Security scans

GetFlowing scans each app for security problems and shows what it finds on the app's Health tab, under Security.

What a scan checksCopy Anchor Link

A scan has five checks: Your app's code, Private keys & passwords, Third-party packages, App settings and The release image. Each shows whether it is up next, checking, checked, partly checked, not needed for this scan, or could not check.

Scans start by themselves when an app is imported, when it changes and before it deploys. You can also choose Start security scan, or Scan again, at any time. Owners, admins and members can start a scan; the app needs a connected repository.

A scan is automated. It does not test how your app handles sign-in, or how it stands up to a real attack. A scan that finds nothing does not mean your app is secure: you remain responsible for your app's security.

FindingsCopy Anchor Link

Each finding has a priority:

Open a finding to see why it matters and what happens next. On plans with the agent, Ask the team to fix sends a repair request to the app's chat: the agent proposes a change as a pull request, and nothing is deployed by itself. It uses AI credits.

Export report downloads the latest scan's findings. It is a record of an automated scan, not a security certification.

A false positiveCopy Anchor Link

If a finding is not a real problem, an owner or admin can choose Mark as a false positive, say why in a few words, and choose how long the dismissal lasts: 30, 60 or 90 days. The reason is kept in Security activity, with their name. The finding counts again if the file it points at changes, the package version changes, the finding becomes more severe, or the dismissal ends. Undo dismissal brings it back at once.

A connected AI assistant can ask for a finding to be dismissed, but only a person can dismiss it.

Advisory or enforcedCopy Anchor Link

By default, findings are advice: an app still deploys, and its findings wait on its Health tab for you to fix.

An owner or admin can make findings block deploys instead. Go to Settings, then Security, and under Deployment protection turn on Block deployment when security requirements are not met. Then choose the Severity threshold: Critical only, High and critical, or Medium and above. Before you switch it on, the card shows how many apps it would block. Once it is on, a release is also blocked while its scan has not finished, or when the scan could not run every check it needs.

When findings block a deploy, the deploy says so. See Security findings block the deploy.