Dashboard & reports
The dashboard is where findings from your agent, repository scans and website scans become tracked issues — with framework coverage, evidence reports for auditors, API keys and an audit log.
On this page
Projects
A project is one thing RuleFix checks, with the frameworks you chose for it. Create one under Projects → New project or Websites:
| Type | Where results come from | Guide |
|---|---|---|
| Repository (GitHub App or public URL) | Scan now, plus your agent over MCP | Importing code |
| Website | Scan again | Website scans |
| Empty project | Your agent, via rulefix_report_scan | MCP server |
- Where results come from
- Scan now, plus your agent over MCP
- Guide
- Importing code
- Where results come from
- Scan again
- Guide
- Website scans
- Where results come from
- Your agent, via
rulefix_report_scan - Guide
- MCP server
The project page shows the latest score, scan history with the source of each scan (dashboard, agent client or website), and the project's issues. New workspaces include a clearly labelled demo project to explore; it can't be scanned.
Issues and triage
Each distinct finding becomes an issue, identified by its fingerprint. Issues lists them across projects, most severe first; filter by status, severity, framework or project. Each row shows what was found, the file and line, and a status control. For the fix, look the rule up in the rules reference or ask your agent to fetch the issues with rulefix_get_issues.
| Status | Meaning | What changes it |
|---|---|---|
| Open | The finding was seen and not yet resolved. | New findings; a fixed issue that appears again (a regression). |
| Fixed | The finding is gone. | You, a complete scan that no longer finds it, or evidence-backed resolution by your agent. |
| Ignored | Reviewed and accepted (false positive or accepted risk). | Only a person in the dashboard. Later scans keep it ignored. |
- Meaning
- The finding was seen and not yet resolved.
- What changes it
- New findings; a fixed issue that appears again (a regression).
- Meaning
- The finding is gone.
- What changes it
- You, a complete scan that no longer finds it, or evidence-backed resolution by your agent.
- Meaning
- Reviewed and accepted (false positive or accepted risk).
- What changes it
- Only a person in the dashboard. Later scans keep it ignored.
Every status change is written to the audit log with who made it, so triage decisions show up in evidence reports.
Framework coverage
Frameworks shows, for each of the eight frameworks, which automated checks RuleFix runs, the open findings by severity and how many projects have it enabled. Open a framework for its requirements, the rules mapped to it and the findings behind the numbers.
Coverage isn't compliance
Coverage tells you which checks ran and what they found. Many requirements — policies, contracts, training, incident response — can't be checked from code or a website, so a framework with no open findings is not a compliance certificate.
Compliance reports
Reports builds an evidence report for one project and the frameworks you pick: the latest scan, score history, open and resolved findings, triage decisions and, for owners and admins, the audit trail — grouped per framework.
- Print or PDF — the report page is laid out for printing; use your browser's Print → Save as PDF.
- JSON — download the same data as a JSON file for your GRC tool or auditor. It's generated on request for the signed-in user and never cached.
API keys and agent connections
Owners and admins manage keys under Settings → API keys. A key authenticates the MCP server for one workspace.
- Give each key a name and an expiry: never, 30, 90 or 365 days.
- The full key is shown once at creation. Afterwards the list shows only its prefix (for example
rf_live_a1B2c3…), status, expiry and when it was last used. - Revoking a key stops everything using it immediately and can't be undone.
The MCP page in the dashboard has ready-to-paste client snippets and shows when an agent last called RuleFix.
Workspace and team
Settings → Workspace holds the workspace name and plan; Settings → Team lists members and their roles — owner, admin or member. Owners and admins can rename the workspace, connect GitHub, manage API keys and read the audit log.
Audit log
Settings → Audit log (owners and admins) is a read-only record of security-relevant changes, written by the database itself so it can't be edited from the app. It records:
- Renamed the workspace
- Changed a member's role
- Removed a member
- Created a project
- Updated a project
- Deleted a project
- Created an API key
- Updated an API key
- Revoked an API key
- Changed an issue's status
- Connected GitHub
- Disconnected GitHub
Your privacy controls
Under Settings → Privacy every user can:
- Export your data as JSON: your profile, workspace memberships, the projects you created and their issues, your consent records and privacy requests.
- Review and withdraw consents — what you agreed to, which version and when, with the full history.
- Request account erasure. We confirm by email first and complete the request within 30 days; some records, such as invoices and consent records, are kept where the law requires it.
- Raise a question or grievance with our grievance officer (see Grievance redressal).
What we store and how it's protected is in Security & data.