Compliance dashboard

Your app's compliance results, on your machine.

Once your app has been scanned (see Compliance scanning), run this from your project:

anvil compliance dashboard

  ✔ Latest scan: 20261008T123221Z-scheduled
  ✔ Mapped 56 resources to Anvil components

  Dashboard running at http://127.0.0.1:53817/?token=4f9c…#/overview
  Press Ctrl+C to stop.

The CLI reads your results from your AWS account, starts a small web server on your machine and opens it in your browser. It runs until you press Ctrl+C. There's nothing to install — the dashboard is part of the CLI and works offline.

Try it

What it shows

Overview

• A score for each framework — how many of the requirements Prowler checked are passing.
• Failing checks by severity: critical, high, medium, low. Click one to see the list.
• What changed since the previous scan: new failures and fixed findings.
• Coverage: how many resources were scanned, and which had no checks for your chosen frameworks.
• The components with the most failures.

Components

Findings grouped the way you wrote your app: each component (a SvelteKitSite, a Waf, your state bucket…), the resources it created, and what's failing on each. This comes from your stack's state, so a failing bucket shows up as "web → S3 bucket" rather than a bare resource ID.

Findings

Every check result, with search, severity and framework filters, and grouping by check, component or resource. Failures are shown by default; turn on Show passing to see everything.

Frameworks

Each framework's requirements, marked passing or failing, with the checks behind each one — the view to share with an auditor.

Finding detail

Click any finding for the full picture: the result, the resource and its component, why it matters, how to fix it, which framework requirements it affects, and reference links.

Reading the results

• Scores are strict. A requirement only counts as passing if every check behind it passes for your app, so one misconfigured resource can fail several requirements.
• A passing score isn't certification. Prowler checks what it can automate; many requirements also need evidence from you.
• The badge in the header shows Up to date when the scan ran after your last deploy, or Deployed since this scan when the results may be out of date.
• Switch scans with the picker in the header — each scan shows what triggered it: scheduled, deploy or manual.
• Rescan starts a new scan with your app's settings. It takes a minute or two, and the dashboard loads it when it's done.

Privacy and security

Scan results describe your security weaknesses, so the dashboard keeps them local:

• It only listens on 127.0.0.1, so it's never reachable from your network.
• Each run has a random access token, so other users and other websites can't read your results. The token is removed from the address bar once the page loads.
• The CLI fetches results with your AWS credentials; the browser never sees them.
• Results are held in memory and never written to disk.
• The page loads nothing from the internet and sends nothing anywhere.

Options

On a remote machine

If you work over SSH or in a remote dev environment, forward a port and open the printed URL in your local browser:

ssh -L 53817:127.0.0.1:53817 you@dev-box
anvil compliance dashboard --no-open --port 53817

Credits

Scans are powered by Prowler, the open-source cloud security tool (Apache-2.0). The dashboard shows which Prowler version produced each scan, so you always know where the evidence came from.