Security

Security reads your app's code for vulnerabilities and risky settings: open Manage, then Security.

Two scans

Each costs credits, and its price is written beside its button, with when it last ran. Pressing the Security tile on Overview starts a quick scan if none has run, and spends those credits. Out of date means the code changed since. When nothing in the code or the context has changed since the last scan, the page says so.

Scan on publish, on the quick scan, runs it by itself after each publish that changed the code, at the same price. It is off until you turn it on. The Publish window has the same switch. See Publish to the web.

What it found

Detected issues lists each problem, with how serious it is, where it is, and what to do.

• Send to chat to fix puts the fix in the chat, for you to read and send. Fix all in chat does it for every issue at once.
• When an issue is a collection anyone can read, Require sign-in or Close to your team closes it on the spot, without a change to the code. See Who may see what.
• After a fix, the issues are checked again, and the list says which are gone and which are still there.

"No issues found" means the scan found nothing. It reads the code for common mistakes, so it cannot rule out every risk.

Add context

The scanner knows only the code. Add context, at the top right, tells it what the code cannot: what the app is for, who uses it, what data it keeps, and what is deliberate.

A shop for a bakery. Customers order without an account. We store names,
phone numbers and addresses for delivery. The menu and prices are public on purpose.

With that, a public menu is not reported as a leak, and orders with addresses are checked as the private data they are.

Libraries

React, Supabase and the other libraries every app runs on are kept by Setherion and checked for known security issues on every release. There is nothing for you to update. The card shows No known issues and the date it was last checked.

Always on

Some protection does not wait for a scan:

• A secret key written into the app's code is never published. The publish is refused, free of charge, whatever the scan says, and the message names the kind of key and the file and line. It recognises the keys of the common AI, payment, email, messaging and code-hosting services, private keys, and the admin keys of a Supabase project. Keys that are public by design, such as a Supabase anon key or a Stripe publishable key, are left alone.
• The keys of connected services stay on Setherion's servers, and the published app calls through Setherion.
• A record is read only by the person who saved it, and your team, until you open it under Access rules.
• Every build and change is opened out of sight before you see it, and sent back for repair if it crashes. See Before it goes out.
• On Business, an app can be made private, so only signed-in people from your workspace open it. See Visibility.
• Letters the app sends stop on their own if many bounce or are marked as spam. See Emails.