Cyber Dashboard turns daily cybersecurity news into an organized, locally managed security overview. It collects enabled news feeds, reads article content, enriches mentioned CVEs with NVD data, analyzes and classifies stories through your own OpenAI-compatible LLM endpoint, and produces daily, weekly, and monthly summaries.
It runs locally, stores its data in SQLite, and is available as a single executable with the frontend embedded.
Download the latest release · Report an issue · MIT License
- Collect recent articles from six curated cybersecurity sources.
- Read AI-generated article summaries and a combined daily briefing.
- Filter a collected day by news source or recollect it when needed.
- Track recently mentioned CVEs, CVSS scores, affected products, first-seen dates, and mention counts.
- Explore every collected CVE ranked by
CVSS + mentions × 0.2, or re-rank the list by CVSS, mention count, or first seen date. - Compare collection, severity, and threat-attribution trends across selectable 7-day, 30-day, and 90-day dashboard periods.
- Review threat-category and threat-actor distributions, with an option to exclude unattributed actors.
- Generate and keep weekly or monthly reports in English or Korean.
- Save reports and daily summaries through an A4 PDF print view.
- Protect collection, settings, CVE refreshes, and report changes behind an administrator login while keeping read-only views public.
- Connect cloud-hosted or local models through an OpenAI Chat Completions-compatible API.
- Save multiple LLM presets when different servers use different endpoints or API keys.
- Select collection sources, report timezone, language, and light or dark appearance.
The default sources are:
| Source | Default |
|---|---|
| The Hacker News | Enabled |
| Cybersecurity News | Enabled |
| StepSecurity Blog | Enabled |
| Dark Reading TI | Enabled |
| BleepingComputer | Enabled |
| 보안뉴스 / BoanNews | Disabled |
For full functionality, you need:
- An NVD API key. Collection does not start until one is registered.
- An OpenAI-compatible LLM endpoint for article analysis, daily summaries, and reports. Collection can still retain feed data without it, but AI features are skipped and the dashboard shows a warning.
- Google Chrome or Chromium when Dark Reading or BleepingComputer is enabled, because their article pages require browser-based loading.
Release binaries are provided for 64-bit Linux, macOS, and Windows (amd64 and arm64). Users of another platform or architecture can build Cyber Dashboard from source when Go and its dependencies support that target.
The LLM may be remote or run on the same machine, but its server must provide an OpenAI Chat Completions-compatible API. An API key is optional for a compatible local endpoint that does not require authentication.
If API costs are a concern or running a local LLM is impractical, an unofficial local proxy such as chatgpt-oauth-go provides another way to use a ChatGPT subscription.
Download the cyber-dashboard-full file for your operating system and architecture from GitHub Releases. This is the recommended build because it includes the frontend.
On Linux or macOS, rename the downloaded file to cyber-dashboard-full, then run:
chmod +x cyber-dashboard-full
./cyber-dashboard-fullOn Windows, run the downloaded .exe file.
Open http://127.0.0.1:13370 in your browser. The server listens only on the local loopback address by default.
On the first run, the terminal prints Initial dashboard password: <generated password>. Save it so you can sign in; the generated password is only displayed once.
The dashboard, daily briefings, CVEs, and saved reports remain readable while logged out. Select Log in to use administrative actions such as collection, CVE refresh, settings changes, and report creation or deletion. After signing in with the generated password, open Settings and replace it under Change password.
Open Settings, then:
- Choose English or Korean.
- Select the collection sources you want to use.
- Enter your NVD API key.
- Select the UTC offset used for collection dates and saved reports.
- Enter an OpenAI-compatible base URL, model name, and API key when required.
- Use Test connection to verify the LLM endpoint.
- Select Save settings. Unsaved source and settings changes can also be reverted.
The UTC offset defaults to the timezone of the machine that first ran the server. It is stored as a fixed offset rather than a named zone and does not follow daylight saving time, so collection dates and daily summaries keep the same day boundary all year.
Use the API base URL, not the full completion URL. For example:
https://api.openai.com/v1
http://127.0.0.1:8888/v1
Cyber Dashboard appends /chat/completions when it sends a request.
Select a date in the calendar and start collection. The selectable feed window covers the most recent 10 days according to the configured timezone.
Collection may take several minutes because the application can load full article pages, run per-article AI analysis, query NVD, and create the daily summary. Closing the collection dialog leaves the server-side job running; use the explicit cancel action if you want to stop it. Duplicate collection and CVE-refresh requests are blocked while a job is active.
Select New beside Reports, choose a weekly or monthly period, and generate the report. The report synthesizes the stored daily summary for every active day in the period; it is not created if any required daily summary is missing. Reports use the language and timezone saved in Settings at generation time. Deleting a report requires confirmation.
Weekly report example
Monthly report example
Initial article listings and RSS metadata come from cyber-news-feed. It normalizes only the content each source publishes through RSS or Atom into per-source static JSON; it does not crawl article pages. Cyber Dashboard separately loads an article page when it needs the full text.
- Fetch enabled RSS metadata and load available article pages.
- Extract full article text and publication metadata.
- Classify and summarize with the LLM, then enrich CVEs with NVD/CNA data.
- Store the results in the local SQLite database.
- Present the dashboard, daily briefings, and weekly/monthly reports.
Article analysis uses the article body when it is available, not only the RSS title or description. The configured LLM classifies the attack method, threat actor, actor country, target sector, victim count, financial damage, patch availability, and zero-day signal. Severity combines relevant CVSS data with contextual signals such as zero-day status, victim impact, financial damage, and patch availability.
NIST-provided CVSS data is preferred when present. CNA assessment data is retained as a fallback, and NVD records marked as rejected are removed from the active CVE view.
Long daily inputs are summarized in batches of at most five fact groups; two batches are joined directly and three or more are merged through an additional model request. Weekly and monthly reports instead use the stored daily summaries as their source, summarize them in batches of at most five days, and always merge multiple batches into one period-level narrative.
The prompts used to create LLM summaries and weekly/monthly reports were explored, compared, and iteratively refined with GPT-5.4-mini, GPT-5.6-luna, and Gemma 4. These models were used as prompt-development references; they are not runtime requirements. You may register another sufficiently capable model as long as its server provides an OpenAI Chat Completions-compatible API and reliably returns the requested JSON format.
AI output can still contain mistakes. Treat summaries, classifications, and severity as analysis aids, and verify important findings against the linked article and authoritative vulnerability sources before making security decisions.
Cyber Dashboard is local-first:
- Articles, CVEs, reports, presets, and settings are stored in a local SQLite database.
- NVD and LLM API keys are encrypted at rest with AES-256-GCM using a locally generated key file.
- Saved API keys are never returned to the settings page. Leave a key field blank to keep the existing value.
- Administrator sessions use HttpOnly, SameSite cookies; access and refresh tokens are never stored in browser storage. Changing the administrator password invalidates all previously issued tokens.
- Theme, dashboard-range, CVE-sort, and threat-actor filter preferences stay only in browser
localStorage; the theme initially follows the system setting. - The server binds to
127.0.0.1unless you explicitly change the address.
The default data directory is the operating system's user configuration directory:
| Operating system | Typical location |
|---|---|
| Linux | ~/.config/cyber-dashboard/ |
| macOS | ~/Library/Application Support/cyber-dashboard/ |
| Windows | %AppData%\cyber-dashboard\ |
Stop the application before copying its data, then back up both dashboard.db and dashboard.db.key. The key file is required to decrypt the API keys stored in the database.
Each release contains:
- Embedded executable:
cyber-dashboard-full-<os>-<arch>is the recommended standalone application. - Server-only executable:
cyber-dashboard-server-only-<os>-<arch>serves frontend files from an externalstaticdirectory. - Frontend archive:
frontend.zipcontains the files used by the server-only executable. - Checksums:
SHA256SUMScontains SHA-256 checksums for the release artifacts.
To use the server-only build on Linux or macOS, extract frontend.zip and rename the downloaded executable to cyber-dashboard-server-only. Then point it at the extracted static directory:
CYBER_DASHBOARD_STATIC_DIR=/path/to/static ./cyber-dashboard-server-onlyCYBER_DASHBOARD_ADDR— HTTP listen address. Default:127.0.0.1:13370.CYBER_DASHBOARD_TRUSTED_HOST— one additional hostname or IP address accepted by the Host and Origin guard for exceptional non-loopback access. Set it tononeonly when you explicitly accept weaker Host protection and do not want to configure a trusted hostname.CYBER_DASHBOARD_DATA_DIR— directory containing the database and encryption key. Default: the operating system's user configuration directory.CYBER_DASHBOARD_STATIC_DIR— frontend directory used only by the server-only executable. Default:static.
If you only need another port, keep the loopback address and change the port, for example 127.0.0.1:8081. Setting CYBER_DASHBOARD_ADDR=0.0.0.0:<port> listens on every network interface and can make the application reachable from other devices. For exceptional access through a hostname, set that single hostname in CYBER_DASHBOARD_TRUSTED_HOST before startup. If you set CYBER_DASHBOARD_TRUSTED_HOST=none, the application starts in an explicitly unsafe convenience mode: the trusted-host allowlist and DNS-rebinding protection are reduced, and startup logs a warning. Authentication still protects administrative actions, but public read endpoints and network exposure remain your responsibility. localhost and loopback IP addresses are always accepted. Never expose this mode directly to the public internet.
Go 1.26 is required. Clone this repository, enter its directory, then run:
go generate ./generator/license
go run ./cmd/cyber-dashboard-fullTo run with editable frontend files, use this from the repository root:
CYBER_DASHBOARD_STATIC_DIR=static go run ./cmd/cyber-dashboard-server-onlyGenerate the ignored license fixtures, then run the default Go and frontend tests from the repository root:
go generate ./generator/license
go test -race -shuffle=on -count=1 ./...
node --test test_static/*.test.jsBrowser tests require Chrome or Chromium and are excluded from the default Go test command. Run the dashboard UI suite after frontend changes:
go test -count=1 -tags=browser ./internal/web/browsertestTo include the browser-based article loader tests, run:
go test -race -shuffle=on -count=1 -tags=browser ./internal/feed/... ./internal/web/...Chromedp normally finds the installed browser automatically. For a non-standard installation, set CYBER_DASHBOARD_BROWSER_PATH for the dashboard UI suite; add the browser's directory to PATH when running the broader article-loader suite. Visual QA output is optional; set CYBER_DASHBOARD_VISUAL_QA_DIR and add the visualqa tag to include PDF evidence generation:
CYBER_DASHBOARD_BROWSER_PATH=/path/to/chrome go test -count=1 -tags=browser ./internal/web/browsertest
CYBER_DASHBOARD_VISUAL_QA_DIR=/path/to/output go test -count=1 -tags='browser visualqa' ./internal/web/browsertestAnother process is using port 13370. Stop that process, or start on another loopback port:
CYBER_DASHBOARD_ADDR=127.0.0.1:13371 ./cyber-dashboard-fullConfirm the base URL and model name, add the server-specific API key when required, increase the timeout for a slow local model, and run Test connection again. The base URL should normally end at /v1, not /chat/completions.
Dark Reading and BleepingComputer can require browser verification. Keep Chrome or Chromium installed, allow extra time for collection, and retry the affected day if a site temporarily rejects automation. Other successfully collected articles remain available.
Verify the NVD API key and use Refresh CVEs later. A score of 0.0 is shown as pending rather than treated as a low-risk score.
Cyber Dashboard is released under the MIT License. The application and its generated frontend.zip include third-party license notices, which are also available from Settings → Licenses.