Frequently asked questions

It's a self-hosted security analytics dashboard for Nginx. It tails your access and error logs, flags known attack patterns — SQL injection, XSS, path traversal, scanner fingerprints, credential stuffing, API abuse — classifies them against CWE, and generates audit-ready reports (SOC 2 / NIST CSF style) via a local Ollama model, a cloud AI provider, or a deterministic fallback. It also produces copy-pasteable firewall remediation commands.

No. It only ever generates commands — iptables, UFW, Nginx deny, Cloudflare, or fail2ban — for you to review and run yourself. It never applies anything to your host, firewall, or DNS automatically. This is a deliberate design choice: it's a monitoring and reporting tool, not an autonomous enforcement agent.

No — it's designed to run as an internal operator tool behind your own network-level access control (an Nginx IP allow-list, a cloud firewall, a VPN). The optional AUTH_USERS login screen and APP_API_KEY shared secret are additional layers on top of that, not substitutes for it.

No. Any combination of providers is optional and independently configurable. If none are reachable, report generation falls back automatically to a deterministic, template-based engine, so you always get a report.

Nginx combined-log-format access and error logs, read from a local path or a mounted Docker volume. You can also upload a file for a one-off pass, or paste raw log lines directly for quick testing.

Node.js 22+ for a direct install, or Docker & Docker Compose for a container deploy — either one, not both. Everything else (Ollama, cloud AI keys) is optional. Full steps are in the install guide.

That's intentional. The default Docker Compose setup binds to 127.0.0.1:3015 on the host, not 0.0.0.0, so it isn't accidentally exposed to the internet. Put it behind your own reverse proxy with TLS for external access.

That value is baked into the frontend bundle at build time, not read at runtime. Run docker compose build (not just up) after changing it.

The default docker-compose.yml mounts your log directory read-only, as a safety default. This feature appends synthetic log lines to exercise the ingestion pipeline, so it needs a writable path — point NGINX_LOG_PATH at one if you want to use it.

Entirely through Lemon Squeezy's built-in License Keys feature. After checkout, Lemon Squeezy emails you a key automatically as part of your receipt. Paste it into APP_LICENSE_KEY in your .env file and restart the app. There's no separate account system, and no in-app "enter your key" screen.

The app keeps working fully — this is a soft check, not a hard lock. You'll see a red pulsing "Unlicensed" badge and a persistent banner, and you'll be operating outside the terms of the license agreement.

One-time, currently £99.99. It's a perpetual license to the major version you buy, including all minor and patch updates released within that series. Major version upgrades (e.g. v2 → v3, if it ever exists) are offered separately.

Yes, for the license check specifically. At startup, and once every 24 hours after that, the app calls Lemon Squeezy's License API to validate the key. The detection and reporting features themselves can run fully offline (with Ollama or the deterministic engine) — only the license check needs outbound access.

No — the license does not permit resale, sublicensing, or redistribution of the software or its source. See the EULA for the full terms.

Lemon Squeezy is the merchant of record for this purchase and handles payment, VAT/sales tax, and receipts — refund requests are handled through them. See our terms & conditions for details.

Not by default. The app runs entirely on your own infrastructure. If you configure a cloud AI provider (Gemini, OpenAI, or Claude) and choose it for a specific report or analysis, the data needed for that request is sent to whichever provider you selected — nothing else is transmitted anywhere. See our privacy policy.

Just your license key, to activate or validate it against Lemon Squeezy's License API. No log data or telemetry from your deployment is included in that call.