diff --git a/dashcaddy-api/routes/auth/sso-gate.js b/dashcaddy-api/routes/auth/sso-gate.js
index 00c48b2..cf60f25 100644
--- a/dashcaddy-api/routes/auth/sso-gate.js
+++ b/dashcaddy-api/routes/auth/sso-gate.js
@@ -388,6 +388,16 @@ ft('chat').then(function(r){return r.text()}).then(function(t){
   fail('Auto-login unavailable. <a href="/web/">Open Emby manually</a> or '+authLink('re-authenticate at DashCaddy'),'API: '+JSON.stringify(j))
 }).catch(function(e){fail('Could not reach DashCaddy. <a href="/web/">Open Emby manually</a>','Error: '+(e&&e.message||'unknown'))})`
     },
+    sec: {
+      // sec.sami — fleet security dashboard. Unlike media apps it needs NO
+      // app-specific token: it's a plain web app behind the TOTP gate. The
+      // SHELL above has already verified check-session returned authenticated
+      // (otherwise it redirected to status.sami), so here we simply enter the
+      // dashboard. ?direct=1 bypasses the Caddy @needsAutoLogin redirect that
+      // sends bare "/" back to /dashcaddy-login, avoiding a loop.
+      title: 'Signing in to Security...', bg: '#070b10', accent: '#58a6ff',
+      body: `d.textContent='Session verified, opening dashboard...';go('/?direct=1');`
+    },
   };
 
   const cfg = pages[service];