Skip to main content
Code Security is currently in beta. Contact support to enable it for your organization.
Code Security covers the controls Superblocks applies to the code and dependencies that ship in your applications. AI-generated code ships fast, and these controls make sure it ships safely, without builders having to leave the editor. Three layers work together:

Supply chain

Control where packages come from and monitor deployed dependencies for newly disclosed CVEs.

Static analysis

Deterministic scanning for hardcoded secrets and insecure code patterns at build and publish time.

Security Agent

A Superblocks-managed AI reviewer that reasons about your application the way a security engineer would.

​
Supply chain

Supply chain controls govern the third-party code your applications depend on.
  • Private registries: route every npm install through the registries your security and platform teams already trust, instead of the public npm registry. Builders and Clark can only install packages you have vetted, and your own internal packages become available to every app.
  • CVE detection: Superblocks matches the packages deployed in your published apps against known advisories, so newly disclosed CVEs surface in Security Center even when the app itself has not changed.

​
Static analysis

Static analysis runs automatically against application source and built artifacts. It is deterministic and Superblocks-managed: no configuration beyond enabling it and choosing which severities block a deploy. It catches hardcoded secrets, injection-prone patterns, and other issues that can be detected by inspecting code directly.

​
Security Agent

The Security Agent is an AI reviewer that reads the application the way a security engineer would, following data across pages, APIs, and integrations to find issues that pattern matching misses, such as missing authorization on a sensitive endpoint or PII returned in an API response. It runs on Claude, following the approach of Anthropic’s open-source Claude Code security review, tuned for the Superblocks execution model so platform-enforced protections are not reported as findings.

​
How findings reach builders

Every Code Security check feeds into the same publish readiness checklist. Builders see one view of which checks passed, which are running, and which are blocking their deploy:
Each item links to a report with findings, evidence, locations, and next actions. Admins choose per check whether findings are blocking (publish is prevented until findings are remediated or an admin overrides) or advisory (findings are shown but publish proceeds). When a finding is eligible, builders click Fix with Clark and Clark remediates it. A remediation attempt never resolves the gate on its own. A fresh run must verify the new application state before publish unblocks.

​
Audit and RBAC

Every run, finding, remediation attempt, escalation, and admin override is recorded as an audit log event, and is available programmatically through the Superblocks MCP server. RBAC controls who can configure checks and blocking thresholds, view reports and findings, escalate blocked findings, and force-push past a blocking check.
  • Policy Agents: configure your own AI reviewers for organization-specific policies beyond security
  • Knowledge: guide Clark while it writes code, so fewer findings appear at publish time