> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vibely.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Pre-publish security scan on every mobile build. Findings block App Store and TestFlight submissions until fixed.

Before Vibely files anything to Apple, it runs a security scan on your mobile project. Findings appear in the publish popover next to the wizard steps; some block submission outright, others surface as warnings you can choose to ship past.

## When the scan runs

The scan triggers from the publish popover the moment you start an iOS publish flow. It runs against the build artifact and the project source — both. By the time you reach the **Review** step in the [8-step wizard](/docs/mobile-app/ship), the latest scan has already completed.

You can also kick off a scan manually from the popover at any time.

## Scan modes

The same two modes that exist on web apply here:

* **Basic** — fast, high-signal pass. Misconfigured signing, missing permission strings, hard-coded secrets, dangerous entitlements.
* **Deep** — longer analysis. Cross-file policy issues, supply-chain warnings on third-party libraries, runtime permission gaps the App Reviewer is likely to flag.

Run Basic during a release cycle; run Deep before a production submission.

## Blockers vs warnings

Findings come in two grades:

* **Blockers** stop the submission. The wizard won't file the build to TestFlight or App Review until the finding is fixed or waived by an admin. Things that almost always get the app rejected (missing usage descriptions, hard-coded API keys in the bundle) live here.
* **Warnings** surface but don't block. Review and decide before you proceed.

Each finding has a **Fix with prompt** button. Clicking it drafts a prompt for the agent — file, severity, suggested fix — and drops you back in the chat to send. Re-run the scan after the patch ships to verify the finding cleared.

## Related

<CardGroup cols={2}>
  <Card title="Ship to stores" icon="apple" href="/docs/mobile-app/ship">
    The 8-step iOS publish wizard the scan runs inside.
  </Card>

  <Card title="Web security" icon="browser" href="/docs/web-app/security">
    Same engine for web projects.
  </Card>

  <Card title="Admin settings" icon="sliders" href="/docs/workspace/admin-settings">
    Workspace Security Center.
  </Card>
</CardGroup>