Security

Your app is built on a lot of code nobody on your project wrote. Most of it is fine. Occasionally somebody finds a hole in a piece of it, publishes the details, and your app inherits the problem without anything in your own project changing.

This screen is the standing answer to "am I affected". It runs a check against the published list of known problems and shows what it found.

A security report with a Run audit button, two views — Issues and Dependencies — and a list of advisories each badged Critical, High, Moderate or Low.

Two views of the same check

Issues is the list of known problems that apply to you, worst first. Each carries a severity — Critical, High, Moderate or Low — and severity is the whole prioritisation. A Critical is worth interrupting your day for. A Low usually is not.

Dependencies turns the same report around and shows what has a newer version available, marked as a major, minor or patch update. Not every update is a security fix; this view is the routine maintenance one.

Running the check

It does not run continuously. Press Run audit and it checks now. The report you are looking at is from the last time somebody did that, so if it is old, run it again before drawing conclusions from it.

An empty report is a real result, not a failure to load — the screen says so plainly when nothing known applies to you.

Acting on something

An advisory can be turned into a request to upgrade, which is filed as a change for your project. The fix itself is a code change like any other: it gets built, checked and deployed the normal way. Nothing here edits your live app directly.

A clean report means nothing known applies to you today. It is a check against a published list, and the list grows. Re-running it next month is not paranoia.

Where to go next

• Changes — where a requested upgrade goes once you file it.
• Deployments — getting the fix out once it is made.
• Secret access — a different kind of security, and one only you can protect.