Build Settings (Security Toggles)

The SwapLab Private Builder incorporates enterprise-grade security scans directly into your CI/CD pipeline. Use these settings to customize how strict the build engine should be when analyzing your source code and dependencies.

Why are some toggles locked? Because SwapLab executes remote commands on cloud infrastructure, certain fundamental security checks cannot be bypassed. This protects both your environment from malicious supply-chain attacks and our engine from executing harmful code.

Security Configurations

verified_user Vulnerability Scan Locked On

What it does: Analyzes the foundational layers of your project before any npm or gradle scripts are executed.

Why it's locked: This is a mandatory safety measure to detect known malicious payloads or blatant exploit attempts in the raw source code before the container runtime fully initializes.

policy Semgrep (SAST) Locked On

What it does: Performs Static Application Security Testing (SAST) using Semgrep rulesets tailored for Node.js, Android, and iOS development.

Why it's locked: It actively prevents the compilation of code containing hardcoded secrets (outside of our secure Keystore JIT injection), SQL injection patterns, or highly insecure cryptographic functions.

inventory_2 Trivy (SCA) Locked On

What it does: Software Composition Analysis (SCA) scans your package.json and package-lock.json against the global CVE (Common Vulnerabilities and Exposures) database.

Why it's locked: Supply chain attacks (malicious NPM packages) are common. Trivy ensures your hybrid app doesn't pull in compromised third-party dependencies during the build phase.

Optional Configurations

shield NPM Script Security (Ignore Scripts)

What it does: When toggled ON, the engine runs npm install --ignore-scripts.

Benefits: This prevents third-party packages from executing arbitrary bash scripts (like postinstall hooks) on your Action runner. This drastically increases security but may break certain plugins (like node-sass or specific native bindings) that rely on post-install compilation.

healing Auto-Heal Vulnerabilities (Audit Fix)

What it does: When toggled ON, the engine automatically runs npm audit fix before compiling the app.

Benefits: It automatically patches minor dependency vulnerabilities on the fly. Note: Leave this OFF if you strictly control your dependency versions and do not want the engine altering them automatically.

bug_report Final Artifact Scan (ClamAV)

What it does: When toggled ON, the compiled output (e.g., the `.apk` or `.aab` file) is scanned by an integrated antivirus daemon before being uploaded to R2.

Benefits: Provides a final peace of mind that the resulting binary is clean. Note: This can add 1-2 minutes to your total build time. If you trust your code and dependencies (and SAST/SCA passed), you can safely leave this OFF to speed up CI/CD workflows.