> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vibescale.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Run a security check

> How to start the scan, what happens during analysis, and how to navigate to the report when it's done.

<Warning>
  The Security Check is only available after the **Opportunity Scale Review** is complete. Finish that step first before proceeding.
</Warning>

## How to start

You can start the check from two places:

* On the **Security Check** page, click **Start analysis**.
* On the main dashboard, click **Start Security Check**.

Both options trigger exactly the same process.

## What happens during analysis

The check takes approximately **20 seconds** and runs four steps in sequence. You track progress in real time:

<Steps>
  <Step title="Code Analysis">
    Examines the repository's source code for insecure patterns, vulnerable logic, and sensitive data exposure.

    Status shown: **Analyzing...** → **Completed**
  </Step>

  <Step title="Dependency Review">
    Checks all libraries imported by the project — including indirect dependencies — against known vulnerability databases.

    Status shown: **Analyzing...** → **Completed**
  </Step>

  <Step title="Secret Detection">
    Scans the repository's history and files for credentials, tokens, and API keys accidentally committed.

    Status shown: **Analyzing...** → **Completed**
  </Step>

  <Step title="Runtime Execution">
    Evaluates the runtime attack surface: server configurations, HTTP headers, and other risks that manifest in production.

    Status shown: **Analyzing...** → **Completed**
  </Step>
</Steps>

A progress bar and overall percentage are displayed throughout the analysis. Previous steps appear as **Completed**; upcoming steps appear as **Waiting...**.

## After completion

When the analysis finishes, you will see **"Security Check Complete!"** and the **View Security Report** button will be enabled.

<Tip>
  To run the analysis again after fixing vulnerabilities, use the **Re-Check** — available in the report once all critical and high findings have been resolved or dismissed.
</Tip>