# A security check before every release reaches production > Substrait scans every release for leaked secrets, weak code, vulnerable dependencies, container issues and problems in the running tool. A tool reaches production only through a promotion that clears the check. URL: https://substrait.build/capabilities/security-check/ Last updated: 2026-11-06 Every release on Substrait is scanned, and production is reached only through a promotion that clears the check on that exact build. A clean build goes through on its own; a build with too many issues waits for a human approver. ## What every release goes through **1. Scans.** Substrait scans for leaked secrets across the full history of the code, weaknesses in the code, dependencies with known vulnerabilities, container images, the running tool, infrastructure definitions and malicious packages. Your organisation's own rules decide which findings block a release. **2. Classification and documents.** Substrait reads the change and places it in your organisation's own risk tiers, with a written reason. Each change then carries the documents that tier needs: a change summary, a technical design, a threat model, a risk analysis, a deployment plan, compliance tags and an API-change analysis. Each change is compared with the last build cleared for production. **3. People review where it matters.** A build that is clean enough under your policy skips this step and is approved automatically. A build with too many issues, a change in a high-risk tier, or a change the check is unsure about goes to a person to review. Approvals can need one person or several, carry deadlines with escalation, and never let a builder approve their own change. A named reviewer can open the build they are asked to approve. **4. Record and release.** Substrait writes a software bill of materials, a licence scan and a chain-of-custody record, then promotes the build. ## Guided fixes Substrait guides a builder who is not an engineer through each fix. A builder can claim a finding is a false positive; your infosec team reviews the claim, and repeated retries are capped.
Substrait security command centre: the tools with the most open findings, and open findings by kind of scan.
Tools ranked by risk, and findings by kind of scan. Product UI. Sample data.
## Questions and answers ### What does Substrait scan for? Leaked secrets across the code's full history, weaknesses in the code, dependencies with known vulnerabilities, container images, the running tool itself, infrastructure definitions and malicious packages. ### Can a builder who is not an engineer fix a finding? Yes. Substrait guides the builder through each fix in plain steps. A builder who believes a finding is wrong can claim a false positive, and the organisation's infosec team reviews the claim. ### Can a builder lower a tool's risk class to skip review? No. Substrait derives the risk class from the change itself. Nothing a builder writes in the code can lower it. ## Related - [A security command centre, built in](https://substrait.build/capabilities/security-command-centre/): Substrait gives the security team one console for every finding across every tool, opening on one page that answers how exposed the company is right now, in the organisation's own severity names. - [Set the guardrails once, not for every change](https://substrait.build/capabilities/policies-and-approvals/): Each organisation sets its own policies and risk tiers in Substrait. Changes inside an approved boundary ship freely; only a change that crosses it goes back for approval. - [Security, configured exactly for your organisation](https://substrait.build/security/): Security, Substrait's third pillar. Every release is checked before production, and each organisation sets how strict that check is: its own risk tiers, blocking rules, severity names, approvers and deadlines, with a full audit trail nobody can alter. - [One click to live, through the security check](https://substrait.build/capabilities/one-command-go-live/): A builder sends a tool to Substrait with one command, through their AI model, and goes live with one click. Substrait promotes the exact build tested in dev to production, only through the security check.