Security scanning
Static scans, dependency checks and live-confirmed vulnerability probes on every build.
Security runs alongside QA on every build. It looks for problems in the code and then probes the running app to confirm which ones are real.
What it checks
- Static scanning of the project's code.
- Dependency checks for known vulnerabilities in the packages your app uses.
- Access-control probes that try to reach things a user should not see.
- Live-confirmed vulnerabilities, reproduced on the preview so you know a finding is real, not theoretical.
Safe to publish
Findings roll up into a view that tells you whether the build is safe to publish. A confirmed, serious finding can block publishing until it is resolved.
Fixing a finding
Each finding explains what was found and where. In many cases a fix is drafted for you to review. Approve it, or ask the builder to take a different approach.
The most common real finding is a permission gap: one user reading another user's records. Describing your roles clearly up front prevents most of them. See Roles and permissions.
Next: Guardrails.
Was this page helpful?