Nine checks before it goes out

The nine checks

These run on the way to publishing. You do not start them.

• Secret keys sitting in the source
• Access rules on every data table
• Powerful database functions left open
• Screens that need a sign-in actually requiring one
• What gets stored in the browser
• Outgoing links and dynamic code execution
• Integrations that are described but not wired
• Generated code editing the dependency list
• The finished files, scanned again before upload

Serious findings stop the publish

One critical or high finding blocks it. The decision is made on the server, not by a checkbox in the interface.

A gate that only appears to block is worse than no gate. People publish on the strength of believing it held.

The deep scan reads the code

The nine checks look for known shapes. The deep scan reads your project and reasons about what it means.

It costs 2 credits, and there are three cases where you pay nothing: the first scan on a project, a scan that finds no issues, and a scan that fails to finish.

The price is shown before you start it, not after.

It may not read everything

There is a cap on how much goes into one scan. On a large project the smaller files are read first and the rest are left out.

The report says how many were skipped. Trimming silently would leave you believing the whole project was covered.

Getting unblocked after a critical finding

Editing an unrelated line does not clear it. The block stays until a new scan says otherwise.

Fix the issue and scan again. If it comes back clean that scan costs nothing — charging to lift a block we applied would make it a toll.

Suggested fixes, applied by you

Findings can come with the exact replacement to make, at no extra credit cost. Applying it happens when you press the button.

If the file changed in the meantime the apply fails, and if the same snippet appears in several places we refuse rather than pick one for you.

Applying a fix does not remove the finding from the list. Only a fresh scan can say it is gone.

We do not keep the findings

Dismissing a finding stores a fingerprint, never the text. Our records do not become a list of your weak spots.

Dismissing hides a row from the list only. The publish decision still counts everything, and tells you how many hidden critical findings there are.