Access control
All routes require authentication. Browser users sign in through the login page and receive a JWT session cookie.
Store, review, and manage findings with roles.
The manager provides protected UI and API access, user CRUD with basic/admin roles, and a hierarchical model for organizations, projects, services, and versions.