Disable dashboard by default

README.md

@@ -87,7 +87,10 @@ docker run --rm -p 3000:3000 ghcr.io/sgasser/pasteguard:latest
 If the detector in 0.9.3 exits with `SIGSEGV`, add `-e ORT_DISABLE_TELEMETRY=1`
 to `docker run`; see [installation troubleshooting](https://pasteguard.com/docs/installation).
 
-Open [localhost:3000](http://localhost:3000) for the dashboard.
+Open [localhost:3000/health](http://localhost:3000/health) to check the service.
+
+The dashboard is disabled by default. Set `dashboard.enabled: true` in `config.yaml`
+to enable it; see [dashboard configuration](https://pasteguard.com/docs/configuration/overview#dashboard).
 
 Point your app or agent to PasteGuard instead of the provider:
 

config.example.yaml

@@ -146,11 +146,12 @@ logging:
   # Only scanned roles (scan_roles) are stored, after PII and secrets are masked.
   log_masked_content: true
 
-# Dashboard settings
+# Dashboard settings (disabled by default)
 dashboard:
-  enabled: true
+  enabled: false
 
   # Basic auth for dashboard (optional)
+  # Without auth, anyone who can reach the server can read dashboard logs.
   # auth:
   #   username: admin
   #   password: ${DASHBOARD_PASSWORD}

docs/api-reference/dashboard-api.mdx

@@ -4,6 +4,8 @@ description: Request logs and statistics
 ---
 
 The dashboard provides an API for accessing request logs and statistics.
+Enable it with `dashboard.enabled: true`; it is disabled by default.
+If `dashboard.auth` is configured, supply Basic Authentication credentials.
 
 ## Logs
 

docs/configuration/overview.mdx

@@ -56,10 +56,15 @@ dashboard:
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `enabled` | `true` | Enable dashboard at `/dashboard` |
+| `enabled` | `false` | Enable dashboard at `/dashboard` |
 | `auth.username` | - | Basic auth username |
 | `auth.password` | - | Basic auth password |
 
+Set `dashboard.enabled: true` to enable the dashboard and its logs/statistics APIs.
+Authentication is optional. Without `dashboard.auth`, anyone who can reach the
+server can read dashboard data; configure authentication or restrict network access.
+Existing configurations with `enabled: true` remain enabled.
+
 ## Environment Variables
 
 Use `${VAR}` or `${VAR:-default}` syntax:

docs/installation.mdx

@@ -29,7 +29,9 @@ docker run --rm -p 3000:3000 ghcr.io/sgasser/pasteguard:latest
 ```
 
 PasteGuard runs on `http://localhost:3000`. Open
-[http://localhost:3000](http://localhost:3000) for the dashboard.
+[http://localhost:3000/health](http://localhost:3000/health) to check the service.
+The dashboard is disabled by default. Enable it with `dashboard.enabled: true`
+in a mounted `config.yaml`; see [dashboard configuration](/configuration/overview#dashboard).
 
 <Note>
 The first start loads the detection model and can take a little longer; the

docs/quickstart.mdx

@@ -9,7 +9,8 @@ description: Run PasteGuard locally and connect Browser Chat, Apps & APIs, or Co
 docker run --rm -p 3000:3000 ghcr.io/sgasser/pasteguard:latest
 ```
 
-PasteGuard runs on `http://localhost:3000`. Open `http://localhost:3000` to see the dashboard.
+PasteGuard runs on `http://localhost:3000`. Open `http://localhost:3000/health` to
+check the service. The dashboard is disabled by default.
 
 <Note>
 For custom configuration, Docker Compose, or persistent logs, see [Installation](/installation).
@@ -61,7 +62,8 @@ The name and email were masked before reaching OpenAI and restored in the respon
 
 ## 5. View Dashboard
 
-Open `http://localhost:3000` in your browser to see:
+Set `dashboard.enabled: true` in a mounted `config.yaml` (see [Installation](/installation))
+and restart PasteGuard. Open `http://localhost:3000/dashboard` in your browser to see:
 
 - Request history
 - Detected PII and secrets

src/config.test.ts

@@ -16,6 +16,31 @@ function cleanupConfig(path: string): void {
 }
 
 describe("config", () => {
+  test.each([
+    ["omitted dashboard", "", false],
+    ["empty dashboard", "dashboard: {}", false],
+    ["explicitly disabled dashboard", "dashboard:\n  enabled: false", false],
+    ["explicitly enabled dashboard", "dashboard:\n  enabled: true", true],
+  ])("loads %s", (_label, dashboard, enabled) => {
+    const path = writeConfig(`
+mode: mask
+providers: {}
+pii_detection:
+  detector_url: http://localhost:5002
+${dashboard}
+`);
+
+    try {
+      expect(loadConfig(path).dashboard.enabled).toBe(enabled);
+    } finally {
+      cleanupConfig(path);
+    }
+  });
+
+  test("ships with the dashboard disabled in the example configuration", () => {
+    expect(loadConfig("config.example.yaml").dashboard.enabled).toBe(false);
+  });
+
   test("accepts a valid detector HTTP URL", () => {
     const path = writeConfig(`
 mode: mask

src/config.ts

@@ -174,7 +174,7 @@ const DashboardAuthSchema = z.object({
 });
 
 const DashboardSchema = z.object({
-  enabled: z.boolean().default(true),
+  enabled: z.boolean().default(false),
   auth: DashboardAuthSchema.optional(),
 });
 

src/index.ts

@@ -160,7 +160,7 @@ Codex:      http://${host}:${port}/codex
 Mask API:   http://${host}:${port}/api/mask
 Health:     http://${host}:${port}/health
 Info:       http://${host}:${port}/info
-Dashboard:  http://${host}:${port}/dashboard
+Dashboard:  ${config.dashboard.enabled ? `http://${host}:${port}/dashboard` : "disabled"}
 
 Mode:       ${config.mode.toUpperCase()}
 ${modeInfo}