Security
What while checks itself at every build and every night, and the security review your agent does before every production deployment.
Updated November 9, 2026.
You, to your agent: Do a security review before deploying to production.
When to use it
It is always there, without declaring anything, and your agent reviews it before each production deployment.
How it works
while checks the security of each app itself, and the agent does its own review before production. The app runs isolated (gVisor), the Internet is closed to it by default, and its secrets are in the vault.
At each build, while analyzes the code received and what the image delivers to the browser (Gitleaks, Opengrep). A production key in what goes to the browser holds production back until an approval, and the rest is reported by deploy_app and get_app_status. A page that imitates a known brand’s sign-in or asks for a bank card is reported (a trial without an account is cut).
The list of components of the whole image, system packages included (Syft), is checked against the known vulnerabilities at each build and then every night (UpdateFOMO), and a serious vulnerability opens an incident that wakes the agent.
After each production deployment and then every night, Probr checks its public addresses from outside, looking for example for a served .env file: its findings are in status, and a serious finding opens the “Serious vulnerabilities” incident.
The agent does its own review of the changes before production, for example /security-review in Claude Code, or Cloudflare’s security review, cloudflare/security-audit-skill, and deploy_app reminds it at each production deployment.
What to know
Phishing detection is a bounded heuristic: a page rendered only as images escapes it.
Your agent’s MCP tools
Your agent handles it with the get_app_status and deploy_app tools.