Feature flags

Settings → Feature flags (Superadmin only) turns optional parts of RedScribe on or off, instance wide. There’s exactly one set of flags per instance; there’s no per-user or per-engagement version of any of them.

Flag	Controls	Default
Notifications	Reviewer and QA assignment notifications, both in-app and email. A user’s own email opt-out (see Notifications & profile) still applies on top of this	On
Recurrence & trends	Recurring-vulnerability detection on the finding page, and the cross-engagement Trends page	On
CVSS calculator	The Open CVSS calculator button and its v3.1/v4.0 calculator on the finding and catalogue create/edit forms	On
Global search	Search across every engagement and finding the user has access to	On
Scan import	Scanner import (Nmap, Burp Suite, Nuclei) from the findings list	On
Require MFA	Requires two factor authentication for every local account, not just Superadmin, which always requires it regardless of this flag	On
Client portal	Allows client-role accounts to log in and use the Client Portal. Managing client companies and accounts stays available to Superadmin and Team Lead either way	Off

What actually happens when a flag is off

Every one of these is enforced in two places at once, not just hidden in the UI: the relevant nav link or button disappears, and the page itself independently checks the flag and refuses to serve the request even if someone reaches the URL directly. Turning a flag off is real access control, not a cosmetic hide.

They fall into two rough groups, depending on how much they actually shut down.

Flags that just hide part of the interface

These narrow what’s available without blocking a whole page or feature outright:

• CVSS calculator off removes only the Open CVSS calculator button and its script from the finding and catalogue forms. The score and vector fields themselves stay on the form either way, since they’re plain text fields underneath; you’d just be typing the vector by hand instead of using the calculator.
• Notifications off stops any in-app or email notification from being generated for review and QA assignment, instance wide. It’s a stronger switch than a single user’s own notification preferences, which only ever narrow what that one person receives, never re-enable something this flag has turned off for everyone.
• Require MFA off only changes whether accounts other than Superadmin are forced into MFA enrollment. It never disables MFA for an account that already enrolled voluntarily, or for a role that requires MFA on its own (see Roles & permissions), and it never touches Superadmin, which requires MFA unconditionally regardless of this flag.

Flags that block a whole request

These stop the underlying page or action from running at all, not just hide the way into it:

• Scan import off removes the Import scan button from the findings list, and blocks the import request directly if someone tries to reach it anyway.
• Global search off removes Search from the sidebar and Home, and blocks the search page itself the same way.
• Recurrence & trends off hides the recurring-vulnerability panel on the finding page, hides the Trends link from the sidebar and Home (which also needs the trend reporting permission; both have to be true for the link to show), and blocks the Trends page itself the same way if reached directly.
• Client portal off is enforced at two separate points. A client account with completely correct credentials gets the same generic invalid-login message a wrong password would, not a distinct “portal disabled” message, so the flag being off isn’t distinguishable from a bad password by someone probing the login form. If it’s turned off while a client is already logged in, their very next request signs them out immediately with an explicit “client portal is currently unavailable” message. Either way, managing client companies and accounts from the staff side is unaffected; this flag only gates the client-facing login and portal itself.

Turning off Require MFA is a deliberate opt-out, not a default

This ships on, so every local account (not just Superadmin, which always requires MFA regardless of this toggle) is enrolled from first login. Turn it off only for a local or disposable dev/test instance, or if you’d rather require it per role instead (see Roles & permissions) than instance-wide.

Changes take effect immediately

Toggling any of these takes effect on the very next request, instance wide. There’s no restart, no cache to clear, and no per-user override to worry about.