Install & run

cd dashboard
bun install
bun run dev                  # Vite dev server (SPA) + proxies /api to :3000
bun run build && bun server/index.ts   # production single-process

Hosting & configuration

HTTP flag	Env	Meaning
`--host`	HOST	Bare --host binds all interfaces (0.0.0.0); --host <addr> binds one; default 127.0.0.1
`--port <n>`	PORT	Listen port (default 3000)
`--tls-cert / --tls-key`	HBS_TLS_CERT / HBS_TLS_KEY	Enable TLS (fingerprint printed at startup)
`-`	HBS_DB_PATH	SQLite path (default server/data/hbs.sqlite)
`-`	HBS_DATA_ROOT	Keys/artifacts root (default server/data)

First run & users

If no users exist, the server creates a super_admin and prints its credentials once in the CLI (random 20-char password).
Disable with HBS_BOOTSTRAP_ADMIN=false → use the /setup wizard instead.
Override with HBS_ADMIN_USERNAME / HBS_ADMIN_PASSWORD.
Roles: super_admin (all), auditor (campaigns, issuances, ingest, treatment, exports), viewer (read-only).

Workflow

Campaign + location (creation can include the first location atomically).
Issuance - a unique random extractor_id and independent X25519 keypair; the dashboard patches the binary and stores the immutable artifact + SHA-256.
Download - token or session authenticated; streams the exact stored bytes and verifies the hash.
Scan - air-gapped by default, or --push.
Ingest - bounds → issuance resolution → token auth → AEAD decrypt + bounded decompress → schema/identity cross-binding → dedupe → one transaction → SSE report-arrived.
Triage - treatment workflow with audit history; owners, due dates, justifications.
Export - Excel, CSV, PDF (executive + technical), Word, diagnostic bundle.

Console pages

Page	Audience	What it does
`Executive Summary`	management	Board one-pager, risk gauge, top risks, presentation mode, print/Save as PDF
`Overview`	all	KPI tiles with drill-down, risk trend, severity donut, top failing checks
`Campaigns`	all	Campaign workspace, scope selector (latest / report / date range)
`Locations & Hosts`	sysadmin	Location cards, host inventory, download snippets, batch drop-zone upload
`Findings`	analyst	Filters (URL-canonical), By Host / By Check pivots, saved views
`Remediation`	sysadmin	Failing checks grouped into action items with copyable fix commands + exports
`Telemetry`	analyst	Scan/ingest percentiles, coverage trend, adoption bars, freshness/SLA
`Standards`	analyst/auditor	CIS / NIST 800-53 / ISO 27001 / PCI-DSS coverage matrix
`Treatment`	auditor	State board (open/accepted_risk/false_positive/remediated) with history
`Admin`	super_admin	Users, issuance keys, retention, audit log, encrypted backup/restore

Key API endpoints

GET    /api/health
POST   /api/auth/setup | /api/auth/login | /api/auth/logout        GET /api/auth/status
GET    /api/campaigns      POST /api/campaigns
POST   /api/campaigns/:id/locations/:loc/issuances   GET (list)
GET    /api/issuances/:id/download?token=…
POST   /api/ingest            (extractor push; Bearer push token)
POST   /api/reports/upload    (multipart batch, ≤32 files; session)
GET    /api/events            (SSE report-arrived)
GET    /api/overview | /api/findings | /api/remediation | /api/telemetry | /api/standards | /api/treatment
GET    /api/export/report/:id?format=xlsx|csv|pdf|docx[&template=executive|technical]
GET    /api/export/campaign/:id?format=…

Info

Cross-cutting: command palette (Ctrl/⌘-K), live SSE activity + notifications, light/dark theme, table twins for every chart, and a print stylesheet.