> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Security scan findings

> Retrieve and interpret the findings for an app security scan

The `app.security.check_run` audit event stores a summary of an app security scan. When the event includes a `run_id`, use it to retrieve the sanitized, ownership-scoped findings for that run. See [Event Types](/developers/references/audit-logs-api/get-started/event-types#security) for the event and its metadata fields.

## The audit event

This event contains scored dependency and static-code findings, plus unscored RLS, hardcoded-secret, and backend-function findings. ClickHouse stores every metadata value as a string, including counts:

```json theme={null}
{
  "timestamp": "2026-07-26T14:32:18Z",
  "user_email": "security.admin@example.com",
  "workspace_id": "67f2c8e01a3b5d004e92d7a1",
  "app_id": "6820f3a4e7b91d003c45a1f2",
  "ip": "203.0.113.42",
  "user_agent": "Mozilla/5.0",
  "event_type": "app.security.check_run",
  "status": "success",
  "error_code": "",
  "metadata": {
    "run_id": "6886b8d390dc7e2f4a2c91b3",
    "findings_total": "5",
    "highest_scored_severity": "high",
    "critical_findings_count": "0",
    "high_findings_count": "1",
    "medium_findings_count": "1",
    "low_findings_count": "0",
    "unscored_findings_count": "3",
    "rls_recommendations_count": "1",
    "hardcoded_secrets_count": "1",
    "backend_functions_issues_count": "1",
    "dependency_vulnerabilities_count": "1",
    "static_code_findings_count": "1"
  }
}
```

Dependency and static-code findings can have a scanner-provided severity. RLS recommendations, hardcoded-secret findings, and backend-function issues are unscored. `highest_scored_severity` considers only scored findings and is `none` when no finding has a recognized severity. Never infer a severity for an unscored category.

`static_code_findings_count` can be absent when the static scanner did not run. An absent key does not mean that the scanner completed with zero findings.

## Retrieving findings

Send the event's `run_id` to [Get security scan findings](/api-reference/audit-logs/get-security-scan-findings), scoped to the workspace in the URL:

```curl theme={null}
curl --request GET \
  --url https://app.base44.com/api/v1/audit-logs/67f2c8e01a3b5d004e92d7a1/security-scan-runs/6886b8d390dc7e2f4a2c91b3 \
  --header 'api_key: <api_key>'
```

The request needs a workspace API key with the `AUDIT_LOGS_READ` (`audit_logs:read`) scope. The lookup is scoped to the workspace in the URL, so a run owned by another workspace is not found.

The list endpoint never hydrates events with findings and has no `include_security_findings` option. Its cursor, page limit, and truncation behavior are unchanged. Events without a `run_id`, and events whose referenced run is no longer available, remain summary-only.

## What the response contains

[Get security scan findings](/api-reference/audit-logs/get-security-scan-findings) documents the full response schema. Each section uses a strict field allowlist. Responses exclude source snippets, evidence, full RLS expressions, secret values or secret-matching text, input hashes, scanner prompts and models, internal user identifiers, and internal-only URLs.

## Interpreting coverage

The `coverage` object reports the outcome for all five scan sections. Treat a section's empty findings array as a clean result only when its coverage is `completed`:

| Value       | Meaning                                                                                        |
| ----------- | ---------------------------------------------------------------------------------------------- |
| `completed` | The section ran to completion. An empty findings array is a clean result only with this value. |
| `failed`    | The section failed. Its findings array must not be treated as clean or complete.               |
| `not_run`   | The section did not run. Its findings array must not be treated as clean or complete.          |
| `unknown`   | The outcome is unavailable. It must never be treated as clean or successful.                   |

When the event metadata contains `coverage_incomplete` with the string value `"true"`, treat `findings_total` as a floor. Fetch the run and inspect `coverage` to identify the incomplete sections. Coverage is evaluated independently for `rls`, `hardcoded_secrets`, `backend_functions`, `dependency_vulnerabilities`, and `static_code`. For example:

```json theme={null}
{
  "run_id": "6886ba43a165272b97b80322",
  "app_id": "6820f3a4e7b91d003c45a1f2",
  "workspace_id": "67f2c8e01a3b5d004e92d7a1",
  "created_date": "2026-07-26T15:04:09Z",
  "coverage": {
    "rls": "completed",
    "hardcoded_secrets": "failed",
    "backend_functions": "not_run",
    "dependency_vulnerabilities": "completed",
    "static_code": "unknown"
  },
  "rls_recommendations": [],
  "hardcoded_secrets": [],
  "backend_functions": [],
  "dependency_vulnerabilities": [],
  "static_code_findings": []
}
```