r1_all.ipk
-Size: 5453
+Size: 5452
 
 Package: luci-app-wazuh
 Version: 1.0.0-r1
@@ -913,7 +924,7 @@ Architecture: all
 Installed-Size: 71680
 Description:  Unified security monitoring dashboard for Wazuh SIEM/XDR integration
 Filename: luci-app-wazuh_1.0.0-r1_all.ipk
-Size: 11070
+Size: 11068
 
 Package: luci-app-wireguard-dashboard
 Version: 0.7.0-r5
@@ -925,7 +936,7 @@ Architecture: all
 Installed-Size: 215040
 Description:  Modern dashboard for WireGuard VPN monitoring on OpenWrt
 Filename: luci-app-wireguard-dashboard_0.7.0-r5_all.ipk
-Size: 42290
+Size: 42284
 
 Package: luci-app-zigbee2mqtt
 Version: 1.0.0-r2
@@ -937,7 +948,7 @@ Architecture: all
 Installed-Size: 40960
 Description:  Graphical interface for managing the Zigbee2MQTT LXC application.
 Filename: luci-app-zigbee2mqtt_1.0.0-r2_all.ipk
-Size: 6598
+Size: 6594
 
 Package: luci-theme-secubox
 Version: 0.4.8-r1
@@ -949,7 +960,32 @@ Architecture: all
 Installed-Size: 491520
 Description:  Global CyberMood design system (CSS/JS/i18n) shared by all SecuBox dashboards.
 Filename: luci-theme-secubox_0.4.8-r1_all.ipk
-Size: 121590
+Size: 121588
+
+Package: secubox-ai-gateway
+Version: 1.0.0-r1
+Depends: jsonfilter, wget-ssl
+License: MIT
+Section: secubox
+Maintainer: CyberMind <contact@cybermind.fr>
+Architecture: all
+Installed-Size: 71680
+Description:  SecuBox AI Gateway implements the Data Classifier (Sovereignty Engine)
+ for AI request routing with three classification tiers:
+ 
+ - LOCAL_ONLY: Sensitive data processed only by on-device LocalAI
+ - SANITIZED: PII scrubbed, routed to EU providers (Mistral)
+ - CLOUD_DIRECT: Generic queries to any cloud provider
+ 
+ Features:
+ - OpenAI-compatible proxy on port 4000
+ - Multi-provider support: LocalAI > Mistral > Claude > GPT > Gemini > xAI
+ - ANSSI CSPN compliance audit logging
+ - Offline mode for airgapped operation
+ 
+ All cloud providers are opt-in. Local tier always active.
+Filename: secubox-ai-gateway_1.0.0-r1_all.ipk
+Size: 13665
 
 Package: secubox-app
 Version: 1.0.0-r2
@@ -960,7 +996,7 @@ Installed-Size: 92160
 Description:  Command line helper for SecuBox App Store manifests. Installs /usr/sbin/secubox-app
  and ships the default manifests under /usr/share/secubox/plugins/.
 Filename: secubox-app_1.0.0-r2_all.ipk
-Size: 11187
+Size: 11185
 
 Package: secubox-app-adguardhome
 Version: 1.0.0-r2
@@ -974,7 +1010,7 @@ Description:  Installer, configuration, and service manager for running AdGuard
  inside Docker on SecuBox-powered OpenWrt systems. Network-wide ad blocker
  with DNS-over-HTTPS/TLS support and detailed analytics.
 Filename: secubox-app-adguardhome_1.0.0-r2_all.ipk
-Size: 2878
+Size: 2881
 
 Package: secubox-app-auth-logger
 Version: 1.2.2-r1
@@ -992,7 +1028,7 @@ Description:  Logs authentication failures from LuCI/rpcd and Dropbear SSH
  - JavaScript hook to intercept login failures
  - CrowdSec parser and bruteforce scenario
 Filename: secubox-app-auth-logger_1.2.2-r1_all.ipk
-Size: 9378
+Size: 9371
 
 Package: secubox-app-crowdsec-custom
 Version: 1.1.0-r1
@@ -1017,7 +1053,7 @@ Description:  Custom CrowdSec configurations for SecuBox web interface protectio
  - Insider WAF: LAN threat detection (C2, exfiltration, lateral movement)
  - Whitelist for trusted networks
 Filename: secubox-app-crowdsec-custom_1.1.0-r1_all.ipk
-Size: 6942
+Size: 6946
 
 Package: secubox-app-cs-firewall-bouncer
 Version: 0.0.31-r4
@@ -1058,7 +1094,7 @@ Description:  Cyberpunk-themed RSS feed aggregator for OpenWrt/SecuBox.
  Features emoji injection, neon styling, and RSS-Bridge support
  for social media feeds (Facebook, Twitter, Mastodon).
 Filename: secubox-app-cyberfeed_0.2.1-r1_all.ipk
-Size: 12452
+Size: 12450
 
 Package: secubox-app-device-intel
 Version: 1.0.0-r1
@@ -1072,7 +1108,7 @@ Description:  Unified device inventory aggregating mac-guardian, client-guardian
  P2P mesh, and exposure scanner data. Includes heuristic classification
  and pluggable emulator modules for MQTT, Zigbee, and USB devices.
 Filename: secubox-app-device-intel_1.0.0-r1_all.ipk
-Size: 13105
+Size: 13098
 
 Package: secubox-app-dns-provider
 Version: 1.0.0-r1
@@ -1086,7 +1122,7 @@ Description:  Programmatic DNS record management via provider APIs (OVH, Gandi
  Cloudflare). Provides the dnsctl CLI for record CRUD, zone sync
  DNS propagation verification, and ACME DNS-01 challenge support.
 Filename: secubox-app-dns-provider_1.0.0-r1_all.ipk
-Size: 8262
+Size: 8258
 
 Package: secubox-app-domoticz
 Version: 1.0.0-r4
@@ -1099,7 +1135,7 @@ Installed-Size: 30720
 Description:  Installer, configuration, and service manager for running Domoticz
  inside an LXC Alpine container on SecuBox-powered OpenWrt systems.
 Filename: secubox-app-domoticz_1.0.0-r4_all.ipk
-Size: 7507
+Size: 7513
 
 Package: secubox-app-exposure
 Version: 1.0.0-r1
@@ -1114,7 +1150,7 @@ Description:  Unified service exposure manager for SecuBox.
  - Dynamic Tor hidden service management
  - HAProxy SSL reverse proxy configuration
 Filename: secubox-app-exposure_1.0.0-r1_all.ipk
-Size: 9151
+Size: 9147
 
 Package: secubox-app-gitea
 Version: 1.0.0-r5
@@ -1151,7 +1187,7 @@ Description:  Dynamic landing page generator for GK2 SecuBox services.
  Aggregates Streamlit apps, MetaBlogizer sites, and infrastructure
  services into a single service directory page.
 Filename: secubox-app-gk2hub_0.1.0-r1_all.ipk
-Size: 4057
+Size: 4060
 
 Package: secubox-app-glances
 Version: 1.0.0-r1
@@ -1174,7 +1210,7 @@ Description:  Glances - Cross-platform system monitoring tool for SecuBox.
  Runs in LXC container for isolation and security.
  Configure in /etc/config/glances.
 Filename: secubox-app-glances_1.0.0-r1_all.ipk
-Size: 6140
+Size: 6142
 
 Package: secubox-app-guacamole
 Version: 1.0.0-r1
@@ -1188,7 +1224,7 @@ Description:  Apache Guacamole clientless remote desktop gateway.
  Runs in an LXC Debian container with guacd and Tomcat.
  Supports SSH, VNC, and RDP connections via web browser.
 Filename: secubox-app-guacamole_1.0.0-r1_all.ipk
-Size: 6946
+Size: 6942
 
 Package: secubox-app-haproxy
 Version: 1.0.0-r24
@@ -1208,7 +1244,7 @@ Description:  HAProxy load balancer and reverse proxy running in an LXC containe
  - Stats dashboard
  - Rate limiting and ACLs
 Filename: secubox-app-haproxy_1.0.0-r24_all.ipk
-Size: 22009
+Size: 22005
 
 Package: secubox-app-hexojs
 Version: 1.0.0-r8
@@ -1232,7 +1268,7 @@ Description:  Hexo CMS - Self-hosted static blog generator for OpenWrt
  Runs in LXC container with Alpine Linux.
  Configure in /etc/config/hexojs.
 Filename: secubox-app-hexojs_1.0.0-r8_all.ipk
-Size: 100058
+Size: 100054
 
 Package: secubox-app-ipblocklist
 Version: 1.0.0-r1
@@ -1247,7 +1283,7 @@ Description: Pre-emptive IP blocklist defense layer for SecuBox.
 Maintainer: Gandalf <gandalf@cybermind.fr>
 License: Apache-2.0
 Filename: secubox-app-ipblocklist_1.0.0-r1_all.ipk
-Size: 4702
+Size: 4701
 
 Package: secubox-app-jabber
 Version: 1.0.0-r1
@@ -1261,7 +1297,7 @@ Description:  Jabber/XMPP instant messaging server based on Prosody.
  Runs in an LXC Debian container with full XMPP support.
  Features multi-user chat (MUC), file uploads, and S2S federation.
 Filename: secubox-app-jabber_1.0.0-r1_all.ipk
-Size: 13278
+Size: 13277
 
 Package: secubox-app-jellyfin
 Version: 3.0.0-r1
@@ -1274,7 +1310,7 @@ Installed-Size: 20480
 Description:  Jellyfin media server running in LXC container.
  Free media server for streaming movies, TV shows, music, and photos.
 Filename: secubox-app-jellyfin_3.0.0-r1_all.ipk
-Size: 4754
+Size: 4755
 
 Package: secubox-app-jitsi
 Version: 1.0.0-r1
@@ -1299,7 +1335,7 @@ Description:  Jitsi Meet - Secure, fully featured video conferencing for SecuBox
  Integrates with HAProxy for SSL termination.
  Configure in /etc/config/jitsi.
 Filename: secubox-app-jitsi_1.0.0-r1_all.ipk
-Size: 8923
+Size: 8926
 
 Package: secubox-app-localai
 Version: 3.9.0-r1
@@ -1321,7 +1357,7 @@ Description:  LocalAI native binary package for OpenWrt.
  
  API: http://<router-ip>:8081/v1
 Filename: secubox-app-localai_3.9.0-r1_all.ipk
-Size: 5833
+Size: 5838
 
 Package: secubox-app-localai-wb
 Version: 2.25.0-r1
@@ -1345,7 +1381,7 @@ Description:  LocalAI native binary package for OpenWrt.
  
  API: http://<router-ip>:8080/v1
 Filename: secubox-app-localai-wb_2.25.0-r1_all.ipk
-Size: 7950
+Size: 7949
 
 Package: secubox-app-lyrion
 Version: 2.0.2-r1
@@ -1365,7 +1401,7 @@ Description:  Lyrion Media Server (formerly Logitech Media Server / Squeezebox S
  Auto-detects available runtime, preferring LXC for lower resource usage.
  Configure runtime in /etc/config/lyrion.
 Filename: secubox-app-lyrion_2.0.2-r1_all.ipk
-Size: 8124
+Size: 8127
 
 Package: secubox-app-mac-guardian
 Version: 0.5.0-r1
@@ -1380,7 +1416,7 @@ Description:  WiFi MAC address security monitor for SecuBox.
  and spoofing. Integrates with CrowdSec and provides
  real-time hostapd hotplug detection.
 Filename: secubox-app-mac-guardian_0.5.0-r1_all.ipk
-Size: 12099
+Size: 12097
 
 Package: secubox-app-magicmirror2
 Version: 0.4.0-r8
@@ -1402,7 +1438,7 @@ Description:  MagicMirror² - Open source modular smart mirror platform for Secu
  Runs in LXC container for isolation and security.
  Configure in /etc/config/magicmirror2.
 Filename: secubox-app-magicmirror2_0.4.0-r8_all.ipk
-Size: 9251
+Size: 9250
 
 Package: secubox-app-mailinabox
 Version: 2.0.0-r1
@@ -1427,7 +1463,7 @@ Description:  Complete email server solution using docker-mailserver for SecuBox
  
  Commands: mailinaboxctl --help
 Filename: secubox-app-mailinabox_2.0.0-r1_all.ipk
-Size: 7570
+Size: 7569
 
 Package: secubox-app-mailserver
 Version: 2.0.0-r1
@@ -1440,7 +1476,7 @@ Installed-Size: 20480
 Description:  Postfix + Dovecot mail server running in LXC container.
  Supports IMAP/SMTP with SSL/TLS.
 Filename: secubox-app-mailserver_2.0.0-r1_all.ipk
-Size: 5699
+Size: 5704
 
 Package: secubox-app-matrix
 Version: 1.0.0-r1
@@ -1454,7 +1490,7 @@ Description:  Matrix homeserver based on Conduit - a lightweight, high-performan
  Matrix server written in Rust. Runs in an LXC Debian container.
  Features E2EE messaging, federation, and mesh integration.
 Filename: secubox-app-matrix_1.0.0-r1_all.ipk
-Size: 10454
+Size: 10448
 
 Package: secubox-app-metabolizer
 Version: 1.0.0-r3
@@ -1475,7 +1511,7 @@ Description:  Metabolizer Blog Pipeline - Integrated CMS with Git-based workflow
  
  Pipeline: Edit in Streamlit -> Push to Gitea -> Build with Hexo -> Publish
 Filename: secubox-app-metabolizer_1.0.0-r3_all.ipk
-Size: 13980
+Size: 13979
 
 Package: secubox-app-mitmproxy
 Version: 0.5.0-r19
@@ -1523,7 +1559,7 @@ Description:  MMPM (MagicMirror Package Manager) for SecuBox.
  
  Runs inside the MagicMirror2 LXC container.
 Filename: secubox-app-mmpm_0.2.0-r5_all.ipk
-Size: 3977
+Size: 3976
 
 Package: secubox-app-nextcloud
 Version: 1.0.0-r2
@@ -1537,7 +1573,7 @@ Description:  Nextcloud file sync and collaboration platform running in a Debian
  LXC container with MariaDB, Redis, and Nginx. Features HAProxy SSL
  integration, automated backups, and KISS LuCI dashboard.
 Filename: secubox-app-nextcloud_1.0.0-r2_all.ipk
-Size: 9672
+Size: 9675
 
 Package: secubox-app-ollama
 Version: 0.1.0-r1
@@ -1559,7 +1595,7 @@ Description:  Ollama - Simple local LLM runtime for SecuBox-powered OpenWrt syst
  Runs in Docker/Podman container.
  Configure in /etc/config/ollama.
 Filename: secubox-app-ollama_0.1.0-r1_all.ipk
-Size: 5739
+Size: 5735
 
 Package: secubox-app-picobrew
 Version: 1.0.0-r7
@@ -1581,7 +1617,7 @@ Description:  PicoBrew Server - Self-hosted brewing controller for PicoBrew devi
  Runs in LXC container with Python/Flask backend.
  Configure in /etc/config/picobrew.
 Filename: secubox-app-picobrew_1.0.0-r7_all.ipk
-Size: 5542
+Size: 5539
 
 Package: secubox-app-rustdesk
 Version: 1.0.0-r1
@@ -1594,7 +1630,7 @@ Installed-Size: 20480
 Description:  Self-hosted RustDesk relay server for remote desktop access.
  Downloads and manages hbbs (ID server) and hbbr (relay server) binaries.
 Filename: secubox-app-rustdesk_1.0.0-r1_all.ipk
-Size: 4465
+Size: 4463
 
 Package: secubox-app-simplex
 Version: 1.0.0-r1
@@ -1618,7 +1654,7 @@ Description:  SimpleX Chat self-hosted messaging infrastructure for SecuBox.
  Privacy-first messaging relay that you control.
  Configure in /etc/config/simplex.
 Filename: secubox-app-simplex_1.0.0-r1_all.ipk
-Size: 9368
+Size: 9364
 
 Package: secubox-app-smbfs
 Version: 1.0.0-r1
@@ -1632,7 +1668,7 @@ Description:  SMB/CIFS remote directory mount manager for SecuBox. Manages share
  network mounts for media servers (Jellyfin, Lyrion), backups, and
  general-purpose remote storage over SMB/CIFS protocol.
 Filename: secubox-app-smbfs_1.0.0-r1_all.ipk
-Size: 5266
+Size: 5269
 
 Package: secubox-app-streamlit
 Version: 1.0.0-r5
@@ -1682,7 +1718,7 @@ Description:  SecuBox Tor Shield - One-click Tor anonymization for OpenWrt
  
  Configure in /etc/config/tor-shield.
 Filename: secubox-app-tor_1.0.0-r1_all.ipk
-Size: 7374
+Size: 7367
 
 Package: secubox-app-voip
 Version: 1.0.0-r1
@@ -1696,7 +1732,7 @@ Description:  VoIP PBX solution with Asterisk in LXC container.
  Features OVH SIP trunk integration, WebRTC support
  and Jabber/XMPP relay for SMS and voicemail notifications.
 Filename: secubox-app-voip_1.0.0-r1_all.ipk
-Size: 11957
+Size: 11955
 
 Package: secubox-app-webapp
 Version: 1.5.0-r7
@@ -1714,7 +1750,7 @@ Description:  SecuBox Control Center Dashboard - A web-based dashboard for monit
  - Service management
  - Network interface control
 Filename: secubox-app-webapp_1.5.0-r7_all.ipk
-Size: 39176
+Size: 39173
 
 Package: secubox-app-zigbee2mqtt
 Version: 1.0.0-r3
@@ -1727,7 +1763,7 @@ Installed-Size: 20480
 Description:  Installer, configuration, and service manager for running Zigbee2MQTT
  inside an Alpine LXC container on SecuBox-powered OpenWrt systems.
 Filename: secubox-app-zigbee2mqtt_1.0.0-r3_all.ipk
-Size: 5542
+Size: 5539
 
 Package: secubox-config-advisor
 Version: 0.1.0-r1
@@ -1746,7 +1782,7 @@ Description:  AI-powered configuration security advisor for SecuBox.
  - LocalAI integration for intelligent analysis
  - Automated remediation suggestions
 Filename: secubox-config-advisor_0.1.0-r1_all.ipk
-Size: 14849
+Size: 14847
 
 Package: secubox-content-pkg
 Version: 1.0.0-r1
@@ -1759,7 +1795,7 @@ Installed-Size: 20480
 Description:  Package Metablogizer sites and Streamlit apps as IPKs for P2P distribution.
  Auto-publishes content to the mesh feed for peer auto-sync.
 Filename: secubox-content-pkg_1.0.0-r1_all.ipk
-Size: 3908
+Size: 3909
 
 Package: secubox-cookie-tracker
 Version: 1.0.0-r1
@@ -1782,7 +1818,7 @@ Description:  Cookie Tracker for SecuBox InterceptoR.
  
  Works with secubox-app-mitmproxy for transparent interception.
 Filename: secubox-cookie-tracker_1.0.0-r1_all.ipk
-Size: 10644
+Size: 10643
 
 Package: secubox-core
 Version: 0.10.0-r16
@@ -1802,7 +1838,7 @@ Description:  SecuBox Core Framework provides the foundational infrastructure fo
  - Unified CLI interface
  - ubus RPC backend
 Filename: secubox-core_0.10.0-r16_all.ipk
-Size: 127205
+Size: 127204
 
 Package: secubox-cve-triage
 Version: 1.0.0-r1
@@ -1822,7 +1858,7 @@ Description:  AI-powered CVE analysis and vulnerability management agent for Sec
  - Approval workflow for patch recommendations
  - LXC and Docker package monitoring
 Filename: secubox-cve-triage_1.0.0-r1_all.ipk
-Size: 11826
+Size: 11829
 
 Package: secubox-dns-guard
 Version: 1.0.0-r1
@@ -1841,7 +1877,7 @@ Description:  SecuBox DNS Guard provides AI-powered DNS anomaly detection using
  - Unusual TLD pattern detection
  - Automatic blocklist generation with approval workflow
 Filename: secubox-dns-guard_1.0.0-r1_all.ipk
-Size: 12486
+Size: 12482
 
 Package: secubox-identity
 Version: 0.1.0-r1
@@ -1860,7 +1896,7 @@ Description:  Decentralized identity management for SecuBox mesh nodes.
  - Peer identity verification
  - Trust scoring integration
 Filename: secubox-identity_0.1.0-r1_all.ipk
-Size: 8084
+Size: 8090
 
 Package: secubox-iot-guard
 Version: 1.0.0-r1
@@ -1876,7 +1912,7 @@ Description:  IoT device isolation, classification, and security monitoring.
  risk scoring. Orchestrates Client Guardian, MAC Guardian
  Vortex Firewall, and Bandwidth Manager for IoT protection.
 Filename: secubox-iot-guard_1.0.0-r1_all.ipk
-Size: 13371
+Size: 13363
 
 Package: secubox-localrecall
 Version: 1.0.0-r1
@@ -1891,7 +1927,7 @@ Description:  Persistent memory system for SecuBox AI agents.
  for context across sessions. LocalAI integration for
  semantic search and AI-powered summarization.
 Filename: secubox-localrecall_1.0.0-r1_all.ipk
-Size: 7795
+Size: 7793
 
 Package: secubox-master-link
 Version: 1.0.0-r1
@@ -1913,7 +1949,7 @@ Description:  Secure mesh onboarding for SecuBox nodes via master/peer link.
  
  Configure in /etc/config/master-link.
 Filename: secubox-master-link_1.0.0-r1_all.ipk
-Size: 15035
+Size: 15034
 
 Package: secubox-mcp-server
 Version: 1.0.0-r1
@@ -1941,7 +1977,7 @@ Description:  Model Context Protocol (MCP) server for SecuBox.
  - ai.explain_ban (Explain CrowdSec decisions)
  - ai.security_posture (Security assessment)
 Filename: secubox-mcp-server_1.0.0-r1_all.ipk
-Size: 11431
+Size: 11428
 
 Package: secubox-mirrornet
 Version: 0.1.0-r1
@@ -1974,7 +2010,7 @@ Description:  AI-powered network anomaly detection for SecuBox.
  DNS anomalies, and protocol anomalies using statistical
  analysis and optional LocalAI integration.
 Filename: secubox-network-anomaly_1.0.0-r1_all.ipk
-Size: 6165
+Size: 6166
 
 Package: secubox-p2p
 Version: 0.6.0-r3
@@ -1993,7 +2029,7 @@ Description:  SecuBox P2P Hub backend providing peer discovery, mesh networking
  and MirrorBox NetMesh Catalog for cross-chain distributed service
  registry with HAProxy vhost discovery and multi-endpoint access URLs.
 Filename: secubox-p2p_0.6.0-r3_all.ipk
-Size: 47860
+Size: 47858
 
 Package: secubox-p2p-intel
 Version: 0.1.0-r1
@@ -2031,7 +2067,7 @@ Description:  Autonomous threat analysis agent for SecuBox.
  
  Part of SecuBox AI Gateway (Couche 2).
 Filename: secubox-threat-analyst_1.0.0-r1_all.ipk
-Size: 9867
+Size: 9866
 
 Package: secubox-vortex-dns
 Version: 1.0.0-r1
@@ -2050,7 +2086,7 @@ Description:  Meshed multi-dynamic subdomain delegation system for SecuBox.
  - Gossip-based exposure config sync
  - Submastering for nested hierarchies
 Filename: secubox-vortex-dns_1.0.0-r1_all.ipk
-Size: 5438
+Size: 5439
 
 Package: secubox-vortex-firewall
 Version: 1.0.0-r1
@@ -2065,5 +2101,5 @@ Description:  DNS-level threat blocking with x47 impact multiplier.
  any connection is established. Integrates threat feeds from
  abuse.ch, OpenPhish, and local DNS Guard detections.
 Filename: secubox-vortex-firewall_1.0.0-r1_all.ipk
-Size: 8895
+Size: 8893
 
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages.gz b/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages.gz
index ae6ba943..85bf6a6e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages.gz and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/Packages.gz differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/apps-local.json b/package/secubox/secubox-app-bonus/root/www/secubox-feed/apps-local.json
index bb0fc9d2..1214a08e 100644
--- a/package/secubox/secubox-app-bonus/root/www/secubox-feed/apps-local.json
+++ b/package/secubox/secubox-app-bonus/root/www/secubox-feed/apps-local.json
@@ -1,12 +1,24 @@
 {
   "feed_url": "/secubox-feed",
-  "generated": "2026-02-28T09:13:34+01:00",
+  "generated": "2026-03-04T07:36:19+01:00",
   "packages": [
+    {
+      "name": "luci-app-ai-gateway",
+      "version": "1.0.0-r1",
+      "filename": "luci-app-ai-gateway_1.0.0-r1_all.ipk",
+      "size": 10787,
+      "category": "utility",
+      "icon": "package",
+      "description": "SecuBox package",
+      "installed": false,
+      "luci_app": null
+    }
+,
     {
       "name": "luci-app-ai-insights",
       "version": "1.0.0-r1",
       "filename": "luci-app-ai-insights_1.0.0-r1_all.ipk",
-      "size": 11639,
+      "size": 11635,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -18,7 +30,7 @@
       "name": "luci-app-auth-guardian",
       "version": "0.4.0-r3",
       "filename": "luci-app-auth-guardian_0.4.0-r3_all.ipk",
-      "size": 12397,
+      "size": 12393,
       "category": "security",
       "icon": "key",
       "description": "Authentication management",
@@ -30,7 +42,7 @@
       "name": "luci-app-backup",
       "version": "1.0.0-r1",
       "filename": "luci-app-backup_1.0.0-r1_all.ipk",
-      "size": 4534,
+      "size": 4535,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -42,7 +54,7 @@
       "name": "luci-app-bandwidth-manager",
       "version": "0.5.0-r2",
       "filename": "luci-app-bandwidth-manager_0.5.0-r2_all.ipk",
-      "size": 61686,
+      "size": 61684,
       "category": "network",
       "icon": "activity",
       "description": "Bandwidth monitoring and control",
@@ -54,7 +66,7 @@
       "name": "luci-app-cdn-cache",
       "version": "0.5.0-r3",
       "filename": "luci-app-cdn-cache_0.5.0-r3_all.ipk",
-      "size": 24254,
+      "size": 24252,
       "category": "network",
       "icon": "globe",
       "description": "CDN caching",
@@ -66,7 +78,7 @@
       "name": "luci-app-client-guardian",
       "version": "0.4.0-r7",
       "filename": "luci-app-client-guardian_0.4.0-r7_all.ipk",
-      "size": 52686,
+      "size": 52682,
       "category": "network",
       "icon": "users",
       "description": "Client management and monitoring",
@@ -78,7 +90,7 @@
       "name": "luci-app-cloner",
       "version": "1.0.0-r1",
       "filename": "luci-app-cloner_1.0.0-r1_all.ipk",
-      "size": 19434,
+      "size": 19431,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -90,7 +102,7 @@
       "name": "luci-app-config-advisor",
       "version": "1.0.0-r1",
       "filename": "luci-app-config-advisor_1.0.0-r1_all.ipk",
-      "size": 8861,
+      "size": 8858,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -102,7 +114,7 @@
       "name": "luci-app-cookie-tracker",
       "version": "1.0.0-r1",
       "filename": "luci-app-cookie-tracker_1.0.0-r1_all.ipk",
-      "size": 5660,
+      "size": 5657,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -114,7 +126,7 @@
       "name": "luci-app-crowdsec-dashboard",
       "version": "0.8.0-r1",
       "filename": "luci-app-crowdsec-dashboard_0.8.0-r1_all.ipk",
-      "size": 43023,
+      "size": 43021,
       "category": "security",
       "icon": "shield",
       "description": "CrowdSec security monitoring",
@@ -126,7 +138,7 @@
       "name": "luci-app-cve-triage",
       "version": "1.0.0-r1",
       "filename": "luci-app-cve-triage_1.0.0-r1_all.ipk",
-      "size": 5945,
+      "size": 5942,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -138,7 +150,7 @@
       "name": "luci-app-cyberfeed",
       "version": "0.1.1-r1",
       "filename": "luci-app-cyberfeed_0.1.1-r1_all.ipk",
-      "size": 12887,
+      "size": 12884,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -150,7 +162,7 @@
       "name": "luci-app-device-intel",
       "version": "1.0.0-r1",
       "filename": "luci-app-device-intel_1.0.0-r1_all.ipk",
-      "size": 12049,
+      "size": 12047,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -162,7 +174,7 @@
       "name": "luci-app-dnsguard",
       "version": "1.1.0-r1",
       "filename": "luci-app-dnsguard_1.1.0-r1_all.ipk",
-      "size": 12448,
+      "size": 12446,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -174,7 +186,7 @@
       "name": "luci-app-dns-provider",
       "version": "1.0.0-r1",
       "filename": "luci-app-dns-provider_1.0.0-r1_all.ipk",
-      "size": 7175,
+      "size": 7166,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -198,7 +210,7 @@
       "name": "luci-app-exposure",
       "version": "1.0.0-r3",
       "filename": "luci-app-exposure_1.0.0-r3_all.ipk",
-      "size": 11700,
+      "size": 11699,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -210,7 +222,7 @@
       "name": "luci-app-gitea",
       "version": "1.0.0-r2",
       "filename": "luci-app-gitea_1.0.0-r2_all.ipk",
-      "size": 16622,
+      "size": 16620,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -222,7 +234,7 @@
       "name": "luci-app-glances",
       "version": "1.0.0-r2",
       "filename": "luci-app-glances_1.0.0-r2_all.ipk",
-      "size": 7016,
+      "size": 7017,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -234,7 +246,7 @@
       "name": "luci-app-gotosocial",
       "version": "0.1.0-r1",
       "filename": "luci-app-gotosocial_0.1.0-r1_all.ipk",
-      "size": 8209,
+      "size": 8208,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -246,7 +258,7 @@
       "name": "luci-app-haproxy",
       "version": "1.0.0-r8",
       "filename": "luci-app-haproxy_1.0.0-r8_all.ipk",
-      "size": 35340,
+      "size": 35342,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -258,7 +270,7 @@
       "name": "luci-app-hexojs",
       "version": "1.0.0-r3",
       "filename": "luci-app-hexojs_1.0.0-r3_all.ipk",
-      "size": 30453,
+      "size": 30451,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -282,7 +294,7 @@
       "name": "luci-app-ipblocklist",
       "version": "1.0.0-r1",
       "filename": "luci-app-ipblocklist_1.0.0-r1_all.ipk",
-      "size": 6529,
+      "size": 6528,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -306,7 +318,7 @@
       "name": "luci-app-jellyfin",
       "version": "1.0.0-r1",
       "filename": "luci-app-jellyfin_1.0.0-r1_all.ipk",
-      "size": 10485,
+      "size": 10486,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -318,7 +330,7 @@
       "name": "luci-app-jitsi",
       "version": "1.0.0-r1",
       "filename": "luci-app-jitsi_1.0.0-r1_all.ipk",
-      "size": 5180,
+      "size": 5175,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -330,7 +342,7 @@
       "name": "luci-app-ksm-manager",
       "version": "0.4.0-r2",
       "filename": "luci-app-ksm-manager_0.4.0-r2_all.ipk",
-      "size": 18783,
+      "size": 18778,
       "category": "system",
       "icon": "cpu",
       "description": "Kernel memory management",
@@ -342,7 +354,7 @@
       "name": "luci-app-localai",
       "version": "0.1.0-r15",
       "filename": "luci-app-localai_0.1.0-r15_all.ipk",
-      "size": 13321,
+      "size": 13317,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -354,7 +366,7 @@
       "name": "luci-app-localrecall",
       "version": "1.0.0-r1",
       "filename": "luci-app-localrecall_1.0.0-r1_all.ipk",
-      "size": 8423,
+      "size": 8415,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -378,7 +390,7 @@
       "name": "luci-app-mac-guardian",
       "version": "0.5.0-r1",
       "filename": "luci-app-mac-guardian_0.5.0-r1_all.ipk",
-      "size": 6669,
+      "size": 6660,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -390,7 +402,7 @@
       "name": "luci-app-magicmirror2",
       "version": "0.4.0-r6",
       "filename": "luci-app-magicmirror2_0.4.0-r6_all.ipk",
-      "size": 12361,
+      "size": 12359,
       "category": "iot",
       "icon": "monitor",
       "description": "Smart mirror display",
@@ -402,7 +414,7 @@
       "name": "luci-app-mailinabox",
       "version": "1.0.0-r1",
       "filename": "luci-app-mailinabox_1.0.0-r1_all.ipk",
-      "size": 5483,
+      "size": 5484,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -414,7 +426,7 @@
       "name": "luci-app-mailserver",
       "version": "1.0.0-r1",
       "filename": "luci-app-mailserver_1.0.0-r1_all.ipk",
-      "size": 6508,
+      "size": 6515,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -426,7 +438,7 @@
       "name": "luci-app-master-link",
       "version": "1.0.0-r1",
       "filename": "luci-app-master-link_1.0.0-r1_all.ipk",
-      "size": 6306,
+      "size": 6305,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -438,7 +450,7 @@
       "name": "luci-app-matrix",
       "version": "1.0.0-r1",
       "filename": "luci-app-matrix_1.0.0-r1_all.ipk",
-      "size": 7527,
+      "size": 7524,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -450,7 +462,7 @@
       "name": "luci-app-media-flow",
       "version": "0.6.4-r1",
       "filename": "luci-app-media-flow_0.6.4-r1_all.ipk",
-      "size": 25382,
+      "size": 25380,
       "category": "media",
       "icon": "film",
       "description": "Media streaming",
@@ -462,7 +474,7 @@
       "name": "luci-app-metablogizer",
       "version": "1.1.0-r1",
       "filename": "luci-app-metablogizer_1.1.0-r1_all.ipk",
-      "size": 26204,
+      "size": 26205,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -474,7 +486,7 @@
       "name": "luci-app-metabolizer",
       "version": "1.0.0-r2",
       "filename": "luci-app-metabolizer_1.0.0-r2_all.ipk",
-      "size": 4820,
+      "size": 4825,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -498,7 +510,7 @@
       "name": "luci-app-mmpm",
       "version": "0.2.0-r3",
       "filename": "luci-app-mmpm_0.2.0-r3_all.ipk",
-      "size": 7974,
+      "size": 7969,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -522,7 +534,7 @@
       "name": "luci-app-ndpid",
       "version": "1.1.2-r2",
       "filename": "luci-app-ndpid_1.1.2-r2_all.ipk",
-      "size": 21700,
+      "size": 21701,
       "category": "security",
       "icon": "eye",
       "description": "Deep packet inspection",
@@ -546,7 +558,7 @@
       "name": "luci-app-network-anomaly",
       "version": "1.0.0-r1",
       "filename": "luci-app-network-anomaly_1.0.0-r1_all.ipk",
-      "size": 7644,
+      "size": 7646,
       "category": "network",
       "icon": "wifi",
       "description": "Network configuration",
@@ -570,7 +582,7 @@
       "name": "luci-app-network-tweaks",
       "version": "1.0.0-r7",
       "filename": "luci-app-network-tweaks_1.0.0-r7_all.ipk",
-      "size": 15948,
+      "size": 15947,
       "category": "network",
       "icon": "wifi",
       "description": "Network configuration",
@@ -582,7 +594,7 @@
       "name": "luci-app-nextcloud",
       "version": "1.0.0-r1",
       "filename": "luci-app-nextcloud_1.0.0-r1_all.ipk",
-      "size": 10350,
+      "size": 10351,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -594,7 +606,7 @@
       "name": "luci-app-ollama",
       "version": "0.1.0-r1",
       "filename": "luci-app-ollama_0.1.0-r1_all.ipk",
-      "size": 14334,
+      "size": 14333,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -606,7 +618,7 @@
       "name": "luci-app-openclaw",
       "version": "1.0.0-r1",
       "filename": "luci-app-openclaw_1.0.0-r1_all.ipk",
-      "size": 8414,
+      "size": 8412,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -618,7 +630,7 @@
       "name": "luci-app-peertube",
       "version": "0",
       "filename": "luci-app-peertube_0_all.ipk",
-      "size": 5755,
+      "size": 5757,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -630,7 +642,7 @@
       "name": "luci-app-picobrew",
       "version": "1.0.0-r1",
       "filename": "luci-app-picobrew_1.0.0-r1_all.ipk",
-      "size": 9534,
+      "size": 9535,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -642,7 +654,7 @@
       "name": "luci-app-secubox",
       "version": "0.7.1-r4",
       "filename": "luci-app-secubox_0.7.1-r4_all.ipk",
-      "size": 82094,
+      "size": 82095,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -654,7 +666,7 @@
       "name": "luci-app-secubox-admin",
       "version": "1.0.0-r19",
       "filename": "luci-app-secubox-admin_1.0.0-r19_all.ipk",
-      "size": 58041,
+      "size": 58039,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -666,7 +678,7 @@
       "name": "luci-app-secubox-crowdsec",
       "version": "1.0.0-r3",
       "filename": "luci-app-secubox-crowdsec_1.0.0-r3_all.ipk",
-      "size": 13920,
+      "size": 13916,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -678,7 +690,7 @@
       "name": "luci-app-secubox-mirror",
       "version": "0.1.0-r1",
       "filename": "luci-app-secubox-mirror_0.1.0-r1_all.ipk",
-      "size": 5850,
+      "size": 5847,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -690,7 +702,7 @@
       "name": "luci-app-secubox-netdiag",
       "version": "1.0.0-r1",
       "filename": "luci-app-secubox-netdiag_1.0.0-r1_all.ipk",
-      "size": 15346,
+      "size": 15344,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -702,7 +714,7 @@
       "name": "luci-app-secubox-netifyd",
       "version": "1.2.1-r1",
       "filename": "luci-app-secubox-netifyd_1.2.1-r1_all.ipk",
-      "size": 36721,
+      "size": 36720,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -714,7 +726,7 @@
       "name": "luci-app-secubox-p2p",
       "version": "0.1.0-r1",
       "filename": "luci-app-secubox-p2p_0.1.0-r1_all.ipk",
-      "size": 46834,
+      "size": 46832,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -726,7 +738,7 @@
       "name": "luci-app-secubox-portal",
       "version": "0.7.0-r3",
       "filename": "luci-app-secubox-portal_0.7.0-r3_all.ipk",
-      "size": 41685,
+      "size": 41682,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -738,7 +750,7 @@
       "name": "luci-app-secubox-security-threats",
       "version": "1.0.0-r4",
       "filename": "luci-app-secubox-security-threats_1.0.0-r4_all.ipk",
-      "size": 10659,
+      "size": 10656,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -750,7 +762,7 @@
       "name": "luci-app-secubox-users",
       "version": "1.0.0-r1",
       "filename": "luci-app-secubox-users_1.0.0-r1_all.ipk",
-      "size": 5147,
+      "size": 5144,
       "category": "system",
       "icon": "box",
       "description": "SecuBox system component",
@@ -762,7 +774,7 @@
       "name": "luci-app-service-registry",
       "version": "1.0.0-r1",
       "filename": "luci-app-service-registry_1.0.0-r1_all.ipk",
-      "size": 39954,
+      "size": 39952,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -774,7 +786,7 @@
       "name": "luci-app-simplex",
       "version": "1.0.0-r1",
       "filename": "luci-app-simplex_1.0.0-r1_all.ipk",
-      "size": 7041,
+      "size": 7035,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -786,7 +798,7 @@
       "name": "luci-app-streamlit",
       "version": "1.0.0-r11",
       "filename": "luci-app-streamlit_1.0.0-r11_all.ipk",
-      "size": 20569,
+      "size": 20565,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -798,7 +810,7 @@
       "name": "luci-app-system-hub",
       "version": "0.5.2-r2",
       "filename": "luci-app-system-hub_0.5.2-r2_all.ipk",
-      "size": 64290,
+      "size": 64292,
       "category": "system",
       "icon": "settings",
       "description": "System management",
@@ -810,7 +822,7 @@
       "name": "luci-app-threat-analyst",
       "version": "1.0.0-r1",
       "filename": "luci-app-threat-analyst_1.0.0-r1_all.ipk",
-      "size": 10144,
+      "size": 10142,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -822,7 +834,7 @@
       "name": "luci-app-tor",
       "version": "1.0.0-r1",
       "filename": "luci-app-tor_1.0.0-r1_all.ipk",
-      "size": 17818,
+      "size": 17816,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -834,7 +846,7 @@
       "name": "luci-app-tor-shield",
       "version": "1.0.0-r10",
       "filename": "luci-app-tor-shield_1.0.0-r10_all.ipk",
-      "size": 22766,
+      "size": 22763,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -846,7 +858,7 @@
       "name": "luci-app-traffic-shaper",
       "version": "0.4.0-r2",
       "filename": "luci-app-traffic-shaper_0.4.0-r2_all.ipk",
-      "size": 14591,
+      "size": 14587,
       "category": "network",
       "icon": "filter",
       "description": "Traffic shaping and QoS",
@@ -858,7 +870,7 @@
       "name": "luci-app-vhost-manager",
       "version": "0.5.0-r5",
       "filename": "luci-app-vhost-manager_0.5.0-r5_all.ipk",
-      "size": 26283,
+      "size": 26278,
       "category": "network",
       "icon": "server",
       "description": "Virtual host management",
@@ -870,7 +882,7 @@
       "name": "luci-app-voip",
       "version": "1.0.0-r1",
       "filename": "luci-app-voip_1.0.0-r1_all.ipk",
-      "size": 11045,
+      "size": 11040,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -882,7 +894,7 @@
       "name": "luci-app-vortex-dns",
       "version": "1.0.0-r1",
       "filename": "luci-app-vortex-dns_1.0.0-r1_all.ipk",
-      "size": 6077,
+      "size": 6074,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -894,7 +906,7 @@
       "name": "luci-app-vortex-firewall",
       "version": "1.0.0-r1",
       "filename": "luci-app-vortex-firewall_1.0.0-r1_all.ipk",
-      "size": 5453,
+      "size": 5452,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -906,7 +918,7 @@
       "name": "luci-app-wazuh",
       "version": "1.0.0-r1",
       "filename": "luci-app-wazuh_1.0.0-r1_all.ipk",
-      "size": 11070,
+      "size": 11068,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -918,7 +930,7 @@
       "name": "luci-app-wireguard-dashboard",
       "version": "0.7.0-r5",
       "filename": "luci-app-wireguard-dashboard_0.7.0-r5_all.ipk",
-      "size": 42290,
+      "size": 42284,
       "category": "vpn",
       "icon": "shield",
       "description": "WireGuard VPN dashboard",
@@ -930,7 +942,7 @@
       "name": "luci-app-zigbee2mqtt",
       "version": "1.0.0-r2",
       "filename": "luci-app-zigbee2mqtt_1.0.0-r2_all.ipk",
-      "size": 6598,
+      "size": 6594,
       "category": "iot",
       "icon": "radio",
       "description": "Zigbee device management",
@@ -942,19 +954,31 @@
       "name": "luci-theme-secubox",
       "version": "0.4.8-r1",
       "filename": "luci-theme-secubox_0.4.8-r1_all.ipk",
-      "size": 121590,
+      "size": 121588,
       "category": "theme",
       "icon": "palette",
       "description": "LuCI theme",
       "installed": false,
       "luci_app": null
     }
+,
+    {
+      "name": "secubox-ai-gateway",
+      "version": "1.0.0-r1",
+      "filename": "secubox-ai-gateway_1.0.0-r1_all.ipk",
+      "size": 13665,
+      "category": "utility",
+      "icon": "package",
+      "description": "SecuBox package",
+      "installed": false,
+      "luci_app": null
+    }
 ,
     {
       "name": "secubox-app",
       "version": "1.0.0-r2",
       "filename": "secubox-app_1.0.0-r2_all.ipk",
-      "size": 11187,
+      "size": 11185,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -966,7 +990,7 @@
       "name": "secubox-app-adguardhome",
       "version": "1.0.0-r2",
       "filename": "secubox-app-adguardhome_1.0.0-r2_all.ipk",
-      "size": 2878,
+      "size": 2881,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -978,7 +1002,7 @@
       "name": "secubox-app-auth-logger",
       "version": "1.2.2-r1",
       "filename": "secubox-app-auth-logger_1.2.2-r1_all.ipk",
-      "size": 9378,
+      "size": 9371,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -990,7 +1014,7 @@
       "name": "secubox-app-crowdsec-custom",
       "version": "1.1.0-r1",
       "filename": "secubox-app-crowdsec-custom_1.1.0-r1_all.ipk",
-      "size": 6942,
+      "size": 6946,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1014,7 +1038,7 @@
       "name": "secubox-app-cyberfeed",
       "version": "0.2.1-r1",
       "filename": "secubox-app-cyberfeed_0.2.1-r1_all.ipk",
-      "size": 12452,
+      "size": 12450,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1026,7 +1050,7 @@
       "name": "secubox-app-device-intel",
       "version": "1.0.0-r1",
       "filename": "secubox-app-device-intel_1.0.0-r1_all.ipk",
-      "size": 13105,
+      "size": 13098,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1038,7 +1062,7 @@
       "name": "secubox-app-dns-provider",
       "version": "1.0.0-r1",
       "filename": "secubox-app-dns-provider_1.0.0-r1_all.ipk",
-      "size": 8262,
+      "size": 8258,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1050,7 +1074,7 @@
       "name": "secubox-app-domoticz",
       "version": "1.0.0-r4",
       "filename": "secubox-app-domoticz_1.0.0-r4_all.ipk",
-      "size": 7507,
+      "size": 7513,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1062,7 +1086,7 @@
       "name": "secubox-app-exposure",
       "version": "1.0.0-r1",
       "filename": "secubox-app-exposure_1.0.0-r1_all.ipk",
-      "size": 9151,
+      "size": 9147,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1086,7 +1110,7 @@
       "name": "secubox-app-gk2hub",
       "version": "0.1.0-r1",
       "filename": "secubox-app-gk2hub_0.1.0-r1_all.ipk",
-      "size": 4057,
+      "size": 4060,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1098,7 +1122,7 @@
       "name": "secubox-app-glances",
       "version": "1.0.0-r1",
       "filename": "secubox-app-glances_1.0.0-r1_all.ipk",
-      "size": 6140,
+      "size": 6142,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1110,7 +1134,7 @@
       "name": "secubox-app-guacamole",
       "version": "1.0.0-r1",
       "filename": "secubox-app-guacamole_1.0.0-r1_all.ipk",
-      "size": 6946,
+      "size": 6942,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1122,7 +1146,7 @@
       "name": "secubox-app-haproxy",
       "version": "1.0.0-r24",
       "filename": "secubox-app-haproxy_1.0.0-r24_all.ipk",
-      "size": 22009,
+      "size": 22005,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1134,7 +1158,7 @@
       "name": "secubox-app-hexojs",
       "version": "1.0.0-r8",
       "filename": "secubox-app-hexojs_1.0.0-r8_all.ipk",
-      "size": 100058,
+      "size": 100054,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1146,7 +1170,7 @@
       "name": "secubox-app-ipblocklist",
       "version": "1.0.0-r1",
       "filename": "secubox-app-ipblocklist_1.0.0-r1_all.ipk",
-      "size": 4702,
+      "size": 4701,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1158,7 +1182,7 @@
       "name": "secubox-app-jabber",
       "version": "1.0.0-r1",
       "filename": "secubox-app-jabber_1.0.0-r1_all.ipk",
-      "size": 13278,
+      "size": 13277,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1170,7 +1194,7 @@
       "name": "secubox-app-jellyfin",
       "version": "3.0.0-r1",
       "filename": "secubox-app-jellyfin_3.0.0-r1_all.ipk",
-      "size": 4754,
+      "size": 4755,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1182,7 +1206,7 @@
       "name": "secubox-app-jitsi",
       "version": "1.0.0-r1",
       "filename": "secubox-app-jitsi_1.0.0-r1_all.ipk",
-      "size": 8923,
+      "size": 8926,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1194,7 +1218,7 @@
       "name": "secubox-app-localai",
       "version": "3.9.0-r1",
       "filename": "secubox-app-localai_3.9.0-r1_all.ipk",
-      "size": 5833,
+      "size": 5838,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1206,7 +1230,7 @@
       "name": "secubox-app-localai-wb",
       "version": "2.25.0-r1",
       "filename": "secubox-app-localai-wb_2.25.0-r1_all.ipk",
-      "size": 7950,
+      "size": 7949,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1218,7 +1242,7 @@
       "name": "secubox-app-lyrion",
       "version": "2.0.2-r1",
       "filename": "secubox-app-lyrion_2.0.2-r1_all.ipk",
-      "size": 8124,
+      "size": 8127,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1230,7 +1254,7 @@
       "name": "secubox-app-mac-guardian",
       "version": "0.5.0-r1",
       "filename": "secubox-app-mac-guardian_0.5.0-r1_all.ipk",
-      "size": 12099,
+      "size": 12097,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1242,7 +1266,7 @@
       "name": "secubox-app-magicmirror2",
       "version": "0.4.0-r8",
       "filename": "secubox-app-magicmirror2_0.4.0-r8_all.ipk",
-      "size": 9251,
+      "size": 9250,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1254,7 +1278,7 @@
       "name": "secubox-app-mailinabox",
       "version": "2.0.0-r1",
       "filename": "secubox-app-mailinabox_2.0.0-r1_all.ipk",
-      "size": 7570,
+      "size": 7569,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1266,7 +1290,7 @@
       "name": "secubox-app-mailserver",
       "version": "2.0.0-r1",
       "filename": "secubox-app-mailserver_2.0.0-r1_all.ipk",
-      "size": 5699,
+      "size": 5704,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1278,7 +1302,7 @@
       "name": "secubox-app-matrix",
       "version": "1.0.0-r1",
       "filename": "secubox-app-matrix_1.0.0-r1_all.ipk",
-      "size": 10454,
+      "size": 10448,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1290,7 +1314,7 @@
       "name": "secubox-app-metabolizer",
       "version": "1.0.0-r3",
       "filename": "secubox-app-metabolizer_1.0.0-r3_all.ipk",
-      "size": 13980,
+      "size": 13979,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1314,7 +1338,7 @@
       "name": "secubox-app-mmpm",
       "version": "0.2.0-r5",
       "filename": "secubox-app-mmpm_0.2.0-r5_all.ipk",
-      "size": 3977,
+      "size": 3976,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1326,7 +1350,7 @@
       "name": "secubox-app-nextcloud",
       "version": "1.0.0-r2",
       "filename": "secubox-app-nextcloud_1.0.0-r2_all.ipk",
-      "size": 9672,
+      "size": 9675,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1338,7 +1362,7 @@
       "name": "secubox-app-ollama",
       "version": "0.1.0-r1",
       "filename": "secubox-app-ollama_0.1.0-r1_all.ipk",
-      "size": 5739,
+      "size": 5735,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1350,7 +1374,7 @@
       "name": "secubox-app-picobrew",
       "version": "1.0.0-r7",
       "filename": "secubox-app-picobrew_1.0.0-r7_all.ipk",
-      "size": 5542,
+      "size": 5539,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1362,7 +1386,7 @@
       "name": "secubox-app-rustdesk",
       "version": "1.0.0-r1",
       "filename": "secubox-app-rustdesk_1.0.0-r1_all.ipk",
-      "size": 4465,
+      "size": 4463,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1374,7 +1398,7 @@
       "name": "secubox-app-simplex",
       "version": "1.0.0-r1",
       "filename": "secubox-app-simplex_1.0.0-r1_all.ipk",
-      "size": 9368,
+      "size": 9364,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1386,7 +1410,7 @@
       "name": "secubox-app-smbfs",
       "version": "1.0.0-r1",
       "filename": "secubox-app-smbfs_1.0.0-r1_all.ipk",
-      "size": 5266,
+      "size": 5269,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1410,7 +1434,7 @@
       "name": "secubox-app-tor",
       "version": "1.0.0-r1",
       "filename": "secubox-app-tor_1.0.0-r1_all.ipk",
-      "size": 7374,
+      "size": 7367,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1422,7 +1446,7 @@
       "name": "secubox-app-voip",
       "version": "1.0.0-r1",
       "filename": "secubox-app-voip_1.0.0-r1_all.ipk",
-      "size": 11957,
+      "size": 11955,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1434,7 +1458,7 @@
       "name": "secubox-app-webapp",
       "version": "1.5.0-r7",
       "filename": "secubox-app-webapp_1.5.0-r7_all.ipk",
-      "size": 39176,
+      "size": 39173,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1446,7 +1470,7 @@
       "name": "secubox-app-zigbee2mqtt",
       "version": "1.0.0-r3",
       "filename": "secubox-app-zigbee2mqtt_1.0.0-r3_all.ipk",
-      "size": 5542,
+      "size": 5539,
       "category": "secubox",
       "icon": "package",
       "description": "SecuBox backend service",
@@ -1458,7 +1482,7 @@
       "name": "secubox-config-advisor",
       "version": "0.1.0-r1",
       "filename": "secubox-config-advisor_0.1.0-r1_all.ipk",
-      "size": 14849,
+      "size": 14847,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1470,7 +1494,7 @@
       "name": "secubox-content-pkg",
       "version": "1.0.0-r1",
       "filename": "secubox-content-pkg_1.0.0-r1_all.ipk",
-      "size": 3908,
+      "size": 3909,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1482,7 +1506,7 @@
       "name": "secubox-cookie-tracker",
       "version": "1.0.0-r1",
       "filename": "secubox-cookie-tracker_1.0.0-r1_all.ipk",
-      "size": 10644,
+      "size": 10643,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1494,7 +1518,7 @@
       "name": "secubox-core",
       "version": "0.10.0-r16",
       "filename": "secubox-core_0.10.0-r16_all.ipk",
-      "size": 127205,
+      "size": 127204,
       "category": "system",
       "icon": "box",
       "description": "SecuBox core components",
@@ -1506,7 +1530,7 @@
       "name": "secubox-cve-triage",
       "version": "1.0.0-r1",
       "filename": "secubox-cve-triage_1.0.0-r1_all.ipk",
-      "size": 11826,
+      "size": 11829,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1518,7 +1542,7 @@
       "name": "secubox-dns-guard",
       "version": "1.0.0-r1",
       "filename": "secubox-dns-guard_1.0.0-r1_all.ipk",
-      "size": 12486,
+      "size": 12482,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1530,7 +1554,7 @@
       "name": "secubox-identity",
       "version": "0.1.0-r1",
       "filename": "secubox-identity_0.1.0-r1_all.ipk",
-      "size": 8084,
+      "size": 8090,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1542,7 +1566,7 @@
       "name": "secubox-iot-guard",
       "version": "1.0.0-r1",
       "filename": "secubox-iot-guard_1.0.0-r1_all.ipk",
-      "size": 13371,
+      "size": 13363,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1554,7 +1578,7 @@
       "name": "secubox-localrecall",
       "version": "1.0.0-r1",
       "filename": "secubox-localrecall_1.0.0-r1_all.ipk",
-      "size": 7795,
+      "size": 7793,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1566,7 +1590,7 @@
       "name": "secubox-master-link",
       "version": "1.0.0-r1",
       "filename": "secubox-master-link_1.0.0-r1_all.ipk",
-      "size": 15035,
+      "size": 15034,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1578,7 +1602,7 @@
       "name": "secubox-mcp-server",
       "version": "1.0.0-r1",
       "filename": "secubox-mcp-server_1.0.0-r1_all.ipk",
-      "size": 11431,
+      "size": 11428,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1602,7 +1626,7 @@
       "name": "secubox-network-anomaly",
       "version": "1.0.0-r1",
       "filename": "secubox-network-anomaly_1.0.0-r1_all.ipk",
-      "size": 6165,
+      "size": 6166,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1614,7 +1638,7 @@
       "name": "secubox-p2p",
       "version": "0.6.0-r3",
       "filename": "secubox-p2p_0.6.0-r3_all.ipk",
-      "size": 47860,
+      "size": 47858,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1638,7 +1662,7 @@
       "name": "secubox-threat-analyst",
       "version": "1.0.0-r1",
       "filename": "secubox-threat-analyst_1.0.0-r1_all.ipk",
-      "size": 9867,
+      "size": 9866,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1650,7 +1674,7 @@
       "name": "secubox-vortex-dns",
       "version": "1.0.0-r1",
       "filename": "secubox-vortex-dns_1.0.0-r1_all.ipk",
-      "size": 5438,
+      "size": 5439,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
@@ -1662,7 +1686,7 @@
       "name": "secubox-vortex-firewall",
       "version": "1.0.0-r1",
       "filename": "secubox-vortex-firewall_1.0.0-r1_all.ipk",
-      "size": 8895,
+      "size": 8893,
       "category": "utility",
       "icon": "package",
       "description": "SecuBox package",
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ai-gateway_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ai-gateway_1.0.0-r1_all.ipk
new file mode 100644
index 00000000..171f7611
Binary files /dev/null and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ai-gateway_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ai-insights_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ai-insights_1.0.0-r1_all.ipk
index 4c7deed1..a8fbbf6b 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ai-insights_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ai-insights_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-auth-guardian_0.4.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-auth-guardian_0.4.0-r3_all.ipk
index eee9e412..186a7574 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-auth-guardian_0.4.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-auth-guardian_0.4.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-backup_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-backup_1.0.0-r1_all.ipk
index efb6e429..13a653ca 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-backup_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-backup_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-bandwidth-manager_0.5.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-bandwidth-manager_0.5.0-r2_all.ipk
index 8318c8aa..024a9008 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-bandwidth-manager_0.5.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-bandwidth-manager_0.5.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cdn-cache_0.5.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cdn-cache_0.5.0-r3_all.ipk
index bce669dd..633c8ccb 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cdn-cache_0.5.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cdn-cache_0.5.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-client-guardian_0.4.0-r7_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-client-guardian_0.4.0-r7_all.ipk
index 2c4d495b..1faf00bd 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-client-guardian_0.4.0-r7_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-client-guardian_0.4.0-r7_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cloner_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cloner_1.0.0-r1_all.ipk
index fbc05e58..fb1090d0 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cloner_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cloner_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-config-advisor_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-config-advisor_1.0.0-r1_all.ipk
index 410f6337..aca69498 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-config-advisor_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-config-advisor_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cookie-tracker_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cookie-tracker_1.0.0-r1_all.ipk
index 23a2564d..e8040d01 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cookie-tracker_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cookie-tracker_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-crowdsec-dashboard_0.8.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-crowdsec-dashboard_0.8.0-r1_all.ipk
index f2c52054..db7ef36f 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-crowdsec-dashboard_0.8.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-crowdsec-dashboard_0.8.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cve-triage_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cve-triage_1.0.0-r1_all.ipk
index 4ac65a77..226d642e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cve-triage_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cve-triage_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cyberfeed_0.1.1-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cyberfeed_0.1.1-r1_all.ipk
index 226a3de7..84580a4e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cyberfeed_0.1.1-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-cyberfeed_0.1.1-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-device-intel_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-device-intel_1.0.0-r1_all.ipk
index c57d304d..6bb6f094 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-device-intel_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-device-intel_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-dns-provider_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-dns-provider_1.0.0-r1_all.ipk
index e38e3171..b1b0cc58 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-dns-provider_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-dns-provider_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-dnsguard_1.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-dnsguard_1.1.0-r1_all.ipk
index 24e85fb6..9fabfcbc 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-dnsguard_1.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-dnsguard_1.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-domoticz_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-domoticz_1.0.0-r1_all.ipk
index dd6a2a18..7c06dc2b 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-domoticz_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-domoticz_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-exposure_1.0.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-exposure_1.0.0-r3_all.ipk
index 07d494cc..d3f1905e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-exposure_1.0.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-exposure_1.0.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-gitea_1.0.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-gitea_1.0.0-r2_all.ipk
index ea80c217..bbbb77d1 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-gitea_1.0.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-gitea_1.0.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-glances_1.0.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-glances_1.0.0-r2_all.ipk
index 36534053..6f4e7dc5 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-glances_1.0.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-glances_1.0.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-gotosocial_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-gotosocial_0.1.0-r1_all.ipk
index 2a17afd9..3f69c107 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-gotosocial_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-gotosocial_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-haproxy_1.0.0-r8_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-haproxy_1.0.0-r8_all.ipk
index 28c90e24..36c06bd6 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-haproxy_1.0.0-r8_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-haproxy_1.0.0-r8_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-hexojs_1.0.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-hexojs_1.0.0-r3_all.ipk
index 55d97485..13417efe 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-hexojs_1.0.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-hexojs_1.0.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-iot-guard_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-iot-guard_1.0.0-r1_all.ipk
index 9939bd1d..6d326ade 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-iot-guard_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-iot-guard_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ipblocklist_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ipblocklist_1.0.0-r1_all.ipk
index 5c620cdd..f02b981e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ipblocklist_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ipblocklist_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jabber_0_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jabber_0_all.ipk
index 01c9098b..f144613d 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jabber_0_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jabber_0_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jellyfin_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jellyfin_1.0.0-r1_all.ipk
index 3c56f5fd..349a7028 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jellyfin_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jellyfin_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jitsi_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jitsi_1.0.0-r1_all.ipk
index fc269336..a5efbfe3 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jitsi_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-jitsi_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ksm-manager_0.4.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ksm-manager_0.4.0-r2_all.ipk
index f56af245..f97095aa 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ksm-manager_0.4.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ksm-manager_0.4.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-localai_0.1.0-r15_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-localai_0.1.0-r15_all.ipk
index d66caccc..8fe0cf11 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-localai_0.1.0-r15_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-localai_0.1.0-r15_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-localrecall_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-localrecall_1.0.0-r1_all.ipk
index dd4df5c9..5d42f321 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-localrecall_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-localrecall_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-lyrion_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-lyrion_1.0.0-r1_all.ipk
index 31640fa6..620fbb1d 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-lyrion_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-lyrion_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mac-guardian_0.5.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mac-guardian_0.5.0-r1_all.ipk
index ca459b6b..57997ff9 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mac-guardian_0.5.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mac-guardian_0.5.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-magicmirror2_0.4.0-r6_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-magicmirror2_0.4.0-r6_all.ipk
index a68bb6e3..a7ee7739 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-magicmirror2_0.4.0-r6_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-magicmirror2_0.4.0-r6_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mailinabox_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mailinabox_1.0.0-r1_all.ipk
index 566ebbca..a2668582 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mailinabox_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mailinabox_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mailserver_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mailserver_1.0.0-r1_all.ipk
index a4f4f8df..12885ce7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mailserver_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mailserver_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-master-link_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-master-link_1.0.0-r1_all.ipk
index 8f25d647..43cb4db7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-master-link_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-master-link_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-matrix_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-matrix_1.0.0-r1_all.ipk
index 6870b28f..86223492 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-matrix_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-matrix_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-media-flow_0.6.4-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-media-flow_0.6.4-r1_all.ipk
index deeee821..727f2d5e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-media-flow_0.6.4-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-media-flow_0.6.4-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-metablogizer_1.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-metablogizer_1.1.0-r1_all.ipk
index e0c36d8f..a8f7de46 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-metablogizer_1.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-metablogizer_1.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-metabolizer_1.0.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-metabolizer_1.0.0-r2_all.ipk
index 71667da5..2ae20c2b 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-metabolizer_1.0.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-metabolizer_1.0.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mitmproxy_0.5.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mitmproxy_0.5.0-r2_all.ipk
index 030b1b6d..5c67f3bd 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mitmproxy_0.5.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mitmproxy_0.5.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mmpm_0.2.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mmpm_0.2.0-r3_all.ipk
index 08f43a3a..06c5ba9d 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mmpm_0.2.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mmpm_0.2.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mqtt-bridge_0.4.0-r4_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mqtt-bridge_0.4.0-r4_all.ipk
index 95293d5e..2b0d10de 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mqtt-bridge_0.4.0-r4_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-mqtt-bridge_0.4.0-r4_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ndpid_1.1.2-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ndpid_1.1.2-r2_all.ipk
index 01cd2344..fe8373a7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ndpid_1.1.2-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ndpid_1.1.2-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-netdata-dashboard_0.5.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-netdata-dashboard_0.5.0-r2_all.ipk
index e2ce3c53..6ce3d2e9 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-netdata-dashboard_0.5.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-netdata-dashboard_0.5.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-anomaly_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-anomaly_1.0.0-r1_all.ipk
index e1444038..d908bef7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-anomaly_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-anomaly_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-modes_0.5.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-modes_0.5.0-r3_all.ipk
index 273624ec..f0254af5 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-modes_0.5.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-modes_0.5.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-tweaks_1.0.0-r7_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-tweaks_1.0.0-r7_all.ipk
index 008c6ebc..ff870b2e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-tweaks_1.0.0-r7_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-network-tweaks_1.0.0-r7_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-nextcloud_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-nextcloud_1.0.0-r1_all.ipk
index 80d75cd2..30a70758 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-nextcloud_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-nextcloud_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ollama_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ollama_0.1.0-r1_all.ipk
index 4c19200d..acef4976 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ollama_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-ollama_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-openclaw_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-openclaw_1.0.0-r1_all.ipk
index 00de5553..f16222be 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-openclaw_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-openclaw_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-peertube_0_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-peertube_0_all.ipk
index 22bdb392..bcec0c89 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-peertube_0_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-peertube_0_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-picobrew_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-picobrew_1.0.0-r1_all.ipk
index 1a89a2d5..6b2c1ac4 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-picobrew_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-picobrew_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-admin_1.0.0-r19_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-admin_1.0.0-r19_all.ipk
index f5af91cc..4f24c315 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-admin_1.0.0-r19_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-admin_1.0.0-r19_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-crowdsec_1.0.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-crowdsec_1.0.0-r3_all.ipk
index 28846fad..e8cfcc0d 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-crowdsec_1.0.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-crowdsec_1.0.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-mirror_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-mirror_0.1.0-r1_all.ipk
index b0bd17cb..0facd626 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-mirror_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-mirror_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-netdiag_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-netdiag_1.0.0-r1_all.ipk
index 0020ff16..93ca315a 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-netdiag_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-netdiag_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-netifyd_1.2.1-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-netifyd_1.2.1-r1_all.ipk
index 9e530dc7..09354474 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-netifyd_1.2.1-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-netifyd_1.2.1-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-p2p_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-p2p_0.1.0-r1_all.ipk
index 4b5ef459..a89a6195 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-p2p_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-p2p_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-portal_0.7.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-portal_0.7.0-r3_all.ipk
index 3c0f4c0b..bad3473b 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-portal_0.7.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-portal_0.7.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-security-threats_1.0.0-r4_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-security-threats_1.0.0-r4_all.ipk
index 4ca48cea..0966afd4 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-security-threats_1.0.0-r4_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-security-threats_1.0.0-r4_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-users_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-users_1.0.0-r1_all.ipk
index b7ac242e..08681b73 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-users_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox-users_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox_0.7.1-r4_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox_0.7.1-r4_all.ipk
index 24afbf9b..f63bc23a 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox_0.7.1-r4_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-secubox_0.7.1-r4_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-service-registry_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-service-registry_1.0.0-r1_all.ipk
index 94fe4929..8dbabd06 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-service-registry_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-service-registry_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-simplex_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-simplex_1.0.0-r1_all.ipk
index 6f5d1f09..4d63f079 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-simplex_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-simplex_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-streamlit_1.0.0-r11_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-streamlit_1.0.0-r11_all.ipk
index 44270aa6..cf4bb6d7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-streamlit_1.0.0-r11_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-streamlit_1.0.0-r11_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-system-hub_0.5.2-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-system-hub_0.5.2-r2_all.ipk
index 834a9db2..e9cc1f02 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-system-hub_0.5.2-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-system-hub_0.5.2-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-threat-analyst_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-threat-analyst_1.0.0-r1_all.ipk
index b508e185..1d0edcb2 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-threat-analyst_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-threat-analyst_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-tor-shield_1.0.0-r10_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-tor-shield_1.0.0-r10_all.ipk
index 80372c36..a5fb2cba 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-tor-shield_1.0.0-r10_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-tor-shield_1.0.0-r10_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-tor_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-tor_1.0.0-r1_all.ipk
index 4c30bfec..a0e4b40c 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-tor_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-tor_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-traffic-shaper_0.4.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-traffic-shaper_0.4.0-r2_all.ipk
index 7a94b76c..477771eb 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-traffic-shaper_0.4.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-traffic-shaper_0.4.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vhost-manager_0.5.0-r5_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vhost-manager_0.5.0-r5_all.ipk
index 36f6fef9..e610753b 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vhost-manager_0.5.0-r5_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vhost-manager_0.5.0-r5_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-voip_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-voip_1.0.0-r1_all.ipk
index 977ba748..056ed273 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-voip_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-voip_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vortex-dns_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vortex-dns_1.0.0-r1_all.ipk
index 8d7a1fd1..cf5092d2 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vortex-dns_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vortex-dns_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vortex-firewall_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vortex-firewall_1.0.0-r1_all.ipk
index 5573b5b0..d1dd6f3f 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vortex-firewall_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-vortex-firewall_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wazuh_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wazuh_1.0.0-r1_all.ipk
index dd475f1d..0155cbcc 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wazuh_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wazuh_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wireguard-dashboard_0.7.0-r5_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wireguard-dashboard_0.7.0-r5_all.ipk
index ec7f5c7d..567ed6b7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wireguard-dashboard_0.7.0-r5_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-wireguard-dashboard_0.7.0-r5_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-zigbee2mqtt_1.0.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-zigbee2mqtt_1.0.0-r2_all.ipk
index 71b8f571..6520103d 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-zigbee2mqtt_1.0.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-app-zigbee2mqtt_1.0.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-theme-secubox_0.4.8-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-theme-secubox_0.4.8-r1_all.ipk
index f57fab06..335756ac 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-theme-secubox_0.4.8-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/luci-theme-secubox_0.4.8-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-ai-gateway_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-ai-gateway_1.0.0-r1_all.ipk
new file mode 100644
index 00000000..87de1554
Binary files /dev/null and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-ai-gateway_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-adguardhome_1.0.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-adguardhome_1.0.0-r2_all.ipk
index aa499b61..94dfdbcf 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-adguardhome_1.0.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-adguardhome_1.0.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-auth-logger_1.2.2-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-auth-logger_1.2.2-r1_all.ipk
index 7cae5985..d07ddd60 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-auth-logger_1.2.2-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-auth-logger_1.2.2-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-crowdsec-custom_1.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-crowdsec-custom_1.1.0-r1_all.ipk
index 6a5cb395..bfb40faf 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-crowdsec-custom_1.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-crowdsec-custom_1.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-cs-firewall-bouncer_0.0.31-r4_aarch64_cortex-a72.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-cs-firewall-bouncer_0.0.31-r4_aarch64_cortex-a72.ipk
index c2011fe8..e8113e5e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-cs-firewall-bouncer_0.0.31-r4_aarch64_cortex-a72.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-cs-firewall-bouncer_0.0.31-r4_aarch64_cortex-a72.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-cyberfeed_0.2.1-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-cyberfeed_0.2.1-r1_all.ipk
index 6ef1204c..fa3abb0b 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-cyberfeed_0.2.1-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-cyberfeed_0.2.1-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-device-intel_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-device-intel_1.0.0-r1_all.ipk
index 41550b2d..34fe77ee 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-device-intel_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-device-intel_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-dns-provider_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-dns-provider_1.0.0-r1_all.ipk
index ff7ab6f5..28007a77 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-dns-provider_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-dns-provider_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-domoticz_1.0.0-r4_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-domoticz_1.0.0-r4_all.ipk
index 9a0bcf26..c38416a0 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-domoticz_1.0.0-r4_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-domoticz_1.0.0-r4_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-exposure_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-exposure_1.0.0-r1_all.ipk
index 5e37fce5..018a60b8 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-exposure_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-exposure_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-gitea_1.0.0-r5_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-gitea_1.0.0-r5_all.ipk
index 40eb37a4..4d159854 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-gitea_1.0.0-r5_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-gitea_1.0.0-r5_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-gk2hub_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-gk2hub_0.1.0-r1_all.ipk
index f84932bf..14861897 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-gk2hub_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-gk2hub_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-glances_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-glances_1.0.0-r1_all.ipk
index 50436647..a6e57f58 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-glances_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-glances_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-guacamole_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-guacamole_1.0.0-r1_all.ipk
index 1c618ff2..679b229b 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-guacamole_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-guacamole_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-haproxy_1.0.0-r24_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-haproxy_1.0.0-r24_all.ipk
index 7c64e894..fa7108ae 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-haproxy_1.0.0-r24_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-haproxy_1.0.0-r24_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-hexojs_1.0.0-r8_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-hexojs_1.0.0-r8_all.ipk
index f5ebc203..12ebee95 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-hexojs_1.0.0-r8_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-hexojs_1.0.0-r8_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-ipblocklist_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-ipblocklist_1.0.0-r1_all.ipk
index 04c6db71..748947ca 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-ipblocklist_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-ipblocklist_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jabber_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jabber_1.0.0-r1_all.ipk
index 48596bc4..14d3476c 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jabber_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jabber_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jellyfin_3.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jellyfin_3.0.0-r1_all.ipk
index a755d60f..848aa9ab 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jellyfin_3.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jellyfin_3.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jitsi_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jitsi_1.0.0-r1_all.ipk
index 9d0a94a2..13bdc4c3 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jitsi_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-jitsi_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-localai-wb_2.25.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-localai-wb_2.25.0-r1_all.ipk
index dc7837d5..63177bc5 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-localai-wb_2.25.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-localai-wb_2.25.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-localai_3.9.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-localai_3.9.0-r1_all.ipk
index 3ef9ae6b..ecc487ab 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-localai_3.9.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-localai_3.9.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-lyrion_2.0.2-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-lyrion_2.0.2-r1_all.ipk
index 16f23dc0..4169fbfd 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-lyrion_2.0.2-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-lyrion_2.0.2-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mac-guardian_0.5.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mac-guardian_0.5.0-r1_all.ipk
index 4c184215..5ac5c454 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mac-guardian_0.5.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mac-guardian_0.5.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-magicmirror2_0.4.0-r8_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-magicmirror2_0.4.0-r8_all.ipk
index f5f690fd..d61ded78 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-magicmirror2_0.4.0-r8_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-magicmirror2_0.4.0-r8_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mailinabox_2.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mailinabox_2.0.0-r1_all.ipk
index 14aab583..a809c2eb 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mailinabox_2.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mailinabox_2.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mailserver_2.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mailserver_2.0.0-r1_all.ipk
index 4d502625..74666648 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mailserver_2.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mailserver_2.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-matrix_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-matrix_1.0.0-r1_all.ipk
index 114c8687..b7af4528 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-matrix_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-matrix_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-metabolizer_1.0.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-metabolizer_1.0.0-r3_all.ipk
index 41c66900..3916d6c7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-metabolizer_1.0.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-metabolizer_1.0.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mitmproxy_0.5.0-r19_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mitmproxy_0.5.0-r19_all.ipk
index bc38463f..7c4e2b49 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mitmproxy_0.5.0-r19_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mitmproxy_0.5.0-r19_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mmpm_0.2.0-r5_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mmpm_0.2.0-r5_all.ipk
index 2c1af2cb..7becaabd 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mmpm_0.2.0-r5_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-mmpm_0.2.0-r5_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-nextcloud_1.0.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-nextcloud_1.0.0-r2_all.ipk
index 9c5f9506..720ec893 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-nextcloud_1.0.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-nextcloud_1.0.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-ollama_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-ollama_0.1.0-r1_all.ipk
index 03699710..e16f67ad 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-ollama_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-ollama_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-picobrew_1.0.0-r7_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-picobrew_1.0.0-r7_all.ipk
index 8d9e2fbc..f6b02341 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-picobrew_1.0.0-r7_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-picobrew_1.0.0-r7_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-rustdesk_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-rustdesk_1.0.0-r1_all.ipk
index 6a435110..aa13b287 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-rustdesk_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-rustdesk_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-simplex_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-simplex_1.0.0-r1_all.ipk
index 34a86a3d..e781eb5c 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-simplex_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-simplex_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-smbfs_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-smbfs_1.0.0-r1_all.ipk
index ab2079ab..09cb83c2 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-smbfs_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-smbfs_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-streamlit_1.0.0-r5_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-streamlit_1.0.0-r5_all.ipk
index bfed17b8..4d8b12de 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-streamlit_1.0.0-r5_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-streamlit_1.0.0-r5_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-tor_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-tor_1.0.0-r1_all.ipk
index ec78b3fa..e7aafa6d 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-tor_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-tor_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-voip_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-voip_1.0.0-r1_all.ipk
index e20f08a2..dc912e81 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-voip_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-voip_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-webapp_1.5.0-r7_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-webapp_1.5.0-r7_all.ipk
index 3308355d..64b4af28 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-webapp_1.5.0-r7_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-webapp_1.5.0-r7_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-zigbee2mqtt_1.0.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-zigbee2mqtt_1.0.0-r3_all.ipk
index 8cf32a74..71e636ee 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-zigbee2mqtt_1.0.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app-zigbee2mqtt_1.0.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app_1.0.0-r2_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app_1.0.0-r2_all.ipk
index 2253a488..eb90ded4 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app_1.0.0-r2_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-app_1.0.0-r2_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-config-advisor_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-config-advisor_0.1.0-r1_all.ipk
index 8a729fcc..66aa0d59 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-config-advisor_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-config-advisor_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-content-pkg_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-content-pkg_1.0.0-r1_all.ipk
index d0c0b706..cbbed23b 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-content-pkg_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-content-pkg_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-cookie-tracker_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-cookie-tracker_1.0.0-r1_all.ipk
index e0064d48..eb6f2a46 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-cookie-tracker_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-cookie-tracker_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-core_0.10.0-r16_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-core_0.10.0-r16_all.ipk
index 992adca9..4e48d59e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-core_0.10.0-r16_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-core_0.10.0-r16_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-cve-triage_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-cve-triage_1.0.0-r1_all.ipk
index e73b5879..3d4b8ac5 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-cve-triage_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-cve-triage_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-dns-guard_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-dns-guard_1.0.0-r1_all.ipk
index a91fe440..9c71490e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-dns-guard_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-dns-guard_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-identity_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-identity_0.1.0-r1_all.ipk
index b670e8ff..a789d2f0 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-identity_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-identity_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-iot-guard_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-iot-guard_1.0.0-r1_all.ipk
index 46c86d1b..e72cc1ef 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-iot-guard_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-iot-guard_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-localrecall_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-localrecall_1.0.0-r1_all.ipk
index 4ec4c595..6b3c4cf7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-localrecall_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-localrecall_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-master-link_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-master-link_1.0.0-r1_all.ipk
index 1ed406d0..18e37328 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-master-link_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-master-link_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-mcp-server_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-mcp-server_1.0.0-r1_all.ipk
index 3f1053aa..70f2cd1c 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-mcp-server_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-mcp-server_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-mirrornet_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-mirrornet_0.1.0-r1_all.ipk
index eb480c26..0aa93e8e 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-mirrornet_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-mirrornet_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-network-anomaly_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-network-anomaly_1.0.0-r1_all.ipk
index 77441cfc..bc1e8838 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-network-anomaly_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-network-anomaly_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-p2p-intel_0.1.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-p2p-intel_0.1.0-r1_all.ipk
index e99e84e9..8d1bcff7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-p2p-intel_0.1.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-p2p-intel_0.1.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-p2p_0.6.0-r3_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-p2p_0.6.0-r3_all.ipk
index 2279a846..68e2d17b 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-p2p_0.6.0-r3_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-p2p_0.6.0-r3_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-threat-analyst_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-threat-analyst_1.0.0-r1_all.ipk
index a67b8f34..2011dde7 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-threat-analyst_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-threat-analyst_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-vortex-dns_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-vortex-dns_1.0.0-r1_all.ipk
index 4fcf3b1e..f85aefb0 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-vortex-dns_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-vortex-dns_1.0.0-r1_all.ipk differ
diff --git a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-vortex-firewall_1.0.0-r1_all.ipk b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-vortex-firewall_1.0.0-r1_all.ipk
index b5cc4bf6..0d8accac 100644
Binary files a/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-vortex-firewall_1.0.0-r1_all.ipk and b/package/secubox/secubox-app-bonus/root/www/secubox-feed/secubox-vortex-firewall_1.0.0-r1_all.ipk differ
diff --git a/scripts/check-sbom-prereqs.sh b/scripts/check-sbom-prereqs.sh
new file mode 100755
index 00000000..80e3212b
--- /dev/null
+++ b/scripts/check-sbom-prereqs.sh
@@ -0,0 +1,197 @@
+#!/bin/bash
+# SecuBox SBOM Prerequisites Checker
+# Validates build environment for SBOM generation
+# Part of CRA Annex I compliance pipeline
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TOPDIR="${TOPDIR:-${SCRIPT_DIR}/..}"
+
+# Auto-detect SDK location if not in buildroot
+if [[ ! -f "${TOPDIR}/include/version.mk" ]]; then
+    if [[ -f "${TOPDIR}/secubox-tools/sdk/include/version.mk" ]]; then
+        TOPDIR="${TOPDIR}/secubox-tools/sdk"
+    elif [[ -f "${TOPDIR}/secubox-tools/openwrt/include/version.mk" ]]; then
+        TOPDIR="${TOPDIR}/secubox-tools/openwrt"
+    fi
+fi
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log_ok() { echo -e "${GREEN}[✓]${NC} $*"; }
+log_info() { echo -e "    $*"; }
+log_warn() { echo -e "${YELLOW}[!]${NC} $*"; }
+log_fail() { echo -e "${RED}[✗]${NC} $*"; }
+
+ERRORS=0
+
+check_openwrt_version() {
+    local version_mk="${TOPDIR}/include/version.mk"
+
+    if [[ ! -f "$version_mk" ]]; then
+        log_fail "OpenWrt version.mk not found: $version_mk"
+        echo "    → Ensure you're running from OpenWrt buildroot directory"
+        ((ERRORS++))
+        return
+    fi
+
+    local version_id
+    # Try multiple patterns to extract version number
+    version_id=$(grep -E '^VERSION_NUMBER\s*[:?]?=' "$version_mk" 2>/dev/null | head -1 | sed 's/.*=\s*//' | tr -d ' ')
+
+    # If it contains Makefile variables, try to extract the fallback value
+    if [[ "$version_id" == *'$('* ]]; then
+        # Extract version from patterns like $(if...,VERSION,FALLBACK) or direct number
+        version_id=$(echo "$version_id" | grep -oE '[0-9]+\.[0-9]+(\.[0-9]+)?' | head -1 || echo "")
+    fi
+
+    # Fallback: check for VERSION_CODE or similar
+    if [[ -z "$version_id" ]]; then
+        version_id=$(grep -E '^VERSION_CODE\s*[:?]?=' "$version_mk" 2>/dev/null | head -1 | sed 's/.*=\s*//' | tr -d ' ')
+    fi
+
+    if [[ -z "$version_id" || ! "$version_id" =~ ^[0-9] ]]; then
+        log_warn "Could not determine OpenWrt version from version.mk"
+        log_info "Assuming OpenWrt >= 22.03 (SDK present)"
+        return
+    fi
+
+    local major minor
+    major=$(echo "$version_id" | cut -d'.' -f1)
+    minor=$(echo "$version_id" | cut -d'.' -f2)
+
+    # Handle non-numeric gracefully
+    [[ ! "$major" =~ ^[0-9]+$ ]] && { log_warn "Non-numeric version: $version_id"; return; }
+    [[ ! "$minor" =~ ^[0-9]+$ ]] && minor=0
+
+    if [[ "$major" -lt 22 ]] || { [[ "$major" -eq 22 ]] && [[ "$minor" -lt 3 ]]; }; then
+        log_fail "OpenWrt version $version_id < 22.03 (SBOM support requires 22.03+)"
+        echo "    → Upgrade to OpenWrt 22.03 or later for CONFIG_JSON_CYCLONEDX_SBOM support"
+        ((ERRORS++))
+    else
+        log_ok "OpenWrt version: $version_id (>= 22.03)"
+    fi
+}
+
+check_package_metadata() {
+    local metadata_pl="${TOPDIR}/scripts/package-metadata.pl"
+
+    if [[ -f "$metadata_pl" ]]; then
+        log_ok "package-metadata.pl found"
+
+        if grep -q "cyclonedx" "$metadata_pl" 2>/dev/null; then
+            log_ok "package-metadata.pl has CycloneDX support"
+        else
+            log_warn "package-metadata.pl may not have CycloneDX support (older version?)"
+        fi
+    else
+        log_fail "package-metadata.pl not found: $metadata_pl"
+        echo "    → This script is required for native OpenWrt SBOM generation"
+        ((ERRORS++))
+    fi
+}
+
+check_perl() {
+    local staging_perl="${TOPDIR}/staging_dir/host/bin/perl"
+
+    if [[ -x "$staging_perl" ]]; then
+        log_ok "Perl found in staging_dir: $staging_perl"
+    elif command -v perl &>/dev/null; then
+        log_ok "System Perl found: $(command -v perl)"
+    else
+        log_fail "Perl not found"
+        echo "    → Install perl: apt install perl (Debian/Ubuntu)"
+        ((ERRORS++))
+    fi
+}
+
+check_host_tools() {
+    local tools=("jq" "sha256sum" "git")
+
+    for tool in "${tools[@]}"; do
+        if command -v "$tool" &>/dev/null; then
+            log_ok "$tool found: $(command -v "$tool")"
+        else
+            log_fail "$tool not found"
+            echo "    → Install: apt install $tool (Debian/Ubuntu)"
+            ((ERRORS++))
+        fi
+    done
+}
+
+check_sbom_tools() {
+    local optional_tools=("syft" "grype" "cyclonedx-cli")
+
+    echo ""
+    echo "=== Optional SBOM Tools ==="
+
+    for tool in "${optional_tools[@]}"; do
+        if command -v "$tool" &>/dev/null; then
+            local version
+            case "$tool" in
+                syft) version=$("$tool" version 2>/dev/null | head -1 || echo "unknown") ;;
+                grype) version=$("$tool" version 2>/dev/null | head -1 || echo "unknown") ;;
+                cyclonedx-cli) version=$("$tool" --version 2>/dev/null | head -1 || echo "unknown") ;;
+                *) version="unknown" ;;
+            esac
+            log_ok "$tool found: $version"
+        else
+            log_warn "$tool not found (will be installed by sbom-generate.sh)"
+            echo "    → Manual install: see https://github.com/anchore/$tool"
+        fi
+    done
+}
+
+check_kconfig() {
+    local config="${TOPDIR}/.config"
+
+    echo ""
+    echo "=== Kconfig SBOM Options ==="
+
+    if [[ ! -f "$config" ]]; then
+        log_warn ".config not found - run 'make menuconfig' first"
+        return
+    fi
+
+    if grep -q "^CONFIG_JSON_CYCLONEDX_SBOM=y" "$config" 2>/dev/null; then
+        log_ok "CONFIG_JSON_CYCLONEDX_SBOM=y is set"
+    else
+        log_warn "CONFIG_JSON_CYCLONEDX_SBOM not enabled"
+        echo "    → Add to .config: CONFIG_JSON_CYCLONEDX_SBOM=y"
+        echo "    → Or run: echo 'CONFIG_JSON_CYCLONEDX_SBOM=y' >> .config && make defconfig"
+    fi
+}
+
+main() {
+    echo "=========================================="
+    echo "SecuBox SBOM Prerequisites Check"
+    echo "CRA Annex I Compliance Pipeline"
+    echo "=========================================="
+    echo ""
+
+    echo "=== Core Requirements ==="
+    check_openwrt_version
+    check_package_metadata
+    check_perl
+    check_host_tools
+
+    check_sbom_tools
+    check_kconfig
+
+    echo ""
+    echo "=========================================="
+    if [[ $ERRORS -gt 0 ]]; then
+        log_fail "$ERRORS critical prerequisite(s) missing"
+        echo "Fix the issues above before running SBOM generation."
+        exit 1
+    else
+        log_ok "All prerequisites satisfied"
+        exit 0
+    fi
+}
+
+main "$@"
diff --git a/scripts/sbom-audit-feed.sh b/scripts/sbom-audit-feed.sh
new file mode 100755
index 00000000..222e47a5
--- /dev/null
+++ b/scripts/sbom-audit-feed.sh
@@ -0,0 +1,219 @@
+#!/bin/bash
+# SecuBox Feed Audit Script
+# Audits SecuBox feed Makefiles for SBOM metadata completeness
+#
+# Copyright (C) 2026 CyberMind Produits SASU
+# License: GPL-2.0-only
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TOPDIR="${SCRIPT_DIR}/.."
+FEED_DIR="${FEED_DIR:-${TOPDIR}/feeds/secubox}"
+OUTPUT_DIR="${OUTPUT_DIR:-${FEED_DIR}}"
+
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+NC='\033[0m'
+
+log_ok() { echo -e "${GREEN}[✓]${NC} $*"; }
+log_warn() { echo -e "${YELLOW}[!]${NC} $*"; }
+log_fail() { echo -e "${RED}[✗]${NC} $*"; }
+
+MISSING_HASH=()
+MISSING_LICENSE=()
+PACKAGES=()
+
+# Extract variable from Makefile
+extract_var() {
+    local file="$1"
+    local var="$2"
+    grep -E "^${var}\s*[:?]?=" "$file" 2>/dev/null | head -1 | sed 's/.*=\s*//' | tr -d ' ' || echo ""
+}
+
+# Try to compute hash from downloaded source
+compute_hash() {
+    local pkg_name="$1"
+    local pkg_version="$2"
+
+    local dl_dir="${TOPDIR}/dl"
+    local patterns=(
+        "${dl_dir}/${pkg_name}-${pkg_version}.tar.gz"
+        "${dl_dir}/${pkg_name}-${pkg_version}.tar.xz"
+        "${dl_dir}/${pkg_name}-${pkg_version}.tar.bz2"
+        "${dl_dir}/${pkg_name}_${pkg_version}.orig.tar.gz"
+    )
+
+    for file in "${patterns[@]}"; do
+        if [[ -f "$file" ]]; then
+            sha256sum "$file" | cut -d' ' -f1
+            return 0
+        fi
+    done
+
+    return 1
+}
+
+audit_package() {
+    local makefile="$1"
+    local pkg_dir
+    pkg_dir=$(dirname "$makefile")
+    local dir_name
+    dir_name=$(basename "$pkg_dir")
+
+    local pkg_name pkg_version pkg_license pkg_hash pkg_source_url
+
+    pkg_name=$(extract_var "$makefile" "PKG_NAME")
+    [[ -z "$pkg_name" ]] && pkg_name="$dir_name"
+
+    pkg_version=$(extract_var "$makefile" "PKG_VERSION")
+    [[ -z "$pkg_version" ]] && pkg_version="unknown"
+
+    pkg_license=$(extract_var "$makefile" "PKG_LICENSE")
+    pkg_hash=$(extract_var "$makefile" "PKG_HASH")
+    pkg_source_url=$(extract_var "$makefile" "PKG_SOURCE_URL")
+
+    # Check for missing hash
+    local hash_status="❌ MISSING"
+    local computed_hash=""
+    if [[ -n "$pkg_hash" && "$pkg_hash" != "skip" ]]; then
+        hash_status="✅ ${pkg_hash:0:12}..."
+    else
+        # Try to compute from local download
+        computed_hash=$(compute_hash "$pkg_name" "$pkg_version" 2>/dev/null || echo "")
+        if [[ -n "$computed_hash" ]]; then
+            hash_status="⚠️ COMPUTED: ${computed_hash:0:12}..."
+        else
+            MISSING_HASH+=("$pkg_name")
+        fi
+    fi
+
+    # Check for missing license
+    local license_status="❌ MISSING"
+    if [[ -n "$pkg_license" ]]; then
+        license_status="$pkg_license"
+    else
+        MISSING_LICENSE+=("$pkg_name")
+    fi
+
+    # Store package info
+    PACKAGES+=("$pkg_name|$pkg_version|$license_status|$hash_status|${pkg_source_url:-N/A}")
+
+    # Output computed hash suggestion if found
+    if [[ -n "$computed_hash" && ( -z "$pkg_hash" || "$pkg_hash" == "skip" ) ]]; then
+        echo "  → Suggested: PKG_HASH:=${computed_hash}" >&2
+    fi
+}
+
+generate_manifest() {
+    local manifest="${OUTPUT_DIR}/MANIFEST.md"
+
+    cat > "$manifest" <<EOF
+# SecuBox Feed — Package Manifest
+_Generated by scripts/sbom-audit-feed.sh — $(date -Iseconds)_
+
+| Package | Version | License | PKG_HASH | Source URL |
+|---------|---------|---------|----------|------------|
+EOF
+
+    for pkg_info in "${PACKAGES[@]}"; do
+        IFS='|' read -r name version license hash source <<< "$pkg_info"
+        echo "| $name | $version | $license | $hash | $source |" >> "$manifest"
+    done
+
+    cat >> "$manifest" <<EOF
+
+## Summary
+
+- **Total packages:** ${#PACKAGES[@]}
+- **Missing PKG_HASH:** ${#MISSING_HASH[@]}
+- **Missing PKG_LICENSE:** ${#MISSING_LICENSE[@]}
+
+EOF
+
+    if [[ ${#MISSING_HASH[@]} -gt 0 ]]; then
+        echo "### Packages Missing PKG_HASH" >> "$manifest"
+        echo "" >> "$manifest"
+        for pkg in "${MISSING_HASH[@]}"; do
+            echo "- \`$pkg\`" >> "$manifest"
+        done
+        echo "" >> "$manifest"
+    fi
+
+    if [[ ${#MISSING_LICENSE[@]} -gt 0 ]]; then
+        echo "### Packages Missing PKG_LICENSE" >> "$manifest"
+        echo "" >> "$manifest"
+        for pkg in "${MISSING_LICENSE[@]}"; do
+            echo "- \`$pkg\`" >> "$manifest"
+        done
+        echo "" >> "$manifest"
+    fi
+
+    log_ok "Generated: $manifest"
+}
+
+main() {
+    echo "=========================================="
+    echo "SecuBox Feed Audit"
+    echo "=========================================="
+    echo ""
+
+    if [[ ! -d "$FEED_DIR" ]]; then
+        log_fail "Feed directory not found: $FEED_DIR"
+        exit 1
+    fi
+
+    echo "Scanning: $FEED_DIR"
+    echo ""
+
+    local count=0
+    for makefile in "$FEED_DIR"/*/Makefile; do
+        [[ -f "$makefile" ]] || continue
+        ((count++))
+        audit_package "$makefile"
+    done
+
+    echo ""
+    echo "=========================================="
+    echo "Audit Results"
+    echo "=========================================="
+    echo ""
+
+    echo "Total packages: $count"
+    echo "Missing PKG_HASH: ${#MISSING_HASH[@]}"
+    echo "Missing PKG_LICENSE: ${#MISSING_LICENSE[@]}"
+    echo ""
+
+    generate_manifest
+
+    if [[ ${#MISSING_HASH[@]} -gt 0 || ${#MISSING_LICENSE[@]} -gt 0 ]]; then
+        echo ""
+        log_warn "Some packages have missing metadata (see MANIFEST.md)"
+
+        if [[ ${#MISSING_HASH[@]} -gt 0 ]]; then
+            echo ""
+            echo "Packages missing PKG_HASH:"
+            for pkg in "${MISSING_HASH[@]}"; do
+                echo "  - $pkg"
+            done
+        fi
+
+        if [[ ${#MISSING_LICENSE[@]} -gt 0 ]]; then
+            echo ""
+            echo "Packages missing PKG_LICENSE:"
+            for pkg in "${MISSING_LICENSE[@]}"; do
+                echo "  - $pkg"
+            done
+        fi
+
+        echo ""
+        log_fail "Fix missing metadata for CRA compliance"
+        exit 1
+    else
+        log_ok "All packages have required metadata"
+        exit 0
+    fi
+}
+
+main "$@"
diff --git a/scripts/sbom-generate.sh b/scripts/sbom-generate.sh
new file mode 100755
index 00000000..e1ba65f9
--- /dev/null
+++ b/scripts/sbom-generate.sh
@@ -0,0 +1,665 @@
+#!/bin/bash
+# SecuBox SBOM Generation Pipeline
+# Generates CycloneDX 1.6 + SPDX 2.3 for CRA Annex I compliance
+# Covers: OpenWrt buildroot, SecuBox feed, rootfs, firmware image
+#
+# Copyright (C) 2026 CyberMind Produits SASU
+# License: GPL-2.0-only
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TOPDIR="${SCRIPT_DIR}/.."
+
+# Defaults
+VERSION="${VERSION:-}"
+ARCH="${ARCH:-aarch64_cortex-a53}"
+OFFLINE="${OFFLINE:-false}"
+NO_CVE="${NO_CVE:-false}"
+OUTPUT_DIR="${OUTPUT_DIR:-${TOPDIR}/dist/sbom}"
+ROOTFS_DIR="${ROOTFS_DIR:-${TOPDIR}/build_dir/target-${ARCH}_musl/root-mvebu}"
+FIRMWARE_DIR="${FIRMWARE_DIR:-${TOPDIR}/bin/targets/mvebu/cortexa53}"
+FEED_DIR="${FEED_DIR:-${TOPDIR}/feeds/secubox}"
+
+# Tool paths (local install fallback)
+LOCAL_BIN="${HOME}/.local/bin"
+SYFT="${SYFT:-$(command -v syft 2>/dev/null || echo "${LOCAL_BIN}/syft")}"
+GRYPE="${GRYPE:-$(command -v grype 2>/dev/null || echo "${LOCAL_BIN}/grype")}"
+CYCLONEDX_CLI="${CYCLONEDX_CLI:-$(command -v cyclonedx-cli 2>/dev/null || echo "${LOCAL_BIN}/cyclonedx-cli")}"
+
+# Colors
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+YELLOW='\033[1;33m'
+BLUE='\033[0;34m'
+NC='\033[0m'
+
+log_info() { echo -e "${BLUE}[INFO]${NC} $*"; }
+log_ok() { echo -e "${GREEN}[OK]${NC} $*"; }
+log_warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
+log_error() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
+
+usage() {
+    cat <<EOF
+SecuBox SBOM Generation Pipeline
+CRA Annex I Compliance - CycloneDX 1.6 + SPDX 2.3
+
+Usage: $0 [OPTIONS]
+
+Options:
+  --version VERSION    Firmware version (default: from ./version or git describe)
+  --arch ARCH          Target architecture (default: aarch64_cortex-a53)
+  --offline            Offline mode - no network access
+  --no-cve             Skip CVE scan
+  --output-dir DIR     Output directory (default: dist/sbom)
+  --help               Show this help
+
+Environment:
+  SOURCE_DATE_EPOCH    Reproducible timestamp (auto-set from git)
+  ROOTFS_DIR           Path to rootfs build directory
+  FIRMWARE_DIR         Path to firmware output directory
+
+Examples:
+  $0                           # Auto-detect version, full pipeline
+  $0 --version 0.20            # Explicit version
+  $0 --offline --no-cve        # Offline mode, skip CVE
+EOF
+    exit 0
+}
+
+# Validate version string (security)
+validate_version() {
+    local ver="$1"
+    # Strip 'v' prefix if present
+    ver="${ver#v}"
+    # Allow: X.Y, X.Y.Z, X.Y.Z-tag, X.Y.Z-tag-N-gHASH (git describe)
+    if [[ ! "$ver" =~ ^[0-9]+\.[0-9]+([.-][a-zA-Z0-9_-]+)*$ ]]; then
+        log_error "Invalid version format: $ver"
+        log_error "Expected: X.Y or X.Y.Z or X.Y-tag or git describe format"
+        exit 1
+    fi
+}
+
+# Validate architecture (security)
+validate_arch() {
+    local arch="$1"
+    local allowed="aarch64_cortex-a53|aarch64_cortex-a72|x86_64|arm_cortex-a9"
+    if [[ ! "$arch" =~ ^($allowed)$ ]]; then
+        log_error "Invalid architecture: $arch"
+        log_error "Allowed: $allowed"
+        exit 1
+    fi
+}
+
+# Parse arguments
+parse_args() {
+    while [[ $# -gt 0 ]]; do
+        case "$1" in
+            --version) VERSION="$2"; shift 2 ;;
+            --arch) ARCH="$2"; shift 2 ;;
+            --offline) OFFLINE="true"; shift ;;
+            --no-cve) NO_CVE="true"; shift ;;
+            --output-dir) OUTPUT_DIR="$2"; shift 2 ;;
+            --help|-h) usage ;;
+            *) log_error "Unknown option: $1"; usage ;;
+        esac
+    done
+}
+
+# 2.0 - Set reproducible timestamp
+setup_reproducibility() {
+    if [[ -z "${SOURCE_DATE_EPOCH:-}" ]]; then
+        if [[ -d "${TOPDIR}/.git" ]]; then
+            export SOURCE_DATE_EPOCH=$(git -C "$TOPDIR" log -1 --pretty=%ct 2>/dev/null || date +%s)
+        else
+            export SOURCE_DATE_EPOCH=$(date +%s)
+        fi
+    fi
+    log_info "SOURCE_DATE_EPOCH: $SOURCE_DATE_EPOCH ($(date -d "@$SOURCE_DATE_EPOCH" -Iseconds 2>/dev/null || date -r "$SOURCE_DATE_EPOCH" -Iseconds))"
+}
+
+# 2.1 - Check and install tools
+install_tool() {
+    local tool="$1"
+    local url="${2:-}"
+
+    if [[ "$OFFLINE" == "true" ]]; then
+        log_error "Tool $tool not found and --offline mode enabled"
+        exit 1
+    fi
+
+    log_info "Installing $tool to ${LOCAL_BIN}..."
+    mkdir -p "$LOCAL_BIN"
+
+    local tmpdir
+    tmpdir=$(mktemp -d)
+    trap "rm -rf '$tmpdir'" EXIT
+
+    case "$tool" in
+        syft)
+            curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b "$LOCAL_BIN"
+            ;;
+        grype)
+            curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b "$LOCAL_BIN"
+            ;;
+        cyclonedx-cli)
+            local arch_suffix="linux-x64"
+            [[ "$(uname -m)" == "aarch64" ]] && arch_suffix="linux-arm64"
+            curl -sSfL -o "${LOCAL_BIN}/cyclonedx-cli" \
+                "https://github.com/CycloneDX/cyclonedx-cli/releases/latest/download/cyclonedx-${arch_suffix}"
+            chmod +x "${LOCAL_BIN}/cyclonedx-cli"
+            ;;
+    esac
+
+    trap - EXIT
+    rm -rf "$tmpdir"
+}
+
+check_tools() {
+    log_info "Checking required tools..."
+
+    local required_tools=("jq" "sha256sum")
+    for tool in "${required_tools[@]}"; do
+        if ! command -v "$tool" &>/dev/null; then
+            log_error "Required tool not found: $tool"
+            exit 1
+        fi
+    done
+
+    # Syft
+    if [[ ! -x "$SYFT" ]] && ! command -v syft &>/dev/null; then
+        install_tool syft
+        SYFT="${LOCAL_BIN}/syft"
+    fi
+    log_ok "syft: $($SYFT version 2>/dev/null | head -1 || echo 'installed')"
+
+    # Grype (optional for CVE scan)
+    if [[ "$NO_CVE" != "true" ]]; then
+        if [[ ! -x "$GRYPE" ]] && ! command -v grype &>/dev/null; then
+            install_tool grype
+            GRYPE="${LOCAL_BIN}/grype"
+        fi
+        log_ok "grype: $($GRYPE version 2>/dev/null | head -1 || echo 'installed')"
+    fi
+
+    # cyclonedx-cli
+    if [[ ! -x "$CYCLONEDX_CLI" ]] && ! command -v cyclonedx-cli &>/dev/null; then
+        install_tool cyclonedx-cli
+        CYCLONEDX_CLI="${LOCAL_BIN}/cyclonedx-cli"
+    fi
+    log_ok "cyclonedx-cli: $($CYCLONEDX_CLI --version 2>/dev/null | head -1 || echo 'installed')"
+}
+
+# 2.2 - Cible A: Native OpenWrt SBOM from ipk
+generate_sbom_native() {
+    log_info "[A] Generating SBOM from OpenWrt native Packages.manifest..."
+
+    local manifest="${TOPDIR}/bin/packages/${ARCH}/secubox/Packages.manifest"
+    local native_cdx="${TOPDIR}/bin/packages/${ARCH}/secubox/Packages.cdx.json"
+
+    if [[ -f "$native_cdx" ]]; then
+        log_ok "Native CycloneDX found: $native_cdx"
+        cp "$native_cdx" "${OUTPUT_DIR}/secubox-${VERSION}-native.cdx.json"
+        return 0
+    fi
+
+    if [[ -f "$manifest" ]]; then
+        log_warn "Packages.manifest found but no .cdx.json - ensure CONFIG_JSON_CYCLONEDX_SBOM=y"
+        # Generate basic SBOM from manifest
+        generate_sbom_from_manifest "$manifest" "${OUTPUT_DIR}/secubox-${VERSION}-native.cdx.json"
+    else
+        log_warn "No Packages.manifest found at $manifest"
+    fi
+}
+
+# Generate SBOM from Packages.manifest
+generate_sbom_from_manifest() {
+    local manifest="$1"
+    local output="$2"
+
+    log_info "Parsing Packages.manifest..."
+
+    local components="[]"
+    local pkg_name="" pkg_version="" pkg_license=""
+
+    while IFS= read -r line || [[ -n "$line" ]]; do
+        case "$line" in
+            Package:*)
+                pkg_name="${line#Package: }"
+                ;;
+            Version:*)
+                pkg_version="${line#Version: }"
+                ;;
+            License:*)
+                pkg_license="${line#License: }"
+                ;;
+            "")
+                if [[ -n "$pkg_name" && -n "$pkg_version" ]]; then
+                    local component
+                    component=$(jq -n \
+                        --arg name "$pkg_name" \
+                        --arg version "$pkg_version" \
+                        --arg license "${pkg_license:-unknown}" \
+                        '{
+                            type: "library",
+                            name: $name,
+                            version: $version,
+                            purl: "pkg:openwrt/\($name)@\($version)",
+                            licenses: [{license: {id: $license}}]
+                        }')
+                    components=$(echo "$components" | jq --argjson c "$component" '. + [$c]')
+                fi
+                pkg_name="" pkg_version="" pkg_license=""
+                ;;
+        esac
+    done < "$manifest"
+
+    jq -n \
+        --arg version "$VERSION" \
+        --arg timestamp "$(date -d "@$SOURCE_DATE_EPOCH" -Iseconds 2>/dev/null || date -r "$SOURCE_DATE_EPOCH" -Iseconds)" \
+        --argjson components "$components" \
+        '{
+            bomFormat: "CycloneDX",
+            specVersion: "1.6",
+            serialNumber: "urn:uuid:'$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)'",
+            version: 1,
+            metadata: {
+                timestamp: $timestamp,
+                component: {
+                    type: "firmware",
+                    name: "SecuBox-native",
+                    version: $version
+                }
+            },
+            components: $components
+        }' > "$output"
+
+    log_ok "Generated native SBOM: $output"
+}
+
+# 2.3 - Cible B: Feed SecuBox Makefiles
+generate_sbom_feed() {
+    log_info "[B] Generating SBOM from SecuBox feed Makefiles..."
+
+    local components="[]"
+    local warnings="${OUTPUT_DIR}/sbom-warnings.txt"
+    > "$warnings"
+
+    if [[ ! -d "$FEED_DIR" ]]; then
+        log_warn "Feed directory not found: $FEED_DIR"
+        return 0
+    fi
+
+    local count=0
+    for makefile in "$FEED_DIR"/*/Makefile; do
+        [[ -f "$makefile" ]] || continue
+
+        local pkg_dir
+        pkg_dir=$(dirname "$makefile")
+        local pkg_name="" pkg_version="" pkg_source="" pkg_hash="" pkg_license=""
+
+        # Extract variables from Makefile
+        pkg_name=$(grep -E '^PKG_NAME\s*[:?]?=' "$makefile" 2>/dev/null | head -1 | sed 's/.*=\s*//' | tr -d ' ')
+        pkg_version=$(grep -E '^PKG_VERSION\s*[:?]?=' "$makefile" 2>/dev/null | head -1 | sed 's/.*=\s*//' | tr -d ' ')
+        pkg_source=$(grep -E '^PKG_SOURCE_URL\s*[:?]?=' "$makefile" 2>/dev/null | head -1 | sed 's/.*=\s*//')
+        pkg_hash=$(grep -E '^PKG_HASH\s*[:?]?=' "$makefile" 2>/dev/null | head -1 | sed 's/.*=\s*//' | tr -d ' ')
+        pkg_license=$(grep -E '^PKG_LICENSE\s*[:?]?=' "$makefile" 2>/dev/null | head -1 | sed 's/.*=\s*//' | tr -d ' ')
+
+        # Fallback to directory name
+        [[ -z "$pkg_name" ]] && pkg_name=$(basename "$pkg_dir")
+        [[ -z "$pkg_version" ]] && pkg_version="0.0.0"
+
+        # Warnings for missing metadata
+        if [[ -z "$pkg_hash" || "$pkg_hash" == "skip" ]]; then
+            echo "MISSING PKG_HASH: $pkg_name ($makefile)" >> "$warnings"
+        fi
+        if [[ -z "$pkg_license" ]]; then
+            echo "MISSING PKG_LICENSE: $pkg_name ($makefile)" >> "$warnings"
+        fi
+
+        # Build component
+        local component
+        component=$(jq -n \
+            --arg name "$pkg_name" \
+            --arg version "$pkg_version" \
+            --arg license "${pkg_license:-unknown}" \
+            --arg source "${pkg_source:-}" \
+            --arg hash "${pkg_hash:-}" \
+            '{
+                type: "library",
+                name: $name,
+                version: $version,
+                purl: "pkg:openwrt/\($name)@\($version)",
+                licenses: [{license: {id: $license}}],
+                externalReferences: (if $source != "" then [{type: "distribution", url: $source}] else [] end),
+                hashes: (if $hash != "" and $hash != "skip" then [{alg: "SHA-256", content: $hash}] else [] end)
+            }')
+        components=$(echo "$components" | jq --argjson c "$component" '. + [$c]')
+        ((count++))
+    done
+
+    # Generate feed SBOM
+    jq -n \
+        --arg version "$VERSION" \
+        --arg timestamp "$(date -d "@$SOURCE_DATE_EPOCH" -Iseconds 2>/dev/null || date -r "$SOURCE_DATE_EPOCH" -Iseconds)" \
+        --argjson components "$components" \
+        '{
+            bomFormat: "CycloneDX",
+            specVersion: "1.6",
+            serialNumber: "urn:uuid:'$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)'",
+            version: 1,
+            metadata: {
+                timestamp: $timestamp,
+                component: {
+                    type: "firmware",
+                    name: "SecuBox-feed",
+                    version: $version
+                }
+            },
+            components: $components
+        }' > "${OUTPUT_DIR}/secubox-${VERSION}-feed.cdx.json"
+
+    log_ok "Feed SBOM: $count packages"
+
+    if [[ -s "$warnings" ]]; then
+        log_warn "Metadata warnings: $(wc -l < "$warnings") issues (see $warnings)"
+    fi
+}
+
+# 2.4 - Cible C: Rootfs scan with Syft
+generate_sbom_rootfs() {
+    log_info "[C] Generating SBOM from rootfs with Syft..."
+
+    if [[ ! -d "$ROOTFS_DIR" ]]; then
+        log_warn "Rootfs directory not found: $ROOTFS_DIR"
+        return 0
+    fi
+
+    "$SYFT" packages "dir:${ROOTFS_DIR}" \
+        --source-name "SecuBox-rootfs" \
+        --source-version "${VERSION}" \
+        -o "cyclonedx-json=${OUTPUT_DIR}/secubox-${VERSION}-rootfs.cdx.json" \
+        -o "spdx-json=${OUTPUT_DIR}/secubox-${VERSION}-rootfs.spdx.json"
+
+    log_ok "Rootfs SBOM generated"
+}
+
+# 2.5 - Cible D: Firmware image scan
+generate_sbom_firmware() {
+    log_info "[D] Generating SBOM from firmware images..."
+
+    if [[ ! -d "$FIRMWARE_DIR" ]]; then
+        log_warn "Firmware directory not found: $FIRMWARE_DIR"
+        return 0
+    fi
+
+    local found=0
+    for fw in "$FIRMWARE_DIR"/secubox-*.bin "$FIRMWARE_DIR"/*.img.gz; do
+        [[ -f "$fw" ]] || continue
+        found=1
+
+        local fw_name
+        fw_name=$(basename "$fw")
+        log_info "Scanning firmware: $fw_name"
+
+        "$SYFT" packages "file:${fw}" \
+            --source-name "SecuBox-firmware" \
+            --source-version "${VERSION}" \
+            -o "cyclonedx-json=${OUTPUT_DIR}/secubox-${VERSION}-firmware.cdx.json" || {
+            log_warn "Syft failed on $fw_name (may be binary blob)"
+        }
+        break  # Only process first firmware
+    done
+
+    if [[ $found -eq 0 ]]; then
+        log_warn "No firmware images found in $FIRMWARE_DIR"
+    fi
+}
+
+# 2.6 - Merge SBOMs
+merge_sboms() {
+    log_info "Merging SBOMs from all sources..."
+
+    local all_components="[]"
+    local sbom_files=()
+
+    # Collect all partial SBOMs
+    for sbom in "${OUTPUT_DIR}"/secubox-${VERSION}-*.cdx.json; do
+        [[ -f "$sbom" ]] || continue
+        sbom_files+=("$sbom")
+        local components
+        components=$(jq '.components // []' "$sbom")
+        all_components=$(echo "$all_components" | jq --argjson c "$components" '. + $c')
+    done
+
+    # Deduplicate by (name, version)
+    local unique_components
+    unique_components=$(echo "$all_components" | jq 'unique_by(.name + "@" + .version)')
+
+    local component_count
+    component_count=$(echo "$unique_components" | jq 'length')
+
+    # Generate merged SBOM with full metadata
+    jq -n \
+        --arg version "$VERSION" \
+        --arg timestamp "$(date -d "@$SOURCE_DATE_EPOCH" -Iseconds 2>/dev/null || date -r "$SOURCE_DATE_EPOCH" -Iseconds)" \
+        --arg serial "urn:uuid:$(uuidgen 2>/dev/null || cat /proc/sys/kernel/random/uuid)" \
+        --argjson components "$unique_components" \
+        '{
+            bomFormat: "CycloneDX",
+            specVersion: "1.6",
+            serialNumber: $serial,
+            version: 1,
+            metadata: {
+                timestamp: $timestamp,
+                component: {
+                    type: "firmware",
+                    name: "SecuBox",
+                    version: $version,
+                    supplier: {
+                        name: "CyberMind Produits SASU",
+                        contact: [{email: "secubox@cybermind.fr"}]
+                    },
+                    manufacturer: {
+                        name: "CyberMind Produits SASU",
+                        url: ["https://cybermind.fr"]
+                    },
+                    licenses: [{license: {id: "GPL-2.0-only"}}],
+                    externalReferences: [
+                        {type: "website", url: "https://secubox.in"},
+                        {type: "vcs", url: "https://github.com/cybermind/secubox"},
+                        {type: "documentation", url: "https://secubox.in/docs/cra"}
+                    ]
+                },
+                tools: [{
+                    vendor: "Anchore",
+                    name: "syft",
+                    version: "'$($SYFT version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || echo "unknown")'"
+                }]
+            },
+            components: $components
+        }' > "${OUTPUT_DIR}/secubox-${VERSION}.cdx.json"
+
+    log_ok "Merged SBOM: $component_count unique components"
+
+    # Also generate SPDX version
+    if command -v "$CYCLONEDX_CLI" &>/dev/null; then
+        "$CYCLONEDX_CLI" convert \
+            --input-file "${OUTPUT_DIR}/secubox-${VERSION}.cdx.json" \
+            --output-file "${OUTPUT_DIR}/secubox-${VERSION}.spdx.json" \
+            --output-format spdxjson 2>/dev/null || {
+            log_warn "SPDX conversion failed (cyclonedx-cli issue)"
+        }
+    fi
+}
+
+# 2.7 - Validate SBOM
+validate_sbom() {
+    log_info "Validating CycloneDX SBOM..."
+
+    local sbom="${OUTPUT_DIR}/secubox-${VERSION}.cdx.json"
+
+    if ! "$CYCLONEDX_CLI" validate \
+        --input-format json \
+        --input-file "$sbom" \
+        --fail-on-errors 2>&1; then
+        log_error "SBOM validation failed"
+        exit 1
+    fi
+
+    log_ok "SBOM validation passed"
+}
+
+# 2.8 - CVE scan
+scan_cve() {
+    if [[ "$NO_CVE" == "true" ]]; then
+        log_info "Skipping CVE scan (--no-cve)"
+        return 0
+    fi
+
+    log_info "Scanning for CVEs with Grype..."
+
+    local sbom="${OUTPUT_DIR}/secubox-${VERSION}.cdx.json"
+
+    "$GRYPE" "sbom:${sbom}" \
+        --output table \
+        --file "${OUTPUT_DIR}/secubox-${VERSION}-cve-table.txt" || true
+
+    "$GRYPE" "sbom:${sbom}" \
+        --output json \
+        --file "${OUTPUT_DIR}/secubox-${VERSION}-cve-report.json" || true
+
+    log_ok "CVE scan complete: ${OUTPUT_DIR}/secubox-${VERSION}-cve-report.json"
+}
+
+# 2.9 - Generate CRA summary report
+generate_cra_summary() {
+    log_info "Generating CRA compliance summary..."
+
+    local sbom="${OUTPUT_DIR}/secubox-${VERSION}.cdx.json"
+    local timestamp
+    timestamp=$(date -d "@$SOURCE_DATE_EPOCH" -Iseconds 2>/dev/null || date -r "$SOURCE_DATE_EPOCH" -Iseconds)
+    local component_count
+    component_count=$(jq '.components | length' "$sbom")
+    local sbom_hash
+    sbom_hash=$(sha256sum "$sbom" | cut -d' ' -f1)
+
+    # Extract unique licenses
+    local licenses
+    licenses=$(jq -r '.components[].licenses[]?.license?.id // empty' "$sbom" 2>/dev/null | sort -u | tr '\n' ', ' | sed 's/,$//')
+
+    # CVE counts
+    local cve_critical=0 cve_high=0 cve_medium=0 cve_low=0
+    local cve_report="${OUTPUT_DIR}/secubox-${VERSION}-cve-report.json"
+    if [[ -f "$cve_report" ]]; then
+        cve_critical=$(jq '[.matches[]? | select(.vulnerability.severity == "Critical")] | length' "$cve_report" 2>/dev/null || echo 0)
+        cve_high=$(jq '[.matches[]? | select(.vulnerability.severity == "High")] | length' "$cve_report" 2>/dev/null || echo 0)
+        cve_medium=$(jq '[.matches[]? | select(.vulnerability.severity == "Medium")] | length' "$cve_report" 2>/dev/null || echo 0)
+        cve_low=$(jq '[.matches[]? | select(.vulnerability.severity == "Low")] | length' "$cve_report" 2>/dev/null || echo 0)
+    fi
+
+    # Missing metadata
+    local missing_metadata=""
+    local warnings="${OUTPUT_DIR}/sbom-warnings.txt"
+    if [[ -f "$warnings" && -s "$warnings" ]]; then
+        missing_metadata=$(cat "$warnings")
+    fi
+
+    cat > "${OUTPUT_DIR}/secubox-${VERSION}-cra-summary.txt" <<EOF
+=== SecuBox CRA Compliance Summary ===
+Version     : ${VERSION}
+Generated   : ${timestamp}
+SOURCE_DATE : ${SOURCE_DATE_EPOCH}
+
+--- Software Bill of Materials ---
+SBOM format    : CycloneDX 1.6 + SPDX 2.3
+Total components : ${component_count}
+SBOM SHA256    : ${sbom_hash}
+
+--- Licenses ---
+${licenses:-No licenses detected}
+
+--- CVE Summary ---
+CRITICAL : ${cve_critical}
+HIGH     : ${cve_high}
+MEDIUM   : ${cve_medium}
+LOW      : ${cve_low}
+(See secubox-${VERSION}-cve-report.json for details)
+
+--- Missing Metadata ---
+${missing_metadata:-None}
+
+--- CRA Annex I Checklist ---
+[x] SBOM published in machine-readable format
+[x] Vulnerability disclosure contact: security@cybermind.fr
+[ ] CSPN certification : IN PROGRESS (target Q3 2026)
+[x] VCS traceability : https://github.com/cybermind/secubox
+EOF
+
+    log_ok "CRA summary: ${OUTPUT_DIR}/secubox-${VERSION}-cra-summary.txt"
+}
+
+# 2.10 - Generate checksums
+generate_checksums() {
+    log_info "Generating checksums..."
+
+    cd "${OUTPUT_DIR}"
+    sha256sum secubox-${VERSION}.* > checksums.sha256
+
+    echo ""
+    echo "=== Generated Files ==="
+    ls -lh secubox-${VERSION}.* checksums.sha256
+    echo ""
+
+    log_ok "SBOM pipeline complete"
+}
+
+# Main
+main() {
+    parse_args "$@"
+
+    # Determine version
+    if [[ -z "$VERSION" ]]; then
+        if [[ -f "${TOPDIR}/version" ]]; then
+            VERSION=$(cat "${TOPDIR}/version" | tr -d ' \n')
+        elif [[ -d "${TOPDIR}/.git" ]]; then
+            VERSION=$(git -C "$TOPDIR" describe --tags --always 2>/dev/null || echo "dev")
+        else
+            VERSION="dev"
+        fi
+    fi
+
+    validate_version "$VERSION"
+    validate_arch "$ARCH"
+
+    echo "=========================================="
+    echo "SecuBox SBOM Generation Pipeline"
+    echo "Version: $VERSION | Arch: $ARCH"
+    echo "=========================================="
+    echo ""
+
+    # Setup
+    mkdir -p "$OUTPUT_DIR"
+    setup_reproducibility
+    check_tools
+
+    # Generate SBOMs from all 4 sources
+    echo ""
+    generate_sbom_native   # A: OpenWrt native
+    generate_sbom_feed     # B: SecuBox feed
+    generate_sbom_rootfs   # C: Rootfs
+    generate_sbom_firmware # D: Firmware image
+
+    # Merge and validate
+    echo ""
+    merge_sboms
+    validate_sbom
+
+    # CVE scan and reports
+    echo ""
+    scan_cve
+    generate_cra_summary
+    generate_checksums
+}
+
+main "$@"