Security scan

Kuika AI scans your app for security problems. A quick scan runs by itself after every build, and a deep scan lets the AI read your code more carefully. You see every finding with a severity and can fix it with one click.

Where to find it

Open More in the builder and choose Security. A status strip above the message box also shows the result, such as Security · no issues. Click it to open the same view.

A new app shows a large Scan now button. When the scan finishes, you see the results. If the code changed since the last scan, a note tells you the results may be stale.

Quick scan

The quick scan follows fixed rules and finishes fast. It checks:

• Secrets in code. Keys, access codes and passwords written into files.
• Vulnerable packages. Your packages are checked against known problems. Each finding shows the installed version and the version that fixes it.
• Risky code patterns. For example a secret used in the web page code, text built in a way that allows SQL injection, or a server that accepts requests from any website.
• Broader code checks, labeled Static analysis.

Run it again any time with Rescan.

Deep scan

Press Deep scan with AI to have the AI follow your screens, endpoints and data access and look for risks the fixed rules miss. It only reads your code and never changes it. It can take about a minute and uses credits. Every deep finding points to a real file and line, and findings that do not are thrown away.

Findings and severity

Each finding shows:

• A severity: Critical, High, Medium, Low or Info
• Where it came from: Secret, Dependency, Rule, Static analysis or AI audit
• The evidence and a recommended fix
• A status: Open, Fixing, Resolved or Ignored

Fix findings

• Fix with AI fixes one finding.
• Fix all sends up to 30 open code findings to the AI in one run, most severe first. It uses credits and asks you to confirm first.
• After a fix, Kuika AI scans again. Only the new scan result counts as proof, not the AI's own report.
• Package vulnerabilities are fixed one at a time.
• Ignore asks for a reason, like "false positive" or "accepted risk", and removes the finding from the counter.

Critical findings and publishing

An open critical finding from a secret, a code rule or static analysis blocks syncing your app to GitHub. Publishing is not blocked, but if you publish with critical findings open, Kuika AI shows a notice with the count. Fix them first. See Test and production and Download your code.

Keep keys out of your code

When your app needs a key for an outside service, add it under More, then Secrets. Pick a name, enter the value and choose the environment, so each environment has its own key. Values are stored encrypted, and after you save one it is never shown again. Kuika AI may also ask for a key in a small card while you chat, and that card saves it straight to encrypted storage.

Do not paste a key into the chat. If you already did, add it on the Secrets page anyway and replace the key at the provider.

Related

• Roles and permissions