Overview
Every bridge deployment triggers an automatic security review. Archway scans your code for vulnerabilities, unsafe patterns, and hardcoded secrets before allowing deployment.
Severity Levels
Critical — Blocks deployment. Must be fixed before the bridge can go live. Examples: hardcoded API keys, SQL injection vulnerabilities.
High — Shows a warning. You can choose to deploy anyway, but it's recommended to fix these. Examples: missing input validation, insecure HTTP calls.
Medium — Informational. Good to fix but won't block or warn.
Low — Minor suggestions for improvement.
What Gets Scanned
Hardcoded secrets and credentials
Known vulnerability patterns
Unsafe code practices (eval, exec, etc.)
Input validation gaps
Insecure network calls
Viewing Results
After a security review runs, results appear in the Security tab of the bridge editor. Each finding shows the severity, description, and the affected code location.
Deploying with Warnings
If the review finds High severity issues but no Critical ones, you'll see a warning dialog. You can:
Go back and fix the issues
Click "Deploy Anyway" to proceed despite the warnings