Add files via upload

docs/en-US/configuration-profiles.md

@@ -21,7 +21,7 @@ server:
   tls_enabled: true
   tls_auto_self_sign: true
 auth:
-  password: "dev-only-change-me"
+  session_duration_hours: 12
 audit:
   enabled: true
   retention_days: 7
@@ -45,7 +45,7 @@ server:
   port: 8080
   tls_enabled: false
 auth:
-  password: "<long-random-password>"
+  session_duration_hours: 12
 audit:
   enabled: true
   retention_days: 30
@@ -90,7 +90,6 @@ Goal: long-running production red-team or security platform.
 
 ```yaml
 auth:
-  password: "<managed-secret>"
   session_duration_hours: 8
 audit:
   enabled: true

docs/en-US/configuration.md

@@ -12,7 +12,6 @@ server:
   port: 8080
   tls_enabled: true
 auth:
-  password: "change-me"
   session_duration_hours: 12
 openai:
   provider: openai
@@ -24,7 +23,7 @@ agent:
   tool_timeout_minutes: 60
 ```
 
-Change the default password immediately. Use HTTPS or a trusted reverse proxy in any shared environment.
+Change the initial `admin` password from the Web UI after first login. Use HTTPS or a trusted reverse proxy in any shared environment.
 
 ## Hot-Apply Boundaries
 

docs/en-US/runbooks.md

@@ -48,7 +48,7 @@ config.yaml
 
 ```yaml
 auth:
-  password: "<long-random-password>"
+  session_duration_hours: 12
 server:
   host: 127.0.0.1
   port: 8080

docs/en-US/security-hardening.md

@@ -6,7 +6,7 @@ This checklist covers pre-production and continuous hardening for CyberStrikeAI.
 
 ## Before Going Live
 
-- Change `auth.password` to a long random secret.
+- Change the initial `admin` password from the Web UI after first login.
 - Use HTTPS or a trusted reverse proxy.
 - Restrict access by IP, VPN, or bastion.
 - Enable `audit.enabled`.

docs/en-US/troubleshooting.md

@@ -37,7 +37,7 @@ Page inaccessible:
 
 Login fails:
 
-- wrong `auth.password`;
+- wrong RBAC user password;
 - config not applied/restarted;
 - stale cookie;
 - audit throttling repeated failures.