Security Scanning

Before a Pro or Team App is published, cdbx automatically scans it for common security problems — things like a database query with no access check, or a hardcoded API key — so you catch them before anyone else can.

How it works

Every publish attempt on Pro/Team runs two checks against your App's code:

• A static analysis pass that looks for known-risky patterns (injection, cross-site scripting, missing authorization checks, hardcoded secrets)
• An AI review pass that reads through the code looking for the same kind of issues in context

If either check finds something real, the publish is stopped and the findings show up on the Security tab in your App's Settings.

Reviewing findings

Open Settings → Security to see:

• What was found, and in which file
• How serious it is
• A Suggest a fix button — generates a small, targeted fix for just that one issue, shown as a diff you can review before applying it

Publishing anyway

Most findings only affect your own App — they never put anything outside it at risk. For these, you can click Publish anyway once you've reviewed them, and the publish goes ahead.

A small number of findings are more serious — they involve something shared across cdbx, not just your App. Those need a quick review from the cdbx team before the App can go live; you'll see a note explaining this on the Security tab.

Availability

Security scanning runs automatically on Pro and Team — there's nothing to turn on. It doesn't run for Free-tier Apps.