# Security

> Scan your site for exposed secrets, risky code and vulnerable packages, let the AI fix what it finds, and teach the scanner what is intended.

Source: https://knowledge.estage.com/project-settings/security/
Part of the ESTAGE knowledge base (https://knowledge.estage.com). Full corpus: https://knowledge.estage.com/llms-full.txt

---
The **Security** tab scans your site's code for **exposed secrets, risky code and vulnerable
dependencies**, and lets the AI fix what it finds. Run it before you launch, and again after big
changes — especially ones that added API keys or third-party code.

It lives in **Settings → Team & Security → Security**. It isn't offered for mobile apps.

## Running a scan

The banner at the top shows when you last scanned. Pick one of two scans:

| Scan | What it checks | Cost |
| --- | --- | --- |
| **Basic security scan** | Static checks of your code, plus your packages against a database of known vulnerabilities. | Free and instant. |
| **Deep security scan** | Everything in the basic scan, plus an AI review of your code. | Uses your AI credits. |

## Reading the results

**Detected Issues** lists each finding with its severity (critical, high, medium, low or info),
the file and line it's in, what's wrong and how to fix it. Findings from the AI review carry an
**AI** badge.

- **Try fix** — the AI edits the file to fix the issue and tells you what it changed. It uses your
  AI credits, and it's offered only for findings in your own code, not for package issues.
- If a fix doesn't work, you get the reason plus two ways out: **Accept as intended** or **Hide
  this item**.
- **Dismiss** (the **×** on a finding) hides it. Dismissed findings are listed at the bottom,
  where **restore** brings one back.

**Project dependencies** shows how many packages your project uses and how many known
vulnerabilities they have. Click **Review** to see each one, with the version that fixes it.

## Teaching the scanner what's intended

Some findings are deliberate — a status page that's public on purpose, a key that's meant to be
public. Click **Edit security memory** and write a note the deep scan reads as context, so it
stops flagging them. **Accept as intended** on a finding adds a line for it to the memory for you.

## Things worth knowing

- The scanner finds common issues but can't catch every possible risk. Treat it as a safety net,
  not a guarantee.
- Fixes change your project's code like any other AI edit — check the preview, and publish to take
  them live.