Get security scan

Changed on

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Returns the app's latest security scan: what it found, and whether it still reflects the app.

Read status before result. The two are independent, so a result can be present on a status that says it is stale, and absent on one that says a scan is in progress.

The findings are grouped by what the scan looked at. rls_recommendations cover entities whose row-level security is too open, hardcoded_secrets and backend_functions cover the app's own code and functions, dependency_vulnerabilities cover its npm packages, static_code_findings come from reading the code, and header_recommendations cover the published app's HTTP headers.

One of those groups depends on what is switched on for the app rather than on what the scan found. static_code_findings comes back as an empty list unless static_code_enabled is true, so an empty list there isn't evidence that there's nothing to find.

Findings ignored with Ignore security finding are still listed. Leave out any whose fingerprint is in ignored_fingerprints to see only the open ones.

This read never starts a scan. Use Run security scan for that, then poll here while status is pending or scanning. Both mean a scan will settle on its own, so treating only scanning as in progress stops the poll early on a queued scan and reads whatever findings the previous one left.

<Note>Findings are only ever as fresh as the scan that produced them. On out_of_date the app has changed since, so treat the findings as a previous snapshot and run a new scan before acting on them.</Note>

<Warning>The response includes fields beyond the ones documented here. Don't rely on undocumented response fields, as they can change at any time.</Warning>

get/api/apps/{app_id}/security/scan

Request

  • Base URL: https://app.base44.com
  • URL: https://app.base44.com/api/apps/{app_id}/security/scan
  • Auth: HTTP bearer

Path parameters

app_idstring required

ID of the app.

Response

The scan's state and its findings.

statusstring required

Where the scan is. up_to_date means result reflects the app as it is now. out_of_date means the app changed since the last scan, so result is stale or absent. none means the app has never been scanned. pending means a scan is queued and scanning means one is running, and both can carry an earlier result while you wait. scan_failed means the last scan died, so run another.

static_code_enabledboolean required

Whether code-reading analysis is switched on for this app (true) or not (false). When it is false, result.static_code_findings comes back as an empty list, so this field is the only way to tell an analysis that found nothing from one that never ran.

Example response

{
  "status": "up_to_date",
  "result": {
    "analysis_summary": "The app exposes orders to any signed-in user and has one hardcoded credential.",
    "rls_recommendations": [],
    "hardcoded_secrets": [],
    "backend_functions": [],
    "open_backend_functions": [],
    "unlocked_user_fields": [
      {
        "field": "tenant_id",
        "declared": true,
        "trusted_by": [
          {
            "entity": "Invoice",
            "uses": [
              "read",
              "update"
            ]
          }
        ],
        "severity": "high",
        "fingerprint": "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e"
      }
    ],
    "exposed_fields": [
      {
        "entity": "Testimonial",
        "field": "client_email",
        "reason": "Private client email addresses",
        "fingerprint": "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e"
      }
    ],
    "dependency_vulnerabilities": [],
    "static_code_findings": [],
    "header_recommendations": [],
    "core_integration_recommendation": "compatible",
    "ignored_fingerprints": [
      "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e"
    ],
    "scanned_at": "2026-08-25T14:05:00Z"
  },
  "static_code_enabled": true,
  "stream": {
    "result": {
      "analysis_summary": "The app exposes orders to any signed-in user and has one hardcoded credential.",
      "rls_recommendations": [],
      "hardcoded_secrets": [],
      "backend_functions": [],
      "open_backend_functions": [],
      "unlocked_user_fields": [
        {
          "field": "tenant_id",
          "declared": true,
          "trusted_by": [
            {
              "entity": "Invoice",
              "uses": [
                "read",
                "update"
              ]
            }
          ],
          "severity": "high",
          "fingerprint": "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e"
        }
      ],
      "exposed_fields": [
        {
          "entity": "Testimonial",
          "field": "client_email",
          "reason": "Private client email addresses",
          "fingerprint": "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e"
        }
      ],
      "dependency_vulnerabilities": [],
      "static_code_findings": [],
      "header_recommendations": [],
      "core_integration_recommendation": "compatible",
      "ignored_fingerprints": [
        "3f9a1c0e8b7d4a6f2e5c9b1d0a8f7e6c5b4a3d2e1f0c9b8a7d6e5f4c3b2a1d0e"
      ],
      "scanned_at": "2026-08-25T14:05:00Z"
    },
    "sections": {
      "backend_functions": "completed",
      "dependency_vulnerabilities": "checking",
      "hardcoded_secrets": "completed",
      "rls": "completed",
      "static_code": "not_run"
    }
  }
}

Changes

  • 7a0fca576e0eRevision changes
    • info

      added the required property // to the response with the status

    • info

      added the required property /// to the response with the status

  • 24333bb209b5Revision changes
    • info

      added the required property // to the response with the status

    • info

      added the required property /// to the response with the status