> ## Documentation Index
> Fetch the complete documentation index at: https://docs.superblocks.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Code Security

> Secure the code and dependencies in every Superblocks app with supply chain controls, static analysis, and an AI security agent

<Note>
  Code Security is currently in **beta**. [Contact support](mailto:support@superblocks.com) to enable it for your organization.
</Note>

**Code Security** covers the controls Superblocks applies to the code and dependencies that ship in your applications. AI-generated code ships fast, and these controls make sure it ships safely, without builders having to leave the editor.

Three layers work together:

<CardGroup cols={3}>
  <Card title="Supply chain" icon="box" href="/admin/code-security/supply-chain/private-registries">
    Control where packages come from and monitor deployed dependencies for newly disclosed CVEs.
  </Card>

  <Card title="Static analysis" icon="magnifying-glass" href="/admin/code-security/static-analysis">
    Deterministic scanning for hardcoded secrets and insecure code patterns at build and publish time.
  </Card>

  <Card title="Security Agent" icon="shield-check" href="/admin/code-security/security-agent">
    A Superblocks-managed AI reviewer that reasons about your application the way a security engineer would.
  </Card>
</CardGroup>

## Supply chain

Supply chain controls govern the third-party code your applications depend on.

* **[Private registries](/admin/code-security/supply-chain/private-registries)**: route every `npm install` through the registries your security and platform teams already trust, instead of the public npm registry. Builders and [Clark](/building-with-clark/index) can only install packages you have vetted, and your own internal packages become available to every app.
* **[CVE detection](/admin/code-security/supply-chain/cve-detection)**: Superblocks matches the packages deployed in your published apps against known advisories, so newly disclosed CVEs surface in Security Center even when the app itself has not changed.

## Static analysis

[Static analysis](/admin/code-security/static-analysis) runs automatically against application source and built artifacts. It is deterministic and Superblocks-managed: no configuration beyond enabling it and choosing which severities block a deploy. It catches hardcoded secrets, injection-prone patterns, and other issues that can be detected by inspecting code directly.

## Security Agent

The [Security Agent](/admin/code-security/security-agent) is an AI reviewer that reads the application the way a security engineer would, following data across pages, APIs, and integrations to find issues that pattern matching misses, such as missing authorization on a sensitive endpoint or PII returned in an API response. It runs on Claude, following the approach of Anthropic's open-source [Claude Code security review](https://github.com/anthropics/claude-code-security-review), tuned for the Superblocks execution model so platform-enforced protections are not reported as findings.

## How findings reach builders

Every Code Security check feeds into the same **publish readiness** checklist. Builders see one view of which checks passed, which are running, and which are blocking their deploy:

```text theme={null}
Static Analysis      Passed
Security Agent       Blocked (2 findings)
```

Each item links to a report with findings, evidence, locations, and next actions. Admins choose per check whether findings are **blocking** (publish is prevented until findings are remediated or an admin overrides) or **advisory** (findings are shown but publish proceeds).

When a finding is eligible, builders click **Fix with Clark** and Clark remediates it. A remediation attempt never resolves the gate on its own. A fresh run must verify the new application state before publish unblocks.

## Audit and RBAC

Every run, finding, remediation attempt, escalation, and admin override is recorded as an [audit log](/admin/audit-logs) event, and is available programmatically through the [Superblocks MCP server](/admin/mcp-server).

RBAC controls who can configure checks and blocking thresholds, view reports and findings, escalate blocked findings, and force-push past a blocking check.

## Related

* [Policy Agents](/admin/policy-agents/index): configure your own AI reviewers for organization-specific policies beyond security
* [Knowledge](/building-with-clark/knowledge/index): guide Clark while it writes code, so fewer findings appear at publish time