Dashboard

Coodoo always opens on the Dashboard. It shows all your repositories on GitHub on one screen, each with a health score. You see right away which ones need attention, and from here you open a project. On the left you see whether Claude Code, Codex, git and GitHub are ready.

Opening and closing a project

• Repositories that are already on this computer are at the top, marked On this computer. Click Open.
• If a repository isn't on this computer yet, click Clone and open. Coodoo clones it to this computer and opens it.
• Add project (top right) creates a new repository, or picks one from your list on GitHub.
• Done with a project? Click the dashboard icon in the top left, or choose Close project in the project menu. You're back on the dashboard. If the autopilot is still running, it just keeps working.
• The bin removes a project from Coodoo. Everything stays on GitHub.

Projects on this computer that your token can't read (for example from an organization) are shown without a score. Give that organization its own token under Accounts → GitHub → Organizations; see Installation. Then all its repositories appear with a score.

Coodoo shows every repository your GitHub token can reach. Archived repositories are left out.

Categories

With Add category you divide the dashboard, for example by client or by kind of project. Every category is a block of its own with its repositories, the lowest score first.

• Putting a repository in a category: drag the card onto the category, or choose the category in the repository's details panel. A repository is in one category at a time.
• Renaming: double-click the name, or use the pencil that appears when you hover over the header. You change the order by dragging a category by its header up or down.
• Deleting: the repositories go to No category; nothing is lost.
• The arrow in front of the name collapses or expands a category.

The grouping is a setting, so like your other settings it goes to all your computers through your private repository coodoo-settings (see On all your computers).

The score

Every repository starts at 100 points. Points go off for what makes it vulnerable:

What	Deduction
Critical security alert	25 each, at most 60
High security alert	10 each, at most 40
Medium alert	3 each, at most 15
Low alert	1 each, at most 5
Default branch not protected	10

Score	Means
90 or more	Healthy
70 to 90	Attention
Below 70	Risk

Under each repository Coodoo says why the score is what it is.

Dependabot off is a failure

When Dependabot alerts are off, you hear nothing about known vulnerabilities in the packages your project uses. Coodoo marks that repository red with Dependabot off, and its score is at most 40.

Click Switch on Dependabot at the repository, or Switch on Dependabot for all … at the top to switch it on everywhere at once. Coodoo reads the repository again right after.

For this your token needs the Administration (read and write) permission; a new token from Coodoo already has it. Coodoo never switches Dependabot off again; that can only be done on GitHub itself.

Fixing alerts

Click a repository with open alerts and choose Fix … alerts. Coodoo puts one goal with priority in that project's queue and opens it. The autopilot updates the packages and checks that build and tests pass. If the repository isn't on this computer yet, the button says Clone and fix: Coodoo clones it first.

Alerts that are already fixed on the default branch, but that GitHub hasn't closed yet, don't count in the score. You see them as … fixed on the card and as Fixed, waiting for GitHub in the details panel. GitHub closes them by itself, sometimes only after a few hours.

At Automatic security updates you switch on GitHub's own security updates. GitHub then opens a pull request itself for every alert that has a newer version, even when Coodoo isn't running. This only works when the Dependabot alerts are on, and your token needs the Administration permission for it.

More

• Alerts opens the repository's security alerts on GitHub.
• Open opens the repository as a project in Coodoo, if you already added it.
• Search a repository and Only with problems make a long list shorter.
• Check again reads everything from GitHub again. Otherwise Coodoo uses what it already knew for five minutes.