> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Internal links on these pages omit the .md extension. Append .md to a docs page URL, or send an Accept: text/markdown header, to get that page as markdown.

# Security

> Scan an app for security problems and act on the findings with the Base44 Apps API

<Note>
  The Apps API is in beta. Its endpoints and responses may change.
</Note>

These endpoints run a security scan on an app, read what it found, and act on the recommendations. See [Running a security scan](/Setting-up-your-app/running-a-security-scan) for the same feature in the Base44 online app editor.

## Run and read a scan

A scan reads the app's code, so it takes a while and runs in the background. [Run security scan](/api-reference/run-security-scan) starts a scan, or returns the last scan when it still matches the app. [Get security scan](/api-reference/get-security-scan) reads the latest scan without starting a new one. A scan's findings go out of date when the app changes, so check the scan's `status` before you act on them.

## Scan findings

Findings come in groups, by what the scan looked at. To ignore a finding, send the `finding_type` that matches its group.

| Group | `finding_type` | What it holds |
| - | - | - |
| `rls_recommendations` | `rls` | Entities whose row-level security is too open. |
| `hardcoded_secrets` | `secret` | Credentials written directly into the app's code. |
| `backend_functions` | `backend_function` | Problems in the app's backend functions. |
| `open_backend_functions` | `open_backend_function` | What each backend function can do, on an app that doesn't require login. These replace `backend_functions` on such an app. |
| `dependency_vulnerabilities` | `dependency` | Known vulnerabilities in the app's npm packages. |
| `static_code_findings` | `static_code` | Problems found by reading the app's code. |
| `header_recommendations` | None | Gaps in the published app's HTTP headers. These can't be ignored. |

## Findings and fingerprints

Every finding, except a header recommendation, has a `fingerprint`. It's a stable ID that stays the same across scans until what the finding flags changes, which is how Base44 recognizes the same finding in a later scan. Each type of finding has its own rule for when its fingerprint changes, and the rule is described on that type's `fingerprint` field.

## Act on findings

You can deal with a finding in three ways.

* Fix it: [Fix RLS recommendations](/api-reference/fix-rls-recommendations) applies the recommended row-level security rules, and [Update security headers](/api-reference/update-security-headers) changes the headers.
* Dismiss it: [Dismiss RLS recommendation](/api-reference/dismiss-rls-recommendation) and [Dismiss header recommendation](/api-reference/dismiss-header-recommendation) remove a recommendation from the scan result without acting on it.
* Ignore it: [Ignore security finding](/api-reference/ignore-security-finding) hides a finding without changing the app or the scan result. The ignore is tied to the finding's `fingerprint`, so it ends when the fingerprint changes and the next scan drops it. [Restore security finding](/api-reference/restore-security-finding) ends an ignore sooner.

## Core integration protection

Core integrations are Base44's built-in integrations, such as sending email or calling a language model. By default, an app's pages can call them directly. With core integration protection on, they can't, and the calls have to come from the app's backend functions instead. File uploads and signed file URLs aren't affected.

The protection has one exception, based on who the app is open to. If only invited users or workspace members can open the app, its signed-in users can still call the integrations directly. If anyone can open the app, nobody can. A scan reports whether turning it on is safe in `core_integration_recommendation`, and [Enable core integration protection](/api-reference/enable-core-integration-protection) turns it on. You can't turn it off through the API.

## Endpoints

### Scan

* [Run security scan](/api-reference/run-security-scan): Scan the app, or return the last scan if it's still current.
* [Get security scan](/api-reference/get-security-scan): Read the latest scan and whether it still reflects the app.

### Recommendations

* [Fix RLS recommendations](/api-reference/fix-rls-recommendations): Apply the recommended row-level security rules to entities you name.
* [Dismiss RLS recommendation](/api-reference/dismiss-rls-recommendation): Remove one entity's recommendation from the scan result.
* [Update security headers](/api-reference/update-security-headers): Change the app's security header settings.
* [Dismiss header recommendation](/api-reference/dismiss-header-recommendation): Hide one header recommendation without changing the headers.
* [Enable core integration protection](/api-reference/enable-core-integration-protection): Require calls to Base44's built-in integrations to come from backend functions.

### Ignore findings

* [Ignore security finding](/api-reference/ignore-security-finding): Keep one finding hidden across rescans.
* [Restore security finding](/api-reference/restore-security-finding): Stop hiding an ignored finding.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.