Google Workspace Security Audit v1.7.0: month-to-month comparison

New findings: files made public or shared outside the organisation in the last 30 days (from the Drive audit log), domain-wide delegation granted in the last 30 days, Gmail filters that match business-email-compromise patterns, super admins without a phishing-resistant second factor, files shared with target audiences, and settings below the CISA SCuBA Google Workspace baseline (MEDIUM and INFO, each row citing its CISA requirement). Settings the Policy API omits because they were never changed are now judged at Google's documented default and marked "Set by: Google default".

Each run is compared with the last completed run of the same customer: resolved findings, findings and rows new this month, and a posture score with a six-run trend. A finding whose data was incomplete in either run is reported as not compared, never as resolved. findings_evidence.csv carries every row with a stable ID.

--tenants, --tenant and --all audit tenants from a tenants file, each stopping if gam info domain answers with a different customer ID. Break-glass admins are excluded from the dormancy checks. qa_report.html says whether the report is ready to send. Exit codes: 0 complete, 1 preflight failed or wrong tenant, 2 some modules could not run, 130 interrupted; modules that do not apply to the tenant (Classroom without an Education licence) do not count.

The Shared Drive scan reads permissions only for items shared beyond the drive's members, about ten times faster with the same results. Gmail filters run in the default audit.

Tested on the dev and Education test tenants, on Linux (Python 3.13), macOS (Python 3.9) and Windows (Python 3.14).