Security findings

Findings come from the connected repository: secrets, auth gaps, data exposure, and similar checks. Each finding shows where, the evidence, and a prompt you can paste into your own editor.

The Security page shows the last completed scan, the loophole lanes it actually walks in fetched files, and open hits. It is not a pentest, it does not sit inside the running process unless you installed the SDK, and a quiet result is not a proof the app is secure.

Private URLs

On Project Settings, list paths that should require a login. Invince GETs them with no cookies against the authorized live origin. A 401, 403, redirect, or login form is blocked. A 200 app page is open. This is not a two-account IDOR test and it does not sign in as your users.

Honest statuses

• Checked: that scanner ran
• Not checked: the tool was missing or skipped. This is not a pass
• Not applicable: the check does not apply to this repo

A passing scan does not mean the app is 100% secure.

Claimed keys

For Stripe live keys, GitHub tokens, OpenAI, Anthropic, Google AI, and Slack tokens found in the repo, Invince asks the provider whether the credential still authenticates. The secret value is not stored. AWS access-key IDs cannot be checked without the secret half. Invince does not revoke the key for you.

False positives

Open the finding and mark it reviewed, ignored, or a false positive. Add a note. The decision stays in history.

Recheck

After you push a fix, Recheck runs the relevant checks again.

Improve

The Improve page ranks this evidence with errors, debt, docs, and launch gates into three actions. It does not edit your repository.