> For the complete documentation index, see [llms.txt](https://docs.buzzy.buzz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.buzzy.buzz/the-building-blocks/security-review.md).

# Security Review

Security Review helps builders assess whether an app's data, permissions, and usage context are ready for a governed release. It focuses on field-level Private Data settings, datatable permissions, security requirements, risk profile, and review findings.

Security Review is guidance. It supports human security and compliance review; it does not replace one.

## What it Reviews

| Area                  | What to check                                                                         |
| --------------------- | ------------------------------------------------------------------------------------- |
| Security requirements | Audience, usage, deployment, external access, and sensitive-data context for the app. |
| Private Data          | Whether sensitive fields need stronger access controls.                               |
| Datatable permissions | Who can view, create, update, or delete records.                                      |
| Field-level access    | Whether individual fields expose data to the right roles only.                        |
| Review findings       | Severity, evidence, recommendation, and the builder decision recorded for each item.  |

## When to Run a Review

* Before publishing an app that stores personal, operational, financial, health, education, internal, or customer data.
* After changing roles, datatable permissions, Private Data settings, forms, APIs, Custom MCP exposure, functions, or code widgets.
* Before exposing app data through REST API or MCP tools.
* Before promoting an app into a staging or production environment.

## How to Use the Findings

1. Describe the app's security requirements and intended audience.
2. Run a review to snapshot current permissions and Private Data settings.
3. Read each finding and compare it with the app's real usage.
4. Update fields, datatable access, roles, or deployment controls as needed.
5. Record the builder decision for each recommendation.
6. Rerun after material changes.

## Related Pages

* [Security and Access Control](/the-building-blocks/datatables-fields-and-data/security-and-access-control.md)
* [Private Data](/the-building-blocks/datatables-fields-and-data/private-data.md)
* [Buzzy Custom MCP](/the-building-blocks/mcp/buzzy-custom-mcp.md)
* [Buzzy REST API](/developing-and-extending-buzzy/buzzy-rest-api.md)
* [Compliance & Security](/the-ultimate-guide-for-vibe-coding-an-application-with-ai/best-practices/compliance-security.md)