Day-to-day operation

Go to /assets → Add asset. Enter the hostname and the system generates a TXT verification record.

Copy the Token from the asset row and publish a TXT record at either the asset's root host (e.g., sun.com) or_nso-verify.sun.com at the client's DNS provider. The app checks both candidates in parallel and the /assets UI labels which one matched, mismatched, or returned no record. Retry and Refresh also perform a basic DNS resolution check (A, AAAA, and CNAME), so a domain can show as resolving for ping/nslookup while TXT ownership remains pending. The displayed TXT Value must match the NSO token exactly; unrelated existing records such as SPF, Google verification, or registrar codes do not verify the asset. The status panel supports per-record Retry verification, aRefresh all button, and auto-rechecks every 30s until all assets are verified. Mismatches and missing TXT records are shown as pending DNS state; red failure alerts are reserved for checks that cannot run.

Admin bypass: Platform super-admins see anAdmin bypass action on each unverified asset row. Bypassing requires a typed justification, marks the asset as scannable without a real DNS check, and renders an amber "Bypassed by admin" badge (never the green "Verified" badge) so the distinction is obvious in screenshots and reports. Every bypass is audited in/settings/platform-audit and/settings/verification-audit.

From /scans, pick an asset and queue a scan profile. Edge Scan runs in-app; Nmap/Nuclei/ZAP/Trivy require an online worker.

/settings/workers lists each worker, last heartbeat, in-flight jobs and queue depth. A worker missing for 2+ minutes is marked offline and its in-flight jobs are re-leased.

Review findings on /vulnerabilities. Mark each Fixed, Accepted, or False positive with a note; every transition is recorded in finding_status_history.

How to read what you see lives in Reading results.

/settings/team handles invites, role changes and removal. Removing a member revokes all access immediately.