Spins up a tenant with its own login URL and seeds its first Org Admin. The organization is registered against a domain it owns — only email addresses on a registered domain can become users. A temporary password is shown here to hand over (or emailed, once SMTP is configured).

Every user_id holding scans or findings, across all organizations. As Super Admin you can open any of them — click View to load that user's findings. Rows marked orphaned have data but no account behind them (usually a pre-auth or deleted identity); their history is still readable and can be transferred to a real account below.

Scans and findings are owned by the org-namespaced user_id ({slug}__{username}). When someone moves to a different organization, re-home their history here — otherwise it stays behind on the old id. Check first, then apply: the check never writes.

Every domain registered on the platform and who holds it. One domain belongs to exactly one organization — this is what a clash is checked against.

Long-lived keys for API / integration access (e.g. hand to the UI team while there's no login screen). These carry Super Admin scope — they bypass org isolation and read all data, so treat each like a password. Shown once at creation; callers send header X-API-Key: cpt_….

The .env seed only runs when the database has zero super admins — it can't add a second one or rename the first. Use this instead: create your own named owner, sign in as them, then retire the seeded root account. Leave the password blank to get a temporary one that must be changed on first sign-in.

Rotate the Super Admin password you were seeded with. Once changed, remove SUPER_ADMIN_PASSWORD from .env — it's only read to create the first admin, and leaving it there keeps your password in plaintext on disk. All your other sessions are signed out.

Add operators to your console. Their email must be on one of your registered domains (—). A random temporary password is generated and shown here to hand over; they must reset it on first sign-in.

Email domains your users may sign up on.

Custom roles limit what a member can reach. Tick the pages, then the level on each: View = read only, Write = create, Edit = change (finding status, etc.), Delete = remove. Write/Edit/Delete always include View. Admins and members with no role stay unrestricted. Changes apply on the member's next request — no re-login.

Real browser session — SPA route traversal, JS bundle/source-map parsing, WebSocket capture, GraphQL detection, full JWT/cookie/localStorage token harvesting. Complements the wordlist-based discovery elsewhere; async job, same shape as a scan.