Security Scans
Find, review, and remediate dependency vulnerabilities in each app build.
Security scans an app's dependencies for known vulnerabilities on each build, keeps the result per version, and lets you review each finding and remediate it. Open it from the app workspace's More menu → Security.
The scans
Each build version is listed with a Completed status, the commit it scanned, and a summary of findings by severity (for example, High 6 · Medium 5 · Low 1). Open a scan to see its findings in full.
Scan details
A scan opens with a severity summary — Critical, High, Medium, Low, and Info with counts — plus the commit and how long the scan took. You can Show suppressed findings, narrow by severity, Bulk update findings, remediate with Fix with AI, or export a Report.
Each finding is one row showing its severity, a title, the scanner (Trivy), that it's a Dependency issue, the lockfile it was found in (for example, frontend/pnpm-lock.yaml), the package, and the advisory id (a CVE or GHSA number).
Fix with AI changes the app to remediate a finding — it edits the app's dependencies through the build agent, not just the report. Review the change it makes, and re-check the tests and scan afterward.
Why this matters
Security tells you what vulnerabilities a build carries before you publish it.
Findings are dependency issues from the app's lockfiles; remediation usually means upgrading a package to a patched version.
Scans are per build version, so you can confirm the exact version you're about to ship.
Related
TestingDeployLast updated