> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vibely.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Inline security panel on every web project. Two scan modes, pre-deploy enforcement, and one-click Fix-with-prompt handoff to the agent.

Every web project has a Security panel that runs static analysis against the codebase and surfaces findings as they happen. The same engine runs again right before you publish, so a misconfigured secret or a permissive policy doesn't sneak out to the public URL.

## Where it lives

The Security panel is a tab in the project view — same row as Code, Preview, and the rest. You can also reach it directly at:

```
/code/project/{id}/security
```

It loads in-place; switching to Security doesn't tear down your dev session.

## Scan modes

Two modes ship today:

* **Basic** — a fast pass that covers the highest-signal checks. Catches the issues you almost always want to know about: exposed secrets, obvious auth gaps, common misconfigurations. Runs in seconds.
* **Deep** — a longer, more exhaustive analysis that follows data flow further and flags subtler issues — permission escalation paths, policy gaps that depend on multiple files, supply-chain warnings. Trades wall time for coverage.

Run Basic while you're iterating; run Deep before you ship something to a real audience.

## Pre-deploy scan

When you click **Deploy** (or **Publish**) on a web project, Vibely runs a security scan before it ships the build. The deploy modal pauses on the scan results.

Findings come in two grades:

* **Blockers** — the deploy will not proceed until the finding is fixed or explicitly waived. The scanner uses this for things you'd genuinely regret shipping (exposed service keys, missing auth on a sensitive route).
* **Warnings** — surfaced but not blocking. Review them and click through.

You can re-run the scan from the modal after you make a change, without restarting the deploy.

## Fix with prompt

Every finding has a **Fix with prompt** button. Clicking it drafts a prompt for the agent that:

* Quotes the finding (file, line, severity, description)
* Asks the agent to fix the underlying issue
* Drops you back into the chat with the draft pre-filled

You can review and edit before sending. Most findings the agent can fix in a turn or two; for harder ones the agent will ask clarifying questions before touching the code.

This is the path most teams use — scan finds it, you click Fix with prompt, the agent ships the patch, you re-scan, deploy proceeds.

## Plan gating

Security is on the platform across plans, but the depth of scan available varies by tier. Open Settings → Security Center (workspace-admin) for the current capability matrix under your plan.

## Related

<CardGroup cols={2}>
  <Card title="Web App publish" icon="globe" href="/docs/web-app/publish">
    Where the pre-deploy scan triggers.
  </Card>

  <Card title="Project settings" icon="gear" href="/docs/workspace/project-settings">
    Per-project security scan configuration.
  </Card>

  <Card title="Admin settings" icon="sliders" href="/docs/workspace/admin-settings">
    Workspace-wide Security Center.
  </Card>

  <Card title="Mobile security" icon="mobile-screen" href="/docs/mobile-app/security">
    Pre-publish scan on mobile projects.
  </Card>
</CardGroup>