Update quick start documentation and simplify startup with new start.sh script

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

Author: elliotsecops

Makefile

@@ -0,0 +1,8 @@
+start: 
+	@bash ./start.sh
+
+start-nogui:
+	@bash ./start.sh --no-gui
+
+build-gui:
+	npm --prefix ./gui install && npm --prefix ./gui run build

QUICKSTART.md

@@ -2,7 +2,23 @@
 
 This guide will get you up and running in minutes with the optimized workflow. The easiest way to start is with the integrated Docker Compose setup that includes both the scanner and a vulnerable test API.
 
-## ⚡ One-Command Setup with Complete Test Environment
+## ⚡ One-Command Setup
+
+### Option 0: Easiest (no Docker)
+```bash
+# From the repo root
+./start.sh
+```
+- Auto-builds the GUI if needed and picks free ports when defaults are busy.
+- Default dashboard URL: http://localhost:8090 (the launcher prints the exact port).
+- No GUI: `./start.sh --no-gui`
+- Override ports: `./start.sh --port 8082 --metrics-port 8095`
+
+Shortcuts:
+```bash
+make start            # same as ./start.sh
+npm start             # same as ./start.sh
+```
 
 ### Option 1: Docker Compose (Recommended for Testing)
 ```bash
@@ -23,7 +39,7 @@ docker exec api-security-scanner ./api-security-scanner -config config-test.yaml
 
 ### Option 2: Quick Start (Dependencies Already Installed)
 ```bash
-# Just run the application
+# Development mode (GUI dev server)
 ./run.sh dev
 ```
 

README.md

@@ -12,20 +12,47 @@ A comprehensive, enterprise-grade API security testing platform with an intuitiv
 
 ## 🎯 Quick Start
 
-**Get running in 60 seconds:**
+Easiest way (one command):
+
+```bash
+# From the repo root
+./start.sh
+```
+
+- This will automatically build the GUI if needed and pick free ports if defaults are busy.
+- Default dashboard URL: http://localhost:8090 (the exact port will be printed on start).
+- Run without the GUI: `./start.sh --no-gui`
+- Override ports: `./start.sh --port 8082 --metrics-port 8095`
+
+Alternative shortcuts:
+
+```bash
+# Using Make
+make start            # with GUI
+a make start-nogui     # backend only
+
+# Using npm (from repo root)
+npm start             # with GUI
+npm run start:nogui   # backend only
+```
+
+Previous flow (kept for development):
 
 ```bash
 # Clone and install everything automatically
 git clone https://github.com/elliotsecops/API-Security-Scanner.git
 cd API-Security-Scanner
 ./install.sh
 
-# Or just run it (if dependencies are installed)
+# Or run development mode (GUI dev server)
 ./run.sh dev
 ```
 
-**Access the GUI:** http://localhost:3000 (development) or http://localhost:8080 (production)
-**Default Login:** `admin` / `admin`
+Access the GUI:
+- Development (run.sh dev): http://localhost:3000
+- Production via start.sh: http://localhost:8090 (or the printed port)
+
+Default Login: `admin` / `admin`
 
 ## 🌟 Why Choose This Scanner?
 
@@ -160,37 +187,44 @@ If you prefer manual installation:
 
 ### ⚡ Easy Commands
 
-```bash
-# Development mode (GUI + backend)
-./run.sh dev
+One-command launch (recommended):
 
-# Production mode (optimized single process)
-./run.sh prod
-
-# Backend only
-./run.sh backend
+```bash
+./start.sh                       # build GUI if needed and start dashboard
+./start.sh --no-gui              # backend only
+./start.sh --port 8082           # override backend port
+./start.sh --metrics-port 8095   # override dashboard port
+```
 
-# GUI development only
-./run.sh gui
+Shortcuts:
 
-# Build everything
-./run.sh build
+```bash
+make start           # same as ./start.sh
+make start-nogui     # same as ./start.sh --no-gui
+npm start            # same as ./start.sh
+npm run start:nogui  # same as ./start.sh --no-gui
+```
 
-# Stop all processes
-./run.sh stop
+Legacy/dev commands (still available):
 
-# Show all commands
-./run.sh help
+```bash
+./run.sh dev         # GUI dev server at :3000, backend at :8080
+./run.sh prod        # legacy production runner
+./run.sh backend     # backend only
+./run.sh gui         # GUI dev server
+./run.sh build       # build everything
+./run.sh stop        # stop processes
+./run.sh help        # show help
 ```
 
 ## 🚀 Usage
 
 ### 🌐 Web Interface (GUI)
 
 **Access Points:**
-- **Development Mode**: http://localhost:3000
-- **Production Mode**: http://localhost:8080
-- **Default Login**: `admin` / `admin`
+- Development (run.sh dev): http://localhost:3000
+- Production (start.sh): http://localhost:8090 (or the port printed by the launcher)
+- Default Login: `admin` / `admin`
 
 **GUI Features:**
 - **📊 Dashboard**: Real-time metrics and system health

config.yaml

@@ -151,7 +151,7 @@ tenant:
 # Metrics and monitoring dashboard configuration
 metrics:
   enabled: true
-  port: 8080
+  port: 8090
   update_interval: 30s
   retention_days: 30
 
@@ -238,23 +238,15 @@ auth:
     token_url: ""
     auth_url: ""
     redirect_url: ""
-    scopes: []
+    scopes: ""
 
     # JWT
     algorithm: "HS256"  # HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512
     secret: ""
     private_key: ""
     public_key: ""
     key_file: ""
-    claims:
-      iss: ""
-      sub: ""
-      aud: ""
-      exp: 3600
-      nbf: 0
-      iat: 0
-      roles: []
-      custom: {}
+    claims: ""
 
     # Mutual TLS
     cert_file: ""
@@ -269,14 +261,3 @@ server:
 headers:
   "User-Agent": "API-Security-Scanner/4.0"
   "X-Scanner": "true"
-    ca_file: ""
-
-# Server configuration
-server:
-  port: 8081
-  host: "localhost"
-
-# Request headers
-headers:
-  "User-Agent": "API-Security-Scanner/4.0"
-  "X-Scanner": "true"