# Running a security scan

> Find permission gaps, exposed keys and risky code in your app, and fix them in one click.


**Dashboard → Security** reviews your app every time you open it and gives it a score out of 100.

## What it checks

| Area | Examples |
|---|---|
| Data permissions | Tables with personal fields (email, phone, address…) readable by anyone; tables anyone can update or delete; form inboxes that are publicly readable. |
| Secrets | API keys written in the code, especially in files that run in the browser; server environment variables used in the browser. |
| Code | The server SDK imported in a browser component; raw HTML rendering (XSS); `eval`. |
| Backend functions | Functions that change data without checking who is calling. |
| AI agents | Agents that can write to tables anyone may modify. |

Each finding has a severity (critical, high, medium, low), where it is, and a recommendation.

## Fixing findings

- **Apply fix** — for permission problems, Draftship rewrites the table's rules and applies them immediately. No rebuild, no AI usage.
- **Fix with AI** — sends a precise fix request to the chat (one message). Use it for code findings, or when you'd like the app adjusted around the new rules.

Scan again after changes to confirm the issue is gone.

## Limits of a scan

The scan is a static review: it catches common, high-impact mistakes, not every possible vulnerability. Test important flows yourself — signed out, as a regular user, and as an admin.