VULN CONSOLE
01/06
The Vulnerability Console

Security fixes that ship themselves.

Every known vulnerability in the software we build on — turned into a verified, reviewable pull request. One click each, proven in the real UI before anyone looks.

1 clickalert → ready PR
✓ provenverified in the live UI
worst-firstevery open alert, triaged
0auto-merges — a human always reviews
Why it exists

The security backlog nobody has time for.

The dashboard pulls in hundreds of libraries, and each one throws security alerts. Clearing a single one is the same tedious chain every time — and there are always more than anyone can get to.

1 · Bump

Raise the library

Find the safe version and update it — then regenerate the lockfile so the whole tree is consistent.

2 · Check

Make sure nothing broke

A dependency bump can quietly break a screen. Someone has to actually open the app and confirm.

3 · Write

Open the pull request

Describe the change, attach the evidence, get it reviewed and merged.

Multiply that by a hundred-plus open alerts. So they pile up — the classic “we’ll get to security when there’s time.”
What it does

Every vulnerability, in one list — each a single click.

The console groups all the open alerts by the library that needs bumping and sorts them worst-first. Pick one — or let it take the highest-severity — and an agent runs the whole chain for you.

vulnerability console · rancher/dashboard⚡ Fix highest severity
Critical
dompurify12 advisories · one bump clears them all
🌿 branch✅ PR #18987▶ recording
High
node-forge7 advisories
FixCreate PRRecord
High
serialize-javascript3 advisories
FixCreate PRRecord
The flow — one click, three steps

Bump it, prove it, PR it.

Behind that one button, the agent does exactly what a careful engineer would — and leaves the video to prove it.

Fix

Bump & rebuild

On our fork: raise the library, regenerate the lockfile, run lint and tests, push a branch.

🌿 a clean fix branch
Prove

Verify in the real UI

Deploy a live preview and drive the actual screens with Playwright — recorded start to finish.

▶ a verification video
PR

Open it for review

Raise a real pull request on rancher/dashboard, with the video embedded as the evidence.

✅ a reviewable PR
Nothing is taken on trust. The fix isn’t “done” until it’s been shown working in the running app.
Guardrails

Fast, but nothing merges itself.

Speed doesn’t mean skipping the safety checks — the console is built so a person is always the one who says yes.

Proven

Verified, not assumed

Every fix is exercised in the live UI before it’s offered — the recording is the receipt.

Reviewed

A human always merges

Each fix lands as an ordinary pull request that a person reviews. The console never merges.

Patient

Brand-new versions wait

A release that’s only days old is held back, so we never chase a freshly-broken version.

Honest

Nothing quietly disappears

A vulnerability only leaves the list when its alert actually closes — fixed by us, or handled elsewhere.

Let’s see it

Now — live.

Here’s the console with today’s real vulnerabilities on rancher/dashboard. Let’s pick one and watch it go from alert to a reviewed pull request.

vuln-console.13.48.147.135.sslip.io
or Space to move