Team sync & web dashboard
Share findings, AI verdicts and decisions with your team — everyone signs in with GitHub.
How it fits together
VS Code extension ──(your GitHub sign-in)──► SecureSense server ──► database
Web dashboard (browser) ──(Sign in with GitHub)──┘
There are no SecureSense accounts or passwords. The server checks your GitHub sign-in on every request and only lets project members read or write a project. The database password stays on the server.
Projects and roles
A project is one codebase, identified by its git remote (for example github.com/you/your-repo). Every teammate's clone of that repo syncs into the same project. A folder without a git remote becomes a private local/… project.
| Role | Can |
|---|---|
| Owner — whoever syncs the project first | Sync, view, add and remove members |
| Member — added by the owner | Sync and view |
Syncing from VS Code
- Sign in: person icon on the SecureSense panel → approve VS Code's GitHub prompt.
- Sync: panel
...menu → SecureSense: Sync. It uploads the latest scan's findings, the AI verdicts, and all decisions. - Syncing again only updates — it never creates duplicates.
Decisions are credited only to the account that uploads them: nobody can upload decisions "as" someone else.
Adding teammates
- In VS Code: SecureSense: Manage Team → Add a teammate by GitHub username.
- On the web: open the project; the Team panel has an Add box (owner only).
The owner can remove members from the same places. The owner can't be removed.
The web dashboard
Open the site and click Sign in with GitHub (same account as in VS Code).
- Dashboard — your projects: confirmed / likely / false-positive counts, findings awaiting a decision, agreement, last sync.
- Project — stats, the verdict distribution, findings by priority with filters and who decided, and the team.
- Finding — scanner message, the AI verdict and rationale, the evidence, and the full decision history.
Only members can see a project; anyone else gets "not found". Web sessions last up to 7 days (less if GitHub issues short-lived tokens), then you sign in again.
Running your own server
The server is the Next.js app in web/ of the repository. To host your own (Vercel + a Neon or any PostgreSQL 15+ database), follow "Running your own server" in the repository's README.md, then set securesense.server.url to your deployment.
Something unclear or wrong? Edit these docs on GitHub.