TheStaff — consent-based security-awareness game

🛰️

Discover & map

nmap scans the event LAN on a schedule and draws each device as a live card around a central hub.

🩺

Find & fix

Open ports → services → likely CVEs with CVSS, plain-language summaries, fix steps and copy-paste detection-only tests.

🤖

AI assistant

Per-CVE chat (your Claude or OpenAI key) that explains the finding and helps you verify it's no longer exploitable.

🛡️

Privacy mode

Mask device IPs on the diagram and in AI messages — safe to show on a shared screen.

Quick start

Try it now mock mode — no network, nmap or container

./scripts/dev.sh
cd frontend && npm install && npm run dev

then open http://localhost:5173/dashboard ← the live dashboard

Run for real container, at the event (rootful Podman)

cp .env.example .env
sed -i "s|^THESTAFF_ADMIN_TOKEN=.*|THESTAFF_ADMIN_TOKEN=$(openssl rand -hex 24)|" .env
sudo ./start.sh

then open http://<host-ip>:8000 ← dashboard on the event box

The generated token is required; paste the same value into ⚙ Settings → Operator token. Rebuild later with sudo ./update.sh.

Screenshots

Shown in privacy mode on the built-in demo network — IPs masked to 192.168.x.x.

Live radial network diagram — **Live diagram.** Every device as a card around the event hub; colour = worst finding state.

AI assistant chat about a CVE — **Ask AI.** A per-CVE chat that explains the finding and helps verify the fix (your own API key).

Settings panel — **Settings.** Privacy mode, AI keys & model, and the operator token — all in one panel.

Operator token & AI keys

Operator token

A secret you generate gates every mutating/active action (scan, accept, healthcheck, wipe, AI). It lives in a gitignored .env; start.sh/update.sh require it. Paste the same value into ⚙ Settings → Operator token.

openssl rand -hex 24

AI keys & model

Add a Claude or OpenAI key in Settings — it's stored only in your browser and proxied per request (never saved on the server). Click Discover models, pick a default, and an Ask AI button appears on each CVE.

Privacy mode

Toggle it to mask IPs on the diagram and in messages sent to the AI — so a guest's address isn't shown on a shared screen or sent to a third-party model.