Skip to main content
Before Vibely files anything to Apple, it runs a security scan on your mobile project. Findings appear in the publish popover next to the wizard steps; some block submission outright, others surface as warnings you can choose to ship past.

​
When the scan runs

The scan triggers from the publish popover the moment you start an iOS publish flow. It runs against the build artifact and the project source — both. By the time you reach the Review step in the 8-step wizard, the latest scan has already completed. You can also kick off a scan manually from the popover at any time.

​
Scan modes

The same two modes that exist on web apply here:
  • Basic — fast, high-signal pass. Misconfigured signing, missing permission strings, hard-coded secrets, dangerous entitlements.
  • Deep — longer analysis. Cross-file policy issues, supply-chain warnings on third-party libraries, runtime permission gaps the App Reviewer is likely to flag.
Run Basic during a release cycle; run Deep before a production submission.

​
Blockers vs warnings

Findings come in two grades:
  • Blockers stop the submission. The wizard won’t file the build to TestFlight or App Review until the finding is fixed or waived by an admin. Things that almost always get the app rejected (missing usage descriptions, hard-coded API keys in the bundle) live here.
  • Warnings surface but don’t block. Review and decide before you proceed.
Each finding has a Fix with prompt button. Clicking it drafts a prompt for the agent — file, severity, suggested fix — and drops you back in the chat to send. Re-run the scan after the patch ships to verify the finding cleared.

Ship to stores

The 8-step iOS publish wizard the scan runs inside.

Web security

Same engine for web projects.

Admin settings

Workspace Security Center.