Security automation
File concrete security findings on a schedule.
The security automation runs a scheduled codebase audit. It looks for concrete vulnerabilities and files one repository issue per confirmed finding.
It focuses on injection, auth and authorization gaps, unsafe secret handling, SSRF, insecure deserialization, insecure defaults, and PII exposure. For Supabase-backed apps, it also checks RLS, service-role key usage, and sensitive columns.
Open Automations in Ara to configure this in your workspace.
How to use it
- Enable it per repository from Automations.
- Keep the first runs issue-only.
- Review the findings before adding fix automation.
- Use repo guardrails before allowing PR/MR creation or merge.
The security automation should be conservative. It should report validated risks, not theoretical scanner noise.