ScanQube | AppSec Operations

Page ownership

Every major surface has a clear job.

Most confusion disappears once you know which page owns context, which page owns detailed review, which page owns action, and which page owns policy.

Dashboard for contextReports for saved detailOps for actionWar Room for live runsSettings for guardrails

Best memory aid

Context → Review → Act

Dashboard gives context, Reports explains one saved scan, and Ops moves the next step forward.

Policy stays separate

Settings shapes future runs

Settings changes what the platform is allowed to do. It is not where you interpret a finished scan.

Surface By Surface

Use these summaries to understand each page's job, best entry point, and main areas.

DashboardAppSec engineers, team leads, managers

Give you the broad operating picture and the best next step.

Open when: You need context, posture, or a place to launch or resume work.

Avoid when: You already know which saved scan to inspect in Reports.

Hero and top metrics

Read the top banner and headline KPIs first. They tell you whether something urgent is happening and whether a run is already in flight.

Analysis workspace

Use the analysis area when you want the current target story, not just the top-level score. This is the best place to understand where the platform is focusing attention.

Follow-on and delivery lanes

Use these areas when the work needs a handoff, a repeated schedule, export delivery, or a TMaaC-guided launch contract after the review is complete.

Open Dashboard

ReportsSecurity analysts, reviewers, release decision makers

Explain one saved scan clearly and keep all of its supporting detail in one place.

Open when: You need the saved result, release decision, proof, evidence, or scan-to-scan changes.

Avoid when: You need a brand-new live run instead of a saved story.

History rail

Use the left-side history to find the correct target, date, or scan type before reading the scan detail panes.

Selected scan story

The summary area gives the fastest explanation of what happened and whether the result is ready for action.

Report tabs

Use the tabs to move from Policy into Inventory, Threat Pulse, Blue Team, Proof, Diff, Evidence, Provenance, Time Travel, and Threat Intel without losing the selected scan.

Import actions

Use proof-pack import and export actions when you need to compare an outside handoff, pull inventory or SIEM artifacts, or move a saved proof story into another system.

Open Reports

PowerProduct developers, AppSec leads, reliability reviewers

Separate beginner-safe product confidence from expert implementation readiness.

Open when: You need to see whether evidence, persistence, memory, CI, and executive reporting are ready enough for product work.

Avoid when: You need the detailed story of one saved scan; Reports is the review surface for that.

Guided priority path

Use the guided view when you need the top few next moves without raw contracts, commands, or artifact links.

Evidence and release confidence

Use the simplified evidence story, platform readiness, CI verdict, and executive brief to decide whether the product story is trustworthy.

Expert workbench

Switch to Expert when you need commands, API contracts, graph tables, memory controls, storage internals, SARIF links, or the full feature matrix.

Open Power

Ops QueueOps owners, queue managers, governance leads

Turn reviewed scan outcomes into tracked, owned follow-up work.

Open when: The scan already makes sense and now needs routing, replay, assignment, waiver review, or queue management.

Avoid when: You still need to understand what the scan found; go back to Reports first.

Active Queue

Use the active queue to see what needs attention now, especially proof gaps, blocked imports, waivers, and follow-up pressure.

Recent saved scans

This section helps you reopen the right saved target from Ops without losing the queue context.

Routing and governance

Use the control plane when you need to decide how follow-up should be assigned, inherited, approved, waived, or sent to an external issue destination.

Workflow health and audit

Use the audit lanes to confirm whether follow-up actions, batch runs, export retries, and operator decisions completed cleanly.

Open Ops Queue

War RoomOperators running fresh validations

Launch new live work and monitor the mission while the platform collects fresh findings and telemetry.

Open when: You need a fresh run, a new target, or a live view of what the platform is doing right now.

Avoid when: A saved scan already exists and you only need review or follow-up.

Mission Readiness

Use this area to confirm the target, whether a repository is attached, and which scan depth matches the job you need.

Mission Launch Console

This is where you enter the target, optional credentials, repository path, provider posture, scan mode, operator guidance, and optional TMaaC source before you launch.

Tactical Theatre

Use the theatre to watch the live stream, switch views, and understand what the platform is doing while the mission runs.

Debrief and saved result

When the run finishes, use the debrief and saved scan handoff to move straight into Reports, inventory, proof-pack review, or Ops follow-through without losing mission context.

Open War Room

SettingsPlatform administrators, leads, governance owners

Define what the platform is allowed to touch, where it sends work, and when people must approve actions.

Open when: You need to change scope, delivery defaults, tracked-work routing, or approval behavior.

Avoid when: You are trying to understand a specific finding or saved scan result.

Target Scope and Protected Paths

Use these areas to decide which environments are approved and which paths should stay off-limits to automation.

Traffic Profile

Tune how aggressively the platform explores so it stays inside the approved operating envelope.

Tracked Work and Export Delivery

Set routing, export delivery, and webhook defaults once so Reports, Dashboard, schedules, and Ops inherit the same policy-backed behavior.

Webhooks and Approval Flow

Control outbound events and whether human approval is required before write, replay, or delivery-triggered actions move forward.

Open Settings

Reports Tabs Explained

The tab names stay short in the product, so this section translates them into plain language.

Policy

The release or decision layer. This tab tells you the posture, whether the target looks blocked or ready, and which proof, inventory, or ops action should come next.

Open Policy first when you need the shortest summary of what the saved scan means.

Inventory

The route and surface map. This tab shows what the platform discovered across preview paths, API paths, auth-gated routes, and exportable application context.

Open Inventory when you need to know where the application is exposed, not just what was found.

Threat Pulse

The pattern and pressure lane. This tab helps you see blocked targets, proof drift, repeat exposure, and inventory pressure beyond one finding.

Open Threat Pulse when you want to understand broader pressure, not just one proof item.

Blue Team

The defense side of the story. This tab shows the defensive posture and what follow-up or coverage work may be needed.

Open Blue Team when the question is about mitigation, resilience, or what defenders need next.

Proof

The replayable proof lane. This is where you see proof capsules, attachment state, bundle-backed proof, and whether the saved proof is ready for revalidation.

Open Proof when you need to confirm the proof itself, not just the headline decision.

Diff

The change view. This tab explains what is new, fixed, regressed, or different from an imported proof pack or an earlier comparison.

Open Diff when you need to answer what changed over time.

Evidence

The raw support behind the story. This tab is where you inspect evidence rows, finding details, attachments, and bundle-backed records before or after proof promotion.

Open Evidence when you need the supporting detail behind a decision or proof item.

Provenance

The decision trace. This tab is about how the platform reached the conclusion, including causal reasoning, TMaaC source metadata, and runtime drift context when present.

Open Provenance when you need auditability or want to explain why the system reached a specific conclusion.

Time Travel

The saved history view for one story. This helps you compare checkpoints, build restore payloads, and see how the scan narrative evolved.

Open Time Travel when a teammate asks how the story moved from one point in time to another.

Threat Intel

The hypothesis and outside signal lane. This tab keeps supporting intelligence, target context, and TM-driven hypotheses close to the saved scan story.

Open Threat Intel when you want the broader context behind the target or hypothesis set.

War Room Areas

These are the main regions inside the live-run surface and what they are meant to answer.

Mission Readiness

The quick preflight summary for target, repository, and scan depth.

Read it before launch to make sure the mission is pointed at the right target.

Mission Launch Console

The live-run setup form for target, credentials, repository, execution depth, provider posture, operator guidance, and optional TMaaC intake.

Use it any time you are starting a new mission.

Tactical Theatre

The live activity view for the combined stream, offensive lane, defensive lane, and mission events.

Use it while the run is active and you want to monitor progress.

Debrief

The wrap-up view that connects the live mission to the saved result, inventory lane, proof-pack handoff, and next-step actions.

Use it as soon as the run completes so you can move into Reports without guessing what happened.

Settings Areas

Settings can look broad at first, so use this map to know which section changes what.

Target Scope

The allow-list for where the platform is permitted to act.

Open it before launching work in a new environment or when you need to confirm approved targets.

Protected Paths

The do-not-touch list for internal or sensitive paths.

Open it when certain routes should stay out of automation scope or replay.

Traffic Profile

The pacing and request behavior controls for live work.

Open it when you need to make the platform gentler, stricter, or more deliberate.

Tracked Work Defaults

The shared routing source for issue providers, follow-up destinations, and policy-aware ownership defaults.

Open it when Reports and Ops should inherit the same issue-routing behavior.

Export Delivery Defaults

The default destination for proof packs, comparison outputs, Markdown handoffs, and SIEM delivery bundles.

Open it before enabling shared exports or repeat delivery.

Webhook Delivery Management

The outbound event subscription and retry area for connected systems.

Open it when another system needs to receive platform events automatically.

Approval Flow

The gate that decides whether people must approve write, replay, or sensitive follow-up actions before they proceed.

Open it before changing how much autonomy the platform is allowed to use.

Open Settings

Page ownership

Every major surface has a clear job.

Most confusion disappears once you know which page owns context, which page owns detailed review, which page owns action, and which page owns policy.

Dashboard for contextReports for saved detailOps for actionWar Room for live runsSettings for guardrails

Best memory aid

Context → Review → Act

Dashboard gives context, Reports explains one saved scan, and Ops moves the next step forward.

Policy stays separate

Settings shapes future runs

Settings changes what the platform is allowed to do. It is not where you interpret a finished scan.

Surface By Surface

Use these summaries to understand each page's job, best entry point, and main areas.

DashboardAppSec engineers, team leads, managers

Give you the broad operating picture and the best next step.

Open when: You need context, posture, or a place to launch or resume work.

Avoid when: You already know which saved scan to inspect in Reports.

Hero and top metrics

Read the top banner and headline KPIs first. They tell you whether something urgent is happening and whether a run is already in flight.

Analysis workspace

Use the analysis area when you want the current target story, not just the top-level score. This is the best place to understand where the platform is focusing attention.

Follow-on and delivery lanes

Use these areas when the work needs a handoff, a repeated schedule, export delivery, or a TMaaC-guided launch contract after the review is complete.

Open Dashboard

ReportsSecurity analysts, reviewers, release decision makers

Explain one saved scan clearly and keep all of its supporting detail in one place.

Open when: You need the saved result, release decision, proof, evidence, or scan-to-scan changes.

Avoid when: You need a brand-new live run instead of a saved story.

History rail

Use the left-side history to find the correct target, date, or scan type before reading the scan detail panes.

Selected scan story

The summary area gives the fastest explanation of what happened and whether the result is ready for action.

Report tabs

Use the tabs to move from Policy into Inventory, Threat Pulse, Blue Team, Proof, Diff, Evidence, Provenance, Time Travel, and Threat Intel without losing the selected scan.

Import actions

Use proof-pack import and export actions when you need to compare an outside handoff, pull inventory or SIEM artifacts, or move a saved proof story into another system.

Open Reports

PowerProduct developers, AppSec leads, reliability reviewers

Separate beginner-safe product confidence from expert implementation readiness.

Open when: You need to see whether evidence, persistence, memory, CI, and executive reporting are ready enough for product work.

Avoid when: You need the detailed story of one saved scan; Reports is the review surface for that.

Guided priority path

Use the guided view when you need the top few next moves without raw contracts, commands, or artifact links.

Evidence and release confidence

Use the simplified evidence story, platform readiness, CI verdict, and executive brief to decide whether the product story is trustworthy.

Expert workbench

Switch to Expert when you need commands, API contracts, graph tables, memory controls, storage internals, SARIF links, or the full feature matrix.

Open Power

Ops QueueOps owners, queue managers, governance leads

Turn reviewed scan outcomes into tracked, owned follow-up work.

Open when: The scan already makes sense and now needs routing, replay, assignment, waiver review, or queue management.

Avoid when: You still need to understand what the scan found; go back to Reports first.

Active Queue

Use the active queue to see what needs attention now, especially proof gaps, blocked imports, waivers, and follow-up pressure.

Recent saved scans

This section helps you reopen the right saved target from Ops without losing the queue context.

Routing and governance

Use the control plane when you need to decide how follow-up should be assigned, inherited, approved, waived, or sent to an external issue destination.

Workflow health and audit

Use the audit lanes to confirm whether follow-up actions, batch runs, export retries, and operator decisions completed cleanly.

Open Ops Queue

War RoomOperators running fresh validations

Launch new live work and monitor the mission while the platform collects fresh findings and telemetry.

Open when: You need a fresh run, a new target, or a live view of what the platform is doing right now.

Avoid when: A saved scan already exists and you only need review or follow-up.

Mission Readiness

Use this area to confirm the target, whether a repository is attached, and which scan depth matches the job you need.

Mission Launch Console

This is where you enter the target, optional credentials, repository path, provider posture, scan mode, operator guidance, and optional TMaaC source before you launch.

Tactical Theatre

Use the theatre to watch the live stream, switch views, and understand what the platform is doing while the mission runs.

Debrief and saved result

When the run finishes, use the debrief and saved scan handoff to move straight into Reports, inventory, proof-pack review, or Ops follow-through without losing mission context.

Open War Room

SettingsPlatform administrators, leads, governance owners

Define what the platform is allowed to touch, where it sends work, and when people must approve actions.

Open when: You need to change scope, delivery defaults, tracked-work routing, or approval behavior.

Avoid when: You are trying to understand a specific finding or saved scan result.

Target Scope and Protected Paths

Use these areas to decide which environments are approved and which paths should stay off-limits to automation.

Traffic Profile

Tune how aggressively the platform explores so it stays inside the approved operating envelope.

Tracked Work and Export Delivery

Set routing, export delivery, and webhook defaults once so Reports, Dashboard, schedules, and Ops inherit the same policy-backed behavior.

Webhooks and Approval Flow

Control outbound events and whether human approval is required before write, replay, or delivery-triggered actions move forward.

Open Settings

Reports Tabs Explained

The tab names stay short in the product, so this section translates them into plain language.

Policy

The release or decision layer. This tab tells you the posture, whether the target looks blocked or ready, and which proof, inventory, or ops action should come next.

Open Policy first when you need the shortest summary of what the saved scan means.

Inventory

The route and surface map. This tab shows what the platform discovered across preview paths, API paths, auth-gated routes, and exportable application context.

Open Inventory when you need to know where the application is exposed, not just what was found.

Threat Pulse

The pattern and pressure lane. This tab helps you see blocked targets, proof drift, repeat exposure, and inventory pressure beyond one finding.

Open Threat Pulse when you want to understand broader pressure, not just one proof item.

Blue Team

The defense side of the story. This tab shows the defensive posture and what follow-up or coverage work may be needed.

Open Blue Team when the question is about mitigation, resilience, or what defenders need next.

Proof

The replayable proof lane. This is where you see proof capsules, attachment state, bundle-backed proof, and whether the saved proof is ready for revalidation.

Open Proof when you need to confirm the proof itself, not just the headline decision.

Diff

The change view. This tab explains what is new, fixed, regressed, or different from an imported proof pack or an earlier comparison.

Open Diff when you need to answer what changed over time.

Evidence

The raw support behind the story. This tab is where you inspect evidence rows, finding details, attachments, and bundle-backed records before or after proof promotion.

Open Evidence when you need the supporting detail behind a decision or proof item.

Provenance

The decision trace. This tab is about how the platform reached the conclusion, including causal reasoning, TMaaC source metadata, and runtime drift context when present.

Open Provenance when you need auditability or want to explain why the system reached a specific conclusion.

Time Travel

The saved history view for one story. This helps you compare checkpoints, build restore payloads, and see how the scan narrative evolved.

Open Time Travel when a teammate asks how the story moved from one point in time to another.

Threat Intel

The hypothesis and outside signal lane. This tab keeps supporting intelligence, target context, and TM-driven hypotheses close to the saved scan story.

Open Threat Intel when you want the broader context behind the target or hypothesis set.

War Room Areas

These are the main regions inside the live-run surface and what they are meant to answer.

Mission Readiness

The quick preflight summary for target, repository, and scan depth.

Read it before launch to make sure the mission is pointed at the right target.

Mission Launch Console

The live-run setup form for target, credentials, repository, execution depth, provider posture, operator guidance, and optional TMaaC intake.

Use it any time you are starting a new mission.

Tactical Theatre

The live activity view for the combined stream, offensive lane, defensive lane, and mission events.

Use it while the run is active and you want to monitor progress.

Debrief

The wrap-up view that connects the live mission to the saved result, inventory lane, proof-pack handoff, and next-step actions.

Use it as soon as the run completes so you can move into Reports without guessing what happened.

Settings Areas

Settings can look broad at first, so use this map to know which section changes what.

Target Scope

The allow-list for where the platform is permitted to act.

Open it before launching work in a new environment or when you need to confirm approved targets.

Protected Paths

The do-not-touch list for internal or sensitive paths.

Open it when certain routes should stay out of automation scope or replay.

Traffic Profile

The pacing and request behavior controls for live work.

Open it when you need to make the platform gentler, stricter, or more deliberate.

Tracked Work Defaults

The shared routing source for issue providers, follow-up destinations, and policy-aware ownership defaults.

Open it when Reports and Ops should inherit the same issue-routing behavior.

Export Delivery Defaults

The default destination for proof packs, comparison outputs, Markdown handoffs, and SIEM delivery bundles.

Open it before enabling shared exports or repeat delivery.

Webhook Delivery Management

The outbound event subscription and retry area for connected systems.

Open it when another system needs to receive platform events automatically.

Approval Flow

The gate that decides whether people must approve write, replay, or sensitive follow-up actions before they proceed.

Open it before changing how much autonomy the platform is allowed to use.

Open Settings

Surface Guide

Every major surface has a clear job.

Surface By Surface

Reports Tabs Explained

War Room Areas

Settings Areas

Platform Documentation

Loading documentation

Surface Guide

Every major surface has a clear job.

Surface By Surface

Reports Tabs Explained

War Room Areas

Settings Areas