fix

README.md

@@ -11,6 +11,7 @@ A Statping-like status monitoring app that demonstrates a Jenkins pipeline for D
 - **TCP checks** – Verify connectivity to host:port
 - **History storage** – SQLite database persists check results
 - **Reports** – Uptime %, avg/min/max latency, recent check history
+- **Authentication** – Session-based login; multi-user with admin-managed accounts
 
 ## Repository Structure
 
@@ -34,14 +35,21 @@ A Statping-like status monitoring app that demonstrates a Jenkins pipeline for D
 ## Manual Test
 
 ```bash
-# Build and run locally
+# Build and run locally (set SECRET_KEY and ADMIN_* for auth)
 docker build -t myapp:test .
-docker run -p 8080:8080 -v $(pwd)/data:/app/data myapp:test
-# Visit http://localhost:8080
+docker run -p 8080:8080 -v $(pwd)/data:/app/data \
+  -e SECRET_KEY=dev-secret-change-in-production \
+  -e ADMIN_USER=admin -e ADMIN_PASSWORD=changeme \
+  myapp:test
+# Visit http://localhost:8080 and log in
 ```
 
 Add services from the dashboard (e.g. `https://example.com`, `google.com:443` for TCP) and view reports.
 
+### Authentication
+
+The app uses session-based authentication. On first run, if `ADMIN_USER` and `ADMIN_PASSWORD` are set and no users exist, an admin user is created. Admins can add more users at `/users`. Set `SECRET_KEY` to a random value (e.g. 32-byte hex) for production.
+
 ### Check Retention and Rollups
 
 To limit database growth, the app **rolls up** old checks into hourly aggregates, then prunes raw data:
@@ -136,7 +144,16 @@ sudo usermod -aG docker ryanv
 
 If multiple users deploy to the same host, use separate paths (e.g. `/opt/myapp-alice`, `/opt/myapp-bob`) and update `docker-compose.yml` to use different ports for each app.
 
-The `docker-compose.yml` mounts `./data:/app/data` for SQLite persistence. Ensure the deploy directory is writable.
+The `docker-compose.yml` mounts `./data:/app/data` for SQLite persistence. The container runs as UID 1000. Ensure the data directory is writable:
+
+```bash
+mkdir -p data
+chown 1000:1000 data
+```
+
+### Dependency Audit
+
+Before deploying, run `make audit` (or `pip-audit`) to check for known vulnerabilities in dependencies.
 
 ### Branch Behavior