stackatdocs
Docs menuDashboard

Docs

Dashboard

On this page

The dashboard at app.stackat.dev shows every organisation you belong to that installed Stackpaw or Stackpaw Audit.

Signing in#

Sign in with GitHub. Stackat shows only what GitHub says you can see: the organisations and repositories the app is installed on that you have access to. If your organisation installed Stackpaw Audit, use Sign in through Stackpaw Audit.

Nothing about you is stored: your repository names are held in memory for the session, which lasts 8 hours.

The first page lists your organisations as cards with the plan, the worst open risk and when they were last scanned. Each organisation has four tabs.

Overview#

  • Last scanned, with a warning when scans have stopped (see Freshness).
  • Next up: the five open items with the highest risk, each with its verdict, version jump, issue and pull request.
  • The numbers: waiting on you (split by risk), up to date, upgrades delivered, CVEs fixed by upgrading, and tools tracked.
  • Trends over 12 weeks: upgrades delivered, open issues, and the share of tools up to date (shown once two weeks are recorded).

The Up to date card counts tools on their latest release ("74% · 13 behind their latest release"), or within the lag you allow with up_to_date ("13 more than 1 release behind (your setting)").

With nothing to do, Overview shows one "All caught up" message. Before the first scan it shows a getting-started checklist.

Inventory#

Every tool behind its latest release, in one table, highest risk first:

  • filters for risk, verdict, repository and security fixes only;
  • search, and sortable columns, including Releases behind;
  • each tool links to its issue.

Repositories where everything is current, or whose last scan failed, take one line each.

Audit evidence#

Every issue Stackat raised and how it was resolved, read live from GitHub: a dated record of patch and change management for ISO 27001 (A.8.8, A.8.32), SOC 2 (CC7.1, CC8.1), NIS2 (Art. 21) and DORA (Art. 9) reviews.

The date range. Pick From and To dates, or a preset: Last 90 days, Last 12 months, This year or All time. An issue counts when it was open at any time in the range. The range is part of the address (?from=2026-01-01&to=2026-06-30), so you can bookmark or share it, and the CSV and the printable page use the same range.

The numbers. Raised, Upgraded (closed when the pin reached the release), Open, Closed as done (closed by your team before the pin reached the release), Closed without upgrading (risk accepted or left out) and the median days to upgrade.

The table. Each issue with its risk, days open, outcome and reason, when and by whom it was closed (Stackat for an upgrade, otherwise the GitHub login), and its pull request.

Download CSV gives one row per issue with these columns:

evidence.csvtext
repository, issue, title, raised, closed, days open, outcome, reason, closed by, risk, breaking change, security, pull request, url

Print or save as PDF opens a printable report with the period, the repositories, who generated it and when, and the controls it covers.

Audit evidence is part of the trial and Team. On the free plan the tab says how many issues are already recorded, and the CSV and the report lead to the upgrade form.

Settings#

  • Plan: your plan, the trial's end, and the repository the free plan scans, which an administrator can choose here (see Choose the free repository).
  • Settings per repository: what each repository's .stackat.yml changes from the defaults (scans, pull requests, cooldown, mirrors, Jira, up to date), which files they were read from, and any problems in them. Repositories on the defaults are listed together.
  • Up to date: when a tool counts as up to date, and whether that came from the default, the organisation's file or the repository's.
  • How to configure: a folded short guide to .stackat.yml.
  • Slack: connect a channel, choose what gets sent, and the weekly digest. See Slack.

Freshness#

Stackat scans every repository once a day; a repository whose default branch has not moved is not downloaded again. A /stackpaw command, or choosing the free repository, scans that one repository straight away.

Overview shows "Scanned 3 hours ago". When no scan has happened for two scan intervals plus half an hour (about two days with daily scans), it shows a warning: one missed scan is not news, two are. When GitHub itself is down, a banner says so; issues and pull requests that could not be written arrive by themselves once GitHub recovers.