Review the security dashboard

Build a self-contained page for the repository’s security picture. The Threat model tab works on Free. Team adds the Code graph tab with the map, owners, coupling and attack surface. The page needs no server to view.

Before you start

• Bravos installed and a repository with a GuardLink threat model.
• GuardLink on PATH.
• For the Code graph tab, a Team licence or trial and the graph binaries staged by setup. See Ask the code graph.

Build the page

From the repository root:

bravos dashboard --no-open

  threat model: GuardLink's threat model, with who introduced and fixed each exposure.
  code graph: The code graph's answers when this page was built: the map, owners and history, coupling, trust, attack surface, entry points and links.

Truncated to the two status lines from the Bravos 1.5.3 audit-notes fixture with code graph 0.1.1. The first output line names .bravos/dashboard/index.html. Open that file in your browser. Without --no-open, Bravos opens it for you when a browser is available; CI and Linux without a display print the path instead.

The default output is gitignored. Ask your agent “show me the findings”, or press d in interactive bravos watch, to build the same page.

Read the two tabs

Threat model embeds GuardLink’s dashboard, including who introduced and fixed an exposure and what changed since the default branch when that history is available. A new repository without a remote or usable history can have a simpler view. --since chooses another comparison ref.

Code graph is on Team, including the 30-day no-card trial. On Free, the tab explains the lock while the threat-model tab stays available. It contains:

View	What to inspect
Map	The repository map and where risk sits
Owners & History	Ownership and change history
Coupling	Files that change together
Trust	Refused edges, read failures and coverage gaps
Attack surface	Entry points ranked by reachable sinks
Entry points	Where inputs enter and the recorded access boundaries
Links	Framework and IDL link coverage, including what the graph does not publish

These are the graph’s answers at build time. A refused question stays visible as a refusal rather than an empty drawing. The page does not reproduce an exploit or confirm a finding; see the verification loop.

Keep the page current

On Team, the command builds a missing graph or rebuilds one behind the code before drawing the page. It uses --scip no-exec, runs no repository code and calls no model. A first build on a large repository can take minutes and the page can be tens of megabytes. --no-graph-build draws from the graph as it stands instead.

The page bar shows when it was built. After half a day it warns that it may be behind. The agent’s briefing also has a Dashboard: line stating whether the saved page is current or how many commits behind it is. Rebuild after code or annotation changes; reopening the saved file does not refresh its data.

The 1.5.3 release notes distinguish a busy graph from a missing one: the dashboard reports that another session or build holds it and builds nothing. Try again in a moment; see busy handling.

Prepare a copy to share

--no-blame leaves git names out of the threat model and replaces graph owner and author names with stand-ins. It does not remove the repository’s security findings; review the page before sharing it.

Flag	Result
--no-blame	Omit git names from both tabs
--since HEAD	Compare against this commit instead of the default branch
--no-open	Write the page without launching a browser
--out security-review.html	Write elsewhere, without writing the default page or its metadata inside the repository
--no-graph-build	Skip refreshing the graph
--json	Print bravos.dashboard-run/v1 with the path, whether a browser opened, and each tab’s state and note

With --out, choose where to keep the file yourself; the default output’s gitignore does not cover that alternate path. The full flag descriptions are in the installed command’s help.

Next

• Ask the code graph for a bounded question behind a view.
• Reading a finding explains why an open, confirmed and stale claim can be the same finding.