Guides
Security review
The security review panel uses AI to scan your project. It’s experimental, so combine it with other tools and manual reviews.
Running a review
- Open the Security panel (top-right of the app shell).
- Click Run Security Review. Elmony launches a dedicated chat and scans the current app.
- When the AI finishes, findings appear in the panel table sorted by severity.
| Severity | Description |
|---|---|
| Critical | Highest priority; should almost always be fixed. |
| High | Important vulnerabilities that typically require remediation. |
| Medium | Potential issues that merit review and may need fixes depending on context. |
| Low | Informational findings that rarely need action. |
Fixing issues
Click Fix Issue on a row, or select several findings and send them to Builder together. Review the resulting code and re-run the security review to confirm the finding is resolved. When automatic approval is enabled, Builder applies its edits as it works; restore the previous version if the fix has unwanted side effects.
Knowledge / security rules
If a finding is a false positive for your use case, click Edit Security Rules. Elmony creates or updates SECURITY_RULES.md in your project root. These instructions are used only during security review runs.
Limitations
- Security review is experimental and won’t catch every issue.
- Use additional scanners such as Snyk or other dependency/security tools for broader coverage.
- Elmony analyzes Supabase schemas via AI but doesn’t show Supabase’s own advisories; check the Supabase console for those alerts.