Skip to main content
The Security page reviews every app and automation in a workspace for security gaps, then lists what it finds so you can fix or ignore them. The review is done by an agent. You can run it in Zite, or from your own agent through the Zite MCP. It does not run on its own, and it does not stop you publishing an app. Only people who can edit the workspace can open the page or start a scan. The workspace also needs to have some code in it already. This shows a review run in Zite or with your own agent, then Open findings listed by severity, then Fix or Ignore issue, and Reopen to bring a finding back to Open.
A security scan runs in Zite or through your agent. Findings are sorted by severity, from Critical to Low. Each one is fixed with Fix or Fix all, or ignored with a reason.

Run a scan in Zite or with your agent, then fix or ignore each finding.

Open the Security page

In the workspace, open Security. You will find it in the workspace overview, and in the workspace menu on a phone. If the page shows a number next to Security, that is how many open critical or high issues there are.

Run a scan

If the workspace has not been scanned yet, you will see Check your workspace for security issues. Choose Scan workspace, then pick how to run it.
Choose In Zite. Zite opens a new chat and starts the review. The message it sends is “Run a security scan of this workspace.”The review is read-only: the agent looks at your apps but does not change any code. You can watch its progress in the chat. If it asks you a question, answer there. If you reload the tab, the scan stops, and you can continue it from the chat.While a scan is running, the page says Scanning in the chat. If the agent is waiting for your answer, it says Scan waiting for your answer in the chat. You can still start a new scan if one is waiting on an answer.
Choose With your agent. In Run a scan with your agent, pick Claude, ChatGPT, Claude Code or another agent, connect Zite if you have not already, then choose Copy prompt and paste the prompt into that agent.Findings from your own agent land on the same Security page. These scans do not use the workspace’s free security allowance.
After a scan, the page says when it last ran. If you have changed the workspace since then, you will also see Code changed since then. Choose Scan again to run another review. A long scan can reach its step limit before it has looked at everything. If that happens, the page says Ran out of steps before finishing. Run another scan to cover the rest.

What a scan looks for

The agent looks at the workspace the way an attacker would: every app and automation, and how they share data. It only records something you should definitely fix: a concrete way for someone to see, change or delete data that is not theirs, act as someone else, or use a key they should not have. Typical gaps include:
  • Pages or actions on a public app that anyone on the internet can use, when they should have to sign in first.
  • Signed-in users reaching other people’s records, or doing something their role should not allow. Being signed in is not the same as being allowed.
  • Forms that save hidden fields a caller could set themselves, such as a price, a status or whether someone is an admin.
  • Lists or pages that return other people’s details, or that send business rules to the browser that someone could use to get around them.
  • API keys, passwords or tokens in page code, which anyone who opens the app can read.
  • Keys written directly into server code instead of the app’s Secrets.
  • Database queries built by pasting what a caller typed into the query itself.
  • Packages the workspace uses that have a known high or critical security problem.
A public contact form, catalogue or sign-up is fine, as long as what it returns or changes is limited to that. The review does not flag missing rate limits or CAPTCHAs on things that are meant to be public, or hardening that has no concrete way to exploit it today. Each issue has a severity:
  • Critical: anyone on the internet can read or change private data, or act as someone else. A key, password or token in page code is always critical.
  • High: any signed-in user can read or change other people’s data, or do what their role forbids.
  • Medium: a real but limited problem, such as seeing a few fields they should not see.
  • Low: nobody can use it against the app today, but something sensitive is within reach of more people than should have it.
Most issue titles are written in plain language, for example “Anyone can see every patient’s appointments.” Known problems in packages use a standard title, such as “A high severity vulnerability in a dependency” or “Several critical severity vulnerabilities in dependencies.” Packages Zite itself provides are left out, because you cannot upgrade those yourself. If the package check cannot run, the scan will not record package issues and the agent’s summary should say they were not checked.

Work through what it found

Issues are listed under Open, Ignored and Resolved. If the workspace has more than one app, you can filter the list to one app. Fix all follows that filter. Choose an issue to read the description. Technical details is hidden until you open it, and is there for anyone who wants to see the file and the suggested code change.
Choose Fix on one issue, or Fix all on the status card when several are open. If there are more than 10 open issues in view, the button says Fix top 10 and takes the most serious ones first.The agent works in the workspace chat, confirms the issue is real, and makes the smallest change that closes it. The issue stays open until that change is on the workspace’s main version. If the turn is stopped, discarded or retried, or the change never lands, the issue stays open.If a later scan finds the same issue after it was resolved, it comes back with a Reopened label.
If you are happy to leave an issue as it is, open the menu on that row and choose Ignore issue. You have to give a reason:
  • I accept the risk
  • Intended behavior
  • Finding is wrong
  • Other
You can add a note. A note is required if you choose Other.Ignored issues stay ignored when you scan again. Only a person can bring one back, with Reopen. If a later scan describes an ignored issue differently, it is marked Changed so you can look at it again. An agent will not un-ignore an issue for you.

Free scans and fixes

A scan or fix you start from the Security page is free, up to 20 credits a day for that workspace, with scans and fixes counting together. The In Zite choice says Free · up to 20 credits a day while you still have allowance left. These free scans and fixes still run if the organization has no credits left, has reached its daily message limit, or a member has reached their personal credit limit. Once that daily amount is used, the same actions still work, but they use your usual credits, and the page says Daily free limit reached. The allowance frees up again over the following 24 hours. Scans you run with your own agent do not use this allowance.
Last modified on November 12, 2026