What Security Agent reviews
When you start a scan, Security Agent:- Maps routes, APIs, data flows, and entry points.
- Builds a threat model for the application.
- Runs static analysis across the codebase.
- Evaluates findings in the context of the application.
- Generates a findings report for your review.
Start an Agent security scan
1
Open Security Center
In your project’s Tools pane, select Security Center. You can also
select Review security from the Publish flow.
2
Start the scan
Select Run scan with Agent.
3
Add context if needed
Optionally add context to focus the threat model on specific areas of your application, then start the security scan.
4
Wait for the review
Wait for Security Agent to complete the review. This typically takes a few minutes and can take up to 15 minutes for larger projects.
Review and fix findings
1
Review the report
Inspect each finding and its severity in Security Center. Dismiss
findings you understand and accept, or revise findings before sending them
for remediation.
2
Fix accepted findings with Agent
Send accepted issues to Agent. Security Agent organizes vulnerabilities into
separate tasks so Agent can work on multiple fixes in parallel.
3
Rerun the scan
After Agent applies the fixes, run another scan to verify the issues are
resolved. Larger projects can reveal additional issues after higher-severity
findings are fixed.
When to use Level 3
An Agent security scan reviews source code. If you also need to examine the running app through browser and network interactions, use a Level 3 black-box pen test. Level 3 runs the black-box test and the source-code review in parallel.Limitations and best practices
- Scanning runs on Replit infrastructure. Replit does not send your code or data to Semgrep, HoundDog.ai, or other third parties.
- Scan configuration and results stay attached to your Replit App.
- A scan is not a complete security review. Use it alongside code review, tests, dependency review, and checks of the running app.
- Rerun a scan after major code changes, after adding or updating dependencies, and before publishing a new version.
Next steps
- Learn how the Project Security Center combines security checks.
- Add a running-app assessment with a black-box pen test.
- Review related terminology in Security concepts.