List security scan findings

1. 1

   Create an API key with the read permission for projects in your workspace settings.

   The API requires an authorized key with the correct read scope to access scan data.

2. 2

   Store the API key and your target project ID securely in your environment variables.

   This keeps credentials private and out of public code.

3. 3

   Send a GET request to the security scan findings URL using your project ID and scan ID.

   This fetches the first batch of issues identified in that scan snapshot.

4. 4

   Check the response for a next page marker and repeat the request until no more pages remain.

   Results are limited to 100 items per call, so you must fetch all pages to see every finding.

Create a service function and UI view to display security scan findings from the Lovable API endpoint GET /v1/projects/{project_id}/security-scans/{scan_id}/findings. Read the Lovable API key from a secure environment variable, pass the project ID and scan ID as arguments, automatically fetch all pages using the pagination next_cursor while has_more is true, and display the findings sorted by scanner name along with their status.

Finding

A specific security weakness, code flaw, or sensitive data leak discovered during an automated scan.

Cursor

A unique bookmark string sent back by the server so you can request the exact next batch of results.

Scope

A specific permission granted to an API key that restricts what actions it can perform.

• Calls will fail with a payment required error if your workspace is not on a Business plan or higher.
• Your API key must have the projects:read or projects:write scope, or you will receive a 403 forbidden response.
• The main security scan endpoint no longer includes findings directly in its response; you must call this dedicated findings endpoint.
• Failing to follow pagination markers will leave out findings if a scan produced more than 50 results.