Security

Scans

Dashboard → Security shows the results of security scans of your app. SKAEL scans every published app on a schedule: weekly on Free, and weekly by default on paid plans, which may scan more often; press Run security scan to scan now, or Scan current draft to check unpublished work.

Three scanners run:

• Image & dependency scan — known vulnerabilities in the packages your app uses,
• Source analysis — risky patterns in your code, including secrets left in the source,
• Access configuration — who can read and write your data.

Findings are grouped by category — access control, dependencies, secrets, configuration, code — with a severity, and you can filter them. The page also shows how many scanners succeeded.

Fixing findings

• Fix with AI on a finding (or Fix all with AI) prepares a request in the chat; review it and send.
• Findings in parts of the stack that SKAEL runs for you are marked Managed by SKAEL — we fix those.

Note

Findings never block publishing, even critical ones — you decide when to fix. The values of any secrets found are never stored or shown. A draft scan doesn’t check container images; that happens on the published build.

Built-in protections

• Uploads are checked before they can be used: size, real file type and zip bombs. See Images and files.
• Each workspace is isolated: apps from different customers can’t reach each other over the network, and AI-generated code runs in a hardened sandbox.
• HTTPS everywhere: every published address and every custom domain gets a certificate automatically.
• Exports leave secrets out: secret-looking values are removed from exported data.