Vulnerable packages, secrets and the deploy gate
Find known vulnerabilities and leaked credentials in what you deploy, and stop risky deploys.
1Vulnerable packages
Security reads the composer.lock and package-lock.json of each live website and checks every package against the OSV vulnerability database. Each finding names the version that fixes it. Development-only packages count one level lower.
2Leaked secrets
On Pro and above, Security looks for keys and tokens (AWS, Stripe, GitHub, Slack, private keys and more) in each website’s code and in recent error reports and logs, and for .env files committed with the code. Secrets are never stored or shown in full.
3Deploy gate
On the Security overview, choose Block deploys with for an environment. A deploy whose packages have a vulnerability at that level stops before it goes live, and the reason appears on the deploy.
4Accepting a risk
To let a deploy through anyway, ignore the finding in Security with a reason. The gate treats ignored findings as accepted.