Get security scan

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Returns the app's latest security scan: what it found, and whether it still reflects the app.

Read status before result. The two are independent, so a result can be present on a status that says it is stale, and absent on one that says a scan is in progress.

The findings are grouped by what the scan looked at. rls_recommendations cover entities whose row-level security is too open, hardcoded_secrets and backend_functions cover the app's own code and functions, dependency_vulnerabilities cover its npm packages, static_code_findings come from reading the code, and header_recommendations cover the published app's HTTP headers.

Two of those groups depend on what is switched on for the app rather than on what the scan found. static_code_findings comes back empty unless static_code_enabled is true, and dependency_vulnerabilities is empty for a caller outside that rollout. Both are empty lists rather than absent, so an empty group is not evidence that there is nothing to find, and static_code_enabled is what tells the two apart.

This read never starts a scan. Use Run security scan for that, then poll here while status is pending or scanning. Both mean a scan will settle on its own, so treating only scanning as in progress stops the poll early on a queued scan and reads whatever findings the previous one left.

<Note>Findings are only ever as fresh as the scan that produced them. On out_of_date the app has changed since, so treat the findings as a previous snapshot and run a new scan before acting on them.</Note>

<Warning>The response includes fields beyond the ones documented here. Don't rely on undocumented response fields, as they can change at any time.</Warning>

{
  "status": "up_to_date",
  "result": {
    "analysis_summary": "The app exposes orders to any signed-in user and has one hardcoded credential.",
    "rls_recommendations": [],
    "hardcoded_secrets": [],
    "backend_functions": [],
    "dependency_vulnerabilities": [],
    "static_code_findings": [],
    "header_recommendations": [],
    "core_integration_recommendation": "compatible",
    "scanned_at": "2026-08-25T14:05:00Z"
  },
  "static_code_enabled": true
}