> ## Documentation Index
> Fetch the complete documentation index at: https://docs.detail.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Vulnerability Scanning with Detail AI

> Detail flags security vulnerabilities as a distinct category within every scan.

Detail flags security vulnerabilities as a distinct category within its bug-finding scans. Contact Support to run a vulnerability-only scan, with a particular focus on vulnerabilities.

## What counts as a security vulnerability

Detail's AI agents look for a broad range of security issues, including but not limited to:

* **Injection flaws** — SQL injection, command injection, template injection, and similar input-handling bugs
* **Insecure data handling** — sensitive data written to logs, stored unencrypted, or transmitted over unprotected channels
* **Authentication and authorization flaws** — broken access controls, missing authentication checks, and privilege escalation paths
* **Cryptographic weaknesses** — use of deprecated algorithms, weak key sizes, and insecure random-number generation
* **Dependency and configuration issues** — patterns that indicate insecure defaults or known-vulnerable usage

Each flagged issue carries the same full report as a standard bug: title, summary, file path, and introduced-by information.

## Security Findings

If you only want to see security findings, you can filter for them in any consumption surface.

<CardGroup cols={3}>
  <Card title="Dashboard" icon="browser">
    Open the Bugs view and select the **Security** filter to show only security vulnerabilities.
  </Card>

  <Card title="CLI" icon="terminal">
    Pass the `--vulns` flag to the bugs list command:

    ```bash theme={null}
    detail bugs list --vulns
    ```
  </Card>

  <Card title="API" icon="code">
    Fetch bugs and filter on the `isSecurityVulnerability` field:

    ```json theme={null}
    { "isSecurityVulnerability": true }
    ```
  </Card>
</CardGroup>

## Filtering security findings

### Dashboard

1. Navigate to the **Bugs** section of your repository.
2. Click the **Security** filter chip.

### CLI

```bash theme={null}
# Show only open security vulnerabilities
detail bugs list --vulns

# Combine with other filters — e.g. bugs introduced in the last 7 days
detail bugs list --vulns --since 7d

# Show a specific vulnerability's full report
detail bugs show bug_abc123
```

### API

Fetch bugs from the API and filter on the `isSecurityVulnerability` field in the response. Each bug object includes:

```json theme={null}
{
  "id": "bug_abc123",
  "title": "SQL injection in user search endpoint",
  "isSecurityVulnerability": true,
  "filePath": "src/api/users.ts",
  "summary": "...",
  "introducedIn": {
    "sha": "a1b2c3d",
    "author": "dev@example.com",
    "date": "2024-11-01"
  }
}
```

Filter your results to objects where `isSecurityVulnerability === true`.

## What each security finding includes

Security findings include all the standard bug report fields. The key fields are:

| Field             | API field                 | Description                                                    |
| ----------------- | ------------------------- | -------------------------------------------------------------- |
| **Title**         | `title`                   | Short description of the vulnerability                         |
| **Summary**       | `summary`                 | Full explanation of the security risk and its potential impact |
| **File path**     | `filePath`                | File where the vulnerability exists                            |
| **Introduced by** | `introducedIn`            | Commit SHA, date, author, and PR that introduced the code      |
| **Security flag** | `isSecurityVulnerability` | Always `true` for security findings                            |