Skip to main content
Superblocks continuously checks the packages your published applications depend on against known vulnerability advisories. This is the detection half of supply chain security: private registries control what can be installed, and CVE detection tells you when something already deployed becomes unsafe. Security Center gives admins a single view of npm package vulnerabilities across every published application in the organization. Superblocks matches deployed package versions against known advisories, so newly disclosed CVEs surface even when the app itself has not changed.

​
Security Center

Security Center lives under Security in the dashboard. Admins with policies:manage see open npm vulnerabilities across published applications, grouped by app, prioritized by severity, and refreshed as new advisories appear.

​
What it shows

Security Center with summary, dependency scans, and expanded advisories The table lists only apps that need attention. Apps with no open vulnerabilities are left out, so an empty table means your published fleet is clean. Each listed app carries one of two statuses: For Unresolved apps, use Fix with Clark or Unpublish. For Needs review, treat the app as unverified: commit a lockfile (or otherwise pin exact versions) and republish so Superblocks can match advisories against real installed versions. Search by app name, package, or CVE / advisory ID. Filter by severity. A Low confidence badge marks findings where Superblocks could not pin an exact version (for example, no lockfile, so the minimum of the declared range was used).

​
What is scanned

  • Scope: Published applications with a deployed commit
  • Packages: Dependencies from the deployed commit (package.json plus lockfile-resolved versions when available)
  • Ecosystem: npm
  • Advisory source: OSV npm feed
  • Detector: Superblocks Package Scanner
Scans evaluate the deployed package set (what is live), not an uncommitted local workspace. Superblocks refreshes its vulnerability index every hour, so findings you see in Security Center stay current within that window as new advisories are published.

​
Fix with Clark

From Security Center, click Fix with Clark on an app or an individual advisory:
  1. The app opens in the editor with a pre-built remediation prompt
  2. Clark upgrades vulnerable packages to safe versions and keeps the app building
  3. Publish (or redeploy) so the deployed package index updates
  4. Security Center reflects the remediated packages on the next scan
Admins can also Unpublish a vulnerable app. Unpublish immediately takes the app offline for all end users; republish (or redeploy) after the fix to restore access. Fix with Clark and Unpublish require deploy access on the target application.

​
Package visibility

Admins can view all npm packages in use across their organization’s applications, including versions. This gives security teams a centralized software bill of materials without requiring manual inventory.

​
Permissions