It does not fix things for you
Suggestions are suggestions. Applying is a click you make, on a diff you have seen.
Deep security scan
Read the whole thing before it goes live
It looks for the parts you cannot see: rows a stranger can read, keys that ended up in browser code. It also drafts the fix — but it never applies one behind your back.
This scan2 credits
- credits per charged scan
- first scan, clean scan
- extra to apply a fix
- standard publish checks
- severity levels
- token input ceiling
The first scan on a project is free, and so is a scan that finds nothing.
What this is
The failures that do not look like failures.
Generated code usually runs fine. The dangerous part is the part that runs fine and is still wrong: a booking table any visitor can read, a service key that got compiled into the browser bundle, a redirect that will take a user anywhere. The scan reads the source and reports those with the file and the evidence line attached.
How to use it
Scan, read, decide.
The cost is shown before the scan starts, and the outcome tells you whether it was charged.
- Start it
Run the scan from the project's security panel. The estimate appears on the button before you commit.
- Read the findings
Results come back ordered by severity, each with the file and the quoted evidence behind it.
- Choose the fixes
Each suggestion shows the exact before and after. Nothing changes until you apply it.
What is in the code
What it costs, exactly.
The billing rules are branches in one pricing function, so the estimate is the charge.
- 2 credits
Charged only when a completed scan actually reports findings.
- First scan free
The first scan on a project costs nothing, so trying it is never a gamble.
- Clean scan free
Zero findings means zero credits. Charging to clear a gate would turn the gate into a toll booth.
- Failed scan free
If the scan does not finish, it is not billed.
- Fixes cost nothing extra
Patches arrive with the scan itself, and applying one is a byte-exact replacement with no model call.
- 60,000 token ceiling
Large projects hit an input cap. The report names the files that were left out rather than hiding the gap.
What it will not do
Where the scan stops.
A security feature that pretends is worse than one that admits its edges.
Applying does not clear the finding
The item stays in the list until a new scan says otherwise. Removing it would let you believe a problem is gone.
Dismissing does not unblock publishing
A dismissed critical finding disappears from the list but still holds the publish gate closed, and the screen says so.
It does not claim completeness
It reports what it found. Absence of findings is evidence, not a guarantee.
Next
Where to go from here
The standard publish checks run on every release; this scan is the deeper pass you choose to run.