Security Scans
Find, review, and remediate dependency vulnerabilities in each app build.
Security scans an app's dependencies for known vulnerabilities on each build, keeps the result per version, and lets you review each finding and remediate it. Open it from the app workspace's More menu → Security.
The scans
Each build version is listed with a Completed status, the commit it scanned, and a summary of findings by severity (for example, High 6 · Medium 5 · Low 1). Open a scan to see its findings in full.
Scan details
A scan opens with a severity summary — Critical, High, Medium, Low, and Info with counts — plus the commit and how long the scan took. You can Show suppressed findings, narrow by severity, Bulk update findings, remediate with Fix with AI, or export a Report.
Each finding is one row showing its severity, a title, the scanner (Trivy), that it's a Dependency issue, the lockfile it was found in (for example, frontend/pnpm-lock.yaml), the package, and the advisory id (a CVE or GHSA number).
While Fix with AI is working, the button is greyed out. Its fix arrives as a new version — for example, Version 2.0.0 (Latest): Fix the actionable security issues detected by security scan… in the version selector.
Fix with AI changes the app to remediate a finding — it edits the app's dependencies through the build agent, not just the report. Review the change it makes, and re-check the tests and scan afterward.
Why this matters
Security tells you what vulnerabilities a build carries before you publish it.
Findings are dependency issues from the app's lockfiles; remediation usually means upgrading a package to a patched version.
Scans are per build version, so you can confirm the exact version you're about to ship.
Related
TestingDeployMaintained by Abhishek Paul
AI-assisted, human-approved
Last updated
Was this helpful?