Security checks

Generated code is still code, and an app you publish is still on the internet. The Security tab gives you both halves of the picture: what is protected without you doing anything, and what a scan found in your app specifically.

Always on

Protection	What it does
Secret encryption at rest	App secrets are encrypted before storage and never handed to the browser
Package firewall	Only vetted packages can be imported; anything else is blocked at build time
SSRF-safe request proxy	Requests your app makes through Dhanu cannot be pointed at internal network addresses
HTTPS	Traffic to a published app is encrypted, with certificates managed for you
Search indexing	Shown here too, because “findable by anyone” is a security decision as much as a marketing one

The last two are listed as off until the app is published, and until you allow indexing, respectively — the panel reports the state you are actually in.

The code scan

Rescan runs a fast static check over the app’s files, looking for the mistakes that matter in browser code:

• secrets left in the source
• cross-site scripting risks
• insecure (non-HTTPS) requests
• unsafe evaluation of strings as code
• privacy leaks

It scores the app and lists what it found.

The AI review

A slower, deeper pass: the assistant reads the app the way a reviewer would and reports what a pattern match cannot see — logic that trusts input it should not, data exposed to the wrong user, an access check that is missing rather than wrong. It runs as a background job with a progress bar, and can be started by the task owner or the person who created the app.

Findings

Each finding carries a severity — Critical, High, Medium, Low or Info — a category, the file and line it points at, and a recommendation.

You can:

• Fix it with the assistant. The finding goes into the chat as an instruction, so the fix happens where every other change happens.
• Mark it resolved once it is dealt with.
• Ignore it when it does not apply — a deliberate choice, recorded, not a silent dismissal.

Dependencies

The tab lists every package your app imports with its version, and checks them against the public vulnerability database. Anything with a known advisory is flagged with its severity and a Fix button that asks the assistant to move off it. You can also download the list — useful when someone in your organisation asks what a published app is built from.

Working with it well

Scan before you publish, not after. Both scans work on the current app, and a finding is cheapest to fix while you are still in the conversation that caused it.

Take secret exposure seriously and immediately. Anything in an app’s files reaches the browser. A key in the code is a key you have given away; move it to the backend and rotate it.

Rescan after a big change. Scans reflect the version they ran against, and the panel tells you which one that was.