Security
The Security tab scans your site’s code for exposed secrets, risky code and vulnerable dependencies, and lets the AI fix what it finds. Run it before you launch, and again after big changes — especially ones that added API keys or third-party code.
It lives in Settings → Team & Security → Security. It isn’t offered for mobile apps.
Running a scan
Section titled “Running a scan”The banner at the top shows when you last scanned. Pick one of two scans:
| Scan | What it checks | Cost |
|---|---|---|
| Basic security scan | Static checks of your code, plus your packages against a database of known vulnerabilities. | Free and instant. |
| Deep security scan | Everything in the basic scan, plus an AI review of your code. | Uses your AI credits. |
Reading the results
Section titled “Reading the results”Detected Issues lists each finding with its severity (critical, high, medium, low or info), the file and line it’s in, what’s wrong and how to fix it. Findings from the AI review carry an AI badge.
- Try fix — the AI edits the file to fix the issue and tells you what it changed. It uses your AI credits, and it’s offered only for findings in your own code, not for package issues.
- If a fix doesn’t work, you get the reason plus two ways out: Accept as intended or Hide this item.
- Dismiss (the × on a finding) hides it. Dismissed findings are listed at the bottom, where restore brings one back.
Project dependencies shows how many packages your project uses and how many known vulnerabilities they have. Click Review to see each one, with the version that fixes it.
Teaching the scanner what’s intended
Section titled “Teaching the scanner what’s intended”Some findings are deliberate — a status page that’s public on purpose, a key that’s meant to be public. Click Edit security memory and write a note the deep scan reads as context, so it stops flagging them. Accept as intended on a finding adds a line for it to the memory for you.
Things worth knowing
Section titled “Things worth knowing”- The scanner finds common issues but can’t catch every possible risk. Treat it as a safety net, not a guarantee.
- Fixes change your project’s code like any other AI edit — check the preview, and publish to take them live.