Chazerai — Security Dashboard

Attacks blocked · 24h

—

Real-time WAF active

Protected sites

—

Backends behind Chazerai

Open findings

—

From recent scans

Live AI rules

—

Auto-learned + mined

Detector

Real-time WAF · inspecting every request

●

—

Total requests

—

Blocked

—

Blocked IPs

Latest alerts

Loading…

Open Detector →

Scanner

Authenticated vulnerability scans

●

—

Scans run

—

Critical

—

High

Latest findings

Loading…

Open Scanner →

Attack activity

Blocked requests · last 7 days

— total

Critical findings

Most recent CRITICAL + HIGH bugs

Loading…

Recently learned bugs

New CVEs · auto-imported from NVD daily

Loading…

Total Requests

—

Blocked

—

Alerts (all-time)

—

Critical (24h)

—

High (24h)

—

Medium (24h)

—

Blocked IPs

—

IP Allowlist — Restrict who can access protected sites

For each site below, you can lock access to specific IPs or CIDR ranges. Empty list = deny-by-default when enabled.

Pick a site:

Protected Sites Backends behind Chazerai — each gets its own port

Add a website you want to protect. Chazerai will open a new port and shield it. Send your users to the new URL instead of the unprotected one.

Name	Backend	Protected URL (give users this)	Owner	Added
No sites yet — add one above

Username	Email	Role	Status	Created	Last login
No users yet

Site	Path Pattern	Allowed Bug IDs	Reason
No exceptions yet

Time	Severity	Rule	Source IP	Path	Action
Loading…

IP	Reason	Expires
Loading…

Include Learned Bugs in Scan 0

Real bug detection templates. Pick which ones to run, then click "Run Selected" — they test against the active site and report findings just like regular scans.

Target site:

Vulnerability Scanner

Probes your protected sites for common vulnerabilities (SQLi, XSS, traversal, SSRF, sensitive files, etc). Per-site consent required — you must explicitly enable scanning on each site you own.

1. Pick a site

Loading sites…

2. Pick tests to run

Loading tests…

Check Learned Bugs with Auth 0

Run real bug templates with the captured auth context (cookie/token) so they hit logged-in pages.

Site (auth scan):

Advanced: Endpoint Recording + Authenticated Scanning

Record the request shapes (paths, methods, parameters) your users actually use, then run authenticated scans against those endpoints.

Pick a site to configure — applies to all sections below

1. Endpoint Recording

Records every unique request shape (method + path + params) when real users browse the site. The scanner then uses this catalog to test endpoints with valid auth.

          Pick a site above, then click Refresh.
        

2. Scanner Credentials

The scanner needs an account to test authenticated endpoints. Provide creds, or let scanner auto-register.

Mode: Login URL: Login field name: Email / Username: Password: Register URL:

3. Run Authenticated Scan

Scanner logs in (or registers), then replays each recorded endpoint with its own session. Catches IDOR, auth bypass, mass assignment.

(uses site selected above)

4. Scheduled Scans

Auto-run a scan periodically. Runs in background; check Recent Findings for results.

Enabled

5. Auto-Learn From CVE

Pick a CVE id and the AI will write a scanner test for it. New tests appear in the scanner library automatically. Requires LLM configured.

CVE must already be in your imported list. Run "Import recent CVEs" in the Detector view first.

Payload Library Self-learning attack payloads — from live traffic, AI generation, and WAF-bypass mutations

The scanner grows its own payload library over time. Real attacker payloads (captured by the WAF), AI-generated variations, and mutated WAF-bypass variants all feed into the scanner's tests.

Total payloads

—

Active

—

Experimental

—

WAF Bypasses

—

Bulk actions: "Use only built-in" enables the trusted built-in payloads and disables traffic/AI/mutation ones — useful if you want to test with the curated set only.

Loading…

Home

Total Requests

Blocked

Alerts (all-time)

Critical (24h)

High (24h)

Medium (24h)

Blocked IPs

IP Allowlist — Restrict who can access protected sites

Protected Sites Backends behind Chazerai — each gets its own port

Users Admins manage who can access the dashboard. Each user only sees their own sites and alerts.

Rule Exceptions Whitelist specific bugs on specific endpoints — useful when a "vulnerability" is intentional (e.g. public API)

AI Code Review — Verdict & Secure Code

▶ Saved Analyses (0)

Recent Alerts Click any row marked FIX AVAILABLE to see the code fix inline

Blocked IPs

IP Allowlist Whitelisted IPs bypass ALL detection rules

Top Attackers (24h)

Top Rules (24h)

Scanners Detected Last 7 days — attacks grouped by scanner signature

AI Auto-Approve loading…

AI Suggestions from your Real Findings 0

AI Rule Suggestions CVE imports + pattern mining → suggested rules for review

Custom Rules Write your own detection rules — the WAF matches them against live traffic alongside the built-in rules

Your custom rules

My Plan

Plan Tiers

My Upgrade Requests

Pending Upgrade Requests

Superadmin — Assign Plans Directly

Upgrade to Plan

Alert Notifications Push critical alerts to Slack, Discord, or any webhook

Settings

Include Learned Bugs in Scan 0

Vulnerability Scanner

Check Learned Bugs with Auth 0

Advanced: Endpoint Recording + Authenticated Scanning

1. Endpoint Recording

2. Scanner Credentials

3. Run Authenticated Scan

4. Scheduled Scans

5. Auto-Learn From CVE

Detection Templates (built-in, executable) 0

Learned Bugs New attacks the scanner learned about — automatic CVE feed + pattern mining

Payload Library Self-learning attack payloads — from live traffic, AI generation, and WAF-bypass mutations

Total payloads

Active

Experimental

WAF Bypasses

Recent Findings Past scans and their results — click "View" to expand, to delete