Find vulnerabilities in the components that run your app

Open an application, go to Settings > Security & runtime, and select Run scan. The page also loads the latest available report.

It checks the application's runtime, dependencies, and base image when those targets are available. The report lists the targets checked and shows warnings when part of the check could not be completed.

Findings can identify a vulnerability, end-of-life or outdated component, or malicious package. The report shows severity, affected status, component and version, and fix or source details when available.

You'll be able to review a diff of the proposed changes in the scan report. If you choose to proceed, Shard Cloud will automatically apply supported dependency updates to your app. No changes will be applied without your choice.

Core, Pro, and Enterprise include a daily scan allowance. Free and Basic have a limit of zero. See the pricing page for current daily limits.

Enterprise plans can enable automatic vulnerability scans for an application from Security & runtime. Manual scans remain available within the plan's daily allowance.

You can view the latest report for up to 45 days after a scan. Score history is retained for 45 days and updates after manual or automatic scans.

No. The score covers known findings and skipped advisories, excludes ignored findings and unchecked items, and may be unavailable. Review warnings and checked targets alongside the score.

Members with permission to control the application can ignore an issue with a reason and optional expiration date. Ignored issues remain visible and are excluded from the score.