Download¶

Download RedPick applications for your platform. Two apps are available:

• Admin Dashboard — for the RedPick team (pentest management, terminal, runner)
• Client Portal — for clients (engagement tracking, findings, report download, billing)

Desktop App (v1.4.0)¶

Windows (x64) — BeDefended-Desktop-v1.4.0-windows-x64.zip

Client Portal (Desktop)¶

Windows (x64) — BD-ClientPortal-v1.0.0-windows-x64.zip macOS (Apple Silicon) — BD-ClientPortal-v1.0.0-macos-arm64.dmg

What Is the Client Portal?¶

The BeDefended Client Portal is the application for clients who commission penetration tests. It allows managing the entire engagement lifecycle without needing access to the terminal, testing tools, or internal data.

Key features:

• Engagement management — Create new penetration tests, define target and scope, monitor status in real time
• Intake questionnaire — Fill out the pre-engagement questionnaire (business context, tech stack, compliance) directly in the portal
• Digital authorization — Sign the test authorization with OTP confirmation (compliant with art. 1341-1342 Italian Civil Code)
• Sanitized findings — View discovered vulnerabilities (without PoC or internal details), track remediation status
• Attack chains — Mermaid diagrams of correlated vulnerability chains
• Report download — Download the report in PDF, HTML, or HWG format
• Retest — Request verification of remediated vulnerabilities
• Messaging — Communicate directly with the BeDefended team for each engagement
• Billing — Choose a plan, pay via Stripe, download invoices
• Team management — Invite colleagues with differentiated roles (admin, technical, viewer)
• 2FA — Two-factor authentication (TOTP) for enhanced security

Technical Architecture¶

The Client Portal is a separate Flutter project (client_portal/) that shares the design system (packages/bd_design_system/) with the admin dashboard. This ensures:

• Identical UI — Same colors, typography, widgets (BdCard, BdButton, BdInput, etc.) as the admin app
• Strict separation — The client portal has no access to terminal, runner, Claude sessions, or internal data
• Native desktop — Flutter codebase compiled for native desktop (Windows/macOS)

client_portal/          # Flutter app (desktop)
  lib/
    screens/            # 15 screens (login, dashboard, findings, etc.)
    providers/          # Riverpod (same pattern as admin)
    api/                # HTTP client (Dio) to /api/v2/client/*
    models/             # 8 models (Engagement, Finding, Message, etc.)
    widgets/            # Layout, engagement card, severity chart
    i18n/               # Italian (primary) + English

packages/
  bd_design_system/     # Shared Dart package
    lib/src/
      theme/            # BdColors, BdTypography, BdShadows, BdAnimations
      widgets/          # BdCard, BdButton, BdInput, BdBadge, BdModal, etc.

Tech stack:

Security — 4 Isolation Layers¶

1. Separate JWTs — Client tokens (type: "client") are rejected by all admin endpoints (/api/v1/*) and vice versa
2. Row-level isolation — Every query includes WHERE company_id = :current_company_id
3. Finding sanitization — Removed: poc_http, raw_markdown, steps_to_reproduce, internal file paths
4. Filtered WebSocket — Only phase_changed, finding_published, status_updated events (never context_updated or session_output)

Client Portal Installation (Desktop)¶

Typical Client Workflow¶

graph LR
    A[Registration] --> B[Login + 2FA]
    B --> C[New Engagement]
    C --> D[Intake Questionnaire]
    D --> E[Scope Definition]
    E --> F[Sign Authorization OTP]
    F --> G[BD Countersign]
    G --> H[Testing in Progress]
    H --> I[Findings + Report]
    I --> J[Remediation Tracking]
    J --> K[Request Retest]

Client Portal — Local Development Setup¶

To develop or test the Client Portal locally:

1. Backend (shared with Admin Dashboard)¶

cd redpick/dashboard/backend

# Install dependencies (includes client portal ones)
pip install -r requirements.txt

# Start the server
uvicorn app.main:app --host 127.0.0.1 --port 8880 --reload

The backend automatically exposes both admin (/api/v1/*) and client (/api/v2/client/*) endpoints.

curl http://127.0.0.1:8880/api/v2/client/health
# Response: {"status":"ok","service":"client-portal"}

2. Client Portal (Flutter)¶

cd redpick/client_portal

# Resolve dependencies
flutter pub get

# Launch in desktop Windows mode
flutter run -d windows

API configuration: The Client Portal connects to http://localhost:8000 by default. To change:

flutter run -d windows --dart-define=API_BASE_URL=http://127.0.0.1:8880

3. Register a test company¶

curl -X POST http://127.0.0.1:8880/api/v2/client/auth/register \
  -H "Content-Type: application/json" \
  -d '{"company_name":"Test Corp","email":"test@test.com","password":"testtest","full_name":"John Doe"}'

Client Portal vs Admin Dashboard — Comparison¶

Client Portal Troubleshooting¶

Proxy Extensions (Burp Suite & Caido)¶

Bridge manual and automated testing — send proxy traffic to the BeDefended Dashboard for AI analysis.

Burp Suite Extension¶

Download bd-proxy-bridge-1.1.0.jar

Features: AI Real-Time Analysis (Claude-powered, async), Scanner tab integration, response fingerprint dedup, endpoint dedup with path normalization, VulnContext tagging (auth/payment/admin/API), Burp target scope integration, injection point extraction, binary content filtering.

Setup: Extensions > Add > Select JAR > Configure Dashboard URL + API Key in "BD Bridge" tab. AI Analysis is ON by default.

Caido Plugin¶

Download bd-proxy-bridge-caido-v1.0.0.zip

Features: Native Caido SDK (backend/frontend split), sdk.requests.inScope() filtering, SQLite queue persistence, response/endpoint dedup, automatic Caido Finding creation for AI-flagged requests.

Setup: Plugins > Install from folder > Select extracted directory > Configure in "BD Bridge" settings page.

What Is the Desktop App?¶

The RedPick desktop app is a native Flutter application (compiled to native code via Skia — not a web wrapper) providing:

• Real-time findings — Live vulnerability tracking as pentests run via WebSocket
• Attack chain visualization — Multi-step exploitation path diagrams (Mermaid SVG)
• Retest tracking — Monitor remediation status across engagements
• Report generation — Export professional pentest reports (HTML/PDF)
• Terminal emulator — Interactive Claude Code sessions directly in the app
• Session streaming — Live output from running pentest agents
• Compliance gap analysis — Multi-framework (PCI-DSS, SOC2, ISO27001, GDPR, ASVS, DORA, NIS2)
• Surface drift detection — Snapshot creation and diff comparison
• Remediation code generation — Framework-specific fix snippets per finding
• Webhook/SIEM integration — Slack, Teams, Splunk, CEF, syslog
• Continuous monitoring — Cron-based periodic re-scan scheduling
• Learning engine — Technique extraction and success recommendations
• Team assignments — Skill-to-pentester allocation with status tracking
• Cost & ROI tracking — Pre-engagement estimates and post-engagement metrics
• CI/CD code review — Client management, API key provisioning, 4-step onboarding wizard

Installation¶

Local Development Setup¶

To run the RedPick desktop app connected to a local backend, follow these prerequisites:

Backend Requirements¶

1. FastAPI Backend (Required)¶

The desktop app is a client-only application — it requires a running RedPick backend server. For local development:

# Clone the repository
git clone https://github.com/sbbedefended/redpick.git
cd redpick/backend

# Install Python 3.13+
python --version  # Verify Python 3.13 or later

# Create virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Start the FastAPI server
uvicorn app.main:app --host 127.0.0.1 --port 8880 --reload

Backend runs on: http://127.0.0.1:8880

2. Database Setup¶

The backend uses SQLite (default, development-friendly) or PostgreSQL (production):

SQLite (Default — No setup needed): - Database file: backend/app.db (auto-created on first run) - No additional configuration required

PostgreSQL (Optional — for production-like testing):

# Install PostgreSQL 14+
# Create database
createdb redpick

# Set environment variable
export DATABASE_URL="postgresql://user:password@localhost:5432/redpick"
# On Windows: set DATABASE_URL=postgresql://user:password@localhost:5432/redpick

# Run migrations (if any)
python -m alembic upgrade head

# Start backend
uvicorn app.main:app --host 127.0.0.1 --port 8880 --reload

3. Create Test Users¶

After the backend starts, create a test user:

# Option A: Via API (curl)
curl -X POST http://127.0.0.1:8880/api/v1/admin/users \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"admin","role":"admin"}'

# Option B: Via FastAPI docs (interactive)
# Open http://127.0.0.1:8880/docs
# Navigate to POST /api/v1/admin/users
# Create user with: {"username":"admin","password":"admin","role":"admin"}

Desktop App Configuration¶

1. Server URL Entry (First Launch)¶

When you launch bd_desktop.exe or RedPick.app:

1. Connect Screen appears (first launch only)
2. Enter server URL: http://127.0.0.1:8880
3. Click Test Connection — should show ✅ "Connected"
4. Click Continue

For remote server (e.g., deployed backend): - Enter: https://your-domain.com (HTTPS required for remote)

2. Login¶

After connection test: 1. Enter username: admin 2. Enter password: admin (or your created password) 3. Click Login

Credentials are stored securely in: - Windows: Credential Manager - macOS: Keychain

Optional: Credentials Configuration File¶

For faster local testing, pre-populate credentials (not recommended for production):

Create ~/.bd-dashboard/config.json:

{
  "serverUrl": "http://127.0.0.1:8880",
  "username": "admin",
  "password": "admin",
  "autoConnect": true
}

The app will auto-connect on launch (stored securely after first login).

Port Configuration¶

To change backend port:

# Start backend on custom port
uvicorn app.main:app --host 127.0.0.1 --port 9000

# Then enter in app: http://127.0.0.1:9000

Firewall & Network¶

If app can't connect to backend:

1. Check backend is running:

   curl http://127.0.0.1:8880/api/v1/health
   

   Should return: {"status":"ok"}

2. Check Windows Firewall (if applicable):

3. Allow bd_desktop.exe through firewall

4. Or: Allow inbound on port 8880

5. Check macOS Firewall:

6. System Settings > Privacy & Security > Firewall

   • Allow RedPick app

7. If using VPN or proxy:

8. Configure in desktop app Settings
9. Backend must be accessible through your network

Full Checklist¶

• [ ] Python 3.13+ installed
• [ ] Backend cloned from sbbedefended/redpick
• [ ] Backend dependencies installed (pip install -r requirements.txt)
• [ ] Database initialized (SQLite auto-creates, or PostgreSQL configured)
• [ ] Test user created (username: admin, password: admin)
• [ ] Backend running on http://127.0.0.1:8880
• [ ] Backend health check passes: curl http://127.0.0.1:8880/api/v1/health
• [ ] Desktop app downloaded and extracted
• [ ] Desktop app first launch: enter http://127.0.0.1:8880
• [ ] Login with admin / admin
• [ ] Dashboard loads with test data

Troubleshooting¶

Release Notes¶

v1.4.0 — Roles, Licensing & AI Analysis (2026-03-17)¶

• 5 unified roles — admin, pentester, client, client_viewer, bughunter with role-filtered sidebar
• Continuous AI Proxy Analyzer — Background claude -p analysis of Burp/Caido traffic (pentest-grade, 10 OWASP categories)
• Bug Bounty integration — Connect HackerOne, Bugcrowd, Intigriti, YesWeHack. Sync programs, push reports, track submissions + payouts
• Encrypted report delivery — RSA-4096 + AES-256-GCM hybrid encryption. Clients upload public key, download encrypted reports
• Ticketing system — Bug reports with auto-sync to GitHub Issues (sbbedefended/redpick)
• Bughunter license tiers — Solo, Team, Pro with platform connections and collaboration
• Client license tiers — Essentials, Professional, Enterprise with feature gating
• Proxy History + Scan Intel — Record and analyze manual proxy traffic per engagement
• Approved Targets — Admin management of pre-approved pentest targets
• Slack notifications default — Always ON for automated /pentest, --no-notify to disable
• Flutter 3.41.4 — Upgraded from 3.27.4
• Full changelog

v1.3.0 — Full Dashboard Parity (2026-03-16)¶

• 17 new screens — Compliance, Surface Drift, Remediation, Threat Model, Executive Brief, Retro, Attack Sim, Webhooks, Confidence, Monitoring, Learning, Assignments, Costs & ROI, Tool Compare, CI/CD Clients, CI/CD Onboarding
• 10 new API clients — Complete backend integration for all new features
• Expandable sidebar — Per-engagement sub-navigation with 15 sub-items (matches web dashboard exactly)
• Full parity — Desktop app now matches 100% of web dashboard pages (36 screens total)
• Full changelog

v1.2.0 — Knowledge Refresh (2026-03-16)¶

• Knowledge Refresh screen — Full-featured knowledge pack management with live output
• Report Generator — Custom report generation with template selection
• Vuln Library — 168 vulnerability templates with search and detail view
• Full changelog

v1.1.0 — Dashboard Overhaul (2026-03-15)¶

• Vulnerability Library: 168 templates imported, HTML rendering, dedicated detail view, locale tabs
• Secure Code Review: new launch flow with GitHub/GitLab/Bitbucket OAuth repository connection
• Header: split "Launch" into "Code Review" + "Pentest" buttons (web + desktop)
• Terminal: ConPTY support via pywinpty, WebSocket proxy through host runner
• Rebranding: removed all PwnDoc references, fully BeDefended
• Full changelog

v1.0.1 — Initial Release¶

All releases and changelogs are available on the GitHub Releases page.

Need Help?¶

• Getting Started Guide — Full setup instructions
• Configuration — Credentials, proxy, VPN setup