Security Scanner
4 min read
Scan your project for security vulnerabilities, misconfigurations, and best practice violations before you publish.
Who can do this: Owners, Admins, and Editors can run security scans before publishing. See Roles and Permissions for details.
Run a security scan before you publish. The scanner reads your project like a security reviewer would, checking your database rules, login settings, server code, and dependencies, then shows you a short list of what passed and what needs attention, with the relevant action items.
Where to Find It
Open your project in Studio and click the Security tab in the top navigation. If you have not run a scan yet, you’ll see an empty state with a Run scan button.
What Gets Checked
The scanner reviews five categories:
Authentication and Authorization. Checks sign-up and login settings, session handling, and access controls for misconfigurations that weaken who can get in.
Data Protection. Validates that user data and files stay separated, and flags misconfigurations that could let one account see another’s information.
API Security. Reviews backend APIs for exposed endpoints, misconfigured access rules, and injection vulnerabilities.
Infrastructure. Checks server-side settings, security headers, and configuration for gaps that could expose your project.
Dependencies. Scans third-party packages and your codebase for known vulnerabilities and leaked secrets.
Each check is a single rule with a clear pass or fail result.
Running a Scan
- Go to the Security tab
- Click Run scan
- Wait for the scan to complete (typically 30 seconds to a few minutes)
While scanning, you see live progress across all five categories. Once complete, the results view shows a summary of any issues found.
Understanding Results
After a scan, you see severity counts at the top:
- Critical: Issues that could expose user data or allow unauthorized access. Publishing is not recommended until these are resolved.
- Warning: Best practice violations worth addressing before launch.
- Info: Minor recommendations for improvement.
If everything passes, you see a green “No issues found” message.
Viewing Details
Click any control to open a detail panel with:
- Summary: A one-line description of the issue
- Detail: Specific evidence from your project (tables, files, settings)
- Remediation: What you need to change to fix it
- Files: Which files in your project are affected
Fixing Issues
For any failing control, you have two options:
Try to fix: This opens the chat with context about the issue. The AI explains what would change in plain language, asks for your approval, then applies the fix. You stay in control of every change.
Ignore: Acknowledges the risk without fixing it. Use this for accepted tradeoffs. If you later fix the issue or it regresses, the ignore status clears automatically.
After making fixes, click Rescan to confirm the issues are resolved. Fixes do not auto-resolve. The scan is the source of truth.
Fixing Multiple Issues
Click Try to fix all to address several issues at once. The AI walks through each one, explaining and asking for approval before making changes.
Scan Status in Publish Flow
When you publish, the dialog shows your current scan status:
| Status | What it means |
|---|---|
| Clean | No security issues found. Safe to publish. |
| Warnings | Minor issues detected. Safe to publish, but consider addressing them. |
| Critical | Serious issues found. Publishing is not recommended. |
| Stale | Your project changed since the last scan. Rescan before publishing. |
| Not scanned | No scan has been run yet. |
Critical issues show a warning, but you can still publish if you choose.
Scan History
The History tab shows past scans with changes between them:
- New: Issues that have appeared since the previous scan
- Resolved: Issues that are now fixed
- Regressed: Previously fixed issues that came back
This helps you track progress over time and catch regressions.
Requirements
Security scanning requires Cloud Backend. If your project does not use Cloud Backend, the Security tab shows an option to enable it.
See Enable Cloud Backend to get started.
Pricing
| Plan | Scans |
|---|---|
| Free | 1 completed scan per project |
| Pro | Unlimited scans |
After using your free scan, upgrade to Pro for unlimited scans.
What the Scanner Does Not Do
The security scanner is a pre-publish safety check, not a replacement for:
- Compliance audits: SOC2, PCI, or HIPAA certification requires a formal third-party audit
- Penetration testing: The scanner reviews configuration, not live attack simulation
- Runtime monitoring: It checks your code and settings, not production traffic
For projects without Cloud Backend, the scanner has nothing to check. Use it alongside your existing security practices, not instead of them.
FAQs
When should I run a security scan?
Run a scan before your first publish, after enabling Cloud Backend, and after any significant changes to authentication, database policies, Edge Functions, or dependencies. The publish flow shows “stale” if your project changed since the last scan, which is a good reminder to rescan.
How long does a scan take?
Most scans complete in 30 seconds to a few minutes, depending on project complexity.
Do I need to rescan after every change?
Rescan after significant changes to authentication, database policies, Edge Functions, or dependencies. The publish flow shows “stale” if your project changed since the last scan.
What does “Ignore” do?
Ignore acknowledges a risk without fixing it. The control stops counting toward your publish status. If you later fix the issue or it regresses, the ignore status clears automatically.
Can I still publish with critical issues?
Yes. The scanner shows a strong warning, but you can choose to publish anyway.
Why did a fixed issue come back?
Check the scan history for “regressed” items. This usually means a later change reintroduced the problem.
Last updated: August 2, 2026
