Skip to main content
Every web project has a Security panel that runs static analysis against the codebase and surfaces findings as they happen. The same engine runs again right before you publish, so a misconfigured secret or a permissive policy doesn’t sneak out to the public URL.

​
Where it lives

The Security panel is a tab in the project view — same row as Code, Preview, and the rest. You can also reach it directly at:
It loads in-place; switching to Security doesn’t tear down your dev session.

​
Scan modes

Two modes ship today:
  • Basic — a fast pass that covers the highest-signal checks. Catches the issues you almost always want to know about: exposed secrets, obvious auth gaps, common misconfigurations. Runs in seconds.
  • Deep — a longer, more exhaustive analysis that follows data flow further and flags subtler issues — permission escalation paths, policy gaps that depend on multiple files, supply-chain warnings. Trades wall time for coverage.
Run Basic while you’re iterating; run Deep before you ship something to a real audience.

​
Pre-deploy scan

When you click Deploy (or Publish) on a web project, Vibely runs a security scan before it ships the build. The deploy modal pauses on the scan results. Findings come in two grades:
  • Blockers — the deploy will not proceed until the finding is fixed or explicitly waived. The scanner uses this for things you’d genuinely regret shipping (exposed service keys, missing auth on a sensitive route).
  • Warnings — surfaced but not blocking. Review them and click through.
You can re-run the scan from the modal after you make a change, without restarting the deploy.

​
Fix with prompt

Every finding has a Fix with prompt button. Clicking it drafts a prompt for the agent that:
  • Quotes the finding (file, line, severity, description)
  • Asks the agent to fix the underlying issue
  • Drops you back into the chat with the draft pre-filled
You can review and edit before sending. Most findings the agent can fix in a turn or two; for harder ones the agent will ask clarifying questions before touching the code. This is the path most teams use — scan finds it, you click Fix with prompt, the agent ships the patch, you re-scan, deploy proceeds.

​
Plan gating

Security is on the platform across plans, but the depth of scan available varies by tier. Open Settings → Security Center (workspace-admin) for the current capability matrix under your plan.

Web App publish

Where the pre-deploy scan triggers.

Project settings

Per-project security scan configuration.

Admin settings

Workspace-wide Security Center.

Mobile security

Pre-publish scan on mobile projects.