---
title: "Your apps' security: what while checks, the while.sh docs"
url: https://while.sh/en/docs/building-blocks/security/
updated: 2026-11-09
---

# Security

What while checks itself at every build and every night, and the security review your agent does before every production deployment.

> You, to your agent: Do a security review before deploying to production.

## When to use it

It is always there, without declaring anything, and your agent reviews it before each production deployment.

## How it works

while checks the security of each app itself, and the agent does its own review before production. The app runs isolated (gVisor), the Internet is closed to it by default, and its secrets are in the vault.

At each build, while analyzes the code received and what the image delivers to the browser (Gitleaks, Opengrep). A production key in what goes to the browser holds production back until an approval, and the rest is reported by `deploy_app` and `get_app_status`. A page that imitates a known brand's sign-in or asks for a bank card is reported (a trial without an account is cut).

The list of components of the whole image, system packages included (Syft), is checked against the known vulnerabilities at each build and then every night (UpdateFOMO), and a serious vulnerability opens an incident that wakes the agent.

After each production deployment and then every night, Probr checks its public addresses from outside, looking for example for a served `.env` file: its findings are in status, and a serious finding opens the "Serious vulnerabilities" incident.

The agent does its own review of the changes before production, for example `/security-review` in Claude Code, or Cloudflare's security review, cloudflare/security-audit-skill, and `deploy_app` reminds it at each production deployment.

## What to know

Phishing detection is a bounded heuristic: a page rendered only as images escapes it.

## Your agent's MCP tools

Your agent handles it with the `get_app_status` and `deploy_app` tools.