SafetyCheck

Fields

Field	Type	Description
id *	string
category *	SafetyCategory
status *	pass, warn, fail, info, not_applicable
severity *	critical, high, medium, low, info
title *	string
finding *	string	Plain English.
environment	string or null
resource	ResourceRef or any or null
blocks_deploy *	boolean
fix	array of FixAction
acknowledged	object or null
detected_at *	string (date-time)
resolved_at	string (date-time) or null

* always present

Example

{
  "id": "chk_01jbx2m9k7q4r8t5v6w3y0z1ck",
  "category": "secrets_in_bundle",
  "status": "fail",
  "severity": "critical",
  "title": "Secret visible in your website's code",
  "finding": "Your SUPABASE_SERVICE_ROLE_KEY is visible to anyone visiting your site.",
  "environment": "production",
  "resource": {
    "type": "service",
    "id": "svc_01jbx2m9k7q4r8t5v6w3y0z1sv",
    "name": "web"
  },
  "blocks_deploy": true,
  "fix": [
    {
      "kind": "manual",
      "label": "Rotate the key in Supabase, then update it here",
      "command": "guv secrets rotate SUPABASE_SERVICE_ROLE_KEY --env production"
    },
    {
      "kind": "open_pr",
      "label": "Ask AI to move the key server-side (opens a PR)"
    }
  ],
  "acknowledged": null,
  "detected_at": "2026-10-23T14:03:00Z",
  "resolved_at": null
}

Used by

• Acknowledge a finding (accept the risk)