> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Run security scan
> This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.
Scans the app for security problems and returns the findings.
The response is the same shape as [Get security scan](/api-reference/get-security-scan), and which of two things you get depends on whether Base44 already has a current answer:
- If the last scan still matches the app, you get it straight back with `status` set to `up_to_date`, and the `X-Scan-Source` response header set to `cache`. Nothing is re-scanned.
- Otherwise a scan starts in the background and you get `status` set to `scanning` with the previous findings still in `result`, and `X-Scan-Source` set to `async`. Poll [Get security scan](/api-reference/get-security-scan) while `status` is `pending` or `scanning`, since both mean a scan is still going to settle.
So a 200 here does not mean a scan ran, and it does not mean the findings in the body are current. Read `status` and the `X-Scan-Source` header to tell the two apart.
A real scan reads the app's code and runs a language model over it, which takes a while and is why it runs in the background rather than on your connection. This endpoint is limited to 5 requests per minute.
Findings are only ever as fresh as the scan that produced them. On `out_of_date` the app has changed since, so treat the findings as a previous snapshot and run a new scan before acting on them.
The response includes fields beyond the ones documented here. Don't rely on undocumented response fields, as they can change at any time.
## OpenAPI
````yaml /developers/references/app-management/app-management-openapi.json post /api/apps/{app_id}/security/scan
openapi: 3.1.0
info:
title: Base44 App Management API
version: 1.0.0
servers:
- url: https://app.base44.com
security:
- ApiKeyAuth: []
paths:
/api/apps/{app_id}/security/scan:
post:
summary: Run security scan
description: >-
This API is in beta. Endpoints, fields, and behavior may still
change, so avoid depending on it in production.
Scans the app for security problems and returns the findings.
The response is the same shape as [Get security
scan](/api-reference/get-security-scan), and which of two things you get
depends on whether Base44 already has a current answer:
- If the last scan still matches the app, you get it straight back with
`status` set to `up_to_date`, and the `X-Scan-Source` response header
set to `cache`. Nothing is re-scanned.
- Otherwise a scan starts in the background and you get `status` set to
`scanning` with the previous findings still in `result`, and
`X-Scan-Source` set to `async`. Poll [Get security
scan](/api-reference/get-security-scan) while `status` is `pending` or
`scanning`, since both mean a scan is still going to settle.
So a 200 here does not mean a scan ran, and it does not mean the
findings in the body are current. Read `status` and the `X-Scan-Source`
header to tell the two apart.
A real scan reads the app's code and runs a language model over it,
which takes a while and is why it runs in the background rather than on
your connection. This endpoint is limited to 5 requests per minute.
Findings are only ever as fresh as the scan that produced them. On
`out_of_date` the app has changed since, so treat the findings as a
previous snapshot and run a new scan before acting on them.
The response includes fields beyond the ones documented here.
Don't rely on undocumented response fields, as they can change at any
time.
operationId: run_scan_api_apps__app_id__security_scan_post
parameters:
- name: app_id
in: path
required: true
schema:
type: string
description: ID of the app to scan.
title: App Id
description: ID of the app to scan.
example: 6820f3a4e7b91d003c45a1f2
- name: language
in: query
required: false
schema:
enum:
- en
- ja
- de
- es
- fr
- pt
type: string
description: >-
Language to return generated text in, as a lowercase two-letter
code. An unsupported value is rejected with a 422.
default: en
title: Language
description: >-
Language to return generated text in, as a lowercase two-letter
code. An unsupported value is rejected with a 422.
example: de
responses:
'200':
description: The findings, or the state of the scan that just started.
content:
application/json:
schema:
$ref: '#/components/schemas/SecurityScanStatus'
headers:
X-Scan-Source:
description: >-
Where the response came from. `cache` means the existing result
was returned and nothing was re-scanned. `async` means a scan
started in the background and `result` holds the previous
findings.
schema:
type: string
enum:
- cache
- async
example: cache
'401':
description: Missing or invalid credentials.
'403':
description: You don't have access to this app.
'404':
description: App not found.
'422':
description: Validation Error
content:
application/json:
schema:
$ref: '#/components/schemas/HTTPValidationError'
'429':
description: Rate limit exceeded (5 requests per minute).
components:
schemas:
SecurityScanStatus:
properties:
status:
type: string
title: Status
description: >-
Where the scan is. `up_to_date` means `result` reflects the app as
it is now. `out_of_date` means the app changed since the last scan,
so `result` is stale or absent. `none` means the app has never been
scanned. `pending` means a scan is queued and `scanning` means one
is running, and both can carry an earlier `result` while you wait.
`scan_failed` means the last scan died, so run another.
example: up_to_date
result:
anyOf:
- $ref: '#/components/schemas/SecurityScanFindings'
- type: 'null'
description: >-
What the scan found, or `null` when there is nothing to show. It is
`null` on `none`, and also on `out_of_date` when the last scan came
from a different version of the scanner, in which case only a fresh
scan produces findings.
static_code_enabled:
type: boolean
title: Static Code Enabled
description: >-
Whether code-reading analysis is switched on for this app (`true`)
or not (`false`). When it is `false`, `result.static_code_findings`
comes back as an empty list, so this field is the only way to tell
an analysis that found nothing from one that never ran.
example: true
type: object
required:
- status
- result
- static_code_enabled
title: SecurityScanStatus
description: The state of an app's security scan, and its findings when it has any.
HTTPValidationError:
properties:
detail:
items:
$ref: '#/components/schemas/ValidationError'
type: array
title: Detail
type: object
title: HTTPValidationError
SecurityScanFindings:
properties:
analysis_summary:
type: string
title: Analysis Summary
description: Plain-language summary of the scan.
example: >-
The app exposes orders to any signed-in user and has one hardcoded
credential.
rls_recommendations:
items:
$ref: '#/components/schemas/SecurityRlsRecommendation'
type: array
title: Rls Recommendations
description: >-
Entities whose row-level security should change, one entry per
entity.
example: []
hardcoded_secrets:
items:
$ref: '#/components/schemas/SecurityHardcodedSecret'
type: array
title: Hardcoded Secrets
description: Credentials written into the app's code.
example: []
backend_functions:
items:
$ref: '#/components/schemas/SecurityBackendFunctionIssue'
type: array
title: Backend Functions
description: Problems found in the app's backend functions.
example: []
dependency_vulnerabilities:
items:
$ref: '#/components/schemas/SecurityDependencyVulnerability'
type: array
title: Dependency Vulnerabilities
description: >-
Known vulnerabilities in the app's npm dependencies. Always empty
for a caller outside the dependency-scanning rollout.
example: []
static_code_findings:
items:
$ref: '#/components/schemas/SecurityStaticCodeFinding'
type: array
title: Static Code Findings
description: >-
Problems found by reading the app's code, listing only the findings
that survived the scan's own second-pass check. It is an empty list
when code-reading analysis is switched off for the app, which is not
the same as a clean result, so read `static_code_enabled` before
concluding there is nothing to find.
example: []
header_recommendations:
items:
$ref: '#/components/schemas/SecurityHeaderRecommendation'
type: array
title: Header Recommendations
description: >-
Recommended changes to the published app's HTTP headers. These are
computed from the app's current settings on every read rather than
stored with the scan.
example: []
core_integration_recommendation:
anyOf:
- type: string
- type: 'null'
title: Core Integration Recommendation
description: >-
Whether the app is ready for Base44's core-integration protection.
`no_restricted_usage` means nothing in the app needs it,
`compatible` means turning it on is safe, `would_be_blocked` means
it would break the app as written, and `publish_required` means the
app has to be published before this can be judged. It is `null` when
the answer does not apply to this app.
example: compatible
scanned_at:
anyOf:
- type: string
format: date-time
- type: 'null'
title: Scanned At
description: >-
When the scan that produced these findings ran, or `null` on a
result recorded before Base44 stored the time.
example: '2026-08-25T14:05:00Z'
type: object
required:
- analysis_summary
- rls_recommendations
- hardcoded_secrets
- backend_functions
- dependency_vulnerabilities
- static_code_findings
- header_recommendations
- core_integration_recommendation
- scanned_at
title: SecurityScanFindings
description: What a completed security scan found.
ValidationError:
properties:
loc:
items:
anyOf:
- type: string
- type: integer
type: array
title: Location
msg:
type: string
title: Message
type:
type: string
title: Error Type
type: object
required:
- loc
- msg
- type
title: ValidationError
SecurityRlsRecommendation:
properties:
entity_name:
type: string
title: Entity Name
description: >-
Entity the recommendation is for, as returned by [List entity
schemas](/api-reference/list-entity-schemas).
example: Order
description:
type: string
title: Description
description: Why the scan recommends these rules, in plain language.
example: >-
Orders are readable by anyone. Restrict reads to the customer who
placed the order.
create_rule:
anyOf:
- additionalProperties: true
type: object
- type: boolean
- type: 'null'
title: Create Rule
description: >-
Recommended rule for creating a record. The rule to apply to this
operation. `true` allows it for everyone, `false` blocks it
outright, `null` leaves it unset, and an object is a filter matched
against the record and the signed-in app user. Send the four rules
to [Update entity schema](/api-reference/update-entity-schema) under
the entity's `rls` to apply them.
example:
user_condition:
id: '{{user.id}}'
read_rule:
anyOf:
- additionalProperties: true
type: object
- type: boolean
- type: 'null'
title: Read Rule
description: >-
Recommended rule for reading records. The rule to apply to this
operation. `true` allows it for everyone, `false` blocks it
outright, `null` leaves it unset, and an object is a filter matched
against the record and the signed-in app user. Send the four rules
to [Update entity schema](/api-reference/update-entity-schema) under
the entity's `rls` to apply them.
example:
user_condition:
id: '{{user.id}}'
update_rule:
anyOf:
- additionalProperties: true
type: object
- type: boolean
- type: 'null'
title: Update Rule
description: >-
Recommended rule for updating a record. The rule to apply to this
operation. `true` allows it for everyone, `false` blocks it
outright, `null` leaves it unset, and an object is a filter matched
against the record and the signed-in app user. Send the four rules
to [Update entity schema](/api-reference/update-entity-schema) under
the entity's `rls` to apply them.
example:
user_condition:
id: '{{user.id}}'
delete_rule:
anyOf:
- additionalProperties: true
type: object
- type: boolean
- type: 'null'
title: Delete Rule
description: >-
Recommended rule for deleting a record. The rule to apply to this
operation. `true` allows it for everyone, `false` blocks it
outright, `null` leaves it unset, and an object is a filter matched
against the record and the signed-in app user. Send the four rules
to [Update entity schema](/api-reference/update-entity-schema) under
the entity's `rls` to apply them.
example: false
type: object
required:
- entity_name
- description
- create_rule
- read_rule
- update_rule
- delete_rule
title: SecurityRlsRecommendation
description: A recommended row-level security rule set for one entity.
SecurityHardcodedSecret:
properties:
file_path:
type: string
title: File Path
description: Path of the file in the app where it was found.
example: src/pages/Checkout.jsx
description:
type: string
title: Description
description: >-
What was found and why it is a problem. The secret's own value is
not included.
example: >-
A Stripe live key is written into the checkout page. Move it to an
app secret and read it from a backend function.
type: object
required:
- file_path
- description
title: SecurityHardcodedSecret
description: A credential written directly into the app's code.
SecurityBackendFunctionIssue:
properties:
file_path:
type: string
title: File Path
description: Path of the file in the app where it was found.
example: functions/createOrder.js
description:
type: string
title: Description
description: What is wrong with the function and what to change.
example: >-
createOrder trusts the price sent by the browser. Look the price up
server-side instead.
type: object
required:
- file_path
- description
title: SecurityBackendFunctionIssue
description: A problem found in one of the app's backend functions.
SecurityDependencyVulnerability:
properties:
package_name:
type: string
title: Package Name
description: Name of the npm package.
example: axios
current_version:
type: string
title: Current Version
description: Version the app currently has.
example: 1.6.2
vulnerable_range:
anyOf:
- type: string
- type: 'null'
title: Vulnerable Range
description: >-
Range of versions the advisory covers, or `null` when the advisory
does not give one.
example: <1.7.4
fixed_version:
anyOf:
- type: string
- type: 'null'
title: Fixed Version
description: >-
First version the advisory says is fixed, or `null` when there is no
fixed release.
example: 1.7.4
safe_fixed_version:
anyOf:
- type: string
- type: 'null'
title: Safe Fixed Version
description: >-
The version Base44 checked is safe to install, which can be newer
than `fixed_version`. It is `null` when no safe version was found,
and absent on a finding recorded before Base44 started checking.
example: 1.7.4
fix_unavailable_reason:
anyOf:
- type: string
- type: 'null'
title: Fix Unavailable Reason
description: >-
Why no safe upgrade exists, when that is the case. It is `null` or
absent when there is one.
example: No released version satisfies the app's peer dependencies.
vuln_id:
type: string
title: Vuln Id
description: Advisory identifier.
example: GHSA-8hc4-vh64-cxmj
severity:
type: string
title: Severity
description: How serious it is, one of `critical`, `high`, `medium` or `low`.
example: high
summary:
type: string
title: Summary
description: One-line summary of the vulnerability.
example: Server-side request forgery in axios
advisory_url:
type: string
title: Advisory Url
description: Link to the full advisory.
example: https://github.com/advisories/GHSA-8hc4-vh64-cxmj
type: object
required:
- package_name
- current_version
- vulnerable_range
- fixed_version
- vuln_id
- severity
- summary
- advisory_url
title: SecurityDependencyVulnerability
description: A known vulnerability in one of the app's npm dependencies.
SecurityStaticCodeFinding:
properties:
title:
type: string
title: Title
description: Short name for the problem.
example: Order lookup trusts a client-supplied ID
severity:
type: string
title: Severity
description: How serious it is, one of `critical`, `high`, `medium` or `low`.
example: high
confidence:
type: string
title: Confidence
description: >-
How sure the scan is, one of `high`, `medium` or `low`. A `low`
confidence finding is worth reading before acting on.
example: high
category:
type: string
title: Category
description: >-
What kind of problem it is, one of `unauthorized_access`,
`unsafe_user_input`, `exposed_sensitive_data`,
`unsafe_redirect_or_external_request`, `unsafe_browser_code`,
`payment_or_webhook_risk`, `file_handling_risk` or `other`.
example: unauthorized_access
file_path:
type: string
title: File Path
description: Path of the file in the app where it was found.
example: src/pages/Orders.jsx
line_number:
anyOf:
- type: integer
- type: 'null'
title: Line Number
description: >-
Line the finding points at, or `null` when the scan could not place
it on one.
example: 42
evidence:
type: string
title: Evidence
description: The snippet of the app's own code the finding is about.
example: const order = await Order.get(searchParams.get('id'))
attack_scenario:
type: string
title: Attack Scenario
description: How someone would exploit it.
example: Change the id in the URL to another customer's order and read it.
impact:
type: string
title: Impact
description: What it costs if exploited.
example: Any signed-in user can read every order.
recommendation:
type: string
title: Recommendation
description: What to change.
example: >-
Add a read rule on Order restricting it to the customer who placed
it.
standards:
anyOf:
- items:
$ref: '#/components/schemas/SecurityStaticCodeStandard'
type: array
- type: 'null'
title: Standards
description: >-
Security standards the finding maps to. Absent on a finding the scan
did not classify.
example:
- framework: CWE
id: CWE-639
name: Authorization Bypass Through User-Controlled Key
type: object
required:
- title
- severity
- confidence
- category
- file_path
- line_number
- evidence
- attack_scenario
- impact
- recommendation
title: SecurityStaticCodeFinding
description: A problem found by reading the app's code.
SecurityHeaderRecommendation:
properties:
flag:
type: string
title: Flag
description: >-
Which setting to turn on, either `prevent_iframe_embedding` or
`restrict_browser_features`.
example: prevent_iframe_embedding
severity:
type: string
title: Severity
description: How serious it is, one of `high`, `medium` or `low`.
example: medium
reason_key:
type: string
title: Reason Key
description: >-
Stable identifier for the reason. The readable text is Base44's own
translated copy, so treat this as a code to branch on rather than
something to show.
example: security.headers.reason.iframe_embedding
type: object
required:
- flag
- severity
- reason_key
title: SecurityHeaderRecommendation
description: A recommended change to the published app's HTTP headers.
SecurityStaticCodeStandard:
properties:
framework:
type: string
title: Framework
description: Which catalog the identifier belongs to.
example: CWE
id:
type: string
title: Id
description: Identifier within that catalog.
example: CWE-639
name:
type: string
title: Name
description: Name of the entry.
example: Authorization Bypass Through User-Controlled Key
type: object
required:
- framework
- id
- name
title: SecurityStaticCodeStandard
description: A security standard a static-analysis finding maps to.
securitySchemes:
ApiKeyAuth:
type: apiKey
in: header
name: api_key
description: Personal API key.
````