The Open Source Vulnerability Orchestrator · React 18 · TypeScript · Vite · Tailwind CSS
Terminal 1 — start the API:
cd warden
uvicorn api.main:app --reload --port 8000Terminal 2 — start the UI:
cd warden/frontend
npm install # first time only
npm run devOpen your browser at http://localhost:5173
Log in with the credentials from your .env file:
- Username: value of
AUTH_USERNAME(default:admin) - Password: value of
AUTH_PASSWORD(default:warden-changeme)
Change the defaults in
.envbefore exposing the app to a network.
cd warden/frontend
npm run build # compiles to frontend/dist/
cd ..
docker compose up -d # starts api + ui + db + redis + workerOpen your browser at http://localhost
The UI is served by nginx on port 80. The API runs on port 8000 and is proxied automatically — no separate API URL needed.
Edit .env in the project root and restart the API:
# .env
AUTH_USERNAME=admin
AUTH_PASSWORD=your-new-password
WARDEN_SECRET_KEY=your-random-secret # generate: python3 -c "import secrets; print(secrets.token_hex(32))"| Route | What it shows |
|---|---|
/login |
Sign in with username and password |
/ |
Dashboard — live metrics, KEV exposure, risk trend, scanner coverage |
/findings |
Full findings table with filters, inline status updates, detail panel |
/kev |
CISA KEV alerts grouped by urgency and days remaining |
/pipeline |
Trigger a full scan or KEV sync, monitor task status |
/reports |
Download CSV reports, copy BI tool connection info |
| Layer | Library |
|---|---|
| Framework | React 18 + TypeScript |
| Build | Vite 5 |
| Styling | Tailwind CSS 3 |
| Charts | Recharts |
| Icons | Lucide React |
| Routing | React Router v6 |
| HTTP | Native fetch (no axios) |
- All API calls proxy to
http://localhost:8000via Vite's dev server — no CORS setup needed in dev. - JWT token is stored in
localStorageunder the keywarden_token. - To point at a different backend URL, change the
targetinvite.config.tsandBASE_URLinsrc/api.ts. - Run
npm run buildthen opendist/index.htmlin a static file server — not directly in a browser (React Router requires a server for client-side routing).