> ## Documentation Index
> Fetch the complete documentation index at: https://docs.replit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent security scans

> Run a source-code security review, assess findings, fix vulnerabilities with Agent, and verify the fixes.

Agent security scans review your entire codebase for security and privacy vulnerabilities. Security Agent combines model-based analysis with static analysis tools such as [Semgrep](https://semgrep.dev/) and [HoundDog.ai](https://hounddog.ai), then presents its findings in the Project Security Center.

Agent security scans are available to all paid Replit builders. A deep audit can take up to 15 minutes for larger projects.

## What Security Agent reviews

When you start a scan, Security Agent:

1. Maps routes, APIs, data flows, and entry points.
2. Builds a threat model for the application.
3. Runs static analysis across the codebase.
4. Evaluates findings in the context of the application.
5. Generates a findings report for your review.

The review can identify insecure code patterns such as SQL injection, cross-site scripting, and cross-site request forgery; privacy issues such as sensitive data flowing to logs or third-party APIs; and architectural vulnerabilities in routes, APIs, and data flows.

## Start an Agent security scan

<Steps>
  <Step title="Open Security Center">
    In your project's **Tools** pane, select **Security Center**. You can also
    select **Review security** from the Publish flow.

    <Frame>
      <img src="https://mintcdn.com/replit/MuLW6SmzOLVKbNrI/images/project-security-center/review-security-button.png?fit=max&auto=format&n=MuLW6SmzOLVKbNrI&q=85&s=f242cc14d62a515060f1a065f6ee7bb5" alt="Review security action in the Publish flow" width="1440" height="900" data-path="images/project-security-center/review-security-button.png" />
    </Frame>
  </Step>

  <Step title="Start the scan">
    Select **Run scan with Agent**.

    <Frame>
      <img src="https://mintcdn.com/replit/MuLW6SmzOLVKbNrI/images/project-security-center/run-scan-with-agent.png?fit=max&auto=format&n=MuLW6SmzOLVKbNrI&q=85&s=32ae50df611a37d070e9640d775cca54" alt="Run scan with Agent action in the Project Security Center" width="1440" height="900" data-path="images/project-security-center/run-scan-with-agent.png" />
    </Frame>
  </Step>

  <Step title="Add context if needed">
    Optionally add context to focus the threat model on specific areas of your application, then start the security scan.

    <Frame>
      <img src="https://mintcdn.com/replit/MuLW6SmzOLVKbNrI/images/project-security-center/scan-options.png?fit=max&auto=format&n=MuLW6SmzOLVKbNrI&q=85&s=2c47ea280383a22967df5daa7f323371" alt="Security scan options with an Add context field and Start security scan action" width="1440" height="900" data-path="images/project-security-center/scan-options.png" />
    </Frame>
  </Step>

  <Step title="Wait for the review">
    Wait for Security Agent to complete the review. This typically takes a few minutes and can take up to 15 minutes for larger projects.
  </Step>
</Steps>

## Review and fix findings

<Steps>
  <Step title="Review the report">
    Inspect each finding and its severity in **Security Center**. Dismiss
    findings you understand and accept, or revise findings before sending them
    for remediation.
  </Step>

  <Step title="Fix accepted findings with Agent">
    Send accepted issues to Agent. Security Agent organizes vulnerabilities into
    separate tasks so Agent can work on multiple fixes in parallel.
  </Step>

  <Step title="Rerun the scan">
    After Agent applies the fixes, run another scan to verify the issues are
    resolved. Larger projects can reveal additional issues after higher-severity
    findings are fixed.
  </Step>
</Steps>

## When to use Level 3

An Agent security scan reviews source code. If you also need to examine the running app through browser and network interactions, use a [Level 3 black-box pen test](/features/security/black-box-pen-tests). Level 3 runs the black-box test and the source-code review in parallel.

## Limitations and best practices

* Scanning runs on Replit infrastructure. Replit does not send your code or data to Semgrep, HoundDog.ai, or other third parties.
* Scan configuration and results stay attached to your Replit App.
* A scan is not a complete security review. Use it alongside code review, tests, dependency review, and checks of the running app.
* Rerun a scan after major code changes, after adding or updating dependencies, and before publishing a new version.

## Next steps

* Learn how the [Project Security Center](/features/security/project-security-center) combines security checks.
* Add a running-app assessment with a [black-box pen test](/features/security/black-box-pen-tests).
* Review related terminology in [Security concepts](/features/security/concepts).