Apps: Securing your app

Running a security scan

Find permission gaps, exposed keys and risky code in your app, and fix them in one click.

Dashboard → Security reviews your app every time you open it and gives it a score out of 100.

What it checks

Area	Examples
Data permissions	Tables with personal fields (email, phone, address…) readable by anyone; tables anyone can update or delete; form inboxes that are publicly readable.
Secrets	API keys written in the code, especially in files that run in the browser; server environment variables used in the browser.
Code	The server SDK imported in a browser component; raw HTML rendering (XSS); `eval`.
Backend functions	Functions that change data without checking who is calling.
AI agents	Agents that can write to tables anyone may modify.

Each finding has a severity (critical, high, medium, low), where it is, and a recommendation.

Fixing findings

Apply fix — for permission problems, Draftship rewrites the table's rules and applies them immediately. No rebuild, no AI usage.
Fix with AI — sends a precise fix request to the chat (one message). Use it for code findings, or when you'd like the app adjusted around the new rules.

Scan again after changes to confirm the issue is gone.

Limits of a scan

The scan is a static review: it catches common, high-impact mistakes, not every possible vulnerability. Test important flows yourself — signed out, as a regular user, and as an admin.